From 6341e752002f90dc87ed49650cb704eac5f62660 Mon Sep 17 00:00:00 2001
From: Jingchen <a1q123456@users.noreply.github.com>
Date: Wed, 24 Jun 2026 13:15:11 +0100
Subject: [PATCH 001/100] refactor: Refactor TaggedCache.ipp to remove
 const_cast in canonicalize_replace_cache (#5638)

Signed-off-by: JCW <a1q123456@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>
---
 include/xrpl/basics/TaggedCache.h    |  86 +++++++++++++++++++--
 include/xrpl/basics/TaggedCache.ipp  |  87 +++++++++++++++++----
 src/test/basics/TaggedCache_test.cpp | 110 +++++++++++++++++++++++++++
 3 files changed, 264 insertions(+), 19 deletions(-)

diff --git a/include/xrpl/basics/TaggedCache.h b/include/xrpl/basics/TaggedCache.h
index 380b7c687f..ecf6071f8d 100644
--- a/include/xrpl/basics/TaggedCache.h
+++ b/include/xrpl/basics/TaggedCache.h
@@ -9,6 +9,7 @@
 #include <xrpl/beast/insight/Insight.h>
 
 #include <atomic>
+#include <cstddef>
 #include <functional>
 #include <mutex>
 #include <thread>
@@ -17,6 +18,22 @@
 
 namespace xrpl {
 
+namespace detail {
+
+// Replace-policy tags selecting how TaggedCache::canonicalizeImpl resolves a
+// collision when the key already exists (defined in TaggedCache.ipp):
+//   - ReplaceCached: always replace the cached value with `data`. `data` is
+//     never written back and may be const.
+//   - ReplaceClient: keep the cached value and write it back into `data` (the
+//     client's pointer), which must therefore be writable.
+//   - ReplaceDynamically: call the supplied callback to decide per call; `data`
+//     is written back when the cached value is kept, so it must be writable.
+struct ReplaceCached;
+struct ReplaceClient;
+struct ReplaceDynamically;
+
+}  // namespace detail
+
 /** Map/cache combination.
     This class implements a cache and a map. The cache keeps objects alive
     in the map. The map allows multiple code paths that reference objects
@@ -96,6 +113,32 @@ public:
     bool
     del(key_type const& key, bool valid);
 
+private:
+    // Selects the `data` parameter type of canonicalizeImpl from the replace
+    // policy: const for detail::ReplaceCached (never written back), otherwise
+    // writable.
+    template <typename Policy>
+    using CanonicalizeClientPointerType = std::conditional_t<
+        std::is_same_v<detail::ReplaceCached, Policy>,
+        SharedPointerType const&,
+        SharedPointerType&>;
+
+    /** Shared implementation of the canonicalize family.
+
+        `policy` selects how a collision is resolved when `key` already exists:
+        detail::ReplaceCached, detail::ReplaceClient or
+        detail::ReplaceDynamically. For ReplaceDynamically `replaceCallback` is
+        invoked with the existing strong pointer and returns whether to replace
+        the cached value with `data`; for the tag policies it is unused.
+    */
+    template <class Policy, class Callback = std::nullptr_t>
+    bool
+    canonicalizeImpl(
+        key_type const& key,
+        CanonicalizeClientPointerType<Policy> data,
+        Policy policy,
+        Callback&& replaceCallback = nullptr);
+
 public:
     /** Replace aliased objects with originals.
 
@@ -104,19 +147,52 @@ public:
         This routine eliminates the duplicate and performs a replacement
         on the callers shared pointer if needed.
 
+        `replaceCallback` is a callable taking the existing strong pointer and
+        returning whether to replace the cached value with `data` (true) or to
+        keep the cached value and write it back into `data` (false). Because the
+        write-back case mutates `data`, `data` must be writable.
+
         @param key The key corresponding to the object
         @param data A shared pointer to the data corresponding to the object.
-        @param replace Function that decides if cache should be replaced
+        @param replaceCallback A callable (existing strong pointer -> bool).
 
-        @return `true` If the key already existed.
-    */
-    template <class R>
+        @return `true` if an existing live entry was found and used; `false` if a new entry was
+                inserted or an expired tracked entry was re-cached.
+    **/
+    template <class Callback>
     bool
-    canonicalize(key_type const& key, SharedPointerType& data, R&& replaceCallback);
+    canonicalize(key_type const& key, SharedPointerType& data, Callback&& replaceCallback);
 
+    /** Insert/update the canonical entry for `key`, always replacing the
+        cached value with `data`.
+
+        If an entry already exists for `key`, the cached value is unconditionally
+        replaced with `data`; otherwise `data` is inserted. `data` is never
+        written back, so it may be const.
+
+        @param key The key corresponding to the object.
+        @param data A shared pointer to the data corresponding to the object.
+
+        @return `true` if an existing live entry was found and used; `false` if a new entry was
+                inserted or an expired tracked entry was re-cached.
+    **/
     bool
     canonicalizeReplaceCache(key_type const& key, SharedPointerType const& data);
 
+    /** Insert the canonical entry for `key`, keeping any existing cached value.
+
+        If an entry already exists for `key`, the cached value is kept and
+        written back into `data` so the caller ends up with the canonical
+        object; otherwise `data` is inserted. Because `data` may be overwritten
+        it must be writable.
+
+        @param key The key corresponding to the object.
+        @param data A shared pointer to the data corresponding to the object;
+                    updated to the canonical value when one already exists.
+
+        @return `true` if an existing live entry was found and used; `false` if a new entry was
+                inserted or an expired tracked entry was re-cached.
+    **/
     bool
     canonicalizeReplaceClient(key_type const& key, SharedPointerType& data);
 
diff --git a/include/xrpl/basics/TaggedCache.ipp b/include/xrpl/basics/TaggedCache.ipp
index cee02749c6..6973ec4ba0 100644
--- a/include/xrpl/basics/TaggedCache.ipp
+++ b/include/xrpl/basics/TaggedCache.ipp
@@ -5,6 +5,30 @@
 
 namespace xrpl {
 
+namespace detail {
+
+// Replace-policy tags selecting how TaggedCache::canonicalizeImpl resolves a
+// collision when the key already exists:
+//   - ReplaceCached: always replace the cached value with `data`. `data` is
+//     never written back and may be const.
+//   - ReplaceClient: keep the cached value and write it back into `data` (the
+//     client's pointer), which must therefore be writable.
+//   - ReplaceDynamically: call the supplied callback to decide per call; `data`
+//     is written back when the cached value is kept, so it must be writable.
+struct ReplaceCached
+{
+};
+
+struct ReplaceClient
+{
+};
+
+struct ReplaceDynamically
+{
+};
+
+}  // namespace detail
+
 template <
     class Key,
     class T,
@@ -300,13 +324,29 @@ template <
     class Hash,
     class KeyEqual,
     class Mutex>
-template <class R>
+template <class Policy, class Callback>
 inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    canonicalize(key_type const& key, SharedPointerType& data, R&& replaceCallback)
+    canonicalizeImpl(
+        key_type const& key,
+        CanonicalizeClientPointerType<Policy> data,
+        [[maybe_unused]] Policy policy,
+        [[maybe_unused]] Callback&& replaceCallback)
 {
     // Return canonical value, store if needed, refresh in cache
     // Return values: true=we had the data already
+
+    // `Policy` is one of:
+    //   - detail::ReplaceCached: always replace the cached value with `data`;
+    //     `data` is never written back and may be const.
+    //   - detail::ReplaceClient: keep the cached value and write it back into
+    //     `data` (the client's pointer), which must therefore be writable.
+    //   - detail::ReplaceDynamically: call `replaceCallback` to decide at run
+    //     time; `data` must be writable.
+    // For the latter two the write-back below requires a mutable `data`, so
+    // passing a const argument is a compile error.
+    constexpr bool replaceCached = std::is_same_v<Policy, detail::ReplaceCached>;
+
     std::scoped_lock const lock(mutex_);
 
     auto cit = cache_.find(key);
@@ -324,13 +364,14 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     Entry& entry = cit->second;
     entry.touch(clock_.now());
 
-    auto shouldReplace = [&] {
-        if constexpr (std::is_invocable_r_v<bool, R>)
+    auto shouldReplaceCached = [&] {
+        if constexpr (replaceCached)
         {
-            // The reason for this extra complexity is for intrusive
-            // strong/weak combo getting a strong is relatively expensive
-            // and not needed for many cases.
-            return replaceCallback();
+            return true;
+        }
+        else if constexpr (std::is_same_v<Policy, detail::ReplaceClient>)
+        {
+            return false;
         }
         else
         {
@@ -340,11 +381,11 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 
     if (entry.isCached())
     {
-        if (shouldReplace())
+        if (shouldReplaceCached())
         {
             entry.ptr = data;
         }
-        else
+        else if constexpr (!replaceCached)
         {
             data = entry.ptr.getStrong();
         }
@@ -356,11 +397,11 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 
     if (cachedData)
     {
-        if (shouldReplace())
+        if (shouldReplaceCached())
         {
             entry.ptr = data;
         }
-        else
+        else if constexpr (!replaceCached)
         {
             entry.ptr.convertToStrong();
             data = cachedData;
@@ -376,6 +417,24 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     return false;
 }
 
+template <
+    class Key,
+    class T,
+    bool IsKeyCache,
+    class SharedWeakUnionPointer,
+    class SharedPointerType,
+    class Hash,
+    class KeyEqual,
+    class Mutex>
+template <class Callback>
+inline bool
+TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
+    canonicalize(key_type const& key, SharedPointerType& data, Callback&& replaceCallback)
+{
+    return canonicalizeImpl(
+        key, data, detail::ReplaceDynamically{}, std::forward<Callback>(replaceCallback));
+}
+
 template <
     class Key,
     class T,
@@ -389,7 +448,7 @@ inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
     canonicalizeReplaceCache(key_type const& key, SharedPointerType const& data)
 {
-    return canonicalize(key, const_cast<SharedPointerType&>(data), []() { return true; });
+    return canonicalizeImpl(key, data, detail::ReplaceCached{});
 }
 
 template <
@@ -405,7 +464,7 @@ inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
     canonicalizeReplaceClient(key_type const& key, SharedPointerType& data)
 {
-    return canonicalize(key, data, []() { return false; });
+    return canonicalizeImpl(key, data, detail::ReplaceClient{});
 }
 
 template <
diff --git a/src/test/basics/TaggedCache_test.cpp b/src/test/basics/TaggedCache_test.cpp
index 77cd25e543..26564a4de8 100644
--- a/src/test/basics/TaggedCache_test.cpp
+++ b/src/test/basics/TaggedCache_test.cpp
@@ -1,5 +1,7 @@
 #include <test/unit_test/SuiteJournal.h>
 
+#include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/IntrusiveRefCounts.h>
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/basics/TaggedCache.ipp>  // IWYU pragma: keep
 #include <xrpl/basics/chrono.h>
@@ -8,6 +10,7 @@
 #include <xrpl/protocol/Protocol.h>
 
 #include <memory>
+#include <utility>
 
 namespace xrpl {
 
@@ -133,6 +136,113 @@ public:
             BEAST_EXPECT(c.getCacheSize() == 0);
             BEAST_EXPECT(c.getTrackSize() == 0);
         }
+        {
+            BEAST_EXPECT(!c.insert(5, "five"));
+            BEAST_EXPECT(c.getCacheSize() == 1);
+            BEAST_EXPECT(c.size() == 1);
+
+            {
+                auto const p1 = c.fetch(5);
+                BEAST_EXPECT(p1 != nullptr);
+                BEAST_EXPECT(c.getCacheSize() == 1);
+                BEAST_EXPECT(c.size() == 1);
+
+                // Advance the clock a lot
+                ++clock;
+                c.sweep();
+                BEAST_EXPECT(c.getCacheSize() == 0);
+                BEAST_EXPECT(c.size() == 1);
+
+                auto p2 = std::make_shared<std::string>("five_2");
+                BEAST_EXPECT(c.canonicalizeReplaceCache(5, p2));
+                BEAST_EXPECT(c.getCacheSize() == 1);
+                BEAST_EXPECT(c.size() == 1);
+                // Make sure the caller's original pointer is unchanged
+                BEAST_EXPECT(p1.get() != p2.get());
+                BEAST_EXPECT(*p2 == "five_2");
+
+                auto const p3 = c.fetch(5);
+                BEAST_EXPECT(p3 != nullptr);
+                BEAST_EXPECT(p3.get() == p2.get());
+                BEAST_EXPECT(p3.get() != p1.get());
+            }
+
+            ++clock;
+            c.sweep();
+            BEAST_EXPECT(c.getCacheSize() == 0);
+            BEAST_EXPECT(c.size() == 0);
+        }
+
+        {
+            testcase("intrptr");
+
+            struct MyRefCountObject : IntrusiveRefCounts
+            {
+                std::string data;
+
+                // Needed to support weak intrusive pointers
+                virtual void
+                partialDestructor() {};
+
+                MyRefCountObject() = default;
+                explicit MyRefCountObject(std::string data) : data(std::move(data))
+                {
+                }
+
+                bool
+                operator==(std::string const& other) const
+                {
+                    return data == other;
+                }
+            };
+
+            using IntrPtrCache = TaggedCache<
+                Key,
+                MyRefCountObject,
+                /*IsKeyCache*/ false,
+                intr_ptr::SharedWeakUnionPtr<MyRefCountObject>,
+                intr_ptr::SharedPtr<MyRefCountObject>>;
+
+            IntrPtrCache intrPtrCache("IntrPtrTest", 1, 1s, clock, journal);
+
+            intrPtrCache.canonicalizeReplaceCache(1, intr_ptr::makeShared<MyRefCountObject>("one"));
+            BEAST_EXPECT(intrPtrCache.getCacheSize() == 1);
+            BEAST_EXPECT(intrPtrCache.size() == 1);
+
+            {
+                {
+                    intrPtrCache.canonicalizeReplaceCache(
+                        1, intr_ptr::makeShared<MyRefCountObject>("one_replaced"));
+
+                    auto p = intrPtrCache.fetch(1);
+                    BEAST_EXPECT(*p == "one_replaced");
+
+                    // Advance the clock a lot
+                    ++clock;
+                    intrPtrCache.sweep();
+                    BEAST_EXPECT(intrPtrCache.getCacheSize() == 0);
+                    BEAST_EXPECT(intrPtrCache.size() == 1);
+
+                    intrPtrCache.canonicalizeReplaceCache(
+                        1, intr_ptr::makeShared<MyRefCountObject>("one_replaced_2"));
+
+                    auto p2 = intrPtrCache.fetch(1);
+                    BEAST_EXPECT(*p2 == "one_replaced_2");
+
+                    intrPtrCache.del(1, true);
+                }
+
+                intrPtrCache.canonicalizeReplaceCache(
+                    1, intr_ptr::makeShared<MyRefCountObject>("one_replaced_3"));
+                auto p3 = intrPtrCache.fetch(1);
+                BEAST_EXPECT(*p3 == "one_replaced_3");
+            }
+
+            ++clock;
+            intrPtrCache.sweep();
+            BEAST_EXPECT(intrPtrCache.getCacheSize() == 0);
+            BEAST_EXPECT(intrPtrCache.size() == 0);
+        }
     }
 };
 

From 69d289a388f7339470e861cee38b29a877ee26a3 Mon Sep 17 00:00:00 2001
From: Zhiyuan Wang <96991820+Kassaking7@users.noreply.github.com>
Date: Wed, 24 Jun 2026 08:15:45 -0400
Subject: [PATCH 002/100] fix: AMM Quality Leak into Domain BookStep for
 Permissioned DEX (#6853)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 src/libxrpl/tx/paths/BookStep.cpp     |  5 ++
 src/test/app/PermissionedDEX_test.cpp | 79 +++++++++++++++++++++++++++
 2 files changed, 84 insertions(+)

diff --git a/src/libxrpl/tx/paths/BookStep.cpp b/src/libxrpl/tx/paths/BookStep.cpp
index 5cc2a987b8..4b045521d2 100644
--- a/src/libxrpl/tx/paths/BookStep.cpp
+++ b/src/libxrpl/tx/paths/BookStep.cpp
@@ -905,6 +905,11 @@ BookStep<TIn, TOut, TDerived>::getAMMOffer(
     ReadView const& view,
     std::optional<Quality> const& clobQuality) const
 {
+    // AMM doesn't support domain books. When fixCleanup3_3_0 is enabled, exclude
+    // AMM liquidity so quality estimation matches actual crossing (tryAMM skips
+    // AMM for domain books).
+    if (book_.domain && view.rules().enabled(fixCleanup3_3_0))
+        return std::nullopt;
     if (ammLiquidity_)
         return ammLiquidity_->getOffer(view, clobQuality);
     return std::nullopt;
diff --git a/src/test/app/PermissionedDEX_test.cpp b/src/test/app/PermissionedDEX_test.cpp
index 99e69ce482..51ca321f7e 100644
--- a/src/test/app/PermissionedDEX_test.cpp
+++ b/src/test/app/PermissionedDEX_test.cpp
@@ -993,6 +993,83 @@ class PermissionedDEX_test : public beast::unit_test::Suite
         BEAST_EXPECT(usd == USD(45));
     }
 
+    void
+    testAmmQualityNotLeaked(FeatureBitset features)
+    {
+        bool const excludesAmmFromDomainQuality = features[fixCleanup3_3_0];
+
+        testcase << "AMM quality not leaked into domain BookStep"
+                 << (excludesAmmFromDomainQuality ? " (Cleanup3_3_0 enabled)"
+                                                  : " (Cleanup3_3_0 disabled)");
+
+        Env env(*this, features);
+        auto const& [gw, domainOwner, alice, bob, carol, USD, domainID, credType] =
+            PermissionedDEX(env);
+        auto const eur = gw["EUR"];
+
+        env.trust(eur(1000), bob, domainOwner);
+        env.close();
+        env(pay(gw, bob, eur(100)));
+        env.close();
+
+        env(pay(gw, alice, USD(500)));
+        env.close();
+
+        // The AMM makes the direct XRP->USD book look much better than it
+        // really is for domain payments. The domain LOB direct path is 1:1,
+        // while the competing XRP->EUR->USD path is 2:1.
+        AMM const amm(env, alice, XRP(10), USD(500));
+
+        auto const directOfferSeq{env.seq(bob)};
+        env(offer(bob, XRP(10), USD(10)), Domain(domainID));
+        env.close();
+
+        auto const xrpEurOfferSeq{env.seq(bob)};
+        env(offer(bob, XRP(10), eur(20)), Domain(domainID));
+        env.close();
+
+        auto const eurUsdOfferSeq{env.seq(domainOwner)};
+        env(offer(domainOwner, eur(20), USD(20)), Domain(domainID));
+        env.close();
+
+        auto const carolBalBefore = env.balance(carol, USD);
+
+        // Both paths compete for the same XRP(10) sendmax. If AMM quality leaks
+        // into the direct domain book, the engine ranks direct XRP->USD first
+        // but crossing can only consume the 1:1 LOB offer. With the fix, the
+        // direct book is ranked by its domain LOB quality, so the 2:1
+        // XRP->EUR->USD path executes first.
+        env(pay(alice, carol, USD(100)),
+            Path(~USD),
+            Path(~eur, ~USD),
+            Sendmax(XRP(10)),
+            Txflags(tfPartialPayment | tfNoRippleDirect),
+            Domain(domainID));
+        env.close();
+
+        auto const delivered = env.balance(carol, USD) - carolBalBefore;
+        if (excludesAmmFromDomainQuality)
+        {
+            BEAST_EXPECT(delivered == USD(20));
+
+            BEAST_EXPECT(checkOffer(env, bob, directOfferSeq, XRP(10), USD(10), 0, true));
+            BEAST_EXPECT(!offerExists(env, bob, xrpEurOfferSeq));
+            BEAST_EXPECT(!offerExists(env, domainOwner, eurUsdOfferSeq));
+        }
+        else
+        {
+            BEAST_EXPECT(delivered == USD(10));
+
+            BEAST_EXPECT(!offerExists(env, bob, directOfferSeq));
+            BEAST_EXPECT(checkOffer(env, bob, xrpEurOfferSeq, XRP(10), eur(20), 0, true));
+            BEAST_EXPECT(checkOffer(env, domainOwner, eurUsdOfferSeq, eur(20), USD(20), 0, true));
+        }
+
+        auto [xrp, usd, lpt] = amm.balances(XRP, USD);
+        BEAST_EXPECT(xrp == XRP(10));
+        BEAST_EXPECT(usd == USD(500));
+    }
+
     void
     testHybridOfferCreate(FeatureBitset features)
     {
@@ -1943,6 +2020,8 @@ public:
         testOfferTokenIssuerInDomain(all);
         testRemoveUnfundedOffer(all);
         testAmmNotUsed(all);
+        testAmmQualityNotLeaked(all);
+        testAmmQualityNotLeaked(all - fixCleanup3_3_0);
         testAutoBridge(all);
 
         // Test hybrid offers

From bb7c4d1c9fdfd1267ac45198ff305545f9579a72 Mon Sep 17 00:00:00 2001
From: Timothy Banks <timothyaaronbanks@gmail.com>
Date: Wed, 24 Jun 2026 08:23:12 -0400
Subject: [PATCH 003/100] fix: Additional RPC validation checks on ammRpcInfo
 account and amm_account fields. (#7324)

---
 src/test/jtx/AMM.h                           | 14 +++++++--
 src/test/jtx/impl/AMM.cpp                    | 30 +++++++++++++++++---
 src/test/rpc/AMMInfo_test.cpp                | 20 +++++++++++++
 src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp | 10 +++++--
 4 files changed, 66 insertions(+), 8 deletions(-)

diff --git a/src/test/jtx/AMM.h b/src/test/jtx/AMM.h
index deadd80290..99131637bb 100644
--- a/src/test/jtx/AMM.h
+++ b/src/test/jtx/AMM.h
@@ -174,12 +174,22 @@ public:
     ammRpcInfo(
         std::optional<AccountID> const& account = std::nullopt,
         std::optional<std::string> const& ledgerIndex = std::nullopt,
-        std::optional<Asset> asset1 = std::nullopt,
-        std::optional<Asset> asset2 = std::nullopt,
+        std::optional<Asset> const& asset1 = std::nullopt,
+        std::optional<Asset> const& asset2 = std::nullopt,
         std::optional<AccountID> const& ammAccount = std::nullopt,
         bool ignoreParams = false,
         unsigned apiVersion = RPC::kApiInvalidVersion) const;
 
+    [[nodiscard]] json::Value
+    ammRpcInfo(
+        std::optional<json::Value> const& account,
+        std::optional<std::string> const& ledgerIndex,
+        std::optional<Asset> const& asset1,
+        std::optional<Asset> const& asset2,
+        std::optional<json::Value> const& ammAccount,
+        bool ignoreParams,
+        unsigned apiVersion) const;
+
     /** Verify the AMM balances.
      */
     [[nodiscard]] bool
diff --git a/src/test/jtx/impl/AMM.cpp b/src/test/jtx/impl/AMM.cpp
index c6dc14081a..2184f7e1b0 100644
--- a/src/test/jtx/impl/AMM.cpp
+++ b/src/test/jtx/impl/AMM.cpp
@@ -183,15 +183,37 @@ json::Value
 AMM::ammRpcInfo(
     std::optional<AccountID> const& account,
     std::optional<std::string> const& ledgerIndex,
-    std::optional<Asset> asset1,
-    std::optional<Asset> asset2,
+    std::optional<Asset> const& asset1,
+    std::optional<Asset> const& asset2,
     std::optional<AccountID> const& ammAccount,
     bool ignoreParams,
     unsigned apiVersion) const
+{
+    auto const toJson = [](AccountID const& a) { return json::Value{to_string(a)}; };
+
+    return ammRpcInfo(
+        account.transform(toJson),
+        ledgerIndex,
+        asset1,
+        asset2,
+        ammAccount.transform(toJson),
+        ignoreParams,
+        apiVersion);
+}
+
+json::Value
+AMM::ammRpcInfo(
+    std::optional<json::Value> const& account,
+    std::optional<std::string> const& ledgerIndex,
+    std::optional<Asset> const& asset1,
+    std::optional<Asset> const& asset2,
+    std::optional<json::Value> const& ammAccount,
+    bool ignoreParams,
+    unsigned apiVersion) const
 {
     json::Value jv;
     if (account)
-        jv[jss::account] = to_string(*account);
+        jv[jss::account] = *account;
     if (ledgerIndex)
         jv[jss::ledger_index] = *ledgerIndex;
     if (!ignoreParams)
@@ -209,7 +231,7 @@ AMM::ammRpcInfo(
             jv[jss::asset2] = STIssue(sfAsset2, asset2_.asset()).getJson(JsonOptions::Values::None);
         }
         if (ammAccount)
-            jv[jss::amm_account] = to_string(*ammAccount);
+            jv[jss::amm_account] = *ammAccount;
     }
     auto jr =
         (apiVersion == RPC::kApiInvalidVersion
diff --git a/src/test/rpc/AMMInfo_test.cpp b/src/test/rpc/AMMInfo_test.cpp
index 28c536aab9..987df6c724 100644
--- a/src/test/rpc/AMMInfo_test.cpp
+++ b/src/test/rpc/AMMInfo_test.cpp
@@ -65,6 +65,26 @@ public:
             BEAST_EXPECT(jv[jss::error_message] == "Account malformed.");
         });
 
+        // Account is not a string
+        testAMM([&](AMM& ammAlice, Env&) {
+            auto const jv =
+                ammAlice.ammRpcInfo(json::Value{42}, std::nullopt, XRP, USD, std::nullopt, true, 3);
+            BEAST_EXPECT(jv[jss::error_message] == "Account malformed.");
+        });
+
+        // AMM Account is not a string
+        testAMM([&](AMM& ammAlice, Env&) {
+            auto const jv = ammAlice.ammRpcInfo(
+                json::Value{to_string(ammAlice.ammAccount())},
+                std::nullopt,
+                XRP,
+                USD,
+                json::Value{42},
+                false,
+                3);
+            BEAST_EXPECT(jv[jss::error_message] == "Account malformed.");
+        });
+
         std::vector<std::tuple<std::optional<Issue>, std::optional<Issue>, TestAccount, bool>> const
             invalidParams = {
                 {xrpIssue(), std::nullopt, TestAccount::None, false},
diff --git a/src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp b/src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp
index 2c2f96b0e8..043fdd2d7b 100644
--- a/src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp
+++ b/src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp
@@ -120,7 +120,10 @@ doAMMInfo(RPC::JsonContext& context)
 
         if (params.isMember(jss::amm_account))
         {
-            auto const id = parseBase58<AccountID>((params[jss::amm_account].asString()));
+            auto const& ammAccount = params[jss::amm_account];
+            if (!ammAccount.isString())
+                return std::unexpected(RpcActMalformed);
+            auto const id = parseBase58<AccountID>(ammAccount.asString());
             if (!id)
                 return std::unexpected(RpcActMalformed);
             auto const sle = ledger->read(keylet::account(*id));
@@ -133,7 +136,10 @@ doAMMInfo(RPC::JsonContext& context)
 
         if (params.isMember(jss::account))
         {
-            accountID = parseBase58<AccountID>(params[jss::account].asString());
+            auto const& localAccount = params[jss::account];
+            if (!localAccount.isString())
+                return std::unexpected(RpcActMalformed);
+            accountID = parseBase58<AccountID>(localAccount.asString());
             if (!accountID || !ledger->read(keylet::account(*accountID)))
                 return std::unexpected(RpcActMalformed);
         }

From b68e1f7170fd0de7b7b7110677919eb9df1773c2 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 24 Jun 2026 13:24:04 +0100
Subject: [PATCH 004/100] fix: Add pragma once checker (#7580)

---
 .pre-commit-config.yaml                       |  8 ++++-
 bin/pre-commit/fix_pragma_once.py             | 34 +++++++++++++++++++
 .../ledger/helpers/PermissionedDEXHelpers.h   |  1 +
 include/xrpl/protocol/Batch.h                 |  2 ++
 include/xrpl/tx/paths/detail/AmountSpec.h     |  0
 include/xrpl/tx/paths/detail/FlowDebugInfo.h  |  1 -
 include/xrpl/tx/paths/detail/StrandFlow.h     |  1 -
 src/libxrpl/tx/paths/Flow.cpp                 |  1 -
 src/libxrpl/tx/paths/XRPEndpointStep.cpp      |  1 -
 src/libxrpl/tx/transactors/escrow/Escrow.cpp  |  0
 src/test/beast/IPEndpointCommon.h             |  2 ++
 src/test/csf.h                                |  2 ++
 src/test/unit_test/utils.h                    |  2 ++
 src/xrpld/app/ledger/OrderBookDB.h            |  0
 src/xrpld/overlay/detail/Tuning.h             |  1 +
 src/xrpld/rpc/detail/PathRequestManager.h     |  1 -
 src/xrpld/rpc/detail/Pathfinder.cpp           |  1 -
 src/xrpld/rpc/detail/RippleLineCache.cpp      |  0
 src/xrpld/rpc/detail/RippleLineCache.h        |  0
 .../rpc/handlers/ledger/LedgerEntryHelpers.h  |  2 ++
 20 files changed, 53 insertions(+), 7 deletions(-)
 create mode 100755 bin/pre-commit/fix_pragma_once.py
 delete mode 100644 include/xrpl/tx/paths/detail/AmountSpec.h
 delete mode 100644 src/libxrpl/tx/transactors/escrow/Escrow.cpp
 delete mode 100644 src/xrpld/app/ledger/OrderBookDB.h
 delete mode 100644 src/xrpld/rpc/detail/RippleLineCache.cpp
 delete mode 100644 src/xrpld/rpc/detail/RippleLineCache.h

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c9dec89435..4cbf4c1dd0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,6 +15,7 @@ repos:
     hooks:
       - id: check-added-large-files
         args: [--maxkb=400, --enforce-all]
+      - id: check-executables-have-shebangs
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-merge-conflict
@@ -35,13 +36,18 @@ repos:
         language: python
         types_or: [c++, c]
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
+      - id: fix-pragma-once
+        name: fix missing '#pragma once' declarations in header files
+        language: python
+        entry: ./bin/pre-commit/fix_pragma_once.py
+        files: \.(h|hpp)$
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
     rev: dd18dad857d6133e90bbe478f4f2f22ec0030269 # frozen: v22.1.5
     hooks:
       - id: clang-format
         args: [--style=file]
-        "types_or": [c++, c, proto]
+        types_or: [c++, c, proto]
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
diff --git a/bin/pre-commit/fix_pragma_once.py b/bin/pre-commit/fix_pragma_once.py
new file mode 100755
index 0000000000..08a505b6d0
--- /dev/null
+++ b/bin/pre-commit/fix_pragma_once.py
@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+
+"""
+Adds "#pragma once" to the top of header files that don't already have it.
+
+Usage: ./bin/pre-commit/fix_pragma_once.py <file1> <file2> ...
+"""
+
+import sys
+from pathlib import Path
+
+PRAGMA_ONCE = "#pragma once\n\n"
+
+
+def fix_pragma_once(path: Path) -> bool:
+    original = path.read_text(encoding="utf-8")
+    if PRAGMA_ONCE not in original:
+        path.write_text(PRAGMA_ONCE + original, encoding="utf-8")
+        return False
+    return True
+
+
+def main() -> int:
+    files = [Path(f) for f in sys.argv[1:]]
+    success = True
+
+    for path in files:
+        success &= fix_pragma_once(path)
+
+    return 0 if success else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/include/xrpl/ledger/helpers/PermissionedDEXHelpers.h b/include/xrpl/ledger/helpers/PermissionedDEXHelpers.h
index 04b12f2fc5..695a4950f0 100644
--- a/include/xrpl/ledger/helpers/PermissionedDEXHelpers.h
+++ b/include/xrpl/ledger/helpers/PermissionedDEXHelpers.h
@@ -1,4 +1,5 @@
 #pragma once
+
 #include <xrpl/ledger/View.h>
 
 namespace xrpl::permissioned_dex {
diff --git a/include/xrpl/protocol/Batch.h b/include/xrpl/protocol/Batch.h
index fa7641af70..2f2412b3ff 100644
--- a/include/xrpl/protocol/Batch.h
+++ b/include/xrpl/protocol/Batch.h
@@ -1,3 +1,5 @@
+#pragma once
+
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/Serializer.h>
diff --git a/include/xrpl/tx/paths/detail/AmountSpec.h b/include/xrpl/tx/paths/detail/AmountSpec.h
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/include/xrpl/tx/paths/detail/FlowDebugInfo.h b/include/xrpl/tx/paths/detail/FlowDebugInfo.h
index ec7df86e53..1ccfba34ce 100644
--- a/include/xrpl/tx/paths/detail/FlowDebugInfo.h
+++ b/include/xrpl/tx/paths/detail/FlowDebugInfo.h
@@ -3,7 +3,6 @@
 #include <xrpl/ledger/PaymentSandbox.h>
 #include <xrpl/protocol/IOUAmount.h>
 #include <xrpl/protocol/XRPAmount.h>
-#include <xrpl/tx/paths/detail/AmountSpec.h>
 
 #include <boost/container/flat_map.hpp>
 
diff --git a/include/xrpl/tx/paths/detail/StrandFlow.h b/include/xrpl/tx/paths/detail/StrandFlow.h
index 31f0182258..4d988a4c7e 100644
--- a/include/xrpl/tx/paths/detail/StrandFlow.h
+++ b/include/xrpl/tx/paths/detail/StrandFlow.h
@@ -9,7 +9,6 @@
 #include <xrpl/protocol/IOUAmount.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/paths/Flow.h>
-#include <xrpl/tx/paths/detail/AmountSpec.h>
 #include <xrpl/tx/paths/detail/FlatSets.h>
 #include <xrpl/tx/paths/detail/FlowDebugInfo.h>
 #include <xrpl/tx/paths/detail/Steps.h>
diff --git a/src/libxrpl/tx/paths/Flow.cpp b/src/libxrpl/tx/paths/Flow.cpp
index 39a9e83e69..7be1f9f633 100644
--- a/src/libxrpl/tx/paths/Flow.cpp
+++ b/src/libxrpl/tx/paths/Flow.cpp
@@ -10,7 +10,6 @@
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STPathSet.h>
 #include <xrpl/tx/paths/RippleCalc.h>
-#include <xrpl/tx/paths/detail/AmountSpec.h>
 #include <xrpl/tx/paths/detail/Steps.h>
 #include <xrpl/tx/paths/detail/StrandFlow.h>
 #include <xrpl/tx/transactors/dex/AMMContext.h>
diff --git a/src/libxrpl/tx/paths/XRPEndpointStep.cpp b/src/libxrpl/tx/paths/XRPEndpointStep.cpp
index 314780c3a7..efdad92791 100644
--- a/src/libxrpl/tx/paths/XRPEndpointStep.cpp
+++ b/src/libxrpl/tx/paths/XRPEndpointStep.cpp
@@ -16,7 +16,6 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/XRPAmount.h>
-#include <xrpl/tx/paths/detail/AmountSpec.h>
 #include <xrpl/tx/paths/detail/EitherAmount.h>
 #include <xrpl/tx/paths/detail/StepChecks.h>
 #include <xrpl/tx/paths/detail/Steps.h>
diff --git a/src/libxrpl/tx/transactors/escrow/Escrow.cpp b/src/libxrpl/tx/transactors/escrow/Escrow.cpp
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/src/test/beast/IPEndpointCommon.h b/src/test/beast/IPEndpointCommon.h
index 15566cb830..0ff0da35be 100644
--- a/src/test/beast/IPEndpointCommon.h
+++ b/src/test/beast/IPEndpointCommon.h
@@ -1,3 +1,5 @@
+#pragma once
+
 #include <xrpl/basics/random.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 
diff --git a/src/test/csf.h b/src/test/csf.h
index 81af3491c4..d2ddbb460d 100644
--- a/src/test/csf.h
+++ b/src/test/csf.h
@@ -1,3 +1,5 @@
+#pragma once
+
 #include <test/csf/BasicNetwork.h>
 #include <test/csf/Digraph.h>
 #include <test/csf/Histogram.h>
diff --git a/src/test/unit_test/utils.h b/src/test/unit_test/utils.h
index 028823c763..677bbff31b 100644
--- a/src/test/unit_test/utils.h
+++ b/src/test/unit_test/utils.h
@@ -1,3 +1,5 @@
+#pragma once
+
 #include <xrpl/protocol/SecretKey.h>
 
 #include <cstring>
diff --git a/src/xrpld/app/ledger/OrderBookDB.h b/src/xrpld/app/ledger/OrderBookDB.h
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/src/xrpld/overlay/detail/Tuning.h b/src/xrpld/overlay/detail/Tuning.h
index 20a60d470e..8357fcd130 100644
--- a/src/xrpld/overlay/detail/Tuning.h
+++ b/src/xrpld/overlay/detail/Tuning.h
@@ -1,4 +1,5 @@
 #pragma once
+
 #include <xrpl/shamap/SHAMapInnerNode.h>
 
 #include <cstddef>
diff --git a/src/xrpld/rpc/detail/PathRequestManager.h b/src/xrpld/rpc/detail/PathRequestManager.h
index 5a5cfde402..c8e272a97d 100644
--- a/src/xrpld/rpc/detail/PathRequestManager.h
+++ b/src/xrpld/rpc/detail/PathRequestManager.h
@@ -3,7 +3,6 @@
 #include <xrpld/app/main/Application.h>
 #include <xrpld/rpc/detail/AssetCache.h>
 #include <xrpld/rpc/detail/PathRequest.h>
-#include <xrpld/rpc/detail/RippleLineCache.h>
 
 #include <atomic>
 #include <mutex>
diff --git a/src/xrpld/rpc/detail/Pathfinder.cpp b/src/xrpld/rpc/detail/Pathfinder.cpp
index 25da86ef8f..e1a2a4acf6 100644
--- a/src/xrpld/rpc/detail/Pathfinder.cpp
+++ b/src/xrpld/rpc/detail/Pathfinder.cpp
@@ -3,7 +3,6 @@
 #include <xrpld/app/main/Application.h>
 #include <xrpld/rpc/detail/AssetCache.h>
 #include <xrpld/rpc/detail/PathfinderUtils.h>
-#include <xrpld/rpc/detail/RippleLineCache.h>
 #include <xrpld/rpc/detail/TrustLine.h>
 
 #include <xrpl/basics/Log.h>
diff --git a/src/xrpld/rpc/detail/RippleLineCache.cpp b/src/xrpld/rpc/detail/RippleLineCache.cpp
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/src/xrpld/rpc/detail/RippleLineCache.h b/src/xrpld/rpc/detail/RippleLineCache.h
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/src/xrpld/rpc/handlers/ledger/LedgerEntryHelpers.h b/src/xrpld/rpc/handlers/ledger/LedgerEntryHelpers.h
index 463547a90d..11f6553dfa 100644
--- a/src/xrpld/rpc/handlers/ledger/LedgerEntryHelpers.h
+++ b/src/xrpld/rpc/handlers/ledger/LedgerEntryHelpers.h
@@ -1,3 +1,5 @@
+#pragma once
+
 #include <xrpld/rpc/detail/RPCHelpers.h>
 
 #include <xrpl/basics/StringUtilities.h>

From 6736ab39df871bbb49107c0af8a2821fc3afebaf Mon Sep 17 00:00:00 2001
From: Mayukha Vadari <mvadari@ripple.com>
Date: Wed, 24 Jun 2026 08:24:27 -0400
Subject: [PATCH 005/100] test: Add test for Permissioned Domain sequence fix
 (#7591)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 src/test/app/PermissionedDomains_test.cpp | 46 +++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/src/test/app/PermissionedDomains_test.cpp b/src/test/app/PermissionedDomains_test.cpp
index f2d7bce152..2cffc18682 100644
--- a/src/test/app/PermissionedDomains_test.cpp
+++ b/src/test/app/PermissionedDomains_test.cpp
@@ -8,18 +8,21 @@
 #include <test/jtx/pay.h>
 #include <test/jtx/permissioned_domains.h>
 #include <test/jtx/ter.h>
+#include <test/jtx/ticket.h>
 #include <test/jtx/txflags.h>
 
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/jss.h>
 
 #include <cstddef>
+#include <cstdint>
 #include <exception>
 #include <map>
 #include <optional>
@@ -526,6 +529,47 @@ class PermissionedDomains_test : public beast::unit_test::Suite
         BEAST_EXPECT(env.ownerCount(alice) == 1);
     }
 
+    void
+    testTicket(FeatureBitset features)
+    {
+        testcase("Tickets");
+
+        using namespace test::jtx;
+
+        Env env(*this, features);
+        Account const alice("alice");
+        env.fund(XRP(1000), alice);
+
+        pdomain::Credentials const credentials{
+            {.issuer = alice, .credType = "credential1"},
+        };
+
+        std::uint32_t seq{env.seq(alice)};
+        env(ticket::create(alice, 2));
+
+        {
+            env(pdomain::setTx(alice, credentials), ticket::Use(++seq));
+            auto domain = pdomain::getNewDomain(env.meta());
+            if (features[fixCleanup3_1_3])
+            {
+                BEAST_EXPECT(domain == keylet::permissionedDomain(alice.id(), seq).key);
+            }
+            else
+            {
+                BEAST_EXPECT(domain == keylet::permissionedDomain(alice.id(), 0).key);
+            }
+        }
+
+        if (features[fixCleanup3_1_3])
+        {
+            env(pdomain::setTx(alice, credentials), ticket::Use(++seq));
+        }
+        else
+        {
+            env(pdomain::setTx(alice, credentials), ticket::Use(++seq), Ter(tefEXCEPTION));
+        }
+    }
+
 public:
     void
     run() override
@@ -540,6 +584,8 @@ public:
         testDelete(withFix_);
         testAccountReserve(withFeature_);
         testAccountReserve(withFix_);
+        testTicket(withFeature_);
+        testTicket(withFix_);
     }
 };
 

From 8bbbc2051e04edb4d0959deb6c8b322e3e29a63e Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 24 Jun 2026 13:25:03 +0100
Subject: [PATCH 006/100] chore: Check more tools to be available (#7600)

---
 .github/scripts/strategy-matrix/linux.json   | 2 +-
 .github/workflows/on-pr.yml                  | 1 +
 .github/workflows/on-trigger.yml             | 1 +
 .github/workflows/publish-docs.yml           | 2 +-
 .github/workflows/reusable-clang-tidy.yml    | 2 +-
 .github/workflows/reusable-upload-recipe.yml | 2 +-
 bin/check-tools.sh                           | 3 +++
 7 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/strategy-matrix/linux.json b/.github/scripts/strategy-matrix/linux.json
index a9b85b766a..863b910dda 100644
--- a/.github/scripts/strategy-matrix/linux.json
+++ b/.github/scripts/strategy-matrix/linux.json
@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-fe4c8ae",
+  "image_tag": "sha-e29b523",
   "configs": {
     "ubuntu": [
       {
diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 0cc9b375a7..0c9eeda712 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -70,6 +70,7 @@ jobs:
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
+            bin/check-tools.sh
             cfg/**
             cmake/**
             conan/**
diff --git a/.github/workflows/on-trigger.yml b/.github/workflows/on-trigger.yml
index 74bca82019..063cdbff7f 100644
--- a/.github/workflows/on-trigger.yml
+++ b/.github/workflows/on-trigger.yml
@@ -27,6 +27,7 @@ on:
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
+      - "bin/check-tools.sh"
       - "cfg/**"
       - "cmake/**"
       - "conan/**"
diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index cc7b6b6e7e..cb7d4c5382 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -41,7 +41,7 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fe4c8ae
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.github/workflows/reusable-clang-tidy.yml b/.github/workflows/reusable-clang-tidy.yml
index e99ef574bf..f36463a5d0 100644
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -39,7 +39,7 @@ jobs:
     needs: [determine-files]
     if: ${{ always() && !cancelled() && (!inputs.check_only_changed || needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.clang_tidy_config_changed == 'true') }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-fe4c8ae"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-e29b523"
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/reusable-upload-recipe.yml b/.github/workflows/reusable-upload-recipe.yml
index a389e98771..a18f76796a 100644
--- a/.github/workflows/reusable-upload-recipe.yml
+++ b/.github/workflows/reusable-upload-recipe.yml
@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fe4c8ae
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/bin/check-tools.sh b/bin/check-tools.sh
index 15b16b6fc8..808f384d5b 100755
--- a/bin/check-tools.sh
+++ b/bin/check-tools.sh
@@ -90,16 +90,19 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check perl
     check pkg-config
     check vim
+    check zip
 
     # These tools are present in our Linux CI images and in local development
     # setups, but not in the macOS CI environment. So check them everywhere
     # except when running in CI on macOS.
     if [ "${os}" = "linux" ] || [ -z "${CI:-}" ]; then
         check clang-format
+        check dot
         check doxygen
         check gcovr
         check gh
         check git-cliff
+        check git-lfs
         check gpg
         # pre-commit, or its alternative implementation prek
         check pre-commit sh -c 'pre-commit --version || prek --version'

From 4fec58251b8d20fd5356f08ed04ddc80d008c2bf Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 24 Jun 2026 14:56:18 +0100
Subject: [PATCH 007/100] build: Patch nix binaries in CMake (#7539)

Co-authored-by: Bart <bthomee@users.noreply.github.com>
---
 .gersemi/definitions.cmake                    |  3 ++
 .../workflows/reusable-build-test-config.yml  | 15 ------
 CMakeLists.txt                                |  2 +
 cmake/CompilationEnv.cmake                    | 13 +++++
 cmake/PatchNixBinary.cmake                    | 53 +++++++++++++++++++
 cmake/XrplCompiler.cmake                      |  9 ++++
 cmake/XrplCore.cmake                          |  1 +
 cmake/XrplSanitizers.cmake                    |  4 +-
 src/tests/libxrpl/CMakeLists.txt              |  1 +
 9 files changed, 83 insertions(+), 18 deletions(-)
 create mode 100644 cmake/PatchNixBinary.cmake

diff --git a/.gersemi/definitions.cmake b/.gersemi/definitions.cmake
index 245f827f90..58bc74c70a 100644
--- a/.gersemi/definitions.cmake
+++ b/.gersemi/definitions.cmake
@@ -96,3 +96,6 @@ function(verbose_find_path variable name)
         ${ARGN}
     )
 endfunction()
+
+function(patch_nix_binary target)
+endfunction()
diff --git a/.github/workflows/reusable-build-test-config.yml b/.github/workflows/reusable-build-test-config.yml
index fe441dba6e..a81d9aec67 100644
--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -229,21 +229,6 @@ jobs:
               --parallel "${BUILD_NPROC}" \
               --target "${CMAKE_TARGET}"
 
-      # This step is needed to allow running in non-Nix environments
-      - name: Patch binary to use default loader and remove rpath (Linux)
-        if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
-        run: |
-          loader="$(/tmp/loader-path.sh)"
-          patchelf --set-interpreter "${loader}" --remove-rpath "${{ env.BUILD_DIR }}/xrpld"
-
-      # We're only running aarch64 Linux builds in Ubuntu-based images, so this is kept simple
-      - name: Install libatomic (Linux aarch64)
-        if: ${{ runner.os == 'Linux' && runner.arch == 'ARM64' }}
-        run: |
-          apt update --yes
-          apt install -y --no-install-recommends \
-              libatomic1
-
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}
         run: |
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3dbe60a220..bdc62442b3 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -57,6 +57,8 @@ if(target)
     )
 endif()
 
+include(PatchNixBinary)
+
 include(XrplSanity)
 include(XrplVersion)
 include(XrplSettings)
diff --git a/cmake/CompilationEnv.cmake b/cmake/CompilationEnv.cmake
index 0d44f90974..8e69a4dfdd 100644
--- a/cmake/CompilationEnv.cmake
+++ b/cmake/CompilationEnv.cmake
@@ -56,3 +56,16 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|arm64|ARM64")
 else()
     message(FATAL_ERROR "Unknown architecture: ${CMAKE_SYSTEM_PROCESSOR}")
 endif()
+
+# --------------------------------------------------------------------
+# Sanitizers
+# --------------------------------------------------------------------
+# SANITIZERS is injected by the Conan toolchain when a sanitizer build is
+# requested (see conan/profiles/sanitizers). The flags are applied to the
+# 'common' target in XrplSanitizers; this flag lets other modules know a
+# sanitizer build is active without depending on that module.
+if(DEFINED SANITIZERS)
+    set(SANITIZERS_ENABLED TRUE)
+else()
+    set(SANITIZERS_ENABLED FALSE)
+endif()
diff --git a/cmake/PatchNixBinary.cmake b/cmake/PatchNixBinary.cmake
new file mode 100644
index 0000000000..79ca0b150c
--- /dev/null
+++ b/cmake/PatchNixBinary.cmake
@@ -0,0 +1,53 @@
+#[===================================================================[
+   Patch executables to run in non-Nix environments.
+
+   The Nix-based CI image links binaries against an ELF interpreter (loader)
+   that lives in the Nix store, so the resulting binaries don't run elsewhere
+   (including once installed from the .deb package). `patch_nix_binary` adds a
+   POST_BUILD step that resets the interpreter to the system default loader and
+   drops the rpath.
+
+   This is only active inside the Nix-based image, detected by the presence of
+   /tmp/loader-path.sh (shipped by that image, resolves the default loader). It
+   is skipped for sanitizer builds, whose runtime libraries are resolved through
+   the rpath. Everywhere else `patch_nix_binary` is a no-op.
+#]===================================================================]
+
+include_guard(GLOBAL)
+
+include(CompilationEnv)
+
+# Provided by the Nix-based CI image; prints the system default ELF loader path.
+set(_loader_path_script "/tmp/loader-path.sh")
+
+if(is_linux AND NOT SANITIZERS_ENABLED AND EXISTS "${_loader_path_script}")
+    execute_process(
+        COMMAND "${_loader_path_script}"
+        OUTPUT_VARIABLE DEFAULT_LOADER_PATH
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        COMMAND_ERROR_IS_FATAL ANY
+    )
+    find_program(PATCHELF_COMMAND patchelf REQUIRED)
+    set(PATCH_NIX_BINARIES TRUE)
+    message(
+        STATUS
+        "Binaries will be patched to use loader '${DEFAULT_LOADER_PATH}'"
+    )
+else()
+    set(PATCH_NIX_BINARIES FALSE)
+endif()
+
+function(patch_nix_binary target)
+    if(NOT PATCH_NIX_BINARIES)
+        return()
+    endif()
+    add_custom_command(
+        TARGET ${target}
+        POST_BUILD
+        COMMAND
+            "${PATCHELF_COMMAND}" --set-interpreter "${DEFAULT_LOADER_PATH}"
+            --remove-rpath "$<TARGET_FILE:${target}>"
+        COMMENT "Patching ${target}: set default loader, remove rpath"
+        VERBATIM
+    )
+endfunction()
diff --git a/cmake/XrplCompiler.cmake b/cmake/XrplCompiler.cmake
index 9af8e962d0..cb4e797137 100644
--- a/cmake/XrplCompiler.cmake
+++ b/cmake/XrplCompiler.cmake
@@ -154,6 +154,15 @@ else()
             >
     )
 
+    # On aarch64, libatomic is required for atomic operations. It is not needed on x86_64.
+    # Linking it statically on Linux
+    if(is_arm64 AND is_linux)
+        target_link_options(
+            common
+            INTERFACE -Wl,--push-state -Wl,-Bstatic -latomic -Wl,--pop-state
+        )
+    endif()
+
     # Keep -stdlib=libstdc++ off the compile commands, but preserve it for linking.
     #
     # Conan turns `compiler.libcxx=libstdc++` into `-stdlib=libstdc++` and puts it in
diff --git a/cmake/XrplCore.cmake b/cmake/XrplCore.cmake
index 52d7714a99..4d4a800d9a 100644
--- a/cmake/XrplCore.cmake
+++ b/cmake/XrplCore.cmake
@@ -247,6 +247,7 @@ target_link_modules(
 
 if(xrpld)
     add_executable(xrpld)
+    patch_nix_binary(xrpld)
     if(tests)
         target_compile_definitions(xrpld PUBLIC ENABLE_TESTS)
         target_compile_definitions(
diff --git a/cmake/XrplSanitizers.cmake b/cmake/XrplSanitizers.cmake
index 64f1841bfb..893c880374 100644
--- a/cmake/XrplSanitizers.cmake
+++ b/cmake/XrplSanitizers.cmake
@@ -14,11 +14,9 @@
 include_guard(GLOBAL)
 include(CompilationEnv)
 
-if(NOT DEFINED SANITIZERS)
-    set(SANITIZERS_ENABLED FALSE)
+if(NOT SANITIZERS_ENABLED)
     return()
 endif()
-set(SANITIZERS_ENABLED TRUE)
 
 message(STATUS "=== Configuring Sanitizers ===")
 message(STATUS "  SANITIZERS: ${SANITIZERS}")
diff --git a/src/tests/libxrpl/CMakeLists.txt b/src/tests/libxrpl/CMakeLists.txt
index 2dae6fccb9..bd56028728 100644
--- a/src/tests/libxrpl/CMakeLists.txt
+++ b/src/tests/libxrpl/CMakeLists.txt
@@ -13,6 +13,7 @@ add_executable(
     helpers/TestSink.cpp
     helpers/TxTest.cpp
 )
+patch_nix_binary(xrpl_tests)
 set_target_properties(
     xrpl_tests
     PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"

From eef8f4a4ff29a76acdc261ab2a309b55ae3cb18e Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 24 Jun 2026 18:23:29 +0100
Subject: [PATCH 008/100] chore: Use clang-tidy v22 new features (#7427)

---
 .clang-tidy                                   |  8 ++-
 .../scripts/levelization/results/ordering.txt |  1 -
 include/xrpl/basics/DecayingSample.h          |  6 +-
 include/xrpl/basics/Log.h                     |  3 +-
 include/xrpl/basics/TaggedCache.h             |  4 +-
 include/xrpl/basics/TaggedCache.ipp           |  4 +-
 include/xrpl/basics/hardened_hash.h           |  2 +-
 .../xrpl/basics/partitioned_unordered_map.h   |  8 +--
 include/xrpl/basics/random.h                  |  1 +
 include/xrpl/beast/asio/io_latency_probe.h    |  4 +-
 include/xrpl/beast/clock/abstract_clock.h     |  8 +--
 .../xrpl/beast/clock/basic_seconds_clock.h    |  8 +--
 .../detail/aged_container_iterator.h          |  6 +-
 .../container/detail/aged_ordered_container.h | 29 ++++----
 .../detail/aged_unordered_container.h         | 32 ++++-----
 include/xrpl/beast/core/List.h                |  6 +-
 include/xrpl/beast/core/LockFreeStack.h       |  6 +-
 include/xrpl/beast/hash/uhash.h               |  2 +-
 include/xrpl/beast/rfc2616.h                  |  2 +-
 .../beast/unit_test/detail/const_container.h  | 10 +--
 include/xrpl/beast/unit_test/reporter.h       | 14 ++--
 include/xrpl/beast/utility/Journal.h          |  6 +-
 include/xrpl/beast/utility/maybe_const.h      |  2 +-
 include/xrpl/beast/utility/rngfill.h          |  4 +-
 include/xrpl/json/json_value.h                |  7 +-
 include/xrpl/protocol/KnownFormats.h          |  4 +-
 include/xrpl/protocol/STBitString.h           |  2 +-
 include/xrpl/protocol/STInteger.h             |  2 +-
 include/xrpl/protocol/STObject.h              | 25 +++----
 include/xrpl/protocol/TER.h                   |  4 +-
 include/xrpl/protocol/Units.h                 |  2 +-
 include/xrpl/protocol/XChainAttestations.h    | 10 +--
 include/xrpl/protocol/digest.h                |  4 +-
 include/xrpl/shamap/FullBelowCache.h          |  2 +-
 src/libxrpl/json/json_valueiterator.cpp       |  2 +-
 src/libxrpl/protocol/XChainAttestations.cpp   |  8 +--
 src/libxrpl/protocol/tokens.cpp               |  8 +--
 src/libxrpl/shamap/SHAMapInnerNode.cpp        |  2 +-
 src/libxrpl/tx/invariants/InvariantCheck.cpp  |  2 +
 src/libxrpl/tx/paths/BookStep.cpp             |  4 +-
 src/libxrpl/tx/paths/Flow.cpp                 |  4 +-
 .../tx/transactors/system/TicketCreate.cpp    |  2 +-
 src/test/app/LedgerReplay_test.cpp            |  4 +-
 src/test/app/Loan_test.cpp                    |  4 +-
 src/test/app/NFTokenDir_test.cpp              | 10 +--
 src/test/app/OfferMPT_test.cpp                |  4 +-
 src/test/app/Offer_test.cpp                   |  8 +--
 src/test/app/TxQ_test.cpp                     |  2 +-
 .../beast/aged_associative_container_test.cpp | 68 +++++++++----------
 .../beast/beast_io_latency_probe_test.cpp     |  4 +-
 .../consensus/ByzantineFailureSim_test.cpp    |  1 -
 src/test/consensus/Consensus_test.cpp         |  1 -
 .../DistributedValidatorsSim_test.cpp         |  1 -
 src/test/consensus/ScaleFreeSim_test.cpp      |  1 -
 src/test/csf/BasicNetwork.h                   |  4 +-
 src/test/csf/Digraph.h                        |  6 +-
 src/test/csf/Scheduler.h                      | 18 ++---
 src/test/csf/SimTime.h                        |  4 +-
 src/test/csf/random.h                         |  4 +-
 src/test/jtx/TestHelpers.h                    |  7 +-
 src/test/nodestore/Timing_test.cpp            |  2 +-
 src/test/server/Server_test.cpp               |  2 +-
 src/test/unit_test/multi_runner.cpp           |  4 +-
 src/test/unit_test/multi_runner.h             |  6 +-
 src/xrpld/app/consensus/RCLConsensus.cpp      |  4 ++
 src/xrpld/app/consensus/RCLValidations.cpp    |  2 +
 src/xrpld/app/ledger/LedgerHistory.cpp        |  4 ++
 src/xrpld/app/ledger/detail/BuildLedger.cpp   |  2 +
 src/xrpld/app/ledger/detail/LedgerCleaner.cpp |  2 +
 src/xrpld/app/ledger/detail/LedgerMaster.cpp  |  6 ++
 src/xrpld/app/main/Application.cpp            |  2 +
 src/xrpld/app/misc/NetworkOPs.cpp             |  2 +
 src/xrpld/app/misc/detail/Transaction.cpp     |  2 +-
 src/xrpld/app/misc/detail/ValidatorSite.cpp   |  2 +
 src/xrpld/app/rdb/backend/detail/Node.cpp     | 10 +--
 src/xrpld/consensus/Consensus.h               | 30 ++++----
 src/xrpld/consensus/ConsensusTypes.h          |  8 +--
 src/xrpld/consensus/DisputedTx.h              |  2 +-
 src/xrpld/consensus/LedgerTrie.h              | 12 ++--
 src/xrpld/consensus/Validations.h             | 14 ++--
 src/xrpld/overlay/Slot.h                      | 21 +++---
 src/xrpld/overlay/Squelch.h                   |  2 +-
 src/xrpld/overlay/detail/PeerImp.h            |  2 +-
 src/xrpld/overlay/detail/ZeroCopyStream.h     |  6 +-
 src/xrpld/peerfinder/detail/Checker.h         |  8 +--
 src/xrpld/peerfinder/detail/Livecache.h       | 23 +++----
 src/xrpld/peerfinder/detail/Logic.h           |  2 +-
 src/xrpld/rpc/detail/RPCCall.cpp              |  2 +-
 .../handlers/admin/keygen/WalletPropose.cpp   |  2 +-
 src/xrpld/rpc/json_body.h                     |  2 +-
 90 files changed, 315 insertions(+), 294 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index e8e2ca7ac9..35427810a3 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -11,6 +11,7 @@ Checks: "-*,
   bugprone-copy-constructor-init,
   bugprone-crtp-constructor-accessibility,
   bugprone-dangling-handle,
+  bugprone-derived-method-shadowing-base-method,
   bugprone-dynamic-static-initializers,
   bugprone-empty-catch,
   bugprone-fold-init-type,
@@ -21,6 +22,7 @@ Checks: "-*,
   bugprone-incorrect-roundings,
   bugprone-infinite-loop,
   bugprone-integer-division,
+  bugprone-invalid-enum-default-initialization,
   bugprone-lambda-function-name,
   bugprone-macro-parentheses,
   bugprone-macro-repeated-side-effects,
@@ -137,6 +139,7 @@ Checks: "-*,
   readability-enum-initial-value,
   readability-identifier-naming,
   readability-implicit-bool-conversion,
+  readability-inconsistent-ifelse-braces,
   readability-make-member-function-const,
   readability-math-missing-parentheses,
   readability-misleading-indentation,
@@ -145,7 +148,9 @@ Checks: "-*,
   readability-redundant-declaration,
   readability-redundant-inline-specifier,
   readability-redundant-member-init,
+  readability-redundant-parentheses,
   readability-redundant-string-init,
+  readability-redundant-typename,
   readability-reference-to-constructed-temporary,
   readability-simplify-boolean-expr,
   readability-static-definition-in-anonymous-namespace,
@@ -153,7 +158,8 @@ Checks: "-*,
   readability-use-std-min-max
   "
 # ---
-# bugprone-narrowing-conversions,                      # this will break a lot of code but we should enable it in the future because it can eliminate a lot of bugs
+# bugprone-narrowing-conversions,                      # This will break a lot of code but we should enable it in the future because it can eliminate a lot of bugs
+# misc-override-with-different-visibility,             # Will be addressed in a future PR, but for now it generates too many warnings
 # readability-inconsistent-declaration-parameter-name, # In this codebase this check will break a lot of arg names
 # readability-static-accessed-through-instance,        # this check is probably unnecessary. It makes the code less readable
 # ---
diff --git a/.github/scripts/levelization/results/ordering.txt b/.github/scripts/levelization/results/ordering.txt
index 547c1b3539..7b31042158 100644
--- a/.github/scripts/levelization/results/ordering.txt
+++ b/.github/scripts/levelization/results/ordering.txt
@@ -83,7 +83,6 @@ test.conditions > xrpl.basics
 test.conditions > xrpl.conditions
 test.consensus > test.csf
 test.consensus > test.jtx
-test.consensus > test.toplevel
 test.consensus > test.unit_test
 test.consensus > xrpl.basics
 test.consensus > xrpld.app
diff --git a/include/xrpl/basics/DecayingSample.h b/include/xrpl/basics/DecayingSample.h
index d1861ebc4a..910c8f9e14 100644
--- a/include/xrpl/basics/DecayingSample.h
+++ b/include/xrpl/basics/DecayingSample.h
@@ -12,8 +12,8 @@ template <int Window, typename Clock>
 class DecayingSample
 {
 public:
-    using value_type = typename Clock::duration::rep;
-    using time_point = typename Clock::time_point;
+    using value_type = Clock::duration::rep;
+    using time_point = Clock::time_point;
 
     DecayingSample() = delete;
 
@@ -93,7 +93,7 @@ template <int HalfLife, class Clock>
 class DecayWindow
 {
 public:
-    using time_point = typename Clock::time_point;
+    using time_point = Clock::time_point;
 
     explicit DecayWindow(time_point now) : when_(now)
     {
diff --git a/include/xrpl/basics/Log.h b/include/xrpl/basics/Log.h
index 6bafbc7c54..0699cdd3d9 100644
--- a/include/xrpl/basics/Log.h
+++ b/include/xrpl/basics/Log.h
@@ -206,8 +206,7 @@ private:
 #ifndef JLOG
 #define JLOG(x) \
     if (!(x))   \
-    {           \
-    }           \
+        ;       \
     else        \
         x
 #endif
diff --git a/include/xrpl/basics/TaggedCache.h b/include/xrpl/basics/TaggedCache.h
index ecf6071f8d..973fcd828a 100644
--- a/include/xrpl/basics/TaggedCache.h
+++ b/include/xrpl/basics/TaggedCache.h
@@ -338,7 +338,7 @@ private:
     sweepHelper(
         clock_type::time_point const& whenExpire,
         [[maybe_unused]] clock_type::time_point const& now,
-        typename KeyValueCacheType::map_type& partition,
+        KeyValueCacheType::map_type& partition,
         SweptPointersVector& stuffToSweep,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&);
@@ -347,7 +347,7 @@ private:
     sweepHelper(
         clock_type::time_point const& whenExpire,
         clock_type::time_point const& now,
-        typename KeyOnlyCacheType::map_type& partition,
+        KeyOnlyCacheType::map_type& partition,
         SweptPointersVector&,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&);
diff --git a/include/xrpl/basics/TaggedCache.ipp b/include/xrpl/basics/TaggedCache.ipp
index 6973ec4ba0..7e812ce4c7 100644
--- a/include/xrpl/basics/TaggedCache.ipp
+++ b/include/xrpl/basics/TaggedCache.ipp
@@ -735,7 +735,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     sweepHelper(
         clock_type::time_point const& whenExpire,
         [[maybe_unused]] clock_type::time_point const& now,
-        typename KeyValueCacheType::map_type& partition,
+        KeyValueCacheType::map_type& partition,
         SweptPointersVector& stuffToSweep,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
@@ -815,7 +815,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     sweepHelper(
         clock_type::time_point const& whenExpire,
         clock_type::time_point const& now,
-        typename KeyOnlyCacheType::map_type& partition,
+        KeyOnlyCacheType::map_type& partition,
         SweptPointersVector&,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
diff --git a/include/xrpl/basics/hardened_hash.h b/include/xrpl/basics/hardened_hash.h
index efc77e058b..b8ea1e0f3f 100644
--- a/include/xrpl/basics/hardened_hash.h
+++ b/include/xrpl/basics/hardened_hash.h
@@ -75,7 +75,7 @@ private:
     detail::seed_pair seeds_{detail::makeSeedPair<>()};
 
 public:
-    using result_type = typename HashAlgorithm::result_type;
+    using result_type = HashAlgorithm::result_type;
 
     HardenedHash() = default;
 
diff --git a/include/xrpl/basics/partitioned_unordered_map.h b/include/xrpl/basics/partitioned_unordered_map.h
index 3bf64985e5..c51cedf2dd 100644
--- a/include/xrpl/basics/partitioned_unordered_map.h
+++ b/include/xrpl/basics/partitioned_unordered_map.h
@@ -57,8 +57,8 @@ public:
     {
         using iterator_category = std::forward_iterator_tag;
         partition_map_type* map{nullptr};
-        typename partition_map_type::iterator ait{};
-        typename map_type::iterator mit;
+        partition_map_type::iterator ait{};
+        map_type::iterator mit;
 
         Iterator() = default;
 
@@ -126,8 +126,8 @@ public:
         using iterator_category = std::forward_iterator_tag;
 
         partition_map_type* map{nullptr};
-        typename partition_map_type::iterator ait{};
-        typename map_type::iterator mit;
+        partition_map_type::iterator ait{};
+        map_type::iterator mit;
 
         ConstIterator() = default;
 
diff --git a/include/xrpl/basics/random.h b/include/xrpl/basics/random.h
index 17f4a1c213..0b298e12d9 100644
--- a/include/xrpl/basics/random.h
+++ b/include/xrpl/basics/random.h
@@ -29,6 +29,7 @@ static_assert(
 namespace detail {
 
 // Determines if a type can be called like an Engine
+// NOLINTNEXTLINE(readability-redundant-typename): typename required by MSVC
 template <class Engine, class Result = typename Engine::result_type>
 using is_engine = std::is_invocable_r<Result, Engine>;
 }  // namespace detail
diff --git a/include/xrpl/beast/asio/io_latency_probe.h b/include/xrpl/beast/asio/io_latency_probe.h
index ce3929a394..5e1b098dcb 100644
--- a/include/xrpl/beast/asio/io_latency_probe.h
+++ b/include/xrpl/beast/asio/io_latency_probe.h
@@ -18,8 +18,8 @@ template <class Clock>
 class IOLatencyProbe
 {
 private:
-    using duration = typename Clock::duration;
-    using time_point = typename Clock::time_point;
+    using duration = Clock::duration;
+    using time_point = Clock::time_point;
 
     std::recursive_mutex mutex_;
     std::condition_variable_any cond_;
diff --git a/include/xrpl/beast/clock/abstract_clock.h b/include/xrpl/beast/clock/abstract_clock.h
index 33d4096d0e..15d785d138 100644
--- a/include/xrpl/beast/clock/abstract_clock.h
+++ b/include/xrpl/beast/clock/abstract_clock.h
@@ -34,10 +34,10 @@ template <class Clock>
 class AbstractClock
 {
 public:
-    using rep = typename Clock::rep;
-    using period = typename Clock::period;
-    using duration = typename Clock::duration;
-    using time_point = typename Clock::time_point;
+    using rep = Clock::rep;
+    using period = Clock::period;
+    using duration = Clock::duration;
+    using time_point = Clock::time_point;
     using clock_type = Clock;
 
     static bool const is_steady = Clock::is_steady;  // NOLINT(readability-identifier-naming)
diff --git a/include/xrpl/beast/clock/basic_seconds_clock.h b/include/xrpl/beast/clock/basic_seconds_clock.h
index 8460dbe26b..5a267e9458 100644
--- a/include/xrpl/beast/clock/basic_seconds_clock.h
+++ b/include/xrpl/beast/clock/basic_seconds_clock.h
@@ -20,10 +20,10 @@ public:
 
     explicit BasicSecondsClock() = default;
 
-    using rep = typename Clock::rep;
-    using period = typename Clock::period;
-    using duration = typename Clock::duration;
-    using time_point = typename Clock::time_point;
+    using rep = Clock::rep;
+    using period = Clock::period;
+    using duration = Clock::duration;
+    using time_point = Clock::time_point;
 
     static bool const is_steady =  // NOLINT(readability-identifier-naming)
         Clock::is_steady;
diff --git a/include/xrpl/beast/container/detail/aged_container_iterator.h b/include/xrpl/beast/container/detail/aged_container_iterator.h
index 8d44646cd4..02fb3927dd 100644
--- a/include/xrpl/beast/container/detail/aged_container_iterator.h
+++ b/include/xrpl/beast/container/detail/aged_container_iterator.h
@@ -16,15 +16,15 @@ template <bool IsConst, class Iterator>
 class AgedContainerIterator
 {
 public:
-    using iterator_category = typename std::iterator_traits<Iterator>::iterator_category;
+    using iterator_category = std::iterator_traits<Iterator>::iterator_category;
     using value_type = std::conditional_t<
         IsConst,
         typename Iterator::value_type::Stashed::value_type const,
         typename Iterator::value_type::Stashed::value_type>;
-    using difference_type = typename std::iterator_traits<Iterator>::difference_type;
+    using difference_type = std::iterator_traits<Iterator>::difference_type;
     using pointer = value_type*;
     using reference = value_type&;
-    using time_point = typename Iterator::value_type::Stashed::time_point;
+    using time_point = Iterator::value_type::Stashed::time_point;
 
     AgedContainerIterator() = default;
 
diff --git a/include/xrpl/beast/container/detail/aged_ordered_container.h b/include/xrpl/beast/container/detail/aged_ordered_container.h
index ad368f2754..4cb2246a22 100644
--- a/include/xrpl/beast/container/detail/aged_ordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_ordered_container.h
@@ -62,8 +62,8 @@ class AgedOrderedContainer
 {
 public:
     using clock_type = AbstractClock<Clock>;
-    using time_point = typename clock_type::time_point;
-    using duration = typename clock_type::duration;
+    using time_point = clock_type::time_point;
+    using duration = clock_type::duration;
     using key_type = Key;
     using mapped_type = T;
     using value_type = std::conditional_t<IsMap, std::pair<Key const, T>, Key>;
@@ -94,8 +94,8 @@ private:
         {
             explicit Stashed() = default;
 
-            using value_type = typename AgedOrderedContainer::value_type;
-            using time_point = typename AgedOrderedContainer::time_point;
+            using value_type = AgedOrderedContainer::value_type;
+            using time_point = AgedOrderedContainer::time_point;
         };
 
         Element(time_point const& when, value_type const& value) : value(value), when(when)
@@ -192,8 +192,8 @@ private:
         }
     };
 
-    using list_type = typename boost::intrusive::
-        make_list<Element, boost::intrusive::constant_time_size<false>>::type;
+    using list_type =
+        boost::intrusive::make_list<Element, boost::intrusive::constant_time_size<false>>::type;
 
     using cont_type = std::conditional_t<
         IsMulti,
@@ -206,8 +206,7 @@ private:
             boost::intrusive::constant_time_size<true>,
             boost::intrusive::compare<KeyValueCompare>>::type>;
 
-    using ElementAllocator =
-        typename std::allocator_traits<Allocator>::template rebind_alloc<Element>;
+    using ElementAllocator = std::allocator_traits<Allocator>::template rebind_alloc<Element>;
 
     using ElementAllocatorTraits = std::allocator_traits<ElementAllocator>;
 
@@ -373,8 +372,8 @@ public:
     using allocator_type = Allocator;
     using reference = value_type&;
     using const_reference = value_type const&;
-    using pointer = typename std::allocator_traits<Allocator>::pointer;
-    using const_pointer = typename std::allocator_traits<Allocator>::const_pointer;
+    using pointer = std::allocator_traits<Allocator>::pointer;
+    using const_pointer = std::allocator_traits<Allocator>::const_pointer;
 
     // A set iterator (IsMap==false) is always const
     // because the elements of a set are immutable.
@@ -617,7 +616,7 @@ public:
         bool MaybeMulti = IsMulti,
         bool MaybeMap = IsMap,
         class = std::enable_if_t<MaybeMap && !MaybeMulti>>
-    typename std::conditional<IsMap, T, void*>::type const&
+    std::conditional<IsMap, T, void*>::type const&
     at(K const& k) const;
 
     template <
@@ -1146,7 +1145,7 @@ private:
     void
     touch(
         beast::detail::AgedContainerIterator<IsConst, Iterator> pos,
-        typename clock_type::time_point const& now);
+        clock_type::time_point const& now);
 
     template <
         bool MaybePropagate = std::allocator_traits<Allocator>::propagate_on_container_swap::value>
@@ -1393,7 +1392,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::at(K co
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
 template <class K, bool MaybeMulti, bool MaybeMap, class>
-typename std::conditional<IsMap, T, void*>::type const&
+std::conditional<IsMap, T, void*>::type const&
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::at(K const& k) const
 {
     auto const iter(cont_.find(k, std::cref(config_.keyCompare())));
@@ -1732,7 +1731,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::operato
         cend(),
         other.cbegin(),
         other.cend(),
-        [&eq, &other](value_type const& lhs, typename Other::value_type const& rhs) {
+        [&eq, &other](value_type const& lhs, Other::value_type const& rhs) {
             return eq(extract(lhs), other.extract(rhs));
         });
 }
@@ -1744,7 +1743,7 @@ template <bool IsConst, class Iterator, class>
 void
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::touch(
     beast::detail::AgedContainerIterator<IsConst, Iterator> pos,
-    typename clock_type::time_point const& now)
+    clock_type::time_point const& now)
 {
     auto& e(*pos.iterator());
     e.when = now;
diff --git a/include/xrpl/beast/container/detail/aged_unordered_container.h b/include/xrpl/beast/container/detail/aged_unordered_container.h
index 7162c237d6..3bad12d9e5 100644
--- a/include/xrpl/beast/container/detail/aged_unordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_unordered_container.h
@@ -67,8 +67,8 @@ class AgedUnorderedContainer
 {
 public:
     using clock_type = AbstractClock<Clock>;
-    using time_point = typename clock_type::time_point;
-    using duration = typename clock_type::duration;
+    using time_point = clock_type::time_point;
+    using duration = clock_type::duration;
     using key_type = Key;
     using mapped_type = T;
     using value_type = std::conditional_t<IsMap, std::pair<Key const, T>, Key>;
@@ -99,8 +99,8 @@ private:
         {
             explicit Stashed() = default;
 
-            using value_type = typename AgedUnorderedContainer::value_type;
-            using time_point = typename AgedUnorderedContainer::time_point;
+            using value_type = AgedUnorderedContainer::value_type;
+            using time_point = AgedUnorderedContainer::time_point;
         };
 
         Element(time_point const& when, value_type const& value) : value(value), when(when)
@@ -201,8 +201,8 @@ private:
         }
     };
 
-    using list_type = typename boost::intrusive::
-        make_list<Element, boost::intrusive::constant_time_size<false>>::type;
+    using list_type =
+        boost::intrusive::make_list<Element, boost::intrusive::constant_time_size<false>>::type;
 
     using cont_type = std::conditional_t<
         IsMulti,
@@ -219,16 +219,14 @@ private:
             boost::intrusive::equal<KeyValueEqual>,
             boost::intrusive::cache_begin<true>>::type>;
 
-    using bucket_type = typename cont_type::bucket_type;
-    using bucket_traits = typename cont_type::bucket_traits;
+    using bucket_type = cont_type::bucket_type;
+    using bucket_traits = cont_type::bucket_traits;
 
-    using ElementAllocator =
-        typename std::allocator_traits<Allocator>::template rebind_alloc<Element>;
+    using ElementAllocator = std::allocator_traits<Allocator>::template rebind_alloc<Element>;
 
     using ElementAllocatorTraits = std::allocator_traits<ElementAllocator>;
 
-    using BucketAllocator =
-        typename std::allocator_traits<Allocator>::template rebind_alloc<Element>;
+    using BucketAllocator = std::allocator_traits<Allocator>::template rebind_alloc<Element>;
 
     using BucketAllocatorTraits = std::allocator_traits<BucketAllocator>;
 
@@ -542,8 +540,8 @@ public:
     using allocator_type = Allocator;
     using reference = value_type&;
     using const_reference = value_type const&;
-    using pointer = typename std::allocator_traits<Allocator>::pointer;
-    using const_pointer = typename std::allocator_traits<Allocator>::const_pointer;
+    using pointer = std::allocator_traits<Allocator>::pointer;
+    using const_pointer = std::allocator_traits<Allocator>::const_pointer;
 
     // A set iterator (IsMap==false) is always const
     // because the elements of a set are immutable.
@@ -850,7 +848,7 @@ public:
         bool MaybeMulti = IsMulti,
         bool MaybeMap = IsMap,
         class = std::enable_if_t<MaybeMap && !MaybeMulti>>
-    typename std::conditional<IsMap, T, void*>::type const&
+    std::conditional<IsMap, T, void*>::type const&
     at(K const& k) const;
 
     template <
@@ -1414,7 +1412,7 @@ private:
     void
     touch(
         beast::detail::AgedContainerIterator<IsConst, Iterator> pos,
-        typename clock_type::time_point const& now)
+        clock_type::time_point const& now)
     {
         auto& e(*pos.iterator());
         e.when = now;
@@ -2111,7 +2109,7 @@ template <
     class KeyEqual,
     class Allocator>
 template <class K, bool MaybeMulti, bool MaybeMap, class>
-typename std::conditional<IsMap, T, void*>::type const&
+std::conditional<IsMap, T, void*>::type const&
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::at(
     K const& k) const
 {
diff --git a/include/xrpl/beast/core/List.h b/include/xrpl/beast/core/List.h
index 946126a004..1c3827ae1c 100644
--- a/include/xrpl/beast/core/List.h
+++ b/include/xrpl/beast/core/List.h
@@ -24,7 +24,7 @@ struct CopyConst<T const, U>
 {
     explicit CopyConst() = default;
 
-    using type = typename std::remove_const<U>::type const;
+    using type = std::remove_const<U>::type const;
 };
 /** @} */
 
@@ -56,7 +56,7 @@ class ListIterator
 {
 public:
     using iterator_category = std::bidirectional_iterator_tag;
-    using value_type = typename beast::detail::CopyConst<N, typename N::value_type>::type;
+    using value_type = beast::detail::CopyConst<N, typename N::value_type>::type;
     using difference_type = std::ptrdiff_t;
     using pointer = value_type*;
     using reference = value_type&;
@@ -259,7 +259,7 @@ template <typename T, typename Tag = void>
 class List
 {
 public:
-    using Node = typename detail::ListNode<T, Tag>;
+    using Node = detail::ListNode<T, Tag>;
 
     using value_type = T;
     using pointer = value_type*;
diff --git a/include/xrpl/beast/core/LockFreeStack.h b/include/xrpl/beast/core/LockFreeStack.h
index 6b8f686246..d4ad45cf5c 100644
--- a/include/xrpl/beast/core/LockFreeStack.h
+++ b/include/xrpl/beast/core/LockFreeStack.h
@@ -12,13 +12,13 @@ template <class Container, bool IsConst>
 class LockFreeStackIterator
 {
 protected:
-    using Node = typename Container::Node;
+    using Node = Container::Node;
     using NodePtr = std::conditional_t<IsConst, Node const*, Node*>;
 
 public:
     using iterator_category = std::forward_iterator_tag;
-    using value_type = typename Container::value_type;
-    using difference_type = typename Container::difference_type;
+    using value_type = Container::value_type;
+    using difference_type = Container::difference_type;
     using pointer =
         std::conditional_t<IsConst, typename Container::const_pointer, typename Container::pointer>;
     using reference = std::
diff --git a/include/xrpl/beast/hash/uhash.h b/include/xrpl/beast/hash/uhash.h
index 97461f67c7..9ffd5924f7 100644
--- a/include/xrpl/beast/hash/uhash.h
+++ b/include/xrpl/beast/hash/uhash.h
@@ -11,7 +11,7 @@ struct Uhash
 {
     Uhash() = default;
 
-    using result_type = typename Hasher::result_type;
+    using result_type = Hasher::result_type;
 
     template <class T>
     result_type
diff --git a/include/xrpl/beast/rfc2616.h b/include/xrpl/beast/rfc2616.h
index cf80bd26c0..e810733210 100644
--- a/include/xrpl/beast/rfc2616.h
+++ b/include/xrpl/beast/rfc2616.h
@@ -102,7 +102,7 @@ Result
 split(FwdIt first, FwdIt last, Char delim)
 {
     using namespace detail;
-    using string = typename Result::value_type;
+    using string = Result::value_type;
 
     Result result;
 
diff --git a/include/xrpl/beast/unit_test/detail/const_container.h b/include/xrpl/beast/unit_test/detail/const_container.h
index c171771e45..6826bf4258 100644
--- a/include/xrpl/beast/unit_test/detail/const_container.h
+++ b/include/xrpl/beast/unit_test/detail/const_container.h
@@ -32,11 +32,11 @@ protected:
     }
 
 public:
-    using value_type = typename cont_type::value_type;
-    using size_type = typename cont_type::size_type;
-    using difference_type = typename cont_type::difference_type;
-    using iterator = typename cont_type::const_iterator;
-    using const_iterator = typename cont_type::const_iterator;
+    using value_type = cont_type::value_type;
+    using size_type = cont_type::size_type;
+    using difference_type = cont_type::difference_type;
+    using iterator = cont_type::const_iterator;
+    using const_iterator = cont_type::const_iterator;
 
     /** Returns `true` if the container is empty. */
     [[nodiscard]] bool
diff --git a/include/xrpl/beast/unit_test/reporter.h b/include/xrpl/beast/unit_test/reporter.h
index 1fdbb451a6..ff990dece5 100644
--- a/include/xrpl/beast/unit_test/reporter.h
+++ b/include/xrpl/beast/unit_test/reporter.h
@@ -48,7 +48,7 @@ private:
         std::size_t cases = 0;
         std::size_t total = 0;
         std::size_t failed = 0;
-        typename clock_type::time_point start = clock_type::now();
+        clock_type::time_point start = clock_type::now();
 
         explicit SuiteResults(std::string name = "") : name(std::move(name))
         {
@@ -60,7 +60,7 @@ private:
 
     struct Results
     {
-        using run_time = std::pair<std::string, typename clock_type::duration>;
+        using run_time = std::pair<std::string, clock_type::duration>;
 
         static constexpr auto kMaxTop = 10;
 
@@ -69,7 +69,7 @@ private:
         std::size_t total = 0;
         std::size_t failed = 0;
         std::vector<run_time> top;
-        typename clock_type::time_point start = clock_type::now();
+        clock_type::time_point start = clock_type::now();
 
         void
         add(SuiteResults const& r);
@@ -91,7 +91,7 @@ public:
 
 private:
     static std::string
-    fmtdur(typename clock_type::duration const& d);
+    fmtdur(clock_type::duration const& d);
 
     void
     onSuiteBegin(SuiteInfo const& info) override;
@@ -141,9 +141,7 @@ Reporter<Unused>::Results::add(SuiteResults const& r)
             top.begin(),
             top.end(),
             elapsed,
-            [](run_time const& t1, typename clock_type::duration const& t2) {
-                return t1.second > t2;
-            });
+            [](run_time const& t1, clock_type::duration const& t2) { return t1.second > t2; });
         if (iter != top.end())
         {
             if (top.size() == kMaxTop)
@@ -181,7 +179,7 @@ Reporter<Unused>::~Reporter()
 
 template <class Unused>
 std::string
-Reporter<Unused>::fmtdur(typename clock_type::duration const& d)
+Reporter<Unused>::fmtdur(clock_type::duration const& d)
 {
     using namespace std::chrono;
     auto const ms = duration_cast<milliseconds>(d);
diff --git a/include/xrpl/beast/utility/Journal.h b/include/xrpl/beast/utility/Journal.h
index 1a0c148d1f..1262a64179 100644
--- a/include/xrpl/beast/utility/Journal.h
+++ b/include/xrpl/beast/utility/Journal.h
@@ -411,9 +411,9 @@ class BasicLogstream : public std::basic_ostream<CharT, Traits>
 {
     using char_type = CharT;
     using traits_type = Traits;
-    using int_type = typename traits_type::int_type;
-    using pos_type = typename traits_type::pos_type;
-    using off_type = typename traits_type::off_type;
+    using int_type = traits_type::int_type;
+    using pos_type = traits_type::pos_type;
+    using off_type = traits_type::off_type;
 
     detail::LogStreamBuf<CharT, Traits> buf_;
 
diff --git a/include/xrpl/beast/utility/maybe_const.h b/include/xrpl/beast/utility/maybe_const.h
index 40904471be..10b2eaf7f6 100644
--- a/include/xrpl/beast/utility/maybe_const.h
+++ b/include/xrpl/beast/utility/maybe_const.h
@@ -15,6 +15,6 @@ struct MaybeConst
 
 /** Alias for omitting `typename`. */
 template <bool IsConst, class T>
-using maybe_const_t = typename MaybeConst<IsConst, T>::type;
+using maybe_const_t = MaybeConst<IsConst, T>::type;
 
 }  // namespace beast
diff --git a/include/xrpl/beast/utility/rngfill.h b/include/xrpl/beast/utility/rngfill.h
index 1614a594c5..2ea84a7a3d 100644
--- a/include/xrpl/beast/utility/rngfill.h
+++ b/include/xrpl/beast/utility/rngfill.h
@@ -13,7 +13,7 @@ template <class Generator>
 void
 rngfill(void* const buffer, std::size_t const bytes, Generator& g)
 {
-    using result_type = typename Generator::result_type;
+    using result_type = Generator::result_type;
     constexpr std::size_t kResultSize = sizeof(result_type);
 
     std::uint8_t* const bufferStart = static_cast<std::uint8_t*>(buffer);
@@ -42,7 +42,7 @@ template <
 void
 rngfill(std::array<std::uint8_t, N>& a, Generator& g)
 {
-    using result_type = typename Generator::result_type;
+    using result_type = Generator::result_type;
     auto i = N / sizeof(result_type);
     result_type* p = reinterpret_cast<result_type*>(a.data());
     while (i--)
diff --git a/include/xrpl/json/json_value.h b/include/xrpl/json/json_value.h
index e9dcb8bcbe..f786c6a9dc 100644
--- a/include/xrpl/json/json_value.h
+++ b/include/xrpl/json/json_value.h
@@ -566,6 +566,7 @@ public:
     using SelfType = ValueConstIterator;
 
     ValueConstIterator() = default;
+    ValueConstIterator(ValueConstIterator const& other) = default;
 
 private:
     /*! \internal Use by Value to create an iterator.
@@ -574,12 +575,12 @@ private:
 
 public:
     SelfType&
-    operator=(ValueIteratorBase const& other);
+    operator=(SelfType const& other);
 
     SelfType
     operator++(int)
     {
-        SelfType temp(*this);
+        SelfType const temp(*this);
         ++*this;
         return temp;
     }
@@ -587,7 +588,7 @@ public:
     SelfType
     operator--(int)
     {
-        SelfType temp(*this);
+        SelfType const temp(*this);
         --*this;
         return temp;
     }
diff --git a/include/xrpl/protocol/KnownFormats.h b/include/xrpl/protocol/KnownFormats.h
index 9aa914ba97..6e21d4bc3a 100644
--- a/include/xrpl/protocol/KnownFormats.h
+++ b/include/xrpl/protocol/KnownFormats.h
@@ -118,13 +118,13 @@ public:
     }
 
     // begin() and end() are provided for testing purposes.
-    [[nodiscard]] typename std::forward_list<Item>::const_iterator
+    [[nodiscard]] std::forward_list<Item>::const_iterator
     begin() const
     {
         return formats_.begin();
     }
 
-    [[nodiscard]] typename std::forward_list<Item>::const_iterator
+    [[nodiscard]] std::forward_list<Item>::const_iterator
     end() const
     {
         return formats_.end();
diff --git a/include/xrpl/protocol/STBitString.h b/include/xrpl/protocol/STBitString.h
index 87c8cd4f45..0267eac22d 100644
--- a/include/xrpl/protocol/STBitString.h
+++ b/include/xrpl/protocol/STBitString.h
@@ -163,7 +163,7 @@ STBitString<Bits>::setValue(BaseUInt<Bits, Tag> const& v)
 }
 
 template <int Bits>
-typename STBitString<Bits>::value_type const&
+STBitString<Bits>::value_type const&
 STBitString<Bits>::value() const
 {
     return value_;
diff --git a/include/xrpl/protocol/STInteger.h b/include/xrpl/protocol/STInteger.h
index 4e3c9a8923..52e0f7a365 100644
--- a/include/xrpl/protocol/STInteger.h
+++ b/include/xrpl/protocol/STInteger.h
@@ -120,7 +120,7 @@ STInteger<Integer>::operator=(value_type const& v)
 }
 
 template <typename Integer>
-inline typename STInteger<Integer>::value_type
+inline STInteger<Integer>::value_type
 STInteger<Integer>::value() const noexcept
 {
     return value_;
diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index c635e8ce22..e65cc79c78 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -243,7 +243,7 @@ public:
         @throws STObject::FieldErr if the field is not present.
     */
     template <class T>
-    typename T::value_type
+    T::value_type
     operator[](TypedField<T> const& f) const;
 
     /** Get the value of a field as a std::optional
@@ -290,7 +290,7 @@ public:
         @throws STObject::FieldErr if the field is not present.
     */
     template <class T>
-    [[nodiscard]] typename T::value_type
+    [[nodiscard]] T::value_type
     at(TypedField<T> const& f) const;
 
     /** Get the value of a field as std::optional
@@ -478,7 +478,7 @@ template <class T>
 class STObject::Proxy
 {
 public:
-    using value_type = typename T::value_type;
+    using value_type = T::value_type;
 
     [[nodiscard]] value_type
     value() const;
@@ -513,13 +513,10 @@ protected:
 template <typename U>
 concept IsArithmeticNumber =
     std::is_arithmetic_v<U> || std::is_same_v<U, Number> || std::is_same_v<U, STAmount>;
-template <
-    typename U,
-    typename Value = typename U::value_type,
-    typename Unit = typename U::unit_type>
+template <typename U, typename Value = U::value_type, typename Unit = U::unit_type>
 concept IsArithmeticValueUnit = std::is_same_v<U, unit::ValueUnit<Unit, Value>> &&
     IsArithmeticNumber<Value> && std::is_class_v<Unit>;
-template <typename U, typename Value = typename U::value_type>
+template <typename U, typename Value = U::value_type>
 concept IsArithmeticST = !IsArithmeticValueUnit<U> && IsArithmeticNumber<Value>;
 template <typename U>
 concept IsArithmetic = IsArithmeticNumber<U> || IsArithmeticST<U> || IsArithmeticValueUnit<U>;
@@ -534,7 +531,7 @@ template <class T>
 class STObject::ValueProxy : public Proxy<T>
 {
 private:
-    using value_type = typename T::value_type;
+    using value_type = T::value_type;
 
 public:
     ValueProxy(ValueProxy const&) = default;
@@ -576,7 +573,7 @@ template <class T>
 class STObject::OptionalProxy : public Proxy<T>
 {
 private:
-    using value_type = typename T::value_type;
+    using value_type = T::value_type;
 
     using optional_type = std::optional<std::decay_t<value_type>>;
 
@@ -840,7 +837,7 @@ operator typename STObject::OptionalProxy<T>::optional_type() const
 }
 
 template <class T>
-typename STObject::OptionalProxy<T>::optional_type
+STObject::OptionalProxy<T>::optional_type
 STObject::OptionalProxy<T>::operator~() const
 {
     return optionalValue();
@@ -933,7 +930,7 @@ STObject::OptionalProxy<T>::optionalValue() const -> optional_type
 }
 
 template <class T>
-typename STObject::OptionalProxy<T>::value_type
+STObject::OptionalProxy<T>::value_type
 STObject::OptionalProxy<T>::valueOr(value_type val) const
 {
     return engaged() ? this->value() : val;
@@ -1040,7 +1037,7 @@ STObject::getPIndex(int offset)
 }
 
 template <class T>
-typename T::value_type
+T::value_type
 STObject::operator[](TypedField<T> const& f) const
 {
     return at(f);
@@ -1068,7 +1065,7 @@ STObject::operator[](OptionaledField<T> const& of) -> OptionalProxy<T>
 }
 
 template <class T>
-[[nodiscard]] typename T::value_type
+[[nodiscard]] T::value_type
 STObject::at(TypedField<T> const& f) const
 {
     auto const b = peekAtPField(f);
diff --git a/include/xrpl/protocol/TER.h b/include/xrpl/protocol/TER.h
index c89610f354..072bd4778f 100644
--- a/include/xrpl/protocol/TER.h
+++ b/include/xrpl/protocol/TER.h
@@ -657,13 +657,13 @@ inline bool
 isTesSuccess(TER x) noexcept
 {
     // Makes use of TERSubset::operator bool()
-    return !(x);
+    return !x;
 }
 
 inline bool
 isTecClaim(TER x) noexcept
 {
-    return ((x) >= tecCLAIM);
+    return (x >= tecCLAIM);
 }
 
 std::unordered_map<TERUnderlyingType, std::pair<char const* const, char const* const>> const&
diff --git a/include/xrpl/protocol/Units.h b/include/xrpl/protocol/Units.h
index 7fedc05a0d..39f745e84e 100644
--- a/include/xrpl/protocol/Units.h
+++ b/include/xrpl/protocol/Units.h
@@ -391,7 +391,7 @@ mulDivU(Source1 value, Dest mul, Source2 div)
         return std::nullopt;
     }
 
-    using desttype = typename Dest::value_type;
+    using desttype = Dest::value_type;
     constexpr auto kMax = std::numeric_limits<desttype>::max();
 
     // Shortcuts, since these happen a lot in the real world
diff --git a/include/xrpl/protocol/XChainAttestations.h b/include/xrpl/protocol/XChainAttestations.h
index 457af727a2..1aec5fe549 100644
--- a/include/xrpl/protocol/XChainAttestations.h
+++ b/include/xrpl/protocol/XChainAttestations.h
@@ -379,16 +379,16 @@ public:
     [[nodiscard]] STArray
     toSTArray() const;
 
-    [[nodiscard]] typename AttCollection::const_iterator
+    [[nodiscard]] AttCollection::const_iterator
     begin() const;
 
-    [[nodiscard]] typename AttCollection::const_iterator
+    [[nodiscard]] AttCollection::const_iterator
     end() const;
 
-    typename AttCollection::iterator
+    AttCollection::iterator
     begin();
 
-    typename AttCollection::iterator
+    AttCollection::iterator
     end();
 
     template <class F>
@@ -419,7 +419,7 @@ operator==(
 }
 
 template <class TAttestation>
-inline typename XChainAttestationsBase<TAttestation>::AttCollection const&
+inline XChainAttestationsBase<TAttestation>::AttCollection const&
 XChainAttestationsBase<TAttestation>::attestations() const
 {
     return attestations_;
diff --git a/include/xrpl/protocol/digest.h b/include/xrpl/protocol/digest.h
index 50bf2735fb..721ce60767 100644
--- a/include/xrpl/protocol/digest.h
+++ b/include/xrpl/protocol/digest.h
@@ -206,7 +206,7 @@ sha512Half(Args const&... args)
     sha512_half_hasher h;
     using beast::hash_append;
     hash_append(h, args...);
-    return static_cast<typename sha512_half_hasher::result_type>(h);
+    return static_cast<sha512_half_hasher::result_type>(h);
 }
 
 /** Returns the SHA512-Half of a series of objects.
@@ -222,7 +222,7 @@ sha512HalfS(Args const&... args)
     sha512_half_hasher_s h;
     using beast::hash_append;
     hash_append(h, args...);
-    return static_cast<typename sha512_half_hasher_s::result_type>(h);
+    return static_cast<sha512_half_hasher_s::result_type>(h);
 }
 
 }  // namespace xrpl
diff --git a/include/xrpl/shamap/FullBelowCache.h b/include/xrpl/shamap/FullBelowCache.h
index 07290dfbd1..e9fd04ac58 100644
--- a/include/xrpl/shamap/FullBelowCache.h
+++ b/include/xrpl/shamap/FullBelowCache.h
@@ -25,7 +25,7 @@ public:
     static constexpr auto kDefaultCacheTargetSize = 0;
 
     using key_type = uint256;
-    using clock_type = typename CacheType::clock_type;
+    using clock_type = CacheType::clock_type;
 
     /** Construct the cache.
 
diff --git a/src/libxrpl/json/json_valueiterator.cpp b/src/libxrpl/json/json_valueiterator.cpp
index 5a3a5ffcdb..bb49902f70 100644
--- a/src/libxrpl/json/json_valueiterator.cpp
+++ b/src/libxrpl/json/json_valueiterator.cpp
@@ -132,7 +132,7 @@ ValueConstIterator::ValueConstIterator(Value::ObjectValues::iterator const& curr
 }
 
 ValueConstIterator&
-ValueConstIterator::operator=(ValueIteratorBase const& other)
+ValueConstIterator::operator=(SelfType const& other)
 {
     copy(other);
     return *this;
diff --git a/src/libxrpl/protocol/XChainAttestations.cpp b/src/libxrpl/protocol/XChainAttestations.cpp
index 805d08c097..792fe5da9d 100644
--- a/src/libxrpl/protocol/XChainAttestations.cpp
+++ b/src/libxrpl/protocol/XChainAttestations.cpp
@@ -628,28 +628,28 @@ XChainAttestationsBase<TAttestation>::XChainAttestationsBase(
 }
 
 template <class TAttestation>
-typename XChainAttestationsBase<TAttestation>::AttCollection::const_iterator
+XChainAttestationsBase<TAttestation>::AttCollection::const_iterator
 XChainAttestationsBase<TAttestation>::begin() const
 {
     return attestations_.begin();
 }
 
 template <class TAttestation>
-typename XChainAttestationsBase<TAttestation>::AttCollection::const_iterator
+XChainAttestationsBase<TAttestation>::AttCollection::const_iterator
 XChainAttestationsBase<TAttestation>::end() const
 {
     return attestations_.end();
 }
 
 template <class TAttestation>
-typename XChainAttestationsBase<TAttestation>::AttCollection::iterator
+XChainAttestationsBase<TAttestation>::AttCollection::iterator
 XChainAttestationsBase<TAttestation>::begin()
 {
     return attestations_.begin();
 }
 
 template <class TAttestation>
-typename XChainAttestationsBase<TAttestation>::AttCollection::iterator
+XChainAttestationsBase<TAttestation>::AttCollection::iterator
 XChainAttestationsBase<TAttestation>::end()
 {
     return attestations_.end();
diff --git a/src/libxrpl/protocol/tokens.cpp b/src/libxrpl/protocol/tokens.cpp
index fcd822a747..d04ceaa3a6 100644
--- a/src/libxrpl/protocol/tokens.cpp
+++ b/src/libxrpl/protocol/tokens.cpp
@@ -135,16 +135,16 @@ static constexpr std::array<int, 256> const kAlphabetReverse = []() {
 }();
 
 template <class Hasher>
-static typename Hasher::result_type
+static Hasher::result_type
 digest(void const* data, std::size_t size) noexcept
 {
     Hasher h;
     h(data, size);
-    return static_cast<typename Hasher::result_type>(h);
+    return static_cast<Hasher::result_type>(h);
 }
 
 template <class Hasher, class T, std::size_t N, class = std::enable_if_t<sizeof(T) == 1>>
-static typename Hasher::result_type
+static Hasher::result_type
 digest(std::array<T, N> const& v)
 {
     return digest<Hasher>(v.data(), v.size());
@@ -152,7 +152,7 @@ digest(std::array<T, N> const& v)
 
 // Computes a double digest (e.g. digest of the digest)
 template <class Hasher, class... Args>
-static typename Hasher::result_type
+static Hasher::result_type
 digest2(Args const&... args)
 {
     return digest<Hasher>(digest<Hasher>(args...));
diff --git a/src/libxrpl/shamap/SHAMapInnerNode.cpp b/src/libxrpl/shamap/SHAMapInnerNode.cpp
index ee6ebf7f3f..74a0e4515f 100644
--- a/src/libxrpl/shamap/SHAMapInnerNode.cpp
+++ b/src/libxrpl/shamap/SHAMapInnerNode.cpp
@@ -200,7 +200,7 @@ SHAMapInnerNode::updateHash()
         using beast::hash_append;
         hash_append(h, HashPrefix::InnerNode);
         iterChildren([&](SHAMapHash const& hh) { hash_append(h, hh); });
-        nh = static_cast<typename sha512_half_hasher::result_type>(h);
+        nh = static_cast<sha512_half_hasher::result_type>(h);
     }
     hash_ = SHAMapHash{nh};
 }
diff --git a/src/libxrpl/tx/invariants/InvariantCheck.cpp b/src/libxrpl/tx/invariants/InvariantCheck.cpp
index b4a533905c..e29a9fe661 100644
--- a/src/libxrpl/tx/invariants/InvariantCheck.cpp
+++ b/src/libxrpl/tx/invariants/InvariantCheck.cpp
@@ -407,8 +407,10 @@ AccountRootsNotDeleted::finalize(
                                "succeeded without deleting an account";
         }
         else
+        {
             JLOG(j.fatal()) << "Invariant failed: account deletion "
                                "succeeded but deleted multiple accounts!";
+        }
         return false;
     }
 
diff --git a/src/libxrpl/tx/paths/BookStep.cpp b/src/libxrpl/tx/paths/BookStep.cpp
index 4b045521d2..448172872a 100644
--- a/src/libxrpl/tx/paths/BookStep.cpp
+++ b/src/libxrpl/tx/paths/BookStep.cpp
@@ -1477,8 +1477,8 @@ bookStepEqual(Step const& step, xrpl::Book const& book)
 {
     return std::visit(
         [&]<typename TIn, typename TOut>(TIn const&, TOut const&) {
-            using TIn_ = typename TIn::amount_type;
-            using TOut_ = typename TOut::amount_type;
+            using TIn_ = TIn::amount_type;
+            using TOut_ = TOut::amount_type;
 
             if constexpr (ValidTaker<TIn_, TOut_>)
             {
diff --git a/src/libxrpl/tx/paths/Flow.cpp b/src/libxrpl/tx/paths/Flow.cpp
index 7be1f9f633..80e05f058c 100644
--- a/src/libxrpl/tx/paths/Flow.cpp
+++ b/src/libxrpl/tx/paths/Flow.cpp
@@ -125,8 +125,8 @@ flow(
     // amount types.
     return std::visit(
         [&, &strands = strands]<typename TIn, typename TOut>(TIn const&, TOut const&) {
-            using TIn_ = typename TIn::amount_type;
-            using TOut_ = typename TOut::amount_type;
+            using TIn_ = TIn::amount_type;
+            using TOut_ = TOut::amount_type;
             return finishFlow(
                 sb,
                 srcAsset,
diff --git a/src/libxrpl/tx/transactors/system/TicketCreate.cpp b/src/libxrpl/tx/transactors/system/TicketCreate.cpp
index 5be00fe76c..be24b6326a 100644
--- a/src/libxrpl/tx/transactors/system/TicketCreate.cpp
+++ b/src/libxrpl/tx/transactors/system/TicketCreate.cpp
@@ -120,7 +120,7 @@ TicketCreate::doApply()
     }
 
     // Update the record of the number of Tickets this account owns.
-    std::uint32_t const oldTicketCount = (*(sleAccountRoot))[~sfTicketCount].valueOr(0u);
+    std::uint32_t const oldTicketCount = (*sleAccountRoot)[~sfTicketCount].valueOr(0u);
 
     sleAccountRoot->setFieldU32(sfTicketCount, oldTicketCount + ticketCount);
 
diff --git a/src/test/app/LedgerReplay_test.cpp b/src/test/app/LedgerReplay_test.cpp
index 810d93e6e1..2422db05de 100644
--- a/src/test/app/LedgerReplay_test.cpp
+++ b/src/test/app/LedgerReplay_test.cpp
@@ -1077,10 +1077,10 @@ struct LedgerReplayer_test : public beast::unit_test::Suite
 
         {
             Config c;
-            std::string const toLoad = (R"xrpldConfig(
+            std::string const toLoad = R"xrpldConfig(
 [ledger_replay]
 0
-)xrpldConfig");
+)xrpldConfig";
             c.loadFromString(toLoad);
             BEAST_EXPECT(c.ledgerReplay == false);
         }
diff --git a/src/test/app/Loan_test.cpp b/src/test/app/Loan_test.cpp
index dbb0033368..2d70efd9b2 100644
--- a/src/test/app/Loan_test.cpp
+++ b/src/test/app/Loan_test.cpp
@@ -3006,9 +3006,9 @@ protected:
             }
 
             if (mptTest)
-                (mptTest)(env, brokers[0], mptt);
+                mptTest(env, brokers[0], mptt);
             if (iouTest)
-                (iouTest)(env, brokers[1]);
+                iouTest(env, brokers[1]);
         };
 
         testCase(
diff --git a/src/test/app/NFTokenDir_test.cpp b/src/test/app/NFTokenDir_test.cpp
index 117f2bc816..e24a524b81 100644
--- a/src/test/app/NFTokenDir_test.cpp
+++ b/src/test/app/NFTokenDir_test.cpp
@@ -143,7 +143,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
         for (uint256 const& nftID : nftIDs)
         {
             offers.emplace_back(keylet::nftoffer(issuer, env.seq(issuer)).key);
-            env(token::createOffer(issuer, nftID, XRP(0)), Txflags((tfSellNFToken)));
+            env(token::createOffer(issuer, nftID, XRP(0)), Txflags(tfSellNFToken));
             env.close();
         }
 
@@ -217,7 +217,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
                 offers.emplace_back(keylet::nftoffer(account, env.seq(account)).key);
                 env(token::createOffer(account, nftID, XRP(0)),
                     token::Destination(buyer),
-                    Txflags((tfSellNFToken)));
+                    Txflags(tfSellNFToken));
             }
             env.close();
 
@@ -421,7 +421,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
                 offers.emplace_back(keylet::nftoffer(account, env.seq(account)).key);
                 env(token::createOffer(account, nftID, XRP(0)),
                     token::Destination(buyer),
-                    Txflags((tfSellNFToken)));
+                    Txflags(tfSellNFToken));
             }
             env.close();
 
@@ -651,7 +651,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
             offers.emplace_back(keylet::nftoffer(account, env.seq(account)).key);
             env(token::createOffer(account, nftID, XRP(0)),
                 token::Destination(buyer),
-                Txflags((tfSellNFToken)));
+                Txflags(tfSellNFToken));
         }
         env.close();
 
@@ -823,7 +823,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
                 offers[i].emplace_back(keylet::nftoffer(account, env.seq(account)).key);
                 env(token::createOffer(account, nftID, XRP(0)),
                     token::Destination(buyer),
-                    Txflags((tfSellNFToken)));
+                    Txflags(tfSellNFToken));
             }
         }
         env.close();
diff --git a/src/test/app/OfferMPT_test.cpp b/src/test/app/OfferMPT_test.cpp
index ed0b2ffbe3..ac50924ac2 100644
--- a/src/test/app/OfferMPT_test.cpp
+++ b/src/test/app/OfferMPT_test.cpp
@@ -3431,7 +3431,7 @@ public:
         auto const gw = Account("gateway");
 
         auto const fee = env.current()->fees().base;
-        env.fund(reserve(env, 2) + drops(9999640) + (fee), ann);
+        env.fund(reserve(env, 2) + drops(9999640) + fee, ann);
         env.fund(reserve(env, 2) + (fee * 4), gw);
         env.close();
 
@@ -3467,7 +3467,7 @@ public:
         auto const bob = Account("bob");
 
         auto const fee = env.current()->fees().base;
-        env.fund(reserve(env, 2) + drops(400'000'000'000) + (fee), alice, bob);
+        env.fund(reserve(env, 2) + drops(400'000'000'000) + fee, alice, bob);
         env.fund(reserve(env, 2) + (fee * 4), gw);
         env.close();
 
diff --git a/src/test/app/Offer_test.cpp b/src/test/app/Offer_test.cpp
index ea8b0a7c0e..1a2f0b2b12 100644
--- a/src/test/app/Offer_test.cpp
+++ b/src/test/app/Offer_test.cpp
@@ -3621,7 +3621,7 @@ public:
         auto const btc = gw["BTC"];
 
         auto const fee = env.current()->fees().base;
-        env.fund(reserve(env, 2) + drops(9999640) + (fee), ann);
+        env.fund(reserve(env, 2) + drops(9999640) + fee, ann);
         env.fund(reserve(env, 2) + (fee * 4), gw);
         env.close();
 
@@ -3659,7 +3659,7 @@ public:
         auto const cny = gw["CNY"];
 
         auto const fee = env.current()->fees().base;
-        env.fund(reserve(env, 2) + drops(400000000000) + (fee), alice, bob);
+        env.fund(reserve(env, 2) + drops(400000000000) + fee, alice, bob);
         env.fund(reserve(env, 2) + (fee * 4), gw);
         env.close();
 
@@ -3706,7 +3706,7 @@ public:
         auto const jpy = gw["JPY"];
 
         auto const fee = env.current()->fees().base;
-        env.fund(reserve(env, 2) + drops(400000000000) + (fee), alice, bob);
+        env.fund(reserve(env, 2) + drops(400000000000) + fee, alice, bob);
         env.fund(reserve(env, 2) + (fee * 4), gw);
         env.close();
 
@@ -3759,7 +3759,7 @@ public:
         auto const jpy = gw2["JPY"];
 
         auto const fee = env.current()->fees().base;
-        env.fund(reserve(env, 2) + drops(400000000000) + (fee), alice, bob);
+        env.fund(reserve(env, 2) + drops(400000000000) + fee, alice, bob);
         env.fund(reserve(env, 2) + (fee * 4), gw1, gw2);
         env.close();
 
diff --git a/src/test/app/TxQ_test.cpp b/src/test/app/TxQ_test.cpp
index 0ae6b4d80a..97cb035578 100644
--- a/src/test/app/TxQ_test.cpp
+++ b/src/test/app/TxQ_test.cpp
@@ -1176,7 +1176,7 @@ public:
         // bankrupt Alice. Fails, because an account can't have
         // more than the minimum reserve in flight before the
         // last queued transaction
-        aliceFee = env.le(alice)->getFieldAmount(sfBalance).xrp().drops() - (62);
+        aliceFee = env.le(alice)->getFieldAmount(sfBalance).xrp().drops() - 62;
         env(noop(alice), Seq(aliceSeq), Fee(aliceFee), Ter(telCAN_NOT_QUEUE_BALANCE));
         checkMetrics(*this, env, 4, 10, 6, 5);
 
diff --git a/src/test/beast/aged_associative_container_test.cpp b/src/test/beast/aged_associative_container_test.cpp
index d7f74aaa7d..2ac5fc5a33 100644
--- a/src/test/beast/aged_associative_container_test.cpp
+++ b/src/test/beast/aged_associative_container_test.cpp
@@ -11,6 +11,7 @@
 #include <xrpl/beast/container/detail/aged_unordered_container.h>
 #include <xrpl/beast/unit_test/suite.h>
 
+#include <algorithm>
 #include <chrono>
 #include <cstddef>
 #include <functional>
@@ -232,10 +233,10 @@ public:
     {
     public:
         using T = void;
-        using Value = typename Base::Key;
+        using Value = Base::Key;
         using Values = std::vector<Value>;
 
-        static typename Base::Key const&
+        static Base::Key const&
         extract(Value const& value)
         {
             return value;  // NOLINT(bugprone-return-const-ref-from-parameter)
@@ -271,7 +272,7 @@ public:
         using Value = std::pair<typename Base::Key, T>;
         using Values = std::vector<Value>;
 
-        static typename Base::Key const&
+        static Base::Key const&
         extract(Value const& value)
         {
             return value.first;
@@ -387,7 +388,7 @@ public:
     struct EqualValue
     {
         bool
-        operator()(typename Traits::Value const& lhs, typename Traits::Value const& rhs)
+        operator()(Traits::Value const& lhs, Traits::Value const& rhs)
         {
             return Traits::extract(lhs) == Traits::extract(rhs);
         }
@@ -647,7 +648,7 @@ AgedAssociativeContainerTestBase::checkUnorderedContentsRefRef(C&& c, Values con
     using Cont = std::remove_reference_t<C>;
     using Traits =
         TestTraits<Cont::is_unordered::value, Cont::is_multi::value, Cont::is_map::value>;
-    using size_type = typename Cont::size_type;
+    using size_type = Cont::size_type;
     auto const hash(c.hashFunction());
     auto const keyEq(c.keyEq());
     for (size_type i(0); i < c.bucketCount(); ++i)
@@ -655,10 +656,9 @@ AgedAssociativeContainerTestBase::checkUnorderedContentsRefRef(C&& c, Values con
         auto const last(c.end(i));
         for (auto iter(c.begin(i)); iter != last; ++iter)
         {
-            auto const match(
-                std::find_if(v.begin(), v.end(), [iter](typename Values::value_type const& e) {
-                    return Traits::extract(*iter) == Traits::extract(e);
-                }));
+            auto const match(std::ranges::find_if(v, [iter](Values::value_type const& e) {
+                return Traits::extract(*iter) == Traits::extract(e);
+            }));
             BEAST_EXPECT(match != v.end());
             BEAST_EXPECT(keyEq(Traits::extract(*iter), Traits::extract(*match)));
             BEAST_EXPECT(hash(Traits::extract(*iter)) == hash(Traits::extract(*match)));
@@ -671,7 +671,7 @@ void
 AgedAssociativeContainerTestBase::checkContentsRefRef(C&& c, Values const& v)
 {
     using Cont = std::remove_reference_t<C>;
-    using size_type = typename Cont::size_type;
+    using size_type = Cont::size_type;
 
     BEAST_EXPECT(c.size() == v.size());
     BEAST_EXPECT(size_type(std::distance(c.begin(), c.end())) == v.size());
@@ -703,7 +703,7 @@ AgedAssociativeContainerTestBase::checkContents(Cont& c)
 {
     using Traits =
         TestTraits<Cont::is_unordered::value, Cont::is_multi::value, Cont::is_map::value>;
-    using Values = typename Traits::Values;
+    using Values = Traits::Values;
     checkContents(c, Values());
 }
 
@@ -719,10 +719,10 @@ std::enable_if_t<!IsUnordered>
 AgedAssociativeContainerTestBase::testConstructEmpty()
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
-    using Comp = typename Traits::Comp;
-    using Alloc = typename Traits::Alloc;
-    using MyComp = typename Traits::MyComp;
-    using MyAlloc = typename Traits::MyAlloc;
+    using Comp = Traits::Comp;
+    using Alloc = Traits::Alloc;
+    using MyComp = Traits::MyComp;
+    using MyAlloc = Traits::MyAlloc;
     typename Traits::ManualClock clock;
 
     // testcase (Traits::name() + " empty");
@@ -755,12 +755,12 @@ std::enable_if_t<IsUnordered>
 AgedAssociativeContainerTestBase::testConstructEmpty()
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
-    using Hash = typename Traits::Hash;
-    using Equal = typename Traits::Equal;
-    using Alloc = typename Traits::Alloc;
-    using MyHash = typename Traits::MyHash;
-    using MyEqual = typename Traits::MyEqual;
-    using MyAlloc = typename Traits::MyAlloc;
+    using Hash = Traits::Hash;
+    using Equal = Traits::Equal;
+    using Alloc = Traits::Alloc;
+    using MyHash = Traits::MyHash;
+    using MyEqual = Traits::MyEqual;
+    using MyAlloc = Traits::MyAlloc;
     typename Traits::ManualClock clock;
 
     // testcase (Traits::name() + " empty");
@@ -813,10 +813,10 @@ std::enable_if_t<!IsUnordered>
 AgedAssociativeContainerTestBase::testConstructRange()
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
-    using Comp = typename Traits::Comp;
-    using Alloc = typename Traits::Alloc;
-    using MyComp = typename Traits::MyComp;
-    using MyAlloc = typename Traits::MyAlloc;
+    using Comp = Traits::Comp;
+    using Alloc = Traits::Alloc;
+    using MyComp = Traits::MyComp;
+    using MyAlloc = Traits::MyAlloc;
     typename Traits::ManualClock clock;
     auto const v(Traits::values());
 
@@ -860,12 +860,12 @@ std::enable_if_t<IsUnordered>
 AgedAssociativeContainerTestBase::testConstructRange()
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
-    using Hash = typename Traits::Hash;
-    using Equal = typename Traits::Equal;
-    using Alloc = typename Traits::Alloc;
-    using MyHash = typename Traits::MyHash;
-    using MyEqual = typename Traits::MyEqual;
-    using MyAlloc = typename Traits::MyAlloc;
+    using Hash = Traits::Hash;
+    using Equal = Traits::Equal;
+    using Alloc = Traits::Alloc;
+    using MyHash = Traits::MyHash;
+    using MyEqual = Traits::MyEqual;
+    using MyAlloc = Traits::MyAlloc;
     typename Traits::ManualClock clock;
     auto const v(Traits::values());
 
@@ -962,7 +962,7 @@ void
 AgedAssociativeContainerTestBase::testCopyMove()
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
-    using Alloc = typename Traits::Alloc;
+    using Alloc = Traits::Alloc;
     typename Traits::ManualClock clock;
     auto const v(Traits::values());
 
@@ -1307,7 +1307,7 @@ AgedAssociativeContainerTestBase::testChronological()
     // Test touch() with a non-const iterator.
     for (auto iter(v.crbegin()); iter != v.crend(); ++iter)
     {
-        using iterator = typename decltype(c)::iterator;
+        using iterator = decltype(c)::iterator;
         iterator const found(c.find(Traits::extract(*iter)));
 
         BEAST_EXPECT(found != c.cend());
@@ -1327,7 +1327,7 @@ AgedAssociativeContainerTestBase::testChronological()
     // Test touch() with a const_iterator
     for (auto iter(v.cbegin()); iter != v.cend(); ++iter)
     {
-        using const_iterator = typename decltype(c)::const_iterator;
+        using const_iterator = decltype(c)::const_iterator;
         const_iterator const found(c.find(Traits::extract(*iter)));
 
         BEAST_EXPECT(found != c.cend());
diff --git a/src/test/beast/beast_io_latency_probe_test.cpp b/src/test/beast/beast_io_latency_probe_test.cpp
index 5f183ef091..b7e4980f05 100644
--- a/src/test/beast/beast_io_latency_probe_test.cpp
+++ b/src/test/beast/beast_io_latency_probe_test.cpp
@@ -36,8 +36,8 @@ class io_latency_probe_test : public beast::unit_test::Suite, public beast::test
     template <class Clock, class MeasureClock = std::chrono::high_resolution_clock>
     struct MeasureAsioTimers
     {
-        using duration = typename Clock::duration;
-        using rep = typename MeasureClock::duration::rep;
+        using duration = Clock::duration;
+        using rep = MeasureClock::duration::rep;
 
         std::vector<duration> elapsedTimes;
 
diff --git a/src/test/consensus/ByzantineFailureSim_test.cpp b/src/test/consensus/ByzantineFailureSim_test.cpp
index ad75a78086..c3c51125b5 100644
--- a/src/test/consensus/ByzantineFailureSim_test.cpp
+++ b/src/test/consensus/ByzantineFailureSim_test.cpp
@@ -1,4 +1,3 @@
-#include <test/csf.h>
 #include <test/csf/Peer.h>
 #include <test/csf/PeerGroup.h>
 #include <test/csf/Sim.h>
diff --git a/src/test/consensus/Consensus_test.cpp b/src/test/consensus/Consensus_test.cpp
index 629a97f0ea..92a4c67e32 100644
--- a/src/test/consensus/Consensus_test.cpp
+++ b/src/test/consensus/Consensus_test.cpp
@@ -1,4 +1,3 @@
-#include <test/csf.h>
 #include <test/csf/Peer.h>
 #include <test/csf/PeerGroup.h>
 #include <test/csf/Sim.h>
diff --git a/src/test/consensus/DistributedValidatorsSim_test.cpp b/src/test/consensus/DistributedValidatorsSim_test.cpp
index 6d9ac6bede..1def09db13 100644
--- a/src/test/consensus/DistributedValidatorsSim_test.cpp
+++ b/src/test/consensus/DistributedValidatorsSim_test.cpp
@@ -1,4 +1,3 @@
-#include <test/csf.h>
 #include <test/csf/PeerGroup.h>
 #include <test/csf/Sim.h>
 #include <test/csf/collectors.h>
diff --git a/src/test/consensus/ScaleFreeSim_test.cpp b/src/test/consensus/ScaleFreeSim_test.cpp
index 7e75aea72a..e533e09eb0 100644
--- a/src/test/consensus/ScaleFreeSim_test.cpp
+++ b/src/test/consensus/ScaleFreeSim_test.cpp
@@ -1,4 +1,3 @@
-#include <test/csf.h>
 #include <test/csf/PeerGroup.h>
 #include <test/csf/Sim.h>
 #include <test/csf/collectors.h>
diff --git a/src/test/csf/BasicNetwork.h b/src/test/csf/BasicNetwork.h
index e1d519b30b..418cdcf289 100644
--- a/src/test/csf/BasicNetwork.h
+++ b/src/test/csf/BasicNetwork.h
@@ -64,9 +64,9 @@ class BasicNetwork
 
     using clock_type = Scheduler::clock_type;
 
-    using duration = typename clock_type::duration;
+    using duration = clock_type::duration;
 
-    using time_point = typename clock_type::time_point;
+    using time_point = clock_type::time_point;
 
     struct LinkType
     {
diff --git a/src/test/csf/Digraph.h b/src/test/csf/Digraph.h
index 6fbb8c3514..20e45faa5b 100644
--- a/src/test/csf/Digraph.h
+++ b/src/test/csf/Digraph.h
@@ -128,7 +128,7 @@ public:
     outVertices() const
     {
         return boost::adaptors::transform(
-            graph_, [](typename Graph::value_type const& v) { return v.first; });
+            graph_, [](Graph::value_type const& v) { return v.first; });
     }
 
     /** Range over target vertices
@@ -139,7 +139,7 @@ public:
     [[nodiscard]] auto
     outVertices(Vertex source) const
     {
-        auto transform = [](typename Links::value_type const& link) { return link.first; };
+        auto transform = [](Links::value_type const& link) { return link.first; };
         auto it = graph_.find(source);
         if (it != graph_.end())
             return boost::adaptors::transform(it->second, transform);
@@ -165,7 +165,7 @@ public:
     [[nodiscard]] auto
     outEdges(Vertex source) const
     {
-        auto transform = [source](typename Links::value_type const& link) {
+        auto transform = [source](Links::value_type const& link) {
             return Edge{source, link.first, link.second};
         };
 
diff --git a/src/test/csf/Scheduler.h b/src/test/csf/Scheduler.h
index ede43be854..e7cbe27036 100644
--- a/src/test/csf/Scheduler.h
+++ b/src/test/csf/Scheduler.h
@@ -27,9 +27,9 @@ class Scheduler
 public:
     using clock_type = beast::ManualClock<std::chrono::steady_clock>;
 
-    using duration = typename clock_type::duration;
+    using duration = clock_type::duration;
 
-    using time_point = typename clock_type::time_point;
+    using time_point = clock_type::time_point;
 
 private:
     using by_when_hook =
@@ -87,14 +87,14 @@ private:
     class QueueType
     {
     private:
-        using by_when_set = typename boost::intrusive::
+        using by_when_set = boost::intrusive::
             make_multiset<Event, boost::intrusive::constant_time_size<false>>::type;
         // alloc_ is owned by the scheduler
         boost::container::pmr::monotonic_buffer_resource* alloc_;
         by_when_set byWhen_;
 
     public:
-        using iterator = typename by_when_set::iterator;
+        using iterator = by_when_set::iterator;
 
         QueueType(QueueType const&) = delete;
         QueueType&
@@ -114,7 +114,7 @@ private:
         end();
 
         template <class Handler>
-        typename by_when_set::iterator
+        by_when_set::iterator
         emplace(time_point when, Handler&& h);
 
         iterator
@@ -287,7 +287,7 @@ Scheduler::QueueType::end() -> iterator
 
 template <class Handler>
 inline auto
-Scheduler::QueueType::emplace(time_point when, Handler&& h) -> typename by_when_set::iterator
+Scheduler::QueueType::emplace(time_point when, Handler&& h) -> by_when_set::iterator
 {
     using event_type = EventImpl<std::decay_t<Handler>>;
     auto const p = alloc_->allocate(sizeof(event_type));
@@ -296,7 +296,7 @@ Scheduler::QueueType::emplace(time_point when, Handler&& h) -> typename by_when_
 }
 
 inline auto
-Scheduler::QueueType::erase(iterator iter) -> typename by_when_set::iterator
+Scheduler::QueueType::erase(iterator iter) -> by_when_set::iterator
 {
     auto& e = *iter;
     auto next = byWhen_.erase(iter);
@@ -309,7 +309,7 @@ Scheduler::QueueType::erase(iterator iter) -> typename by_when_set::iterator
 struct Scheduler::CancelToken
 {
 private:
-    typename QueueType::iterator iter_;
+    QueueType::iterator iter_;
 
 public:
     CancelToken() = delete;
@@ -319,7 +319,7 @@ public:
 
 private:
     friend class Scheduler;
-    CancelToken(typename QueueType::iterator iter) : iter_(iter)
+    CancelToken(QueueType::iterator iter) : iter_(iter)
     {
     }
 };
diff --git a/src/test/csf/SimTime.h b/src/test/csf/SimTime.h
index e38a375e02..125674f15d 100644
--- a/src/test/csf/SimTime.h
+++ b/src/test/csf/SimTime.h
@@ -11,7 +11,7 @@ using RealDuration = RealClock::duration;
 using RealTime = RealClock::time_point;
 
 using SimClock = beast::ManualClock<std::chrono::steady_clock>;
-using SimDuration = typename SimClock::duration;
-using SimTime = typename SimClock::time_point;
+using SimDuration = SimClock::duration;
+using SimTime = SimClock::time_point;
 
 }  // namespace xrpl::test::csf
diff --git a/src/test/csf/random.h b/src/test/csf/random.h
index 08002aed7f..30f98e37fe 100644
--- a/src/test/csf/random.h
+++ b/src/test/csf/random.h
@@ -72,14 +72,14 @@ public:
     Selector(RAIter first, RAIter last, std::vector<double> const& w, Generator& g)
         : first_{first}, last_{last}, dd_{w.begin(), w.end()}, g_{g}
     {
-        using tag = typename std::iterator_traits<RAIter>::iterator_category;
+        using tag = std::iterator_traits<RAIter>::iterator_category;
         static_assert(
             std::is_same_v<tag, std::random_access_iterator_tag>,
             "Selector only supports random access iterators.");
         // TODO: Allow for forward iterators
     }
 
-    typename std::iterator_traits<RAIter>::value_type
+    std::iterator_traits<RAIter>::value_type
     operator()()
     {
         auto idx = dd_(g_);
diff --git a/src/test/jtx/TestHelpers.h b/src/test/jtx/TestHelpers.h
index 27c54d830b..0e35e6b9ec 100644
--- a/src/test/jtx/TestHelpers.h
+++ b/src/test/jtx/TestHelpers.h
@@ -27,6 +27,7 @@ namespace xrpl::test::jtx {
 */
 template <
     class SField,
+    // NOLINTNEXTLINE(readability-redundant-typename): typename required by MSVC
     class StoredValue = typename SField::type::value_type,
     class OutputValue = StoredValue>
 struct JTxField
@@ -213,8 +214,8 @@ template <class JTxField>
 struct JTxFieldWrapper
 {
     using JF = JTxField;
-    using SF = typename JF::SF;
-    using SV = typename JF::SV;
+    using SF = JF::SF;
+    using SV = JF::SV;
 
 protected:
     SF const& sfield_;
@@ -266,9 +267,11 @@ public:
     }
 };
 
+// NOLINTNEXTLINE(readability-redundant-typename): typename required by MSVC
 template <class SField, class UnitTag, class ValueType = typename SField::type::value_type>
 using valueUnitWrapper = JTxFieldWrapper<ValueUnitField<SField, UnitTag, ValueType>>;
 
+// NOLINTNEXTLINE(readability-redundant-typename): typename required by MSVC
 template <class SField, class StoredValue = typename SField::type::value_type>
 using simpleField = JTxFieldWrapper<JTxField<SField, StoredValue>>;
 
diff --git a/src/test/nodestore/Timing_test.cpp b/src/test/nodestore/Timing_test.cpp
index f5e6bf8aa4..e308d0d5ff 100644
--- a/src/test/nodestore/Timing_test.cpp
+++ b/src/test/nodestore/Timing_test.cpp
@@ -57,7 +57,7 @@ template <class Generator>
 static void
 rngcpy(void* buffer, std::size_t bytes, Generator& g)
 {
-    using result_type = typename Generator::result_type;
+    using result_type = Generator::result_type;
     while (bytes >= sizeof(result_type))
     {
         auto const v = g();
diff --git a/src/test/server/Server_test.cpp b/src/test/server/Server_test.cpp
index 54091ef767..9ff0015b5d 100644
--- a/src/test/server/Server_test.cpp
+++ b/src/test/server/Server_test.cpp
@@ -169,7 +169,7 @@ public:
     // Connect to an address
     template <class Socket>
     bool
-    connect(Socket& s, typename Socket::endpoint_type const& ep)
+    connect(Socket& s, Socket::endpoint_type const& ep)
     {
         try
         {
diff --git a/src/test/unit_test/multi_runner.cpp b/src/test/unit_test/multi_runner.cpp
index 3a56d22654..71208313a4 100644
--- a/src/test/unit_test/multi_runner.cpp
+++ b/src/test/unit_test/multi_runner.cpp
@@ -69,9 +69,7 @@ Results::add(SuiteResults const& r)
             top.begin(),
             top.end(),
             elapsed,
-            [](run_time const& t1, typename clock_type::duration const& t2) {
-                return t1.second > t2;
-            });
+            [](run_time const& t1, clock_type::duration const& t2) { return t1.second > t2; });
 
         if (iter != top.end())
         {
diff --git a/src/test/unit_test/multi_runner.h b/src/test/unit_test/multi_runner.h
index 8b07559e8c..55cf6c25fa 100644
--- a/src/test/unit_test/multi_runner.h
+++ b/src/test/unit_test/multi_runner.h
@@ -42,7 +42,7 @@ struct SuiteResults
     std::size_t cases = 0;
     std::size_t total = 0;
     std::size_t failed = 0;
-    typename clock_type::time_point start = clock_type::now();
+    clock_type::time_point start = clock_type::now();
 
     explicit SuiteResults(std::string name = "") : name(std::move(name))
     {
@@ -57,7 +57,7 @@ struct Results
     using static_string = boost::beast::static_string<256>;
     // results may be stored in shared memory. Use `static_string` to ensure
     // pointers from different memory spaces do not co-mingle
-    using run_time = std::pair<static_string, typename clock_type::duration>;
+    using run_time = std::pair<static_string, clock_type::duration>;
 
     static constexpr auto kMaxTop = 10;
 
@@ -66,7 +66,7 @@ struct Results
     std::size_t total = 0;
     std::size_t failed = 0;
     boost::container::static_vector<run_time, kMaxTop> top;
-    typename clock_type::time_point start = clock_type::now();
+    clock_type::time_point start = clock_type::now();
 
     void
     add(SuiteResults const& r);
diff --git a/src/xrpld/app/consensus/RCLConsensus.cpp b/src/xrpld/app/consensus/RCLConsensus.cpp
index a474c9c339..a7c2b26c04 100644
--- a/src/xrpld/app/consensus/RCLConsensus.cpp
+++ b/src/xrpld/app/consensus/RCLConsensus.cpp
@@ -580,7 +580,9 @@ RCLConsensus::Adaptor::doAccept(
         JLOG(j_.info()) << "CNF Val " << newLCLHash;
     }
     else
+    {
         JLOG(j_.info()) << "CNF buildLCL " << newLCLHash;
+    }
 
     // See if we can accept a ledger as fully-validated
     ledgerMaster_.consensusBuilt(built.ledger, result.txns.id(), std::move(consensusJson));
@@ -796,7 +798,9 @@ RCLConsensus::Adaptor::buildLCL(
         JLOG(j_.debug()) << "Consensus built ledger we were acquiring";
     }
     else
+    {
         JLOG(j_.debug()) << "Consensus built new ledger";
+    }
     return RCLCxLedger{std::move(built)};
 }
 
diff --git a/src/xrpld/app/consensus/RCLValidations.cpp b/src/xrpld/app/consensus/RCLValidations.cpp
index 02ff86b23d..9d40e60b00 100644
--- a/src/xrpld/app/consensus/RCLValidations.cpp
+++ b/src/xrpld/app/consensus/RCLValidations.cpp
@@ -46,8 +46,10 @@ RCLValidatedLedger::RCLValidatedLedger(
         ancestors_ = hashIndex->getFieldV256(sfHashes).value();
     }
     else
+    {
         JLOG(j_.warn()) << "Ledger " << ledgerSeq_ << ":" << ledgerID_
                         << " missing recent ancestor hashes";
+    }
 }
 
 auto
diff --git a/src/xrpld/app/ledger/LedgerHistory.cpp b/src/xrpld/app/ledger/LedgerHistory.cpp
index 8520fc941f..b7e1772942 100644
--- a/src/xrpld/app/ledger/LedgerHistory.cpp
+++ b/src/xrpld/app/ledger/LedgerHistory.cpp
@@ -368,8 +368,10 @@ LedgerHistory::handleMismatch(
                              << " validated: " << to_string(*validatedConsensusHash);
         }
         else
+        {
             JLOG(j_.error()) << "MISMATCH with same consensus transaction set: "
                              << to_string(*builtConsensusHash);
+        }
     }
 
     // Find differences between built and valid ledgers
@@ -381,8 +383,10 @@ LedgerHistory::handleMismatch(
         JLOG(j_.error()) << "MISMATCH with same " << builtTx.size() << " transactions";
     }
     else
+    {
         JLOG(j_.error()) << "MISMATCH with " << builtTx.size() << " built and " << validTx.size()
                          << " valid transactions.";
+    }
 
     JLOG(j_.error()) << "built\n" << getJson({*builtLedger, {}});
     JLOG(j_.error()) << "valid\n" << getJson({*validLedger, {}});
diff --git a/src/xrpld/app/ledger/detail/BuildLedger.cpp b/src/xrpld/app/ledger/detail/BuildLedger.cpp
index a77c1c9c50..2a4121ede9 100644
--- a/src/xrpld/app/ledger/detail/BuildLedger.cpp
+++ b/src/xrpld/app/ledger/detail/BuildLedger.cpp
@@ -204,9 +204,11 @@ buildLedger(
                                 << accum.txCount();
             }
             else
+            {
                 JLOG(j.debug()) << "Applied " << applied << " transactions. "
                                 << "Total transactions in ledger (including Inner Batch): "
                                 << accum.txCount();
+            }
         });
 }
 
diff --git a/src/xrpld/app/ledger/detail/LedgerCleaner.cpp b/src/xrpld/app/ledger/detail/LedgerCleaner.cpp
index 9f2db9d2f2..b96f01e577 100644
--- a/src/xrpld/app/ledger/detail/LedgerCleaner.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerCleaner.cpp
@@ -366,7 +366,9 @@ private:
             }
         }
         else
+        {
             JLOG(j_.warn()) << "Validated ledger is prior to target ledger";
+        }
 
         return ledgerHash;
     }
diff --git a/src/xrpld/app/ledger/detail/LedgerMaster.cpp b/src/xrpld/app/ledger/detail/LedgerMaster.cpp
index 9baad0ec90..31510b44d2 100644
--- a/src/xrpld/app/ledger/detail/LedgerMaster.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerMaster.cpp
@@ -755,7 +755,9 @@ LedgerMaster::getFetchPack(LedgerIndex missing, InboundLedger::Reason reason)
         JLOG(journal_.trace()) << "Requested fetch pack for " << missing;
     }
     else
+    {
         JLOG(journal_.debug()) << "No peer for fetch pack";
+    }
 }
 
 void
@@ -1797,10 +1799,14 @@ LedgerMaster::fetchForHistory(
                     getFetchPack(missing, reason);
                 }
                 else
+                {
                     JLOG(journal_.trace()) << "fetchForHistory no fetch pack for " << missing;
+                }
             }
             else
+            {
                 JLOG(journal_.debug()) << "fetchForHistory found failed acquire";
+            }
         }
         if (ledger)
         {
diff --git a/src/xrpld/app/main/Application.cpp b/src/xrpld/app/main/Application.cpp
index 67b5e30eb7..c2fb78ce79 100644
--- a/src/xrpld/app/main/Application.cpp
+++ b/src/xrpld/app/main/Application.cpp
@@ -1612,7 +1612,9 @@ ApplicationImp::signalStop(std::string const& msg)
             JLOG(journal_.warn()) << "Server stopping";
         }
         else
+        {
             JLOG(journal_.warn()) << "Server stopping: " << msg;
+        }
 
         isTimeToStop.notify_all();
     }
diff --git a/src/xrpld/app/misc/NetworkOPs.cpp b/src/xrpld/app/misc/NetworkOPs.cpp
index d807dea10a..1802441a66 100644
--- a/src/xrpld/app/misc/NetworkOPs.cpp
+++ b/src/xrpld/app/misc/NetworkOPs.cpp
@@ -1687,11 +1687,13 @@ NetworkOPsImp::apply(std::unique_lock<std::mutex>& batchLock)
                         e.transaction->setKept();
                     }
                     else
+                    {
                         JLOG(journal_.debug())
                             << "Not holding transaction " << e.transaction->getID() << ": "
                             << (e.local ? "local" : "network") << ", "
                             << "result: " << e.result << " ledgers left: "
                             << (ledgersLeft ? to_string(*ledgersLeft) : "unspecified");
+                    }
                 }
             }
             else
diff --git a/src/xrpld/app/misc/detail/Transaction.cpp b/src/xrpld/app/misc/detail/Transaction.cpp
index 425a5723fb..2c55c474eb 100644
--- a/src/xrpld/app/misc/detail/Transaction.cpp
+++ b/src/xrpld/app/misc/detail/Transaction.cpp
@@ -73,7 +73,7 @@ Transaction::setStatus(
 TransStatus
 Transaction::sqlTransactionStatus(boost::optional<std::string> const& status)
 {
-    auto const c = (status) ? safeCast<TxnSql>((*status)[0]) : TxnSql::Unknown;
+    auto const c = status ? safeCast<TxnSql>((*status)[0]) : TxnSql::Unknown;
 
     switch (static_cast<TxnSql>(c))
     {
diff --git a/src/xrpld/app/misc/detail/ValidatorSite.cpp b/src/xrpld/app/misc/detail/ValidatorSite.cpp
index 76fd078174..6ce3711652 100644
--- a/src/xrpld/app/misc/detail/ValidatorSite.cpp
+++ b/src/xrpld/app/misc/detail/ValidatorSite.cpp
@@ -339,8 +339,10 @@ ValidatorSite::onRequestTimeout(std::size_t siteIdx, error_code const& ec)
             JLOG(j_.warn()) << "Request for " << site.activeResource->uri << " took too long";
         }
         else
+        {
             JLOG(j_.error()) << "Request took too long, but a response has "
                                 "already been processed";
+        }
     }
 
     std::scoped_lock const lockState{stateMutex_};
diff --git a/src/xrpld/app/rdb/backend/detail/Node.cpp b/src/xrpld/app/rdb/backend/detail/Node.cpp
index 9b7db6f0f5..dcc146397b 100644
--- a/src/xrpld/app/rdb/backend/detail/Node.cpp
+++ b/src/xrpld/app/rdb/backend/detail/Node.cpp
@@ -125,7 +125,7 @@ makeLedgerDBs(
             std::size_t notnull = 0, dfltValue = 0, pk = 0;
             soci::indicator ind = soci::i_null;
             soci::statement st =
-                (tx->getSession().prepare << ("PRAGMA table_info(AccountTransactions);"),
+                (tx->getSession().prepare << "PRAGMA table_info(AccountTransactions);",
                  soci::into(cid),
                  soci::into(name),
                  soci::into(type),
@@ -1065,10 +1065,10 @@ accountTxPage(
     if (findLedger == 0)
     {
         sql = boost::str(
-            boost::format(kPrefix + (R"(AccountTransactions.LedgerSeq BETWEEN %u AND %u
+            boost::format(kPrefix + R"(AccountTransactions.LedgerSeq BETWEEN %u AND %u
              ORDER BY AccountTransactions.LedgerSeq %s,
              AccountTransactions.TxnSeq %s
-             LIMIT %u;)")) %
+             LIMIT %u;)") %
             toBase58(options.account) % options.ledgerRange.min % options.ledgerRange.max % order %
             order % queryLimit);
     }
@@ -1080,7 +1080,7 @@ accountTxPage(
 
         auto b58acct = toBase58(options.account);
         sql = boost::str(
-            boost::format((
+            boost::format(
                 R"(SELECT AccountTransactions.LedgerSeq,AccountTransactions.TxnSeq,
             Status,RawTxn,TxnMeta
             FROM AccountTransactions, Transactions WHERE
@@ -1097,7 +1097,7 @@ accountTxPage(
             ORDER BY AccountTransactions.LedgerSeq %s,
             AccountTransactions.TxnSeq %s
             LIMIT %u;
-            )")) %
+            )") %
             b58acct % minLedger % maxLedger % b58acct % findLedger % compare % findSeq % order %
             order % queryLimit);
     }
diff --git a/src/xrpld/consensus/Consensus.h b/src/xrpld/consensus/Consensus.h
index 131db30ce0..b8d04e18b5 100644
--- a/src/xrpld/consensus/Consensus.h
+++ b/src/xrpld/consensus/Consensus.h
@@ -276,11 +276,11 @@ checkConsensus(
 template <class Adaptor>
 class Consensus
 {
-    using Ledger_t = typename Adaptor::Ledger_t;
-    using TxSet_t = typename Adaptor::TxSet_t;
-    using NodeID_t = typename Adaptor::NodeID_t;
-    using Tx_t = typename TxSet_t::Tx;
-    using PeerPosition_t = typename Adaptor::PeerPosition_t;
+    using Ledger_t = Adaptor::Ledger_t;
+    using TxSet_t = Adaptor::TxSet_t;
+    using NodeID_t = Adaptor::NodeID_t;
+    using Tx_t = TxSet_t::Tx;
+    using PeerPosition_t = Adaptor::PeerPosition_t;
     using Proposal_t = ConsensusProposal<NodeID_t, typename Ledger_t::ID, typename TxSet_t::ID>;
 
     using Result = ConsensusResult<Adaptor>;
@@ -341,7 +341,7 @@ public:
     void
     startRound(
         NetClock::time_point const& now,
-        typename Ledger_t::ID const& prevLedgerID,
+        Ledger_t::ID const& prevLedgerID,
         Ledger_t prevLedger,
         hash_set<NodeID_t> const& nowUntrusted,
         bool proposing,
@@ -402,7 +402,7 @@ public:
 
         @return ID of previous ledger
     */
-    typename Ledger_t::ID
+    Ledger_t::ID
     prevLedgerID() const
     {
         return prevLedgerID_;
@@ -428,16 +428,14 @@ private:
     void
     startRoundInternal(
         NetClock::time_point const& now,
-        typename Ledger_t::ID const& prevLedgerID,
+        Ledger_t::ID const& prevLedgerID,
         Ledger_t const& prevLedger,
         ConsensusMode mode,
         std::unique_ptr<std::stringstream> const& clog);
 
     // Change our view of the previous ledger
     void
-    handleWrongLedger(
-        typename Ledger_t::ID const& lgrId,
-        std::unique_ptr<std::stringstream> const& clog);
+    handleWrongLedger(Ledger_t::ID const& lgrId, std::unique_ptr<std::stringstream> const& clog);
 
     /** Check if our previous ledger matches the network's.
 
@@ -568,7 +566,7 @@ private:
     // Non-peer (self) consensus data
 
     // Last validated ledger ID provided to consensus
-    typename Ledger_t::ID prevLedgerID_;
+    Ledger_t::ID prevLedgerID_;
     // Last validated ledger seen by consensus
     Ledger_t previousLedger_;
 
@@ -616,7 +614,7 @@ template <class Adaptor>
 void
 Consensus<Adaptor>::startRound(
     NetClock::time_point const& now,
-    typename Ledger_t::ID const& prevLedgerID,
+    Ledger_t::ID const& prevLedgerID,
     Ledger_t prevLedger,
     hash_set<NodeID_t> const& nowUntrusted,
     bool proposing,
@@ -661,7 +659,7 @@ template <class Adaptor>
 void
 Consensus<Adaptor>::startRoundInternal(
     NetClock::time_point const& now,
-    typename Ledger_t::ID const& prevLedgerID,
+    Ledger_t::ID const& prevLedgerID,
     Ledger_t const& prevLedger,
     ConsensusMode mode,
     std::unique_ptr<std::stringstream> const& clog)
@@ -811,7 +809,9 @@ Consensus<Adaptor>::peerProposalInternal(
                 gotTxSet(now_, *set);
             }
             else
+            {
                 JLOG(j_.debug()) << "Don't have tx set for peer";
+            }
         }
         else if (result_)
         {
@@ -1025,7 +1025,7 @@ Consensus<Adaptor>::getJson(bool full) const
 template <class Adaptor>
 void
 Consensus<Adaptor>::handleWrongLedger(
-    typename Ledger_t::ID const& lgrId,
+    Ledger_t::ID const& lgrId,
     std::unique_ptr<std::stringstream> const& clog)
 {
     CLOG(clog) << "handleWrongLedger. ";
diff --git a/src/xrpld/consensus/ConsensusTypes.h b/src/xrpld/consensus/ConsensusTypes.h
index 64a7f5fdea..f043fc0663 100644
--- a/src/xrpld/consensus/ConsensusTypes.h
+++ b/src/xrpld/consensus/ConsensusTypes.h
@@ -183,11 +183,11 @@ enum class ConsensusState {
 template <class Traits>
 struct ConsensusResult
 {
-    using Ledger_t = typename Traits::Ledger_t;
-    using TxSet_t = typename Traits::TxSet_t;
-    using NodeID_t = typename Traits::NodeID_t;
+    using Ledger_t = Traits::Ledger_t;
+    using TxSet_t = Traits::TxSet_t;
+    using NodeID_t = Traits::NodeID_t;
 
-    using Tx_t = typename TxSet_t::Tx;
+    using Tx_t = TxSet_t::Tx;
     using Proposal_t = ConsensusProposal<NodeID_t, typename Ledger_t::ID, typename TxSet_t::ID>;
     using Dispute_t = DisputedTx<Tx_t, NodeID_t>;
 
diff --git a/src/xrpld/consensus/DisputedTx.h b/src/xrpld/consensus/DisputedTx.h
index 1c0c069f54..ba8329714b 100644
--- a/src/xrpld/consensus/DisputedTx.h
+++ b/src/xrpld/consensus/DisputedTx.h
@@ -29,7 +29,7 @@ namespace xrpl {
 template <class Tx, class NodeId>
 class DisputedTx
 {
-    using TxID_t = typename Tx::ID;
+    using TxID_t = Tx::ID;
     using Map_t = boost::container::flat_map<NodeId, bool>;
 
 public:
diff --git a/src/xrpld/consensus/LedgerTrie.h b/src/xrpld/consensus/LedgerTrie.h
index 9d76c7f283..cd9662ff02 100644
--- a/src/xrpld/consensus/LedgerTrie.h
+++ b/src/xrpld/consensus/LedgerTrie.h
@@ -21,8 +21,8 @@ template <class Ledger>
 class SpanTip
 {
 public:
-    using Seq = typename Ledger::Seq;
-    using ID = typename Ledger::ID;
+    using Seq = Ledger::Seq;
+    using ID = Ledger::ID;
 
     SpanTip(Seq s, ID i, Ledger const lgr) : seq{s}, id{i}, ledger_{std::move(lgr)}
     {
@@ -58,8 +58,8 @@ namespace ledger_trie_detail {
 template <class Ledger>
 class Span
 {
-    using Seq = typename Ledger::Seq;
-    using ID = typename Ledger::ID;
+    using Seq = Ledger::Seq;
+    using ID = Ledger::ID;
 
     // The span is the half-open interval [start,end) of ledger_
     Seq start_{0};
@@ -323,8 +323,8 @@ struct Node
 template <class Ledger>
 class LedgerTrie
 {
-    using Seq = typename Ledger::Seq;
-    using ID = typename Ledger::ID;
+    using Seq = Ledger::Seq;
+    using ID = Ledger::ID;
 
     using Node = ledger_trie_detail::Node<Ledger>;
     using Span = ledger_trie_detail::Span<Ledger>;
diff --git a/src/xrpld/consensus/Validations.h b/src/xrpld/consensus/Validations.h
index 2f5762ce83..f109ae620b 100644
--- a/src/xrpld/consensus/Validations.h
+++ b/src/xrpld/consensus/Validations.h
@@ -267,13 +267,13 @@ to_string(ValStatus m)
 template <class Adaptor>
 class Validations
 {
-    using Mutex = typename Adaptor::Mutex;
-    using Validation = typename Adaptor::Validation;
-    using Ledger = typename Adaptor::Ledger;
-    using ID = typename Ledger::ID;
-    using Seq = typename Ledger::Seq;
-    using NodeID = typename Validation::NodeID;
-    using NodeKey = typename Validation::NodeKey;
+    using Mutex = Adaptor::Mutex;
+    using Validation = Adaptor::Validation;
+    using Ledger = Adaptor::Ledger;
+    using ID = Ledger::ID;
+    using Seq = Ledger::Seq;
+    using NodeID = Validation::NodeID;
+    using NodeKey = Validation::NodeKey;
 
     using WrappedValidationType =
         std::decay_t<std::invoke_result_t<decltype(&Validation::unwrap), Validation>>;
diff --git a/src/xrpld/overlay/Slot.h b/src/xrpld/overlay/Slot.h
index 0600265500..7490798787 100644
--- a/src/xrpld/overlay/Slot.h
+++ b/src/xrpld/overlay/Slot.h
@@ -82,7 +82,7 @@ class Slot final
 private:
     friend class Slots<ClockType>;
     using id_t = Peer::id_t;
-    using time_point = typename ClockType::time_point;
+    using time_point = ClockType::time_point;
 
     // a callback to report ignored squelches
     using ignored_squelch_callback = std::function<void()>;
@@ -217,7 +217,7 @@ private:
     std::uint16_t reachedThreshold_{0};
 
     // last time peers were selected, used to age the slot
-    typename ClockType::time_point lastSelected_;
+    ClockType::time_point lastSelected_;
 
     SlotState state_{SlotState::Counting};  // slot's state
     SquelchHandler const& handler_;         // squelch/unsquelch handler
@@ -483,7 +483,7 @@ Slot<ClockType>::notInState(PeerState state) const
 }
 
 template <typename ClockType>
-std::set<typename Peer::id_t>
+std::set<Peer::id_t>
 Slot<ClockType>::getSelected() const
 {
     std::set<id_t> r;
@@ -496,7 +496,7 @@ Slot<ClockType>::getSelected() const
 }
 
 template <typename ClockType>
-std::unordered_map<typename Peer::id_t, std::tuple<PeerState, uint16_t, uint32_t, uint32_t>>
+std::unordered_map<Peer::id_t, std::tuple<PeerState, uint16_t, uint32_t, uint32_t>>
 Slot<ClockType>::getPeers() const
 {
     using namespace std::chrono;
@@ -526,8 +526,8 @@ Slot<ClockType>::getPeers() const
 template <typename ClockType>
 class Slots final
 {
-    using time_point = typename ClockType::time_point;
-    using id_t = typename Peer::id_t;
+    using time_point = ClockType::time_point;
+    using id_t = Peer::id_t;
     using messages = beast::aged_unordered_map<
         uint256,
         std::unordered_set<Peer::id_t>,
@@ -600,7 +600,7 @@ public:
         PublicKey const& validator,
         id_t id,
         protocol::MessageType type,
-        typename Slot<ClockType>::ignored_squelch_callback callback);
+        Slot<ClockType>::ignored_squelch_callback callback);
 
     /** Check if peers stopped relaying messages
      * and if slots stopped receiving messages from the validator.
@@ -651,9 +651,8 @@ public:
     /** Get peers info. Return map of peer's state, count, and squelch
      * expiration milliseconds.
      */
-    std::
-        unordered_map<typename Peer::id_t, std::tuple<PeerState, uint16_t, uint32_t, std::uint32_t>>
-        getPeers(PublicKey const& validator)
+    std::unordered_map<Peer::id_t, std::tuple<PeerState, uint16_t, uint32_t, std::uint32_t>>
+    getPeers(PublicKey const& validator)
     {
         auto const& it = slots_.find(validator);
         if (it != slots_.end())
@@ -742,7 +741,7 @@ Slots<ClockType>::updateSlotAndSquelch(
     PublicKey const& validator,
     id_t id,
     protocol::MessageType type,
-    typename Slot<ClockType>::ignored_squelch_callback callback)
+    Slot<ClockType>::ignored_squelch_callback callback)
 {
     if (!addPeerMessage(key, id))
         return;
diff --git a/src/xrpld/overlay/Squelch.h b/src/xrpld/overlay/Squelch.h
index b509f293c2..96d8c26f1d 100644
--- a/src/xrpld/overlay/Squelch.h
+++ b/src/xrpld/overlay/Squelch.h
@@ -14,7 +14,7 @@ namespace xrpl::reduce_relay {
 template <typename ClockType>
 class Squelch
 {
-    using time_point = typename ClockType::time_point;
+    using time_point = ClockType::time_point;
 
 public:
     explicit Squelch(beast::Journal journal) : journal_(journal)
diff --git a/src/xrpld/overlay/detail/PeerImp.h b/src/xrpld/overlay/detail/PeerImp.h
index 26d7e0a832..28fb6b33a4 100644
--- a/src/xrpld/overlay/detail/PeerImp.h
+++ b/src/xrpld/overlay/detail/PeerImp.h
@@ -293,7 +293,7 @@ public:
     /** Send a set of PeerFinder endpoints as a protocol message. */
     template <
         class FwdIt,
-        class = typename std::enable_if_t<
+        class = std::enable_if_t<
             std::is_same_v<typename std::iterator_traits<FwdIt>::value_type, PeerFinder::Endpoint>>>
     void
     sendEndpoints(FwdIt first, FwdIt last);
diff --git a/src/xrpld/overlay/detail/ZeroCopyStream.h b/src/xrpld/overlay/detail/ZeroCopyStream.h
index d8d311105d..f77f266321 100644
--- a/src/xrpld/overlay/detail/ZeroCopyStream.h
+++ b/src/xrpld/overlay/detail/ZeroCopyStream.h
@@ -17,7 +17,7 @@ template <class Buffers>
 class ZeroCopyInputStream : public ::google::protobuf::io::ZeroCopyInputStream
 {
 private:
-    using iterator = typename Buffers::const_iterator;
+    using iterator = Buffers::const_iterator;
     using const_buffer = boost::asio::const_buffer;
 
     google::protobuf::int64 count_ = 0;
@@ -110,8 +110,8 @@ template <class Streambuf>
 class ZeroCopyOutputStream : public ::google::protobuf::io::ZeroCopyOutputStream
 {
 private:
-    using buffers_type = typename Streambuf::mutable_buffers_type;
-    using iterator = typename buffers_type::const_iterator;
+    using buffers_type = Streambuf::mutable_buffers_type;
+    using iterator = buffers_type::const_iterator;
     using mutable_buffer = boost::asio::mutable_buffer;
 
     Streambuf& streambuf_;
diff --git a/src/xrpld/peerfinder/detail/Checker.h b/src/xrpld/peerfinder/detail/Checker.h
index 8ab084830c..2f324bf8b6 100644
--- a/src/xrpld/peerfinder/detail/Checker.h
+++ b/src/xrpld/peerfinder/detail/Checker.h
@@ -34,8 +34,8 @@ private:
     template <class Handler>
     struct AsyncOp : BasicAsyncOp
     {
-        using socket_type = typename Protocol::socket;
-        using endpoint_type = typename Protocol::endpoint;
+        using socket_type = Protocol::socket;
+        using endpoint_type = Protocol::endpoint;
 
         Checker& checker;
         socket_type socket;
@@ -57,8 +57,8 @@ private:
 
     //--------------------------------------------------------------------------
 
-    using list_type = typename boost::intrusive::
-        make_list<BasicAsyncOp, boost::intrusive::constant_time_size<true>>::type;
+    using list_type =
+        boost::intrusive::make_list<BasicAsyncOp, boost::intrusive::constant_time_size<true>>::type;
 
     std::mutex mutex_;
     std::condition_variable cond_;
diff --git a/src/xrpld/peerfinder/detail/Livecache.h b/src/xrpld/peerfinder/detail/Livecache.h
index 84efcb7bd1..c5f04be90a 100644
--- a/src/xrpld/peerfinder/detail/Livecache.h
+++ b/src/xrpld/peerfinder/detail/Livecache.h
@@ -65,12 +65,12 @@ public:
         };
 
     public:
-        using iterator = boost::transform_iterator<Transform, typename list_type::const_iterator>;
+        using iterator = boost::transform_iterator<Transform, list_type::const_iterator>;
 
         using const_iterator = iterator;
 
         using reverse_iterator =
-            boost::transform_iterator<Transform, typename list_type::const_reverse_iterator>;
+            boost::transform_iterator<Transform, list_type::const_reverse_iterator>;
 
         using const_reverse_iterator = reverse_iterator;
 
@@ -132,7 +132,7 @@ public:
         }
 
     private:
-        explicit Hop(typename beast::MaybeConst<IsConst, list_type>::type& list) : list_(list)
+        explicit Hop(beast::MaybeConst<IsConst, list_type>::type& list) : list_(list)
         {
         }
 
@@ -145,7 +145,7 @@ protected:
     // Work-around to call Hop's private constructor from Livecache
     template <bool IsConst>
     static Hop<IsConst>
-    makeHop(typename beast::MaybeConst<IsConst, list_type>::type& list)
+    makeHop(beast::MaybeConst<IsConst, list_type>::type& list)
     {
         return Hop<IsConst>(list);
     }
@@ -208,30 +208,29 @@ public:
         template <bool IsConst>
         struct Transform
         {
-            using first_argument = typename lists_type::value_type;
+            using first_argument = lists_type::value_type;
             using result_type = Hop<IsConst>;
 
             explicit Transform() = default;
 
             Hop<IsConst>
-            operator()(typename beast::MaybeConst<IsConst, typename lists_type::value_type>::type&
-                           list) const
+            operator()(beast::MaybeConst<IsConst, lists_type::value_type>::type& list) const
             {
                 return makeHop<IsConst>(list);
             }
         };
 
     public:
-        using iterator = boost::transform_iterator<Transform<false>, typename lists_type::iterator>;
+        using iterator = boost::transform_iterator<Transform<false>, lists_type::iterator>;
 
         using const_iterator =
-            boost::transform_iterator<Transform<true>, typename lists_type::const_iterator>;
+            boost::transform_iterator<Transform<true>, lists_type::const_iterator>;
 
         using reverse_iterator =
-            boost::transform_iterator<Transform<false>, typename lists_type::reverse_iterator>;
+            boost::transform_iterator<Transform<false>, lists_type::reverse_iterator>;
 
         using const_reverse_iterator =
-            boost::transform_iterator<Transform<true>, typename lists_type::const_reverse_iterator>;
+            boost::transform_iterator<Transform<true>, lists_type::const_reverse_iterator>;
 
         iterator
         begin()
@@ -338,7 +337,7 @@ public:
     }
 
     /** Returns the number of entries in the cache. */
-    typename cache_type::size_type
+    cache_type::size_type
     size() const
     {
         return cache_.size();
diff --git a/src/xrpld/peerfinder/detail/Logic.h b/src/xrpld/peerfinder/detail/Logic.h
index 815858cf00..55cce506ba 100644
--- a/src/xrpld/peerfinder/detail/Logic.h
+++ b/src/xrpld/peerfinder/detail/Logic.h
@@ -980,7 +980,7 @@ public:
     /** Adds eligible Fixed addresses for outbound attempts. */
     template <class Container>
     void
-    getFixed(std::size_t needed, Container& c, typename ConnectHandouts::Squelches& squelches)
+    getFixed(std::size_t needed, Container& c, ConnectHandouts::Squelches& squelches)
     {
         auto const now(clock.now());
         for (auto iter = fixed_.begin(); needed && iter != fixed_.end(); ++iter)
diff --git a/src/xrpld/rpc/detail/RPCCall.cpp b/src/xrpld/rpc/detail/RPCCall.cpp
index f405ffe4de..123b9fc7a5 100644
--- a/src/xrpld/rpc/detail/RPCCall.cpp
+++ b/src/xrpld/rpc/detail/RPCCall.cpp
@@ -1589,7 +1589,7 @@ struct RPCCallImp
 
             jvResult["result"] = jvReply;
 
-            (callbackFuncP)(jvResult);
+            callbackFuncP(jvResult);
         }
 
         return false;
diff --git a/src/xrpld/rpc/handlers/admin/keygen/WalletPropose.cpp b/src/xrpld/rpc/handlers/admin/keygen/WalletPropose.cpp
index c783319049..4b5f1821e3 100644
--- a/src/xrpld/rpc/handlers/admin/keygen/WalletPropose.cpp
+++ b/src/xrpld/rpc/handlers/admin/keygen/WalletPropose.cpp
@@ -39,7 +39,7 @@ estimateEntropy(std::string const& input)
     {
         (void)_;
         auto x = f / input.length();
-        se += (x)*log2(x);
+        se += x * log2(x);
     }
 
     // We multiply it by the length, to get an estimate of
diff --git a/src/xrpld/rpc/json_body.h b/src/xrpld/rpc/json_body.h
index 4520a8bf39..5c4c56cef8 100644
--- a/src/xrpld/rpc/json_body.h
+++ b/src/xrpld/rpc/json_body.h
@@ -22,7 +22,7 @@ struct JsonBody
         dynamic_buffer_type buffer_;
 
     public:
-        using const_buffers_type = typename dynamic_buffer_type::const_buffers_type;
+        using const_buffers_type = dynamic_buffer_type::const_buffers_type;
 
         using is_deferred = std::false_type;
 

From 556d62a0deee94cc55b2f9cfb29e29dd7926aa1c Mon Sep 17 00:00:00 2001
From: Michael Legleux <legleux@users.noreply.github.com>
Date: Wed, 24 Jun 2026 16:53:46 -0700
Subject: [PATCH 009/100] build: Align xrpld RPM packaging with DEB package
 (#7529)

---
 .github/workflows/reusable-package.yml |  20 +---
 cmake/XrplPackaging.cmake              |   1 -
 cspell.config.yaml                     |   1 +
 package/README.md                      | 159 ++++++++++++++++---------
 package/build_pkg.sh                   | 148 ++++++++++++-----------
 package/rpm/xrpld.spec                 |  22 +++-
 package/shared/50-xrpld.preset         |   2 -
 7 files changed, 203 insertions(+), 150 deletions(-)
 delete mode 100644 package/shared/50-xrpld.preset

diff --git a/.github/workflows/reusable-package.yml b/.github/workflows/reusable-package.yml
index eed4bfc4a3..249e807592 100644
--- a/.github/workflows/reusable-package.yml
+++ b/.github/workflows/reusable-package.yml
@@ -39,23 +39,8 @@ jobs:
         working-directory: .github/scripts/strategy-matrix
         run: ./generate.py --packaging >>"${GITHUB_OUTPUT}"
 
-  generate-version:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          sparse-checkout: |
-            .github/actions/generate-version
-            src/libxrpl/protocol/BuildInfo.cpp
-      - name: Generate version
-        id: version
-        uses: ./.github/actions/generate-version
-
   package:
-    needs: [generate-matrix, generate-version]
+    needs: [generate-matrix]
     if: ${{ github.event.repository.visibility == 'public' }}
     strategy:
       fail-fast: false
@@ -82,14 +67,13 @@ jobs:
 
       - name: Build package
         env:
-          PKG_VERSION: ${{ needs.generate-version.outputs.version }}
           PKG_RELEASE: ${{ inputs.pkg_release }}
         run: ./package/build_pkg.sh
 
       - name: Upload package artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: ${{ matrix.artifact_name }}-pkg-${{ needs.generate-version.outputs.version }}
+          name: ${{ matrix.artifact_name }}-pkg
           path: |
             ${{ env.BUILD_DIR }}/debbuild/*.deb
             ${{ env.BUILD_DIR }}/debbuild/*.ddeb
diff --git a/cmake/XrplPackaging.cmake b/cmake/XrplPackaging.cmake
index fe885c200c..8e3861925d 100644
--- a/cmake/XrplPackaging.cmake
+++ b/cmake/XrplPackaging.cmake
@@ -28,7 +28,6 @@ endif()
 set(package_env
     SRC_DIR=${CMAKE_SOURCE_DIR}
     BUILD_DIR=${CMAKE_BINARY_DIR}
-    PKG_VERSION=${xrpld_version}
     PKG_RELEASE=${pkg_release}
 )
 
diff --git a/cspell.config.yaml b/cspell.config.yaml
index 0d38c4be7b..8273df6c98 100644
--- a/cspell.config.yaml
+++ b/cspell.config.yaml
@@ -301,6 +301,7 @@ words:
   - txs
   - ubsan
   - UBSAN
+  - ufdio
   - umant
   - unacquired
   - unambiguity
diff --git a/package/README.md b/package/README.md
index 63c2ab88fc..4b78106c4c 100644
--- a/package/README.md
+++ b/package/README.md
@@ -6,10 +6,10 @@ This directory contains all files needed to build RPM and Debian packages for `x
 
 ```
 package/
-  build_pkg.sh      Staging and build script (called by CMake targets and CI)
+  build_pkg.sh      Staging and build script (called by the CMake `package` target and CI)
   rpm/
-    xrpld.spec      RPM spec (xrpld_version/pkg_release passed via rpmbuild --define)
-  debian/           Debian control files (control, rules, install, links, conffiles, ...)
+    xrpld.spec      RPM spec
+  debian/           Debian control files (control, rules, copyright, xrpld.docs, xrpld.links, source/format)
   shared/
     xrpld.service       systemd unit file (used by both RPM and DEB)
     xrpld.sysusers      sysusers.d config (used by both RPM and DEB)
@@ -21,21 +21,19 @@ package/
 
 Packaging targets and their container images are declared in
 [`.github/scripts/strategy-matrix/linux.json`](../.github/scripts/strategy-matrix/linux.json)
-inside `package_configs` configurations. Today only
-`linux/amd64` is emitted. The package format
-(deb or rpm) is inferred at build time from the container's package manager
-(`apt-get` -> deb, `dnf`/`yum` -> rpm). The image tag is composed as
-`ghcr.io/xrplf/xrpld/packaging-<distro>:sha-<git_sha>` —
-the same scheme used by `reusable-build-test.yml`. Bump `image_sha` in
-`linux.json` and both CI and local builds pick up the new image with no
-workflow edits.
+under `package_configs`, one entry per distro. Today only `linux/amd64` is
+emitted. Each entry pins its full container image in an `image` field; to move
+to a new image, edit that field and both CI and local builds pick it up. The
+package format (deb or rpm) is inferred at build time from the container's
+package manager (`apt-get` -> deb, `dnf`/`yum` -> rpm).
 
-| Package type | Image (derived from `linux.json`)                    | Tool required                                                   |
-| ------------ | ---------------------------------------------------- | --------------------------------------------------------------- |
-| RPM          | `ghcr.io/xrplf/xrpld/packaging-rhel:sha-<git_sha>`   | `rpmbuild`                                                      |
-| DEB          | `ghcr.io/xrplf/xrpld/packaging-debian:sha-<git_sha>` | `dpkg-buildpackage`, `debhelper (>= 13)`, `dh-sequence-systemd` |
+| Package type | Image (`package_configs.<distro>[].image` in `linux.json`) | Tools required                                      |
+| ------------ | ---------------------------------------------------------- | --------------------------------------------------- |
+| RPM          | `ghcr.io/xrplf/xrpld/packaging-rhel:sha-<sha>`             | `rpmbuild`                                          |
+| DEB          | `ghcr.io/xrplf/xrpld/packaging-debian:sha-<sha>`           | `dpkg-buildpackage`, debhelper with compat level 13 |
 
-To print the exact image tags for the current `linux.json`:
+To print the full packaging matrix (artifact names and images) for the current
+`linux.json`:
 
 ```bash
 ./.github/scripts/strategy-matrix/generate.py --packaging
@@ -46,12 +44,13 @@ To print the exact image tags for the current `linux.json`:
 ### Via CI
 
 Caller workflows (`on-pr.yml`, `on-tag.yml`, `on-trigger.yml`) call
-`reusable-strategy-matrix.yml` with `mode: packaging` to generate the matrix of
-`{artifact_name, os}` entries, then fan out to
-`reusable-package.yml` per entry. That workflow downloads the pre-built `xrpld`
-binary artifact, detects the package format from the container, and calls
-`build_pkg.sh` directly — no CMake configure or build step is needed inside
-the packaging job.
+`reusable-package.yml`. That workflow generates its own packaging matrix from
+`package_configs` in `linux.json` (via `generate.py --packaging`) and fans out
+one job per distro. Each job downloads the pre-built `xrpld` binary artifact and
+runs in that distro's container, so the package format follows from the
+container's package manager. The packaging script derives the package version
+from the downloaded binary's `xrpld --version` output; no CMake configure or
+build step is needed inside the packaging job.
 
 ### Locally (mirrors CI)
 
@@ -60,22 +59,19 @@ inside the same container CI uses. The image tag is derived from `linux.json`
 so you don't need to hardcode a SHA.
 
 ```bash
-# From the repo root. Pick any image flagged with `"package": true` in
-# linux.json; the package format is inferred from the container's package
-# manager. Example for the rpm-producing image:
-IMAGE=$(jq -r '
-  .os | map(select(.package == true))[0] |
-  "ghcr.io/xrplf/ci/\(.distro_name)-\(.distro_version):\(.compiler_name)-\(.compiler_version)-sha-\(.image_sha)"
-' .github/scripts/strategy-matrix/linux.json)
+# From the repo root. Each distro's container image is the `image` field of its
+# package_configs entry in linux.json; the package format is inferred from the
+# container's package manager. Example for the rpm-producing image (use
+# .package_configs.debian[0].image for the deb image):
+IMAGE=$(jq -r '.package_configs.rhel[0].image' .github/scripts/strategy-matrix/linux.json)
 
-VERSION=2.4.0-local
 PKG_RELEASE=1
 
 docker run --rm \
     -v "$(pwd):/src" \
     -w /src \
-    "$IMAGE" \
-    ./package/build_pkg.sh --pkg-version "$VERSION" --pkg-release "$PKG_RELEASE"
+    "${IMAGE}" \
+    ./package/build_pkg.sh --pkg-release "${PKG_RELEASE}"
 
 # Output:
 #   build/debbuild/*.deb         (DEB + dbgsym .ddeb)
@@ -91,41 +87,73 @@ needed, but the host toolchain replaces the pinned CI image:
 ```bash
 cmake \
     -Dxrpld=ON \
-    -Dxrpld_version=2.4.0-local \
+    -Dpkg_release=1 \
     -Dtests=OFF \
     ..
 
 cmake --build . --target package # deb on Debian/Ubuntu, rpm on RHEL
 ```
 
-The `cmake/XrplPackaging.cmake` module defines the target only if at least one
-of `rpmbuild` / `dpkg-buildpackage` is present; `build_pkg.sh` then infers the
-package format from the host's package manager. The packaging script installs
-to FHS-standard paths (`/usr/bin`, `/etc/xrpld`, etc.) regardless of
+The `cmake/XrplPackaging.cmake` module defines the `package` target only if at
+least one of `rpmbuild` / `dpkg-buildpackage` is present; `build_pkg.sh` then
+infers the package format from the host's package manager. The packaging script
+installs to FHS-standard paths (`/usr/bin`, `/etc/xrpld`, etc.) regardless of
 `CMAKE_INSTALL_PREFIX`.
 
+The package version is not a CMake input on this path: `build_pkg.sh` derives it
+from the just-built `xrpld` binary's `xrpld --version` output. The package
+release defaults to 1 and is overridable with `-Dpkg_release=N`.
+
 ## How `build_pkg.sh` works
 
-`build_pkg.sh` accepts long-form flags, each of which can also be set via an
-environment variable. Flags override env vars; env vars override the built-in
-defaults. Run `./package/build_pkg.sh --help` for the same table:
+`build_pkg.sh` derives the `xrpld` software version from
+`${BUILD_DIR}/xrpld --version` in both package formats.
 
-| Flag                       | Env var             | Default                       | Purpose                             |
-| -------------------------- | ------------------- | ----------------------------- | ----------------------------------- |
-| `--src-dir DIR`            | `SRC_DIR`           | `$PWD`                        | repo root                           |
-| `--build-dir DIR`          | `BUILD_DIR`         | `$PWD/build`                  | directory holding pre-built `xrpld` |
-| `--pkg-version STR`        | `PKG_VERSION`       | parsed from `xrpld --version` | version string, e.g. `3.2.0-b1`     |
-| `--pkg-release N`          | `PKG_RELEASE`       | `1`                           | package release number              |
-| `--source-date-epoch SECS` | `SOURCE_DATE_EPOCH` | latest git commit ctime       | reproducibility timestamp           |
+The binary's version is already SemVer-validated by `BuildInfo`.
+`build_pkg.sh` converts pre-release versions such as `3.2.0-b1` or
+`3.2.0-rc1` from `-` to `~` for package metadata so pre-releases sort before
+the final release. If that normalized package version still contains `-`,
+packaging fails because RPM forbids `-` in `Version`, and Debian uses `-` as
+the upstream/revision separator.
+
+`pkg_version` is the normalized package metadata version derived inside
+`build_pkg.sh` from the binary-reported `xrpld` version (`-` pre-release
+separator converted to `~`). It is not a separate user input.
+
+`PKG_RELEASE` is a different value: the package release iteration for that
+`xrpld` version. RPM receives the normalized `pkg_version` and `PKG_RELEASE` as
+the `pkg_version` and `pkg_release` macros for its `Version` and `Release`
+values; DEB writes them as `${pkg_version}-${PKG_RELEASE}` in
+`debian/changelog`.
+
+With `PKG_RELEASE=1`, the package metadata becomes:
+
+| Input version      | RPM version/release          | Debian version       |
+| ------------------ | ---------------------------- | -------------------- |
+| `3.2.0`            | `3.2.0-1%{?dist}`            | `3.2.0-1`            |
+| `3.2.0-b0+abc1234` | `3.2.0~b0+abc1234-1%{?dist}` | `3.2.0~b0+abc1234-1` |
+| `3.2.0-b1`         | `3.2.0~b1-1%{?dist}`         | `3.2.0~b1-1`         |
+| `3.2.0-rc1`        | `3.2.0~rc1-1%{?dist}`        | `3.2.0~rc1-1`        |
+
+The Debian changelog entry carries the repository component: final releases use
+`stable`, `b0` builds, including `b0+metadata`, use `develop`, and `bN`/`rcN`
+pre-releases use `unstable`.
+Build metadata on a final release, such as `3.2.0+abc123`, is rejected.
+
+The RPM path intentionally uses `~` in `Version`, matching the Debian
+pre-release ordering convention, so RPM filenames/NVRs begin with forms like
+`xrpld-3.2.0~b1-...` and `xrpld-3.2.0~rc1-...` instead of encoding
+pre-releases with an older `0.<release>.<suffix>` RPM `Release` value.
 
 The package format (`deb` or `rpm`) is inferred from the host's package
 manager (`apt-get` -> deb, `dnf`/`yum` -> rpm). Hosts without one of those
 fail early.
 
 Flags are for explicit invocation; environment variables are intended for
-CMake/systemd/CI integration. The CI workflow and the CMake `package` target
-both invoke `build_pkg.sh` with no flags, configuring it entirely via env
-(see `cmake/XrplPackaging.cmake`).
+CMake/CI integration. The CI workflow and the CMake `package` target both invoke
+`build_pkg.sh` with no flags; CMake supplies `SRC_DIR`, `BUILD_DIR`, and
+`PKG_RELEASE` via env, while CI supplies `BUILD_DIR` and `PKG_RELEASE` via env
+and lets the script use defaults for the rest.
 
 It resolves `SRC_DIR` and `BUILD_DIR` to absolute paths, then calls
 `stage_common()` to copy the binary, config files, and shared support files
@@ -134,18 +162,32 @@ into the staging area, and invokes the platform build tool.
 ### RPM
 
 1. Creates the standard `rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}` tree inside the build directory.
-2. Copies `xrpld.spec` and all source files (binary, configs, service files) into `SOURCES/`.
-3. Runs `rpmbuild -bb --define "xrpld_version ..." --define "pkg_release ..."`. The spec uses manual `install` commands to place files.
+2. Copies `xrpld.spec` and all shared source files (binary, configs, service files) into `SOURCES/`.
+3. Runs `rpmbuild -bb`, passing the normalized package metadata version as the
+   `pkg_version` RPM macro and `PKG_RELEASE` as the `pkg_release` RPM macro.
+   The spec uses manual `install` commands to place files, disables `dwz`, and
+   writes uncompressed RPM payloads while generating debuginfo packages.
 4. Output: `rpmbuild/RPMS/x86_64/xrpld-*.rpm`
 
+The uncompressed RPM payload setting is intentionally unconditional for
+generated RPMs. It trades larger RPM artifacts for much shorter package
+build/validation time, which keeps RPM package validation in the same rough time
+class as Debian package validation.
+
+RPM upgrades intentionally do not restart a running `xrpld` service. The spec
+uses `%systemd_postun`, matching Debian's `dh_installsystemd
+--no-stop-on-upgrade` behavior; operators pick up the new binary on the next
+service restart.
+
 ### DEB
 
 1. Creates a staging source tree at `debbuild/source/` inside the build directory.
 2. Stages the binary, configs, `README.md`, and `LICENSE.md`.
 3. Copies `package/debian/` control files into `debbuild/source/debian/`.
 4. Copies shared service/sysusers/tmpfiles into `debian/` where `dh_installsystemd`, `dh_installsysusers`, and `dh_installtmpfiles` pick them up automatically.
-5. Generates a minimal `debian/changelog` (pre-release versions use `~` instead of `-`).
-6. Runs `dpkg-buildpackage -b --no-sign`. `debian/rules` uses manual `install` commands.
+5. Generates a minimal `debian/changelog` using `${pkg_version}-${PKG_RELEASE}`,
+   where `pkg_version` is derived from the binary-reported `xrpld` version.
+6. Runs `dpkg-buildpackage -b --no-sign -d` (`-d` skips the build-dependency check, since the binary is already built). `debian/rules` uses manual `install` commands.
 7. Output: `debbuild/*.deb` and `debbuild/*.ddeb` (dbgsym package)
 
 ## Post-build verification
@@ -161,11 +203,14 @@ rpm -qlp rpmbuild/RPMS/x86_64/*.rpm
 
 ## Reproducibility
 
-The following environment variables improve build reproducibility. They are not
-set automatically by `build_pkg.sh`; set them manually if needed:
+`build_pkg.sh` already defaults `SOURCE_DATE_EPOCH` to the latest git commit
+time, or the current time outside a git tree, and exports it (override with
+`--source-date-epoch` / `SOURCE_DATE_EPOCH`); the RPM spec clamps file
+modification times to it via `%build_mtime_policy`. The remaining variables
+below further improve reproducibility but are _not_ set by the script — export
+them yourself if needed:
 
 ```bash
-export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
 export TZ=UTC
 export LC_ALL=C.UTF-8
 export GZIP=-n
diff --git a/package/build_pkg.sh b/package/build_pkg.sh
index e2ec8fee3d..3684fc096a 100755
--- a/package/build_pkg.sh
+++ b/package/build_pkg.sh
@@ -3,20 +3,18 @@ set -euo pipefail
 
 # Build an RPM or Debian package from a pre-built xrpld binary.
 #
-# Flags override env vars; env vars override defaults. Env vars are intended
-# for CMake/systemd/CI integration; flags are for explicit invocation.
+# Flags override env vars; env vars override defaults.
 
 usage() {
     cat <<'EOF'
 Usage: build_pkg.sh [options]
 
 Options (each can also be set via the env var shown):
-  --src-dir DIR             repo root                  [SRC_DIR;           default: $PWD]
-  --build-dir DIR           directory holding xrpld    [BUILD_DIR;         default: $PWD/build]
-  --pkg-version STR         version, e.g. 3.2.0-b1     [PKG_VERSION;       default: parsed from xrpld --version]
-  --pkg-release N           package release number     [PKG_RELEASE;       default: 1]
-  --source-date-epoch SECS  reproducibility timestamp  [SOURCE_DATE_EPOCH; default: latest git commit ctime]
-  -h, --help                show this help and exit
+  --src-dir DIR            repo root                 [SRC_DIR;           default: ${PWD}]
+  --build-dir DIR          directory holding xrpld   [BUILD_DIR;         default: ${PWD}/build]
+  --pkg-release N          package release iteration [PKG_RELEASE;       default: 1]
+  --source-date-epoch SECS reproducibility timestamp [SOURCE_DATE_EPOCH; latest git ctime; fallback: current time]
+  -h, --help               show this help and exit
 EOF
 }
 
@@ -30,8 +28,7 @@ need_arg() {
 # Seed from env. CLI parsing below overrides these directly.
 SRC_DIR="${SRC_DIR:-}"
 BUILD_DIR="${BUILD_DIR:-}"
-PKG_VERSION="${PKG_VERSION:-}"
-PKG_RELEASE="${PKG_RELEASE:-}"
+PKG_RELEASE="${PKG_RELEASE:-1}"
 SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-}"
 
 while [[ $# -gt 0 ]]; do
@@ -46,11 +43,6 @@ while [[ $# -gt 0 ]]; do
             BUILD_DIR="$2"
             shift 2
             ;;
-        --pkg-version)
-            need_arg "$@"
-            PKG_VERSION="$2"
-            shift 2
-            ;;
         --pkg-release)
             need_arg "$@"
             PKG_RELEASE="$2"
@@ -74,19 +66,61 @@ while [[ $# -gt 0 ]]; do
 done
 
 SRC_DIR="$(cd "${SRC_DIR:-${PWD}}" && pwd)"
-BUILD_DIR="$(cd "${BUILD_DIR:-${PWD}/build}" && pwd)"
-PKG_RELEASE="${PKG_RELEASE:-1}"
-
-if [[ -z "${PKG_VERSION}" ]]; then
-    PKG_VERSION="$("${BUILD_DIR}/xrpld" --version | awk 'NR==1 {print $3; exit}')"
+BUILD_DIR="${BUILD_DIR:-${PWD}/build}"
+if [[ ! -d "${BUILD_DIR}" ]]; then
+    echo "build_pkg.sh: build directory not found: ${BUILD_DIR}" >&2
+    echo "Build xrpld before packaging, or set BUILD_DIR to the directory containing xrpld." >&2
+    exit 1
 fi
+BUILD_DIR="$(cd "${BUILD_DIR}" && pwd)"
 
-if [[ -z "${PKG_VERSION}" ]]; then
-    echo "PKG_VERSION is empty (not provided and could not be derived)." >&2
+xrpld_binary="${BUILD_DIR}/xrpld"
+if [[ ! -x "${xrpld_binary}" ]]; then
+    echo "build_pkg.sh: expected executable xrpld binary at ${xrpld_binary}." >&2
+    echo "Build xrpld before packaging, or set BUILD_DIR to the directory containing xrpld." >&2
     exit 1
 fi
 
-VERSION="${PKG_VERSION}"
+xrpld_version="$("${xrpld_binary}" --version | awk 'NR == 1 { print $3 }')"
+
+if [[ -z "${xrpld_version}" ]]; then
+    echo "build_pkg.sh: unable to derive xrpld version from ${xrpld_binary} --version." >&2
+    exit 1
+fi
+
+# The version as the package formats consume it: identical to xrpld_version
+# except a pre-release uses '~' (3.2.0-b1 -> 3.2.0~b1), which also sorts before
+# the final 3.2.0; a no-op for a final release. Lowercase = derived internally,
+# not an input (cf. pkg_type).
+pkg_version="${xrpld_version}"
+pre_release=""
+if [[ "${xrpld_version}" == *-* ]]; then
+    pre_release="${xrpld_version#*-}"
+    pkg_version="${xrpld_version%%-*}~${pre_release}"
+fi
+
+# BuildInfo already SemVer-validates the binary's version. Packaging adds one
+# narrower constraint: after pre-release normalization, the package version must
+# not contain '-' because RPM forbids it in Version and Debian uses it as the
+# upstream/revision separator.
+if [[ "${pkg_version}" == *-* ]]; then
+    echo "build_pkg.sh: unsupported xrpld version '${xrpld_version}'." >&2
+    echo "Package version '${pkg_version}' cannot contain '-'." >&2
+    echo "Use a single-token pre-release like 3.2.0-b1 or 3.2.0-rc2." >&2
+    exit 1
+fi
+
+if [[ -z "${pre_release}" && "${xrpld_version}" == *+* ]]; then
+    echo "build_pkg.sh: unsupported xrpld version '${xrpld_version}'." >&2
+    echo "Build metadata is only supported on bN/rcN pre-releases." >&2
+    exit 1
+fi
+
+if [[ -n "${pre_release}" && ! "${pre_release}" =~ ^(b0|b[1-9][0-9]*|rc[0-9]+)(\+.*)?$ ]]; then
+    echo "build_pkg.sh: unsupported xrpld pre-release '${pre_release}'." >&2
+    echo "Use bN or rcN, e.g. 3.2.0-b1 or 3.2.0-rc2." >&2
+    exit 1
+fi
 
 if command -v apt-get >/dev/null 2>&1; then
     pkg_type=deb
@@ -98,32 +132,15 @@ else
 fi
 
 if [[ -z "${SOURCE_DATE_EPOCH}" ]]; then
-    if git -C "$SRC_DIR" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-        SOURCE_DATE_EPOCH="$(git -C "$SRC_DIR" log -1 --format=%ct)"
+    if git -C "${SRC_DIR}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+        SOURCE_DATE_EPOCH="$(git -C "${SRC_DIR}" log -1 --format=%ct)"
     else
         SOURCE_DATE_EPOCH="$(date +%s)"
     fi
 fi
 
 export SOURCE_DATE_EPOCH
-CHANGELOG_DATE="$(date -u -R -d "@$SOURCE_DATE_EPOCH")"
-
-# Split VERSION at the first '-' into base and optional pre-release suffix.
-# Examples: "3.2.0" -> ("3.2.0", ""); "3.2.0-b1" -> ("3.2.0", "b1").
-VER_BASE="${VERSION%%-*}"
-VER_SUFFIX="${VERSION#*-}"
-[[ "${VER_SUFFIX}" == "${VERSION}" ]] && VER_SUFFIX=""
-
-# Reject multi-segment suffixes (e.g. "beta-1", "rc1-15-gabc123"). Neither an
-# RPM Version nor a Debian upstream version may contain '-' (it's the NVR /
-# version-revision separator), and the convention here is single-token
-# suffixes like b1 or rc2. Fail early with a clear message rather than letting
-# the package tooling blow up or silently mangle dashes.
-if [[ "${VER_SUFFIX}" == *-* ]]; then
-    echo "build_pkg.sh: multi-segment pre-release in VERSION='${VERSION}' (suffix '${VER_SUFFIX}')." >&2
-    echo "Use single-token suffixes like 3.2.0-b1 or 3.2.0-rc2." >&2
-    exit 1
-fi
+CHANGELOG_DATE="$(date -u -R -d "@${SOURCE_DATE_EPOCH}")"
 
 SHARED="${SRC_DIR}/package/shared"
 DEBIAN_DIR="${SRC_DIR}/package/debian"
@@ -143,7 +160,6 @@ stage_common() {
     cp "${SHARED}/xrpld.sysusers" "${dest}/xrpld.sysusers"
     cp "${SHARED}/xrpld.tmpfiles" "${dest}/xrpld.tmpfiles"
     cp "${SHARED}/xrpld.logrotate" "${dest}/xrpld.logrotate"
-    cp "${SHARED}/50-xrpld.preset" "${dest}/50-xrpld.preset"
 }
 
 build_rpm() {
@@ -154,18 +170,11 @@ build_rpm() {
     cp "${SRC_DIR}/package/rpm/xrpld.spec" "${topdir}/SPECS/xrpld.spec"
     stage_common "${topdir}/SOURCES"
 
-    # Pre-releases use the modern rpm '~' convention (rpm >= 4.10): the suffix
-    # goes in Version (e.g. 3.2.0~b1), which rpmvercmp sorts *before* the final
-    # 3.2.0 — identical semantics to Debian's '~'. Release is just the package
-    # release number. This replaces the older "0.<release>.<suffix>" Release
-    # hack and keeps the RPM and DEB version strings symmetric.
-    local rpm_version="${VER_BASE}${VER_SUFFIX:+~${VER_SUFFIX}}"
-
     set -x
     rpmbuild -bb \
         --define "_topdir ${topdir}" \
-        --define "xrpld_version ${rpm_version}" \
-        --define "xrpld_release ${PKG_RELEASE}" \
+        --define "pkg_version ${pkg_version}" \
+        --define "pkg_release ${PKG_RELEASE}" \
         "${topdir}/SPECS/xrpld.spec"
 }
 
@@ -182,23 +191,26 @@ build_deb() {
     cp "${staging}/xrpld.tmpfiles" "${staging}/debian/xrpld.tmpfiles"
     cp "${staging}/xrpld.logrotate" "${staging}/debian/xrpld.logrotate"
 
-    # Debian '~' marks a pre-release; 3.2.0~b1 sorts before 3.2.0.
-    local deb_full_version="${VER_BASE}${VER_SUFFIX:+~${VER_SUFFIX}}-${PKG_RELEASE}"
-
-    # Derive release channel from the version suffix:
-    #   (none)      -> stable    (tagged release)
-    #   b0          -> develop   (develop-branch build)
-    #   b<N>, rc<N> -> unstable  (pre-release)
-    local deb_distribution
-    case "${VER_SUFFIX}" in
-        "") deb_distribution="stable" ;;
-        b0) deb_distribution="develop" ;;
-        *) deb_distribution="unstable" ;;
-    esac
+    # Choose the Debian repository component for this package.
+    #   3.2.0 -> stable, *-b0[+metadata] -> develop,
+    #   bN/rcN pre-releases -> unstable.
+    local deb_component
+    if [[ -z "${pre_release}" ]]; then
+        deb_component="stable"
+    elif [[ "${pre_release}" =~ ^b0(\+.*)?$ ]]; then
+        deb_component="develop"
+    elif [[ "${pre_release}" =~ ^(b[1-9][0-9]*|rc[0-9]+)(\+.*)?$ ]]; then
+        deb_component="unstable"
+    else
+        echo "build_pkg.sh: unsupported xrpld pre-release '${pre_release}'." >&2
+        echo "Use bN or rcN, e.g. 3.2.0-b1 or 3.2.0-rc2." >&2
+        exit 1
+    fi
 
+    # Debian version is <upstream>[~<pre>]-<pkg release>.
     cat >"${staging}/debian/changelog" <<EOF
-xrpld (${deb_full_version}) ${deb_distribution}; urgency=medium
-  * Release ${VERSION}.
+xrpld (${pkg_version}-${PKG_RELEASE}) ${deb_component}; urgency=medium
+  * Release ${xrpld_version}.
 
  -- XRPL Foundation <contact@xrplf.org>  ${CHANGELOG_DATE}
 EOF
diff --git a/package/rpm/xrpld.spec b/package/rpm/xrpld.spec
index 5595fd0d8d..61c2d61ec6 100644
--- a/package/rpm/xrpld.spec
+++ b/package/rpm/xrpld.spec
@@ -1,6 +1,14 @@
+%if "%{?pkg_version}" == ""
+%{error:pkg_version must be defined}
+%endif
+
+%if "%{?pkg_release}" == ""
+%{error:pkg_release must be defined}
+%endif
+
 Name:     xrpld
-Version:  %{xrpld_version}
-Release:  %{xrpld_release}%{?dist}
+Version:  %{pkg_version}
+Release:  %{pkg_release}%{?dist}
 Summary:  XRP Ledger daemon
 
 License:  ISC
@@ -11,6 +19,9 @@ BuildRequires: systemd-rpm-macros
 
 %undefine _debugsource_packages
 %debug_package
+# Intentionally trade larger RPM artifacts for faster package validation.
+%global _binary_payload w.ufdio
+%global _find_debuginfo_dwz_opts %{nil}
 
 %build_mtime_policy clamp_to_source_date_epoch
 
@@ -37,7 +48,10 @@ install -Dm0644 %{_sourcedir}/validators.txt       %{buildroot}%{_sysconfdir}/%{
 install -Dm0644 %{_sourcedir}/xrpld.service        %{buildroot}%{_unitdir}/xrpld.service
 install -Dm0644 %{_sourcedir}/xrpld.sysusers       %{buildroot}%{_sysusersdir}/xrpld.conf
 install -Dm0644 %{_sourcedir}/xrpld.tmpfiles       %{buildroot}%{_tmpfilesdir}/xrpld.conf
-install -Dm0644 %{_sourcedir}/50-xrpld.preset      %{buildroot}%{_presetdir}/50-xrpld.preset
+install -Dm0644 /dev/null %{buildroot}%{_presetdir}/50-xrpld.preset
+cat >%{buildroot}%{_presetdir}/50-xrpld.preset <<'EOF'
+enable xrpld.service
+EOF
 
 # Logrotate config
 install -Dm0644 %{_sourcedir}/xrpld.logrotate      %{buildroot}%{_sysconfdir}/logrotate.d/%{name}
@@ -62,7 +76,7 @@ systemd-tmpfiles --create %{_tmpfilesdir}/xrpld.conf || :
 %systemd_preun xrpld.service
 
 %postun
-%systemd_postun_with_restart xrpld.service
+%systemd_postun xrpld.service
 
 %files
 %license %{_docdir}/%{name}/LICENSE.md
diff --git a/package/shared/50-xrpld.preset b/package/shared/50-xrpld.preset
deleted file mode 100644
index bfbcd56577..0000000000
--- a/package/shared/50-xrpld.preset
+++ /dev/null
@@ -1,2 +0,0 @@
-# /usr/lib/systemd/system-preset/50-xrpld.preset
-enable xrpld.service

From 3097c157b6ca13d368eef8b03d26fa027b277a4c Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Thu, 25 Jun 2026 13:40:06 +0100
Subject: [PATCH 010/100] build: Switch to a new conan XRPLF remote (#7622)

---
 .github/actions/setup-conan/action.yml       |  2 +-
 .github/workflows/on-pr.yml                  |  4 +-
 .github/workflows/on-tag.yml                 |  4 +-
 .github/workflows/on-trigger.yml             |  4 +-
 .github/workflows/reusable-upload-recipe.yml | 20 ++----
 .github/workflows/upload-conan-deps.yml      |  6 +-
 BUILD.md                                     |  2 +-
 conan.lock                                   | 64 ++++++++++----------
 conan/lockfile/regenerate.sh                 |  2 +-
 conanfile.py                                 |  4 +-
 docs/build/advanced_conan.md                 |  2 +-
 11 files changed, 54 insertions(+), 60 deletions(-)

diff --git a/.github/actions/setup-conan/action.yml b/.github/actions/setup-conan/action.yml
index 0dd22f0d92..e8a548cfce 100644
--- a/.github/actions/setup-conan/action.yml
+++ b/.github/actions/setup-conan/action.yml
@@ -9,7 +9,7 @@ inputs:
   remote_url:
     description: "The URL of the Conan endpoint to use."
     required: false
-    default: https://conan.ripplex.io
+    default: https://conan.xrplf.org/repository/conan/
 
 runs:
   using: composite
diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 0c9eeda712..2ad0641863 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -154,8 +154,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   notify-clio:
     needs: upload-recipe
diff --git a/.github/workflows/on-tag.yml b/.github/workflows/on-tag.yml
index 42d5827cab..abedc13d69 100644
--- a/.github/workflows/on-tag.yml
+++ b/.github/workflows/on-tag.yml
@@ -20,8 +20,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   build-test:
     if: ${{ github.repository == 'XRPLF/rippled' }}
diff --git a/.github/workflows/on-trigger.yml b/.github/workflows/on-trigger.yml
index 063cdbff7f..5f018cb12c 100644
--- a/.github/workflows/on-trigger.yml
+++ b/.github/workflows/on-trigger.yml
@@ -98,8 +98,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   package:
     needs: build-test
diff --git a/.github/workflows/reusable-upload-recipe.yml b/.github/workflows/reusable-upload-recipe.yml
index a18f76796a..feeee0a621 100644
--- a/.github/workflows/reusable-upload-recipe.yml
+++ b/.github/workflows/reusable-upload-recipe.yml
@@ -14,7 +14,7 @@ on:
         description: "The URL of the Conan endpoint to use."
         required: false
         type: string
-        default: https://conan.ripplex.io
+        default: https://conan.xrplf.org/repository/conan/
 
     secrets:
       remote_username:
@@ -41,6 +41,10 @@ jobs:
   upload:
     runs-on: ubuntu-latest
     container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    env:
+      REMOTE_NAME: ${{ inputs.remote_name }}
+      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
+      CONAN_PASSWORD_XRPLF: ${{ secrets.remote_password }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -56,15 +60,9 @@ jobs:
           remote_url: ${{ inputs.remote_url }}
 
       - name: Log into Conan remote
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
-          REMOTE_USERNAME: ${{ secrets.remote_username }}
-          REMOTE_PASSWORD: ${{ secrets.remote_password }}
-        run: conan remote login "${REMOTE_NAME}" "${REMOTE_USERNAME}" --password "${REMOTE_PASSWORD}"
+        run: conan remote login "${REMOTE_NAME}" "${CONAN_LOGIN_USERNAME_XRPLF}" --password "${CONAN_PASSWORD_XRPLF}"
 
       - name: Upload Conan recipe (version)
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=${{ steps.version.outputs.version }}
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.version.outputs.version }}
@@ -73,8 +71,6 @@ jobs:
       # 'develop' branch, see on-trigger.yml.
       - name: Upload Conan recipe (develop)
         if: ${{ github.event_name == 'push' }}
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=develop
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/develop
@@ -83,8 +79,6 @@ jobs:
       # one of the 'release' branches, see on-pr.yml.
       - name: Upload Conan recipe (rc)
         if: ${{ github.event_name == 'pull_request' }}
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=rc
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/rc
@@ -93,8 +87,6 @@ jobs:
       # release, see on-tag.yml.
       - name: Upload Conan recipe (release)
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=release
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/release
diff --git a/.github/workflows/upload-conan-deps.yml b/.github/workflows/upload-conan-deps.yml
index 5d3712cf9e..92b72cf6a9 100644
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -34,7 +34,7 @@ on:
 
 env:
   CONAN_REMOTE_NAME: xrplf
-  CONAN_REMOTE_URL: https://conan.ripplex.io
+  CONAN_REMOTE_URL: https://conan.xrplf.org/repository/conan/
   NPROC_SUBTRACT: 2
 
 concurrency:
@@ -108,10 +108,12 @@ jobs:
 
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
-        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.CONAN_REMOTE_USERNAME }}" --password "${{ secrets.CONAN_REMOTE_PASSWORD }}"
+        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.NEXUS_REMOTE_USERNAME }}" --password "${{ secrets.NEXUS_REMOTE_PASSWORD }}"
 
       - name: Upload Conan packages
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
         env:
           FORCE_OPTION: ${{ github.event.inputs.force_upload == 'true' && '--force' || '' }}
+          CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+          CONAN_PASSWORD_XRPLF: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
         run: conan upload "*" --remote="${CONAN_REMOTE_NAME}" --confirm ${FORCE_OPTION}
diff --git a/BUILD.md b/BUILD.md
index 2ac24f2c5d..847cd7bc1a 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -101,7 +101,7 @@ More information on customizing Conan can be found in the [Advanced Conan config
 Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
 
 ```bash
-conan remote add --index 0 --force xrplf https://conan.ripplex.io
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
 ```
 
 ### Set Up Ccache
diff --git a/conan.lock b/conan.lock
index d80a6d0c57..ae45a900b6 100644
--- a/conan.lock
+++ b/conan.lock
@@ -1,43 +1,43 @@
 {
     "version": "0.5",
     "requires": [
-        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1778091116.056",
-        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1765850149.987",
-        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1778091117.311",
-        "soci/4.0.3#fe32b9ad5eb47e79ab9e45a68f363945%1774450067.231",
-        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1765850147.878",
-        "secp256k1/0.7.1#481881709eb0bdd0185a12b912bbe8ad%1770910500.329",
-        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1765850186.86",
-        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1774398111.888",
-        "protobuf/6.33.5#d96d52ba5baaaa532f47bda866ad87a5%1774467363.12",
-        "openssl/3.6.2#4789bbf131b77d0515d15e094c8f697f%1778071755.506",
-        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1775040983.408",
-        "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504%1765850143.914",
-        "libiconv/1.17#1e65319e945f2d31941a9d28cc13c058%1765842973.492",
-        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1765842973.03",
-        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1778091117.848",
+        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1777558780.503",
+        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1743678659.187",
+        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1776096494.149",
+        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1751554127.172",
+        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
+        "secp256k1/0.7.1#b1f450b7f78a36fff75bb6934a356f3a%1782338841.3729",
+        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1759820024.194",
+        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1772560729.95",
+        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1778763145.334",
+        "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
+        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1774883011.384",
+        "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1775037240.923",
+        "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1774021608.288",
+        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1722218217.276",
+        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1776147552.838",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
-        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1768312129.152",
-        "grpc/1.81.0#2fb144aeb47e7f35c6ebb0e5f35bed31%1781620605.685",
-        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1765850143.772",
-        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1765850143.772",
-        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1774439234.681",
-        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1765850143.837",
-        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1778091165.282",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
+        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1755784855.585",
+        "grpc/1.81.1#5217e6ef0544c42b46f4af35d5e7f649%1782307148.845616",
+        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
+        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1754573467.979",
+        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1766500685.317",
+        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1762886692.465",
+        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1778050991.9",
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
     ],
     "build_requires": [
-        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1778091116.056",
-        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1774447376.964",
-        "protobuf/6.33.5#d96d52ba5baaaa532f47bda866ad87a5%1774467363.12",
-        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1765850144.707",
+        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1777558780.503",
+        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1751971032.423",
+        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1778763145.334",
+        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1745483323.489",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
-        "m4/1.4.19#4523e4347b55cd26ae918bd5770cab9a%1778062762.471",
-        "cmake/4.3.0#b939a42e98f593fb34d3a8c5cc860359%1774439249.183",
-        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1774439233.447",
+        "m4/1.4.19#34c4bbc3eeebe98ca6edf2f52d602e7d%1777282960.259",
+        "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1781521538.233",
+        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1766594659.866",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
     ],
     "python_requires": [],
     "overrides": {
@@ -57,7 +57,7 @@
             "boost/1.91.0"
         ],
         "lz4/[>=1.9.4 <2]": [
-            "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504"
+            "lz4/1.10.0#982d9b673900f665a1da109e09c17cab"
         ]
     },
     "config_requires": []
diff --git a/conan/lockfile/regenerate.sh b/conan/lockfile/regenerate.sh
index 1aa47628f0..98ee6f7c99 100755
--- a/conan/lockfile/regenerate.sh
+++ b/conan/lockfile/regenerate.sh
@@ -14,7 +14,7 @@ export CONAN_HOME="$TEMP_DIR"
 # Ensure that the xrplf remote is the first to be consulted, so any recipes we
 # patched are used. We also add it there to not created huge diff when the
 # official Conan Center Index is updated.
-conan remote add --force --index 0 xrplf https://conan.ripplex.io
+conan remote add --force --index 0 xrplf https://conan.xrplf.org/repository/conan/
 
 # Delete any existing lockfile.
 rm -f conan.lock
diff --git a/conanfile.py b/conanfile.py
index 5b78dc22e3..2733d4fc9c 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -28,10 +28,10 @@ class Xrpl(ConanFile):
 
     requires = [
         "ed25519/2015.03",
-        "grpc/1.81.0",
+        "grpc/1.81.1",
         "libarchive/3.8.7",
         "nudb/2.0.9",
-        "openssl/3.6.2",
+        "openssl/3.6.3",
         "secp256k1/0.7.1",
         "soci/4.0.3",
         "zlib/1.3.2",
diff --git a/docs/build/advanced_conan.md b/docs/build/advanced_conan.md
index aae17e385a..26b88ef186 100644
--- a/docs/build/advanced_conan.md
+++ b/docs/build/advanced_conan.md
@@ -34,7 +34,7 @@ higher index than the default Conan Center remote, so it is consulted first. You
 can do this by running:
 
 ```bash
-conan remote add --index 0 --force xrplf https://conan.ripplex.io
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
 ```
 
 Alternatively, you can pull our recipes from the repository and export them locally:

From 07c64f07f02cedf9eeb185fc7c28e2d6711fc113 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Thu, 25 Jun 2026 15:47:55 +0100
Subject: [PATCH 011/100] chore: Revert "build: Switch to a new conan XRPLF
 remote (#7622)" (#7623)

---
 .github/actions/setup-conan/action.yml       |  2 +-
 .github/workflows/on-pr.yml                  |  4 +-
 .github/workflows/on-tag.yml                 |  4 +-
 .github/workflows/on-trigger.yml             |  4 +-
 .github/workflows/reusable-upload-recipe.yml | 20 ++++--
 .github/workflows/upload-conan-deps.yml      |  6 +-
 BUILD.md                                     |  2 +-
 conan.lock                                   | 64 ++++++++++----------
 conan/lockfile/regenerate.sh                 |  2 +-
 conanfile.py                                 |  4 +-
 docs/build/advanced_conan.md                 |  2 +-
 11 files changed, 60 insertions(+), 54 deletions(-)

diff --git a/.github/actions/setup-conan/action.yml b/.github/actions/setup-conan/action.yml
index e8a548cfce..0dd22f0d92 100644
--- a/.github/actions/setup-conan/action.yml
+++ b/.github/actions/setup-conan/action.yml
@@ -9,7 +9,7 @@ inputs:
   remote_url:
     description: "The URL of the Conan endpoint to use."
     required: false
-    default: https://conan.xrplf.org/repository/conan/
+    default: https://conan.ripplex.io
 
 runs:
   using: composite
diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 2ad0641863..0c9eeda712 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -154,8 +154,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
 
   notify-clio:
     needs: upload-recipe
diff --git a/.github/workflows/on-tag.yml b/.github/workflows/on-tag.yml
index abedc13d69..42d5827cab 100644
--- a/.github/workflows/on-tag.yml
+++ b/.github/workflows/on-tag.yml
@@ -20,8 +20,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
 
   build-test:
     if: ${{ github.repository == 'XRPLF/rippled' }}
diff --git a/.github/workflows/on-trigger.yml b/.github/workflows/on-trigger.yml
index 5f018cb12c..063cdbff7f 100644
--- a/.github/workflows/on-trigger.yml
+++ b/.github/workflows/on-trigger.yml
@@ -98,8 +98,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
 
   package:
     needs: build-test
diff --git a/.github/workflows/reusable-upload-recipe.yml b/.github/workflows/reusable-upload-recipe.yml
index feeee0a621..a18f76796a 100644
--- a/.github/workflows/reusable-upload-recipe.yml
+++ b/.github/workflows/reusable-upload-recipe.yml
@@ -14,7 +14,7 @@ on:
         description: "The URL of the Conan endpoint to use."
         required: false
         type: string
-        default: https://conan.xrplf.org/repository/conan/
+        default: https://conan.ripplex.io
 
     secrets:
       remote_username:
@@ -41,10 +41,6 @@ jobs:
   upload:
     runs-on: ubuntu-latest
     container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
-    env:
-      REMOTE_NAME: ${{ inputs.remote_name }}
-      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
-      CONAN_PASSWORD_XRPLF: ${{ secrets.remote_password }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -60,9 +56,15 @@ jobs:
           remote_url: ${{ inputs.remote_url }}
 
       - name: Log into Conan remote
-        run: conan remote login "${REMOTE_NAME}" "${CONAN_LOGIN_USERNAME_XRPLF}" --password "${CONAN_PASSWORD_XRPLF}"
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
+          REMOTE_USERNAME: ${{ secrets.remote_username }}
+          REMOTE_PASSWORD: ${{ secrets.remote_password }}
+        run: conan remote login "${REMOTE_NAME}" "${REMOTE_USERNAME}" --password "${REMOTE_PASSWORD}"
 
       - name: Upload Conan recipe (version)
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=${{ steps.version.outputs.version }}
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.version.outputs.version }}
@@ -71,6 +73,8 @@ jobs:
       # 'develop' branch, see on-trigger.yml.
       - name: Upload Conan recipe (develop)
         if: ${{ github.event_name == 'push' }}
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=develop
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/develop
@@ -79,6 +83,8 @@ jobs:
       # one of the 'release' branches, see on-pr.yml.
       - name: Upload Conan recipe (rc)
         if: ${{ github.event_name == 'pull_request' }}
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=rc
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/rc
@@ -87,6 +93,8 @@ jobs:
       # release, see on-tag.yml.
       - name: Upload Conan recipe (release)
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=release
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/release
diff --git a/.github/workflows/upload-conan-deps.yml b/.github/workflows/upload-conan-deps.yml
index 92b72cf6a9..5d3712cf9e 100644
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -34,7 +34,7 @@ on:
 
 env:
   CONAN_REMOTE_NAME: xrplf
-  CONAN_REMOTE_URL: https://conan.xrplf.org/repository/conan/
+  CONAN_REMOTE_URL: https://conan.ripplex.io
   NPROC_SUBTRACT: 2
 
 concurrency:
@@ -108,12 +108,10 @@ jobs:
 
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
-        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.NEXUS_REMOTE_USERNAME }}" --password "${{ secrets.NEXUS_REMOTE_PASSWORD }}"
+        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.CONAN_REMOTE_USERNAME }}" --password "${{ secrets.CONAN_REMOTE_PASSWORD }}"
 
       - name: Upload Conan packages
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
         env:
           FORCE_OPTION: ${{ github.event.inputs.force_upload == 'true' && '--force' || '' }}
-          CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-          CONAN_PASSWORD_XRPLF: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
         run: conan upload "*" --remote="${CONAN_REMOTE_NAME}" --confirm ${FORCE_OPTION}
diff --git a/BUILD.md b/BUILD.md
index 847cd7bc1a..2ac24f2c5d 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -101,7 +101,7 @@ More information on customizing Conan can be found in the [Advanced Conan config
 Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
 
 ```bash
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
+conan remote add --index 0 --force xrplf https://conan.ripplex.io
 ```
 
 ### Set Up Ccache
diff --git a/conan.lock b/conan.lock
index ae45a900b6..d80a6d0c57 100644
--- a/conan.lock
+++ b/conan.lock
@@ -1,43 +1,43 @@
 {
     "version": "0.5",
     "requires": [
-        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1777558780.503",
-        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1743678659.187",
-        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1776096494.149",
-        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1751554127.172",
-        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
-        "secp256k1/0.7.1#b1f450b7f78a36fff75bb6934a356f3a%1782338841.3729",
-        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1759820024.194",
-        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1772560729.95",
-        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1778763145.334",
-        "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
-        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1774883011.384",
-        "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1775037240.923",
-        "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1774021608.288",
-        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1722218217.276",
-        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1776147552.838",
+        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1778091116.056",
+        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1765850149.987",
+        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1778091117.311",
+        "soci/4.0.3#fe32b9ad5eb47e79ab9e45a68f363945%1774450067.231",
+        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1765850147.878",
+        "secp256k1/0.7.1#481881709eb0bdd0185a12b912bbe8ad%1770910500.329",
+        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1765850186.86",
+        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1774398111.888",
+        "protobuf/6.33.5#d96d52ba5baaaa532f47bda866ad87a5%1774467363.12",
+        "openssl/3.6.2#4789bbf131b77d0515d15e094c8f697f%1778071755.506",
+        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1775040983.408",
+        "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504%1765850143.914",
+        "libiconv/1.17#1e65319e945f2d31941a9d28cc13c058%1765842973.492",
+        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1765842973.03",
+        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1778091117.848",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
-        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1755784855.585",
-        "grpc/1.81.1#5217e6ef0544c42b46f4af35d5e7f649%1782307148.845616",
-        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
-        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1754573467.979",
-        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1766500685.317",
-        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1762886692.465",
-        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1778050991.9",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1768312129.152",
+        "grpc/1.81.0#2fb144aeb47e7f35c6ebb0e5f35bed31%1781620605.685",
+        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1765850143.772",
+        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1765850143.772",
+        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1774439234.681",
+        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1765850143.837",
+        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1778091165.282",
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
     ],
     "build_requires": [
-        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1777558780.503",
-        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1751971032.423",
-        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1778763145.334",
-        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1745483323.489",
+        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1778091116.056",
+        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1774447376.964",
+        "protobuf/6.33.5#d96d52ba5baaaa532f47bda866ad87a5%1774467363.12",
+        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1765850144.707",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
-        "m4/1.4.19#34c4bbc3eeebe98ca6edf2f52d602e7d%1777282960.259",
-        "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1781521538.233",
-        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1766594659.866",
+        "m4/1.4.19#4523e4347b55cd26ae918bd5770cab9a%1778062762.471",
+        "cmake/4.3.0#b939a42e98f593fb34d3a8c5cc860359%1774439249.183",
+        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1774439233.447",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
     ],
     "python_requires": [],
     "overrides": {
@@ -57,7 +57,7 @@
             "boost/1.91.0"
         ],
         "lz4/[>=1.9.4 <2]": [
-            "lz4/1.10.0#982d9b673900f665a1da109e09c17cab"
+            "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504"
         ]
     },
     "config_requires": []
diff --git a/conan/lockfile/regenerate.sh b/conan/lockfile/regenerate.sh
index 98ee6f7c99..1aa47628f0 100755
--- a/conan/lockfile/regenerate.sh
+++ b/conan/lockfile/regenerate.sh
@@ -14,7 +14,7 @@ export CONAN_HOME="$TEMP_DIR"
 # Ensure that the xrplf remote is the first to be consulted, so any recipes we
 # patched are used. We also add it there to not created huge diff when the
 # official Conan Center Index is updated.
-conan remote add --force --index 0 xrplf https://conan.xrplf.org/repository/conan/
+conan remote add --force --index 0 xrplf https://conan.ripplex.io
 
 # Delete any existing lockfile.
 rm -f conan.lock
diff --git a/conanfile.py b/conanfile.py
index 2733d4fc9c..5b78dc22e3 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -28,10 +28,10 @@ class Xrpl(ConanFile):
 
     requires = [
         "ed25519/2015.03",
-        "grpc/1.81.1",
+        "grpc/1.81.0",
         "libarchive/3.8.7",
         "nudb/2.0.9",
-        "openssl/3.6.3",
+        "openssl/3.6.2",
         "secp256k1/0.7.1",
         "soci/4.0.3",
         "zlib/1.3.2",
diff --git a/docs/build/advanced_conan.md b/docs/build/advanced_conan.md
index 26b88ef186..aae17e385a 100644
--- a/docs/build/advanced_conan.md
+++ b/docs/build/advanced_conan.md
@@ -34,7 +34,7 @@ higher index than the default Conan Center remote, so it is consulted first. You
 can do this by running:
 
 ```bash
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
+conan remote add --index 0 --force xrplf https://conan.ripplex.io
 ```
 
 Alternatively, you can pull our recipes from the repository and export them locally:

From 0711a7b493c63d261cb7fcb02b22c9de744d8ff7 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Thu, 25 Jun 2026 23:06:04 +0100
Subject: [PATCH 012/100] build: Switch to a new conan XRPLF remote, again
 (#7638)

---
 .github/actions/setup-conan/action.yml       |  2 +-
 .github/workflows/on-pr.yml                  |  4 +-
 .github/workflows/on-tag.yml                 |  4 +-
 .github/workflows/on-trigger.yml             |  4 +-
 .github/workflows/reusable-upload-recipe.yml | 20 ++----
 .github/workflows/upload-conan-deps.yml      |  6 +-
 BUILD.md                                     |  2 +-
 conan.lock                                   | 64 ++++++++++----------
 conan/lockfile/regenerate.sh                 |  2 +-
 conanfile.py                                 |  4 +-
 docs/build/advanced_conan.md                 |  2 +-
 11 files changed, 54 insertions(+), 60 deletions(-)

diff --git a/.github/actions/setup-conan/action.yml b/.github/actions/setup-conan/action.yml
index 0dd22f0d92..e8a548cfce 100644
--- a/.github/actions/setup-conan/action.yml
+++ b/.github/actions/setup-conan/action.yml
@@ -9,7 +9,7 @@ inputs:
   remote_url:
     description: "The URL of the Conan endpoint to use."
     required: false
-    default: https://conan.ripplex.io
+    default: https://conan.xrplf.org/repository/conan/
 
 runs:
   using: composite
diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 0c9eeda712..2ad0641863 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -154,8 +154,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   notify-clio:
     needs: upload-recipe
diff --git a/.github/workflows/on-tag.yml b/.github/workflows/on-tag.yml
index 42d5827cab..abedc13d69 100644
--- a/.github/workflows/on-tag.yml
+++ b/.github/workflows/on-tag.yml
@@ -20,8 +20,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   build-test:
     if: ${{ github.repository == 'XRPLF/rippled' }}
diff --git a/.github/workflows/on-trigger.yml b/.github/workflows/on-trigger.yml
index 063cdbff7f..5f018cb12c 100644
--- a/.github/workflows/on-trigger.yml
+++ b/.github/workflows/on-trigger.yml
@@ -98,8 +98,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   package:
     needs: build-test
diff --git a/.github/workflows/reusable-upload-recipe.yml b/.github/workflows/reusable-upload-recipe.yml
index a18f76796a..feeee0a621 100644
--- a/.github/workflows/reusable-upload-recipe.yml
+++ b/.github/workflows/reusable-upload-recipe.yml
@@ -14,7 +14,7 @@ on:
         description: "The URL of the Conan endpoint to use."
         required: false
         type: string
-        default: https://conan.ripplex.io
+        default: https://conan.xrplf.org/repository/conan/
 
     secrets:
       remote_username:
@@ -41,6 +41,10 @@ jobs:
   upload:
     runs-on: ubuntu-latest
     container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    env:
+      REMOTE_NAME: ${{ inputs.remote_name }}
+      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
+      CONAN_PASSWORD_XRPLF: ${{ secrets.remote_password }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -56,15 +60,9 @@ jobs:
           remote_url: ${{ inputs.remote_url }}
 
       - name: Log into Conan remote
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
-          REMOTE_USERNAME: ${{ secrets.remote_username }}
-          REMOTE_PASSWORD: ${{ secrets.remote_password }}
-        run: conan remote login "${REMOTE_NAME}" "${REMOTE_USERNAME}" --password "${REMOTE_PASSWORD}"
+        run: conan remote login "${REMOTE_NAME}" "${CONAN_LOGIN_USERNAME_XRPLF}" --password "${CONAN_PASSWORD_XRPLF}"
 
       - name: Upload Conan recipe (version)
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=${{ steps.version.outputs.version }}
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.version.outputs.version }}
@@ -73,8 +71,6 @@ jobs:
       # 'develop' branch, see on-trigger.yml.
       - name: Upload Conan recipe (develop)
         if: ${{ github.event_name == 'push' }}
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=develop
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/develop
@@ -83,8 +79,6 @@ jobs:
       # one of the 'release' branches, see on-pr.yml.
       - name: Upload Conan recipe (rc)
         if: ${{ github.event_name == 'pull_request' }}
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=rc
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/rc
@@ -93,8 +87,6 @@ jobs:
       # release, see on-tag.yml.
       - name: Upload Conan recipe (release)
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=release
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/release
diff --git a/.github/workflows/upload-conan-deps.yml b/.github/workflows/upload-conan-deps.yml
index 5d3712cf9e..92b72cf6a9 100644
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -34,7 +34,7 @@ on:
 
 env:
   CONAN_REMOTE_NAME: xrplf
-  CONAN_REMOTE_URL: https://conan.ripplex.io
+  CONAN_REMOTE_URL: https://conan.xrplf.org/repository/conan/
   NPROC_SUBTRACT: 2
 
 concurrency:
@@ -108,10 +108,12 @@ jobs:
 
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
-        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.CONAN_REMOTE_USERNAME }}" --password "${{ secrets.CONAN_REMOTE_PASSWORD }}"
+        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.NEXUS_REMOTE_USERNAME }}" --password "${{ secrets.NEXUS_REMOTE_PASSWORD }}"
 
       - name: Upload Conan packages
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
         env:
           FORCE_OPTION: ${{ github.event.inputs.force_upload == 'true' && '--force' || '' }}
+          CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+          CONAN_PASSWORD_XRPLF: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
         run: conan upload "*" --remote="${CONAN_REMOTE_NAME}" --confirm ${FORCE_OPTION}
diff --git a/BUILD.md b/BUILD.md
index 2ac24f2c5d..847cd7bc1a 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -101,7 +101,7 @@ More information on customizing Conan can be found in the [Advanced Conan config
 Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
 
 ```bash
-conan remote add --index 0 --force xrplf https://conan.ripplex.io
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
 ```
 
 ### Set Up Ccache
diff --git a/conan.lock b/conan.lock
index d80a6d0c57..45dd145914 100644
--- a/conan.lock
+++ b/conan.lock
@@ -1,43 +1,43 @@
 {
     "version": "0.5",
     "requires": [
-        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1778091116.056",
-        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1765850149.987",
-        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1778091117.311",
-        "soci/4.0.3#fe32b9ad5eb47e79ab9e45a68f363945%1774450067.231",
-        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1765850147.878",
-        "secp256k1/0.7.1#481881709eb0bdd0185a12b912bbe8ad%1770910500.329",
-        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1765850186.86",
-        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1774398111.888",
-        "protobuf/6.33.5#d96d52ba5baaaa532f47bda866ad87a5%1774467363.12",
-        "openssl/3.6.2#4789bbf131b77d0515d15e094c8f697f%1778071755.506",
-        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1775040983.408",
-        "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504%1765850143.914",
-        "libiconv/1.17#1e65319e945f2d31941a9d28cc13c058%1765842973.492",
-        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1765842973.03",
-        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1778091117.848",
+        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
+        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
+        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
+        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
+        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
+        "secp256k1/0.7.1#b1f450b7f78a36fff75bb6934a356f3a%1782338841.3729",
+        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1782392413.075713",
+        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
+        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
+        "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
+        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
+        "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
+        "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
+        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
+        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
-        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1768312129.152",
-        "grpc/1.81.0#2fb144aeb47e7f35c6ebb0e5f35bed31%1781620605.685",
-        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1765850143.772",
-        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1765850143.772",
-        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1774439234.681",
-        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1765850143.837",
-        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1778091165.282",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
+        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
+        "grpc/1.81.1#5217e6ef0544c42b46f4af35d5e7f649%1782307148.845616",
+        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
+        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
+        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
+        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
+        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
     ],
     "build_requires": [
-        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1778091116.056",
-        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1774447376.964",
-        "protobuf/6.33.5#d96d52ba5baaaa532f47bda866ad87a5%1774467363.12",
-        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1765850144.707",
+        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
+        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
+        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
+        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
-        "m4/1.4.19#4523e4347b55cd26ae918bd5770cab9a%1778062762.471",
-        "cmake/4.3.0#b939a42e98f593fb34d3a8c5cc860359%1774439249.183",
-        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1774439233.447",
+        "m4/1.4.19#34c4bbc3eeebe98ca6edf2f52d602e7d%1777282960.259",
+        "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
+        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
     ],
     "python_requires": [],
     "overrides": {
@@ -57,7 +57,7 @@
             "boost/1.91.0"
         ],
         "lz4/[>=1.9.4 <2]": [
-            "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504"
+            "lz4/1.10.0#982d9b673900f665a1da109e09c17cab"
         ]
     },
     "config_requires": []
diff --git a/conan/lockfile/regenerate.sh b/conan/lockfile/regenerate.sh
index 1aa47628f0..98ee6f7c99 100755
--- a/conan/lockfile/regenerate.sh
+++ b/conan/lockfile/regenerate.sh
@@ -14,7 +14,7 @@ export CONAN_HOME="$TEMP_DIR"
 # Ensure that the xrplf remote is the first to be consulted, so any recipes we
 # patched are used. We also add it there to not created huge diff when the
 # official Conan Center Index is updated.
-conan remote add --force --index 0 xrplf https://conan.ripplex.io
+conan remote add --force --index 0 xrplf https://conan.xrplf.org/repository/conan/
 
 # Delete any existing lockfile.
 rm -f conan.lock
diff --git a/conanfile.py b/conanfile.py
index 5b78dc22e3..2733d4fc9c 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -28,10 +28,10 @@ class Xrpl(ConanFile):
 
     requires = [
         "ed25519/2015.03",
-        "grpc/1.81.0",
+        "grpc/1.81.1",
         "libarchive/3.8.7",
         "nudb/2.0.9",
-        "openssl/3.6.2",
+        "openssl/3.6.3",
         "secp256k1/0.7.1",
         "soci/4.0.3",
         "zlib/1.3.2",
diff --git a/docs/build/advanced_conan.md b/docs/build/advanced_conan.md
index aae17e385a..26b88ef186 100644
--- a/docs/build/advanced_conan.md
+++ b/docs/build/advanced_conan.md
@@ -34,7 +34,7 @@ higher index than the default Conan Center remote, so it is consulted first. You
 can do this by running:
 
 ```bash
-conan remote add --index 0 --force xrplf https://conan.ripplex.io
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
 ```
 
 Alternatively, you can pull our recipes from the repository and export them locally:

From b9eee1d24537299acf3ea8dd33dd8ef9d9c6bd7a Mon Sep 17 00:00:00 2001
From: Mayukha Vadari <mvadari@ripple.com>
Date: Fri, 26 Jun 2026 06:24:12 -0400
Subject: [PATCH 013/100] refactor: Rename (mostly keylet) functions to more
 closely match the docs (#7059)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 include/xrpl/ledger/helpers/EscrowHelpers.h   |   4 +-
 include/xrpl/protocol/Indexes.h               |  90 ++---
 .../xrpl/protocol/detail/ledger_entries.macro |  18 +-
 include/xrpl/protocol/nft.h                   |   4 +-
 include/xrpl/tx/paths/detail/StepChecks.h     |   6 +-
 src/libxrpl/ledger/Ledger.cpp                 |   4 +-
 src/libxrpl/ledger/View.cpp                   |   2 +-
 src/libxrpl/ledger/helpers/AMMHelpers.cpp     |   4 +-
 src/libxrpl/ledger/helpers/MPTokenHelpers.cpp |  30 +-
 src/libxrpl/ledger/helpers/NFTokenHelpers.cpp |  32 +-
 .../ledger/helpers/RippleStateHelpers.cpp     |  22 +-
 src/libxrpl/ledger/helpers/TokenHelpers.cpp   |  14 +-
 src/libxrpl/protocol/Indexes.cpp              |  46 +--
 src/libxrpl/tx/Transactor.cpp                 |   8 +-
 src/libxrpl/tx/invariants/InvariantCheck.cpp  |   4 +-
 .../tx/invariants/LoanBrokerInvariant.cpp     |   2 +-
 src/libxrpl/tx/invariants/MPTInvariant.cpp    |   2 +-
 src/libxrpl/tx/invariants/VaultInvariant.cpp  |   6 +-
 src/libxrpl/tx/paths/BookStep.cpp             |   2 +-
 src/libxrpl/tx/paths/DirectStep.cpp           |   4 +-
 src/libxrpl/tx/paths/MPTEndpointStep.cpp      |   2 +-
 src/libxrpl/tx/paths/XRPEndpointStep.cpp      |   2 +-
 .../tx/transactors/account/AccountDelete.cpp  |   4 +-
 .../tx/transactors/account/AccountSet.cpp     |   2 +-
 .../tx/transactors/account/SetRegularKey.cpp  |   2 +-
 .../tx/transactors/account/SignerListSet.cpp  |   6 +-
 .../tx/transactors/bridge/XChainBridge.cpp    |   2 +-
 .../tx/transactors/check/CheckCash.cpp        |   4 +-
 .../tx/transactors/check/CheckCreate.cpp      |   4 +-
 .../tx/transactors/dex/AMMClawback.cpp        |   2 +-
 src/libxrpl/tx/transactors/dex/AMMCreate.cpp  |   9 +-
 src/libxrpl/tx/transactors/dex/AMMDeposit.cpp |   5 +-
 .../tx/transactors/dex/AMMWithdraw.cpp        |   4 +-
 .../tx/transactors/dex/OfferCreate.cpp        |   8 +-
 .../tx/transactors/escrow/EscrowCancel.cpp    |   2 +-
 .../tx/transactors/escrow/EscrowCreate.cpp    |   4 +-
 .../tx/transactors/escrow/EscrowFinish.cpp    |   2 +-
 .../lending/LoanBrokerCoverClawback.cpp       |   6 +-
 .../lending/LoanBrokerCoverDeposit.cpp        |   4 +-
 .../lending/LoanBrokerCoverWithdraw.cpp       |   4 +-
 .../transactors/lending/LoanBrokerDelete.cpp  |   4 +-
 .../tx/transactors/lending/LoanBrokerSet.cpp  |   6 +-
 .../tx/transactors/lending/LoanDelete.cpp     |   4 +-
 .../tx/transactors/lending/LoanManage.cpp     |   4 +-
 .../tx/transactors/lending/LoanPay.cpp        |   6 +-
 .../tx/transactors/lending/LoanSet.cpp        |   6 +-
 .../tx/transactors/nft/NFTokenAcceptOffer.cpp |   6 +-
 .../tx/transactors/nft/NFTokenCancelOffer.cpp |   2 +-
 .../payment_channel/PaymentChannelCreate.cpp  |   2 +-
 src/libxrpl/tx/transactors/system/Change.cpp  |   2 +-
 .../tx/transactors/system/TicketCreate.cpp    |   2 +-
 src/libxrpl/tx/transactors/token/Clawback.cpp |   4 +-
 .../tx/transactors/token/MPTokenAuthorize.cpp |   9 +-
 .../token/MPTokenIssuanceCreate.cpp           |   2 +-
 .../token/MPTokenIssuanceDestroy.cpp          |   4 +-
 .../transactors/token/MPTokenIssuanceSet.cpp  |   4 +-
 src/libxrpl/tx/transactors/token/TrustSet.cpp |  14 +-
 .../tx/transactors/vault/VaultClawback.cpp    |   6 +-
 .../tx/transactors/vault/VaultCreate.cpp      |   2 +-
 .../tx/transactors/vault/VaultDelete.cpp      |   4 +-
 .../tx/transactors/vault/VaultDeposit.cpp     |   4 +-
 src/libxrpl/tx/transactors/vault/VaultSet.cpp |   4 +-
 .../tx/transactors/vault/VaultWithdraw.cpp    |   4 +-
 src/test/app/AccountDelete_test.cpp           |  16 +-
 src/test/app/Batch_test.cpp                   |   2 +-
 src/test/app/Check_test.cpp                   |  64 ++--
 src/test/app/Clawback_test.cpp                |   2 +-
 src/test/app/EscrowToken_test.cpp             |   7 +-
 src/test/app/FeeVote_test.cpp                 |   2 +-
 src/test/app/FixNFTokenPageLinks_test.cpp     |  72 ++--
 src/test/app/Flow_test.cpp                    |   2 +-
 src/test/app/Freeze_test.cpp                  |  12 +-
 src/test/app/Invariants_test.cpp              | 108 +++---
 src/test/app/LPTokenTransfer_test.cpp         |   4 +-
 src/test/app/LoanBroker_test.cpp              |  32 +-
 src/test/app/Loan_test.cpp                    | 118 +++---
 src/test/app/MPToken_test.cpp                 |   2 +-
 src/test/app/MultiSign_test.cpp               |   2 +-
 src/test/app/NFTokenAuth_test.cpp             |  26 +-
 src/test/app/NFTokenBurn_test.cpp             | 111 +++---
 src/test/app/NFTokenDir_test.cpp              |  16 +-
 src/test/app/NFToken_test.cpp                 | 342 +++++++++---------
 src/test/app/Offer_test.cpp                   |  10 +-
 src/test/app/Path_test.cpp                    |  12 +-
 src/test/app/PayChan_test.cpp                 |   2 +-
 src/test/app/PayStrand_test.cpp               |   4 +-
 src/test/app/PermissionedDEX_test.cpp         |   2 +-
 src/test/app/RCLValidations_test.cpp          |   2 +-
 src/test/app/SetAuth_test.cpp                 |   2 +-
 src/test/app/Vault_test.cpp                   |  58 +--
 src/test/jtx/impl/Env.cpp                     |   6 +-
 src/test/jtx/impl/TestHelpers.cpp             |   8 +-
 src/test/jtx/impl/balance.cpp                 |   2 +-
 src/test/jtx/impl/mpt.cpp                     |   8 +-
 src/test/rpc/AccountTx_test.cpp               |   2 +-
 src/test/rpc/LedgerEntry_test.cpp             |  10 +-
 src/test/rpc/Subscribe_test.cpp               |  17 +-
 src/tests/libxrpl/helpers/TxTest.cpp          |   6 +-
 src/tests/libxrpl/tx/AccountSet.cpp           |   6 +-
 src/xrpld/app/ledger/detail/BuildLedger.cpp   |   2 +-
 src/xrpld/app/ledger/detail/InboundLedger.cpp |   6 +-
 .../app/ledger/detail/LedgerPersistence.cpp   |   2 +-
 src/xrpld/app/ledger/detail/LocalTxs.cpp      |   2 +-
 src/xrpld/app/main/Application.cpp            |   7 +-
 src/xrpld/app/misc/detail/TxQ.cpp             |   2 +-
 src/xrpld/rpc/detail/AssetCache.cpp           |   2 +-
 src/xrpld/rpc/detail/Pathfinder.cpp           |   2 +-
 src/xrpld/rpc/detail/RPCHelpers.cpp           |   2 +-
 src/xrpld/rpc/handlers/VaultInfo.cpp          |   2 +-
 .../rpc/handlers/account/AccountInfo.cpp      |   2 +-
 .../rpc/handlers/account/AccountNFTs.cpp      |   6 +-
 .../rpc/handlers/account/AccountObjects.cpp   |   4 +-
 src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp |  10 +-
 .../rpc/handlers/orderbook/NFTOffersHelpers.h |   2 +-
 114 files changed, 825 insertions(+), 812 deletions(-)

diff --git a/include/xrpl/ledger/helpers/EscrowHelpers.h b/include/xrpl/ledger/helpers/EscrowHelpers.h
index bdb83230eb..dc7c479c42 100644
--- a/include/xrpl/ledger/helpers/EscrowHelpers.h
+++ b/include/xrpl/ledger/helpers/EscrowHelpers.h
@@ -42,7 +42,7 @@ escrowUnlockApplyHelper<Issue>(
     beast::Journal journal)
 {
     Issue const& issue = amount.get<Issue>();
-    Keylet const trustLineKey = keylet::line(receiver, issue);
+    Keylet const trustLineKey = keylet::trustLine(receiver, issue);
     bool const recvLow = issuer > receiver;
     bool const senderIssuer = issuer == sender;
     bool const receiverIssuer = issuer == receiver;
@@ -175,7 +175,7 @@ escrowUnlockApplyHelper<MPTIssue>(
     bool const receiverIssuer = issuer == receiver;
 
     auto const mptID = amount.get<MPTIssue>().getMptID();
-    auto const issuanceKey = keylet::mptIssuance(mptID);
+    auto const issuanceKey = keylet::mptokenIssuance(mptID);
     if (!view.exists(keylet::mptoken(issuanceKey.key, receiver)) && createAsset && !receiverIssuer)
     {
         if (std::uint32_t const ownerCount = {sleDest->at(sfOwnerCount)};
diff --git a/include/xrpl/protocol/Indexes.h b/include/xrpl/protocol/Indexes.h
index 887a208ec6..75a2335f6f 100644
--- a/include/xrpl/protocol/Indexes.h
+++ b/include/xrpl/protocol/Indexes.h
@@ -68,21 +68,15 @@ skip(LedgerIndex ledger) noexcept;
 
 /** The (fixed) index of the object containing the ledger fees. */
 Keylet const&
-fees() noexcept;
+feeSettings() noexcept;
 
 /** The (fixed) index of the object containing the ledger negativeUNL. */
 Keylet const&
 negativeUNL() noexcept;
 
 /** The beginning of an order book */
-struct BookT
-{
-    explicit BookT() = default;
-
-    Keylet
-    operator()(Book const& b) const;
-};
-static BookT const kBook{};
+Keylet
+book(Book const& b);
 
 /** The index of a trust line for a given currency
 
@@ -93,12 +87,12 @@ static BookT const kBook{};
 */
 /** @{ */
 Keylet
-line(AccountID const& id0, AccountID const& id1, Currency const& currency) noexcept;
+trustLine(AccountID const& id0, AccountID const& id1, Currency const& currency) noexcept;
 
 inline Keylet
-line(AccountID const& id, Issue const& issue) noexcept
+trustLine(AccountID const& id, Issue const& issue) noexcept
 {
-    return line(id, issue.account, issue.currency);
+    return trustLine(id, issue.account, issue.currency);
 }
 /** @} */
 
@@ -119,37 +113,27 @@ Keylet
 quality(Keylet const& k, std::uint64_t q) noexcept;
 
 /** The directory for the next lower quality */
-struct NextT
-{
-    explicit NextT() = default;
-
-    Keylet
-    operator()(Keylet const& k) const;
-};
-static NextT const kNext{};
+Keylet
+next(Keylet const& k);
 
 /** A ticket belonging to an account */
-struct TicketT
+/** @{ */
+Keylet
+ticket(AccountID const& id, std::uint32_t ticketSeq);
+
+Keylet
+ticket(AccountID const& id, SeqProxy ticketSeq);
+
+inline Keylet
+ticket(uint256 const& key)
 {
-    explicit TicketT() = default;
-
-    Keylet
-    operator()(AccountID const& id, std::uint32_t ticketSeq) const;
-
-    Keylet
-    operator()(AccountID const& id, SeqProxy ticketSeq) const;
-
-    Keylet
-    operator()(uint256 const& key) const
-    {
-        return {ltTICKET, key};
-    }
-};
-static TicketT const kTicket{};
+    return {ltTICKET, key};
+}
+/** @} */
 
 /** A SignerList */
 Keylet
-signers(AccountID const& account) noexcept;
+signerList(AccountID const& account) noexcept;
 
 /** A Check */
 /** @{ */
@@ -209,7 +193,7 @@ escrow(AccountID const& src, std::uint32_t seq) noexcept;
 
 /** A PaymentChannel */
 Keylet
-payChan(AccountID const& src, AccountID const& dst, std::uint32_t seq) noexcept;
+payChannel(AccountID const& src, AccountID const& dst, std::uint32_t seq) noexcept;
 
 /** NFT page keylets
 
@@ -221,22 +205,22 @@ payChan(AccountID const& src, AccountID const& dst, std::uint32_t seq) noexcept;
 /** @{ */
 /** A keylet for the owner's first possible NFT page. */
 Keylet
-nftpageMin(AccountID const& owner);
+nftokenPageMin(AccountID const& owner);
 
 /** A keylet for the owner's last possible NFT page. */
 Keylet
-nftpageMax(AccountID const& owner);
+nftokenPageMax(AccountID const& owner);
 
 Keylet
-nftpage(Keylet const& k, uint256 const& token);
+nftokenPage(Keylet const& k, uint256 const& token);
 /** @} */
 
 /** An offer from an account to buy or sell an NFT */
 Keylet
-nftoffer(AccountID const& owner, std::uint32_t seq);
+nftokenOffer(AccountID const& owner, std::uint32_t seq);
 
 inline Keylet
-nftoffer(uint256 const& offer)
+nftokenOffer(uint256 const& offer)
 {
     return {ltNFTOKEN_OFFER, offer};
 }
@@ -287,13 +271,13 @@ credential(uint256 const& key) noexcept
 }
 
 Keylet
-mptIssuance(std::uint32_t seq, AccountID const& issuer) noexcept;
+mptokenIssuance(std::uint32_t seq, AccountID const& issuer) noexcept;
 
 Keylet
-mptIssuance(MPTID const& issuanceID) noexcept;
+mptokenIssuance(MPTID const& issuanceID) noexcept;
 
 inline Keylet
-mptIssuance(uint256 const& issuanceKey)
+mptokenIssuance(uint256 const& issuanceKey)
 {
     return {ltMPTOKEN_ISSUANCE, issuanceKey};
 }
@@ -320,10 +304,10 @@ vault(uint256 const& vaultKey)
 }
 
 Keylet
-loanbroker(AccountID const& owner, std::uint32_t seq) noexcept;
+loanBroker(AccountID const& owner, std::uint32_t seq) noexcept;
 
 inline Keylet
-loanbroker(uint256 const& key)
+loanBroker(uint256 const& key)
 {
     return {ltLOAN_BROKER, key};
 }
@@ -376,11 +360,15 @@ struct KeyletDesc
 std::array<KeyletDesc<AccountID const&>, 6> const kDirectAccountKeylets{
     {{.function = &keylet::account, .expectedLEName = jss::AccountRoot, .includeInTests = false},
      {.function = &keylet::ownerDir, .expectedLEName = jss::DirectoryNode, .includeInTests = true},
-     {.function = &keylet::signers, .expectedLEName = jss::SignerList, .includeInTests = true},
+     {.function = &keylet::signerList, .expectedLEName = jss::SignerList, .includeInTests = true},
      // It's normally impossible to create an item at nftpage_min, but
      // test it anyway, since the invariant checks for it.
-     {.function = &keylet::nftpageMin, .expectedLEName = jss::NFTokenPage, .includeInTests = true},
-     {.function = &keylet::nftpageMax, .expectedLEName = jss::NFTokenPage, .includeInTests = true},
+     {.function = &keylet::nftokenPageMin,
+      .expectedLEName = jss::NFTokenPage,
+      .includeInTests = true},
+     {.function = &keylet::nftokenPageMax,
+      .expectedLEName = jss::NFTokenPage,
+      .includeInTests = true},
      {.function = &keylet::did, .expectedLEName = jss::DID, .includeInTests = true}}};
 
 MPTID
diff --git a/include/xrpl/protocol/detail/ledger_entries.macro b/include/xrpl/protocol/detail/ledger_entries.macro
index 632038a9c5..e0ea1a61c3 100644
--- a/include/xrpl/protocol/detail/ledger_entries.macro
+++ b/include/xrpl/protocol/detail/ledger_entries.macro
@@ -21,7 +21,7 @@
 
 /** A ledger object which identifies an offer to buy or sell an NFT.
 
-    \sa keylet::nftoffer
+    \sa keylet::nftokenOffer
  */
 LEDGER_ENTRY(ltNFTOKEN_OFFER, 0x0037, NFTokenOffer, nft_offer, ({
     {sfOwner,                SoeRequired},
@@ -84,7 +84,7 @@ LEDGER_ENTRY(ltNEGATIVE_UNL, 0x004e, NegativeUNL, nunl, ({
 
 /** A ledger object which contains a list of NFTs
 
-    \sa keylet::nftpageMin, keylet::nftpageMax, keylet::nftpage
+    \sa keylet::nftokenPageMin, keylet::nftokenPageMax, keylet::nftokenPage
  */
 LEDGER_ENTRY(ltNFTOKEN_PAGE, 0x0050, NFTokenPage, nft_page, ({
     {sfPreviousPageMin,      SoeOptional},
@@ -96,7 +96,7 @@ LEDGER_ENTRY(ltNFTOKEN_PAGE, 0x0050, NFTokenPage, nft_page, ({
 
 /** A ledger object which contains a signer list for an account.
 
-    \sa keylet::signers
+    \sa keylet::signerList
  */
 // All fields are SoeRequired because there is always a SignerEntries.
 // If there are no SignerEntries the node is deleted.
@@ -112,7 +112,7 @@ LEDGER_ENTRY(ltSIGNER_LIST, 0x0053, SignerList, signer_list, ({
 
 /** A ledger object which describes a ticket.
 
-    \sa keylet::kTicket
+    \sa keylet::ticket
  */
 LEDGER_ENTRY(ltTICKET, 0x0054, Ticket, ticket, ({
     {sfAccount,              SoeRequired},
@@ -272,7 +272,7 @@ LEDGER_ENTRY(ltXCHAIN_OWNED_CLAIM_ID, 0x0071, XChainOwnedClaimID, xchain_owned_c
 
     @note Per Vinnie Falco this should be renamed to ltTRUST_LINE
 
-    \sa keylet::line
+    \sa keylet::trustLine
  */
 LEDGER_ENTRY(ltRIPPLE_STATE, 0x0072, RippleState, state, ({
     {sfBalance,              SoeRequired},
@@ -292,7 +292,7 @@ LEDGER_ENTRY(ltRIPPLE_STATE, 0x0072, RippleState, state, ({
 
     \note This is a singleton: only one such object exists in the ledger.
 
-    \sa keylet::fees
+    \sa keylet::feeSettings
  */
 LEDGER_ENTRY(ltFEE_SETTINGS, 0x0073, FeeSettings, fee, ({
     // Old version uses raw numbers
@@ -346,7 +346,7 @@ LEDGER_ENTRY(ltESCROW, 0x0075, Escrow, escrow, ({
 
 /** A ledger object describing a single unidirectional XRP payment channel.
 
-    \sa keylet::payChan
+    \sa keylet::payChannel
  */
 LEDGER_ENTRY(ltPAYCHAN, 0x0078, PayChannel, payment_channel, ({
     {sfAccount,              SoeRequired},
@@ -384,7 +384,7 @@ LEDGER_ENTRY(ltAMM, 0x0079, AMM, amm, ({
 }))
 
 /** A ledger object which tracks MPTokenIssuance
-    \sa keylet::mptIssuance
+    \sa keylet::mptokenIssuance
  */
 LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
     {sfIssuer,                   SoeRequired},
@@ -499,7 +499,7 @@ LEDGER_ENTRY(ltVAULT, 0x0084, Vault, vault, ({
 
 /** A ledger object representing a loan broker
 
-    \sa keylet::loanbroker
+    \sa keylet::loanBroker
  */
 LEDGER_ENTRY(ltLOAN_BROKER, 0x0088, LoanBroker, loan_broker, ({
     {sfPreviousTxnID,        SoeRequired},
diff --git a/include/xrpl/protocol/nft.h b/include/xrpl/protocol/nft.h
index 1e79b3f285..54227dd1ea 100644
--- a/include/xrpl/protocol/nft.h
+++ b/include/xrpl/protocol/nft.h
@@ -52,7 +52,7 @@ getTransferFee(uint256 const& id)
 }
 
 inline std::uint32_t
-getSerial(uint256 const& id)
+getSequence(uint256 const& id)
 {
     std::uint32_t seq = 0;
     memcpy(&seq, id.begin() + 28, 4);
@@ -92,7 +92,7 @@ getTaxon(uint256 const& id)
 
     // The taxon cipher is just an XOR, so it is reversible by applying the
     // XOR a second time.
-    return cipheredTaxon(getSerial(id), toTaxon(taxon));
+    return cipheredTaxon(getSequence(id), toTaxon(taxon));
 }
 
 inline AccountID
diff --git a/include/xrpl/tx/paths/detail/StepChecks.h b/include/xrpl/tx/paths/detail/StepChecks.h
index fea9f90a31..4955c4f8e6 100644
--- a/include/xrpl/tx/paths/detail/StepChecks.h
+++ b/include/xrpl/tx/paths/detail/StepChecks.h
@@ -27,7 +27,7 @@ checkFreeze(
         }
     }
 
-    if (auto sle = view.read(keylet::line(src, dst, currency)))
+    if (auto sle = view.read(keylet::trustLine(src, dst, currency)))
     {
         if (sle->isFlag((dst > src) ? lsfHighFreeze : lsfLowFreeze))
         {
@@ -71,8 +71,8 @@ checkNoRipple(
     beast::Journal j)
 {
     // fetch the ripple lines into and out of this node
-    auto sleIn = view.read(keylet::line(prev, cur, currency));
-    auto sleOut = view.read(keylet::line(cur, next, currency));
+    auto sleIn = view.read(keylet::trustLine(prev, cur, currency));
+    auto sleOut = view.read(keylet::trustLine(cur, next, currency));
 
     if (!sleIn || !sleOut)
         return terNO_LINE;
diff --git a/src/libxrpl/ledger/Ledger.cpp b/src/libxrpl/ledger/Ledger.cpp
index 82956650e2..188fb3cd2c 100644
--- a/src/libxrpl/ledger/Ledger.cpp
+++ b/src/libxrpl/ledger/Ledger.cpp
@@ -180,7 +180,7 @@ Ledger::Ledger(
     }
 
     {
-        auto sle = std::make_shared<SLE>(keylet::fees());
+        auto sle = std::make_shared<SLE>(keylet::feeSettings());
         // Whether featureXRPFees is supported will depend on startup options.
         if (std::ranges::find(amendments, featureXRPFees) != amendments.end())
         {
@@ -560,7 +560,7 @@ Ledger::setup()
 
     try
     {
-        if (auto const sle = read(keylet::fees()))
+        if (auto const sle = read(keylet::feeSettings()))
         {
             bool oldFees = false;
             bool newFees = false;
diff --git a/src/libxrpl/ledger/View.cpp b/src/libxrpl/ledger/View.cpp
index fdd7998609..ebac76a754 100644
--- a/src/libxrpl/ledger/View.cpp
+++ b/src/libxrpl/ledger/View.cpp
@@ -70,7 +70,7 @@ isVaultPseudoAccountFrozen(
         // LCOV_EXCL_STOP
     }
 
-    auto const mptIssuance = view.read(keylet::mptIssuance(mptShare.getMptID()));
+    auto const mptIssuance = view.read(keylet::mptokenIssuance(mptShare.getMptID()));
     if (mptIssuance == nullptr)
         return false;  // zero MPToken won't block deletion of MPTokenIssuance
 
diff --git a/src/libxrpl/ledger/helpers/AMMHelpers.cpp b/src/libxrpl/ledger/helpers/AMMHelpers.cpp
index cacbfc9d58..7cd27a1f34 100644
--- a/src/libxrpl/ledger/helpers/AMMHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/AMMHelpers.cpp
@@ -555,7 +555,7 @@ ammLPHolds(
     auto const currency = ammLPTCurrency(asset1, asset2);
     STAmount amount;
 
-    auto const sle = view.read(keylet::line(lpAccount, ammAccount, currency));
+    auto const sle = view.read(keylet::trustLine(lpAccount, ammAccount, currency));
     if (!sle)
     {
         amount.clear(Issue{currency, ammAccount});
@@ -647,7 +647,7 @@ ammAccountHolds(ReadView const& view, AccountID const& ammAccountID, Asset const
             }
             else if (
                 auto const sle =
-                    view.read(keylet::line(ammAccountID, issue.account, issue.currency));
+                    view.read(keylet::trustLine(ammAccountID, issue.account, issue.currency));
                 sle && !isFrozen(view, ammAccountID, issue.currency, issue.account))
             {
                 STAmount amount = (*sle)[sfBalance];
diff --git a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
index 8b3385471d..a1af63a80f 100644
--- a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
@@ -40,7 +40,7 @@ namespace xrpl {
 bool
 isGlobalFrozen(ReadView const& view, MPTIssue const& mptIssue)
 {
-    if (auto const sle = view.read(keylet::mptIssuance(mptIssue.getMptID())))
+    if (auto const sle = view.read(keylet::mptokenIssuance(mptIssue.getMptID())))
         return sle->isFlag(lsfMPTLocked);
     return false;
 }
@@ -95,7 +95,7 @@ transferRate(ReadView const& view, MPTID const& issuanceID)
     // fee is 0-50,000 (0-50%), rate is 1,000,000,000-2,000,000,000
     // For example, if transfer fee is 50% then 10,000 * 50,000 = 500,000
     // which represents 50% of 1,000,000,000
-    if (auto const sle = view.read(keylet::mptIssuance(issuanceID));
+    if (auto const sle = view.read(keylet::mptokenIssuance(issuanceID));
         sle && sle->isFieldPresent(sfTransferFee))
     {
         auto const fee = sle->getFieldU16(sfTransferFee);
@@ -110,7 +110,7 @@ transferRate(ReadView const& view, MPTID const& issuanceID)
 canAddHolding(ReadView const& view, MPTIssue const& mptIssue)
 {
     auto mptID = mptIssue.getMptID();
-    auto issuance = view.read(keylet::mptIssuance(mptID));
+    auto issuance = view.read(keylet::mptokenIssuance(mptID));
     if (!issuance)
     {
         return tecOBJECT_NOT_FOUND;
@@ -132,7 +132,7 @@ addEmptyHolding(
     beast::Journal journal)
 {
     auto const& mptID = mptIssue.getMptID();
-    auto const mpt = view.peek(keylet::mptIssuance(mptID));
+    auto const mpt = view.peek(keylet::mptokenIssuance(mptID));
     if (!mpt)
         return tefINTERNAL;  // LCOV_EXCL_LINE
     if (mpt->isFlag(lsfMPTLocked))
@@ -204,7 +204,7 @@ authorizeMPToken(
             return tecINSUFFICIENT_RESERVE;
 
         // Defensive check before we attempt to create MPToken for the issuer
-        auto const mpt = view.read(keylet::mptIssuance(mptIssuanceID));
+        auto const mpt = view.read(keylet::mptokenIssuance(mptIssuanceID));
         if (!mpt || mpt->getAccountID(sfIssuer) == account)
         {
             // LCOV_EXCL_START
@@ -230,7 +230,7 @@ authorizeMPToken(
         return tesSUCCESS;
     }
 
-    auto const sleMptIssuance = view.read(keylet::mptIssuance(mptIssuanceID));
+    auto const sleMptIssuance = view.read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleMptIssuance)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
@@ -308,7 +308,7 @@ requireAuth(
     AuthType authType,
     std::uint8_t depth)
 {
-    auto const mptID = keylet::mptIssuance(mptIssue.getMptID());
+    auto const mptID = keylet::mptokenIssuance(mptIssue.getMptID());
     auto const sleIssuance = view.read(mptID);
     if (!sleIssuance)
         return tecOBJECT_NOT_FOUND;
@@ -406,7 +406,7 @@ enforceMPTokenAuthorization(
     XRPAmount const& priorBalance,  // for MPToken authorization
     beast::Journal j)
 {
-    auto const sleIssuance = view.read(keylet::mptIssuance(mptIssuanceID));
+    auto const sleIssuance = view.read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleIssuance)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
@@ -530,7 +530,7 @@ canTransfer(
     WaiveMPTCanTransfer waive,
     std::uint8_t depth)
 {
-    auto const mptID = keylet::mptIssuance(mptIssue.getMptID());
+    auto const mptID = keylet::mptokenIssuance(mptIssue.getMptID());
     auto const sleIssuance = view.read(mptID);
     if (!sleIssuance)
         return tecOBJECT_NOT_FOUND;
@@ -584,7 +584,7 @@ canTrade(ReadView const& view, Asset const& asset, std::uint8_t depth)
     return asset.visit(
         [&](Issue const&) -> TER { return tesSUCCESS; },
         [&](MPTIssue const& mptIssue) -> TER {
-            auto const sleIssuance = view.read(keylet::mptIssuance(mptIssue.getMptID()));
+            auto const sleIssuance = view.read(keylet::mptokenIssuance(mptIssue.getMptID()));
             if (!sleIssuance)
                 return tecOBJECT_NOT_FOUND;
             if (!sleIssuance->isFlag(lsfMPTCanTrade))
@@ -638,7 +638,7 @@ TER
 lockEscrowMPT(ApplyView& view, AccountID const& sender, STAmount const& amount, beast::Journal j)
 {
     auto const mptIssue = amount.get<MPTIssue>();
-    auto const mptID = keylet::mptIssuance(mptIssue.getMptID());
+    auto const mptID = keylet::mptokenIssuance(mptIssue.getMptID());
     auto sleIssuance = view.peek(mptID);
     if (!sleIssuance)
     {  // LCOV_EXCL_START
@@ -743,7 +743,7 @@ unlockEscrowMPT(
 
     auto const& issuer = netAmount.getIssuer();
     auto const& mptIssue = netAmount.get<MPTIssue>();
-    auto const mptID = keylet::mptIssuance(mptIssue.getMptID());
+    auto const mptID = keylet::mptokenIssuance(mptIssue.getMptID());
     auto sleIssuance = view.peek(mptID);
     if (!sleIssuance)
     {  // LCOV_EXCL_START
@@ -927,7 +927,7 @@ checkCreateMPT(
     if (mptIssue.getIssuer() == holder)
         return tesSUCCESS;
 
-    auto const mptIssuanceID = keylet::mptIssuance(mptIssue.getMptID());
+    auto const mptIssuanceID = keylet::mptokenIssuance(mptIssue.getMptID());
     auto const mptokenID = keylet::mptoken(mptIssuanceID.key, holder);
     if (!view.exists(mptokenID))
     {
@@ -963,7 +963,7 @@ availableMPTAmount(SLE const& sleIssuance)
 std::int64_t
 availableMPTAmount(ReadView const& view, MPTID const& mptID)
 {
-    auto const sle = view.read(keylet::mptIssuance(mptID));
+    auto const sle = view.read(keylet::mptokenIssuance(mptID));
     if (!sle)
         Throw<std::runtime_error>(transHuman(tecINTERNAL));
     return availableMPTAmount(*sle);
@@ -987,7 +987,7 @@ issuerFundsToSelfIssue(ReadView const& view, MPTIssue const& issue)
 {
     STAmount amount{issue};
 
-    auto const sle = view.read(keylet::mptIssuance(issue));
+    auto const sle = view.read(keylet::mptokenIssuance(issue));
     if (!sle)
         return amount;
     auto const available = availableMPTAmount(*sle);
diff --git a/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp b/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
index 5b467db796..af429358bb 100644
--- a/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
@@ -44,8 +44,8 @@ namespace xrpl::nft {
 static SLE::const_pointer
 locatePage(ReadView const& view, AccountID const& owner, uint256 const& id)
 {
-    auto const first = keylet::nftpage(keylet::nftpageMin(owner), id);
-    auto const last = keylet::nftpageMax(owner);
+    auto const first = keylet::nftokenPage(keylet::nftokenPageMin(owner), id);
+    auto const last = keylet::nftokenPageMax(owner);
 
     // This NFT can only be found in the first page with a key that's strictly
     // greater than `first`, so look for that, up until the maximum possible
@@ -57,8 +57,8 @@ locatePage(ReadView const& view, AccountID const& owner, uint256 const& id)
 static SLE::pointer
 locatePage(ApplyView& view, AccountID const& owner, uint256 const& id)
 {
-    auto const first = keylet::nftpage(keylet::nftpageMin(owner), id);
-    auto const last = keylet::nftpageMax(owner);
+    auto const first = keylet::nftokenPage(keylet::nftokenPageMin(owner), id);
+    auto const last = keylet::nftokenPageMax(owner);
 
     // This NFT can only be found in the first page with a key that's strictly
     // greater than `first`, so look for that, up until the maximum possible
@@ -74,9 +74,9 @@ getPageForToken(
     uint256 const& id,
     std::function<void(ApplyView&, AccountID const&)> const& createCallback)
 {
-    auto const base = keylet::nftpageMin(owner);
-    auto const first = keylet::nftpage(base, id);
-    auto const last = keylet::nftpageMax(owner);
+    auto const base = keylet::nftokenPageMin(owner);
+    auto const first = keylet::nftokenPage(base, id);
+    auto const last = keylet::nftokenPageMax(owner);
 
     // This NFT can only be found in the first page with a key that's strictly
     // greater than `first`, so look for that, up until the maximum possible
@@ -182,7 +182,7 @@ getPageForToken(
         ? narr[kDirMaxTokensPerPage - 1].getFieldH256(sfNFTokenID).next()
         : carr[0].getFieldH256(sfNFTokenID);
 
-    auto np = std::make_shared<SLE>(keylet::nftpage(base, tokenIDForNewPage));
+    auto np = std::make_shared<SLE>(keylet::nftokenPage(base, tokenIDForNewPage));
     XRPL_ASSERT(np->key() > base.key, "xrpl::nft::getPageForToken : valid NFT page index");
     np->setFieldArray(sfNFTokens, narr);
     np->setFieldH256(sfNextPageMin, cp->key());
@@ -597,7 +597,7 @@ removeTokenOffersWithLimit(ApplyView& view, Keylet const& directory, std::size_t
         // deleting during iteration.
         for (int i = offerIndexes.size() - 1; i >= 0; --i)
         {
-            if (auto const offer = view.peek(keylet::nftoffer(offerIndexes[i])))
+            if (auto const offer = view.peek(keylet::nftokenOffer(offerIndexes[i])))
             {
                 if (deleteTokenOffer(view, offer))
                 {
@@ -651,11 +651,11 @@ repairNFTokenDirectoryLinks(ApplyView& view, AccountID const& owner)
 {
     bool didRepair = false;
 
-    auto const last = keylet::nftpageMax(owner);
+    auto const last = keylet::nftokenPageMax(owner);
 
     SLE::pointer page = view.peek(Keylet(
         ltNFTOKEN_PAGE,
-        view.succ(keylet::nftpageMin(owner).key, last.key.next()).value_or(last.key)));
+        view.succ(keylet::nftokenPageMin(owner).key, last.key.next()).value_or(last.key)));
 
     if (!page)
         return didRepair;
@@ -839,10 +839,10 @@ tokenOfferCreatePreclaim(
         if (view.rules().enabled(featureNFTokenMintOffer))
         {
             if (nftIssuer != amount.getIssuer() &&
-                !view.read(keylet::line(nftIssuer, amount.get<Issue>())))
+                !view.read(keylet::trustLine(nftIssuer, amount.get<Issue>())))
                 return tecNO_LINE;
         }
-        else if (!view.exists(keylet::line(nftIssuer, amount.get<Issue>())))
+        else if (!view.exists(keylet::trustLine(nftIssuer, amount.get<Issue>())))
         {
             return tecNO_LINE;
         }
@@ -934,7 +934,7 @@ tokenOfferCreateApply(
         priorBalance < view.fees().accountReserve((*acct)[sfOwnerCount] + 1))
         return tecINSUFFICIENT_RESERVE;
 
-    auto const offerID = keylet::nftoffer(acctID, seqProxy.value());
+    auto const offerID = keylet::nftokenOffer(acctID, seqProxy.value());
 
     // Create the offer:
     {
@@ -1020,7 +1020,7 @@ checkTrustlineAuthorized(
 
         if (issuerAccount->isFlag(lsfRequireAuth))
         {
-            auto const trustLine = view.read(keylet::line(id, issue.account, issue.currency));
+            auto const trustLine = view.read(keylet::trustLine(id, issue.account, issue.currency));
 
             if (!trustLine)
             {
@@ -1070,7 +1070,7 @@ checkTrustlineDeepFrozen(
             return tesSUCCESS;
         }
 
-        auto const trustLine = view.read(keylet::line(id, issue.account, issue.currency));
+        auto const trustLine = view.read(keylet::trustLine(id, issue.account, issue.currency));
 
         if (!trustLine)
         {
diff --git a/src/libxrpl/ledger/helpers/RippleStateHelpers.cpp b/src/libxrpl/ledger/helpers/RippleStateHelpers.cpp
index 7ed7ab8fc4..5a2995c030 100644
--- a/src/libxrpl/ledger/helpers/RippleStateHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/RippleStateHelpers.cpp
@@ -47,7 +47,7 @@ creditLimit(
 {
     STAmount result(Issue{currency, account});
 
-    auto sleRippleState = view.read(keylet::line(account, issuer, currency));
+    auto sleRippleState = view.read(keylet::trustLine(account, issuer, currency));
 
     if (sleRippleState)
     {
@@ -78,7 +78,7 @@ creditBalance(
 {
     STAmount result(Issue{currency, account});
 
-    auto sleRippleState = view.read(keylet::line(account, issuer, currency));
+    auto sleRippleState = view.read(keylet::trustLine(account, issuer, currency));
 
     if (sleRippleState)
     {
@@ -114,7 +114,7 @@ isIndividualFrozen(
     if (issuer != account)
     {
         // Check if the issuer froze the line
-        auto const sle = view.read(keylet::line(account, issuer, currency));
+        auto const sle = view.read(keylet::trustLine(account, issuer, currency));
         if (sle && sle->isFlag((issuer > account) ? lsfHighFreeze : lsfLowFreeze))
             return true;
     }
@@ -138,7 +138,7 @@ isFrozen(
     if (issuer != account)
     {
         // Check if the issuer froze the line
-        sle = view.read(keylet::line(account, issuer, currency));
+        sle = view.read(keylet::trustLine(account, issuer, currency));
         if (sle && sle->isFlag((issuer > account) ? lsfHighFreeze : lsfLowFreeze))
             return true;
     }
@@ -162,7 +162,7 @@ isDeepFrozen(
         return false;
     }
 
-    auto const sle = view.read(keylet::line(account, issuer, currency));
+    auto const sle = view.read(keylet::trustLine(account, issuer, currency));
     if (!sle)
     {
         return false;
@@ -403,7 +403,7 @@ issueIOU(
 
     bool const bSenderHigh = issue.account > account;
 
-    auto const index = keylet::line(issue.account, account, issue.currency);
+    auto const index = keylet::trustLine(issue.account, account, issue.currency);
 
     if (auto state = view.peek(index))
     {
@@ -497,7 +497,7 @@ redeemIOU(
 
     bool const bSenderHigh = account > issue.account;
 
-    if (auto state = view.peek(keylet::line(account, issue.account, issue.currency)))
+    if (auto state = view.peek(keylet::trustLine(account, issue.account, issue.currency)))
     {
         STAmount finalBalance = state->getFieldAmount(sfBalance);
 
@@ -558,7 +558,7 @@ requireAuth(ReadView const& view, Issue const& issue, AccountID const& account,
     if (isXRP(issue) || issue.account == account)
         return tesSUCCESS;
 
-    auto const trustLine = view.read(keylet::line(account, issue.account, issue.currency));
+    auto const trustLine = view.read(keylet::trustLine(account, issue.account, issue.currency));
     // If account has no line, and this is a strong check, fail
     if (!trustLine && authType == AuthType::StrongAuth)
         return tecNO_LINE;
@@ -596,7 +596,7 @@ canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, Acc
     auto const isRippleDisabled = [&](AccountID account) -> bool {
         // Line might not exist, but some transfers can create it. If this
         // is the case, just check the default ripple on the issuer account.
-        auto const line = view.read(keylet::line(account, issue));
+        auto const line = view.read(keylet::trustLine(account, issue));
         if (line)
         {
             bool const issuerHigh = issuerId > account;
@@ -638,7 +638,7 @@ addEmptyHolding(
     auto const& srcId = issuerId;
     auto const& dstId = accountID;
     auto const high = srcId > dstId;
-    auto const index = keylet::line(srcId, dstId, currency);
+    auto const index = keylet::trustLine(srcId, dstId, currency);
     auto const sleSrc = view.peek(keylet::account(srcId));
     auto const sleDst = view.peek(keylet::account(dstId));
     if (!sleDst || !sleSrc)
@@ -696,7 +696,7 @@ removeEmptyHolding(
     // If the account is the issuer, then no line should exist. Check anyway.
     // If a line does exist, it will get deleted. If not, return success.
     bool const accountIsIssuer = accountID == issue.account;
-    auto const line = view.peek(keylet::line(accountID, issue));
+    auto const line = view.peek(keylet::trustLine(accountID, issue));
     if (!line)
         return accountIsIssuer ? (TER)tesSUCCESS : (TER)tecOBJECT_NOT_FOUND;
     if (!accountIsIssuer && line->at(sfBalance)->iou() != beast::kZero)
diff --git a/src/libxrpl/ledger/helpers/TokenHelpers.cpp b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
index 7191456868..f0a0220e1e 100644
--- a/src/libxrpl/ledger/helpers/TokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
@@ -179,7 +179,7 @@ getLineIfUsable(
     FreezeHandling zeroIfFrozen,
     beast::Journal j)
 {
-    auto sle = view.read(keylet::line(account, issuer, currency));
+    auto sle = view.read(keylet::trustLine(account, issuer, currency));
 
     if (!sle)
     {
@@ -320,7 +320,7 @@ accountHolds(
     {
         // if the account is the issuer, and the issuance exists, their limit is
         // the issuance limit minus the outstanding value
-        auto const issuance = view.read(keylet::mptIssuance(mptIssue.getMptID()));
+        auto const issuance = view.read(keylet::mptokenIssuance(mptIssue.getMptID()));
 
         if (!issuance)
         {
@@ -357,7 +357,7 @@ accountHolds(
         }
         else if (zeroIfUnauthorized == AuthHandling::ZeroIfUnauthorized)
         {
-            auto const sleIssuance = view.read(keylet::mptIssuance(mptIssue.getMptID()));
+            auto const sleIssuance = view.read(keylet::mptokenIssuance(mptIssue.getMptID()));
 
             // if auth is enabled on the issuance and mpt is not authorized,
             // clear amount
@@ -568,7 +568,7 @@ directSendNoFeeIOU(
     XRPL_ASSERT(uSenderID != uReceiverID, "xrpl::directSendNoFeeIOU : sender is not receiver");
 
     bool const bSenderHigh = uSenderID > uReceiverID;
-    auto const index = keylet::line(uSenderID, uReceiverID, currency);
+    auto const index = keylet::trustLine(uSenderID, uReceiverID, currency);
 
     XRPL_ASSERT(
         !isXRP(uSenderID) && uSenderID != noAccount(),
@@ -1066,7 +1066,7 @@ directSendNoFeeMPT(
     beast::Journal j)
 {
     // Do not check MPT authorization here - it must have been checked earlier
-    auto const mptID = keylet::mptIssuance(saAmount.get<MPTIssue>().getMptID());
+    auto const mptID = keylet::mptokenIssuance(saAmount.get<MPTIssue>().getMptID());
     auto const& issuer = saAmount.getIssuer();
     auto sleIssuance = view.peek(mptID);
     if (!sleIssuance)
@@ -1158,7 +1158,7 @@ directSendNoLimitMPT(
     // Safe to get MPT since directSendNoLimitMPT is only called by accountSendMPT
     auto const& issuer = saAmount.getIssuer();
 
-    auto const sle = view.read(keylet::mptIssuance(saAmount.get<MPTIssue>().getMptID()));
+    auto const sle = view.read(keylet::mptokenIssuance(saAmount.get<MPTIssue>().getMptID()));
     if (!sle)
         return tecOBJECT_NOT_FOUND;
 
@@ -1215,7 +1215,7 @@ directSendNoLimitMultiMPT(
 {
     auto const& issuer = mptIssue.getIssuer();
 
-    auto const sle = view.read(keylet::mptIssuance(mptIssue.getMptID()));
+    auto const sle = view.read(keylet::mptokenIssuance(mptIssue.getMptID()));
     if (!sle)
         return tecOBJECT_NOT_FOUND;
 
diff --git a/src/libxrpl/protocol/Indexes.cpp b/src/libxrpl/protocol/Indexes.cpp
index ae29bd3297..a49f7b85ee 100644
--- a/src/libxrpl/protocol/Indexes.cpp
+++ b/src/libxrpl/protocol/Indexes.cpp
@@ -218,7 +218,7 @@ amendments() noexcept
 }
 
 Keylet const&
-fees() noexcept
+feeSettings() noexcept
 {
     static Keylet const kRet{ltFEE_SETTINGS, indexHash(LedgerNameSpace::FeeSettings)};
     return kRet;
@@ -232,18 +232,18 @@ negativeUNL() noexcept
 }
 
 Keylet
-BookT::operator()(Book const& b) const
+book(Book const& b)
 {
     return {ltDIR_NODE, getBookBase(b)};
 }
 
 Keylet
-line(AccountID const& id0, AccountID const& id1, Currency const& currency) noexcept
+trustLine(AccountID const& id0, AccountID const& id1, Currency const& currency) noexcept
 {
     // There is code in TrustSet that calls us with id0 == id1, to allow users
     // to locate and delete such "weird" trustlines. If we remove that code, we
     // could enable this assert:
-    // XRPL_ASSERT(id0 != id1, "xrpl::keylet::line : accounts must be
+    // XRPL_ASSERT(id0 != id1, "xrpl::keylet::trustLine : accounts must be
     // different");
 
     // A trust line is shared between two accounts; while we typically think
@@ -285,20 +285,20 @@ quality(Keylet const& k, std::uint64_t q) noexcept
 }
 
 Keylet
-NextT::operator()(Keylet const& k) const
+next(Keylet const& k)
 {
-    XRPL_ASSERT(k.type == ltDIR_NODE, "xrpl::keylet::NextT::operator() : valid input type");
+    XRPL_ASSERT(k.type == ltDIR_NODE, "xrpl::keylet::next : valid input type");
     return {ltDIR_NODE, getQualityNext(k.key)};
 }
 
 Keylet
-TicketT::operator()(AccountID const& id, std::uint32_t ticketSeq) const
+ticket(AccountID const& id, std::uint32_t ticketSeq)
 {
     return {ltTICKET, getTicketIndex(id, ticketSeq)};
 }
 
 Keylet
-TicketT::operator()(AccountID const& id, SeqProxy ticketSeq) const
+ticket(AccountID const& id, SeqProxy ticketSeq)
 {
     return {ltTICKET, getTicketIndex(id, ticketSeq)};
 }
@@ -307,15 +307,15 @@ TicketT::operator()(AccountID const& id, SeqProxy ticketSeq) const
 // else. If we ever support multiple pages of signer lists, this would be the
 // keylet used to locate them.
 static Keylet
-signers(AccountID const& account, std::uint32_t page) noexcept
+signerList(AccountID const& account, std::uint32_t page) noexcept
 {
     return {ltSIGNER_LIST, indexHash(LedgerNameSpace::SignerList, account, page)};
 }
 
 Keylet
-signers(AccountID const& account) noexcept
+signerList(AccountID const& account) noexcept
 {
-    return signers(account, 0);
+    return signerList(account, 0);
 }
 
 Keylet
@@ -375,13 +375,13 @@ escrow(AccountID const& src, std::uint32_t seq) noexcept
 }
 
 Keylet
-payChan(AccountID const& src, AccountID const& dst, std::uint32_t seq) noexcept
+payChannel(AccountID const& src, AccountID const& dst, std::uint32_t seq) noexcept
 {
     return {ltPAYCHAN, indexHash(LedgerNameSpace::XRPPaymentChannel, src, dst, seq)};
 }
 
 Keylet
-nftpageMin(AccountID const& owner)
+nftokenPageMin(AccountID const& owner)
 {
     std::array<std::uint8_t, 32> buf{};
     std::memcpy(buf.data(), owner.data(), owner.size());
@@ -389,7 +389,7 @@ nftpageMin(AccountID const& owner)
 }
 
 Keylet
-nftpageMax(AccountID const& owner)
+nftokenPageMax(AccountID const& owner)
 {
     uint256 id = nft::kPageMask;
     std::memcpy(id.data(), owner.data(), owner.size());
@@ -397,14 +397,14 @@ nftpageMax(AccountID const& owner)
 }
 
 Keylet
-nftpage(Keylet const& k, uint256 const& token)
+nftokenPage(Keylet const& k, uint256 const& token)
 {
-    XRPL_ASSERT(k.type == ltNFTOKEN_PAGE, "xrpl::keylet::nftpage : valid input type");
+    XRPL_ASSERT(k.type == ltNFTOKEN_PAGE, "xrpl::keylet::nftokenPage : valid input type");
     return {ltNFTOKEN_PAGE, (k.key & ~nft::kPageMask) + (token & nft::kPageMask)};
 }
 
 Keylet
-nftoffer(AccountID const& owner, std::uint32_t seq)
+nftokenOffer(AccountID const& owner, std::uint32_t seq)
 {
     return {ltNFTOKEN_OFFER, indexHash(LedgerNameSpace::NftokenOffer, owner, seq)};
 }
@@ -518,13 +518,13 @@ oracle(AccountID const& account, std::uint32_t const& documentID) noexcept
 }
 
 Keylet
-mptIssuance(std::uint32_t seq, AccountID const& issuer) noexcept
+mptokenIssuance(std::uint32_t seq, AccountID const& issuer) noexcept
 {
-    return mptIssuance(makeMptID(seq, issuer));
+    return mptokenIssuance(makeMptID(seq, issuer));
 }
 
 Keylet
-mptIssuance(MPTID const& issuanceID) noexcept
+mptokenIssuance(MPTID const& issuanceID) noexcept
 {
     return {ltMPTOKEN_ISSUANCE, indexHash(LedgerNameSpace::MPTokenIssuance, issuanceID)};
 }
@@ -532,7 +532,7 @@ mptIssuance(MPTID const& issuanceID) noexcept
 Keylet
 mptoken(MPTID const& issuanceID, AccountID const& holder) noexcept
 {
-    return mptoken(mptIssuance(issuanceID).key, holder);
+    return mptoken(mptokenIssuance(issuanceID).key, holder);
 }
 
 Keylet
@@ -554,9 +554,9 @@ vault(AccountID const& owner, std::uint32_t seq) noexcept
 }
 
 Keylet
-loanbroker(AccountID const& owner, std::uint32_t seq) noexcept
+loanBroker(AccountID const& owner, std::uint32_t seq) noexcept
 {
-    return loanbroker(indexHash(LedgerNameSpace::LoanBroker, owner, seq));
+    return loanBroker(indexHash(LedgerNameSpace::LoanBroker, owner, seq));
 }
 
 Keylet
diff --git a/src/libxrpl/tx/Transactor.cpp b/src/libxrpl/tx/Transactor.cpp
index 2ff24d92b5..3a10b7124f 100644
--- a/src/libxrpl/tx/Transactor.cpp
+++ b/src/libxrpl/tx/Transactor.cpp
@@ -528,7 +528,7 @@ Transactor::checkSeqProxy(ReadView const& view, STTx const& tx, beast::Journal j
         }
 
         // Transaction can never succeed if the Ticket is not in the ledger.
-        if (!view.exists(keylet::kTicket(id, tSeqProx)))
+        if (!view.exists(keylet::ticket(id, tSeqProx)))
         {
             JLOG(j.trace()) << "applyTransaction: ticket already used or never created "
                             << "a_seq=" << aSeq << " t_seq=" << tSeqProx;
@@ -593,7 +593,7 @@ Transactor::ticketDelete(
 {
     // Delete the Ticket, adjust the account root ticket count, and
     // reduce the owner count.
-    SLE::pointer const sleTicket = view.peek(keylet::kTicket(ticketIndex));
+    SLE::pointer const sleTicket = view.peek(keylet::ticket(ticketIndex));
     if (!sleTicket)
     {
         // LCOV_EXCL_START
@@ -851,7 +851,7 @@ Transactor::checkMultiSign(
     beast::Journal const j)
 {
     // Get id's SignerList and Quorum.
-    STLedgerEntry::const_pointer const sleAccountSigners = view.read(keylet::signers(id));
+    STLedgerEntry::const_pointer const sleAccountSigners = view.read(keylet::signerList(id));
     // If the signer list doesn't exist the account is not multi-signing.
     if (!sleAccountSigners)
     {
@@ -1031,7 +1031,7 @@ removeExpiredNFTokenOffers(
 
     for (auto const& index : offers)
     {
-        if (auto const offer = view.peek(keylet::nftoffer(index)))
+        if (auto const offer = view.peek(keylet::nftokenOffer(index)))
         {
             nft::deleteTokenOffer(view, offer);
             if (++removed == kExpiredOfferRemoveLimit)
diff --git a/src/libxrpl/tx/invariants/InvariantCheck.cpp b/src/libxrpl/tx/invariants/InvariantCheck.cpp
index e29a9fe661..231705efaf 100644
--- a/src/libxrpl/tx/invariants/InvariantCheck.cpp
+++ b/src/libxrpl/tx/invariants/InvariantCheck.cpp
@@ -518,8 +518,8 @@ AccountRootsDeletedClean::finalize(
             // checked above as entries in directAccountKeylets. This uses
             // view.succ() to check for any NFT pages in between the two
             // endpoints.
-            Keylet const first = keylet::nftpageMin(accountID);
-            Keylet const last = keylet::nftpageMax(accountID);
+            Keylet const first = keylet::nftokenPageMin(accountID);
+            Keylet const last = keylet::nftokenPageMax(accountID);
 
             std::optional<uint256> key = view.succ(first.key, last.key.next());
 
diff --git a/src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp b/src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp
index 8586a27be3..d239acd417 100644
--- a/src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp
+++ b/src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp
@@ -130,7 +130,7 @@ ValidLoanBroker::finalize(
     for (auto const& [brokerID, broker] : brokers_)
     {
         auto const& after =
-            broker.brokerAfter ? broker.brokerAfter : view.read(keylet::loanbroker(brokerID));
+            broker.brokerAfter ? broker.brokerAfter : view.read(keylet::loanBroker(brokerID));
 
         if (!after)
         {
diff --git a/src/libxrpl/tx/invariants/MPTInvariant.cpp b/src/libxrpl/tx/invariants/MPTInvariant.cpp
index a2369cc1b9..1176594bbf 100644
--- a/src/libxrpl/tx/invariants/MPTInvariant.cpp
+++ b/src/libxrpl/tx/invariants/MPTInvariant.cpp
@@ -551,7 +551,7 @@ ValidMPTTransfer::finalize(
         std::uint16_t senders = 0;
         std::uint16_t receivers = 0;
         bool invalidTransfer = false;
-        auto const sleIssuance = view.read(keylet::mptIssuance(mptID));
+        auto const sleIssuance = view.read(keylet::mptokenIssuance(mptID));
         if (!sleIssuance)
         {
             continue;
diff --git a/src/libxrpl/tx/invariants/VaultInvariant.cpp b/src/libxrpl/tx/invariants/VaultInvariant.cpp
index 80b8f36bd9..84814977db 100644
--- a/src/libxrpl/tx/invariants/VaultInvariant.cpp
+++ b/src/libxrpl/tx/invariants/VaultInvariant.cpp
@@ -199,7 +199,7 @@ ValidVault::deltaAssets(AccountID const& id) const
             {
                 if (isXRP(issue))
                     return lookup(keylet::account(id).key);
-                auto result = lookup(keylet::line(id, issue).key);
+                auto result = lookup(keylet::trustLine(id, issue).key);
                 // Trust-line balance is stored from the low-account's perspective;
                 // negate if id is the high account so the delta is in id's terms.
                 if (result && id > issue.getIssuer())
@@ -238,7 +238,7 @@ ValidVault::deltaShares(AccountID const& id) const
     auto const& afterVault = afterVault_[0];
     auto const it = [&]() {
         if (id == afterVault.pseudoId)
-            return deltas_.find(keylet::mptIssuance(afterVault.shareMPTID).key);
+            return deltas_.find(keylet::mptokenIssuance(afterVault.shareMPTID).key);
         return deltas_.find(keylet::mptoken(afterVault.shareMPTID, id).key);
     }();
 
@@ -411,7 +411,7 @@ ValidVault::finalize(
                 return e;
         }
 
-        auto const sleShares = view.read(keylet::mptIssuance(afterVault.shareMPTID));
+        auto const sleShares = view.read(keylet::mptokenIssuance(afterVault.shareMPTID));
 
         return sleShares ? std::optional<Shares>(Shares::make(*sleShares)) : std::nullopt;
     }();
diff --git a/src/libxrpl/tx/paths/BookStep.cpp b/src/libxrpl/tx/paths/BookStep.cpp
index 448172872a..adb73f126e 100644
--- a/src/libxrpl/tx/paths/BookStep.cpp
+++ b/src/libxrpl/tx/paths/BookStep.cpp
@@ -1359,7 +1359,7 @@ BookStep<TIn, TOut, TDerived>::check(StrandContext const& ctx) const
 
             auto const err = book_.in.visit(
                 [&](Issue const& issue) -> std::optional<TER> {
-                    auto sle = view.read(keylet::line(*prev, cur, issue.currency));
+                    auto sle = view.read(keylet::trustLine(*prev, cur, issue.currency));
                     if (!sle)
                         return terNO_LINE;
                     if (sle->isFlag((cur > *prev) ? lsfHighNoRipple : lsfLowNoRipple))
diff --git a/src/libxrpl/tx/paths/DirectStep.cpp b/src/libxrpl/tx/paths/DirectStep.cpp
index cc6e75ea3d..f8f12bd421 100644
--- a/src/libxrpl/tx/paths/DirectStep.cpp
+++ b/src/libxrpl/tx/paths/DirectStep.cpp
@@ -344,7 +344,7 @@ DirectIPaymentStep::quality(ReadView const& sb, QualityDirection qDir) const
     if (src_ == dst_)
         return QUALITY_ONE;
 
-    auto const sle = sb.read(keylet::line(dst_, src_, currency_));
+    auto const sle = sb.read(keylet::trustLine(dst_, src_, currency_));
 
     if (!sle)
         return QUALITY_ONE;
@@ -420,7 +420,7 @@ DirectIPaymentStep::check(StrandContext const& ctx, SLE::const_ref sleSrc) const
     // Since this is a payment a trust line must be present.  Perform all
     // trust line related checks.
     {
-        auto const sleLine = ctx.view.read(keylet::line(src_, dst_, currency_));
+        auto const sleLine = ctx.view.read(keylet::trustLine(src_, dst_, currency_));
         if (!sleLine)
         {
             JLOG(j_.trace()) << "DirectStepI: No credit line. " << *this;
diff --git a/src/libxrpl/tx/paths/MPTEndpointStep.cpp b/src/libxrpl/tx/paths/MPTEndpointStep.cpp
index 7dcd6d9241..a47cfa15a5 100644
--- a/src/libxrpl/tx/paths/MPTEndpointStep.cpp
+++ b/src/libxrpl/tx/paths/MPTEndpointStep.cpp
@@ -434,7 +434,7 @@ MPTEndpointStep<TDerived>::maxPaymentFlow(ReadView const& sb) const
         return {toAmount<MPTAmount>(maxFlow), DebtDirection::Redeems};
 
     // From an issuer to a holder
-    if (auto const sle = sb.read(keylet::mptIssuance(mptIssue_)))
+    if (auto const sle = sb.read(keylet::mptokenIssuance(mptIssue_)))
     {
         // If issuer is the source account, and it is direct payment then
         // MPTEndpointStep is the only step. Provide available maxFlow.
diff --git a/src/libxrpl/tx/paths/XRPEndpointStep.cpp b/src/libxrpl/tx/paths/XRPEndpointStep.cpp
index efdad92791..05d893a50d 100644
--- a/src/libxrpl/tx/paths/XRPEndpointStep.cpp
+++ b/src/libxrpl/tx/paths/XRPEndpointStep.cpp
@@ -203,7 +203,7 @@ private:
         {
             return ctx.strandDeliver.visit(
                 [&](Issue const& issue) {
-                    if (!ctx.view.exists(keylet::line(acc, issue)))
+                    if (!ctx.view.exists(keylet::trustLine(acc, issue)))
                         return -1;
                     return 0;
                 },
diff --git a/src/libxrpl/tx/transactors/account/AccountDelete.cpp b/src/libxrpl/tx/transactors/account/AccountDelete.cpp
index 833f1c8b25..254733a618 100644
--- a/src/libxrpl/tx/transactors/account/AccountDelete.cpp
+++ b/src/libxrpl/tx/transactors/account/AccountDelete.cpp
@@ -260,8 +260,8 @@ AccountDelete::preclaim(PreclaimContext const& ctx)
         return tecHAS_OBLIGATIONS;
 
     // If the account owns any NFTs it cannot be deleted.
-    Keylet const first = keylet::nftpageMin(account);
-    Keylet const last = keylet::nftpageMax(account);
+    Keylet const first = keylet::nftokenPageMin(account);
+    Keylet const last = keylet::nftokenPageMax(account);
 
     auto const cp = ctx.view.read(
         Keylet(ltNFTOKEN_PAGE, ctx.view.succ(first.key, last.key.next()).value_or(last.key)));
diff --git a/src/libxrpl/tx/transactors/account/AccountSet.cpp b/src/libxrpl/tx/transactors/account/AccountSet.cpp
index 36a7e7419f..dfe7ec5b5f 100644
--- a/src/libxrpl/tx/transactors/account/AccountSet.cpp
+++ b/src/libxrpl/tx/transactors/account/AccountSet.cpp
@@ -315,7 +315,7 @@ AccountSet::doApply()
             return tecNEED_MASTER_KEY;
         }
 
-        if ((!sle->isFieldPresent(sfRegularKey)) && (!view().peek(keylet::signers(accountID_))))
+        if ((!sle->isFieldPresent(sfRegularKey)) && (!view().peek(keylet::signerList(accountID_))))
         {
             // Account has no regular key or multi-signer signer list.
             return tecNO_ALTERNATIVE_KEY;
diff --git a/src/libxrpl/tx/transactors/account/SetRegularKey.cpp b/src/libxrpl/tx/transactors/account/SetRegularKey.cpp
index 08ccf5e7ab..f408f31690 100644
--- a/src/libxrpl/tx/transactors/account/SetRegularKey.cpp
+++ b/src/libxrpl/tx/transactors/account/SetRegularKey.cpp
@@ -67,7 +67,7 @@ SetRegularKey::doApply()
     else
     {
         // Account has disabled master key and no multi-signer signer list.
-        if (sle->isFlag(lsfDisableMaster) && !view().peek(keylet::signers(accountID_)))
+        if (sle->isFlag(lsfDisableMaster) && !view().peek(keylet::signerList(accountID_)))
             return tecNO_ALTERNATIVE_KEY;
 
         sle->makeFieldAbsent(sfRegularKey);
diff --git a/src/libxrpl/tx/transactors/account/SignerListSet.cpp b/src/libxrpl/tx/transactors/account/SignerListSet.cpp
index cedb9ace78..2f95d32664 100644
--- a/src/libxrpl/tx/transactors/account/SignerListSet.cpp
+++ b/src/libxrpl/tx/transactors/account/SignerListSet.cpp
@@ -232,7 +232,7 @@ SignerListSet::removeFromLedger(
 {
     auto const accountKeylet = keylet::account(account);
     auto const ownerDirKeylet = keylet::ownerDir(account);
-    auto const signerListKeylet = keylet::signers(account);
+    auto const signerListKeylet = keylet::signerList(account);
 
     return removeSignersFromLedger(
         registry, view, accountKeylet, ownerDirKeylet, signerListKeylet, j);
@@ -302,7 +302,7 @@ SignerListSet::replaceSignerList()
 {
     auto const accountKeylet = keylet::account(accountID_);
     auto const ownerDirKeylet = keylet::ownerDir(accountID_);
-    auto const signerListKeylet = keylet::signers(accountID_);
+    auto const signerListKeylet = keylet::signerList(accountID_);
 
     // This may be either a create or a replace.  Preemptively remove any
     // old signer list.  May reduce the reserve, so this is done before
@@ -367,7 +367,7 @@ SignerListSet::destroySignerList()
         return tecNO_ALTERNATIVE_KEY;
 
     auto const ownerDirKeylet = keylet::ownerDir(accountID_);
-    auto const signerListKeylet = keylet::signers(accountID_);
+    auto const signerListKeylet = keylet::signerList(accountID_);
     return removeSignersFromLedger(
         ctx_.registry, view(), accountKeylet, ownerDirKeylet, signerListKeylet, j_);
 }
diff --git a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
index 273beaea0f..1e9e0bfc61 100644
--- a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
+++ b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
@@ -759,7 +759,7 @@ getSignersListAndQuorum(ReadView const& view, SLE const& sleBridge, beast::Journ
         return {r, q, tecINTERNAL};
     }
 
-    auto const sleS = view.read(keylet::signers(sleBridge[sfAccount]));
+    auto const sleS = view.read(keylet::signerList(sleBridge[sfAccount]));
     if (!sleS)
     {
         return {r, q, tecXCHAIN_NO_SIGNERS_LIST};
diff --git a/src/libxrpl/tx/transactors/check/CheckCash.cpp b/src/libxrpl/tx/transactors/check/CheckCash.cpp
index c5813ae42d..80ef742f52 100644
--- a/src/libxrpl/tx/transactors/check/CheckCash.cpp
+++ b/src/libxrpl/tx/transactors/check/CheckCash.cpp
@@ -192,7 +192,7 @@ CheckCash::preclaim(PreclaimContext const& ctx)
                 [&](Issue const& issue) -> TER {
                     Currency const currency{issue.currency};
                     auto const sleTrustLine =
-                        ctx.view.read(keylet::line(dstId, issuerId, currency));
+                        ctx.view.read(keylet::trustLine(dstId, issuerId, currency));
 
                     auto const sleIssuer = ctx.view.read(keylet::account(issuerId));
                     if (!sleIssuer)
@@ -411,7 +411,7 @@ CheckCash::doApply()
                     // If a trust line does not exist yet create one.
                     Issue const& trustLineIssue = issue;
                     AccountID const truster = deliverIssuer == accountID_ ? srcId : accountID_;
-                    trustLineKey = keylet::line(truster, trustLineIssue);
+                    trustLineKey = keylet::trustLine(truster, trustLineIssue);
                     destLow = deliverIssuer > accountID_;
 
                     if (!psb.exists(*trustLineKey))
diff --git a/src/libxrpl/tx/transactors/check/CheckCreate.cpp b/src/libxrpl/tx/transactors/check/CheckCreate.cpp
index ff82912a1f..595bcc4ab1 100644
--- a/src/libxrpl/tx/transactors/check/CheckCreate.cpp
+++ b/src/libxrpl/tx/transactors/check/CheckCreate.cpp
@@ -127,7 +127,7 @@ CheckCreate::preclaim(PreclaimContext const& ctx)
                     {
                         // Check if the issuer froze the line
                         auto const sleTrust =
-                            ctx.view.read(keylet::line(srcId, issuerId, issue.currency));
+                            ctx.view.read(keylet::trustLine(srcId, issuerId, issue.currency));
                         if (sleTrust &&
                             sleTrust->isFlag((issuerId > srcId) ? lsfHighFreeze : lsfLowFreeze))
                         {
@@ -139,7 +139,7 @@ CheckCreate::preclaim(PreclaimContext const& ctx)
                     {
                         // Check if dst froze the line.
                         auto const sleTrust =
-                            ctx.view.read(keylet::line(issuerId, dstId, issue.currency));
+                            ctx.view.read(keylet::trustLine(issuerId, dstId, issue.currency));
                         if (sleTrust &&
                             sleTrust->isFlag((dstId > issuerId) ? lsfHighFreeze : lsfLowFreeze))
                         {
diff --git a/src/libxrpl/tx/transactors/dex/AMMClawback.cpp b/src/libxrpl/tx/transactors/dex/AMMClawback.cpp
index 0cc2be381f..c1ef9f875e 100644
--- a/src/libxrpl/tx/transactors/dex/AMMClawback.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMClawback.cpp
@@ -136,7 +136,7 @@ AMMClawback::preclaim(PreclaimContext const& ctx)
                     !sleIssuer->isFlag(lsfNoFreeze);
             },
             [&](MPTIssue const& issue) {
-                auto const sleIssuance = ctx.view.read(keylet::mptIssuance(issue.getMptID()));
+                auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(issue.getMptID()));
 
                 return sleIssuance && sleIssuance->isFlag(lsfMPTCanClawback) &&
                     sleIssuance->getAccountID(sfIssuer) == ctx.tx[sfAccount];
diff --git a/src/libxrpl/tx/transactors/dex/AMMCreate.cpp b/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
index 9c1a5cfacb..ef271ba362 100644
--- a/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
@@ -212,7 +212,7 @@ AMMCreate::preclaim(PreclaimContext const& ctx)
     auto clawbackDisabled = [&](Asset const& asset) -> TER {
         return asset.visit(
             [&](MPTIssue const& issue) -> TER {
-                auto const sle = ctx.view.read(keylet::mptIssuance(issue.getMptID()));
+                auto const sle = ctx.view.read(keylet::mptokenIssuance(issue.getMptID()));
                 if (!sle)
                     return tecINTERNAL;  // LCOV_EXCL_LINE
                 if (sle->isFlag(lsfMPTCanClawback))
@@ -260,7 +260,7 @@ applyCreate(ApplyContext& ctx, Sandbox& sb, AccountID const& account, beast::Jou
 
     // LP Token already exists. (should not happen)
     auto const lptIss = ammLPTIssue(amount.asset(), amount2.asset(), accountId);
-    if (sb.read(keylet::line(accountId, lptIss)))
+    if (sb.read(keylet::trustLine(accountId, lptIss)))
     {
         JLOG(j.error()) << "AMM Instance: LP Token already exists.";
         return {tecDUPLICATE, false};
@@ -330,7 +330,8 @@ applyCreate(ApplyContext& ctx, Sandbox& sb, AccountID const& account, beast::Jou
                 // Set AMM flag on AMM trustline
                 if (!isXRP(amount))
                 {
-                    SLE::pointer const sleRippleState = sb.peek(keylet::line(accountId, issue));
+                    SLE::pointer const sleRippleState =
+                        sb.peek(keylet::trustLine(accountId, issue));
                     if (!sleRippleState)
                     {
                         return tecINTERNAL;  // LCOV_EXCL_LINE
@@ -364,7 +365,7 @@ applyCreate(ApplyContext& ctx, Sandbox& sb, AccountID const& account, beast::Jou
                     << lpTokens << " " << amount << " " << amount2;
     auto addOrderBook = [&](Asset const& assetIn, Asset const& assetOut, std::uint64_t uRate) {
         Book const book{assetIn, assetOut, std::nullopt};
-        auto const dir = keylet::quality(keylet::kBook(book), uRate);
+        auto const dir = keylet::quality(keylet::book(book), uRate);
         if (auto const bookExisted = static_cast<bool>(sb.read(dir)); !bookExisted)
             ctx.registry.get().getOrderBookDB().addOrderBook(book);
     };
diff --git a/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp b/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
index 653e8c6961..3665850f2d 100644
--- a/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
@@ -233,7 +233,7 @@ AMMDeposit::preclaim(PreclaimContext const& ctx)
             auto const lpIssue = (*ammSle)[sfLPTokenBalance].get<Issue>();
             // Adjust the reserve if LP doesn't have LPToken trustline
             auto const sle =
-                ctx.view.read(keylet::line(accountID, lpIssue.account, lpIssue.currency));
+                ctx.view.read(keylet::trustLine(accountID, lpIssue.account, lpIssue.currency));
             if (xrpLiquid(ctx.view, accountID, !sle, ctx.j) >= deposit)
                 return TER(tesSUCCESS);
             if (sle)
@@ -532,7 +532,8 @@ AMMDeposit::deposit(
         {
             auto const& lpIssue = lpTokensDeposit.get<Issue>();
             // Adjust the reserve if LP doesn't have LPToken trustline
-            auto const sle = view.read(keylet::line(accountID_, lpIssue.account, lpIssue.currency));
+            auto const sle =
+                view.read(keylet::trustLine(accountID_, lpIssue.account, lpIssue.currency));
             if (xrpLiquid(view, accountID_, !sle, j_) >= depositAmount)
                 return tesSUCCESS;
         }
diff --git a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
index 17ce1a6b83..6cbcfb1e50 100644
--- a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
@@ -615,8 +615,8 @@ AMMWithdraw::withdraw(
         bool const isIssue = asset.holds<Issue>();
         bool const assetNotExists = [&] {
             if (isIssue)
-                return !view.exists(keylet::line(account, asset.get<Issue>()));
-            auto const issuanceKey = keylet::mptIssuance(asset.get<MPTIssue>());
+                return !view.exists(keylet::trustLine(account, asset.get<Issue>()));
+            auto const issuanceKey = keylet::mptokenIssuance(asset.get<MPTIssue>());
             mptokenKey = keylet::mptoken(issuanceKey.key, account);
             if (!view.exists(*mptokenKey))
                 return true;
diff --git a/src/libxrpl/tx/transactors/dex/OfferCreate.cpp b/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
index 547d40e7b8..ed5a22e3db 100644
--- a/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
+++ b/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
@@ -284,7 +284,7 @@ OfferCreate::checkAcceptAsset(
             auto const& issuer = issue.getIssuer();
             if (issuerAccount->isFlag(lsfRequireAuth))
             {
-                auto const trustLine = view.read(keylet::line(id, issuer, issue.currency));
+                auto const trustLine = view.read(keylet::trustLine(id, issuer, issue.currency));
 
                 if (!trustLine)
                 {
@@ -308,7 +308,7 @@ OfferCreate::checkAcceptAsset(
                 }
             }
 
-            auto const trustLine = view.read(keylet::line(id, issue.account, issue.currency));
+            auto const trustLine = view.read(keylet::trustLine(id, issue.account, issue.currency));
 
             if (!trustLine)
             {
@@ -575,7 +575,7 @@ OfferCreate::applyHybrid(
     // if offer is hybrid, need to also place into open offer dir
     Book const book{saTakerPays.asset(), saTakerGets.asset(), std::nullopt};
 
-    auto dir = keylet::quality(keylet::kBook(book), openRate);
+    auto dir = keylet::quality(keylet::book(book), openRate);
     bool const bookExists = sb.exists(dir);
 
     auto const bookNode = sb.dirAppend(dir, offerKey, [&](SLE::ref sle) {
@@ -887,7 +887,7 @@ OfferCreate::applyGuts(Sandbox& sb, Sandbox& sbCancel)
     // Hybrid domain offer - BookDirectory points to domain directory,
     // and AdditionalBooks field stores one entry that points to the open
     // directory
-    auto dir = keylet::quality(keylet::kBook(book), uRate);
+    auto dir = keylet::quality(keylet::book(book), uRate);
     bool const bookExisted = static_cast<bool>(sb.peek(dir));
 
     auto setBookDir = [&](SLE::ref sle, std::optional<uint256> const& maybeDomain) {
diff --git a/src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp b/src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp
index b8f4604d73..55a9133e1e 100644
--- a/src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp
+++ b/src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp
@@ -72,7 +72,7 @@ escrowCancelPreclaimHelper<MPTIssue>(
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
     // If the mpt does not exist, return tecOBJECT_NOT_FOUND
-    auto const issuanceKey = keylet::mptIssuance(amount.get<MPTIssue>().getMptID());
+    auto const issuanceKey = keylet::mptokenIssuance(amount.get<MPTIssue>().getMptID());
     auto const sleIssuance = ctx.view.read(issuanceKey);
     if (!sleIssuance)
         return tecOBJECT_NOT_FOUND;
diff --git a/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp b/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
index 0a12e2d1bc..0d83885349 100644
--- a/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
+++ b/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
@@ -208,7 +208,7 @@ escrowCreatePreclaimHelper<Issue>(
         return tecNO_PERMISSION;
 
     // If the account does not have a trustline to the issuer, return tecNO_LINE
-    auto const sleRippleState = ctx.view.read(keylet::line(account, issuer, issue.currency));
+    auto const sleRippleState = ctx.view.read(keylet::trustLine(account, issuer, issue.currency));
     if (!sleRippleState)
         return tecNO_LINE;
 
@@ -271,7 +271,7 @@ escrowCreatePreclaimHelper<MPTIssue>(
         return tecNO_PERMISSION;
 
     // If the mpt does not exist, return tecOBJECT_NOT_FOUND
-    auto const issuanceKey = keylet::mptIssuance(amount.get<MPTIssue>().getMptID());
+    auto const issuanceKey = keylet::mptokenIssuance(amount.get<MPTIssue>().getMptID());
     auto const sleIssuance = ctx.view.read(issuanceKey);
     if (!sleIssuance)
         return tecOBJECT_NOT_FOUND;
diff --git a/src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp b/src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp
index 4cda867b48..7f1f9ec078 100644
--- a/src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp
+++ b/src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp
@@ -172,7 +172,7 @@ escrowFinishPreclaimHelper<MPTIssue>(
         return tesSUCCESS;
 
     // If the mpt does not exist, return tecOBJECT_NOT_FOUND
-    auto const issuanceKey = keylet::mptIssuance(amount.get<MPTIssue>().getMptID());
+    auto const issuanceKey = keylet::mptokenIssuance(amount.get<MPTIssue>().getMptID());
     auto const sleIssuance = ctx.view.read(issuanceKey);
     if (!sleIssuance)
         return tecOBJECT_NOT_FOUND;
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverClawback.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverClawback.cpp
index 041bf73abf..9bb84e878e 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverClawback.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverClawback.cpp
@@ -218,7 +218,7 @@ preclaimHelper<MPTIssue>(
     SLE const& sleIssuer,
     STAmount const& clawAmount)
 {
-    auto const issuanceKey = keylet::mptIssuance(clawAmount.get<MPTIssue>().getMptID());
+    auto const issuanceKey = keylet::mptokenIssuance(clawAmount.get<MPTIssue>().getMptID());
     auto const sleIssuance = ctx.view.read(issuanceKey);
     if (!sleIssuance)
         return tecOBJECT_NOT_FOUND;
@@ -245,7 +245,7 @@ LoanBrokerCoverClawback::preclaim(PreclaimContext const& ctx)
     auto const brokerID = *findBrokerID;
     auto const amount = tx[~sfAmount];
 
-    auto const sleBroker = ctx.view.read(keylet::loanbroker(brokerID));
+    auto const sleBroker = ctx.view.read(keylet::loanBroker(brokerID));
     if (!sleBroker)
     {
         JLOG(ctx.j.warn()) << "LoanBroker does not exist.";
@@ -344,7 +344,7 @@ LoanBrokerCoverClawback::doApply()
     auto const brokerID = *findBrokerID;
     auto const amount = tx[~sfAmount];
 
-    auto sleBroker = view().peek(keylet::loanbroker(brokerID));
+    auto sleBroker = view().peek(keylet::loanBroker(brokerID));
     if (!sleBroker)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
index 537996ba57..76a5493a73 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
@@ -49,7 +49,7 @@ LoanBrokerCoverDeposit::preclaim(PreclaimContext const& ctx)
     auto const brokerID = tx[sfLoanBrokerID];
     auto const amount = tx[sfAmount];
 
-    auto const sleBroker = ctx.view.read(keylet::loanbroker(brokerID));
+    auto const sleBroker = ctx.view.read(keylet::loanBroker(brokerID));
     if (!sleBroker)
     {
         JLOG(ctx.j.warn()) << "LoanBroker does not exist.";
@@ -129,7 +129,7 @@ LoanBrokerCoverDeposit::doApply()
     auto const& tx = ctx_.tx;
 
     auto const brokerID = tx[sfLoanBrokerID];
-    auto broker = view().peek(keylet::loanbroker(brokerID));
+    auto broker = view().peek(keylet::loanBroker(brokerID));
     if (!broker)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
index fea6f3b9cb..426f77cc70 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
@@ -68,7 +68,7 @@ LoanBrokerCoverWithdraw::preclaim(PreclaimContext const& ctx)
         JLOG(ctx.j.warn()) << "Trying to withdraw into a pseudo-account.";
         return tecPSEUDO_ACCOUNT;
     }
-    auto const sleBroker = ctx.view.read(keylet::loanbroker(brokerID));
+    auto const sleBroker = ctx.view.read(keylet::loanBroker(brokerID));
     if (!sleBroker)
     {
         JLOG(ctx.j.warn()) << "LoanBroker does not exist.";
@@ -180,7 +180,7 @@ LoanBrokerCoverWithdraw::doApply()
     auto const amount = tx[sfAmount];
     auto const dstAcct = tx[~sfDestination].value_or(accountID_);
 
-    auto broker = view().peek(keylet::loanbroker(brokerID));
+    auto broker = view().peek(keylet::loanBroker(brokerID));
     if (!broker)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerDelete.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerDelete.cpp
index f3c000bf0b..141cc2cf56 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerDelete.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerDelete.cpp
@@ -43,7 +43,7 @@ LoanBrokerDelete::preclaim(PreclaimContext const& ctx)
     auto const account = tx[sfAccount];
     auto const brokerID = tx[sfLoanBrokerID];
 
-    auto const sleBroker = ctx.view.read(keylet::loanbroker(brokerID));
+    auto const sleBroker = ctx.view.read(keylet::loanBroker(brokerID));
     if (!sleBroker)
     {
         JLOG(ctx.j.warn()) << "LoanBroker does not exist.";
@@ -129,7 +129,7 @@ LoanBrokerDelete::doApply()
     auto const brokerID = tx[sfLoanBrokerID];
 
     // Delete the loan broker
-    auto broker = view().peek(keylet::loanbroker(brokerID));
+    auto broker = view().peek(keylet::loanBroker(brokerID));
     if (!broker)
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
     auto const vaultID = broker->at(sfVaultID);
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerSet.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerSet.cpp
index 2dc003eb7f..ab1c8f22dc 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerSet.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerSet.cpp
@@ -114,7 +114,7 @@ LoanBrokerSet::preclaim(PreclaimContext const& ctx)
     {
         // Updating an existing Broker
 
-        auto const sleBroker = ctx.view.read(keylet::loanbroker(*brokerID));
+        auto const sleBroker = ctx.view.read(keylet::loanBroker(*brokerID));
         if (!sleBroker)
         {
             JLOG(ctx.j.warn()) << "LoanBroker does not exist.";
@@ -178,7 +178,7 @@ LoanBrokerSet::doApply()
     if (auto const brokerID = tx[~sfLoanBrokerID])
     {
         // Modify an existing LoanBroker
-        auto broker = view.peek(keylet::loanbroker(*brokerID));
+        auto broker = view.peek(keylet::loanBroker(*brokerID));
         if (!broker)
         {
             // This should be impossible
@@ -229,7 +229,7 @@ LoanBrokerSet::doApply()
             return tefBAD_LEDGER;
             // LCOV_EXCL_STOP
         }
-        auto broker = std::make_shared<SLE>(keylet::loanbroker(accountID_, sequence));
+        auto broker = std::make_shared<SLE>(keylet::loanBroker(accountID_, sequence));
 
         if (auto const ter = dirLink(view, accountID_, broker))
             return ter;  // LCOV_EXCL_LINE
diff --git a/src/libxrpl/tx/transactors/lending/LoanDelete.cpp b/src/libxrpl/tx/transactors/lending/LoanDelete.cpp
index d4ec92a9fb..3459119379 100644
--- a/src/libxrpl/tx/transactors/lending/LoanDelete.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanDelete.cpp
@@ -54,7 +54,7 @@ LoanDelete::preclaim(PreclaimContext const& ctx)
     }
 
     auto const loanBrokerID = loanSle->at(sfLoanBrokerID);
-    auto const loanBrokerSle = ctx.view.read(keylet::loanbroker(loanBrokerID));
+    auto const loanBrokerSle = ctx.view.read(keylet::loanBroker(loanBrokerID));
     if (!loanBrokerSle)
     {
         // should be impossible
@@ -85,7 +85,7 @@ LoanDelete::doApply()
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
 
     auto const brokerID = loanSle->at(sfLoanBrokerID);
-    auto const brokerSle = view.peek(keylet::loanbroker(brokerID));
+    auto const brokerSle = view.peek(keylet::loanBroker(brokerID));
     if (!brokerSle)
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
     auto const brokerPseudoAccount = brokerSle->at(sfAccount);
diff --git a/src/libxrpl/tx/transactors/lending/LoanManage.cpp b/src/libxrpl/tx/transactors/lending/LoanManage.cpp
index 2b5c9d25f6..830eb30272 100644
--- a/src/libxrpl/tx/transactors/lending/LoanManage.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanManage.cpp
@@ -111,7 +111,7 @@ LoanManage::preclaim(PreclaimContext const& ctx)
     }
 
     auto const loanBrokerID = loanSle->at(sfLoanBrokerID);
-    auto const loanBrokerSle = ctx.view.read(keylet::loanbroker(loanBrokerID));
+    auto const loanBrokerSle = ctx.view.read(keylet::loanBroker(loanBrokerID));
     if (!loanBrokerSle)
     {
         // should be impossible
@@ -398,7 +398,7 @@ LoanManage::doApply()
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
 
     auto const brokerID = loanSle->at(sfLoanBrokerID);
-    auto const brokerSle = view.peek(keylet::loanbroker(brokerID));
+    auto const brokerSle = view.peek(keylet::loanBroker(brokerID));
     if (!brokerSle)
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
 
diff --git a/src/libxrpl/tx/transactors/lending/LoanPay.cpp b/src/libxrpl/tx/transactors/lending/LoanPay.cpp
index 5c0b46de42..fcda2a9fff 100644
--- a/src/libxrpl/tx/transactors/lending/LoanPay.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanPay.cpp
@@ -110,7 +110,7 @@ LoanPay::calculateBaseFee(ReadView const& view, STTx const& tx)
         return normalCost;
     }
 
-    auto const brokerSle = view.read(keylet::loanbroker(loanSle->at(sfLoanBrokerID)));
+    auto const brokerSle = view.read(keylet::loanBroker(loanSle->at(sfLoanBrokerID)));
     if (!brokerSle)
     {
         // Let preclaim worry about the error for this
@@ -213,7 +213,7 @@ LoanPay::preclaim(PreclaimContext const& ctx)
     }
 
     auto const loanBrokerID = loanSle->at(sfLoanBrokerID);
-    auto const loanBrokerSle = ctx.view.read(keylet::loanbroker(loanBrokerID));
+    auto const loanBrokerSle = ctx.view.read(keylet::loanBroker(loanBrokerID));
     if (!loanBrokerSle)
     {
         // This should be impossible
@@ -293,7 +293,7 @@ LoanPay::doApply()
     std::int32_t const loanScale = loanSle->at(sfLoanScale);
 
     auto const brokerID = loanSle->at(sfLoanBrokerID);
-    auto const brokerSle = view.peek(keylet::loanbroker(brokerID));
+    auto const brokerSle = view.peek(keylet::loanBroker(brokerID));
     if (!brokerSle)
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
     auto const brokerOwner = brokerSle->at(sfOwner);
diff --git a/src/libxrpl/tx/transactors/lending/LoanSet.cpp b/src/libxrpl/tx/transactors/lending/LoanSet.cpp
index 573f700f51..903707320b 100644
--- a/src/libxrpl/tx/transactors/lending/LoanSet.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanSet.cpp
@@ -150,7 +150,7 @@ LoanSet::checkSign(PreclaimContext const& ctx)
         if (auto const c = ctx.tx.at(~sfCounterparty))
             return c;
 
-        if (auto const broker = ctx.view.read(keylet::loanbroker(ctx.tx[sfLoanBrokerID])))
+        if (auto const broker = ctx.view.read(keylet::loanBroker(ctx.tx[sfLoanBrokerID])))
             return broker->at(sfOwner);
         return std::nullopt;
     }();
@@ -268,7 +268,7 @@ LoanSet::preclaim(PreclaimContext const& ctx)
     auto const account = tx[sfAccount];
     auto const brokerID = tx[sfLoanBrokerID];
 
-    auto const brokerSle = ctx.view.read(keylet::loanbroker(brokerID));
+    auto const brokerSle = ctx.view.read(keylet::loanBroker(brokerID));
     if (!brokerSle)
     {
         // This can only be hit if there's a counterparty specified, otherwise
@@ -373,7 +373,7 @@ LoanSet::doApply()
 
     auto const brokerID = tx[sfLoanBrokerID];
 
-    auto const brokerSle = view.peek(keylet::loanbroker(brokerID));
+    auto const brokerSle = view.peek(keylet::loanBroker(brokerID));
     if (!brokerSle)
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
     auto const brokerOwner = brokerSle->at(sfOwner);
diff --git a/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp b/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
index 6a82a15044..1d303b7141 100644
--- a/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
+++ b/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
@@ -60,7 +60,7 @@ NFTokenAcceptOffer::preclaim(PreclaimContext const& ctx)
             if (id->isZero())
                 return {nullptr, tecOBJECT_NOT_FOUND};
 
-            auto offerSLE = ctx.view.read(keylet::nftoffer(*id));
+            auto offerSLE = ctx.view.read(keylet::nftokenOffer(*id));
 
             if (!offerSLE)
                 return {nullptr, tecOBJECT_NOT_FOUND};
@@ -307,7 +307,7 @@ NFTokenAcceptOffer::preclaim(PreclaimContext const& ctx)
         if (ctx.view.rules().enabled(fixEnforceNFTokenTrustline) &&
             (nft::getFlags(tokenID) & nft::kFlagCreateTrustLines) == 0 &&
             nftMinter != amount.getIssuer() &&
-            !ctx.view.read(keylet::line(nftMinter, amount.get<Issue>())))
+            !ctx.view.read(keylet::trustLine(nftMinter, amount.get<Issue>())))
             return tecNO_LINE;
 
         // Check that the issuer is allowed to receive IOUs.
@@ -442,7 +442,7 @@ NFTokenAcceptOffer::doApply()
     auto const loadToken = [this](std::optional<uint256> const& id) {
         SLE::pointer sle;
         if (id)
-            sle = view().peek(keylet::nftoffer(*id));
+            sle = view().peek(keylet::nftokenOffer(*id));
         return sle;
     };
 
diff --git a/src/libxrpl/tx/transactors/nft/NFTokenCancelOffer.cpp b/src/libxrpl/tx/transactors/nft/NFTokenCancelOffer.cpp
index d04714907e..6c6f7d4e8b 100644
--- a/src/libxrpl/tx/transactors/nft/NFTokenCancelOffer.cpp
+++ b/src/libxrpl/tx/transactors/nft/NFTokenCancelOffer.cpp
@@ -88,7 +88,7 @@ NFTokenCancelOffer::doApply()
 {
     for (auto const& id : ctx_.tx[sfNFTokenOffers])
     {
-        if (auto offer = view().peek(keylet::nftoffer(id));
+        if (auto offer = view().peek(keylet::nftokenOffer(id));
             offer && !nft::deleteTokenOffer(view(), offer))
         {
             // LCOV_EXCL_START
diff --git a/src/libxrpl/tx/transactors/payment_channel/PaymentChannelCreate.cpp b/src/libxrpl/tx/transactors/payment_channel/PaymentChannelCreate.cpp
index 63dbe01944..977da56861 100644
--- a/src/libxrpl/tx/transactors/payment_channel/PaymentChannelCreate.cpp
+++ b/src/libxrpl/tx/transactors/payment_channel/PaymentChannelCreate.cpp
@@ -137,7 +137,7 @@ PaymentChannelCreate::doApply()
     //
     // Note that we use the value from the sequence or ticket as the
     // payChan sequence.  For more explanation see comments in SeqProxy.h.
-    Keylet const payChanKeylet = keylet::payChan(account, dst, ctx_.tx.getSeqValue());
+    Keylet const payChanKeylet = keylet::payChannel(account, dst, ctx_.tx.getSeqValue());
     auto const slep = std::make_shared<SLE>(payChanKeylet);
 
     // Funds held in this channel
diff --git a/src/libxrpl/tx/transactors/system/Change.cpp b/src/libxrpl/tx/transactors/system/Change.cpp
index 38fee5bf92..f27855a5c8 100644
--- a/src/libxrpl/tx/transactors/system/Change.cpp
+++ b/src/libxrpl/tx/transactors/system/Change.cpp
@@ -254,7 +254,7 @@ Change::applyAmendment()
 TER
 Change::applyFee()
 {
-    auto const k = keylet::fees();
+    auto const k = keylet::feeSettings();
 
     SLE::pointer feeObject = view().peek(k);
 
diff --git a/src/libxrpl/tx/transactors/system/TicketCreate.cpp b/src/libxrpl/tx/transactors/system/TicketCreate.cpp
index be24b6326a..73a72c217d 100644
--- a/src/libxrpl/tx/transactors/system/TicketCreate.cpp
+++ b/src/libxrpl/tx/transactors/system/TicketCreate.cpp
@@ -100,7 +100,7 @@ TicketCreate::doApply()
     for (std::uint32_t i = 0; i < ticketCount; ++i)
     {
         std::uint32_t const curTicketSeq = firstTicketSeq + i;
-        Keylet const ticketKeylet = keylet::kTicket(accountID_, curTicketSeq);
+        Keylet const ticketKeylet = keylet::ticket(accountID_, curTicketSeq);
         SLE::pointer const sleTicket = std::make_shared<SLE>(ticketKeylet);
 
         sleTicket->setAccountID(sfAccount, accountID_);
diff --git a/src/libxrpl/tx/transactors/token/Clawback.cpp b/src/libxrpl/tx/transactors/token/Clawback.cpp
index 06132c1c97..64457a3b5f 100644
--- a/src/libxrpl/tx/transactors/token/Clawback.cpp
+++ b/src/libxrpl/tx/transactors/token/Clawback.cpp
@@ -109,7 +109,7 @@ preclaimHelper<Issue>(
         return tecNO_PERMISSION;
 
     auto const sleRippleState =
-        ctx.view.read(keylet::line(holder, issuer, clawAmount.get<Issue>().currency));
+        ctx.view.read(keylet::trustLine(holder, issuer, clawAmount.get<Issue>().currency));
     if (!sleRippleState)
         return tecNO_LINE;
 
@@ -153,7 +153,7 @@ preclaimHelper<MPTIssue>(
     AccountID const& holder,
     STAmount const& clawAmount)
 {
-    auto const issuanceKey = keylet::mptIssuance(clawAmount.get<MPTIssue>().getMptID());
+    auto const issuanceKey = keylet::mptokenIssuance(clawAmount.get<MPTIssue>().getMptID());
     auto const sleIssuance = ctx.view.read(issuanceKey);
     if (!sleIssuance)
         return tecOBJECT_NOT_FOUND;
diff --git a/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp b/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
index 332d160cac..e1d9daaada 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
@@ -64,7 +64,7 @@ MPTokenAuthorize::preclaim(PreclaimContext const& ctx)
             if ((*sleMpt)[sfMPTAmount] != 0)
             {
                 auto const sleMptIssuance =
-                    ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+                    ctx.view.read(keylet::mptokenIssuance(ctx.tx[sfMPTokenIssuanceID]));
                 if (!sleMptIssuance)
                     return tefINTERNAL;  // LCOV_EXCL_LINE
 
@@ -74,7 +74,7 @@ MPTokenAuthorize::preclaim(PreclaimContext const& ctx)
             if ((*sleMpt)[~sfLockedAmount].value_or(0) != 0)
             {
                 auto const sleMptIssuance =
-                    ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+                    ctx.view.read(keylet::mptokenIssuance(ctx.tx[sfMPTokenIssuanceID]));
                 if (!sleMptIssuance)
                     return tefINTERNAL;  // LCOV_EXCL_LINE
 
@@ -87,7 +87,8 @@ MPTokenAuthorize::preclaim(PreclaimContext const& ctx)
         }
 
         // Now test when the holder wants to hold/create/authorize a new MPT
-        auto const sleMptIssuance = ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+        auto const sleMptIssuance =
+            ctx.view.read(keylet::mptokenIssuance(ctx.tx[sfMPTokenIssuanceID]));
 
         if (!sleMptIssuance)
             return tecOBJECT_NOT_FOUND;
@@ -106,7 +107,7 @@ MPTokenAuthorize::preclaim(PreclaimContext const& ctx)
     if (!sleHolder)
         return tecNO_DST;
 
-    auto const sleMptIssuance = ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+    auto const sleMptIssuance = ctx.view.read(keylet::mptokenIssuance(ctx.tx[sfMPTokenIssuanceID]));
     if (!sleMptIssuance)
         return tecOBJECT_NOT_FOUND;
 
diff --git a/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp b/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
index 90e33d3a70..68956a533d 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
@@ -112,7 +112,7 @@ MPTokenIssuanceCreate::create(ApplyView& view, beast::Journal journal, MPTCreate
         return std::unexpected(tecINSUFFICIENT_RESERVE);
 
     auto const mptId = makeMptID(args.sequence, args.account);
-    auto const mptIssuanceKeylet = keylet::mptIssuance(mptId);
+    auto const mptIssuanceKeylet = keylet::mptokenIssuance(mptId);
 
     // create the MPTokenIssuance
     {
diff --git a/src/libxrpl/tx/transactors/token/MPTokenIssuanceDestroy.cpp b/src/libxrpl/tx/transactors/token/MPTokenIssuanceDestroy.cpp
index 1029c25813..c56697767b 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenIssuanceDestroy.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenIssuanceDestroy.cpp
@@ -21,7 +21,7 @@ TER
 MPTokenIssuanceDestroy::preclaim(PreclaimContext const& ctx)
 {
     // ensure that issuance exists
-    auto const sleMPT = ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+    auto const sleMPT = ctx.view.read(keylet::mptokenIssuance(ctx.tx[sfMPTokenIssuanceID]));
     if (!sleMPT)
         return tecOBJECT_NOT_FOUND;
 
@@ -42,7 +42,7 @@ MPTokenIssuanceDestroy::preclaim(PreclaimContext const& ctx)
 TER
 MPTokenIssuanceDestroy::doApply()
 {
-    auto const mpt = view().peek(keylet::mptIssuance(ctx_.tx[sfMPTokenIssuanceID]));
+    auto const mpt = view().peek(keylet::mptokenIssuance(ctx_.tx[sfMPTokenIssuanceID]));
     if (accountID_ != mpt->getAccountID(sfIssuer))
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
diff --git a/src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp b/src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp
index 1cb12709d5..e200c9762a 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp
@@ -127,7 +127,7 @@ TER
 MPTokenIssuanceSet::preclaim(PreclaimContext const& ctx)
 {
     // ensure that issuance exists
-    auto const sleMptIssuance = ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+    auto const sleMptIssuance = ctx.view.read(keylet::mptokenIssuance(ctx.tx[sfMPTokenIssuanceID]));
     if (!sleMptIssuance)
         return tecOBJECT_NOT_FOUND;
 
@@ -222,7 +222,7 @@ MPTokenIssuanceSet::doApply()
     }
     else
     {
-        sle = view().peek(keylet::mptIssuance(mptIssuanceID));
+        sle = view().peek(keylet::mptokenIssuance(mptIssuanceID));
     }
 
     if (!sle)
diff --git a/src/libxrpl/tx/transactors/token/TrustSet.cpp b/src/libxrpl/tx/transactors/token/TrustSet.cpp
index 7838b212b2..151e82bab9 100644
--- a/src/libxrpl/tx/transactors/token/TrustSet.cpp
+++ b/src/libxrpl/tx/transactors/token/TrustSet.cpp
@@ -129,7 +129,7 @@ TrustSet::checkGranularSemantics(
 {
     auto const saLimitAmount = tx.getFieldAmount(sfLimitAmount);
     auto const sleRippleState = view.read(
-        keylet::line(
+        keylet::trustLine(
             tx[sfAccount], saLimitAmount.getIssuer(), saLimitAmount.get<Issue>().currency));
 
     // granular permissions are not allowed to create a trustline
@@ -192,7 +192,7 @@ TrustSet::preclaim(PreclaimContext const& ctx)
         //   o The trust line already exists
         // Then allow the TrustSet.
         if (ctx.view.rules().enabled(fixDisallowIncomingV1) &&
-            ctx.view.exists(keylet::line(id, uDstAccountID, currency)))
+            ctx.view.exists(keylet::trustLine(id, uDstAccountID, currency)))
         {
             // pass
         }
@@ -212,7 +212,7 @@ TrustSet::preclaim(PreclaimContext const& ctx)
         // TrustSet if the asset is AMM LP token and AMM is not in empty state.
         if (sleDst->isFieldPresent(sfAMMID))
         {
-            if (ctx.view.exists(keylet::line(id, uDstAccountID, currency)))
+            if (ctx.view.exists(keylet::trustLine(id, uDstAccountID, currency)))
             {
                 // pass
             }
@@ -235,7 +235,7 @@ TrustSet::preclaim(PreclaimContext const& ctx)
         }
         else if (sleDst->isFieldPresent(sfVaultID) || sleDst->isFieldPresent(sfLoanBrokerID))
         {
-            if (!ctx.view.exists(keylet::line(id, uDstAccountID, currency)))
+            if (!ctx.view.exists(keylet::trustLine(id, uDstAccountID, currency)))
                 return tecNO_PERMISSION;
             // else pass
         }
@@ -269,7 +269,7 @@ TrustSet::preclaim(PreclaimContext const& ctx)
 
         bool const bHigh = id > uDstAccountID;
         // Fetching current state of trust line
-        auto const sleRippleState = ctx.view.read(keylet::line(id, uDstAccountID, currency));
+        auto const sleRippleState = ctx.view.read(keylet::trustLine(id, uDstAccountID, currency));
         std::uint32_t uFlags = sleRippleState ? sleRippleState->getFieldU32(sfFlags) : 0u;
         // Computing expected trust line state
         uFlags = computeFreezeFlags(
@@ -361,7 +361,7 @@ TrustSet::doApply()
     saLimitAllow.get<Issue>().account = accountID_;
 
     SLE::pointer const sleRippleState =
-        view().peek(keylet::line(accountID_, uDstAccountID, currency));
+        view().peek(keylet::trustLine(accountID_, uDstAccountID, currency));
 
     if (sleRippleState)
     {
@@ -609,7 +609,7 @@ TrustSet::doApply()
         // Zero balance in currency.
         STAmount const saBalance(Issue{currency, noAccount()});
 
-        auto const k = keylet::line(accountID_, uDstAccountID, currency);
+        auto const k = keylet::trustLine(accountID_, uDstAccountID, currency);
 
         JLOG(j_.trace()) << "doTrustSet: Creating ripple line: " << to_string(k.key);
 
diff --git a/src/libxrpl/tx/transactors/vault/VaultClawback.cpp b/src/libxrpl/tx/transactors/vault/VaultClawback.cpp
index a8587feaeb..541660c98f 100644
--- a/src/libxrpl/tx/transactors/vault/VaultClawback.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultClawback.cpp
@@ -86,7 +86,7 @@ VaultClawback::preclaim(PreclaimContext const& ctx)
     auto const holder = ctx.tx[sfHolder];
     auto const maybeAmount = ctx.tx[~sfAmount];
     auto const mptIssuanceID = vault->at(sfShareMPTID);
-    auto const sleShareIssuance = ctx.view.read(keylet::mptIssuance(mptIssuanceID));
+    auto const sleShareIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleShareIssuance)
     {
         // LCOV_EXCL_START
@@ -180,7 +180,7 @@ VaultClawback::preclaim(PreclaimContext const& ctx)
 
         return vaultAsset.visit(
             [&](MPTIssue const& issue) -> TER {
-                auto const mptIssue = ctx.view.read(keylet::mptIssuance(issue.getMptID()));
+                auto const mptIssue = ctx.view.read(keylet::mptokenIssuance(issue.getMptID()));
                 if (mptIssue == nullptr)
                     return tecOBJECT_NOT_FOUND;
 
@@ -337,7 +337,7 @@ VaultClawback::doApply()
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
     auto const mptIssuanceID = *vault->at(sfShareMPTID);
-    auto const sleIssuance = view().read(keylet::mptIssuance(mptIssuanceID));
+    auto const sleIssuance = view().read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleIssuance)
     {
         // LCOV_EXCL_START
diff --git a/src/libxrpl/tx/transactors/vault/VaultCreate.cpp b/src/libxrpl/tx/transactors/vault/VaultCreate.cpp
index 4163753014..d262132b6f 100644
--- a/src/libxrpl/tx/transactors/vault/VaultCreate.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultCreate.cpp
@@ -194,7 +194,7 @@ VaultCreate::doApply()
             return std::nullopt;
         return asset.holds<MPTIssue>()
             ? keylet::mptoken(asset.get<MPTIssue>().getMptID(), pseudoId).key
-            : keylet::line(pseudoId, asset.get<Issue>()).key;
+            : keylet::trustLine(pseudoId, asset.get<Issue>()).key;
     }();
     auto const maybeShare = MPTokenIssuanceCreate::create(
         view(),
diff --git a/src/libxrpl/tx/transactors/vault/VaultDelete.cpp b/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
index 030a7e971c..0550f08b17 100644
--- a/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
@@ -57,7 +57,7 @@ VaultDelete::preclaim(PreclaimContext const& ctx)
     }
 
     // Verify we can destroy MPTokenIssuance
-    auto const sleMPT = ctx.view.read(keylet::mptIssuance(vault->at(sfShareMPTID)));
+    auto const sleMPT = ctx.view.read(keylet::mptokenIssuance(vault->at(sfShareMPTID)));
 
     if (!sleMPT)
     {
@@ -110,7 +110,7 @@ VaultDelete::doApply()
     // Destroy the share issuance. Do not use MPTokenIssuanceDestroy for this,
     // no special logic needed. First run few checks, duplicated from preclaim.
     auto const shareMPTID = *vault->at(sfShareMPTID);
-    auto const mpt = view().peek(keylet::mptIssuance(shareMPTID));
+    auto const mpt = view().peek(keylet::mptokenIssuance(shareMPTID));
     if (!mpt)
     {
         // LCOV_EXCL_START
diff --git a/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp b/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
index c08d1e957c..b70543d280 100644
--- a/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
@@ -90,7 +90,7 @@ VaultDeposit::preclaim(PreclaimContext const& ctx)
         // LCOV_EXCL_STOP
     }
 
-    auto const sleIssuance = ctx.view.read(keylet::mptIssuance(mptIssuanceID));
+    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleIssuance)
     {
         // LCOV_EXCL_START
@@ -206,7 +206,7 @@ VaultDeposit::doApply()
 
     // Make sure the depositor can hold shares.
     auto const mptIssuanceID = (*vault)[sfShareMPTID];
-    auto const sleIssuance = view().read(keylet::mptIssuance(mptIssuanceID));
+    auto const sleIssuance = view().read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleIssuance)
     {
         // LCOV_EXCL_START
diff --git a/src/libxrpl/tx/transactors/vault/VaultSet.cpp b/src/libxrpl/tx/transactors/vault/VaultSet.cpp
index 6d0ade6e52..c71e84858a 100644
--- a/src/libxrpl/tx/transactors/vault/VaultSet.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultSet.cpp
@@ -75,7 +75,7 @@ VaultSet::preclaim(PreclaimContext const& ctx)
     }
 
     auto const mptIssuanceID = (*vault)[sfShareMPTID];
-    auto const sleIssuance = ctx.view.read(keylet::mptIssuance(mptIssuanceID));
+    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleIssuance)
     {
         // LCOV_EXCL_START
@@ -130,7 +130,7 @@ VaultSet::doApply()
     auto const vaultAsset = vault->at(sfAsset);
 
     auto const mptIssuanceID = (*vault)[sfShareMPTID];
-    auto const sleIssuance = view().peek(keylet::mptIssuance(mptIssuanceID));
+    auto const sleIssuance = view().peek(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleIssuance)
     {
         // LCOV_EXCL_START
diff --git a/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp b/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
index 05dcfea506..815d8ccd5b 100644
--- a/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
@@ -106,7 +106,7 @@ VaultWithdraw::preclaim(PreclaimContext const& ctx)
         // to the equivalent asset amount before checking withdrawal
         // limits. Pre-amendment the limit check was skipped for
         // share-denominated withdrawals.
-        auto const sleIssuance = ctx.view.read(keylet::mptIssuance(vaultShare));
+        auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(vaultShare));
         if (!sleIssuance)
         {
             // LCOV_EXCL_START
@@ -180,7 +180,7 @@ VaultWithdraw::doApply()
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
     auto const mptIssuanceID = *((*vault)[sfShareMPTID]);
-    auto const sleIssuance = view().read(keylet::mptIssuance(mptIssuanceID));
+    auto const sleIssuance = view().read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleIssuance)
     {
         // LCOV_EXCL_START
diff --git a/src/test/app/AccountDelete_test.cpp b/src/test/app/AccountDelete_test.cpp
index 65ff9ed839..399696ec0d 100644
--- a/src/test/app/AccountDelete_test.cpp
+++ b/src/test/app/AccountDelete_test.cpp
@@ -215,8 +215,8 @@ public:
             BEAST_EXPECT(env.closed()->exists(keylet::ownerDir(carol.id())));
             BEAST_EXPECT(env.closed()->exists(keylet::depositPreauth(carol.id(), becky.id())));
             BEAST_EXPECT(env.closed()->exists(keylet::offer(carol.id(), carolOfferSeq)));
-            BEAST_EXPECT(env.closed()->exists(keylet::kTicket(carol.id(), carolTicketSeq)));
-            BEAST_EXPECT(env.closed()->exists(keylet::signers(carol.id())));
+            BEAST_EXPECT(env.closed()->exists(keylet::ticket(carol.id(), carolTicketSeq)));
+            BEAST_EXPECT(env.closed()->exists(keylet::signerList(carol.id())));
 
             // Delete carol's account even with stuff in her directory.  Show
             // that multisigning for the delete does not increase carol's fee.
@@ -229,8 +229,8 @@ public:
             BEAST_EXPECT(!env.closed()->exists(keylet::ownerDir(carol.id())));
             BEAST_EXPECT(!env.closed()->exists(keylet::depositPreauth(carol.id(), becky.id())));
             BEAST_EXPECT(!env.closed()->exists(keylet::offer(carol.id(), carolOfferSeq)));
-            BEAST_EXPECT(!env.closed()->exists(keylet::kTicket(carol.id(), carolTicketSeq)));
-            BEAST_EXPECT(!env.closed()->exists(keylet::signers(carol.id())));
+            BEAST_EXPECT(!env.closed()->exists(keylet::ticket(carol.id(), carolTicketSeq)));
+            BEAST_EXPECT(!env.closed()->exists(keylet::signerList(carol.id())));
 
             // Verify that Carol's XRP, minus the fee, was transferred to becky.
             BEAST_EXPECT(env.balance(becky) == carolOldBalance + beckyOldBalance - acctDelFee);
@@ -386,7 +386,7 @@ public:
         env(escrow::cancel(becky, alice, escrowSeq));
         env.close();
 
-        Keylet const alicePayChanKey{keylet::payChan(alice, becky, env.seq(alice))};
+        Keylet const alicePayChanKey{keylet::payChannel(alice, becky, env.seq(alice))};
 
         env(payChanCreate(alice, becky, XRP(57), 4s, env.now() + 2s, alice.pk()));
         env.close();
@@ -417,7 +417,7 @@ public:
 
         // gw creates a PayChannel with alice as the destination, this should
         // prevent alice from deleting her account.
-        Keylet const gwPayChanKey{keylet::payChan(gw, alice, env.seq(gw))};
+        Keylet const gwPayChanKey{keylet::payChannel(gw, alice, env.seq(gw))};
 
         env(payChanCreate(gw, alice, XRP(68), 4s, env.now() + 2s, alice.pk()));
         env.close();
@@ -662,7 +662,7 @@ public:
             BEAST_EXPECT(closed->exists(keylet::account(bob.id())));
             for (std::uint32_t i = 0; i < 250; ++i)
             {
-                BEAST_EXPECT(closed->exists(keylet::kTicket(bob.id(), ticketSeq + i)));
+                BEAST_EXPECT(closed->exists(keylet::ticket(bob.id(), ticketSeq + i)));
             }
         }
 
@@ -681,7 +681,7 @@ public:
             BEAST_EXPECT(!closed->exists(keylet::account(bob.id())));
             for (std::uint32_t i = 0; i < 250; ++i)
             {
-                BEAST_EXPECT(!closed->exists(keylet::kTicket(bob.id(), ticketSeq + i)));
+                BEAST_EXPECT(!closed->exists(keylet::ticket(bob.id(), ticketSeq + i)));
             }
         }
     }
diff --git a/src/test/app/Batch_test.cpp b/src/test/app/Batch_test.cpp
index 47f9a84fb9..6aaae62155 100644
--- a/src/test/app/Batch_test.cpp
+++ b/src/test/app/Batch_test.cpp
@@ -3040,7 +3040,7 @@ class Batch_test : public beast::unit_test::Suite
         env(vault.deposit({.depositor = lender, .id = vaultKeylet.key, .amount = deposit}));
         env.close();
 
-        auto const brokerKeylet = keylet::loanbroker(lender.id(), env.seq(lender));
+        auto const brokerKeylet = keylet::loanBroker(lender.id(), env.seq(lender));
 
         {
             using namespace loanBroker;
diff --git a/src/test/app/Check_test.cpp b/src/test/app/Check_test.cpp
index 9b814a24b1..3ad1e3fa4e 100644
--- a/src/test/app/Check_test.cpp
+++ b/src/test/app/Check_test.cpp
@@ -1951,8 +1951,8 @@ class Check_test : public beast::unit_test::Suite
                                  Account const& acct2,
                                  IOU const& offerIou,
                                  IOU const& checkIou) {
-            auto const offerLine = env.le(keylet::line(acct1, acct2, offerIou.currency));
-            auto const checkLine = env.le(keylet::line(acct1, acct2, checkIou.currency));
+            auto const offerLine = env.le(keylet::trustLine(acct1, acct2, offerIou.currency));
+            auto const checkLine = env.le(keylet::trustLine(acct1, acct2, checkIou.currency));
             if (offerLine == nullptr || checkLine == nullptr)
             {
                 BEAST_EXPECT(offerLine == nullptr && checkLine == nullptr);
@@ -2023,7 +2023,7 @@ class Check_test : public beast::unit_test::Suite
             IOU const oF1 = gw1["OF1"];
             env(offer(gw1, XRP(98), oF1(98)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, oF1.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, oF1.currency)) == nullptr);
             env(offer(alice, oF1(98), XRP(98)));
             ++alice.owners;
             env.close();
@@ -2041,7 +2041,7 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(gw1, env.seq(gw1))};
             env(check::create(gw1, alice, cK1(98)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, cK1.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, cK1.currency)) == nullptr);
             env(check::cash(alice, chkId, cK1(98)));
             ++alice.owners;
             verifyDeliveredAmount(env, cK1(98));
@@ -2070,7 +2070,7 @@ class Check_test : public beast::unit_test::Suite
             IOU const oF1 = gw1["OF1"];
             env(offer(alice, XRP(97), oF1(97)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, oF1.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, oF1.currency)) == nullptr);
             env(offer(bob, oF1(97), XRP(97)));
             ++bob.owners;
             env.close();
@@ -2094,12 +2094,12 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(alice, env.seq(alice))};
             env(check::create(alice, bob, cK1(97)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, cK1.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, cK1.currency)) == nullptr);
             env(check::cash(bob, chkId, cK1(97)), Ter(terNO_RIPPLE));
             env.close();
 
-            BEAST_EXPECT(env.le(keylet::line(gw1, bob, oF1.currency)) != nullptr);
-            BEAST_EXPECT(env.le(keylet::line(gw1, bob, cK1.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, bob, oF1.currency)) != nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, bob, cK1.currency)) == nullptr);
 
             // Delete alice's check since it is no longer needed.
             env(check::cancel(alice, chkId));
@@ -2123,7 +2123,7 @@ class Check_test : public beast::unit_test::Suite
             IOU const oF2 = gw1["OF2"];
             env(offer(gw1, XRP(96), oF2(96)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, oF2.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, oF2.currency)) == nullptr);
             env(offer(alice, oF2(96), XRP(96)));
             ++alice.owners;
             env.close();
@@ -2141,7 +2141,7 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(gw1, env.seq(gw1))};
             env(check::create(gw1, alice, cK2(96)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, cK2.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, cK2.currency)) == nullptr);
             env(check::cash(alice, chkId, cK2(96)));
             ++alice.owners;
             verifyDeliveredAmount(env, cK2(96));
@@ -2167,7 +2167,7 @@ class Check_test : public beast::unit_test::Suite
             IOU const oF2 = gw1["OF2"];
             env(offer(alice, XRP(95), oF2(95)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, oF2.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, oF2.currency)) == nullptr);
             env(offer(bob, oF2(95), XRP(95)));
             ++bob.owners;
             env.close();
@@ -2182,7 +2182,7 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(alice, env.seq(alice))};
             env(check::create(alice, bob, cK2(95)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, cK2.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, cK2.currency)) == nullptr);
             env(check::cash(bob, chkId, cK2(95)));
             ++bob.owners;
             verifyDeliveredAmount(env, cK2(95));
@@ -2214,7 +2214,7 @@ class Check_test : public beast::unit_test::Suite
             IOU const oF3 = gw1["OF3"];
             env(offer(gw1, XRP(94), oF3(94)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, oF3.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, oF3.currency)) == nullptr);
             env(offer(alice, oF3(94), XRP(94)));
             ++alice.owners;
             env.close();
@@ -2232,7 +2232,7 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(gw1, env.seq(gw1))};
             env(check::create(gw1, alice, cK3(94)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, cK3.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, cK3.currency)) == nullptr);
             env(check::cash(alice, chkId, cK3(94)));
             ++alice.owners;
             verifyDeliveredAmount(env, cK3(94));
@@ -2258,7 +2258,7 @@ class Check_test : public beast::unit_test::Suite
             IOU const oF3 = gw1["OF3"];
             env(offer(alice, XRP(93), oF3(93)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, oF3.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, oF3.currency)) == nullptr);
             env(offer(bob, oF3(93), XRP(93)));
             ++bob.owners;
             env.close();
@@ -2273,7 +2273,7 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(alice, env.seq(alice))};
             env(check::create(alice, bob, cK3(93)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, cK3.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, cK3.currency)) == nullptr);
             env(check::cash(bob, chkId, cK3(93)));
             ++bob.owners;
             verifyDeliveredAmount(env, cK3(93));
@@ -2299,7 +2299,7 @@ class Check_test : public beast::unit_test::Suite
             IOU const oF4 = gw1["OF4"];
             env(offer(gw1, XRP(92), oF4(92)), Ter(tecFROZEN));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, oF4.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, oF4.currency)) == nullptr);
             env(offer(alice, oF4(92), XRP(92)), Ter(tecFROZEN));
             env.close();
 
@@ -2313,7 +2313,7 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(gw1, env.seq(gw1))};
             env(check::create(gw1, alice, cK4(92)), Ter(tecFROZEN));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, cK4.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, cK4.currency)) == nullptr);
             env(check::cash(alice, chkId, cK4(92)), Ter(tecNO_ENTRY));
             env.close();
 
@@ -2324,8 +2324,8 @@ class Check_test : public beast::unit_test::Suite
 
             // Because gw1 has set lsfGlobalFreeze, neither trust line
             // is created.
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, oF4.currency)) == nullptr);
-            BEAST_EXPECT(env.le(keylet::line(gw1, alice, cK4.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, oF4.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, alice, cK4.currency)) == nullptr);
         }
         //------------ lsfGlobalFreeze, check written by non-issuer ------------
         {
@@ -2337,7 +2337,7 @@ class Check_test : public beast::unit_test::Suite
             IOU const oF4 = gw1["OF4"];
             env(offer(alice, XRP(91), oF4(91)), Ter(tecFROZEN));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, oF4.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, oF4.currency)) == nullptr);
             env(offer(bob, oF4(91), XRP(91)), Ter(tecFROZEN));
             env.close();
 
@@ -2351,7 +2351,7 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(alice, env.seq(alice))};
             env(check::create(alice, bob, cK4(91)), Ter(tecFROZEN));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, cK4.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, cK4.currency)) == nullptr);
             env(check::cash(bob, chkId, cK4(91)), Ter(tecNO_ENTRY));
             env.close();
 
@@ -2362,8 +2362,8 @@ class Check_test : public beast::unit_test::Suite
 
             // Because gw1 has set lsfGlobalFreeze, neither trust line
             // is created.
-            BEAST_EXPECT(env.le(keylet::line(gw1, bob, oF4.currency)) == nullptr);
-            BEAST_EXPECT(env.le(keylet::line(gw1, bob, cK4.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, bob, oF4.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw1, bob, cK4.currency)) == nullptr);
         }
 
         //-------------- lsfRequireAuth, check written by issuer ---------------
@@ -2387,7 +2387,7 @@ class Check_test : public beast::unit_test::Suite
             env(offer(gw2, XRP(92), oF5(92)));
             ++gw2.owners;
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw2, alice, oF5.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw2, alice, oF5.currency)) == nullptr);
             env(offer(alice, oF5(92), XRP(92)), Ter(tecNO_LINE));
             env.close();
 
@@ -2409,7 +2409,7 @@ class Check_test : public beast::unit_test::Suite
             env(check::create(gw2, alice, cK5(92)));
             ++gw2.owners;
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(gw2, alice, cK5.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw2, alice, cK5.currency)) == nullptr);
             env(check::cash(alice, chkId, cK5(92)), Ter(tecNO_AUTH));
             env.close();
 
@@ -2421,8 +2421,8 @@ class Check_test : public beast::unit_test::Suite
 
             // Because gw2 has set lsfRequireAuth, neither trust line
             // is created.
-            BEAST_EXPECT(env.le(keylet::line(gw2, alice, oF5.currency)) == nullptr);
-            BEAST_EXPECT(env.le(keylet::line(gw2, alice, cK5.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw2, alice, oF5.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw2, alice, cK5.currency)) == nullptr);
 
             // Since we don't need it any more, remove gw2's check.
             env(check::cancel(gw2, chkId));
@@ -2441,7 +2441,7 @@ class Check_test : public beast::unit_test::Suite
             env(offer(alice, XRP(91), oF5(91)), Ter(tecUNFUNDED_OFFER));
             env.close();
             env(offer(bob, oF5(91), XRP(91)), Ter(tecNO_LINE));
-            BEAST_EXPECT(env.le(keylet::line(gw2, bob, oF5.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw2, bob, oF5.currency)) == nullptr);
             env.close();
 
             gw2.verifyOwners(__LINE__);
@@ -2453,7 +2453,7 @@ class Check_test : public beast::unit_test::Suite
             uint256 const chkId{getCheckIndex(alice, env.seq(alice))};
             env(check::create(alice, bob, cK5(91)));
             env.close();
-            BEAST_EXPECT(env.le(keylet::line(alice, bob, cK5.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(alice, bob, cK5.currency)) == nullptr);
             env(check::cash(bob, chkId, cK5(91)), Ter(tecPATH_PARTIAL));
             env.close();
 
@@ -2468,8 +2468,8 @@ class Check_test : public beast::unit_test::Suite
 
             // Because gw2 has set lsfRequireAuth, neither trust line
             // is created.
-            BEAST_EXPECT(env.le(keylet::line(gw2, bob, oF5.currency)) == nullptr);
-            BEAST_EXPECT(env.le(keylet::line(gw2, bob, cK5.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw2, bob, oF5.currency)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(gw2, bob, cK5.currency)) == nullptr);
         }
     }
 
diff --git a/src/test/app/Clawback_test.cpp b/src/test/app/Clawback_test.cpp
index 5d0ecf022d..b1a756382d 100644
--- a/src/test/app/Clawback_test.cpp
+++ b/src/test/app/Clawback_test.cpp
@@ -53,7 +53,7 @@ class Clawback_test : public beast::unit_test::Suite
         test::jtx::Account const& dst,
         Currency const& cur)
     {
-        if (auto sle = env.le(keylet::line(src, dst, cur)))
+        if (auto sle = env.le(keylet::trustLine(src, dst, cur)))
         {
             auto const useHigh = src.id() > dst.id();
             return sle->isFlag(useHigh ? lsfHighFreeze : lsfLowFreeze);
diff --git a/src/test/app/EscrowToken_test.cpp b/src/test/app/EscrowToken_test.cpp
index 5bb1303dba..666ee498bd 100644
--- a/src/test/app/EscrowToken_test.cpp
+++ b/src/test/app/EscrowToken_test.cpp
@@ -57,7 +57,7 @@ struct EscrowToken_test : public beast::unit_test::Suite
     static uint64_t
     issuerMPTEscrowed(jtx::Env const& env, jtx::MPT const& mpt)
     {
-        auto const sle = env.le(keylet::mptIssuance(mpt.mpt()));
+        auto const sle = env.le(keylet::mptokenIssuance(mpt.mpt()));
         if (sle && sle->isFieldPresent(sfLockedAmount))
             return (*sle)[sfLockedAmount];
         return 0;
@@ -929,7 +929,7 @@ struct EscrowToken_test : public beast::unit_test::Suite
             env(trust(alice, usd(0)));
             env.close();
 
-            auto const trustLineKey = keylet::line(alice.id(), gw.id(), usd.currency);
+            auto const trustLineKey = keylet::trustLine(alice.id(), gw.id(), usd.currency);
             BEAST_EXPECT(!env.current()->exists(trustLineKey));
 
             env.close();
@@ -3177,7 +3177,8 @@ struct EscrowToken_test : public beast::unit_test::Suite
             BEAST_EXPECT(mptEscrowed(env, bob, mpt) == 0);
             BEAST_EXPECT(env.balance(gw, mpt) == outstandingMPT);
             BEAST_EXPECT(issuerMPTEscrowed(env, mpt) == 0);
-            BEAST_EXPECT(!env.le(keylet::mptIssuance(mpt.mpt()))->isFieldPresent(sfLockedAmount));
+            BEAST_EXPECT(
+                !env.le(keylet::mptokenIssuance(mpt.mpt()))->isFieldPresent(sfLockedAmount));
         }
 
         // Max MPT Amount Issued (Escrow Max MPT)
diff --git a/src/test/app/FeeVote_test.cpp b/src/test/app/FeeVote_test.cpp
index bf42e762c6..666dec1249 100644
--- a/src/test/app/FeeVote_test.cpp
+++ b/src/test/app/FeeVote_test.cpp
@@ -144,7 +144,7 @@ verifyFeeObject(
     Rules const& rules,
     FeeSettingsFields const& expected)
 {
-    auto const feeObject = ledger->read(keylet::fees());
+    auto const feeObject = ledger->read(keylet::feeSettings());
     if (!feeObject)
         return false;
 
diff --git a/src/test/app/FixNFTokenPageLinks_test.cpp b/src/test/app/FixNFTokenPageLinks_test.cpp
index cfe2fd1808..7b13fc060b 100644
--- a/src/test/app/FixNFTokenPageLinks_test.cpp
+++ b/src/test/app/FixNFTokenPageLinks_test.cpp
@@ -267,7 +267,7 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
 
         // Get the index of the middle page.
         uint256 const aliceMiddleNFTokenPageIndex = [&env, &alice]() {
-            auto lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+            auto lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
             return lastNFTokenPage->at(sfPreviousPageMin);
         }();
 
@@ -290,12 +290,12 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         // Removing the last token from the last page deletes the last
         // page.  This is a bug.  The contents of the next-to-last page
         // should have been moved into the last page.
-        BEAST_EXPECT(!env.le(keylet::nftpageMax(alice)));
+        BEAST_EXPECT(!env.le(keylet::nftokenPageMax(alice)));
 
         // alice's "middle" page is still present, but has no links.
         {
-            auto aliceMiddleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), aliceMiddleNFTokenPageIndex));
+            auto aliceMiddleNFTokenPage = env.le(
+                keylet::nftokenPage(keylet::nftokenPageMin(alice), aliceMiddleNFTokenPageIndex));
             if (!BEAST_EXPECT(aliceMiddleNFTokenPage))
                 return;
 
@@ -315,7 +315,7 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
 
         // Get the index of the middle page.
         uint256 const bobMiddleNFTokenPageIndex = [&env, &bob]() {
-            auto lastNFTokenPage = env.le(keylet::nftpageMax(bob));
+            auto lastNFTokenPage = env.le(keylet::nftokenPageMax(bob));
             return lastNFTokenPage->at(sfPreviousPageMin);
         }();
 
@@ -332,13 +332,13 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         // Removing the last token from the last page deletes the last
         // page.  This is a bug.  The contents of the next-to-last page
         // should have been moved into the last page.
-        BEAST_EXPECT(!env.le(keylet::nftpageMax(bob)));
+        BEAST_EXPECT(!env.le(keylet::nftokenPageMax(bob)));
 
         // bob's "middle" page is still present, but has lost the
         // NextPageMin field.
         {
             auto bobMiddleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(bob), bobMiddleNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(bob), bobMiddleNFTokenPageIndex));
             if (!BEAST_EXPECT(bobMiddleNFTokenPage))
                 return;
 
@@ -358,7 +358,7 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
 
         // Get the index of the middle page.
         uint256 const carolMiddleNFTokenPageIndex = [&env, &carol]() {
-            auto lastNFTokenPage = env.le(keylet::nftpageMax(carol));
+            auto lastNFTokenPage = env.le(keylet::nftokenPageMax(carol));
             return lastNFTokenPage->at(sfPreviousPageMin);
         }();
 
@@ -367,7 +367,7 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         dariaNFTs.reserve(32);
         for (int i = 0; i < 32; ++i)
         {
-            uint256 const offerIndex = keylet::nftoffer(carol, env.seq(carol)).key;
+            uint256 const offerIndex = keylet::nftokenOffer(carol, env.seq(carol)).key;
             env(token::createOffer(carol, carolNFTs.back(), XRP(0)), Txflags(tfSellNFToken));
             env.close();
 
@@ -383,12 +383,12 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         // Removing the last token from the last page deletes the last
         // page.  This is a bug.  The contents of the next-to-last page
         // should have been moved into the last page.
-        BEAST_EXPECT(!env.le(keylet::nftpageMax(carol)));
+        BEAST_EXPECT(!env.le(keylet::nftokenPageMax(carol)));
 
         // carol's "middle" page is still present, but has lost the
         // NextPageMin field.
         auto carolMiddleNFTokenPage =
-            env.le(keylet::nftpage(keylet::nftpageMin(carol), carolMiddleNFTokenPageIndex));
+            env.le(keylet::nftokenPage(keylet::nftokenPageMin(carol), carolMiddleNFTokenPageIndex));
         if (!BEAST_EXPECT(carolMiddleNFTokenPage))
             return;
 
@@ -401,7 +401,7 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         // back from daria.
         for (uint256 const& nft : dariaNFTs)
         {
-            uint256 const offerIndex = keylet::nftoffer(carol, env.seq(carol)).key;
+            uint256 const offerIndex = keylet::nftokenOffer(carol, env.seq(carol)).key;
             env(token::createOffer(carol, nft, drops(1)), token::Owner(daria));
             env.close();
 
@@ -418,8 +418,8 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
 
         // carol's "middle" page is present and still has no NextPageMin field.
         {
-            auto carolMiddleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(carol), carolMiddleNFTokenPageIndex));
+            auto carolMiddleNFTokenPage = env.le(
+                keylet::nftokenPage(keylet::nftokenPageMin(carol), carolMiddleNFTokenPageIndex));
             if (!BEAST_EXPECT(carolMiddleNFTokenPage))
                 return;
 
@@ -428,7 +428,7 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         }
         // carol has a "last" page again, but it has no PreviousPageMin field.
         {
-            auto carolLastNFTokenPage = env.le(keylet::nftpageMax(carol));
+            auto carolLastNFTokenPage = env.le(keylet::nftokenPageMax(carol));
 
             BEAST_EXPECT(!carolLastNFTokenPage->isFieldPresent(sfPreviousPageMin));
             BEAST_EXPECT(!carolLastNFTokenPage->isFieldPresent(sfNextPageMin));
@@ -456,12 +456,12 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         // Verify that alice's NFToken directory is still damaged.
 
         // alice's last page should still be missing.
-        BEAST_EXPECT(!env.le(keylet::nftpageMax(alice)));
+        BEAST_EXPECT(!env.le(keylet::nftokenPageMax(alice)));
 
         // alice's "middle" page is still present and has no links.
         {
-            auto aliceMiddleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), aliceMiddleNFTokenPageIndex));
+            auto aliceMiddleNFTokenPage = env.le(
+                keylet::nftokenPage(keylet::nftokenPageMin(alice), aliceMiddleNFTokenPageIndex));
             if (!BEAST_EXPECT(aliceMiddleNFTokenPage))
                 return;
 
@@ -480,7 +480,7 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
 
         // alice's last page should now be present and include no links.
         {
-            auto aliceLastNFTokenPage = env.le(keylet::nftpageMax(alice));
+            auto aliceLastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
             if (!BEAST_EXPECT(aliceLastNFTokenPage))
                 return;
 
@@ -489,8 +489,8 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         }
 
         // alice's middle page should be gone.
-        BEAST_EXPECT(
-            !env.le(keylet::nftpage(keylet::nftpageMin(alice), aliceMiddleNFTokenPageIndex)));
+        BEAST_EXPECT(!env.le(
+            keylet::nftokenPage(keylet::nftokenPageMin(alice), aliceMiddleNFTokenPageIndex)));
 
         BEAST_EXPECT(nftCount(env, alice) == 32);
         BEAST_EXPECT(ownerCount(env, alice) == 1);
@@ -502,12 +502,12 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         // Verify that bob's NFToken directory is still damaged.
 
         // bob's last page should still be missing.
-        BEAST_EXPECT(!env.le(keylet::nftpageMax(bob)));
+        BEAST_EXPECT(!env.le(keylet::nftokenPageMax(bob)));
 
         // bob's "middle" page is still present and missing NextPageMin.
         {
             auto bobMiddleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(bob), bobMiddleNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(bob), bobMiddleNFTokenPageIndex));
             if (!BEAST_EXPECT(bobMiddleNFTokenPage))
                 return;
 
@@ -522,7 +522,7 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         // bob's last page should now be present and include a previous
         // link but no next link.
         {
-            auto const lastPageKeylet = keylet::nftpageMax(bob);
+            auto const lastPageKeylet = keylet::nftokenPageMax(bob);
             auto const bobLastNFTokenPage = env.le(lastPageKeylet);
             if (!BEAST_EXPECT(bobLastNFTokenPage))
                 return;
@@ -532,8 +532,8 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
             BEAST_EXPECT(!bobLastNFTokenPage->isFieldPresent(sfNextPageMin));
 
             auto const bobNewFirstNFTokenPage = env.le(
-                keylet::nftpage(
-                    keylet::nftpageMin(bob), bobLastNFTokenPage->at(sfPreviousPageMin)));
+                keylet::nftokenPage(
+                    keylet::nftokenPageMin(bob), bobLastNFTokenPage->at(sfPreviousPageMin)));
             if (!BEAST_EXPECT(bobNewFirstNFTokenPage))
                 return;
 
@@ -544,7 +544,8 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
         }
 
         // bob's middle page should be gone.
-        BEAST_EXPECT(!env.le(keylet::nftpage(keylet::nftpageMin(bob), bobMiddleNFTokenPageIndex)));
+        BEAST_EXPECT(
+            !env.le(keylet::nftokenPage(keylet::nftokenPageMin(bob), bobMiddleNFTokenPageIndex)));
 
         BEAST_EXPECT(nftCount(env, bob) == 64);
         BEAST_EXPECT(ownerCount(env, bob) == 2);
@@ -557,17 +558,16 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
 
         // carol's "middle" page is present and has no NextPageMin field.
         {
-            auto carolMiddleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(carol), carolMiddleNFTokenPageIndex));
+            auto carolMiddleNFTokenPage = env.le(
+                keylet::nftokenPage(keylet::nftokenPageMin(carol), carolMiddleNFTokenPageIndex));
             if (!BEAST_EXPECT(carolMiddleNFTokenPage))
                 return;
-
             BEAST_EXPECT(carolMiddleNFTokenPage->isFieldPresent(sfPreviousPageMin));
             BEAST_EXPECT(!carolMiddleNFTokenPage->isFieldPresent(sfNextPageMin));
         }
         // carol has a "last" page, but it has no PreviousPageMin field.
         {
-            auto carolLastNFTokenPage = env.le(keylet::nftpageMax(carol));
+            auto carolLastNFTokenPage = env.le(keylet::nftokenPageMax(carol));
 
             BEAST_EXPECT(!carolLastNFTokenPage->isFieldPresent(sfPreviousPageMin));
             BEAST_EXPECT(!carolLastNFTokenPage->isFieldPresent(sfNextPageMin));
@@ -579,9 +579,9 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
 
         {
             // carol's "middle" page is present and now has a NextPageMin field.
-            auto const lastPageKeylet = keylet::nftpageMax(carol);
-            auto carolMiddleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(carol), carolMiddleNFTokenPageIndex));
+            auto const lastPageKeylet = keylet::nftokenPageMax(carol);
+            auto carolMiddleNFTokenPage = env.le(
+                keylet::nftokenPage(keylet::nftokenPageMin(carol), carolMiddleNFTokenPageIndex));
             if (!BEAST_EXPECT(carolMiddleNFTokenPage))
                 return;
 
@@ -602,8 +602,8 @@ class FixNFTokenPageLinks_test : public beast::unit_test::Suite
 
             // carol also has a "first" page that includes a NextPageMin field.
             auto carolFirstNFTokenPage = env.le(
-                keylet::nftpage(
-                    keylet::nftpageMin(carol), carolMiddleNFTokenPage->at(sfPreviousPageMin)));
+                keylet::nftokenPage(
+                    keylet::nftokenPageMin(carol), carolMiddleNFTokenPage->at(sfPreviousPageMin)));
             if (!BEAST_EXPECT(carolFirstNFTokenPage))
                 return;
 
diff --git a/src/test/app/Flow_test.cpp b/src/test/app/Flow_test.cpp
index 5f56a0ceb1..72e39ab890 100644
--- a/src/test/app/Flow_test.cpp
+++ b/src/test/app/Flow_test.cpp
@@ -57,7 +57,7 @@ getNoRippleFlag(
     jtx::Account const& dst,
     Currency const& cur)
 {
-    if (auto sle = env.le(keylet::line(src, dst, cur)))
+    if (auto sle = env.le(keylet::trustLine(src, dst, cur)))
     {
         auto const flag = (src.id() > dst.id()) ? lsfHighNoRipple : lsfLowNoRipple;
         return sle->isFlag(flag);
diff --git a/src/test/app/Freeze_test.cpp b/src/test/app/Freeze_test.cpp
index 2b5ca831da..786f5b4680 100644
--- a/src/test/app/Freeze_test.cpp
+++ b/src/test/app/Freeze_test.cpp
@@ -1788,7 +1788,7 @@ class Freeze_test : public beast::unit_test::Suite
             env(token::mint(a2, 0), Txflags(tfTransferable));
             env.close();
 
-            auto const buyIdx = keylet::nftoffer(a1, env.seq(a1)).key;
+            auto const buyIdx = keylet::nftokenOffer(a1, env.seq(a1)).key;
             env(token::createOffer(a1, nftID, usd(10)), token::Owner(a2));
             env.close();
 
@@ -1874,10 +1874,10 @@ class Freeze_test : public beast::unit_test::Suite
             env(token::mint(a2, 0), Txflags(tfTransferable));
             env.close();
 
-            uint256 const sellIdx = keylet::nftoffer(a2, env.seq(a2)).key;
+            uint256 const sellIdx = keylet::nftokenOffer(a2, env.seq(a2)).key;
             env(token::createOffer(a2, nftID, usd(10)), Txflags(tfSellNFToken));
             env.close();
-            auto const buyIdx = keylet::nftoffer(a1, env.seq(a1)).key;
+            auto const buyIdx = keylet::nftokenOffer(a1, env.seq(a1)).key;
             env(token::createOffer(a1, nftID, usd(11)), token::Owner(a2));
             env.close();
 
@@ -1900,13 +1900,13 @@ class Freeze_test : public beast::unit_test::Suite
             env(token::mint(minter, 0), token::XferFee(1u), Txflags(tfTransferable));
             env.close();
 
-            uint256 const minterSellIdx = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterSellIdx = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, drops(1)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(a2, minterSellIdx));
             env.close();
 
-            uint256 const sellIdx = keylet::nftoffer(a2, env.seq(a2)).key;
+            uint256 const sellIdx = keylet::nftokenOffer(a2, env.seq(a2)).key;
             env(token::createOffer(a2, nftID, usd(100)), Txflags(tfSellNFToken));
             env.close();
             env(trust(g1, minter["USD"](1000), tfSetFreeze | tfSetDeepFreeze));
@@ -1960,7 +1960,7 @@ class Freeze_test : public beast::unit_test::Suite
         env(token::mint(account, 0), Txflags(tfTransferable));
         env.close();
 
-        uint256 const sellOfferIndex = keylet::nftoffer(account, env.seq(account)).key;
+        uint256 const sellOfferIndex = keylet::nftokenOffer(account, env.seq(account)).key;
         env(token::createOffer(account, nftID, currency), Txflags(tfSellNFToken));
         env.close();
 
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index e0c29ea72a..804cfaebfc 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -462,7 +462,7 @@ class Invariants_test : public beast::unit_test::Suite
                 BEAST_EXPECT(sle->at(~sfAMMID) == ammKey);
 
                 for (auto const& trustKeylet :
-                     {keylet::line(ammAcctID, a1["USD"]), keylet::line(a1, ammIssue)})
+                     {keylet::trustLine(ammAcctID, a1["USD"]), keylet::trustLine(a1, ammIssue)})
                 {
                     auto const line = ac.view().peek(trustKeylet);
                     if (!line)
@@ -563,7 +563,7 @@ class Invariants_test : public beast::unit_test::Suite
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
                 // create simple trust SLE with xrp currency
                 auto const sleNew =
-                    std::make_shared<SLE>(keylet::line(a1, a2, xrpIssue().currency));
+                    std::make_shared<SLE>(keylet::trustLine(a1, a2, xrpIssue().currency));
                 ac.view().insert(sleNew);
                 return true;
             });
@@ -579,7 +579,8 @@ class Invariants_test : public beast::unit_test::Suite
             {{"a trust line with deep freeze flag without normal freeze was "
               "created"}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
-                auto const sleNew = std::make_shared<SLE>(keylet::line(a1, a2, a1["USD"].currency));
+                auto const sleNew =
+                    std::make_shared<SLE>(keylet::trustLine(a1, a2, a1["USD"].currency));
                 sleNew->setFieldAmount(sfLowLimit, a1["USD"](0));
                 sleNew->setFieldAmount(sfHighLimit, a1["USD"](0));
 
@@ -594,7 +595,8 @@ class Invariants_test : public beast::unit_test::Suite
             {{"a trust line with deep freeze flag without normal freeze was "
               "created"}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
-                auto const sleNew = std::make_shared<SLE>(keylet::line(a1, a2, a1["USD"].currency));
+                auto const sleNew =
+                    std::make_shared<SLE>(keylet::trustLine(a1, a2, a1["USD"].currency));
                 sleNew->setFieldAmount(sfLowLimit, a1["USD"](0));
                 sleNew->setFieldAmount(sfHighLimit, a1["USD"](0));
                 std::uint32_t uFlags = 0u;
@@ -608,7 +610,8 @@ class Invariants_test : public beast::unit_test::Suite
             {{"a trust line with deep freeze flag without normal freeze was "
               "created"}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
-                auto const sleNew = std::make_shared<SLE>(keylet::line(a1, a2, a1["USD"].currency));
+                auto const sleNew =
+                    std::make_shared<SLE>(keylet::trustLine(a1, a2, a1["USD"].currency));
                 sleNew->setFieldAmount(sfLowLimit, a1["USD"](0));
                 sleNew->setFieldAmount(sfHighLimit, a1["USD"](0));
                 std::uint32_t uFlags = 0u;
@@ -622,7 +625,8 @@ class Invariants_test : public beast::unit_test::Suite
             {{"a trust line with deep freeze flag without normal freeze was "
               "created"}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
-                auto const sleNew = std::make_shared<SLE>(keylet::line(a1, a2, a1["USD"].currency));
+                auto const sleNew =
+                    std::make_shared<SLE>(keylet::trustLine(a1, a2, a1["USD"].currency));
                 sleNew->setFieldAmount(sfLowLimit, a1["USD"](0));
                 sleNew->setFieldAmount(sfHighLimit, a1["USD"](0));
                 std::uint32_t uFlags = 0u;
@@ -636,7 +640,8 @@ class Invariants_test : public beast::unit_test::Suite
             {{"a trust line with deep freeze flag without normal freeze was "
               "created"}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
-                auto const sleNew = std::make_shared<SLE>(keylet::line(a1, a2, a1["USD"].currency));
+                auto const sleNew =
+                    std::make_shared<SLE>(keylet::trustLine(a1, a2, a1["USD"].currency));
                 sleNew->setFieldAmount(sfLowLimit, a1["USD"](0));
                 sleNew->setFieldAmount(sfHighLimit, a1["USD"](0));
                 std::uint32_t uFlags = 0u;
@@ -691,8 +696,8 @@ class Invariants_test : public beast::unit_test::Suite
                                         ApplyContext& ac,
                                         int a1Balance,
                                         int a2Balance) {
-            auto const sleA1 = ac.view().peek(keylet::line(a1, g1["USD"]));
-            auto const sleA2 = ac.view().peek(keylet::line(a2, g1["USD"]));
+            auto const sleA1 = ac.view().peek(keylet::trustLine(a1, g1["USD"]));
+            auto const sleA2 = ac.view().peek(keylet::trustLine(a2, g1["USD"]));
 
             sleA1->setFieldAmount(sfBalance, g1["USD"](a1Balance));
             sleA2->setFieldAmount(sfBalance, g1["USD"](a2Balance));
@@ -961,7 +966,7 @@ class Invariants_test : public beast::unit_test::Suite
                     return false;
 
                 MPTIssue const mpt{makeMptID(1, AccountID(0x4985601))};
-                auto sleNew = std::make_shared<SLE>(keylet::mptIssuance(mpt.getMptID()));
+                auto sleNew = std::make_shared<SLE>(keylet::mptokenIssuance(mpt.getMptID()));
                 sleNew->setFieldU64(sfOutstandingAmount, -1);
                 ac.view().insert(sleNew);
                 return true;
@@ -977,7 +982,7 @@ class Invariants_test : public beast::unit_test::Suite
                     return false;
 
                 MPTIssue const mpt{makeMptID(1, AccountID(0x4985601))};
-                auto sleNew = std::make_shared<SLE>(keylet::mptIssuance(mpt.getMptID()));
+                auto sleNew = std::make_shared<SLE>(keylet::mptokenIssuance(mpt.getMptID()));
                 sleNew->setFieldU64(sfLockedAmount, -1);
                 ac.view().insert(sleNew);
                 return true;
@@ -993,7 +998,7 @@ class Invariants_test : public beast::unit_test::Suite
                     return false;
 
                 MPTIssue const mpt{makeMptID(1, AccountID(0x4985601))};
-                auto sleNew = std::make_shared<SLE>(keylet::mptIssuance(mpt.getMptID()));
+                auto sleNew = std::make_shared<SLE>(keylet::mptokenIssuance(mpt.getMptID()));
                 sleNew->setFieldU64(sfOutstandingAmount, 1);
                 sleNew->setFieldU64(sfLockedAmount, 10);
                 ac.view().insert(sleNew);
@@ -1176,7 +1181,7 @@ class Invariants_test : public beast::unit_test::Suite
         doInvariantCheck(
             {{"NFT page has invalid size"}},
             [&makeNFTokenIDs](Account const& a1, Account const&, ApplyContext& ac) {
-                auto nftPage = std::make_shared<SLE>(keylet::nftpageMax(a1));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPageMax(a1));
                 nftPage->setFieldArray(sfNFTokens, makeNFTokenIDs(0));
 
                 ac.view().insert(nftPage);
@@ -1186,7 +1191,7 @@ class Invariants_test : public beast::unit_test::Suite
         doInvariantCheck(
             {{"NFT page has invalid size"}},
             [&makeNFTokenIDs](Account const& a1, Account const&, ApplyContext& ac) {
-                auto nftPage = std::make_shared<SLE>(keylet::nftpageMax(a1));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPageMax(a1));
                 nftPage->setFieldArray(sfNFTokens, makeNFTokenIDs(33));
 
                 ac.view().insert(nftPage);
@@ -1199,7 +1204,7 @@ class Invariants_test : public beast::unit_test::Suite
                 STArray nfTokens = makeNFTokenIDs(2);
                 std::iter_swap(nfTokens.begin(), nfTokens.begin() + 1);
 
-                auto nftPage = std::make_shared<SLE>(keylet::nftpageMax(a1));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPageMax(a1));
                 nftPage->setFieldArray(sfNFTokens, nfTokens);
 
                 ac.view().insert(nftPage);
@@ -1212,7 +1217,7 @@ class Invariants_test : public beast::unit_test::Suite
                 STArray nfTokens = makeNFTokenIDs(1);
                 nfTokens[0].setFieldVL(sfURI, Blob{});
 
-                auto nftPage = std::make_shared<SLE>(keylet::nftpageMax(a1));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPageMax(a1));
                 nftPage->setFieldArray(sfNFTokens, nfTokens);
 
                 ac.view().insert(nftPage);
@@ -1222,9 +1227,9 @@ class Invariants_test : public beast::unit_test::Suite
         doInvariantCheck(
             {{"NFT page is improperly linked"}},
             [&makeNFTokenIDs](Account const& a1, Account const&, ApplyContext& ac) {
-                auto nftPage = std::make_shared<SLE>(keylet::nftpageMax(a1));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPageMax(a1));
                 nftPage->setFieldArray(sfNFTokens, makeNFTokenIDs(1));
-                nftPage->setFieldH256(sfPreviousPageMin, keylet::nftpageMax(a1).key);
+                nftPage->setFieldH256(sfPreviousPageMin, keylet::nftokenPageMax(a1).key);
 
                 ac.view().insert(nftPage);
                 return true;
@@ -1233,9 +1238,9 @@ class Invariants_test : public beast::unit_test::Suite
         doInvariantCheck(
             {{"NFT page is improperly linked"}},
             [&makeNFTokenIDs](Account const& a1, Account const& a2, ApplyContext& ac) {
-                auto nftPage = std::make_shared<SLE>(keylet::nftpageMax(a1));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPageMax(a1));
                 nftPage->setFieldArray(sfNFTokens, makeNFTokenIDs(1));
-                nftPage->setFieldH256(sfPreviousPageMin, keylet::nftpageMin(a2).key);
+                nftPage->setFieldH256(sfPreviousPageMin, keylet::nftokenPageMin(a2).key);
 
                 ac.view().insert(nftPage);
                 return true;
@@ -1244,7 +1249,7 @@ class Invariants_test : public beast::unit_test::Suite
         doInvariantCheck(
             {{"NFT page is improperly linked"}},
             [&makeNFTokenIDs](Account const& a1, Account const&, ApplyContext& ac) {
-                auto nftPage = std::make_shared<SLE>(keylet::nftpageMax(a1));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPageMax(a1));
                 nftPage->setFieldArray(sfNFTokens, makeNFTokenIDs(1));
                 nftPage->setFieldH256(sfNextPageMin, nftPage->key());
 
@@ -1256,10 +1261,10 @@ class Invariants_test : public beast::unit_test::Suite
             {{"NFT page is improperly linked"}},
             [&makeNFTokenIDs](Account const& a1, Account const& a2, ApplyContext& ac) {
                 STArray nfTokens = makeNFTokenIDs(1);
-                auto nftPage = std::make_shared<SLE>(keylet::nftpage(
-                    keylet::nftpageMax(a1), ++(nfTokens[0].getFieldH256(sfNFTokenID))));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPage(
+                    keylet::nftokenPageMax(a1), ++(nfTokens[0].getFieldH256(sfNFTokenID))));
                 nftPage->setFieldArray(sfNFTokens, nfTokens);
-                nftPage->setFieldH256(sfNextPageMin, keylet::nftpageMax(a2).key);
+                nftPage->setFieldH256(sfNextPageMin, keylet::nftokenPageMax(a2).key);
 
                 ac.view().insert(nftPage);
                 return true;
@@ -1269,8 +1274,8 @@ class Invariants_test : public beast::unit_test::Suite
             {{"NFT found in incorrect page"}},
             [&makeNFTokenIDs](Account const& a1, Account const&, ApplyContext& ac) {
                 STArray nfTokens = makeNFTokenIDs(2);
-                auto nftPage = std::make_shared<SLE>(keylet::nftpage(
-                    keylet::nftpageMax(a1), (nfTokens[1].getFieldH256(sfNFTokenID))));
+                auto nftPage = std::make_shared<SLE>(keylet::nftokenPage(
+                    keylet::nftokenPageMax(a1), (nfTokens[1].getFieldH256(sfNFTokenID))));
                 nftPage->setFieldArray(sfNFTokens, nfTokens);
 
                 ac.view().insert(nftPage);
@@ -2129,7 +2134,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         auto const getBookRootKey = [](Account const& account, std::uint64_t quality) {
             Book const book{xrpIssue(), account["USD"], std::nullopt};
-            return keylet::quality(keylet::kBook(book), quality);
+            return keylet::quality(keylet::book(book), quality);
         };
 
         // Root book-directory pages carry exchange-rate metadata that must
@@ -2301,7 +2306,7 @@ class Invariants_test : public beast::unit_test::Suite
         // Create Loan Broker
         using namespace loanBroker;
 
-        auto const loanBrokerKeylet = keylet::loanbroker(a.id(), env.seq(a));
+        auto const loanBrokerKeylet = keylet::loanBroker(a.id(), env.seq(a));
         // Create a Loan Broker with all default values.
         env(set(a, vaultID), Fee(kIncrement));
 
@@ -2680,7 +2685,7 @@ class Invariants_test : public beast::unit_test::Suite
                 return false;
 
             auto const mptIssuanceID = (*sleVault)[sfShareMPTID];
-            auto sleShares = ac.peek(keylet::mptIssuance(mptIssuanceID));
+            auto sleShares = ac.peek(keylet::mptokenIssuance(mptIssuanceID));
             if (!sleShares)
                 return false;
 
@@ -2982,7 +2987,7 @@ class Invariants_test : public beast::unit_test::Suite
                 auto sleVault = ac.view().peek(keylet);
                 if (!sleVault)
                     return false;
-                auto sleShares = ac.view().peek(keylet::mptIssuance((*sleVault)[sfShareMPTID]));
+                auto sleShares = ac.view().peek(keylet::mptokenIssuance((*sleVault)[sfShareMPTID]));
                 if (!sleShares)
                     return false;
                 ac.view().erase(sleVault);
@@ -3007,7 +3012,7 @@ class Invariants_test : public beast::unit_test::Suite
                 auto sleVault = ac.view().peek(keylet);
                 if (!sleVault)
                     return false;
-                auto sleShares = ac.view().peek(keylet::mptIssuance((*sleVault)[sfShareMPTID]));
+                auto sleShares = ac.view().peek(keylet::mptokenIssuance((*sleVault)[sfShareMPTID]));
                 if (!sleShares)
                     return false;
                 // Note, such an "orphaned" update of MPT issuance attached to a
@@ -3097,7 +3102,7 @@ class Invariants_test : public beast::unit_test::Suite
                 (*sleVault)[sfAssetsMaximum] = 200;
                 ac.view().update(sleVault);
 
-                auto sleShares = ac.view().peek(keylet::mptIssuance((*sleVault)[sfShareMPTID]));
+                auto sleShares = ac.view().peek(keylet::mptokenIssuance((*sleVault)[sfShareMPTID]));
                 if (!sleShares)
                     return false;
                 ac.view().erase(sleShares);
@@ -3293,7 +3298,7 @@ class Invariants_test : public beast::unit_test::Suite
                 if (!sleVault)
                     return false;
                 ac.view().update(sleVault);
-                auto sleShares = ac.view().peek(keylet::mptIssuance((*sleVault)[sfShareMPTID]));
+                auto sleShares = ac.view().peek(keylet::mptokenIssuance((*sleVault)[sfShareMPTID]));
                 if (!sleShares)
                     return false;
                 (*sleShares)[sfOutstandingAmount] = 0;
@@ -3313,7 +3318,7 @@ class Invariants_test : public beast::unit_test::Suite
                 auto sleVault = ac.view().peek(keylet);
                 if (!sleVault)
                     return false;
-                auto sleShares = ac.view().peek(keylet::mptIssuance((*sleVault)[sfShareMPTID]));
+                auto sleShares = ac.view().peek(keylet::mptokenIssuance((*sleVault)[sfShareMPTID]));
                 if (!sleShares)
                     return false;
                 (*sleShares)[sfMaximumAmount] = 10;
@@ -3336,7 +3341,7 @@ class Invariants_test : public beast::unit_test::Suite
                 auto sleVault = ac.view().peek(keylet);
                 if (!sleVault)
                     return false;
-                auto sleShares = ac.view().peek(keylet::mptIssuance((*sleVault)[sfShareMPTID]));
+                auto sleShares = ac.view().peek(keylet::mptokenIssuance((*sleVault)[sfShareMPTID]));
                 if (!sleShares)
                     return false;
                 (*sleShares)[sfOutstandingAmount] = kMaxMpTokenAmount + 1;
@@ -3438,7 +3443,7 @@ class Invariants_test : public beast::unit_test::Suite
                 auto sleVault = ac.view().peek(keylet);
                 if (!sleVault)
                     return false;
-                auto sleShares = ac.view().peek(keylet::mptIssuance((*sleVault)[sfShareMPTID]));
+                auto sleShares = ac.view().peek(keylet::mptokenIssuance((*sleVault)[sfShareMPTID]));
                 if (!sleShares)
                     return false;
                 ac.view().update(sleVault);
@@ -3490,7 +3495,7 @@ class Invariants_test : public beast::unit_test::Suite
                 auto sleVault = ac.view().peek(keylet);
                 if (!sleVault)
                     return false;
-                auto sleShares = ac.view().peek(keylet::mptIssuance((*sleVault)[sfShareMPTID]));
+                auto sleShares = ac.view().peek(keylet::mptokenIssuance((*sleVault)[sfShareMPTID]));
                 if (!sleShares)
                     return false;
                 ac.view().update(sleVault);
@@ -3537,7 +3542,7 @@ class Invariants_test : public beast::unit_test::Suite
                 ac.view().insert(sleAccount);
 
                 auto const sharesMptId = makeMptID(sequence, pseudoId);
-                auto const sharesKeylet = keylet::mptIssuance(sharesMptId);
+                auto const sharesKeylet = keylet::mptokenIssuance(sharesMptId);
                 auto sleShares = std::make_shared<SLE>(sharesKeylet);
                 auto const sharesPage = ac.view().dirInsert(
                     keylet::ownerDir(pseudoId), sharesKeylet, describeOwnerDir(pseudoId));
@@ -3595,7 +3600,7 @@ class Invariants_test : public beast::unit_test::Suite
                 ac.view().insert(sleAccount);
 
                 auto const sharesMptId = makeMptID(sequence, pseudoId);
-                auto const sharesKeylet = keylet::mptIssuance(sharesMptId);
+                auto const sharesKeylet = keylet::mptokenIssuance(sharesMptId);
                 auto sleShares = std::make_shared<SLE>(sharesKeylet);
                 auto const sharesPage = ac.view().dirInsert(
                     keylet::ownerDir(pseudoId), sharesKeylet, describeOwnerDir(pseudoId));
@@ -3637,7 +3642,7 @@ class Invariants_test : public beast::unit_test::Suite
                 sleVault->setFieldU64(sfOwnerNode, *vaultPage);
 
                 auto const sharesMptId = makeMptID(sequence, a2.id());
-                auto const sharesKeylet = keylet::mptIssuance(sharesMptId);
+                auto const sharesKeylet = keylet::mptokenIssuance(sharesMptId);
                 auto sleShares = std::make_shared<SLE>(sharesKeylet);
                 auto const sharesPage = ac.view().dirInsert(
                     keylet::ownerDir(a2.id()), sharesKeylet, describeOwnerDir(a2.id()));
@@ -4277,7 +4282,7 @@ class Invariants_test : public beast::unit_test::Suite
                     return false;
 
                 MPTIssue const mpt{makeMptID(sle->getFieldU32(sfSequence), a1)};
-                auto sleNew = std::make_shared<SLE>(keylet::mptIssuance(mpt.getMptID()));
+                auto sleNew = std::make_shared<SLE>(keylet::mptokenIssuance(mpt.getMptID()));
                 sleNew->setFieldU64(sfOutstandingAmount, 110);
                 sleNew->setFieldU64(sfMaximumAmount, 100);
                 ac.view().insert(sleNew);
@@ -4294,7 +4299,7 @@ class Invariants_test : public beast::unit_test::Suite
                     return false;
 
                 MPTIssue const mpt{makeMptID(sle->getFieldU32(sfSequence), a1)};
-                auto sleNew = std::make_shared<SLE>(keylet::mptIssuance(mpt.getMptID()));
+                auto sleNew = std::make_shared<SLE>(keylet::mptokenIssuance(mpt.getMptID()));
                 sleNew->setFieldU64(sfOutstandingAmount, 100);
                 sleNew->setFieldU64(sfMaximumAmount, 100);
                 ac.view().insert(sleNew);
@@ -4338,7 +4343,7 @@ class Invariants_test : public beast::unit_test::Suite
             });
         testPayment(
             "OutstandingAmount overflow", [&](MPTID const& id, ApplyContext& ac, Account const&) {
-                auto sle = ac.view().peek(keylet::mptIssuance(id));
+                auto sle = ac.view().peek(keylet::mptokenIssuance(id));
                 if (!sle)
                     return false;
                 sle->setFieldU64(sfOutstandingAmount, 101);
@@ -4365,7 +4370,8 @@ class Invariants_test : public beast::unit_test::Suite
                     for (int i = 0; i < nTokens; ++i)
                     {
                         MPTIssue const mpt{makeMptID(seq + i, a1)};
-                        auto sleNew = std::make_shared<SLE>(keylet::mptIssuance(mpt.getMptID()));
+                        auto sleNew =
+                            std::make_shared<SLE>(keylet::mptokenIssuance(mpt.getMptID()));
                         ac.view().insert(sleNew);
 
                         sleNew = std::make_shared<SLE>(keylet::mptoken(mpt.getMptID(), a2));
@@ -4419,7 +4425,7 @@ class Invariants_test : public beast::unit_test::Suite
                 if (!sleAcct)
                     return false;
                 MPTIssue const mpt{makeMptID(sleAcct->getFieldU32(sfSequence), a1)};
-                auto sleNew = std::make_shared<SLE>(keylet::mptIssuance(mpt.getMptID()));
+                auto sleNew = std::make_shared<SLE>(keylet::mptokenIssuance(mpt.getMptID()));
                 sleNew->setFieldH256(sfReferenceHolding, uint256{1});
                 ac.view().insert(sleNew);
                 return true;
@@ -4442,7 +4448,7 @@ class Invariants_test : public beast::unit_test::Suite
                     if (!sleVault)
                         return false;
                     auto sleIssuance =
-                        ac.view().peek(keylet::mptIssuance(sleVault->at(sfShareMPTID)));
+                        ac.view().peek(keylet::mptokenIssuance(sleVault->at(sfShareMPTID)));
                     if (!sleIssuance)
                         return false;
                     sleIssuance->setFieldH256(sfReferenceHolding, uint256{2});
@@ -4484,7 +4490,7 @@ class Invariants_test : public beast::unit_test::Suite
                     if (!sleVault)
                         return false;
                     auto const sleIssuance =
-                        ac.view().peek(keylet::mptIssuance(sleVault->at(sfShareMPTID)));
+                        ac.view().peek(keylet::mptokenIssuance(sleVault->at(sfShareMPTID)));
                     if (!sleIssuance || !sleIssuance->isFieldPresent(sfReferenceHolding))
                         return false;
                     auto sleHolding = ac.view().peek(
@@ -4550,7 +4556,7 @@ class Invariants_test : public beast::unit_test::Suite
                                 ac.view().update(sle);
                                 return true;
                             };
-                            auto issuanceSle = ac.view().peek(keylet::mptIssuance(id));
+                            auto issuanceSle = ac.view().peek(keylet::mptokenIssuance(id));
                             if (!issuanceSle)
                                 return false;
                             auto const flags = issuanceSle->at(sfFlags);
@@ -4724,8 +4730,8 @@ class Invariants_test : public beast::unit_test::Suite
                                                    auto const& goodConfig) {
             char const* const c1 = "USD";
             char const* const c2 = "EUR";
-            auto const k1 = keylet::line(a1, a2, a1[c1].currency);
-            auto const k2 = keylet::line(a1, a3, a1[c2].currency);
+            auto const k1 = keylet::trustLine(a1, a2, a1[c1].currency);
+            auto const k2 = keylet::trustLine(a1, a3, a1[c2].currency);
 
             bool const k1First = k1.key < k2.key;
             auto const& badKey = k1First ? k1 : k2;
@@ -4820,7 +4826,7 @@ class Invariants_test : public beast::unit_test::Suite
                     return false;
 
                 MPTIssue const mpt{makeMptID(1, AccountID(0x4985601))};
-                auto sleNew = std::make_shared<SLE>(keylet::mptIssuance(mpt.getMptID()));
+                auto sleNew = std::make_shared<SLE>(keylet::mptokenIssuance(mpt.getMptID()));
                 // outstanding exceeds kMaxMpTokenAmount -> checkAmount sets bad_
                 sleNew->setFieldU64(sfOutstandingAmount, kMaxMpTokenAmount + 1);
                 // locked is valid and <= outstanding -> must NOT clear bad_
diff --git a/src/test/app/LPTokenTransfer_test.cpp b/src/test/app/LPTokenTransfer_test.cpp
index 4bf2db9515..2947b3a3ce 100644
--- a/src/test/app/LPTokenTransfer_test.cpp
+++ b/src/test/app/LPTokenTransfer_test.cpp
@@ -359,7 +359,7 @@ class LPTokenTransfer_test : public jtx::AMMTest
         env.close();
 
         // bob_ creates a sell offer for lptoken
-        uint256 const sellOfferIndex = keylet::nftoffer(bob_, env.seq(bob_)).key;
+        uint256 const sellOfferIndex = keylet::nftokenOffer(bob_, env.seq(bob_)).key;
         env(token::createOffer(bob_, nftID, STAmount{lpIssue, 10}), Txflags(tfSellNFToken));
         env.close();
 
@@ -420,7 +420,7 @@ class LPTokenTransfer_test : public jtx::AMMTest
             env.close();
 
             // bob_ creates a buy offer with lptoken despite bob_'s USD is frozen
-            uint256 const buyOfferIndex = keylet::nftoffer(bob_, env.seq(bob_)).key;
+            uint256 const buyOfferIndex = keylet::nftokenOffer(bob_, env.seq(bob_)).key;
             env(token::createOffer(bob_, nftID, STAmount{lpIssue, 10}), token::Owner(carol_));
             env.close();
 
diff --git a/src/test/app/LoanBroker_test.cpp b/src/test/app/LoanBroker_test.cpp
index 0edb955b90..671f98a901 100644
--- a/src/test/app/LoanBroker_test.cpp
+++ b/src/test/app/LoanBroker_test.cpp
@@ -94,7 +94,7 @@ class LoanBroker_test : public beast::unit_test::Suite
             using namespace loanBroker;
             // Can't create a loan broker regardless of whether the vault exists
             env(set(alice, keylet.key), Ter(temDISABLED));
-            auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+            auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
             // Other LoanBroker transactions are disabled, too.
             // 1. LoanBrokerCoverDeposit
             env(coverDeposit(alice, brokerKeylet.key, asset(1000)), Ter(temDISABLED));
@@ -180,7 +180,7 @@ class LoanBroker_test : public beast::unit_test::Suite
         static PrettyAsset const kGhostIouAsset = kNonExistent["GST"];
         PrettyAsset const vaultPseudoIouAsset = vault.pseudoAccount["PSD"];
 
-        auto const badKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+        auto const badKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
         env(set(alice, badVault.vaultID));
         env.close();
         auto const badBrokerPseudo = [&]() {
@@ -193,7 +193,7 @@ class LoanBroker_test : public beast::unit_test::Suite
         }();
         PrettyAsset const badBrokerPseudoIouAsset = badBrokerPseudo["WAT"];
 
-        auto const keylet = keylet::loanbroker(alice.id(), env.seq(alice));
+        auto const keylet = keylet::loanBroker(alice.id(), env.seq(alice));
         {
             // Start with default values
             auto jtx = env.jt(set(alice, vault.vaultID));
@@ -736,7 +736,7 @@ class LoanBroker_test : public beast::unit_test::Suite
                     // Modifications
 
                     // Update the fields
-                    auto const nextKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+                    auto const nextKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
 
                     // fields that can't be changed
                     // LoanBrokerID
@@ -892,7 +892,7 @@ class LoanBroker_test : public beast::unit_test::Suite
         env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = asset(50)}));
         env.close();
 
-        auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+        auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
         env(set(alice, vaultInfo.vaultID));
         env.close();
 
@@ -1231,7 +1231,7 @@ class LoanBroker_test : public beast::unit_test::Suite
         env.close();
 
         // Predict LoanBroker key using alice's current sequence BEFORE submit
-        auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+        auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
 
         // Create LoanBroker pointing to the vault
         env(loanBroker::set(alice, vaultKeylet.key));
@@ -1250,7 +1250,7 @@ class LoanBroker_test : public beast::unit_test::Suite
         beast::Journal const jlog{sink};
         ApplyContext ac{env.app(), ov, tx, tesSUCCESS, env.current()->fees().base, TapNone, jlog};
 
-        if (auto sleBroker = ac.view().peek(keylet::loanbroker(brokerKeylet.key)))
+        if (auto sleBroker = ac.view().peek(keylet::loanBroker(brokerKeylet.key)))
         {
             auto const vaultID = (*sleBroker)[sfVaultID];
             if (auto sleVault = ac.view().peek(keylet::vault(vaultID)))
@@ -1337,7 +1337,7 @@ class LoanBroker_test : public beast::unit_test::Suite
                 err);
         });
 
-        auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+        auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
         // Can create LoanBroker if the vault owner is not authorized
         forUnauthAuth([&](auto) { env(set(alice, vaultInfo.vaultID)); });
 
@@ -1415,7 +1415,7 @@ class LoanBroker_test : public beast::unit_test::Suite
         env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = asset(50)}));
         env.close();
 
-        auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+        auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
         env(set(alice, vaultInfo.vaultID));
         env.close();
 
@@ -1503,7 +1503,7 @@ class LoanBroker_test : public beast::unit_test::Suite
                 Ter(err));
             env.close();
 
-            auto const brokerKeylet = keylet::loanbroker(broker, env.seq(broker));
+            auto const brokerKeylet = keylet::loanBroker(broker, env.seq(broker));
 
             env(loanBroker::set(broker, keylet.key));
             env.close();
@@ -1617,7 +1617,7 @@ class LoanBroker_test : public beast::unit_test::Suite
         env.close();
 
         // Create loan broker
-        auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+        auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
         env(set(alice, vaultKeylet.key));
         env.close();
 
@@ -1734,7 +1734,7 @@ class LoanBroker_test : public beast::unit_test::Suite
         env.close();
 
         // Create loan broker
-        auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+        auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
         env(set(alice, vaultKeylet.key));
         env.close();
 
@@ -1876,7 +1876,7 @@ class LoanBroker_test : public beast::unit_test::Suite
             env(vault.withdraw({.depositor = broker, .id = keylet.key, .amount = token(1'000)}));
 
             // Test LoanBroker withdraw
-            auto const brokerKeylet = keylet::loanbroker(broker, env.seq(broker));
+            auto const brokerKeylet = keylet::loanBroker(broker, env.seq(broker));
 
             env(loanBroker::set(broker, keylet.key));
             env.close();
@@ -2004,7 +2004,7 @@ class LoanBroker_test : public beast::unit_test::Suite
             }
 
             // Test LoanBroker withdraw
-            auto const brokerKeylet = keylet::loanbroker(broker, env.seq(broker));
+            auto const brokerKeylet = keylet::loanBroker(broker, env.seq(broker));
 
             env(loanBroker::set(broker, keylet.key));
             env.close();
@@ -2068,7 +2068,7 @@ class LoanBroker_test : public beast::unit_test::Suite
             env(createTx);
             env.close();
 
-            auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+            auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
             env(set(alice, vaultKeylet.key));
             env.close();
 
@@ -2215,7 +2215,7 @@ class LoanBroker_test : public beast::unit_test::Suite
                 env(createTx);
                 env.close();
 
-                auto const brokerKeylet = keylet::loanbroker(alice.id(), env.seq(alice));
+                auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
                 env(set(alice, vaultKeylet.key));
                 env.close();
 
diff --git a/src/test/app/Loan_test.cpp b/src/test/app/Loan_test.cpp
index 2d70efd9b2..1b0dd414e1 100644
--- a/src/test/app/Loan_test.cpp
+++ b/src/test/app/Loan_test.cpp
@@ -127,7 +127,7 @@ protected:
             Account const bob{"bob"};
             env.fund(XRP(10000), alice, bob);
 
-            auto const keylet = keylet::loanbroker(alice, env.seq(alice));
+            auto const keylet = keylet::loanBroker(alice, env.seq(alice));
 
             using namespace std::chrono_literals;
             using namespace loan;
@@ -214,7 +214,7 @@ protected:
         [[nodiscard]] Keylet
         brokerKeylet() const
         {
-            return keylet::loanbroker(brokerID);
+            return keylet::loanBroker(brokerID);
         }
         [[nodiscard]] Keylet
         vaultKeylet() const
@@ -371,7 +371,7 @@ protected:
             std::uint32_t ownerCount) const
         {
             using namespace jtx;
-            if (auto brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            if (auto brokerSle = env.le(keylet::loanBroker(broker.brokerID));
                 env.test.BEAST_EXPECT(brokerSle))
             {
                 TenthBips16 const managementFeeRate{brokerSle->at(sfManagementFeeRate)};
@@ -469,7 +469,7 @@ protected:
                     paymentRemaining,
                     1);
 
-                if (auto brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+                if (auto brokerSle = env.le(keylet::loanBroker(broker.brokerID));
                     env.test.BEAST_EXPECT(brokerSle))
                 {
                     if (auto vaultSle = env.le(keylet::vault(brokerSle->at(sfVaultID)));
@@ -538,7 +538,7 @@ protected:
             BEAST_EXPECT(vault->at(sfAssetsAvailable) == deposit.value());
         }
 
-        auto const keylet = keylet::loanbroker(lender.id(), env.seq(lender));
+        auto const keylet = keylet::loanBroker(lender.id(), env.seq(lender));
 
         using namespace loanBroker;
         env(set(lender, vaultKeylet.key, params.flags),
@@ -631,7 +631,7 @@ protected:
     bool
     canImpairLoan(jtx::Env const& env, BrokerInfo const& broker, LoanState const& state)
     {
-        if (auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             if (auto const vaultSle = env.le(keylet::vault(brokerSle->at(sfVaultID)));
@@ -802,7 +802,7 @@ protected:
         BrokerInfo const broker = createVaultAndBroker(env, asset, lender, brokerParams);
 
         auto const pseudoAcctOpt = [&]() -> std::optional<Account> {
-            auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             if (!BEAST_EXPECT(brokerSle))
                 return std::nullopt;
             auto const brokerPseudo = brokerSle->at(sfAccount);
@@ -813,7 +813,7 @@ protected:
         Account const& pseudoAcct = *pseudoAcctOpt;
 
         auto const loanKeyletOpt = [&]() -> std::optional<Keylet> {
-            auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             if (!BEAST_EXPECT(brokerSle))
                 return std::nullopt;
 
@@ -1287,7 +1287,7 @@ protected:
             toEndOfLife)
     {
         auto const [keylet, loanSequence] = [&]() {
-            auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             if (!BEAST_EXPECT(brokerSle))
             {
                 // will be invalid
@@ -1376,7 +1376,7 @@ protected:
 
         auto const startDate = env.current()->header().parentCloseTime.time_since_epoch().count();
 
-        if (auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             BEAST_EXPECT(brokerSle->at(sfOwnerCount) == 1);
@@ -1557,7 +1557,7 @@ protected:
             borrowerStartingBalance.value() - adjustment);
         BEAST_EXPECT(env.ownerCount(borrower) == borrowerOwnerCount);
 
-        if (auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             BEAST_EXPECT(brokerSle->at(sfOwnerCount) == 0);
@@ -1633,7 +1633,7 @@ protected:
         auto const loanSetFee = Fee(env.current()->fees().base * 2);
 
         auto const pseudoAcct = [&]() {
-            auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             if (!BEAST_EXPECT(brokerSle))
                 return Account{lender};
             auto const brokerPseudo = brokerSle->at(sfAccount);
@@ -1896,7 +1896,7 @@ protected:
         // XRP can not be frozen, but run through the loop anyway to test
         // the tecLIMIT_EXCEEDED case
         {
-            auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             if (!BEAST_EXPECT(brokerSle))
                 return;
 
@@ -2020,7 +2020,7 @@ protected:
         // Finally! Create a loan
 
         auto coverAvailable = [&env, this](uint256 const& brokerID, Number const& expected) {
-            if (auto const brokerSle = env.le(keylet::loanbroker(brokerID));
+            if (auto const brokerSle = env.le(keylet::loanBroker(brokerID));
                 BEAST_EXPECT(brokerSle))
             {
                 auto const available = brokerSle->at(sfCoverAvailable);
@@ -2030,7 +2030,7 @@ protected:
             return Number{};
         };
         auto getDefaultInfo = [&env, this](LoanState const& state, BrokerInfo const& broker) {
-            if (auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            if (auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
                 BEAST_EXPECT(brokerSle))
             {
                 BEAST_EXPECT(
@@ -3149,7 +3149,7 @@ protected:
 
                 env(pay(borrower, issuer, broker.asset(10'000)));
                 env.close();
-                auto const trustline = keylet::line(borrower, broker.asset.raw().get<Issue>());
+                auto const trustline = keylet::trustLine(borrower, broker.asset.raw().get<Issue>());
                 auto const sleLine1 = env.le(trustline);
                 BEAST_EXPECT(sleLine1 == nullptr);
 
@@ -3242,7 +3242,7 @@ protected:
                 env.trust(broker.asset(0), lender);
                 env.close();
 
-                auto const trustline = keylet::line(lender, broker.asset.raw().get<Issue>());
+                auto const trustline = keylet::trustLine(lender, broker.asset.raw().get<Issue>());
                 auto const sleLine1 = env.le(trustline);
                 BEAST_EXPECT(sleLine1 != nullptr);
 
@@ -3552,7 +3552,7 @@ protected:
                 }
             }
 
-            if (auto brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            if (auto brokerSle = env.le(keylet::loanBroker(broker.brokerID));
                 BEAST_EXPECT(brokerSle))
             {
                 BEAST_EXPECT(brokerSle->at(sfOwnerCount) == 0);
@@ -3563,7 +3563,7 @@ protected:
                     lender, broker.brokerID, STAmount(broker.asset, coverAvailable)));
                 env.close();
 
-                brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+                brokerSle = env.le(keylet::loanBroker(broker.brokerID));
                 BEAST_EXPECT(brokerSle && brokerSle->at(sfCoverAvailable) == 0);
             }
             // Verify we can delete the loan broker
@@ -3795,7 +3795,7 @@ protected:
 
         BrokerInfo const broker{createVaultAndBroker(env, xrpAsset, lender, brokerParams)};
 
-        if (auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             BEAST_EXPECT(brokerSle->at(sfDebtMaximum) == 0);
@@ -3865,7 +3865,7 @@ protected:
         createJson["OverpaymentInterestRate"] = 1360;
         createJson["PaymentInterval"] = 727;
 
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
         auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -4208,11 +4208,11 @@ protected:
             Env env(*this);
 
             auto getCoverBalance = [&](BrokerInfo const& brokerInfo, auto const& accountField) {
-                if (auto const le = env.le(keylet::loanbroker(brokerInfo.brokerID));
+                if (auto const le = env.le(keylet::loanBroker(brokerInfo.brokerID));
                     BEAST_EXPECT(le))
                 {
                     auto const account = le->at(accountField);
-                    if (auto const sleLine = env.le(keylet::line(account, iou));
+                    if (auto const sleLine = env.le(keylet::trustLine(account, iou));
                         BEAST_EXPECT(sleLine))
                     {
                         STAmount balance = sleLine->at(sfBalance);
@@ -4390,7 +4390,7 @@ protected:
         env.close();
 
         auto const pseudoBroker = [&]() -> std::optional<Account> {
-            if (auto brokerSle = env.le(keylet::loanbroker(brokerInfo.brokerID));
+            if (auto brokerSle = env.le(keylet::loanBroker(brokerInfo.brokerID));
                 BEAST_EXPECT(brokerSle))
             {
                 return Account{"pseudo", brokerSle->at(sfAccount)};
@@ -4620,7 +4620,7 @@ protected:
         createJson["PaymentTotal"] = "2891743748";
         createJson["PrincipalRequested"] = "8516.98";
 
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
 
         createJson = env.json(createJson, Sig(sfCounterpartySignature, lender));
         env(createJson, Ter(temINVALID));
@@ -4681,7 +4681,7 @@ protected:
         createJson["PaymentTotal"] = 5678;
         createJson["PrincipalRequested"] = "9924.81";
 
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
         auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -4690,7 +4690,7 @@ protected:
         env.close();
 
         auto const pseudoAcct = [&]() {
-            auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             if (!BEAST_EXPECT(brokerSle))
                 return Account{lender};
             auto const brokerPseudo = brokerSle->at(sfAccount);
@@ -4771,7 +4771,7 @@ protected:
         createJson["PaymentTotal"] = 1;
         createJson["PrincipalRequested"] = "0.000763058";
 
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
         auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -4840,7 +4840,7 @@ protected:
         // There are enough payments due on this loan that it only needs to be
         // created once, and can be paid on multiple times. Just don't create a
         // gazillion test cases.
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
         auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -4979,7 +4979,7 @@ protected:
         createJson["PaymentTotal"] = 5678;
         createJson["PrincipalRequested"] = "9924.81";
 
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
         auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -5085,7 +5085,7 @@ protected:
         createJson["PaymentTotal"] = 5678;
         createJson["PrincipalRequested"] = "9924.81";
 
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
         auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -5250,7 +5250,7 @@ protected:
         }
         {
             // Start date when the ledger is closed will be larger
-            auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
             auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
             auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -5277,7 +5277,7 @@ protected:
         }
         {
             // Start date when the ledger is closed will be larger
-            auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
             auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
             auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -5325,7 +5325,7 @@ protected:
             if (!BEAST_EXPECT(total != 0))
                 return;
 
-            auto const brokerState = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerState = env.le(keylet::loanBroker(broker.brokerID));
             // Intentionally shadow the outer values
             auto const loanSequence = brokerState->at(sfLoanSequence);
             auto const keylet = keylet::loan(broker.brokerID, loanSequence);
@@ -5514,7 +5514,7 @@ protected:
 
         auto const loanSetFee = Fee(env.current()->fees().base * 2);
 
-        auto const brokerPreLoan = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerPreLoan = env.le(keylet::loanBroker(broker.brokerID));
         if (BEAST_EXPECT(brokerPreLoan); !brokerPreLoan.has_value())
             return;
 
@@ -5549,7 +5549,7 @@ protected:
         auto const overdueClose = tp{d{state1.nextPaymentDate + state1.paymentInterval}};
         env.close(overdueClose);
 
-        auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSle = env.le(loanKeylet);
         if (!BEAST_EXPECT(brokerSle && loanSle))
             return;
@@ -5684,7 +5684,7 @@ protected:
             env(createTx);
             env.close();
 
-            auto const brokerBefore = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerBefore = env.le(keylet::loanBroker(broker.brokerID));
             BEAST_EXPECT(brokerBefore);
             if (!brokerBefore)
                 return;
@@ -5701,7 +5701,7 @@ protected:
             env(coverClawback(issuer, 0), loanBrokerID(broker.brokerID));
             env.close();
 
-            auto const brokerAfter = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerAfter = env.le(keylet::loanBroker(broker.brokerID));
             BEAST_EXPECT(brokerAfter);
             if (!brokerAfter)
                 return;
@@ -5793,7 +5793,7 @@ protected:
             kGracePeriod(grace),
             Fee(loanSetFee));
 
-        auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
         BEAST_EXPECT(brokerSle);
         auto const loanSequence = brokerSle ? brokerSle->at(sfLoanSequence) : 0;
         auto const loanKeylet = keylet::loan(broker.brokerID, loanSequence);
@@ -5825,7 +5825,7 @@ protected:
         auto after = getCurrentState(env, broker, loanKeylet);
         auto const loanSle = env.le(loanKeylet);
         BEAST_EXPECT(loanSle);
-        auto const brokerSle2 = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerSle2 = env.le(keylet::loanBroker(broker.brokerID));
         BEAST_EXPECT(brokerSle2);
 
         auto const closePaymentFee = loanSle ? loanSle->at(sfClosePaymentFee) : Number{};
@@ -5987,7 +5987,7 @@ protected:
         auto broker = createVaultAndBroker(env, asset, lender, brokerParams);
 
         auto const loanKeyletOpt = [&]() -> std::optional<Keylet> {
-            auto const brokerSle = env.le(keylet::loanbroker(broker.brokerID));
+            auto const brokerSle = env.le(keylet::loanBroker(broker.brokerID));
             if (!BEAST_EXPECT(brokerSle))
                 return std::nullopt;
 
@@ -6258,7 +6258,7 @@ protected:
             txFee);
         env.close();
 
-        auto const brokerKeyLet = keylet::loanbroker(lender.id(), env.seq(lender));
+        auto const brokerKeyLet = keylet::loanBroker(lender.id(), env.seq(lender));
 
         env(loanBroker::set(lender, vaultKeyLet.key), txFee);
         env.close();
@@ -6332,7 +6332,7 @@ protected:
         env.close();
 
         // Verify DebtTotal is exactly 804
-        if (auto const brokerSle = env.le(keylet::loanbroker(brokerInfo.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(brokerInfo.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             log << *brokerSle << std::endl;
@@ -6353,7 +6353,7 @@ protected:
         env.close();
 
         // Validate CoverAvailable == 80 XRP and DebtTotal remains 804
-        if (auto const brokerSle = env.le(keylet::loanbroker(brokerInfo.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(brokerInfo.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             log << *brokerSle << std::endl;
@@ -6463,7 +6463,7 @@ protected:
                 txFee);
             env.close();
 
-            auto const brokerKeylet = keylet::loanbroker(broker.id(), env.seq(broker));
+            auto const brokerKeylet = keylet::loanBroker(broker.id(), env.seq(broker));
 
             env(loanBroker::set(broker, vaultKeylet.key), txFee);
             env.close();
@@ -6747,7 +6747,7 @@ protected:
         env(loanBroker::coverDeposit(broker, brokerInfo.brokerID, STAmount{iou, additionalCover}));
         env.close();
         // Verify broker owner has a trustline
-        auto const brokerTrustline = keylet::line(broker, iou);
+        auto const brokerTrustline = keylet::trustLine(broker, iou);
         BEAST_EXPECT(env.le(brokerTrustline) != nullptr);
         // Broker owner deletes their trustline
         // First, pay any positive balance to issuer to zero it out
@@ -6766,7 +6766,7 @@ protected:
         // Verify trustline is still deleted
         BEAST_EXPECT(env.le(brokerTrustline) == nullptr);
         // Verify the service fee went to the broker pseudo-account
-        if (auto const brokerSle = env.le(keylet::loanbroker(brokerInfo.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(brokerInfo.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             Account const pseudo("pseudo-account", brokerSle->at(sfAccount));
@@ -6847,7 +6847,7 @@ protected:
         // Verify the MPT is still unauthorized.
         BEAST_EXPECT(env.le(brokerMpt) == nullptr);
         // Verify the service fee went to the broker pseudo-account
-        if (auto const brokerSle = env.le(keylet::loanbroker(brokerInfo.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(brokerInfo.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             Account const pseudo("pseudo-account", brokerSle->at(sfAccount));
@@ -6950,7 +6950,7 @@ protected:
         // Verify broker is still not authorized
         env(pay(issuer, broker, mpt(1'000)), Ter(tecNO_AUTH));
         // Verify the service fee went to the broker pseudo-account
-        if (auto const brokerSle = env.le(keylet::loanbroker(brokerInfo.brokerID));
+        if (auto const brokerSle = env.le(keylet::loanBroker(brokerInfo.brokerID));
             BEAST_EXPECT(brokerSle))
         {
             Account const pseudo("pseudo-account", brokerSle->at(sfAccount));
@@ -7186,7 +7186,7 @@ protected:
                 .coverDeposit = 500'000,
             });
         auto const [currentSeq, vaultKeylet] = [&]() {
-            auto const brokerSle = env.le(keylet::loanbroker(brokerInfo.brokerID));
+            auto const brokerSle = env.le(keylet::loanBroker(brokerInfo.brokerID));
             if (!BEAST_EXPECT(brokerSle))
                 return std::make_tuple(0u, keylet::unchecked(beast::kZero));
             auto const currentSeq = brokerSle->at(sfLoanSequence);
@@ -7358,7 +7358,7 @@ protected:
         env.close();
 
         // Create a loan
-        auto const sleBroker = env.le(keylet::loanbroker(broker.brokerID));
+        auto const sleBroker = env.le(keylet::loanBroker(broker.brokerID));
         if (!BEAST_EXPECT(sleBroker))
             return;
 
@@ -7899,7 +7899,7 @@ protected:
         env(vault.deposit({.depositor = lender, .id = vaultKeylet.key, .amount = asset(5'000)}));
         env.close();
 
-        auto const brokerKeylet = keylet::loanbroker(lender.id(), env.seq(lender));
+        auto const brokerKeylet = keylet::loanBroker(lender.id(), env.seq(lender));
         env(loanBroker::set(lender, vaultKeylet.key),
             loanBroker::kDebtMaximum(Number{100}),
             Fee(env.current()->fees().base * 2));
@@ -8006,7 +8006,7 @@ protected:
         createJson["PaymentTotal"] = 3;
         createJson["PaymentInterval"] = 600;
 
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
         auto const keylet = keylet::loan(broker.brokerID, loanSequence);
 
@@ -8089,7 +8089,7 @@ protected:
         createJson["PaymentTotal"] = 3;
         createJson["PaymentInterval"] = 600;
 
-        auto const brokerStateBefore = env.le(keylet::loanbroker(broker.brokerID));
+        auto const brokerStateBefore = env.le(keylet::loanBroker(broker.brokerID));
         auto const loanSequence = brokerStateBefore->at(sfLoanSequence);
         auto const loanKeylet = keylet::loan(broker.brokerID, loanSequence);
         createJson = env.json(createJson, Sig(sfCounterpartySignature, lender));
@@ -8231,7 +8231,7 @@ protected:
                 // Create the TINY loan first (while vaultScale is still
                 // small).  principal 0.01, 0% interest, 1 payment =>
                 // loanScale = vaultScale.
-                auto const brokerSle1 = env.le(keylet::loanbroker(c.broker.brokerID));
+                auto const brokerSle1 = env.le(keylet::loanBroker(c.broker.brokerID));
                 if (!BEAST_EXPECT(brokerSle1))
                     return std::nullopt;
                 auto const tinyLoanSeq = brokerSle1->at(sfLoanSequence);
@@ -8248,7 +8248,7 @@ protected:
                 // Create the BIG loan second.  100% annual interest over 20
                 // payments pushes totalValueOutstanding high enough that
                 // loanScale > vaultScale.
-                auto const brokerSle2 = env.le(keylet::loanbroker(c.broker.brokerID));
+                auto const brokerSle2 = env.le(keylet::loanBroker(c.broker.brokerID));
                 if (!BEAST_EXPECT(brokerSle2))
                     return std::nullopt;
                 auto const bigLoanSeq = brokerSle2->at(sfLoanSequence);
@@ -8299,7 +8299,7 @@ protected:
                     kAmount(STAmount{asset, clawbackAmount}));
                 env.close();
 
-                auto const brokerSle = env.le(keylet::loanbroker(c.broker.brokerID));
+                auto const brokerSle = env.le(keylet::loanBroker(c.broker.brokerID));
                 if (!BEAST_EXPECT(brokerSle) ||
                     !BEAST_EXPECT(brokerSle->at(sfCoverAvailable) == expectedCoverAfter))
                     return std::nullopt;
@@ -8312,7 +8312,7 @@ protected:
             // than to the owner.
             auto feeGoesToPseudo = [&](Env& env, Ctx const& c, Keylet const& loanKeylet) -> bool {
                 Asset const asset{c.iou};
-                auto const brokerSle = env.le(keylet::loanbroker(c.broker.brokerID));
+                auto const brokerSle = env.le(keylet::loanBroker(c.broker.brokerID));
                 if (!BEAST_EXPECT(brokerSle))
                     return false;
                 auto const pseudoAcct = Account("pseudo", brokerSle->at(sfAccount));
@@ -8394,7 +8394,7 @@ protected:
                 env.close();
 
                 // Read broker state and compute both old and new minimums.
-                auto const brokerSle = env.le(keylet::loanbroker(c.broker.brokerID));
+                auto const brokerSle = env.le(keylet::loanBroker(c.broker.brokerID));
                 auto const vaultSle = env.le(keylet::vault(c.broker.vaultID));
                 if (!BEAST_EXPECT(brokerSle) || !BEAST_EXPECT(vaultSle))
                     return;
diff --git a/src/test/app/MPToken_test.cpp b/src/test/app/MPToken_test.cpp
index 2cab3e7c89..bfb80d3e36 100644
--- a/src/test/app/MPToken_test.cpp
+++ b/src/test/app/MPToken_test.cpp
@@ -4049,7 +4049,7 @@ class MPToken_test : public beast::unit_test::Suite
             // view may contain partial state and must be discarded.
             if (expectedOutstanding)
             {
-                auto const sle = av.peek(keylet::mptIssuance(mptTester.issuanceID()));
+                auto const sle = av.peek(keylet::mptokenIssuance(mptTester.issuanceID()));
                 if (!BEAST_EXPECT(sle))
                     return;
                 BEAST_EXPECTS(sle->getFieldU64(sfOutstandingAmount) == *expectedOutstanding, label);
diff --git a/src/test/app/MultiSign_test.cpp b/src/test/app/MultiSign_test.cpp
index f161226210..8fb1eb31ab 100644
--- a/src/test/app/MultiSign_test.cpp
+++ b/src/test/app/MultiSign_test.cpp
@@ -1511,7 +1511,7 @@ public:
         env.close();
 
         // Verify that the SignerList object was created correctly.
-        auto const& sle = env.le(keylet::signers(alice.id()));
+        auto const& sle = env.le(keylet::signerList(alice.id()));
         BEAST_EXPECT(sle);
         BEAST_EXPECT(sle->getFieldArray(sfSignerEntries).size() == 2);
         if (features[fixIncludeKeyletFields])
diff --git a/src/test/app/NFTokenAuth_test.cpp b/src/test/app/NFTokenAuth_test.cpp
index 4929cadd65..66716a13b7 100644
--- a/src/test/app/NFTokenAuth_test.cpp
+++ b/src/test/app/NFTokenAuth_test.cpp
@@ -43,7 +43,7 @@ class NFTokenAuth_test : public beast::unit_test::Suite
         env(token::mint(account, 0), token::XferFee(xfee), Txflags(tfTransferable));
         env.close();
 
-        auto const sellIdx = keylet::nftoffer(account, env.seq(account)).key;
+        auto const sellIdx = keylet::nftokenOffer(account, env.seq(account)).key;
         env(token::createOffer(account, nftID, currency), Txflags(tfSellNFToken));
         env.close();
 
@@ -74,7 +74,7 @@ public:
         env(pay(g1, a1, usd(1000)));
 
         auto const [nftID, _] = mintAndOfferNFT(env, a2, drops(1));
-        auto const buyIdx = keylet::nftoffer(a1, env.seq(a1)).key;
+        auto const buyIdx = keylet::nftokenOffer(a1, env.seq(a1)).key;
 
         // It should be possible to create a buy offer even if NFT owner is not
         // authorized
@@ -130,7 +130,7 @@ public:
         // close ledger before running the actual tests against this trustline.
         // After ledger is closed, the trustline will not exist.
         auto const unauthTrustline = [&](OpenView& view, beast::Journal) -> bool {
-            auto const sleA1 = std::make_shared<SLE>(keylet::line(a1, g1, g1["USD"].currency));
+            auto const sleA1 = std::make_shared<SLE>(keylet::trustLine(a1, g1, g1["USD"].currency));
             sleA1->setFieldAmount(sfBalance, a1["USD"](-1000));
             view.rawInsert(sleA1);
             return true;
@@ -179,7 +179,7 @@ public:
         env(pay(g1, a2, usd(10)));
         env.close();
 
-        auto const buyIdx = keylet::nftoffer(a1, env.seq(a1)).key;
+        auto const buyIdx = keylet::nftokenOffer(a1, env.seq(a1)).key;
         env(token::createOffer(a1, nftID, usd(10)), token::Owner(a2));
         env.close();
 
@@ -193,7 +193,7 @@ public:
         // tests against this trustline. After ledger is closed, the trustline
         // will not exist.
         auto const unauthTrustline = [&](OpenView& view, beast::Journal) -> bool {
-            auto const sleA1 = std::make_shared<SLE>(keylet::line(a1, g1, g1["USD"].currency));
+            auto const sleA1 = std::make_shared<SLE>(keylet::trustLine(a1, g1, g1["USD"].currency));
             sleA1->setFieldAmount(sfBalance, a1["USD"](-1000));
             view.rawInsert(sleA1);
             return true;
@@ -244,7 +244,7 @@ public:
             // Authorizing trustline to make an offer creation possible
             env(trust(g1, usd(0), a2, tfSetfAuth));
             env.close();
-            auto const sellIdx = keylet::nftoffer(a2, env.seq(a2)).key;
+            auto const sellIdx = keylet::nftokenOffer(a2, env.seq(a2)).key;
             env(token::createOffer(a2, nftID, usd(10)), Txflags(tfSellNFToken));
             env.close();
             //
@@ -268,7 +268,7 @@ public:
         }
         else
         {
-            auto const sellIdx = keylet::nftoffer(a2, env.seq(a2)).key;
+            auto const sellIdx = keylet::nftokenOffer(a2, env.seq(a2)).key;
 
             // Old behavior: sell offer can be created without authorization
             env(token::createOffer(a2, nftID, usd(10)), Txflags(tfSellNFToken));
@@ -313,7 +313,7 @@ public:
 
         // Creating an artificial unauth trustline
         auto const unauthTrustline = [&](OpenView& view, beast::Journal) -> bool {
-            auto const sleA1 = std::make_shared<SLE>(keylet::line(a1, g1, g1["USD"].currency));
+            auto const sleA1 = std::make_shared<SLE>(keylet::trustLine(a1, g1, g1["USD"].currency));
             sleA1->setFieldAmount(sfBalance, a1["USD"](-1000));
             view.rawInsert(sleA1);
             return true;
@@ -353,7 +353,7 @@ public:
         env.close();
 
         auto const [nftID, sellIdx] = mintAndOfferNFT(env, a2, usd(10));
-        auto const buyIdx = keylet::nftoffer(a1, env.seq(a1)).key;
+        auto const buyIdx = keylet::nftokenOffer(a1, env.seq(a1)).key;
         env(token::createOffer(a1, nftID, usd(11)), token::Owner(a2));
         env.close();
 
@@ -422,7 +422,7 @@ public:
         env.close();
 
         auto const [nftID, sellIdx] = mintAndOfferNFT(env, a2, usd(10));
-        auto const buyIdx = keylet::nftoffer(a1, env.seq(a1)).key;
+        auto const buyIdx = keylet::nftokenOffer(a1, env.seq(a1)).key;
         env(token::createOffer(a1, nftID, usd(11)), token::Owner(a2));
         env.close();
 
@@ -432,7 +432,7 @@ public:
         env.close();
 
         auto const unauthTrustline = [&](OpenView& view, beast::Journal) -> bool {
-            auto const sleA1 = std::make_shared<SLE>(keylet::line(a1, g1, g1["USD"].currency));
+            auto const sleA1 = std::make_shared<SLE>(keylet::trustLine(a1, g1, g1["USD"].currency));
             sleA1->setFieldAmount(sfBalance, a1["USD"](-1000));
             view.rawInsert(sleA1);
             return true;
@@ -483,7 +483,7 @@ public:
         env.close();
 
         auto const [nftID, sellIdx] = mintAndOfferNFT(env, a2, usd(10));
-        auto const buyIdx = keylet::nftoffer(a1, env.seq(a1)).key;
+        auto const buyIdx = keylet::nftokenOffer(a1, env.seq(a1)).key;
         env(token::createOffer(a1, nftID, usd(11)), token::Owner(a2));
         env.close();
 
@@ -559,7 +559,7 @@ public:
         auto const [nftID, minterSellIdx] = mintAndOfferNFT(env, minter, drops(1), 1);
         env(token::acceptSellOffer(a1, minterSellIdx));
 
-        uint256 const sellIdx = keylet::nftoffer(a1, env.seq(a1)).key;
+        uint256 const sellIdx = keylet::nftokenOffer(a1, env.seq(a1)).key;
         env(token::createOffer(a1, nftID, usd(100)), Txflags(tfSellNFToken));
 
         if (features[fixEnforceNFTokenTrustlineV2])
diff --git a/src/test/app/NFTokenBurn_test.cpp b/src/test/app/NFTokenBurn_test.cpp
index 46b02d03cf..00667dc5ac 100644
--- a/src/test/app/NFTokenBurn_test.cpp
+++ b/src/test/app/NFTokenBurn_test.cpp
@@ -76,7 +76,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
         for (uint32_t i = 0; i < tokenCancelCount; ++i)
         {
             // Create sell offer
-            offerIndexes.push_back(keylet::nftoffer(owner, env.seq(owner)).key);
+            offerIndexes.push_back(keylet::nftokenOffer(owner, env.seq(owner)).key);
             env(token::createOffer(owner, nftokenID, drops(1)), Txflags(tfSellNFToken));
             env.close();
         }
@@ -235,7 +235,8 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             {
                 // We do the same work on alice and minter, so make a lambda.
                 auto xferNFT = [&env, &becky](AcctStat& acct, auto& iter) {
-                    uint256 const offerIndex = keylet::nftoffer(acct.acct, env.seq(acct.acct)).key;
+                    uint256 const offerIndex =
+                        keylet::nftokenOffer(acct.acct, env.seq(acct.acct)).key;
                     env(token::createOffer(acct, *iter, XRP(0)), Txflags(tfSellNFToken));
                     env.close();
                     env(token::acceptSellOffer(becky, offerIndex));
@@ -472,19 +473,19 @@ class NFTokenBurn_test : public beast::unit_test::Suite
 
             // Verify that that all three pages are present and remember the
             // indexes.
-            auto lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+            auto lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
             if (!BEAST_EXPECT(lastNFTokenPage))
                 return;
 
             uint256 const middleNFTokenPageIndex = lastNFTokenPage->at(sfPreviousPageMin);
             auto middleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
             if (!BEAST_EXPECT(middleNFTokenPage))
                 return;
 
             uint256 const firstNFTokenPageIndex = middleNFTokenPage->at(sfPreviousPageMin);
             auto firstNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), firstNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), firstNFTokenPageIndex));
             if (!BEAST_EXPECT(firstNFTokenPage))
                 return;
 
@@ -498,7 +499,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
 
             // Verify that the last page is still present and contains just one
             // NFT.
-            lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+            lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
             if (!BEAST_EXPECT(lastNFTokenPage))
                 return;
 
@@ -517,21 +518,21 @@ class NFTokenBurn_test : public beast::unit_test::Suite
                 // _previous_ page because we need to preserve that last
                 // page as an anchor.  The contents of the next-to-last page
                 // are moved into the last page.
-                lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+                lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
                 BEAST_EXPECT(lastNFTokenPage);
                 BEAST_EXPECT(lastNFTokenPage->at(~sfPreviousPageMin) == firstNFTokenPageIndex);
                 BEAST_EXPECT(!lastNFTokenPage->isFieldPresent(sfNextPageMin));
                 BEAST_EXPECT(lastNFTokenPage->getFieldArray(sfNFTokens).size() == 32);
 
                 // The "middle" page should be gone.
-                middleNFTokenPage =
-                    env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                middleNFTokenPage = env.le(
+                    keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
                 BEAST_EXPECT(!middleNFTokenPage);
 
                 // The "first" page should still be present and linked to
                 // the last page.
-                firstNFTokenPage =
-                    env.le(keylet::nftpage(keylet::nftpageMin(alice), firstNFTokenPageIndex));
+                firstNFTokenPage = env.le(
+                    keylet::nftokenPage(keylet::nftokenPageMin(alice), firstNFTokenPageIndex));
                 BEAST_EXPECT(firstNFTokenPage);
                 BEAST_EXPECT(!firstNFTokenPage->isFieldPresent(sfPreviousPageMin));
                 BEAST_EXPECT(firstNFTokenPage->at(~sfNextPageMin) == lastNFTokenPage->key());
@@ -542,13 +543,13 @@ class NFTokenBurn_test : public beast::unit_test::Suite
                 // Removing the last token from the last page deletes the last
                 // page.  This is a bug.  The contents of the next-to-last page
                 // should have been moved into the last page.
-                lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+                lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
                 BEAST_EXPECT(!lastNFTokenPage);
 
                 // The "middle" page is still present, but has lost the
                 // NextPageMin field.
-                middleNFTokenPage =
-                    env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                middleNFTokenPage = env.le(
+                    keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
                 if (!BEAST_EXPECT(middleNFTokenPage))
                     return;
                 BEAST_EXPECT(middleNFTokenPage->isFieldPresent(sfPreviousPageMin));
@@ -576,19 +577,19 @@ class NFTokenBurn_test : public beast::unit_test::Suite
 
             // Verify that that all three pages are present and remember the
             // indexes.
-            auto lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+            auto lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
             if (!BEAST_EXPECT(lastNFTokenPage))
                 return;
 
             uint256 const middleNFTokenPageIndex = lastNFTokenPage->at(sfPreviousPageMin);
             auto middleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
             if (!BEAST_EXPECT(middleNFTokenPage))
                 return;
 
             uint256 const firstNFTokenPageIndex = middleNFTokenPage->at(sfPreviousPageMin);
             auto firstNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), firstNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), firstNFTokenPageIndex));
             if (!BEAST_EXPECT(firstNFTokenPage))
                 return;
 
@@ -604,17 +605,17 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             // Verify that middle page is gone and the links in the two
             // remaining pages are correct.
             middleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
             BEAST_EXPECT(!middleNFTokenPage);
 
-            lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+            lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
             BEAST_EXPECT(!lastNFTokenPage->isFieldPresent(sfNextPageMin));
             BEAST_EXPECT(lastNFTokenPage->getFieldH256(sfPreviousPageMin) == firstNFTokenPageIndex);
 
             firstNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), firstNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), firstNFTokenPageIndex));
             BEAST_EXPECT(
-                firstNFTokenPage->getFieldH256(sfNextPageMin) == keylet::nftpageMax(alice).key);
+                firstNFTokenPage->getFieldH256(sfNextPageMin) == keylet::nftokenPageMax(alice).key);
             BEAST_EXPECT(!firstNFTokenPage->isFieldPresent(sfPreviousPageMin));
 
             // Burn the remaining nfts.
@@ -637,19 +638,19 @@ class NFTokenBurn_test : public beast::unit_test::Suite
 
             // Verify that that all three pages are present and remember the
             // indexes.
-            auto lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+            auto lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
             if (!BEAST_EXPECT(lastNFTokenPage))
                 return;
 
             uint256 const middleNFTokenPageIndex = lastNFTokenPage->at(sfPreviousPageMin);
             auto middleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
             if (!BEAST_EXPECT(middleNFTokenPage))
                 return;
 
             uint256 const firstNFTokenPageIndex = middleNFTokenPage->at(sfPreviousPageMin);
             auto firstNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), firstNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), firstNFTokenPageIndex));
             if (!BEAST_EXPECT(firstNFTokenPage))
                 return;
 
@@ -664,18 +665,18 @@ class NFTokenBurn_test : public beast::unit_test::Suite
 
             // Verify the first page is gone.
             firstNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), firstNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), firstNFTokenPageIndex));
             BEAST_EXPECT(!firstNFTokenPage);
 
             // Check the links in the other two pages.
             middleNFTokenPage =
-                env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
             if (!BEAST_EXPECT(middleNFTokenPage))
                 return;
             BEAST_EXPECT(!middleNFTokenPage->isFieldPresent(sfPreviousPageMin));
             BEAST_EXPECT(middleNFTokenPage->isFieldPresent(sfNextPageMin));
 
-            lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+            lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
             if (!BEAST_EXPECT(lastNFTokenPage))
                 return;
             BEAST_EXPECT(lastNFTokenPage->isFieldPresent(sfPreviousPageMin));
@@ -696,20 +697,20 @@ class NFTokenBurn_test : public beast::unit_test::Suite
                 // _previous_ page because we need to preserve that last
                 // page as an anchor.  The contents of the next-to-last page
                 // are moved into the last page.
-                lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+                lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
                 BEAST_EXPECT(lastNFTokenPage);
                 BEAST_EXPECT(!lastNFTokenPage->isFieldPresent(sfPreviousPageMin));
                 BEAST_EXPECT(!lastNFTokenPage->isFieldPresent(sfNextPageMin));
                 BEAST_EXPECT(lastNFTokenPage->getFieldArray(sfNFTokens).size() == 32);
 
                 // The "middle" page should be gone.
-                middleNFTokenPage =
-                    env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                middleNFTokenPage = env.le(
+                    keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
                 BEAST_EXPECT(!middleNFTokenPage);
 
                 // The "first" page should still be gone.
-                firstNFTokenPage =
-                    env.le(keylet::nftpage(keylet::nftpageMin(alice), firstNFTokenPageIndex));
+                firstNFTokenPage = env.le(
+                    keylet::nftokenPage(keylet::nftokenPageMin(alice), firstNFTokenPageIndex));
                 BEAST_EXPECT(!firstNFTokenPage);
             }
             else
@@ -717,13 +718,13 @@ class NFTokenBurn_test : public beast::unit_test::Suite
                 // Removing the last token from the last page deletes the last
                 // page.  This is a bug.  The contents of the next-to-last page
                 // should have been moved into the last page.
-                lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+                lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
                 BEAST_EXPECT(!lastNFTokenPage);
 
                 // The "middle" page is still present, but has lost the
                 // NextPageMin field.
-                middleNFTokenPage =
-                    env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+                middleNFTokenPage = env.le(
+                    keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
                 if (!BEAST_EXPECT(middleNFTokenPage))
                     return;
                 BEAST_EXPECT(!middleNFTokenPage->isFieldPresent(sfPreviousPageMin));
@@ -777,7 +778,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
                     env.app(), ov, tx, tesSUCCESS, env.current()->fees().base, TapNone, jlog};
 
                 // Verify that the last page is present and contains one NFT.
-                auto lastNFTokenPage = ac.view().peek(keylet::nftpageMax(alice));
+                auto lastNFTokenPage = ac.view().peek(keylet::nftokenPageMax(alice));
                 if (!BEAST_EXPECT(lastNFTokenPage))
                     return;
                 BEAST_EXPECT(lastNFTokenPage->getFieldArray(sfNFTokens).size() == 1);
@@ -809,10 +810,10 @@ class NFTokenBurn_test : public beast::unit_test::Suite
                     env.app(), ov, tx, tesSUCCESS, env.current()->fees().base, TapNone, jlog};
 
                 // Verify that the middle  page is present.
-                auto lastNFTokenPage = ac.view().peek(keylet::nftpageMax(alice));
+                auto lastNFTokenPage = ac.view().peek(keylet::nftokenPageMax(alice));
                 auto middleNFTokenPage = ac.view().peek(
-                    keylet::nftpage(
-                        keylet::nftpageMin(alice),
+                    keylet::nftokenPage(
+                        keylet::nftokenPageMin(alice),
                         lastNFTokenPage->getFieldH256(sfPreviousPageMin)));
                 BEAST_EXPECT(middleNFTokenPage);
 
@@ -865,11 +866,11 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             // Verify all sell offers are present in the ledger.
             for (uint256 const& offerIndex : offerIndexes)
             {
-                BEAST_EXPECT(env.le(keylet::nftoffer(offerIndex)));
+                BEAST_EXPECT(env.le(keylet::nftokenOffer(offerIndex)));
             }
 
             // Becky creates a buy offer
-            uint256 const beckyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftokenID, drops(1)), token::Owner(alice));
             env.close();
 
@@ -881,12 +882,12 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             // that alice created
             for (uint256 const& offerIndex : offerIndexes)
             {
-                BEAST_EXPECT(!env.le(keylet::nftoffer(offerIndex)));
+                BEAST_EXPECT(!env.le(keylet::nftokenOffer(offerIndex)));
             }
 
             // Burning the token should also remove the one buy offer
             // that becky created
-            BEAST_EXPECT(!env.le(keylet::nftoffer(beckyOfferIndex)));
+            BEAST_EXPECT(!env.le(keylet::nftokenOffer(beckyOfferIndex)));
 
             // alice and becky should have ownerCounts of zero
             BEAST_EXPECT(ownerCount(env, alice) == 0);
@@ -912,7 +913,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             // Verify all sell offers are present in the ledger.
             for (uint256 const& offerIndex : offerIndexes)
             {
-                BEAST_EXPECT(env.le(keylet::nftoffer(offerIndex)));
+                BEAST_EXPECT(env.le(keylet::nftokenOffer(offerIndex)));
             }
 
             // Burn the token
@@ -923,7 +924,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             // Count the number of sell offers that have been deleted
             for (uint256 const& offerIndex : offerIndexes)
             {
-                if (!env.le(keylet::nftoffer(offerIndex)))
+                if (!env.le(keylet::nftokenOffer(offerIndex)))
                     offerDeletedCount++;
             }
 
@@ -956,7 +957,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             // Verify all sell offers are present in the ledger.
             for (uint256 const& offerIndex : offerIndexes)
             {
-                BEAST_EXPECT(env.le(keylet::nftoffer(offerIndex)));
+                BEAST_EXPECT(env.le(keylet::nftokenOffer(offerIndex)));
             }
 
             // becky creates 2 buy offers
@@ -973,7 +974,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             // ledger.
             for (uint256 const& offerIndex : offerIndexes)
             {
-                BEAST_EXPECT(!env.le(keylet::nftoffer(offerIndex)));
+                BEAST_EXPECT(!env.le(keylet::nftokenOffer(offerIndex)));
             }
 
             // alice should have ownerCount of zero because all her
@@ -1044,7 +1045,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
                 env.close();
 
                 // Minter creates an offer for the NFToken.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nfts.back(), XRP(0)), Txflags(tfSellNFToken));
                 env.close();
 
@@ -1091,19 +1092,19 @@ class NFTokenBurn_test : public beast::unit_test::Suite
 
         // Verify that that all three pages are present and remember the
         // indexes.
-        auto lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+        auto lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
         if (!BEAST_EXPECT(lastNFTokenPage))
             return;
 
         uint256 const middleNFTokenPageIndex = lastNFTokenPage->at(sfPreviousPageMin);
         auto middleNFTokenPage =
-            env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+            env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
         if (!BEAST_EXPECT(middleNFTokenPage))
             return;
 
         uint256 const firstNFTokenPageIndex = middleNFTokenPage->at(sfPreviousPageMin);
         auto firstNFTokenPage =
-            env.le(keylet::nftpage(keylet::nftpageMin(alice), firstNFTokenPageIndex));
+            env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), firstNFTokenPageIndex));
         if (!BEAST_EXPECT(firstNFTokenPage))
             return;
 
@@ -1115,7 +1116,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
             nfts.pop_back();
 
             // alice creates an offer for the NFToken.
-            uint256 const aliceOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, last32NFTs.back(), XRP(0)), Txflags(tfSellNFToken));
             env.close();
 
@@ -1127,14 +1128,14 @@ class NFTokenBurn_test : public beast::unit_test::Suite
         // Removing the last token from the last page deletes alice's last
         // page.  This is a bug.  The contents of the next-to-last page
         // should have been moved into the last page.
-        lastNFTokenPage = env.le(keylet::nftpageMax(alice));
+        lastNFTokenPage = env.le(keylet::nftokenPageMax(alice));
         BEAST_EXPECT(!lastNFTokenPage);
         BEAST_EXPECT(ownerCount(env, alice) == 2);
 
         // The "middle" page is still present, but has lost the
         // NextPageMin field.
         middleNFTokenPage =
-            env.le(keylet::nftpage(keylet::nftpageMin(alice), middleNFTokenPageIndex));
+            env.le(keylet::nftokenPage(keylet::nftokenPageMin(alice), middleNFTokenPageIndex));
         if (!BEAST_EXPECT(middleNFTokenPage))
             return;
         BEAST_EXPECT(middleNFTokenPage->isFieldPresent(sfPreviousPageMin));
@@ -1149,7 +1150,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
         for (uint256 const nftID : last32NFTs)
         {
             // minter creates an offer for the NFToken.
-            uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, XRP(0)), Txflags(tfSellNFToken));
             env.close();
 
diff --git a/src/test/app/NFTokenDir_test.cpp b/src/test/app/NFTokenDir_test.cpp
index e24a524b81..19bf58f247 100644
--- a/src/test/app/NFTokenDir_test.cpp
+++ b/src/test/app/NFTokenDir_test.cpp
@@ -142,7 +142,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
         std::vector<uint256> offers;
         for (uint256 const& nftID : nftIDs)
         {
-            offers.emplace_back(keylet::nftoffer(issuer, env.seq(issuer)).key);
+            offers.emplace_back(keylet::nftokenOffer(issuer, env.seq(issuer)).key);
             env(token::createOffer(issuer, nftID, XRP(0)), Txflags(tfSellNFToken));
             env.close();
         }
@@ -214,7 +214,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
                 env.close();
 
                 // Create an offer to give the NFT to buyer for free.
-                offers.emplace_back(keylet::nftoffer(account, env.seq(account)).key);
+                offers.emplace_back(keylet::nftokenOffer(account, env.seq(account)).key);
                 env(token::createOffer(account, nftID, XRP(0)),
                     token::Destination(buyer),
                     Txflags(tfSellNFToken));
@@ -237,7 +237,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
             // generates a non-tesSUCCESS error code.
             for (uint256 const& nftID : nftIDs)
             {
-                uint256 const offerID = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const offerID = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, XRP(100)), Txflags(tfSellNFToken));
                 env.close();
 
@@ -418,7 +418,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
                 env.close();
 
                 // Create an offer to give the NFT to buyer for free.
-                offers.emplace_back(keylet::nftoffer(account, env.seq(account)).key);
+                offers.emplace_back(keylet::nftokenOffer(account, env.seq(account)).key);
                 env(token::createOffer(account, nftID, XRP(0)),
                     token::Destination(buyer),
                     Txflags(tfSellNFToken));
@@ -445,7 +445,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
             // generates a non-tesSUCCESS error code.
             for (uint256 const& nftID : nftIDs)
             {
-                uint256 const offerID = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const offerID = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, XRP(100)), Txflags(tfSellNFToken));
                 env.close();
 
@@ -648,7 +648,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
             env.close();
 
             // Create an offer to give the NFT to buyer for free.
-            offers.emplace_back(keylet::nftoffer(account, env.seq(account)).key);
+            offers.emplace_back(keylet::nftokenOffer(account, env.seq(account)).key);
             env(token::createOffer(account, nftID, XRP(0)),
                 token::Destination(buyer),
                 Txflags(tfSellNFToken));
@@ -684,7 +684,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
         // a non-tesSUCCESS error code.
         for (uint256 const& nftID : nftIDs)
         {
-            uint256 const offerID = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerID = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftID, XRP(100)), Txflags(tfSellNFToken));
             env.close();
 
@@ -820,7 +820,7 @@ class NFTokenDir_test : public beast::unit_test::Suite
                 env.close();
 
                 // Create an offer to give the NFT to buyer for free.
-                offers[i].emplace_back(keylet::nftoffer(account, env.seq(account)).key);
+                offers[i].emplace_back(keylet::nftokenOffer(account, env.seq(account)).key);
                 env(token::createOffer(account, nftID, XRP(0)),
                     token::Destination(buyer),
                     Txflags(tfSellNFToken));
diff --git a/src/test/app/NFToken_test.cpp b/src/test/app/NFToken_test.cpp
index cb92b23a4c..ef7c385acb 100644
--- a/src/test/app/NFToken_test.cpp
+++ b/src/test/app/NFToken_test.cpp
@@ -143,7 +143,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             Account const alice{"alice"};
             env.fund(XRP(10000), alice);
             env.close();
-            uint256 const aliceOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId1, XRP(1000)), token::Owner(master));
             env.close();
 
@@ -861,7 +861,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         BEAST_EXPECT(ownerCount(env, alice) == 1);
 
         // This is the offer we'll try to cancel.
-        uint256 const buyerOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+        uint256 const buyerOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
         env(token::createOffer(buyer, nftAlice0ID, XRP(1)), token::Owner(alice), Ter(tesSUCCESS));
         env.close();
         BEAST_EXPECT(ownerCount(env, buyer) == 1);
@@ -904,7 +904,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // List of offer IDs containing zero is invalid.
             // craftedIndex is not a valid offer index but it is not zero.
-            auto const craftedIndex = keylet::nftoffer(gw, env.seq(gw)).key;
+            auto const craftedIndex = keylet::nftokenOffer(gw, env.seq(gw)).key;
             env(token::cancelOffer(buyer, {buyerOfferIndex, uint256{}, craftedIndex}),
                 Ter(temMALFORMED));
             env.close();
@@ -1006,32 +1006,32 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         BEAST_EXPECT(ownerCount(env, alice) == aliceCount);
 
         // alice creates sell offers for her nfts.
-        uint256 const plainOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const plainOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
         env(token::createOffer(alice, nftAlice0ID, XRP(10)), Txflags(tfSellNFToken));
         env.close();
         aliceCount++;
         BEAST_EXPECT(ownerCount(env, alice) == aliceCount);
 
-        uint256 const audOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const audOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
         env(token::createOffer(alice, nftAlice0ID, gwAUD(30)), Txflags(tfSellNFToken));
         env.close();
         aliceCount++;
         BEAST_EXPECT(ownerCount(env, alice) == aliceCount);
 
-        uint256 const xrpOnlyOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const xrpOnlyOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
         env(token::createOffer(alice, nftXrpOnlyID, XRP(20)), Txflags(tfSellNFToken));
         env.close();
         aliceCount++;
         BEAST_EXPECT(ownerCount(env, alice) == aliceCount);
 
-        uint256 const noXferOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const noXferOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
         env(token::createOffer(alice, nftNoXferID, XRP(30)), Txflags(tfSellNFToken));
         env.close();
         aliceCount++;
         BEAST_EXPECT(ownerCount(env, alice) == aliceCount);
 
         // alice creates a sell offer that will expire soon.
-        uint256 const aliceExpOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const aliceExpOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
         env(token::createOffer(alice, nftNoXferID, XRP(40)),
             Txflags(tfSellNFToken),
             token::Expiration(lastClose(env) + 5));
@@ -1040,7 +1040,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         BEAST_EXPECT(ownerCount(env, alice) == aliceCount);
 
         // buyer creates a Buy offer that will expire soon.
-        uint256 const buyerExpOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+        uint256 const buyerExpOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
         env(token::createOffer(buyer, nftAlice0ID, XRP(40)),
             token::Owner(alice),
             token::Expiration(lastClose(env) + 5));
@@ -1108,7 +1108,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         BEAST_EXPECT(ownerCount(env, buyer) == buyerCount);
 
         // The buy offer must be present in the ledger.
-        uint256 const missingOfferIndex = keylet::nftoffer(alice, 1).key;
+        uint256 const missingOfferIndex = keylet::nftokenOffer(alice, 1).key;
         env(token::acceptBuyOffer(buyer, missingOfferIndex), Ter(tecOBJECT_NOT_FOUND));
         env.close();
         BEAST_EXPECT(ownerCount(env, buyer) == buyerCount);
@@ -1120,7 +1120,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         if (features[fixCleanup3_1_3])
         {
             buyerCount--;
-            BEAST_EXPECT(!env.closed()->exists(keylet::nftoffer(buyerExpOfferIndex)));
+            BEAST_EXPECT(!env.closed()->exists(keylet::nftokenOffer(buyerExpOfferIndex)));
         }
         BEAST_EXPECT(ownerCount(env, buyer) == buyerCount);
 
@@ -1144,7 +1144,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         if (features[fixCleanup3_1_3])
         {
             aliceCount--;
-            BEAST_EXPECT(!env.closed()->exists(keylet::nftoffer(aliceExpOfferIndex)));
+            BEAST_EXPECT(!env.closed()->exists(keylet::nftokenOffer(aliceExpOfferIndex)));
         }
         BEAST_EXPECT(ownerCount(env, alice) == aliceCount);
         BEAST_EXPECT(ownerCount(env, buyer) == buyerCount);
@@ -1171,7 +1171,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // corresponding buy and sell offers.
         {
             // buyer creates a buy offer for one of alice's nfts.
-            uint256 const buyerOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyerOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftAlice0ID, gwAUD(29)), token::Owner(alice));
             env.close();
             buyerCount++;
@@ -1204,7 +1204,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         }
         {
             // buyer creates a buy offer for one of alice's nfts.
-            uint256 const buyerOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyerOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftAlice0ID, gwAUD(31)), token::Owner(alice));
             env.close();
             buyerCount++;
@@ -1243,7 +1243,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // preclaim buy
         {
             // buyer creates a buy offer for one of alice's nfts.
-            uint256 const buyerOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyerOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftAlice0ID, gwAUD(30)), token::Owner(alice));
             env.close();
             buyerCount++;
@@ -1270,7 +1270,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // alice gives her NFT to gw, so alice no longer owns nftAlice0.
             {
-                uint256 const offerIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+                uint256 const offerIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
                 env(token::createOffer(alice, nftAlice0ID, XRP(0)), Txflags(tfSellNFToken));
                 env.close();
                 env(token::acceptSellOffer(gw, offerIndex));
@@ -1295,7 +1295,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // preclaim sell
         {
             // buyer creates a buy offer for one of alice's nfts.
-            uint256 const buyerOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyerOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftXrpOnlyID, XRP(30)), token::Owner(alice));
             env.close();
             buyerCount++;
@@ -1323,7 +1323,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             // buyer attempting to accept one of alice's offers with
             // insufficient funds.
             {
-                uint256 const offerIndex = keylet::nftoffer(gw, env.seq(gw)).key;
+                uint256 const offerIndex = keylet::nftokenOffer(gw, env.seq(gw)).key;
                 env(token::createOffer(gw, nftAlice0ID, XRP(0)), Txflags(tfSellNFToken));
                 env.close();
                 env(token::acceptSellOffer(alice, offerIndex));
@@ -1376,7 +1376,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env(token::mint(minter1, 0u), token::Issuer(alice), Txflags(flags));
             env.close();
 
-            uint256 const offerIndex = keylet::nftoffer(minter1, env.seq(minter1)).key;
+            uint256 const offerIndex = keylet::nftokenOffer(minter1, env.seq(minter1)).key;
             env(token::createOffer(minter1, nftID, XRP(0)), Txflags(tfSellNFToken));
             env.close();
 
@@ -1479,13 +1479,13 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.close();
 
             BEAST_EXPECT(ownerCount(env, alice) == 2);
-            uint256 const aliceOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftIOUsOkayID, gwAUD(50)), Txflags(tfSellNFToken));
             env.close();
             BEAST_EXPECT(ownerCount(env, alice) == 3);
 
             BEAST_EXPECT(ownerCount(env, buyer) == 1);
-            uint256 const buyerOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyerOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftIOUsOkayID, gwAUD(50)), token::Owner(alice));
             env.close();
             BEAST_EXPECT(ownerCount(env, buyer) == 2);
@@ -1588,7 +1588,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 env.close();
 
                 // becky buys the nft for 1 drop.
-                uint256 const beckyBuyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+                uint256 const beckyBuyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
                 env(token::createOffer(becky, nftNoAutoTrustID, drops(1)), token::Owner(alice));
                 env.close();
                 env(token::acceptBuyOffer(alice, beckyBuyOfferIndex));
@@ -1596,14 +1596,14 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
                 // becky attempts to sell the nft for AUD.
                 TER const createOfferTER = (xferFee != 0u) ? TER(tecNO_LINE) : TER(tesSUCCESS);
-                uint256 const beckyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+                uint256 const beckyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
                 env(token::createOffer(becky, nftNoAutoTrustID, gwAUD(100)),
                     Txflags(tfSellNFToken),
                     Ter(createOfferTER));
                 env.close();
 
                 // cheri offers to buy the nft for CAD.
-                uint256 const cheriOfferIndex = keylet::nftoffer(cheri, env.seq(cheri)).key;
+                uint256 const cheriOfferIndex = keylet::nftokenOffer(cheri, env.seq(cheri)).key;
                 env(token::createOffer(cheri, nftNoAutoTrustID, gwCAD(100)),
                     token::Owner(becky),
                     Ter(createOfferTER));
@@ -1641,14 +1641,14 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                         break;
                 }
                 // becky buys the nft for 1 drop.
-                uint256 const beckyBuyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+                uint256 const beckyBuyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
                 env(token::createOffer(becky, nftAutoTrustID, drops(1)), token::Owner(alice));
                 env.close();
                 env(token::acceptBuyOffer(alice, beckyBuyOfferIndex));
                 env.close();
 
                 // becky sells the nft for AUD.
-                uint256 const beckySellOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+                uint256 const beckySellOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
                 env(token::createOffer(becky, nftAutoTrustID, gwAUD(100)), Txflags(tfSellNFToken));
                 env.close();
                 env(token::acceptSellOffer(cheri, beckySellOfferIndex));
@@ -1658,7 +1658,8 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 BEAST_EXPECT(env.balance(alice, gwAUD) == gwAUD(10));
 
                 // becky buys the nft back for CAD.
-                uint256 const beckyBuyBackOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+                uint256 const beckyBuyBackOfferIndex =
+                    keylet::nftokenOffer(becky, env.seq(becky)).key;
                 env(token::createOffer(becky, nftAutoTrustID, gwCAD(50)), token::Owner(cheri));
                 env.close();
                 env(token::acceptBuyOffer(cheri, beckyBuyBackOfferIndex));
@@ -1678,7 +1679,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 env.close();
 
                 // alice sells the nft using AUD.
-                uint256 const aliceSellOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+                uint256 const aliceSellOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
                 env(token::createOffer(alice, nftNoAutoTrustID, gwAUD(200)),
                     Txflags(tfSellNFToken));
                 env.close();
@@ -1695,7 +1696,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                     Txflags(tfSellNFToken),
                     Ter(tecNO_LINE));
                 env.close();
-                uint256 const cheriSellOfferIndex = keylet::nftoffer(cheri, env.seq(cheri)).key;
+                uint256 const cheriSellOfferIndex = keylet::nftokenOffer(cheri, env.seq(cheri)).key;
                 env(token::createOffer(cheri, nftNoAutoTrustID, gwCAD(100)),
                     Txflags(tfSellNFToken));
                 env.close();
@@ -1742,7 +1743,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 Ter(tefNFTOKEN_IS_NOT_TRANSFERABLE));
 
             // alice offers to sell the nft and becky accepts the offer.
-            uint256 const aliceSellOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceSellOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftAliceNoTransferID, XRP(20)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(becky, aliceSellOfferIndex));
@@ -1770,7 +1771,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // alice offers to buy the nft back from becky.  becky accepts
             // the offer.
-            uint256 const aliceBuyOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceBuyOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftAliceNoTransferID, XRP(22)), token::Owner(becky));
             env.close();
             env(token::acceptBuyOffer(becky, aliceBuyOfferIndex));
@@ -1826,7 +1827,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // minter successfully offers their nft for sale.
             BEAST_EXPECT(ownerCount(env, minter) == 1);
-            uint256 const minterSellOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterSellOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftMinterNoTransferID, XRP(22)), Txflags(tfSellNFToken));
             env.close();
             BEAST_EXPECT(ownerCount(env, minter) == 2);
@@ -1861,7 +1862,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // alice can create an offer to buy the nft.
             BEAST_EXPECT(ownerCount(env, alice) == 0);
-            uint256 const aliceBuyOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceBuyOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftMinterNoTransferID, XRP(25)), token::Owner(becky));
             env.close();
             BEAST_EXPECT(ownerCount(env, alice) == 1);
@@ -1876,7 +1877,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // Now minter can create an offer to buy the nft.
             BEAST_EXPECT(ownerCount(env, minter) == 0);
-            uint256 const minterBuyOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterBuyOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftMinterNoTransferID, XRP(26)), token::Owner(becky));
             env.close();
             BEAST_EXPECT(ownerCount(env, minter) == 1);
@@ -1915,12 +1916,12 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(ownerCount(env, alice) == 1);
 
             // Both alice and becky can make offers for alice's nft.
-            uint256 const aliceSellOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceSellOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftAliceID, XRP(20)), Txflags(tfSellNFToken));
             env.close();
             BEAST_EXPECT(ownerCount(env, alice) == 2);
 
-            uint256 const beckyBuyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyBuyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftAliceID, XRP(21)), token::Owner(alice));
             env.close();
             BEAST_EXPECT(ownerCount(env, alice) == 2);
@@ -1932,7 +1933,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(ownerCount(env, becky) == 2);
 
             // becky offers to sell the nft.
-            uint256 const beckySellOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckySellOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftAliceID, XRP(22)), Txflags(tfSellNFToken));
             env.close();
             BEAST_EXPECT(ownerCount(env, alice) == 0);
@@ -1947,7 +1948,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(ownerCount(env, minter) == 1);
 
             // minter offers to sell the nft.
-            uint256 const minterSellOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterSellOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftAliceID, XRP(23)), Txflags(tfSellNFToken));
             env.close();
             BEAST_EXPECT(ownerCount(env, alice) == 0);
@@ -2029,7 +2030,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.close();
 
             // Becky buys the nft for XAU(10).  Check balances.
-            uint256 const beckyBuyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyBuyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftID, gwXAU(10)), token::Owner(alice));
             env.close();
             BEAST_EXPECT(env.balance(alice, gwXAU) == gwXAU(1000));
@@ -2041,7 +2042,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(env.balance(becky, gwXAU) == gwXAU(990));
 
             // becky sells nft to carol.  alice's balance should not change.
-            uint256 const beckySellOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckySellOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftID, gwXAU(10)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(carol, beckySellOfferIndex));
@@ -2051,7 +2052,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(env.balance(carol, gwXAU) == gwXAU(990));
 
             // minter buys nft from carol.  alice's balance should not change.
-            uint256 const minterBuyOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterBuyOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, gwXAU(10)), token::Owner(carol));
             env.close();
             env(token::acceptBuyOffer(carol, minterBuyOfferIndex));
@@ -2063,7 +2064,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // minter sells the nft to alice.  gwXAU balances should finish
             // where they started.
-            uint256 const minterSellOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterSellOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, gwXAU(10)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(alice, minterSellOfferIndex));
@@ -2090,7 +2091,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.close();
 
             // Becky buys the nft for XAU(10).  Check balances.
-            uint256 const beckyBuyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyBuyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftID, gwXAU(10)), token::Owner(alice));
             env.close();
             BEAST_EXPECT(env.balance(alice, gwXAU) == gwXAU(1000));
@@ -2102,7 +2103,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(env.balance(becky, gwXAU) == gwXAU(990));
 
             // becky sells nft to carol.  alice's balance goes up.
-            uint256 const beckySellOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckySellOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftID, gwXAU(10)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(carol, beckySellOfferIndex));
@@ -2113,7 +2114,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(env.balance(carol, gwXAU) == gwXAU(990));
 
             // minter buys nft from carol.  alice's balance goes up.
-            uint256 const minterBuyOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterBuyOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, gwXAU(10)), token::Owner(carol));
             env.close();
             env(token::acceptBuyOffer(carol, minterBuyOfferIndex));
@@ -2126,7 +2127,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // minter sells the nft to alice.  Because alice is part of the
             // transaction no transfer fee is removed.
-            uint256 const minterSellOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterSellOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, gwXAU(10)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(alice, minterSellOfferIndex));
@@ -2171,7 +2172,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.close();
 
             // Becky buys the nft for XAU(10).  Check balances.
-            uint256 const beckyBuyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyBuyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftID, gwXAU(10)), token::Owner(alice));
             env.close();
             BEAST_EXPECT(env.balance(alice, gwXAU) == gwXAU(1000));
@@ -2183,7 +2184,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(env.balance(becky, gwXAU) == gwXAU(990));
 
             // becky sells nft to minter.  alice's balance goes up.
-            uint256 const beckySellOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckySellOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftID, gwXAU(100)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(minter, beckySellOfferIndex));
@@ -2194,7 +2195,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             BEAST_EXPECT(env.balance(minter, gwXAU) == gwXAU(900));
 
             // carol buys nft from minter.  alice's balance goes up.
-            uint256 const carolBuyOfferIndex = keylet::nftoffer(carol, env.seq(carol)).key;
+            uint256 const carolBuyOfferIndex = keylet::nftokenOffer(carol, env.seq(carol)).key;
             env(token::createOffer(carol, nftID, gwXAU(10)), token::Owner(minter));
             env.close();
             env(token::acceptBuyOffer(minter, carolBuyOfferIndex));
@@ -2207,7 +2208,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // carol sells the nft to alice.  Because alice is part of the
             // transaction no transfer fee is removed.
-            uint256 const carolSellOfferIndex = keylet::nftoffer(carol, env.seq(carol)).key;
+            uint256 const carolSellOfferIndex = keylet::nftokenOffer(carol, env.seq(carol)).key;
             env(token::createOffer(carol, nftID, gwXAU(10)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(alice, carolSellOfferIndex));
@@ -2248,7 +2249,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             // alice there should be no transfer fee.
             STAmount aliceBalance = env.balance(alice);
             STAmount minterBalance = env.balance(minter);
-            uint256 const minterBuyOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterBuyOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, XRP(1)), token::Owner(alice));
             env.close();
             env(token::acceptBuyOffer(alice, minterBuyOfferIndex));
@@ -2262,7 +2263,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             // alice does not get any transfer fee.
             auto pmt = drops(50000);
             STAmount carolBalance = env.balance(carol);
-            uint256 const minterSellOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterSellOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, pmt), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(carol, minterSellOfferIndex));
@@ -2276,7 +2277,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             // carol sells to becky. This is the smallest amount to pay for a
             // transfer that enables a transfer fee of 1 basis point.
             STAmount beckyBalance = env.balance(becky);
-            uint256 const beckyBuyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyBuyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             pmt = drops(50001);
             env(token::createOffer(becky, nftID, pmt), token::Owner(carol));
             env.close();
@@ -2321,7 +2322,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             // alice there should be no transfer fee.
             STAmount aliceBalance = env.balance(alice, gwXAU);
             STAmount minterBalance = env.balance(minter, gwXAU);
-            uint256 const minterBuyOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterBuyOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, tinyXAU), token::Owner(alice));
             env.close();
             env(token::acceptBuyOffer(alice, minterBuyOfferIndex));
@@ -2333,7 +2334,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // minter sells to carol.
             STAmount carolBalance = env.balance(carol, gwXAU);
-            uint256 const minterSellOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const minterSellOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftID, tinyXAU), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(carol, minterSellOfferIndex));
@@ -2351,7 +2352,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             STAmount const cheapNFT(gwXAU, STAmount::kMinValue, STAmount::kMinOffset + 5);
 
             STAmount beckyBalance = env.balance(becky, gwXAU);
-            uint256 const beckyBuyOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyBuyOfferIndex = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftID, cheapNFT), token::Owner(carol));
             env.close();
             env(token::acceptBuyOffer(carol, beckyBuyOfferIndex));
@@ -2581,22 +2582,22 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // Test how adding a Destination field to an offer affects permissions
         // for canceling offers.
         {
-            uint256 const offerMinterToIssuer = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterToIssuer = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Destination(issuer),
                 Txflags(tfSellNFToken));
 
-            uint256 const offerMinterToBuyer = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterToBuyer = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Destination(buyer),
                 Txflags(tfSellNFToken));
 
-            uint256 const offerIssuerToMinter = keylet::nftoffer(issuer, env.seq(issuer)).key;
+            uint256 const offerIssuerToMinter = keylet::nftokenOffer(issuer, env.seq(issuer)).key;
             env(token::createOffer(issuer, nftokenID, drops(1)),
                 token::Owner(minter),
                 token::Destination(minter));
 
-            uint256 const offerIssuerToBuyer = keylet::nftoffer(issuer, env.seq(issuer)).key;
+            uint256 const offerIssuerToBuyer = keylet::nftokenOffer(issuer, env.seq(issuer)).key;
             env(token::createOffer(issuer, nftokenID, drops(1)),
                 token::Owner(minter),
                 token::Destination(buyer));
@@ -2637,7 +2638,8 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // Test how adding a Destination field to a sell offer affects
         // accepting that offer.
         {
-            uint256 const offerMinterSellsToBuyer = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterSellsToBuyer =
+                keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Destination(buyer),
                 Txflags(tfSellNFToken));
@@ -2665,7 +2667,8 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // Test how adding a Destination field to a buy offer affects
         // accepting that offer.
         {
-            uint256 const offerMinterBuysFromBuyer = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterBuysFromBuyer =
+                keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Owner(buyer),
                 token::Destination(buyer));
@@ -2692,7 +2695,8 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             // If a destination other than the NFToken owner is set, that
             // destination must act as a broker.  The NFToken owner may not
             // simply accept the offer.
-            uint256 const offerBuyerBuysFromMinter = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerBuyerBuysFromMinter =
+                keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID, drops(1)),
                 token::Owner(minter),
                 token::Destination(broker));
@@ -2715,12 +2719,12 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // Show that a sell offer's Destination can broker that sell offer
         // to another account.
         {
-            uint256 const offerMinterToBroker = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterToBroker = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Destination(broker),
                 Txflags(tfSellNFToken));
 
-            uint256 const offerBuyerToMinter = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerBuyerToMinter = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID, drops(1)), token::Owner(minter));
 
             env.close();
@@ -2752,15 +2756,15 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // Destination doesn't match, but can complete if the Destination
         // does match.
         {
-            uint256 const offerBuyerToMinter = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerBuyerToMinter = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID, drops(1)),
                 token::Destination(minter),
                 Txflags(tfSellNFToken));
 
-            uint256 const offerMinterToBuyer = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterToBuyer = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID, drops(1)), token::Owner(buyer));
 
-            uint256 const offerIssuerToBuyer = keylet::nftoffer(issuer, env.seq(issuer)).key;
+            uint256 const offerIssuerToBuyer = keylet::nftokenOffer(issuer, env.seq(issuer)).key;
             env(token::createOffer(issuer, nftokenID, drops(1)), token::Owner(buyer));
 
             env.close();
@@ -2808,12 +2812,12 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // Show that if a buy and a sell offer both have the same destination,
         // then that destination can broker the offers.
         {
-            uint256 const offerMinterToBroker = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterToBroker = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Destination(broker),
                 Txflags(tfSellNFToken));
 
-            uint256 const offerBuyerToBroker = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerBuyerToBroker = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID, drops(1)),
                 token::Owner(minter),
                 token::Destination(broker));
@@ -2883,7 +2887,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
         // create offer (allowed now) then cancel
         {
-            uint256 const offerIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
 
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Destination(buyer),
@@ -2896,7 +2900,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
         // create offer, enable flag, then cancel
         {
-            uint256 const offerIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
 
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Destination(buyer),
@@ -2915,7 +2919,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
         // create offer then transfer
         {
-            uint256 const offerIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
 
             env(token::createOffer(minter, nftokenID, drops(1)),
                 token::Destination(buyer),
@@ -3002,23 +3006,23 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         {
             std::uint32_t const expiration = lastClose(env) + 25;
 
-            uint256 const offerMinterToIssuer = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterToIssuer = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID0, drops(1)),
                 token::Destination(issuer),
                 token::Expiration(expiration),
                 Txflags(tfSellNFToken));
 
-            uint256 const offerMinterToAnyone = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offerMinterToAnyone = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID0, drops(1)),
                 token::Expiration(expiration),
                 Txflags(tfSellNFToken));
 
-            uint256 const offerIssuerToMinter = keylet::nftoffer(issuer, env.seq(issuer)).key;
+            uint256 const offerIssuerToMinter = keylet::nftokenOffer(issuer, env.seq(issuer)).key;
             env(token::createOffer(issuer, nftokenID0, drops(1)),
                 token::Owner(minter),
                 token::Expiration(expiration));
 
-            uint256 const offerBuyerToMinter = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerBuyerToMinter = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, drops(1)),
                 token::Owner(minter),
                 token::Expiration(expiration));
@@ -3078,13 +3082,13 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         {
             std::uint32_t const expiration = lastClose(env) + 25;
 
-            uint256 const offer0 = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offer0 = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID0, drops(1)),
                 token::Expiration(expiration),
                 Txflags(tfSellNFToken));
             minterCount++;
 
-            uint256 const offer1 = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const offer1 = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID1, drops(1)),
                 token::Expiration(expiration),
                 Txflags(tfSellNFToken));
@@ -3149,7 +3153,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // Transfer nftokenID0 back to minter so we start the next test in
             // a simple place.
-            uint256 const offerSellBack = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerSellBack = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, XRP(0)),
                 Txflags(tfSellNFToken),
                 token::Destination(minter));
@@ -3168,13 +3172,13 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         {
             std::uint32_t const expiration = lastClose(env) + 25;
 
-            uint256 const offer0 = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offer0 = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, drops(1)),
                 token::Owner(minter),
                 token::Expiration(expiration));
             buyerCount++;
 
-            uint256 const offer1 = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offer1 = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID1, drops(1)),
                 token::Owner(minter),
                 token::Expiration(expiration));
@@ -3237,7 +3241,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // Transfer nftokenID0 back to minter so we start the next test in
             // a simple place.
-            uint256 const offerSellBack = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerSellBack = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, XRP(0)),
                 Txflags(tfSellNFToken),
                 token::Destination(minter));
@@ -3256,23 +3260,23 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         {
             std::uint32_t const expiration = lastClose(env) + 25;
 
-            uint256 const sellOffer0 = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const sellOffer0 = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID0, drops(1)),
                 token::Expiration(expiration),
                 Txflags(tfSellNFToken));
             minterCount++;
 
-            uint256 const sellOffer1 = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const sellOffer1 = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID1, drops(1)),
                 token::Expiration(expiration),
                 Txflags(tfSellNFToken));
             minterCount++;
 
-            uint256 const buyOffer0 = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyOffer0 = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, drops(1)), token::Owner(minter));
             buyerCount++;
 
-            uint256 const buyOffer1 = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyOffer1 = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID1, drops(1)), token::Owner(minter));
             buyerCount++;
 
@@ -3331,7 +3335,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // Transfer nftokenID0 back to minter so we start the next test in
             // a simple place.
-            uint256 const offerSellBack = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerSellBack = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, XRP(0)),
                 Txflags(tfSellNFToken),
                 token::Destination(minter));
@@ -3350,18 +3354,18 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         {
             std::uint32_t const expiration = lastClose(env) + 25;
 
-            uint256 const sellOffer0 = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const sellOffer0 = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID0, drops(1)), Txflags(tfSellNFToken));
 
-            uint256 const sellOffer1 = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const sellOffer1 = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID1, drops(1)), Txflags(tfSellNFToken));
 
-            uint256 const buyOffer0 = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyOffer0 = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, drops(1)),
                 token::Expiration(expiration),
                 token::Owner(minter));
 
-            uint256 const buyOffer1 = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyOffer1 = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID1, drops(1)),
                 token::Expiration(expiration),
                 token::Owner(minter));
@@ -3412,7 +3416,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // Transfer nftokenID0 back to minter so we start the next test in
             // a simple place.
-            uint256 const offerSellBack = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerSellBack = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, XRP(0)),
                 Txflags(tfSellNFToken),
                 token::Destination(minter));
@@ -3431,22 +3435,22 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         {
             std::uint32_t const expiration = lastClose(env) + 25;
 
-            uint256 const sellOffer0 = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const sellOffer0 = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID0, drops(1)),
                 token::Expiration(expiration),
                 Txflags(tfSellNFToken));
 
-            uint256 const sellOffer1 = keylet::nftoffer(minter, env.seq(minter)).key;
+            uint256 const sellOffer1 = keylet::nftokenOffer(minter, env.seq(minter)).key;
             env(token::createOffer(minter, nftokenID1, drops(1)),
                 token::Expiration(expiration),
                 Txflags(tfSellNFToken));
 
-            uint256 const buyOffer0 = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyOffer0 = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, drops(1)),
                 token::Expiration(expiration),
                 token::Owner(minter));
 
-            uint256 const buyOffer1 = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyOffer1 = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID1, drops(1)),
                 token::Expiration(expiration),
                 token::Owner(minter));
@@ -3488,7 +3492,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // Transfer nftokenID0 back to minter so we start the next test in
             // a simple place.
-            uint256 const offerSellBack = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerSellBack = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftokenID0, XRP(0)),
                 Txflags(tfSellNFToken),
                 token::Destination(minter));
@@ -3526,7 +3530,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         env.close();
 
         // Anyone can cancel an expired offer.
-        uint256 const expiredOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const expiredOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
 
         env(token::createOffer(alice, nftokenID, XRP(1000)),
             Txflags(tfSellNFToken),
@@ -3548,7 +3552,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
         // Create a couple of offers with a destination.  Those offers
         // should be cancellable by the creator and the destination.
-        uint256 const dest1OfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const dest1OfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
 
         env(token::createOffer(alice, nftokenID, XRP(1000)),
             token::Destination(becky),
@@ -3566,7 +3570,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         BEAST_EXPECT(ownerCount(env, alice) == 1);
 
         // alice can cancel her own offer, even if becky is the destination.
-        uint256 const dest2OfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const dest2OfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
 
         env(token::createOffer(alice, nftokenID, XRP(1000)),
             token::Destination(becky),
@@ -3585,7 +3589,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         env(token::mint(minter, 0), token::Issuer(alice), Txflags(tfTransferable));
         env.close();
 
-        uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+        uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
 
         env(token::createOffer(minter, mintersNFTokenID, XRP(1000)), Txflags(tfSellNFToken));
         env.close();
@@ -3643,7 +3647,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env(token::mint(nftAcct, 0), token::Uri(uri), Txflags(tfTransferable));
             env.close();
 
-            offerIndexes.push_back(keylet::nftoffer(offerAcct, env.seq(offerAcct)).key);
+            offerIndexes.push_back(keylet::nftokenOffer(offerAcct, env.seq(offerAcct)).key);
             env(token::createOffer(offerAcct, nftokenID, drops(1)),
                 token::Owner(nftAcct),
                 token::Expiration(lastClose(env) + 5));
@@ -3656,7 +3660,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // All offers should be in the ledger.
         for (uint256 const& offerIndex : offerIndexes)
         {
-            BEAST_EXPECT(env.le(keylet::nftoffer(offerIndex)));
+            BEAST_EXPECT(env.le(keylet::nftokenOffer(offerIndex)));
         }
 
         // alice attempts to cancel all of the expired offers.  There is one
@@ -3669,7 +3673,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         env.close();
 
         // Verify that offer is gone from the ledger.
-        BEAST_EXPECT(!env.le(keylet::nftoffer(offerIndexes.back())));
+        BEAST_EXPECT(!env.le(keylet::nftokenOffer(offerIndexes.back())));
         offerIndexes.pop_back();
 
         // But alice adds a sell offer to the list...
@@ -3678,7 +3682,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env(token::mint(alice, 0), token::Uri(uri), Txflags(tfTransferable));
             env.close();
 
-            offerIndexes.push_back(keylet::nftoffer(alice, env.seq(alice)).key);
+            offerIndexes.push_back(keylet::nftokenOffer(alice, env.seq(alice)).key);
             env(token::createOffer(alice, nftokenID, drops(1)), Txflags(tfSellNFToken));
             env.close();
 
@@ -3708,7 +3712,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // Verify that remaining offers are gone from the ledger.
         for (uint256 const& offerIndex : offerIndexes)
         {
-            BEAST_EXPECT(!env.le(keylet::nftoffer(offerIndex)));
+            BEAST_EXPECT(!env.le(keylet::nftokenOffer(offerIndex)));
         }
     }
 
@@ -3789,13 +3793,13 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 uint256 const nftID = mintNFT();
 
                 // minter creates their offer.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nftID, XRP(0)), Txflags(tfSellNFToken));
                 env.close();
 
                 // buyer creates their offer.  Note: a buy offer can never
                 // offer zero.
-                uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, XRP(1)), token::Owner(minter));
                 env.close();
 
@@ -3831,13 +3835,13 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 uint256 const nftID = mintNFT();
 
                 // minter creates their offer.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nftID, XRP(0)), Txflags(tfSellNFToken));
                 env.close();
 
                 // buyer creates their offer.  Note: a buy offer can never
                 // offer zero.
-                uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, XRP(1)), token::Owner(minter));
                 env.close();
 
@@ -3880,13 +3884,13 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 uint256 const nftID = mintNFT(kMaxTransferFee);
 
                 // minter creates their offer.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nftID, XRP(0)), Txflags(tfSellNFToken));
                 env.close();
 
                 // buyer creates their offer.  Note: a buy offer can never
                 // offer zero.
-                uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, XRP(1)), token::Owner(minter));
                 env.close();
 
@@ -3922,13 +3926,13 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 uint256 const nftID = mintNFT(kMaxTransferFee);
 
                 // minter creates their offer.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nftID, XRP(0)), Txflags(tfSellNFToken));
                 env.close();
 
                 // buyer creates their offer.  Note: a buy offer can never
                 // offer zero.
-                uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, XRP(1)), token::Owner(minter));
                 env.close();
 
@@ -3995,14 +3999,14 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 uint256 const nftID = mintNFT();
 
                 // minter creates their offer.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nftID, gwXAU(1000)), Txflags(tfSellNFToken));
                 env.close();
 
                 {
                     // buyer creates an offer for more XAU than they currently
                     // own.
-                    uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                    uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                     env(token::createOffer(buyer, nftID, gwXAU(1001)), token::Owner(minter));
                     env.close();
 
@@ -4019,7 +4023,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 {
                     // buyer creates an offer for less that what minter is
                     // asking.
-                    uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                    uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                     env(token::createOffer(buyer, nftID, gwXAU(999)), token::Owner(minter));
                     env.close();
 
@@ -4035,7 +4039,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 }
 
                 // buyer creates a large enough offer.
-                uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, gwXAU(1000)), token::Owner(minter));
                 env.close();
 
@@ -4072,13 +4076,13 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 uint256 const nftID = mintNFT(kMaxTransferFee);
 
                 // minter creates their offer.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nftID, gwXAU(900)), Txflags(tfSellNFToken));
                 env.close();
                 {
                     // buyer creates an offer for more XAU than they currently
                     // own.
-                    uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                    uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                     env(token::createOffer(buyer, nftID, gwXAU(1001)), token::Owner(minter));
                     env.close();
 
@@ -4095,7 +4099,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 {
                     // buyer creates an offer for less that what minter is
                     // asking.
-                    uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                    uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                     env(token::createOffer(buyer, nftID, gwXAU(899)), token::Owner(minter));
                     env.close();
 
@@ -4110,7 +4114,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                     env.close();
                 }
                 // buyer creates a large enough offer.
-                uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, gwXAU(1000)), token::Owner(minter));
                 env.close();
 
@@ -4150,12 +4154,12 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 uint256 const nftID = mintNFT(kMaxTransferFee / 2);  // 25%
 
                 // minter creates their offer.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nftID, gwXAU(900)), Txflags(tfSellNFToken));
                 env.close();
 
                 // buyer creates a large enough offer.
-                uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, gwXAU(1000)), token::Owner(minter));
                 env.close();
 
@@ -4187,12 +4191,12 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 uint256 const nftID = mintNFT(kMaxTransferFee / 2);  // 25%
 
                 // minter creates their offer.
-                uint256 const minterOfferIndex = keylet::nftoffer(minter, env.seq(minter)).key;
+                uint256 const minterOfferIndex = keylet::nftokenOffer(minter, env.seq(minter)).key;
                 env(token::createOffer(minter, nftID, gwXAU(900)), Txflags(tfSellNFToken));
                 env.close();
 
                 // buyer creates a large enough offer.
-                uint256 const buyOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+                uint256 const buyOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
                 env(token::createOffer(buyer, nftID, gwXAU(1000)), token::Owner(minter));
                 env.close();
 
@@ -4242,9 +4246,9 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         BEAST_EXPECT(nftCount(env, buyer2) == 0);
 
         // Both buyer1 and buyer2 create buy offers for nftId.
-        uint256 const buyer1OfferIndex = keylet::nftoffer(buyer1, env.seq(buyer1)).key;
+        uint256 const buyer1OfferIndex = keylet::nftokenOffer(buyer1, env.seq(buyer1)).key;
         env(token::createOffer(buyer1, nftId, XRP(100)), token::Owner(issuer));
-        uint256 const buyer2OfferIndex = keylet::nftoffer(buyer2, env.seq(buyer2)).key;
+        uint256 const buyer2OfferIndex = keylet::nftokenOffer(buyer2, env.seq(buyer2)).key;
         env(token::createOffer(buyer2, nftId, XRP(100)), token::Owner(issuer));
         env.close();
 
@@ -4332,7 +4336,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
         // NFTokenCreateOffer
         BEAST_EXPECT(ownerCount(env, buyer) == 10);
-        uint256 const offerIndex0 = keylet::nftoffer(buyer, buyerTicketSeq).key;
+        uint256 const offerIndex0 = keylet::nftokenOffer(buyer, buyerTicketSeq).key;
         env(token::createOffer(buyer, nftId, XRP(1)),
             token::Owner(issuer),
             ticket::Use(buyerTicketSeq++));
@@ -4347,7 +4351,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         BEAST_EXPECT(ticketCount(env, buyer) == 8);
 
         // NFTokenCreateOffer.  buyer tries again.
-        uint256 const offerIndex1 = keylet::nftoffer(buyer, buyerTicketSeq).key;
+        uint256 const offerIndex1 = keylet::nftokenOffer(buyer, buyerTicketSeq).key;
         env(token::createOffer(buyer, nftId, XRP(2)),
             token::Owner(issuer),
             ticket::Use(buyerTicketSeq++));
@@ -4424,7 +4428,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         env(token::createOffer(becky, nftId, XRP(2)), token::Owner(minter));
         env.close();
 
-        uint256 const carlaOfferIndex = keylet::nftoffer(carla, env.seq(carla)).key;
+        uint256 const carlaOfferIndex = keylet::nftokenOffer(carla, env.seq(carla)).key;
         env(token::createOffer(carla, nftId, XRP(3)), token::Owner(minter));
         env.close();
 
@@ -4702,25 +4706,25 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             TER const offerCreateTER = temBAD_AMOUNT;
 
             // Make offers with negative amounts for the NFTs
-            uint256 const sellNegXrpOfferIndex = keylet::nftoffer(issuer, env.seq(issuer)).key;
+            uint256 const sellNegXrpOfferIndex = keylet::nftokenOffer(issuer, env.seq(issuer)).key;
             env(token::createOffer(issuer, nftID0, XRP(-2)),
                 Txflags(tfSellNFToken),
                 Ter(offerCreateTER));
             env.close();
 
-            uint256 const sellNegIouOfferIndex = keylet::nftoffer(issuer, env.seq(issuer)).key;
+            uint256 const sellNegIouOfferIndex = keylet::nftokenOffer(issuer, env.seq(issuer)).key;
             env(token::createOffer(issuer, nftID1, gwXAU(-2)),
                 Txflags(tfSellNFToken),
                 Ter(offerCreateTER));
             env.close();
 
-            uint256 const buyNegXrpOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyNegXrpOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftID0, XRP(-1)),
                 token::Owner(issuer),
                 Ter(offerCreateTER));
             env.close();
 
-            uint256 const buyNegIouOfferIndex = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const buyNegIouOfferIndex = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::createOffer(buyer, nftID1, gwXAU(-1)),
                 token::Owner(issuer),
                 Ter(offerCreateTER));
@@ -4883,7 +4887,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                                       uint256 const& nftID,
                                       STAmount const& amount,
                                       std::optional<TER const> const terCode = {}) {
-                uint256 const offerID = keylet::nftoffer(offerer, env.seq(offerer)).key;
+                uint256 const offerID = keylet::nftokenOffer(offerer, env.seq(offerer)).key;
                 env(token::createOffer(offerer, nftID, amount),
                     token::Owner(owner),
                     terCode ? Ter(*terCode) : Ter(static_cast<TER>(tesSUCCESS)));
@@ -4896,7 +4900,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                                        uint256 const& nftID,
                                        STAmount const& amount,
                                        std::optional<TER const> const terCode = {}) {
-                uint256 const offerID = keylet::nftoffer(offerer, env.seq(offerer)).key;
+                uint256 const offerID = keylet::nftokenOffer(offerer, env.seq(offerer)).key;
                 env(token::createOffer(offerer, nftID, amount),
                     Txflags(tfSellNFToken),
                     terCode ? Ter(*terCode) : Ter(static_cast<TER>(tesSUCCESS)));
@@ -5409,10 +5413,10 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
         // Bob creates a buy offer for 5 XRP.  Alice creates a sell offer
         // for 0 XRP.
-        uint256 const bobBuyOfferIndex = keylet::nftoffer(bob, env.seq(bob)).key;
+        uint256 const bobBuyOfferIndex = keylet::nftokenOffer(bob, env.seq(bob)).key;
         env(token::createOffer(bob, nftId, XRP(5)), token::Owner(alice));
 
-        uint256 const aliceSellOfferIndex = keylet::nftoffer(alice, env.seq(alice)).key;
+        uint256 const aliceSellOfferIndex = keylet::nftokenOffer(alice, env.seq(alice)).key;
         env(token::createOffer(alice, nftId, XRP(0)),
             token::Destination(bob),
             Txflags(tfSellNFToken));
@@ -5423,10 +5427,10 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         env.close();
 
         // Note that bob still has a buy offer on the books.
-        BEAST_EXPECT(env.le(keylet::nftoffer(bobBuyOfferIndex)));
+        BEAST_EXPECT(env.le(keylet::nftokenOffer(bobBuyOfferIndex)));
 
         // Bob creates a sell offer for the gift NFT from alice.
-        uint256 const bobSellOfferIndex = keylet::nftoffer(bob, env.seq(bob)).key;
+        uint256 const bobSellOfferIndex = keylet::nftokenOffer(bob, env.seq(bob)).key;
         env(token::createOffer(bob, nftId, XRP(4)), Txflags(tfSellNFToken));
         env.close();
 
@@ -6043,7 +6047,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 token::Amount(XRP(10)),
                 token::Destination(buyer),
                 token::Expiration(lastClose(env) + 25));
-            uint256 const offerAliceSellsToBuyer = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const offerAliceSellsToBuyer = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::cancelOffer(alice, {offerAliceSellsToBuyer}));
             env.close();
 
@@ -6052,7 +6056,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
                 token::Amount(XRP(10)),
                 token::Destination(alice),
                 token::Expiration(lastClose(env) + 25));
-            uint256 const offerBuyerSellsToAlice = keylet::nftoffer(buyer, env.seq(buyer)).key;
+            uint256 const offerBuyerSellsToAlice = keylet::nftokenOffer(buyer, env.seq(buyer)).key;
             env(token::cancelOffer(alice, {offerBuyerSellsToAlice}));
             env.close();
 
@@ -6203,12 +6207,12 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             // Alice creates one sell offer for each NFT
             // Verify the offer indexes are correct in the NFTokenCreateOffer tx
             // meta
-            uint256 const aliceOfferIndex1 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex1 = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId1, drops(1)), Txflags(tfSellNFToken));
             env.close();
             verifyNFTokenOfferID(aliceOfferIndex1);
 
-            uint256 const aliceOfferIndex2 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex2 = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId2, drops(1)), Txflags(tfSellNFToken));
             env.close();
             verifyNFTokenOfferID(aliceOfferIndex2);
@@ -6222,7 +6226,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // Bobs creates a buy offer for nftId1
             // Verify the offer id is correct in the NFTokenCreateOffer tx meta
-            auto const bobBuyOfferIndex = keylet::nftoffer(bob, env.seq(bob)).key;
+            auto const bobBuyOfferIndex = keylet::nftokenOffer(bob, env.seq(bob)).key;
             env(token::createOffer(bob, nftId1, drops(1)), token::Owner(alice));
             env.close();
             verifyNFTokenOfferID(bobBuyOfferIndex);
@@ -6243,7 +6247,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             verifyNFTokenID(nftId);
 
             // Alice creates sell offer and set broker as destination
-            uint256 const offerAliceToBroker = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const offerAliceToBroker = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId, drops(1)),
                 token::Destination(broker),
                 Txflags(tfSellNFToken));
@@ -6251,7 +6255,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             verifyNFTokenOfferID(offerAliceToBroker);
 
             // Bob creates buy offer
-            uint256 const offerBobToBroker = keylet::nftoffer(bob, env.seq(bob)).key;
+            uint256 const offerBobToBroker = keylet::nftokenOffer(bob, env.seq(bob)).key;
             env(token::createOffer(bob, nftId, drops(1)), token::Owner(alice));
             env.close();
             verifyNFTokenOfferID(offerBobToBroker);
@@ -6272,12 +6276,12 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             verifyNFTokenID(nftId);
 
             // Alice creates 2 sell offers for the same NFT
-            uint256 const aliceOfferIndex1 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex1 = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId, drops(1)), Txflags(tfSellNFToken));
             env.close();
             verifyNFTokenOfferID(aliceOfferIndex1);
 
-            uint256 const aliceOfferIndex2 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex2 = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId, drops(1)), Txflags(tfSellNFToken));
             env.close();
             verifyNFTokenOfferID(aliceOfferIndex2);
@@ -6291,7 +6295,8 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
         if (features[featureNFTokenMintOffer])
         {
-            uint256 const aliceMintWithOfferIndex1 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceMintWithOfferIndex1 =
+                keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::mint(alice), token::Amount(XRP(0)));
             env.close();
             verifyNFTokenOfferID(aliceMintWithOfferIndex1);
@@ -6314,7 +6319,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.close();
 
             // acct makes an sell offer
-            uint256 const sellOfferIndex = keylet::nftoffer(acct, env.seq(acct)).key;
+            uint256 const sellOfferIndex = keylet::nftokenOffer(acct, env.seq(acct)).key;
             env(token::createOffer(acct, nftId, amt), Txflags(tfSellNFToken));
             env.close();
 
@@ -6519,7 +6524,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.close();
 
             // Bob makes a buy offer for 1 XRP
-            auto const buyOfferIndex = keylet::nftoffer(bob, env.seq(bob)).key;
+            auto const buyOfferIndex = keylet::nftokenOffer(bob, env.seq(bob)).key;
             env(token::createOffer(bob, nftId, XRP(1)), token::Owner(alice));
             env.close();
 
@@ -6567,14 +6572,14 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.close();
 
             // Alice creates sell offer and set broker as destination
-            uint256 const offerAliceToBroker = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const offerAliceToBroker = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId, XRP(1)),
                 token::Destination(broker),
                 Txflags(tfSellNFToken));
             env.close();
 
             // Bob creates buy offer
-            uint256 const offerBobToBroker = keylet::nftoffer(bob, env.seq(bob)).key;
+            uint256 const offerBobToBroker = keylet::nftokenOffer(bob, env.seq(bob)).key;
             env(token::createOffer(bob, nftId, XRP(1)), token::Owner(alice));
             env.close();
 
@@ -6668,10 +6673,10 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // becky buys the nfts for 1 drop each.
             {
-                uint256 const beckyBuyOfferIndex1 = keylet::nftoffer(becky, env.seq(becky)).key;
+                uint256 const beckyBuyOfferIndex1 = keylet::nftokenOffer(becky, env.seq(becky)).key;
                 env(token::createOffer(becky, nftAutoTrustID, drops(1)), token::Owner(issuer));
 
-                uint256 const beckyBuyOfferIndex2 = keylet::nftoffer(becky, env.seq(becky)).key;
+                uint256 const beckyBuyOfferIndex2 = keylet::nftokenOffer(becky, env.seq(becky)).key;
                 env(token::createOffer(becky, nftNoAutoTrustID, drops(1)), token::Owner(issuer));
 
                 env.close();
@@ -6681,7 +6686,8 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             }
 
             // becky creates offers to sell the nfts for AUD.
-            uint256 const beckyAutoTrustOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyAutoTrustOfferIndex =
+                keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftAutoTrustID, gwAUD(100)), Txflags(tfSellNFToken));
             env.close();
 
@@ -6699,7 +6705,8 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.close();
             BEAST_EXPECT(ownerCount(env, issuer) == 1);
 
-            uint256 const beckyNoAutoTrustOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyNoAutoTrustOfferIndex =
+                keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftNoAutoTrustID, gwAUD(100)), Txflags(tfSellNFToken));
             env.close();
 
@@ -6823,10 +6830,10 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
         // becky buys the nfts for 1 drop each.
         {
-            uint256 const beckyBuyOfferIndex1 = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyBuyOfferIndex1 = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftAutoTrustID, drops(1)), token::Owner(issuer));
 
-            uint256 const beckyBuyOfferIndex2 = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyBuyOfferIndex2 = keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftNoAutoTrustID, drops(1)), token::Owner(issuer));
 
             env.close();
@@ -6853,7 +6860,8 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // However if the NFToken has the tfTrustLine flag set,
             // then becky can create the offer.
-            uint256 const beckyAutoTrustOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyAutoTrustOfferIndex =
+                keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftAutoTrustID, isISU(100)), Txflags(tfSellNFToken));
             env.close();
 
@@ -6870,10 +6878,12 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         {
             // With featureNFTokenMintOffer things go better.
             // becky creates offers to sell the nfts for ISU.
-            uint256 const beckyNoAutoTrustOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyNoAutoTrustOfferIndex =
+                keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftNoAutoTrustID, isISU(100)), Txflags(tfSellNFToken));
             env.close();
-            uint256 const beckyAutoTrustOfferIndex = keylet::nftoffer(becky, env.seq(becky)).key;
+            uint256 const beckyAutoTrustOfferIndex =
+                keylet::nftokenOffer(becky, env.seq(becky)).key;
             env(token::createOffer(becky, nftAutoTrustID, isISU(100)), Txflags(tfSellNFToken));
             env.close();
 
@@ -7107,7 +7117,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             checkURI(issuer, "uri", __LINE__);
 
             // Account != Owner
-            uint256 const offerID = keylet::nftoffer(issuer, env.seq(issuer)).key;
+            uint256 const offerID = keylet::nftokenOffer(issuer, env.seq(issuer)).key;
             env(token::createOffer(issuer, nftId, XRP(0)), Txflags(tfSellNFToken));
             env.close();
             env(token::acceptSellOffer(alice, offerID));
diff --git a/src/test/app/Offer_test.cpp b/src/test/app/Offer_test.cpp
index 1a2f0b2b12..804bd9b86c 100644
--- a/src/test/app/Offer_test.cpp
+++ b/src/test/app/Offer_test.cpp
@@ -2196,7 +2196,7 @@ public:
         jtx::PrettyAmount const& expectBalance)
     {
         Issue const& issue = expectBalance.value().get<Issue>();
-        auto const sleTrust = env.le(keylet::line(account.id(), issue));
+        auto const sleTrust = env.le(keylet::trustLine(account.id(), issue));
         BEAST_EXPECT(sleTrust);
         if (sleTrust)
         {
@@ -2363,7 +2363,7 @@ public:
                 else
                 {
                     // Verify that no trustline was created.
-                    auto const sleTrust = env.le(keylet::line(acct, usd));
+                    auto const sleTrust = env.le(keylet::trustLine(acct, usd));
                     BEAST_EXPECT(!sleTrust);
                 }
             }
@@ -2548,8 +2548,8 @@ public:
         env.require(offers(bob, 0));
 
         // The two trustlines that were generated by offers should be gone.
-        BEAST_EXPECT(!env.le(keylet::line(alice.id(), eur)));
-        BEAST_EXPECT(!env.le(keylet::line(bob.id(), usd)));
+        BEAST_EXPECT(!env.le(keylet::trustLine(alice.id(), eur)));
+        BEAST_EXPECT(!env.le(keylet::trustLine(bob.id(), usd)));
 
         // Make two more offers that leave one of the offers non-dry. We
         // need to properly sequence the transactions:
@@ -4484,7 +4484,7 @@ public:
                                   jtx::Account const& src,
                                   jtx::Account const& dst,
                                   Currency const& cur) -> bool {
-            return bool(env.le(keylet::line(src, dst, cur)));
+            return bool(env.le(keylet::trustLine(src, dst, cur)));
         };
 
         Account const alice("alice");
diff --git a/src/test/app/Path_test.cpp b/src/test/app/Path_test.cpp
index 4cfe938798..8f19a419a0 100644
--- a/src/test/app/Path_test.cpp
+++ b/src/test/app/Path_test.cpp
@@ -880,7 +880,7 @@ public:
             })",
             jv);
 
-        auto const jvL = env.le(keylet::line(Account("bob").id(), Account("alice")["USD"]))
+        auto const jvL = env.le(keylet::trustLine(Account("bob").id(), Account("alice")["USD"]))
                              ->getJson(JsonOptions::Values::None);
         for (auto it = jv.begin(); it != jv.end(); ++it)
             BEAST_EXPECT(*it == jvL[it.memberName()]);
@@ -922,14 +922,15 @@ public:
             })",
             jv);
 
-        auto const jvL = env.le(keylet::line(Account("bob").id(), Account("alice")["USD"]))
+        auto const jvL = env.le(keylet::trustLine(Account("bob").id(), Account("alice")["USD"]))
                              ->getJson(JsonOptions::Values::None);
         for (auto it = jv.begin(); it != jv.end(); ++it)
             BEAST_EXPECT(*it == jvL[it.memberName()]);
 
         env.trust(Account("bob")["USD"](0), "alice");
         env.trust(Account("alice")["USD"](0), "bob");
-        BEAST_EXPECT(env.le(keylet::line(Account("bob").id(), Account("alice")["USD"])) == nullptr);
+        BEAST_EXPECT(
+            env.le(keylet::trustLine(Account("bob").id(), Account("alice")["USD"])) == nullptr);
     }
 
     void
@@ -972,13 +973,14 @@ public:
             })",
             jv);
 
-        auto const jvL = env.le(keylet::line(Account("alice").id(), Account("bob")["USD"]))
+        auto const jvL = env.le(keylet::trustLine(Account("alice").id(), Account("bob")["USD"]))
                              ->getJson(JsonOptions::Values::None);
         for (auto it = jv.begin(); it != jv.end(); ++it)
             BEAST_EXPECT(*it == jvL[it.memberName()]);
 
         env(pay("alice", "bob", Account("alice")["USD"](50)));
-        BEAST_EXPECT(env.le(keylet::line(Account("alice").id(), Account("bob")["USD"])) == nullptr);
+        BEAST_EXPECT(
+            env.le(keylet::trustLine(Account("alice").id(), Account("bob")["USD"])) == nullptr);
     }
 
     void
diff --git a/src/test/app/PayChan_test.cpp b/src/test/app/PayChan_test.cpp
index bb2d9636e6..fd2c7790d5 100644
--- a/src/test/app/PayChan_test.cpp
+++ b/src/test/app/PayChan_test.cpp
@@ -62,7 +62,7 @@ struct PayChan_test : public beast::unit_test::Suite
         auto const sle = view.read(keylet::account(account));
         if (!sle)
             return {};
-        auto const k = keylet::payChan(account, dst, (*sle)[sfSequence] - 1);
+        auto const k = keylet::payChannel(account, dst, (*sle)[sfSequence] - 1);
         return {k.key, view.read(k)};
     }
 
diff --git a/src/test/app/PayStrand_test.cpp b/src/test/app/PayStrand_test.cpp
index 471c641f36..1f9290de63 100644
--- a/src/test/app/PayStrand_test.cpp
+++ b/src/test/app/PayStrand_test.cpp
@@ -80,7 +80,7 @@ getTrustFlag(
     Currency const& cur,
     TrustFlag flag)
 {
-    if (auto sle = env.le(keylet::line(src, dst, cur)))
+    if (auto sle = env.le(keylet::trustLine(src, dst, cur)))
     {
         auto const useHigh = src.id() > dst.id();
         return sle->isFlag(trustFlag(flag, useHigh));
@@ -454,7 +454,7 @@ struct ExistingElementPool
                 for (auto const& c : currencies)
                 {
                     // Line balance
-                    auto const lk = keylet::line(*ai1, *ai2, c);
+                    auto const lk = keylet::trustLine(*ai1, *ai2, c);
                     auto const b1 = lineBalance(v1, lk);
                     auto const b2 = lineBalance(v2, lk);
                     if (b1 != b2)
diff --git a/src/test/app/PermissionedDEX_test.cpp b/src/test/app/PermissionedDEX_test.cpp
index 51ca321f7e..8578b8a9ba 100644
--- a/src/test/app/PermissionedDEX_test.cpp
+++ b/src/test/app/PermissionedDEX_test.cpp
@@ -144,7 +144,7 @@ class PermissionedDEX_test : public beast::unit_test::Suite
     static uint256
     getBookDirKey(Book const& book, STAmount const& takerPays, STAmount const& takerGets)
     {
-        return keylet::quality(keylet::kBook(book), getRate(takerGets, takerPays)).key;
+        return keylet::quality(keylet::book(book), getRate(takerGets, takerPays)).key;
     }
 
     static std::optional<uint256>
diff --git a/src/test/app/RCLValidations_test.cpp b/src/test/app/RCLValidations_test.cpp
index c3b0ddea9c..aaf84225a7 100644
--- a/src/test/app/RCLValidations_test.cpp
+++ b/src/test/app/RCLValidations_test.cpp
@@ -97,7 +97,7 @@ class RCLValidations_test : public beast::unit_test::Suite
             auto next = std::make_shared<Ledger>(*prev, env.app().getTimeKeeper().closeTime());
             // Force a different hash on the first iteration
             next->updateSkipList();
-            BEAST_EXPECT(next->read(keylet::fees()));
+            BEAST_EXPECT(next->read(keylet::feeSettings()));
             if (forceHash)
             {
                 next->setImmutable();
diff --git a/src/test/app/SetAuth_test.cpp b/src/test/app/SetAuth_test.cpp
index df0c6fe5d0..57526d0a0c 100644
--- a/src/test/app/SetAuth_test.cpp
+++ b/src/test/app/SetAuth_test.cpp
@@ -51,7 +51,7 @@ struct SetAuth_test : public beast::unit_test::Suite
         env(fset(gw, asfRequireAuth));
         env.close();
         env(auth(gw, "alice", "USD"));
-        BEAST_EXPECT(env.le(keylet::line(Account("alice").id(), gw.id(), usd.currency)));
+        BEAST_EXPECT(env.le(keylet::trustLine(Account("alice").id(), gw.id(), usd.currency)));
         env(trust("alice", usd(1000)));
         env(trust("bob", usd(1000)));
         env(pay(gw, "alice", usd(100)));
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index 065b6b0044..4643bc8555 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -113,7 +113,7 @@ class Vault_test : public beast::unit_test::Suite
                 {
                     BEAST_EXPECT(vault->at(sfScale) == 0);
                 }
-                auto const shares = env.le(keylet::mptIssuance(vault->at(sfShareMPTID)));
+                auto const shares = env.le(keylet::mptokenIssuance(vault->at(sfShareMPTID)));
                 BEAST_EXPECT(shares != nullptr);
                 if (!asset.integral())
                 {
@@ -1692,7 +1692,7 @@ class Vault_test : public beast::unit_test::Suite
             auto v = env.le(keylet);
             BEAST_EXPECT(v);
             MPTID const share = (*v)[sfShareMPTID];
-            auto issuance = env.le(keylet::mptIssuance(share));
+            auto issuance = env.le(keylet::mptokenIssuance(share));
             BEAST_EXPECT(issuance);
             Number const outstandingShares = issuance->at(sfOutstandingAmount);
             BEAST_EXPECT(outstandingShares == 100);
@@ -2794,7 +2794,7 @@ class Vault_test : public beast::unit_test::Suite
             env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(200)}));
             env.close();
 
-            auto trustline = env.le(keylet::line(owner, asset.raw().get<Issue>()));
+            auto trustline = env.le(keylet::trustLine(owner, asset.raw().get<Issue>()));
             BEAST_EXPECT(trustline == nullptr);
 
             // Withdraw without trust line, will succeed
@@ -2977,7 +2977,7 @@ class Vault_test : public beast::unit_test::Suite
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(200)}));
                 env.close();
 
-                auto trustline = env.le(keylet::line(owner, asset.raw().get<Issue>()));
+                auto trustline = env.le(keylet::trustLine(owner, asset.raw().get<Issue>()));
                 BEAST_EXPECT(trustline == nullptr);
 
                 env(ticket::create(owner, 1));
@@ -3405,7 +3405,7 @@ class Vault_test : public beast::unit_test::Suite
             return {vault->at(sfAccount), vault->at(sfShareMPTID)};
         }();
         BEAST_EXPECT(env.le(keylet::account(vaultAccount)));
-        BEAST_EXPECT(env.le(keylet::mptIssuance(issuanceId)));
+        BEAST_EXPECT(env.le(keylet::mptokenIssuance(issuanceId)));
         PrettyAsset const shares{issuanceId};
 
         {
@@ -3559,7 +3559,7 @@ class Vault_test : public beast::unit_test::Suite
                         auto vault = sb.peek(keylet::vault(keylet.key));
                         if (!BEAST_EXPECT(vault))
                             return false;
-                        auto shares = sb.peek(keylet::mptIssuance(vault->at(sfShareMPTID)));
+                        auto shares = sb.peek(keylet::mptokenIssuance(vault->at(sfShareMPTID)));
                         if (!BEAST_EXPECT(shares))
                             return false;
                         if (fn(*vault, *shares))
@@ -4308,7 +4308,7 @@ class Vault_test : public beast::unit_test::Suite
             BEAST_EXPECT(env.balance(d.depositor, d.shares) == d.share(1000));
 
             // Create a loan broker backed by this vault
-            auto const brokerKeylet = keylet::loanbroker(d.owner.id(), env.seq(d.owner));
+            auto const brokerKeylet = keylet::loanBroker(d.owner.id(), env.seq(d.owner));
             env(set(d.owner, d.keylet.key));
             env.close();
 
@@ -4783,7 +4783,7 @@ class Vault_test : public beast::unit_test::Suite
             auto const sleVault = env.le(vaultKeylet);
             BEAST_EXPECT(sleVault != nullptr);
 
-            auto const sleIssuance = env.le(keylet::mptIssuance(sleVault->at(sfShareMPTID)));
+            auto const sleIssuance = env.le(keylet::mptokenIssuance(sleVault->at(sfShareMPTID)));
             BEAST_EXPECT(sleIssuance != nullptr);
 
             return sleIssuance->at(sfOutstandingAmount);
@@ -4822,7 +4822,7 @@ class Vault_test : public beast::unit_test::Suite
             env.close();
 
             auto const& sharesAvailable = vaultShareBalance(vaultKeylet);
-            auto const& brokerKeylet = keylet::loanbroker(owner.id(), env.seq(owner));
+            auto const& brokerKeylet = keylet::loanBroker(owner.id(), env.seq(owner));
 
             env(set(owner, vaultKeylet.key));
             env.close();
@@ -5215,7 +5215,7 @@ class Vault_test : public beast::unit_test::Suite
                 PrettyAsset const shares = MPTIssue(vaultSle->at(sfShareMPTID));
 
                 // Create a loan broker backed by this vault
-                auto const brokerKeylet = keylet::loanbroker(owner.id(), env.seq(owner));
+                auto const brokerKeylet = keylet::loanBroker(owner.id(), env.seq(owner));
                 env(set(owner, vaultKeylet.key));
                 env.close();
 
@@ -5273,7 +5273,7 @@ class Vault_test : public beast::unit_test::Suite
                 PrettyAsset const shares = MPTIssue(vaultSle->at(sfShareMPTID));
 
                 // Create a loan broker backed by this vault
-                auto const brokerKeylet = keylet::loanbroker(owner.id(), env.seq(owner));
+                auto const brokerKeylet = keylet::loanBroker(owner.id(), env.seq(owner));
                 env(set(owner, vaultKeylet.key));
                 env.close();
 
@@ -5328,7 +5328,7 @@ class Vault_test : public beast::unit_test::Suite
                 PrettyAsset const shares = MPTIssue(vaultSle->at(sfShareMPTID));
 
                 // Create a loan broker backed by this vault
-                auto const brokerKeylet = keylet::loanbroker(owner.id(), env.seq(owner));
+                auto const brokerKeylet = keylet::loanBroker(owner.id(), env.seq(owner));
                 env(set(owner, vaultKeylet.key));
                 env.close();
 
@@ -5382,7 +5382,7 @@ class Vault_test : public beast::unit_test::Suite
                     return;
                 PrettyAsset const shares = MPTIssue(vaultSle->at(sfShareMPTID));
 
-                auto const brokerKeylet = keylet::loanbroker(owner.id(), env.seq(owner));
+                auto const brokerKeylet = keylet::loanBroker(owner.id(), env.seq(owner));
                 env(set(owner, vaultKeylet.key));
                 env.close();
 
@@ -5430,7 +5430,7 @@ class Vault_test : public beast::unit_test::Suite
                     return;
                 PrettyAsset const shares = MPTIssue(vaultSle->at(sfShareMPTID));
 
-                auto const brokerKeylet = keylet::loanbroker(owner.id(), env.seq(owner));
+                auto const brokerKeylet = keylet::loanBroker(owner.id(), env.seq(owner));
                 env(set(owner, vaultKeylet.key));
                 env.close();
 
@@ -5537,7 +5537,7 @@ class Vault_test : public beast::unit_test::Suite
             PrettyAsset const shares = MPTIssue(vaultSle->at(sfShareMPTID));
 
             // Create a loan broker backed by this vault
-            auto const brokerKeylet = keylet::loanbroker(owner.id(), env.seq(owner));
+            auto const brokerKeylet = keylet::loanBroker(owner.id(), env.seq(owner));
             env(set(owner, vaultKeylet.key));
             env.close();
 
@@ -6338,7 +6338,7 @@ class Vault_test : public beast::unit_test::Suite
         env.close();
 
         // Loan broker: no cover, no management fee, debt cap 10x principal.
-        f.brokerID = keylet::loanbroker(f.lender.id(), env.seq(f.lender)).key;
+        f.brokerID = keylet::loanBroker(f.lender.id(), env.seq(f.lender)).key;
         {
             using namespace loanBroker;
             env(set(f.lender, vaultKeylet.key),
@@ -6347,7 +6347,7 @@ class Vault_test : public beast::unit_test::Suite
         }
 
         // Loan: 3,333 USD principal, impaired immediately.
-        auto const sleBroker = env.le(keylet::loanbroker(f.brokerID));
+        auto const sleBroker = env.le(keylet::loanBroker(f.brokerID));
         if (!BEAST_EXPECT(sleBroker))
             return f;
         f.loanKeylet = keylet::loan(f.brokerID, sleBroker->at(sfLoanSequence));
@@ -6392,7 +6392,7 @@ class Vault_test : public beast::unit_test::Suite
             return f;
         f.sharesLender = tokenLender->getFieldU64(sfMPTAmount);
 
-        auto const sleIssuance = env.le(keylet::mptIssuance(f.shareAsset));
+        auto const sleIssuance = env.le(keylet::mptokenIssuance(f.shareAsset));
         if (!BEAST_EXPECT(sleIssuance))
             return f;
         BEAST_EXPECT(sleIssuance->getFieldU64(sfOutstandingAmount) == f.sharesLender);
@@ -6482,7 +6482,7 @@ class Vault_test : public beast::unit_test::Suite
         auto const vaultAfter = env.le(vaultKey);
         if (!BEAST_EXPECT(vaultAfter))
             return;
-        auto const issuanceAfter = env.le(keylet::mptIssuance(f.shareAsset));
+        auto const issuanceAfter = env.le(keylet::mptokenIssuance(f.shareAsset));
         if (!BEAST_EXPECT(issuanceAfter))
             return;
 
@@ -6580,7 +6580,7 @@ class Vault_test : public beast::unit_test::Suite
         auto const vaultAfter = env.le(vaultKey);
         if (!BEAST_EXPECT(vaultAfter))
             return;
-        auto const issuanceAfter = env.le(keylet::mptIssuance(f.shareAsset));
+        auto const issuanceAfter = env.le(keylet::mptokenIssuance(f.shareAsset));
         if (!BEAST_EXPECT(issuanceAfter))
             return;
         BEAST_EXPECT(issuanceAfter->getFieldU64(sfOutstandingAmount) == f.sharesLender);
@@ -6671,7 +6671,7 @@ class Vault_test : public beast::unit_test::Suite
         auto const vaultFinal = env.le(vaultKey);
         if (!BEAST_EXPECT(vaultFinal))
             return;
-        auto const issuanceFinal = env.le(keylet::mptIssuance(f.shareAsset));
+        auto const issuanceFinal = env.le(keylet::mptokenIssuance(f.shareAsset));
         if (!BEAST_EXPECT(issuanceFinal))
             return;
 
@@ -6753,7 +6753,7 @@ class Vault_test : public beast::unit_test::Suite
         auto const vaultFinal = env.le(vaultKeylet);
         if (!BEAST_EXPECT(vaultFinal))
             return;
-        auto const issuanceFinal = env.le(keylet::mptIssuance(shareAsset));
+        auto const issuanceFinal = env.le(keylet::mptokenIssuance(shareAsset));
         if (!BEAST_EXPECT(issuanceFinal))
             return;
         BEAST_EXPECT(issuanceFinal->getFieldU64(sfOutstandingAmount) == 0);
@@ -6836,7 +6836,7 @@ class Vault_test : public beast::unit_test::Suite
         auto const vaultAfter = env.le(vaultKey);
         if (!BEAST_EXPECT(vaultAfter))
             return;
-        auto const issuanceAfter = env.le(keylet::mptIssuance(f.shareAsset));
+        auto const issuanceAfter = env.le(keylet::mptokenIssuance(f.shareAsset));
         if (!BEAST_EXPECT(issuanceAfter))
             return;
 
@@ -7355,7 +7355,7 @@ class Vault_test : public beast::unit_test::Suite
             auto const sleVault = env.le(vaultKeylet);
             if (!sleVault)
                 return std::nullopt;
-            auto const sleIssuance = env.le(keylet::mptIssuance(sleVault->at(sfShareMPTID)));
+            auto const sleIssuance = env.le(keylet::mptokenIssuance(sleVault->at(sfShareMPTID)));
             if (!sleIssuance || !sleIssuance->isFieldPresent(sfReferenceHolding))
                 return std::nullopt;
             return sleIssuance->getFieldH256(sfReferenceHolding);
@@ -7415,13 +7415,13 @@ class Vault_test : public beast::unit_test::Suite
             auto const sleVault = env.le(keylet);
             BEAST_EXPECT(sleVault != nullptr);
             auto const pseudoId = sleVault->at(sfAccount);
-            auto const expected = keylet::line(pseudoId, asset.raw().get<Issue>()).key;
+            auto const expected = keylet::trustLine(pseudoId, asset.raw().get<Issue>()).key;
 
             auto const stored = readReferenceHolding(env, keylet);
             BEAST_EXPECT(stored.has_value());
             BEAST_EXPECT(stored && *stored == expected);
             // The pointed-to RippleState must actually exist.
-            BEAST_EXPECT(env.le(keylet::line(pseudoId, asset.raw().get<Issue>())) != nullptr);
+            BEAST_EXPECT(env.le(keylet::trustLine(pseudoId, asset.raw().get<Issue>())) != nullptr);
         }
 
         // XRP-backed vaults leave the field absent: XRP has no separate
@@ -7479,7 +7479,7 @@ class Vault_test : public beast::unit_test::Suite
             mptt.create({.flags = tfMPTCanTransfer | tfMPTCanLock});
             env.close();
 
-            auto const sleIssuance = env.le(keylet::mptIssuance(mptt.issuanceID()));
+            auto const sleIssuance = env.le(keylet::mptokenIssuance(mptt.issuanceID()));
             if (BEAST_EXPECT(sleIssuance))
                 BEAST_EXPECT(!sleIssuance->isFieldPresent(sfReferenceHolding));
         }
@@ -7505,7 +7505,7 @@ class Vault_test : public beast::unit_test::Suite
             auto const sleVault = env.le(vaultKeylet);
             if (!sleVault)
                 return false;
-            auto const sleIssuance = env.le(keylet::mptIssuance(sleVault->at(sfShareMPTID)));
+            auto const sleIssuance = env.le(keylet::mptokenIssuance(sleVault->at(sfShareMPTID)));
             if (!sleIssuance || !sleIssuance->isFieldPresent(sfReferenceHolding))
                 return false;
             auto const holdingKey = sleIssuance->getFieldH256(sfReferenceHolding);
@@ -7741,7 +7741,7 @@ class Vault_test : public beast::unit_test::Suite
 
             BEAST_EXPECT(env.le(keylet) == nullptr);
             BEAST_EXPECT(env.le(holdingKeylet) == nullptr);
-            BEAST_EXPECT(env.le(keylet::mptIssuance(sharedMptId)) == nullptr);
+            BEAST_EXPECT(env.le(keylet::mptokenIssuance(sharedMptId)) == nullptr);
         }
     }
 
diff --git a/src/test/jtx/impl/Env.cpp b/src/test/jtx/impl/Env.cpp
index 707e1338a7..db45deb6de 100644
--- a/src/test/jtx/impl/Env.cpp
+++ b/src/test/jtx/impl/Env.cpp
@@ -213,7 +213,7 @@ Env::balance(Account const& account, Asset const& asset) const
         [&](Issue const& issue) -> PrettyAmount {
             if (isXRP(issue.currency))
                 return balance(account);
-            auto const sle = le(keylet::line(account.id(), issue));
+            auto const sle = le(keylet::trustLine(account.id(), issue));
             if (!sle)
                 return {STAmount(issue, 0), account.name()};
             auto amount = sle->getFieldAmount(sfBalance);
@@ -231,7 +231,7 @@ Env::balance(Account const& account, Asset const& asset) const
             if (account.id() == issuer)
             {
                 // Issuer balance
-                auto const sle = le(keylet::mptIssuance(id));
+                auto const sle = le(keylet::mptokenIssuance(id));
                 if (!sle)
                     return {STAmount(mptIssue, 0), account.name()};
 
@@ -253,7 +253,7 @@ Env::balance(Account const& account, Asset const& asset) const
 PrettyAmount
 Env::limit(Account const& account, Issue const& issue) const
 {
-    auto const sle = le(keylet::line(account.id(), issue));
+    auto const sle = le(keylet::trustLine(account.id(), issue));
     if (!sle)
         return {STAmount(issue, 0), account.name()};
     auto const aHigh = account.id() > issue.account;
diff --git a/src/test/jtx/impl/TestHelpers.cpp b/src/test/jtx/impl/TestHelpers.cpp
index a8ec899c8a..95c8a68436 100644
--- a/src/test/jtx/impl/TestHelpers.cpp
+++ b/src/test/jtx/impl/TestHelpers.cpp
@@ -338,7 +338,7 @@ xrpMinusFee(Env const& env, std::int64_t xrpAmount)
 [[nodiscard]] bool
 expectHolding(Env& env, AccountID const& account, STAmount const& value, bool defaultLimits)
 {
-    if (auto const sle = env.le(keylet::line(account, value.get<Issue>())))
+    if (auto const sle = env.le(keylet::trustLine(account, value.get<Issue>())))
     {
         Issue const issue = value.get<Issue>();
         bool const accountLow = account < issue.account;
@@ -368,7 +368,7 @@ expectHolding(Env& env, AccountID const& account, STAmount const& value, bool de
 [[nodiscard]] bool
 expectHolding(Env& env, AccountID const& account, None const&, Issue const& issue)
 {
-    return !env.le(keylet::line(account, issue));
+    return !env.le(keylet::trustLine(account, issue));
 }
 
 [[nodiscard]] bool
@@ -388,7 +388,7 @@ expectHolding(Env& env, AccountID const& account, None const& value)
 [[nodiscard]] bool
 expectMPT(Env& env, AccountID const& account, STAmount const& value)
 {
-    auto const mptIssuanceID = keylet::mptIssuance(value.asset().get<MPTIssue>());
+    auto const mptIssuanceID = keylet::mptokenIssuance(value.asset().get<MPTIssue>());
     auto const mptToken = env.le(keylet::mptoken(mptIssuanceID.key, account));
     return mptToken && (*mptToken)[sfMPTAmount] == value.mpt().value();
 }
@@ -553,7 +553,7 @@ claim(
 uint256
 channel(AccountID const& account, AccountID const& dst, std::uint32_t seqProxyValue)
 {
-    auto const k = keylet::payChan(account, dst, seqProxyValue);
+    auto const k = keylet::payChannel(account, dst, seqProxyValue);
     return k.key;
 }
 
diff --git a/src/test/jtx/impl/balance.cpp b/src/test/jtx/impl/balance.cpp
index ddb45a8a97..9d1b812641 100644
--- a/src/test/jtx/impl/balance.cpp
+++ b/src/test/jtx/impl/balance.cpp
@@ -36,7 +36,7 @@ doBalance(Env& env, AccountID const& account, bool kNone, STAmount const& value,
     }
     else
     {
-        auto const sle = env.le(keylet::line(account, issue));
+        auto const sle = env.le(keylet::trustLine(account, issue));
         if (kNone)
         {
             TEST_EXPECT(!sle);
diff --git a/src/test/jtx/impl/mpt.cpp b/src/test/jtx/impl/mpt.cpp
index 7da3305eec..84c5b5fbec 100644
--- a/src/test/jtx/impl/mpt.cpp
+++ b/src/test/jtx/impl/mpt.cpp
@@ -201,8 +201,8 @@ MPTTester::create(MPTCreate const& arg)
     if (!isTesSuccess(submit(arg, jv)))
     {
         // Verify issuance doesn't exist
-        env_.require(
-            RequireAny([&]() -> bool { return env_.le(keylet::mptIssuance(*id_)) == nullptr; }));
+        env_.require(RequireAny(
+            [&]() -> bool { return env_.le(keylet::mptokenIssuance(*id_)) == nullptr; }));
 
         id_.reset();
     }
@@ -465,7 +465,7 @@ MPTTester::forObject(
 {
     if (!id_)
         Throw<std::runtime_error>("MPT has not been created");
-    auto const key = holder ? keylet::mptoken(*id_, holder->id()) : keylet::mptIssuance(*id_);
+    auto const key = holder ? keylet::mptoken(*id_, holder->id()) : keylet::mptokenIssuance(*id_);
     if (auto const sle = env_.le(key))
         return cb(sle);
     return false;
@@ -630,7 +630,7 @@ MPTTester::getBalance(Account const& account) const
         Throw<std::runtime_error>("MPT has not been created");
     if (account == issuer_)
     {
-        if (auto const sle = env_.le(keylet::mptIssuance(*id_)))
+        if (auto const sle = env_.le(keylet::mptokenIssuance(*id_)))
             return sle->getFieldU64(sfOutstandingAmount);
     }
     else
diff --git a/src/test/rpc/AccountTx_test.cpp b/src/test/rpc/AccountTx_test.cpp
index 421f6bd1fa..bd7b07e936 100644
--- a/src/test/rpc/AccountTx_test.cpp
+++ b/src/test/rpc/AccountTx_test.cpp
@@ -589,7 +589,7 @@ class AccountTx_test : public beast::unit_test::Suite
             env(payChanCreate, Sig(alie));
             env.close();
 
-            std::string const payChanIndex{strHex(keylet::payChan(alice, gw, payChanSeq).key)};
+            std::string const payChanIndex{strHex(keylet::payChannel(alice, gw, payChanSeq).key)};
 
             {
                 json::Value payChanFund;
diff --git a/src/test/rpc/LedgerEntry_test.cpp b/src/test/rpc/LedgerEntry_test.cpp
index dd9eb1c119..14908cf72a 100644
--- a/src/test/rpc/LedgerEntry_test.cpp
+++ b/src/test/rpc/LedgerEntry_test.cpp
@@ -1476,7 +1476,7 @@ class LedgerEntry_test : public beast::unit_test::Suite
 
         // positive test
         {
-            Keylet const keylet = keylet::fees();
+            Keylet const keylet = keylet::feeSettings();
             json::Value jvParams;
             jvParams[jss::fee] = to_string(keylet.key);
             json::Value const jrr =
@@ -1526,7 +1526,7 @@ class LedgerEntry_test : public beast::unit_test::Suite
         uint256 const nftokenID0 = token::getNextID(env, issuer, 0, tfTransferable);
         env(token::mint(issuer, 0), Txflags(tfTransferable));
         env.close();
-        uint256 const offerID = keylet::nftoffer(issuer, env.seq(issuer)).key;
+        uint256 const offerID = keylet::nftokenOffer(issuer, env.seq(issuer)).key;
         env(token::createOffer(issuer, nftokenID0, drops(1)),
             token::Destination(buyer),
             Txflags(tfSellNFToken));
@@ -1560,7 +1560,7 @@ class LedgerEntry_test : public beast::unit_test::Suite
         env(token::mint(issuer, 0), Txflags(tfTransferable));
         env.close();
 
-        auto const nftpage = keylet::nftpageMax(issuer);
+        auto const nftpage = keylet::nftokenPageMax(issuer);
         BEAST_EXPECT(env.le(nftpage) != nullptr);
 
         {
@@ -1710,7 +1710,7 @@ class LedgerEntry_test : public beast::unit_test::Suite
 
         std::string const ledgerHash{to_string(env.closed()->header().hash)};
 
-        uint256 const payChanIndex{keylet::payChan(alice, env.master, env.seq(alice) - 1).key};
+        uint256 const payChanIndex{keylet::payChannel(alice, env.master, env.seq(alice) - 1).key};
         {
             // Request the payment channel using its index.
             json::Value jvParams;
@@ -2421,7 +2421,7 @@ class LedgerEntry_test : public beast::unit_test::Suite
         };
 
         test(jss::amendments, jss::Amendments, keylet::amendments(), true);
-        test(jss::fee, jss::FeeSettings, keylet::fees(), true);
+        test(jss::fee, jss::FeeSettings, keylet::feeSettings(), true);
         // There won't be an nunl
         test(jss::nunl, jss::NegativeUNL, keylet::negativeUNL(), false);
         // Can only get the short skip list this way
diff --git a/src/test/rpc/Subscribe_test.cpp b/src/test/rpc/Subscribe_test.cpp
index 5c519f3869..97c5290947 100644
--- a/src/test/rpc/Subscribe_test.cpp
+++ b/src/test/rpc/Subscribe_test.cpp
@@ -1452,12 +1452,12 @@ public:
             // Alice creates one sell offer for each NFT
             // Verify the offer indexes are correct in the NFTokenCreateOffer tx
             // meta
-            uint256 const aliceOfferIndex1 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex1 = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId1, drops(1)), Txflags(tfSellNFToken));
             BEAST_EXPECT(env.syncClose());
             verifyNFTokenOfferID(aliceOfferIndex1);
 
-            uint256 const aliceOfferIndex2 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex2 = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId2, drops(1)), Txflags(tfSellNFToken));
             BEAST_EXPECT(env.syncClose());
             verifyNFTokenOfferID(aliceOfferIndex2);
@@ -1471,7 +1471,7 @@ public:
 
             // Bobs creates a buy offer for nftId1
             // Verify the offer id is correct in the NFTokenCreateOffer tx meta
-            auto const bobBuyOfferIndex = keylet::nftoffer(bob, env.seq(bob)).key;
+            auto const bobBuyOfferIndex = keylet::nftokenOffer(bob, env.seq(bob)).key;
             env(token::createOffer(bob, nftId1, drops(1)), token::Owner(alice));
             BEAST_EXPECT(env.syncClose());
             verifyNFTokenOfferID(bobBuyOfferIndex);
@@ -1492,7 +1492,7 @@ public:
             verifyNFTokenID(nftId);
 
             // Alice creates sell offer and set broker as destination
-            uint256 const offerAliceToBroker = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const offerAliceToBroker = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId, drops(1)),
                 token::Destination(broker),
                 Txflags(tfSellNFToken));
@@ -1500,7 +1500,7 @@ public:
             verifyNFTokenOfferID(offerAliceToBroker);
 
             // Bob creates buy offer
-            uint256 const offerBobToBroker = keylet::nftoffer(bob, env.seq(bob)).key;
+            uint256 const offerBobToBroker = keylet::nftokenOffer(bob, env.seq(bob)).key;
             env(token::createOffer(bob, nftId, drops(1)), token::Owner(alice));
             BEAST_EXPECT(env.syncClose());
             verifyNFTokenOfferID(offerBobToBroker);
@@ -1521,12 +1521,12 @@ public:
             verifyNFTokenID(nftId);
 
             // Alice creates 2 sell offers for the same NFT
-            uint256 const aliceOfferIndex1 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex1 = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId, drops(1)), Txflags(tfSellNFToken));
             BEAST_EXPECT(env.syncClose());
             verifyNFTokenOfferID(aliceOfferIndex1);
 
-            uint256 const aliceOfferIndex2 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceOfferIndex2 = keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::createOffer(alice, nftId, drops(1)), Txflags(tfSellNFToken));
             BEAST_EXPECT(env.syncClose());
             verifyNFTokenOfferID(aliceOfferIndex2);
@@ -1540,7 +1540,8 @@ public:
 
         if (features[featureNFTokenMintOffer])
         {
-            uint256 const aliceMintWithOfferIndex1 = keylet::nftoffer(alice, env.seq(alice)).key;
+            uint256 const aliceMintWithOfferIndex1 =
+                keylet::nftokenOffer(alice, env.seq(alice)).key;
             env(token::mint(alice), token::Amount(XRP(0)));
             BEAST_EXPECT(env.syncClose());
             verifyNFTokenOfferID(aliceMintWithOfferIndex1);
diff --git a/src/tests/libxrpl/helpers/TxTest.cpp b/src/tests/libxrpl/helpers/TxTest.cpp
index aeaa805b27..86e36b8abf 100644
--- a/src/tests/libxrpl/helpers/TxTest.cpp
+++ b/src/tests/libxrpl/helpers/TxTest.cpp
@@ -231,13 +231,13 @@ TxTest::getCloseTime() const
 STAmount
 TxTest::getBalance(AccountID const& account, IOU const& iou) const
 {
-    auto const sle = openLedger_->read(keylet::line(account, iou.issue()));
+    auto const sle = openLedger_->read(keylet::trustLine(account, iou.issue()));
     if (!sle)
         return STAmount{iou.issue(), 0};
 
-    auto const rippleState = ledger_entries::RippleState{sle};
+    auto const trustLine = ledger_entries::RippleState{sle};
 
-    auto balance = rippleState.getBalance();
+    auto balance = trustLine.getBalance();
     if (iou.issue().account == account)
     {
         throw std::logic_error("TxTest::getBalance: account is issuer");
diff --git a/src/tests/libxrpl/tx/AccountSet.cpp b/src/tests/libxrpl/tx/AccountSet.cpp
index 726e6e9024..46b298dde8 100644
--- a/src/tests/libxrpl/tx/AccountSet.cpp
+++ b/src/tests/libxrpl/tx/AccountSet.cpp
@@ -619,7 +619,7 @@ TEST(AccountSet, Ticket)
     // Verify alice has 1 owner object (the ticket)
     EXPECT_EQ(env.getAccountRoot(alice.id()).getOwnerCount(), 1u);
     // Verify ticket exists
-    EXPECT_TRUE(env.getClosedLedger().exists(keylet::kTicket(alice.id(), ticketSeq)));
+    EXPECT_TRUE(env.getClosedLedger().exists(keylet::ticket(alice.id(), ticketSeq)));
 
     // Try using a ticket that alice doesn't have
     EXPECT_EQ(
@@ -629,7 +629,7 @@ TEST(AccountSet, Ticket)
     env.close();
 
     // Verify ticket still exists
-    EXPECT_TRUE(env.getClosedLedger().exists(keylet::kTicket(alice.id(), ticketSeq)));
+    EXPECT_TRUE(env.getClosedLedger().exists(keylet::ticket(alice.id(), ticketSeq)));
 
     // Get alice's sequence before using the ticket
     std::uint32_t const aliceSeq = env.getAccountRoot(alice.id()).getSequence();
@@ -642,7 +642,7 @@ TEST(AccountSet, Ticket)
 
     // Verify ticket is consumed (no owner objects)
     EXPECT_EQ(env.getAccountRoot(alice.id()).getOwnerCount(), 0u);
-    EXPECT_FALSE(env.getClosedLedger().exists(keylet::kTicket(alice.id(), ticketSeq)));
+    EXPECT_FALSE(env.getClosedLedger().exists(keylet::ticket(alice.id(), ticketSeq)));
 
     // Verify alice's sequence did NOT advance (ticket use doesn't increment seq)
     EXPECT_EQ(env.getAccountRoot(alice.id()).getSequence(), aliceSeq);
diff --git a/src/xrpld/app/ledger/detail/BuildLedger.cpp b/src/xrpld/app/ledger/detail/BuildLedger.cpp
index 2a4121ede9..2eb64ecaf9 100644
--- a/src/xrpld/app/ledger/detail/BuildLedger.cpp
+++ b/src/xrpld/app/ledger/detail/BuildLedger.cpp
@@ -73,7 +73,7 @@ buildLedgerImpl(
 
     // Accept ledger
     XRPL_ASSERT(
-        built->header().seq < kXrpLedgerEarliestFees || built->read(keylet::fees()),
+        built->header().seq < kXrpLedgerEarliestFees || built->read(keylet::feeSettings()),
         "xrpl::buildLedgerImpl : valid ledger fees");
     built->setAccepted(closeTime, closeResolution, closeTimeCorrect);
 
diff --git a/src/xrpld/app/ledger/detail/InboundLedger.cpp b/src/xrpld/app/ledger/detail/InboundLedger.cpp
index 5a9f24cc2e..e4df126ee8 100644
--- a/src/xrpld/app/ledger/detail/InboundLedger.cpp
+++ b/src/xrpld/app/ledger/detail/InboundLedger.cpp
@@ -109,7 +109,7 @@ InboundLedger::init(ScopedLockType& collectionLock)
     JLOG(journal_.debug()) << "Acquiring ledger we already have in "
                            << " local store. " << hash_;
     XRPL_ASSERT(
-        ledger_->header().seq < kXrpLedgerEarliestFees || ledger_->read(keylet::fees()),
+        ledger_->header().seq < kXrpLedgerEarliestFees || ledger_->read(keylet::feeSettings()),
         "xrpl::InboundLedger::init : valid ledger fees");
     ledger_->setImmutable();
 
@@ -331,7 +331,7 @@ InboundLedger::tryDB(NodeStore::Database& srcDB)
         JLOG(journal_.debug()) << "Had everything locally";
         complete_ = true;
         XRPL_ASSERT(
-            ledger_->header().seq < kXrpLedgerEarliestFees || ledger_->read(keylet::fees()),
+            ledger_->header().seq < kXrpLedgerEarliestFees || ledger_->read(keylet::feeSettings()),
             "xrpl::InboundLedger::tryDB : valid ledger fees");
         ledger_->setImmutable();
     }
@@ -427,7 +427,7 @@ InboundLedger::done()
     if (complete_ && !failed_ && ledger_)
     {
         XRPL_ASSERT(
-            ledger_->header().seq < kXrpLedgerEarliestFees || ledger_->read(keylet::fees()),
+            ledger_->header().seq < kXrpLedgerEarliestFees || ledger_->read(keylet::feeSettings()),
             "xrpl::InboundLedger::done : valid ledger fees");
         ledger_->setImmutable();
         switch (reason_)
diff --git a/src/xrpld/app/ledger/detail/LedgerPersistence.cpp b/src/xrpld/app/ledger/detail/LedgerPersistence.cpp
index 579f66063c..3561b66951 100644
--- a/src/xrpld/app/ledger/detail/LedgerPersistence.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerPersistence.cpp
@@ -122,7 +122,7 @@ finishLoadByIndexOrHash(std::shared_ptr<Ledger> const& ledger, beast::Journal j)
         return;
 
     XRPL_ASSERT(
-        ledger->header().seq < kXrpLedgerEarliestFees || ledger->read(keylet::fees()),
+        ledger->header().seq < kXrpLedgerEarliestFees || ledger->read(keylet::feeSettings()),
         "xrpl::finishLoadByIndexOrHash : valid ledger fees");
     ledger->setImmutable();
 
diff --git a/src/xrpld/app/ledger/detail/LocalTxs.cpp b/src/xrpld/app/ledger/detail/LocalTxs.cpp
index d843acfe44..5bfe8684f0 100644
--- a/src/xrpld/app/ledger/detail/LocalTxs.cpp
+++ b/src/xrpld/app/ledger/detail/LocalTxs.cpp
@@ -163,7 +163,7 @@ public:
 
             // Ticket should have been created by now.  Remove if ticket
             // does not exist.
-            return !view.exists(keylet::kTicket(acctID, seqProx));
+            return !view.exists(keylet::ticket(acctID, seqProx));
         });
     }
 
diff --git a/src/xrpld/app/main/Application.cpp b/src/xrpld/app/main/Application.cpp
index c2fb78ce79..08d84636f6 100644
--- a/src/xrpld/app/main/Application.cpp
+++ b/src/xrpld/app/main/Application.cpp
@@ -1681,7 +1681,7 @@ ApplicationImp::startGenesisLedger()
     auto const next = std::make_shared<Ledger>(*genesis, getTimeKeeper().closeTime());
     next->updateSkipList();
     XRPL_ASSERT(
-        next->header().seq < kXrpLedgerEarliestFees || next->read(keylet::fees()),
+        next->header().seq < kXrpLedgerEarliestFees || next->read(keylet::feeSettings()),
         "xrpl::ApplicationImp::startGenesisLedger : valid ledger fees");
     next->setImmutable();
     openLedger_.emplace(next, cachedSLEs_, logs_->journal("OpenLedger"));
@@ -1703,7 +1703,7 @@ ApplicationImp::getLastFullLedger()
             return ledger;
 
         XRPL_ASSERT(
-            ledger->header().seq < kXrpLedgerEarliestFees || ledger->read(keylet::fees()),
+            ledger->header().seq < kXrpLedgerEarliestFees || ledger->read(keylet::feeSettings()),
             "xrpl::ApplicationImp::getLastFullLedger : valid ledger fees");
         ledger->setImmutable();
 
@@ -1854,7 +1854,8 @@ ApplicationImp::loadLedgerFromFile(std::string const& name)
         loadLedger->stateMap().flushDirty(NodeObjectType::AccountNode);
 
         XRPL_ASSERT(
-            loadLedger->header().seq < kXrpLedgerEarliestFees || loadLedger->read(keylet::fees()),
+            loadLedger->header().seq < kXrpLedgerEarliestFees ||
+                loadLedger->read(keylet::feeSettings()),
             "xrpl::ApplicationImp::loadLedgerFromFile : valid ledger fees");
         loadLedger->setAccepted(closeTime, closeTimeResolution, !closeTimeEstimated);
 
diff --git a/src/xrpld/app/misc/detail/TxQ.cpp b/src/xrpld/app/misc/detail/TxQ.cpp
index 0326828a70..9022095ea8 100644
--- a/src/xrpld/app/misc/detail/TxQ.cpp
+++ b/src/xrpld/app/misc/detail/TxQ.cpp
@@ -760,7 +760,7 @@ TxQ::apply(
     // If the transaction needs a Ticket is that Ticket in the ledger?
     SeqProxy const acctSeqProx = SeqProxy::sequence((*sleAccount)[sfSequence]);
     SeqProxy const txSeqProx = tx->getSeqProxy();
-    if (txSeqProx.isTicket() && !view.exists(keylet::kTicket(account, txSeqProx)))
+    if (txSeqProx.isTicket() && !view.exists(keylet::ticket(account, txSeqProx)))
     {
         if (txSeqProx.value() < acctSeqProx.value())
         {
diff --git a/src/xrpld/rpc/detail/AssetCache.cpp b/src/xrpld/rpc/detail/AssetCache.cpp
index 23cc31252d..e29f5659f9 100644
--- a/src/xrpld/rpc/detail/AssetCache.cpp
+++ b/src/xrpld/rpc/detail/AssetCache.cpp
@@ -136,7 +136,7 @@ AssetCache::getMPTs(xrpl::AccountID const& account)
             auto const mptID = sle->getFieldH192(sfMPTokenIssuanceID);
             bool const zeroBalance = sle->at(sfMPTAmount) == 0;
             bool const maxedOut = [&] {
-                if (auto const sleIssuance = ledger_->read(keylet::mptIssuance(mptID)))
+                if (auto const sleIssuance = ledger_->read(keylet::mptokenIssuance(mptID)))
                 {
                     return sleIssuance->at(sfOutstandingAmount) == maxMPTAmount(*sleIssuance);
                 }
diff --git a/src/xrpld/rpc/detail/Pathfinder.cpp b/src/xrpld/rpc/detail/Pathfinder.cpp
index e1a2a4acf6..d7566622e8 100644
--- a/src/xrpld/rpc/detail/Pathfinder.cpp
+++ b/src/xrpld/rpc/detail/Pathfinder.cpp
@@ -951,7 +951,7 @@ Pathfinder::isNoRipple(
     AccountID const& toAccount,
     Currency const& currency)
 {
-    auto sleRipple = ledger_->read(keylet::line(toAccount, fromAccount, currency));
+    auto sleRipple = ledger_->read(keylet::trustLine(toAccount, fromAccount, currency));
 
     auto const flag((toAccount > fromAccount) ? lsfHighNoRipple : lsfLowNoRipple);
 
diff --git a/src/xrpld/rpc/detail/RPCHelpers.cpp b/src/xrpld/rpc/detail/RPCHelpers.cpp
index 7ab2468b75..1764375812 100644
--- a/src/xrpld/rpc/detail/RPCHelpers.cpp
+++ b/src/xrpld/rpc/detail/RPCHelpers.cpp
@@ -86,7 +86,7 @@ isRelatedToAccount(ReadView const& ledger, SLE::const_ref sle, AccountID const&
     }
     if (sle->getType() == ltSIGNER_LIST)
     {
-        Keylet const accountSignerList = keylet::signers(accountID);
+        Keylet const accountSignerList = keylet::signerList(accountID);
         return sle->key() == accountSignerList.key;
     }
     if (sle->getType() == ltNFTOKEN_OFFER)
diff --git a/src/xrpld/rpc/handlers/VaultInfo.cpp b/src/xrpld/rpc/handlers/VaultInfo.cpp
index 2c00205131..b6d2fe259f 100644
--- a/src/xrpld/rpc/handlers/VaultInfo.cpp
+++ b/src/xrpld/rpc/handlers/VaultInfo.cpp
@@ -79,7 +79,7 @@ doVaultInfo(RPC::JsonContext& context)
     auto const sleVault = lpLedger->read(keylet::vault(uNodeIndex));
     auto const sleIssuance = sleVault == nullptr  //
         ? nullptr
-        : lpLedger->read(keylet::mptIssuance(sleVault->at(sfShareMPTID)));
+        : lpLedger->read(keylet::mptokenIssuance(sleVault->at(sfShareMPTID)));
     if (!sleVault || !sleIssuance)
     {
         jvResult[jss::error] = "entryNotFound";
diff --git a/src/xrpld/rpc/handlers/account/AccountInfo.cpp b/src/xrpld/rpc/handlers/account/AccountInfo.cpp
index d0f45cbc6f..fba48ea93e 100644
--- a/src/xrpld/rpc/handlers/account/AccountInfo.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountInfo.cpp
@@ -222,7 +222,7 @@ doAccountInfo(RPC::JsonContext& context)
 
             // This code will need to be revisited if in the future we support
             // multiple SignerLists on one account.
-            auto const sleSigners = ledger->read(keylet::signers(accountID));
+            auto const sleSigners = ledger->read(keylet::signerList(accountID));
             if (sleSigners)
                 jvSignerList.append(sleSigners->getJson(JsonOptions::Values::None));
 
diff --git a/src/xrpld/rpc/handlers/account/AccountNFTs.cpp b/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
index 0eb91206f3..0249963908 100644
--- a/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
@@ -74,8 +74,8 @@ doAccountNFTs(RPC::JsonContext& context)
             return RPC::invalidFieldError(jss::marker);
     }
 
-    auto const first = keylet::nftpage(keylet::nftpageMin(accountID), marker);
-    auto const last = keylet::nftpageMax(accountID);
+    auto const first = keylet::nftokenPage(keylet::nftokenPageMin(accountID), marker);
+    auto const last = keylet::nftokenPageMax(accountID);
 
     auto cp = ledger->read(
         Keylet(ltNFTOKEN_PAGE, ledger->succ(first.key, last.key.next()).value_or(last.key)));
@@ -134,7 +134,7 @@ doAccountNFTs(RPC::JsonContext& context)
                 obj[sfFlags.jsonName] = nft::getFlags(nftokenID);
                 obj[sfIssuer.jsonName] = to_string(nft::getIssuer(nftokenID));
                 obj[sfNFTokenTaxon.jsonName] = nft::toUInt32(nft::getTaxon(nftokenID));
-                obj[jss::nft_serial] = nft::getSerial(nftokenID);
+                obj[jss::nft_serial] = nft::getSequence(nftokenID);
                 if (std::uint16_t const xferFee = {nft::getTransferFee(nftokenID)})
                     obj[sfTransferFee.jsonName] = xferFee;
             }
diff --git a/src/xrpld/rpc/handlers/account/AccountObjects.cpp b/src/xrpld/rpc/handlers/account/AccountObjects.cpp
index 08a7fbe44a..8375feb4e7 100644
--- a/src/xrpld/rpc/handlers/account/AccountObjects.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountObjects.cpp
@@ -61,7 +61,7 @@ getAccountObjects(
         (!typeFilter.has_value() || typeMatchesFilter(typeFilter.value(), ltNFTOKEN_PAGE)) &&
         dirIndex.isZero();
 
-    Keylet const firstNFTPage = keylet::nftpageMin(account);
+    Keylet const firstNFTPage = keylet::nftokenPageMin(account);
 
     // we need to check the marker to see if it is an NFTTokenPage index.
     if (iterateNFTPages && entryIndex.isNonZero())
@@ -85,7 +85,7 @@ getAccountObjects(
         Keylet const first =
             entryIndex.isZero() ? firstNFTPage : Keylet{ltNFTOKEN_PAGE, entryIndex};
 
-        Keylet const last = keylet::nftpageMax(account);
+        Keylet const last = keylet::nftokenPageMax(account);
 
         auto currentKey = ledger.succ(first.key, last.key.next()).value_or(last.key);
 
diff --git a/src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp b/src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp
index 236712f0c2..2dd7ae34d4 100644
--- a/src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp
+++ b/src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp
@@ -82,7 +82,7 @@ parseIndex(json::Value const& params, json::StaticString const fieldName, unsign
         if (index == jss::amendments.cStr())
             return keylet::amendments().key;
         if (index == jss::fee.cStr())
-            return keylet::fees().key;
+            return keylet::feeSettings().key;
         if (index == jss::nunl)
             return keylet::negativeUNL().key;
         if (index == jss::hashes)
@@ -434,7 +434,7 @@ parseEscrow(
     return keylet::escrow(*id, *seq).key;
 }
 
-auto const parseFeeSettings = fixed(keylet::fees());
+auto const parseFeeSettings = fixed(keylet::feeSettings());
 
 static std::expected<uint256, json::Value>
 parseFixed(
@@ -493,7 +493,7 @@ parseLoanBroker(
     if (!seq)
         return std::unexpected(seq.error());
 
-    return keylet::loanbroker(*id, *seq).key;
+    return keylet::loanBroker(*id, *seq).key;
 }
 
 static std::expected<uint256, json::Value>
@@ -555,7 +555,7 @@ parseMPTokenIssuance(
             "malformedMPTokenIssuance", fieldName, "Hash192");
     }
 
-    return keylet::mptIssuance(*mptIssuanceID).key;
+    return keylet::mptokenIssuance(*mptIssuanceID).key;
 }
 
 static std::expected<uint256, json::Value>
@@ -707,7 +707,7 @@ parseRippleState(
             "malformedCurrency", jss::currency, "Currency");
     }
 
-    return keylet::line(*id1, *id2, uCurrency).key;
+    return keylet::trustLine(*id1, *id2, uCurrency).key;
 }
 
 static std::expected<uint256, json::Value>
diff --git a/src/xrpld/rpc/handlers/orderbook/NFTOffersHelpers.h b/src/xrpld/rpc/handlers/orderbook/NFTOffersHelpers.h
index 8529ec2d2c..42b99a0009 100644
--- a/src/xrpld/rpc/handlers/orderbook/NFTOffersHelpers.h
+++ b/src/xrpld/rpc/handlers/orderbook/NFTOffersHelpers.h
@@ -78,7 +78,7 @@ enumerateNFTOffers(RPC::JsonContext& context, uint256 const& nftId, Keylet const
         if (!startAfter.parseHex(marker.asString()))
             return rpcError(RpcInvalidParams);
 
-        auto const sle = ledger->read(keylet::nftoffer(startAfter));
+        auto const sle = ledger->read(keylet::nftokenOffer(startAfter));
 
         if (!sle || nftId != sle->getFieldH256(sfNFTokenID))
             return rpcError(RpcInvalidParams);

From 12a5d9014ebf2e45cc763688c6d7a58fa4139c82 Mon Sep 17 00:00:00 2001
From: Timothy Banks <timothyaaronbanks@gmail.com>
Date: Fri, 26 Jun 2026 06:24:25 -0400
Subject: [PATCH 014/100] refactor: Retire Clawback amendment (#7353)

---
 include/xrpl/protocol/detail/features.macro   |  2 +-
 .../xrpl/protocol/detail/transactions.macro   |  2 +-
 .../protocol_autogen/transactions/Clawback.h  |  2 +-
 src/libxrpl/ledger/CanonicalTXSet.cpp         |  3 +-
 .../tx/transactors/account/AccountSet.cpp     | 39 +++++------
 src/test/app/Clawback_test.cpp                | 69 -------------------
 src/test/app/Delegate_test.cpp                |  1 -
 src/test/rpc/AccountInfo_test.cpp             | 30 +++-----
 .../rpc/handlers/account/AccountInfo.cpp      |  7 +-
 9 files changed, 36 insertions(+), 119 deletions(-)

diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index 573dca951d..1ccb60d3af 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -64,7 +64,6 @@ XRPL_FEATURE(DID,                        Supported::Yes, VoteBehavior::DefaultNo
 XRPL_FIX    (DisallowIncomingV1,         Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(XChainBridge,               Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(AMM,                        Supported::Yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(Clawback,                   Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(XRPFees,                    Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (RemoveNFTokenAutoTrustLine, Supported::Yes, VoteBehavior::DefaultYes)
 
@@ -116,6 +115,7 @@ XRPL_RETIRE_FIX(UniversalNumber)
 
 XRPL_RETIRE_FEATURE(Checks)
 XRPL_RETIRE_FEATURE(CheckCashMakesTrustLine)
+XRPL_RETIRE_FEATURE(Clawback)
 XRPL_RETIRE_FEATURE(CryptoConditions)
 XRPL_RETIRE_FEATURE(CryptoConditionsSuite)
 XRPL_RETIRE_FEATURE(DeletableAccounts)
diff --git a/include/xrpl/protocol/detail/transactions.macro b/include/xrpl/protocol/detail/transactions.macro
index 450e2558cc..dbaaf46083 100644
--- a/include/xrpl/protocol/detail/transactions.macro
+++ b/include/xrpl/protocol/detail/transactions.macro
@@ -395,7 +395,7 @@ TRANSACTION(ttNFTOKEN_ACCEPT_OFFER, 29, NFTokenAcceptOffer,
 #endif
 TRANSACTION(ttCLAWBACK, 30, Clawback,
     Delegation::Delegable,
-    featureClawback,
+    uint256{},
     NoPriv,
     ({
     {sfAmount, SoeRequired, SoeMptSupported},
diff --git a/include/xrpl/protocol_autogen/transactions/Clawback.h b/include/xrpl/protocol_autogen/transactions/Clawback.h
index bbf1c411f3..ecd7ebe7a2 100644
--- a/include/xrpl/protocol_autogen/transactions/Clawback.h
+++ b/include/xrpl/protocol_autogen/transactions/Clawback.h
@@ -20,7 +20,7 @@ class ClawbackBuilder;
  *
  * Type: ttCLAWBACK (30)
  * Delegable: Delegation::Delegable
- * Amendment: featureClawback
+ * Amendment: uint256{}
  * Privileges: NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
diff --git a/src/libxrpl/ledger/CanonicalTXSet.cpp b/src/libxrpl/ledger/CanonicalTXSet.cpp
index df4e88e346..12cec5e321 100644
--- a/src/libxrpl/ledger/CanonicalTXSet.cpp
+++ b/src/libxrpl/ledger/CanonicalTXSet.cpp
@@ -42,7 +42,8 @@ CanonicalTXSet::accountKey(AccountID const& account)
 void
 CanonicalTXSet::insert(std::shared_ptr<STTx const> txn)
 {
-    Key key(accountKey(txn->getAccountID(sfAccount)), txn->getSeqProxy(), txn->getTransactionID());
+    Key const key(
+        accountKey(txn->getAccountID(sfAccount)), txn->getSeqProxy(), txn->getTransactionID());
     map_.emplace(key, std::move(txn));
 }
 
diff --git a/src/libxrpl/tx/transactors/account/AccountSet.cpp b/src/libxrpl/tx/transactors/account/AccountSet.cpp
index dfe7ec5b5f..f0ad5b113a 100644
--- a/src/libxrpl/tx/transactors/account/AccountSet.cpp
+++ b/src/libxrpl/tx/transactors/account/AccountSet.cpp
@@ -194,30 +194,27 @@ AccountSet::preclaim(PreclaimContext const& ctx)
     //
     // Clawback
     //
-    if (ctx.view.rules().enabled(featureClawback))
+    if (uSetFlag == asfAllowTrustLineClawback)
     {
-        if (uSetFlag == asfAllowTrustLineClawback)
+        if (sle->isFlag(lsfNoFreeze))
         {
-            if (sle->isFlag(lsfNoFreeze))
-            {
-                JLOG(ctx.j.trace()) << "Can't set Clawback if NoFreeze is set";
-                return tecNO_PERMISSION;
-            }
-
-            if (!dirIsEmpty(ctx.view, keylet::ownerDir(id)))
-            {
-                JLOG(ctx.j.trace()) << "Owner directory not empty.";
-                return tecOWNERS;
-            }
+            JLOG(ctx.j.trace()) << "Can't set Clawback if NoFreeze is set";
+            return tecNO_PERMISSION;
         }
-        else if (uSetFlag == asfNoFreeze)
+
+        if (!dirIsEmpty(ctx.view, keylet::ownerDir(id)))
         {
-            // Cannot set NoFreeze if clawback is enabled
-            if (sle->isFlag(lsfAllowTrustLineClawback))
-            {
-                JLOG(ctx.j.trace()) << "Can't set NoFreeze if clawback is enabled";
-                return tecNO_PERMISSION;
-            }
+            JLOG(ctx.j.trace()) << "Owner directory not empty.";
+            return tecOWNERS;
+        }
+    }
+    else if (uSetFlag == asfNoFreeze)
+    {
+        // Cannot set NoFreeze if clawback is enabled
+        if (sle->isFlag(lsfAllowTrustLineClawback))
+        {
+            JLOG(ctx.j.trace()) << "Can't set NoFreeze if clawback is enabled";
+            return tecNO_PERMISSION;
         }
     }
 
@@ -576,7 +573,7 @@ AccountSet::doApply()
     }
 
     // Set flag for clawback
-    if (ctx_.view().rules().enabled(featureClawback) && uSetFlag == asfAllowTrustLineClawback)
+    if (uSetFlag == asfAllowTrustLineClawback)
     {
         JLOG(j_.trace()) << "set allow clawback";
         uFlagsOut |= lsfAllowTrustLineClawback;
diff --git a/src/test/app/Clawback_test.cpp b/src/test/app/Clawback_test.cpp
index b1a756382d..2dadd9f503 100644
--- a/src/test/app/Clawback_test.cpp
+++ b/src/test/app/Clawback_test.cpp
@@ -161,35 +161,6 @@ class Clawback_test : public beast::unit_test::Suite
             BEAST_EXPECT(ownerCount(env, alice) == 0);
             BEAST_EXPECT(ownerCount(env, bob) == 0);
         }
-
-        // Test that one cannot enable asfAllowTrustLineClawback when
-        // featureClawback amendment is disabled
-        {
-            Env env(*this, features - featureClawback);
-
-            Account const alice{"alice"};
-
-            env.fund(XRP(1000), alice);
-            env.close();
-
-            env.require(Nflags(alice, asfAllowTrustLineClawback));
-
-            // alice attempts to set asfAllowTrustLineClawback flag while
-            // amendment is disabled. no error is returned, but the flag remains
-            // to be unset.
-            env(fset(alice, asfAllowTrustLineClawback));
-            env.close();
-            env.require(Nflags(alice, asfAllowTrustLineClawback));
-
-            // now enable clawback amendment
-            env.enableFeature(featureClawback);
-            env.close();
-
-            // asfAllowTrustLineClawback can be set
-            env(fset(alice, asfAllowTrustLineClawback));
-            env.close();
-            env.require(Flags(alice, asfAllowTrustLineClawback));
-        }
     }
 
     void
@@ -198,46 +169,6 @@ class Clawback_test : public beast::unit_test::Suite
         testcase("Validation");
         using namespace test::jtx;
 
-        // Test that Clawback tx fails for the following:
-        // 1. when amendment is disabled
-        // 2. when asfAllowTrustLineClawback flag has not been set
-        {
-            Env env(*this, features - featureClawback);
-
-            Account const alice{"alice"};
-            Account const bob{"bob"};
-
-            env.fund(XRP(1000), alice, bob);
-            env.close();
-
-            env.require(Nflags(alice, asfAllowTrustLineClawback));
-
-            auto const usd = alice["USD"];
-
-            // alice issues 10 USD to bob
-            env.trust(usd(1000), bob);
-            env(pay(alice, bob, usd(10)));
-            env.close();
-
-            env.require(Balance(bob, alice["USD"](10)));
-            env.require(Balance(alice, bob["USD"](-10)));
-
-            // clawback fails because amendment is disabled
-            env(claw(alice, bob["USD"](5)), Ter(temDISABLED));
-            env.close();
-
-            // now enable clawback amendment
-            env.enableFeature(featureClawback);
-            env.close();
-
-            // clawback fails because asfAllowTrustLineClawback has not been set
-            env(claw(alice, bob["USD"](5)), Ter(tecNO_PERMISSION));
-            env.close();
-
-            env.require(Balance(bob, alice["USD"](10)));
-            env.require(Balance(alice, bob["USD"](-10)));
-        }
-
         // Test that Clawback tx fails for the following:
         // 1. invalid flag
         // 2. negative STAmount
diff --git a/src/test/app/Delegate_test.cpp b/src/test/app/Delegate_test.cpp
index 1516219e46..6e80577797 100644
--- a/src/test/app/Delegate_test.cpp
+++ b/src/test/app/Delegate_test.cpp
@@ -2340,7 +2340,6 @@ class Delegate_test : public beast::unit_test::Suite
         // NFTokenMint, NFTokenBurn, NFTokenCreateOffer, NFTokenCancelOffer,
         // NFTokenAcceptOffer are not included, they are tested separately.
         std::unordered_map<std::string, uint256> txRequiredFeatures{
-            {"Clawback", featureClawback},
             {"AMMClawback", featureAMMClawback},
             {"AMMCreate", featureAMM},
             {"AMMDeposit", featureAMM},
diff --git a/src/test/rpc/AccountInfo_test.cpp b/src/test/rpc/AccountInfo_test.cpp
index 385fc2f58a..d061be1f0e 100644
--- a/src/test/rpc/AccountInfo_test.cpp
+++ b/src/test/rpc/AccountInfo_test.cpp
@@ -583,24 +583,17 @@ public:
         static constexpr std::pair<std::string_view, std::uint32_t> kAllowTrustLineClawbackFlag{
             "allowTrustLineClawback", asfAllowTrustLineClawback};
 
-        if (features[featureClawback])
-        {
-            // must use bob's account because alice has noFreeze set
-            auto const f1 = getAccountFlag(kAllowTrustLineClawbackFlag.first, bob);
-            BEAST_EXPECT(f1.has_value());
-            BEAST_EXPECT(!f1.value());  // NOLINT(bugprone-unchecked-optional-access)
+        // must use bob's account because alice has noFreeze set
+        auto const f1 = getAccountFlag(kAllowTrustLineClawbackFlag.first, bob);
+        BEAST_EXPECT(f1.has_value());
+        BEAST_EXPECT(!f1.value());  // NOLINT(bugprone-unchecked-optional-access)
 
-            // Set allowTrustLineClawback
-            env(fset(bob, kAllowTrustLineClawbackFlag.second));
-            env.close();
-            auto const f2 = getAccountFlag(kAllowTrustLineClawbackFlag.first, bob);
-            BEAST_EXPECT(f2.has_value());
-            BEAST_EXPECT(f2.value());  // NOLINT(bugprone-unchecked-optional-access)
-        }
-        else
-        {
-            BEAST_EXPECT(!getAccountFlag(kAllowTrustLineClawbackFlag.first, bob));
-        }
+        // Set allowTrustLineClawback
+        env(fset(bob, kAllowTrustLineClawbackFlag.second));
+        env.close();
+        auto const f2 = getAccountFlag(kAllowTrustLineClawbackFlag.first, bob);
+        BEAST_EXPECT(f2.has_value());
+        BEAST_EXPECT(f2.value());  // NOLINT(bugprone-unchecked-optional-access)
 
         static constexpr std::pair<std::string_view, std::uint32_t> kAllowTrustLineLockingFlag{
             "allowTrustLineLocking", asfAllowTrustLineLocking};
@@ -634,8 +627,7 @@ public:
 
         FeatureBitset const allFeatures{xrpl::test::jtx::testableAmendments()};
         testAccountFlags(allFeatures);
-        testAccountFlags(allFeatures - featureClawback);
-        testAccountFlags(allFeatures - featureClawback - featureTokenEscrow);
+        testAccountFlags(allFeatures - featureTokenEscrow);
     }
 };
 
diff --git a/src/xrpld/rpc/handlers/account/AccountInfo.cpp b/src/xrpld/rpc/handlers/account/AccountInfo.cpp
index fba48ea93e..3a96593452 100644
--- a/src/xrpld/rpc/handlers/account/AccountInfo.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountInfo.cpp
@@ -169,11 +169,8 @@ doAccountInfo(RPC::JsonContext& context)
         for (auto const& lsf : kDisallowIncomingFlags)
             acctFlags[lsf.first.data()] = sleAccepted->isFlag(lsf.second);
 
-        if (ledger->rules().enabled(featureClawback))
-        {
-            acctFlags[kAllowTrustLineClawbackFlag.first.data()] =
-                sleAccepted->isFlag(kAllowTrustLineClawbackFlag.second);
-        }
+        acctFlags[kAllowTrustLineClawbackFlag.first.data()] =
+            sleAccepted->isFlag(kAllowTrustLineClawbackFlag.second);
 
         if (ledger->rules().enabled(featureTokenEscrow))
         {

From 2ab43b6fda1dac284d799e7a4755b2279b6c902d Mon Sep 17 00:00:00 2001
From: Timothy Banks <tbanks@ripple.com>
Date: Fri, 26 Jun 2026 06:31:16 -0400
Subject: [PATCH 015/100] refactor: Retire NFTokenReserve fix (#7367)

---
 include/xrpl/protocol/detail/features.macro   |   2 +-
 .../tx/transactors/nft/NFTokenAcceptOffer.cpp |  30 ++-
 src/test/app/NFToken_test.cpp                 | 189 +++++++-----------
 3 files changed, 86 insertions(+), 135 deletions(-)

diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index 1ccb60d3af..2b6beaa671 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -58,7 +58,6 @@ XRPL_FIX    (EmptyDID,                   Supported::Yes, VoteBehavior::DefaultNo
 XRPL_FEATURE(PriceOracle,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (AMMOverflowOffer,           Supported::Yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (InnerObjTemplate,           Supported::Yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (NFTokenReserve,             Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (FillOrKill,                 Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(DID,                        Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (DisallowIncomingV1,         Supported::Yes, VoteBehavior::DefaultNo)
@@ -104,6 +103,7 @@ XRPL_RETIRE_FIX(CheckThreading)
 XRPL_RETIRE_FIX(MasterKeyAsRegularKey)
 XRPL_RETIRE_FIX(NonFungibleTokensV1_2)
 XRPL_RETIRE_FIX(NFTokenRemint)
+XRPL_RETIRE_FIX(NFTokenReserve)
 XRPL_RETIRE_FIX(PayChanRecipientOwnerDir)
 XRPL_RETIRE_FIX(QualityUpperBound)
 XRPL_RETIRE_FIX(ReducedOffersV1)
diff --git a/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp b/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
index 1d303b7141..14bf3646c0 100644
--- a/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
+++ b/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
@@ -374,28 +374,22 @@ NFTokenAcceptOffer::transferNFToken(
 
     auto const insertRet = nft::insertToken(view(), buyer, std::move(tokenAndPage->token));
 
-    // if fixNFTokenReserve is enabled, check if the buyer has sufficient
-    // reserve to own a new object, if their OwnerCount changed.
-    //
     // There was an issue where the buyer accepts a sell offer, the ledger
     // didn't check if the buyer has enough reserve, meaning that buyer can get
     // NFTs free of reserve.
-    if (view().rules().enabled(fixNFTokenReserve))
-    {
-        // To check if there is sufficient reserve, we cannot use preFeeBalance_
-        // because NFT is sold for a price. So we must use the balance after
-        // the deduction of the potential offer price. A small caveat here is
-        // that the balance has already deducted the transaction fee, meaning
-        // that the reserve requirement is a few drops higher.
-        auto const buyerBalance = sleBuyer->getFieldAmount(sfBalance);
+    // To check if there is sufficient reserve, we cannot use preFeeBalance_
+    // because NFT is sold for a price. So we must use the balance after
+    // the deduction of the potential offer price. A small caveat here is
+    // that the balance has already deducted the transaction fee, meaning
+    // that the reserve requirement is a few drops higher.
+    auto const buyerBalance = sleBuyer->getFieldAmount(sfBalance);
 
-        auto const buyerOwnerCountAfter = sleBuyer->getFieldU32(sfOwnerCount);
-        if (buyerOwnerCountAfter > buyerOwnerCountBefore)
-        {
-            if (auto const reserve = view().fees().accountReserve(buyerOwnerCountAfter);
-                buyerBalance < reserve)
-                return tecINSUFFICIENT_RESERVE;
-        }
+    auto const buyerOwnerCountAfter = sleBuyer->getFieldU32(sfOwnerCount);
+    if (buyerOwnerCountAfter > buyerOwnerCountBefore)
+    {
+        if (auto const reserve = view().fees().accountReserve(buyerOwnerCountAfter);
+            buyerBalance < reserve)
+            return tecINSUFFICIENT_RESERVE;
     }
 
     return insertRet;
diff --git a/src/test/app/NFToken_test.cpp b/src/test/app/NFToken_test.cpp
index ef7c385acb..f191e04a47 100644
--- a/src/test/app/NFToken_test.cpp
+++ b/src/test/app/NFToken_test.cpp
@@ -6351,60 +6351,44 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             // Bob owns no object
             BEAST_EXPECT(ownerCount(env, bob) == 0);
 
-            // Without fixNFTokenReserve amendment, when bob accepts an NFT sell
-            // offer, he can get the NFT free of reserve
-            if (!features[fixNFTokenReserve])
-            {
-                // Bob is able to accept the offer
-                env(token::acceptSellOffer(bob, sellOfferIndex));
-                env.close();
-
-                // Bob now owns an extra objects
-                BEAST_EXPECT(ownerCount(env, bob) == 1);
-
-                // This is the wrong behavior, since Bob should need at least
-                // one incremental reserve.
-            }
-            // With fixNFTokenReserve, bob can no longer accept the offer unless
+            // bob can no longer accept the offer unless
             // there is enough reserve. A detail to note is that NFTs(sell
             // offer) will not allow one to go below the reserve requirement,
             // because buyer's balance is computed after the transaction fee is
             // deducted. This means that the reserve requirement will be `base
             // fee` drops higher than normal.
-            else
-            {
-                // Bob is not able to accept the offer with only the account
-                // reserve (200,000,000 drops)
-                env(token::acceptSellOffer(bob, sellOfferIndex), Ter(tecINSUFFICIENT_RESERVE));
-                env.close();
 
-                // after prev transaction, Bob owns `200M - base fee` drops due
-                // to burnt tx fee
+            // Bob is not able to accept the offer with only the account
+            // reserve (200,000,000 drops)
+            env(token::acceptSellOffer(bob, sellOfferIndex), Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
 
-                BEAST_EXPECT(ownerCount(env, bob) == 0);
+            // after prev transaction, Bob owns `200M - base fee` drops due
+            // to burnt tx fee
 
-                // Send bob an kIncrement reserve and base fee (to make up for
-                // the transaction fee burnt from the prev failed tx) Bob now
-                // owns 250,000,000 drops
-                env(pay(env.master, bob, incReserve + drops(baseFee)));
-                env.close();
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
 
-                // However, this transaction will still fail because the reserve
-                // requirement is `base fee` drops higher
-                env(token::acceptSellOffer(bob, sellOfferIndex), Ter(tecINSUFFICIENT_RESERVE));
-                env.close();
+            // Send bob an kIncrement reserve and base fee (to make up for
+            // the transaction fee burnt from the prev failed tx) Bob now
+            // owns 250,000,000 drops
+            env(pay(env.master, bob, incReserve + drops(baseFee)));
+            env.close();
 
-                // Send bob `base fee * 2` drops
-                // Bob now owns `250M + base fee` drops
-                env(pay(env.master, bob, drops(baseFee * 2)));
-                env.close();
+            // However, this transaction will still fail because the reserve
+            // requirement is `base fee` drops higher
+            env(token::acceptSellOffer(bob, sellOfferIndex), Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
 
-                // Bob is now able to accept the offer
-                env(token::acceptSellOffer(bob, sellOfferIndex));
-                env.close();
+            // Send bob `base fee * 2` drops
+            // Bob now owns `250M + base fee` drops
+            env(pay(env.master, bob, drops(baseFee * 2)));
+            env.close();
 
-                BEAST_EXPECT(ownerCount(env, bob) == 1);
-            }
+            // Bob is now able to accept the offer
+            env(token::acceptSellOffer(bob, sellOfferIndex));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
         }
 
         // Now exercise the scenario when the buyer accepts
@@ -6423,83 +6407,63 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
             env.fund(acctReserve + XRP(1), bob);
             env.close();
 
-            if (!features[fixNFTokenReserve])
+            // alice mints the first NFT and creates a sell offer for 0 XRP
+            auto const sellOfferIndex1 = mintAndCreateSellOffer(env, alice, XRP(0));
+
+            // Bob cannot accept this offer because he doesn't have the
+            // reserve for the NFT
+            env(token::acceptSellOffer(bob, sellOfferIndex1), Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+
+            // Give bob enough reserve
+            env(pay(env.master, bob, drops(incReserve)));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+
+            // Bob now owns his first NFT
+            env(token::acceptSellOffer(bob, sellOfferIndex1));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+
+            // alice now mints 31 more NFTs and creates an offer for each
+            // NFT, then sells to bob
+            for (size_t i = 0; i < 31; i++)
             {
-                // Bob can accept many NFTs without having a single reserve!
-                for (size_t i = 0; i < 200; i++)
-                {
-                    // alice mints an NFT and creates a sell offer for 0 XRP
-                    auto const sellOfferIndex = mintAndCreateSellOffer(env, alice, XRP(0));
+                // alice mints an NFT and creates a sell offer for 0 XRP
+                auto const sellOfferIndex = mintAndCreateSellOffer(env, alice, XRP(0));
 
-                    // Bob is able to accept the offer
-                    env(token::acceptSellOffer(bob, sellOfferIndex));
-                    env.close();
-                }
+                // Bob can accept the offer because the new NFT is stored in
+                // an existing NFTokenPage so no new reserve is required
+                env(token::acceptSellOffer(bob, sellOfferIndex));
+                env.close();
             }
-            else
-            {
-                // alice mints the first NFT and creates a sell offer for 0 XRP
-                auto const sellOfferIndex1 = mintAndCreateSellOffer(env, alice, XRP(0));
 
-                // Bob cannot accept this offer because he doesn't have the
-                // reserve for the NFT
-                env(token::acceptSellOffer(bob, sellOfferIndex1), Ter(tecINSUFFICIENT_RESERVE));
-                env.close();
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
 
-                // Give bob enough reserve
-                env(pay(env.master, bob, drops(incReserve)));
-                env.close();
+            // alice now mints the 33rd NFT and creates an sell offer for 0
+            // XRP
+            auto const sellOfferIndex33 = mintAndCreateSellOffer(env, alice, XRP(0));
 
-                BEAST_EXPECT(ownerCount(env, bob) == 0);
+            // Bob fails to accept this NFT because he does not have enough
+            // reserve for a new NFTokenPage
+            env(token::acceptSellOffer(bob, sellOfferIndex33), Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
 
-                // Bob now owns his first NFT
-                env(token::acceptSellOffer(bob, sellOfferIndex1));
-                env.close();
+            // Send bob incremental reserve
+            env(pay(env.master, bob, drops(incReserve)));
+            env.close();
 
-                BEAST_EXPECT(ownerCount(env, bob) == 1);
+            // Bob now has enough reserve to accept the offer and now
+            // owns one more NFTokenPage
+            env(token::acceptSellOffer(bob, sellOfferIndex33));
+            env.close();
 
-                // alice now mints 31 more NFTs and creates an offer for each
-                // NFT, then sells to bob
-                for (size_t i = 0; i < 31; i++)
-                {
-                    // alice mints an NFT and creates a sell offer for 0 XRP
-                    auto const sellOfferIndex = mintAndCreateSellOffer(env, alice, XRP(0));
-
-                    // Bob can accept the offer because the new NFT is stored in
-                    // an existing NFTokenPage so no new reserve is required
-                    env(token::acceptSellOffer(bob, sellOfferIndex));
-                    env.close();
-                }
-
-                BEAST_EXPECT(ownerCount(env, bob) == 1);
-
-                // alice now mints the 33rd NFT and creates an sell offer for 0
-                // XRP
-                auto const sellOfferIndex33 = mintAndCreateSellOffer(env, alice, XRP(0));
-
-                // Bob fails to accept this NFT because he does not have enough
-                // reserve for a new NFTokenPage
-                env(token::acceptSellOffer(bob, sellOfferIndex33), Ter(tecINSUFFICIENT_RESERVE));
-                env.close();
-
-                // Send bob incremental reserve
-                env(pay(env.master, bob, drops(incReserve)));
-                env.close();
-
-                // Bob now has enough reserve to accept the offer and now
-                // owns one more NFTokenPage
-                env(token::acceptSellOffer(bob, sellOfferIndex33));
-                env.close();
-
-                BEAST_EXPECT(ownerCount(env, bob) == 2);
-            }
+            BEAST_EXPECT(ownerCount(env, bob) == 2);
         }
 
         // Test the behavior when the seller accepts a buy offer.
-        // The behavior should not change regardless whether fixNFTokenReserve
-        // is enabled or not, since the ledger is able to guard against
-        // free NFTokenPages when buy offer is accepted. This is merely an
-        // additional test to exercise existing offer behavior.
         {
             Account const alice{"alice"};
             Account const bob{"bob"};
@@ -6544,10 +6508,6 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         }
 
         // Test the reserve behavior in brokered mode.
-        // The behavior should not change regardless whether fixNFTokenReserve
-        // is enabled or not, since the ledger is able to guard against
-        // free NFTokenPages in brokered mode. This is merely an
-        // additional test to exercise existing offer behavior.
         {
             Account const alice{"alice"};
             Account const bob{"bob"};
@@ -7211,9 +7171,7 @@ public:
     void
     run() override
     {
-        testWithFeats(
-            allFeatures_ - fixNFTokenReserve - featureNFTokenMintOffer - featureDynamicNFT -
-            fixCleanup3_1_3);
+        testWithFeats(allFeatures_ - featureNFTokenMintOffer - featureDynamicNFT - fixCleanup3_1_3);
     }
 };
 
@@ -7222,8 +7180,7 @@ class NFTokenDisallowIncoming_test : public NFTokenBaseUtil_test
     void
     run() override
     {
-        testWithFeats(
-            allFeatures_ - fixNFTokenReserve - featureNFTokenMintOffer - featureDynamicNFT);
+        testWithFeats(allFeatures_ - featureNFTokenMintOffer - featureDynamicNFT);
     }
 };
 

From bb2ab4243b81a056063f23d1bd3f8babe1f8b32b Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Fri, 26 Jun 2026 11:42:24 +0100
Subject: [PATCH 016/100] ci: Better determine when we need to run full
 clang-tidy (#7635)

---
 .github/workflows/on-pr.yml               |  1 -
 .github/workflows/on-trigger.yml          |  1 -
 .github/workflows/reusable-clang-tidy.yml | 11 +++--------
 3 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 2ad0641863..19fb170b92 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -122,7 +122,6 @@ jobs:
       issues: write
       contents: read
     with:
-      check_only_changed: true
       create_issue_on_failure: false
 
   build-test:
diff --git a/.github/workflows/on-trigger.yml b/.github/workflows/on-trigger.yml
index 5f018cb12c..49a93d2746 100644
--- a/.github/workflows/on-trigger.yml
+++ b/.github/workflows/on-trigger.yml
@@ -72,7 +72,6 @@ jobs:
       issues: write
       contents: read
     with:
-      check_only_changed: false
       create_issue_on_failure: ${{ github.event_name == 'schedule' }}
 
   build-test:
diff --git a/.github/workflows/reusable-clang-tidy.yml b/.github/workflows/reusable-clang-tidy.yml
index f36463a5d0..e66909ffad 100644
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -3,10 +3,6 @@ name: Run clang-tidy on files
 on:
   workflow_call:
     inputs:
-      check_only_changed:
-        description: "Check only changed files in PR. If false, checks all files in the repository."
-        type: boolean
-        default: false
       create_issue_on_failure:
         description: "Whether to create an issue if the check failed"
         type: boolean
@@ -29,15 +25,14 @@ env:
 
 jobs:
   determine-files:
-    if: ${{ inputs.check_only_changed }}
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@c7045074aafe9fb92fa537aa4446f81fbfc17e8b
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
-    if: ${{ always() && !cancelled() && (!inputs.check_only_changed || needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.clang_tidy_config_changed == 'true') }}
+    if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
     container: "ghcr.io/xrplf/xrpld/nix-debian:sha-e29b523"
     permissions:
@@ -96,7 +91,7 @@ jobs:
         id: run_clang_tidy
         continue-on-error: true
         env:
-          TARGETS: ${{ (needs.determine-files.outputs.clang_tidy_config_changed != 'true' && inputs.check_only_changed) && needs.determine-files.outputs.cpp_changed_files || 'src tests' }}
+          TARGETS: ${{ needs.determine-files.outputs.need_full_run != 'true' && needs.determine-files.outputs.cpp_changed_files || 'src tests' }}
         run: |
           set -o pipefail
           run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"

From 50fdb38ace4faa3b8f75fde106c14c83d0637fb6 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Fri, 26 Jun 2026 11:46:39 +0100
Subject: [PATCH 017/100] chore: Enable groups of clang-tidy checks by default
 (#7637)

---
 .clang-tidy | 307 ++++++++++++++++++++++++++--------------------------
 1 file changed, 152 insertions(+), 155 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index 35427810a3..ef55e8517c 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -1,161 +1,158 @@
 ---
 Checks: "-*,
-  bugprone-argument-comment,
-  bugprone-assert-side-effect,
-  bugprone-bad-signal-to-kill-thread,
-  bugprone-bool-pointer-implicit-conversion,
-  bugprone-capturing-this-in-member-variable,
-  bugprone-casting-through-void,
-  bugprone-chained-comparison,
-  bugprone-compare-pointer-to-member-virtual-function,
-  bugprone-copy-constructor-init,
-  bugprone-crtp-constructor-accessibility,
-  bugprone-dangling-handle,
-  bugprone-derived-method-shadowing-base-method,
-  bugprone-dynamic-static-initializers,
-  bugprone-empty-catch,
-  bugprone-fold-init-type,
-  bugprone-forward-declaration-namespace,
-  bugprone-inaccurate-erase,
-  bugprone-inc-dec-in-conditions,
-  bugprone-incorrect-enable-if,
-  bugprone-incorrect-roundings,
-  bugprone-infinite-loop,
-  bugprone-integer-division,
-  bugprone-invalid-enum-default-initialization,
-  bugprone-lambda-function-name,
-  bugprone-macro-parentheses,
-  bugprone-macro-repeated-side-effects,
-  bugprone-misleading-setter-of-reference,
-  bugprone-misplaced-operator-in-strlen-in-alloc,
-  bugprone-misplaced-pointer-arithmetic-in-alloc,
-  bugprone-misplaced-widening-cast,
-  bugprone-move-forwarding-reference,
-  bugprone-multi-level-implicit-pointer-conversion,
-  bugprone-multiple-new-in-one-expression,
-  bugprone-multiple-statement-macro,
-  bugprone-no-escape,
-  bugprone-non-zero-enum-to-bool-conversion,
-  bugprone-optional-value-conversion,
-  bugprone-parent-virtual-call,
-  bugprone-pointer-arithmetic-on-polymorphic-object,
-  bugprone-posix-return,
-  bugprone-redundant-branch-condition,
-  bugprone-reserved-identifier,
-  bugprone-return-const-ref-from-parameter,
-  bugprone-shared-ptr-array-mismatch,
-  bugprone-signal-handler,
-  bugprone-signed-char-misuse,
-  bugprone-sizeof-container,
-  bugprone-sizeof-expression,
-  bugprone-spuriously-wake-up-functions,
-  bugprone-standalone-empty,
-  bugprone-string-constructor,
-  bugprone-string-integer-assignment,
-  bugprone-string-literal-with-embedded-nul,
-  bugprone-stringview-nullptr,
-  bugprone-suspicious-enum-usage,
-  bugprone-suspicious-include,
-  bugprone-suspicious-memory-comparison,
-  bugprone-suspicious-memset-usage,
-  bugprone-suspicious-missing-comma,
-  bugprone-suspicious-realloc-usage,
-  bugprone-suspicious-semicolon,
-  bugprone-suspicious-string-compare,
-  bugprone-suspicious-stringview-data-usage,
-  bugprone-swapped-arguments,
-  bugprone-switch-missing-default-case,
-  bugprone-terminating-continue,
-  bugprone-throw-keyword-missing,
-  bugprone-too-small-loop-variable,
-  bugprone-unchecked-optional-access,
-  bugprone-undefined-memory-manipulation,
-  bugprone-undelegated-constructor,
-  bugprone-unhandled-exception-at-new,
-  bugprone-unhandled-self-assignment,
-  bugprone-unique-ptr-array-mismatch,
-  bugprone-unsafe-functions,
-  bugprone-unused-local-non-trivial-variable,
-  bugprone-unused-raii,
-  bugprone-unused-return-value,
-  bugprone-use-after-move,
-  bugprone-virtual-near-miss,
-  cppcoreguidelines-init-variables,
-  cppcoreguidelines-misleading-capture-default-by-value,
-  cppcoreguidelines-no-suspend-with-lock,
-  cppcoreguidelines-pro-type-member-init,
-  cppcoreguidelines-pro-type-static-cast-downcast,
-  cppcoreguidelines-rvalue-reference-param-not-moved,
-  cppcoreguidelines-use-default-member-init,
-  cppcoreguidelines-use-enum-class,
-  cppcoreguidelines-virtual-class-destructor,
-  hicpp-ignored-remove-result,
+  bugprone-*,
+  -bugprone-assignment-in-if-condition,
+  -bugprone-bitwise-pointer-cast,
+  -bugprone-branch-clone,
+  -bugprone-command-processor,
+  -bugprone-copy-constructor-mutates-argument,
+  -bugprone-default-operator-new-on-overaligned-type,
+  -bugprone-easily-swappable-parameters,
+  -bugprone-exception-copy-constructor-throws,
+  -bugprone-exception-escape,
+  -bugprone-float-loop-counter,
+  -bugprone-forwarding-reference-overload,
+  -bugprone-implicit-widening-of-multiplication-result,
+  -bugprone-incorrect-enable-shared-from-this,
+  -bugprone-narrowing-conversions,
+  -bugprone-nondeterministic-pointer-iteration-order,
+  -bugprone-not-null-terminated-result,
+  -bugprone-random-generator-seed,
+  -bugprone-raw-memory-call-on-non-trivial-type,
+  -bugprone-std-namespace-modification,
+  -bugprone-tagged-union-member-count,
+  -bugprone-throwing-static-initialization,
+  -bugprone-unchecked-string-to-number-conversion,
+  -bugprone-unintended-char-ostream-output,
+
+  cppcoreguidelines-*,
+  -cppcoreguidelines-avoid-c-arrays,
+  -cppcoreguidelines-avoid-capturing-lambda-coroutines,
+  -cppcoreguidelines-avoid-const-or-ref-data-members,
+  -cppcoreguidelines-avoid-do-while,
+  -cppcoreguidelines-avoid-goto,
+  -cppcoreguidelines-avoid-magic-numbers,
+  -cppcoreguidelines-avoid-non-const-global-variables,
+  -cppcoreguidelines-avoid-reference-coroutine-parameters,
+  -cppcoreguidelines-c-copy-assignment-signature,
+  -cppcoreguidelines-explicit-virtual-functions,
+  -cppcoreguidelines-interfaces-global-init,
+  -cppcoreguidelines-macro-to-enum,
+  -cppcoreguidelines-macro-usage,
+  -cppcoreguidelines-missing-std-forward,
+  -cppcoreguidelines-narrowing-conversions,
+  -cppcoreguidelines-no-malloc,
+  -cppcoreguidelines-noexcept-destructor,
+  -cppcoreguidelines-noexcept-move-operations,
+  -cppcoreguidelines-noexcept-swap,
+  -cppcoreguidelines-non-private-member-variables-in-classes,
+  -cppcoreguidelines-owning-memory,
+  -cppcoreguidelines-prefer-member-initializer,
+  -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
+  -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
+  -cppcoreguidelines-pro-bounds-constant-array-index,
+  -cppcoreguidelines-pro-bounds-pointer-arithmetic,
+  -cppcoreguidelines-pro-type-const-cast,
+  -cppcoreguidelines-pro-type-cstyle-cast,
+  -cppcoreguidelines-pro-type-reinterpret-cast,
+  -cppcoreguidelines-pro-type-union-access,
+  -cppcoreguidelines-pro-type-vararg,
+  -cppcoreguidelines-slicing,
+  -cppcoreguidelines-special-member-functions,
+
   llvm-namespace-comment,
-  misc-const-correctness,
-  misc-definitions-in-headers,
-  misc-header-include-cycle,
-  misc-include-cleaner,
-  misc-misplaced-const,
-  misc-redundant-expression,
-  misc-static-assert,
-  misc-throw-by-value-catch-by-reference,
-  misc-unused-alias-decls,
-  misc-unused-using-decls,
-  modernize-concat-nested-namespaces,
-  modernize-deprecated-headers,
-  modernize-make-shared,
-  modernize-make-unique,
-  modernize-pass-by-value,
-  modernize-type-traits,
-  modernize-use-designated-initializers,
-  modernize-use-emplace,
-  modernize-use-equals-default,
-  modernize-use-equals-delete,
-  modernize-use-nodiscard,
-  modernize-use-override,
-  modernize-use-ranges,
-  modernize-use-scoped-lock,
-  modernize-use-starts-ends-with,
-  modernize-use-std-numbers,
-  modernize-use-using,
-  performance-faster-string-find,
-  performance-for-range-copy,
-  performance-implicit-conversion-in-loop,
-  performance-inefficient-vector-operation,
-  performance-move-const-arg,
-  performance-move-constructor-init,
-  performance-no-automatic-move,
-  performance-trivially-destructible,
-  readability-ambiguous-smartptr-reset-call,
-  readability-avoid-nested-conditional-operator,
-  readability-avoid-return-with-void-value,
-  readability-braces-around-statements,
-  readability-const-return-type,
-  readability-container-contains,
-  readability-container-size-empty,
-  readability-convert-member-functions-to-static,
-  readability-duplicate-include,
-  readability-else-after-return,
-  readability-enum-initial-value,
-  readability-identifier-naming,
-  readability-implicit-bool-conversion,
-  readability-inconsistent-ifelse-braces,
-  readability-make-member-function-const,
-  readability-math-missing-parentheses,
-  readability-misleading-indentation,
-  readability-non-const-parameter,
-  readability-redundant-casting,
-  readability-redundant-declaration,
-  readability-redundant-inline-specifier,
-  readability-redundant-member-init,
-  readability-redundant-parentheses,
-  readability-redundant-string-init,
-  readability-redundant-typename,
-  readability-reference-to-constructed-temporary,
-  readability-simplify-boolean-expr,
-  readability-static-definition-in-anonymous-namespace,
-  readability-suspicious-call-argument,
-  readability-use-std-min-max
+
+  misc-*,
+  -misc-anonymous-namespace-in-header,
+  -misc-confusable-identifiers,
+  -misc-coroutine-hostile-raii,
+  -misc-misleading-bidirectional,
+  -misc-misleading-identifier,
+  -misc-multiple-inheritance,
+  -misc-new-delete-overloads,
+  -misc-no-recursion,
+  -misc-non-copyable-objects,
+  -misc-non-private-member-variables-in-classes,
+  -misc-override-with-different-visibility,
+  -misc-predictable-rand,
+  -misc-unconventional-assign-operator,
+  -misc-uniqueptr-reset-release,
+  -misc-unused-parameters,
+  -misc-use-anonymous-namespace,
+  -misc-use-internal-linkage,
+
+  modernize-*,
+  -modernize-avoid-bind,
+  -modernize-avoid-c-arrays,
+  -modernize-avoid-c-style-cast,
+  -modernize-avoid-setjmp-longjmp,
+  -modernize-avoid-variadic-functions,
+  -modernize-deprecated-ios-base-aliases,
+  -modernize-loop-convert,
+  -modernize-macro-to-enum,
+  -modernize-min-max-use-initializer-list,
+  -modernize-raw-string-literal,
+  -modernize-redundant-void-arg,
+  -modernize-replace-auto-ptr,
+  -modernize-replace-disallow-copy-and-assign-macro,
+  -modernize-replace-random-shuffle,
+  -modernize-return-braced-init-list,
+  -modernize-shrink-to-fit,
+  -modernize-unary-static-assert,
+  -modernize-use-auto,
+  -modernize-use-bool-literals,
+  -modernize-use-constraints,
+  -modernize-use-default-member-init,
+  -modernize-use-integer-sign-comparison,
+  -modernize-use-noexcept,
+  -modernize-use-nullptr,
+  -modernize-use-std-format,
+  -modernize-use-std-print,
+  -modernize-use-trailing-return-type,
+  -modernize-use-transparent-functors,
+  -modernize-use-uncaught-exceptions,
+
+  performance-*,
+  -performance-avoid-endl,
+  -performance-enum-size,
+  -performance-inefficient-algorithm,
+  -performance-inefficient-string-concatenation,
+  -performance-no-int-to-ptr,
+  -performance-noexcept-destructor,
+  -performance-noexcept-move-constructor,
+  -performance-noexcept-swap,
+  -performance-type-promotion-in-math-fn,
+  -performance-unnecessary-copy-initialization,
+  -performance-unnecessary-value-param,
+
+  readability-*,
+  -readability-avoid-const-params-in-decls,
+  -readability-avoid-unconditional-preprocessor-if,
+  -readability-container-data-pointer,
+  -readability-delete-null-pointer,
+  -readability-function-cognitive-complexity,
+  -readability-function-size,
+  -readability-identifier-length,
+  -readability-inconsistent-declaration-parameter-name,
+  -readability-isolate-declaration,
+  -readability-magic-numbers,
+  -readability-misplaced-array-index,
+  -readability-named-parameter,
+  -readability-operators-representation,
+  -readability-qualified-auto,
+  -readability-redundant-access-specifiers,
+  -readability-redundant-control-flow,
+  -readability-redundant-function-ptr-dereference,
+  -readability-redundant-preprocessor,
+  -readability-redundant-smartptr-get,
+  -readability-redundant-string-cstr,
+  -readability-simplify-subscript-expr,
+  -readability-static-accessed-through-instance,
+  -readability-string-compare,
+  -readability-uniqueptr-delete-release,
+  -readability-uppercase-literal-suffix,
+  -readability-use-anyofallof,
+  -readability-use-concise-preprocessor-directives
   "
 # ---
 # bugprone-narrowing-conversions,                      # This will break a lot of code but we should enable it in the future because it can eliminate a lot of bugs

From 652b5f9af1b58c974ddcb8c4684227aca9fd1527 Mon Sep 17 00:00:00 2001
From: yinyiqian1 <yqian@ripple.com>
Date: Fri, 26 Jun 2026 16:34:22 -0400
Subject: [PATCH 018/100] fix: Block delegate tx from being queued (#7640)

---
 src/test/app/TxQ_test.cpp         | 38 +++++++++++++++++++++++++++++++
 src/xrpld/app/misc/detail/TxQ.cpp |  4 ++++
 2 files changed, 42 insertions(+)

diff --git a/src/test/app/TxQ_test.cpp b/src/test/app/TxQ_test.cpp
index 97cb035578..2d10eb4beb 100644
--- a/src/test/app/TxQ_test.cpp
+++ b/src/test/app/TxQ_test.cpp
@@ -5,6 +5,7 @@
 #include <test/jtx/WSClient.h>
 #include <test/jtx/amount.h>
 #include <test/jtx/balance.h>
+#include <test/jtx/delegate.h>
 #include <test/jtx/envconfig.h>
 #include <test/jtx/fee.h>
 #include <test/jtx/flags.h>
@@ -2335,6 +2336,42 @@ public:
         BEAST_EXPECT(env.balance(alice) == drops(5));
     }
 
+    void
+    testDelegateTxCannotQueue()
+    {
+        using namespace jtx;
+        testcase("disallow delegate transaction from being queued");
+
+        Env env(*this, makeConfig({{Keys::kMinimumTxnInLedgerStandalone, "3"}}));
+
+        auto const alice = Account("alice");
+        auto const bob = Account("bob");
+        auto const carol = Account("carol");
+
+        env.fund(XRP(50000), alice, bob);
+        env.close();
+        env.fund(XRP(50000), carol);
+        env.close();
+
+        env(delegate::set(alice, bob, {"Payment"}));
+        env.close();
+
+        fillQueue(env, alice);
+        checkMetrics(*this, env, 0, 8, 5, 4);
+
+        // Delegated transactions are not allowed to be queued.
+        env(pay(alice, carol, drops(1)), delegate::As(bob), Ter(telCAN_NOT_QUEUE));
+        checkMetrics(*this, env, 0, 8, 5, 4);
+
+        // Delegated transactions may still apply directly if they pay the
+        // open ledger fee. They just cannot be held in the queue.
+        env(pay(alice, carol, drops(1)),
+            delegate::As(bob),
+            Fee(openLedgerCost(env)),
+            Ter(tesSUCCESS));
+        checkMetrics(*this, env, 0, 8, 6, 4);
+    }
+
     void
     testConsequences()
     {
@@ -4662,6 +4699,7 @@ public:
         testBlockersSeq();
         testBlockersTicket();
         testInFlightBalance();
+        testDelegateTxCannotQueue();
         testConsequences();
     }
 
diff --git a/src/xrpld/app/misc/detail/TxQ.cpp b/src/xrpld/app/misc/detail/TxQ.cpp
index 9022095ea8..ec5ac569d6 100644
--- a/src/xrpld/app/misc/detail/TxQ.cpp
+++ b/src/xrpld/app/misc/detail/TxQ.cpp
@@ -398,6 +398,10 @@ TxQ::canBeHeld(
         ((flags & TapFailHard) != 0u))
         return telCAN_NOT_QUEUE;
 
+    // Disallow delegated transactions from being queued.
+    if (tx.isFieldPresent(sfDelegate))
+        return telCAN_NOT_QUEUE;
+
     {
         // To be queued and relayed, the transaction needs to
         // promise to stick around for long enough that it has

From 3e9f1d0ab856775ee5a1fc3cf5e2ee942b508821 Mon Sep 17 00:00:00 2001
From: Vito Tumas <5780819+Tapanito@users.noreply.github.com>
Date: Fri, 26 Jun 2026 23:38:59 +0200
Subject: [PATCH 019/100] fix: Unify freeze checks for pseudo-account
 deposit/withdraw (#7382)

Signed-off-by: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com>
Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Co-authored-by: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com>
Co-authored-by: Shawn Xie <35279399+shawnxie999@users.noreply.github.com>
---
 include/xrpl/ledger/helpers/TokenHelpers.h    |  69 ++
 include/xrpl/tx/transactors/dex/AMMWithdraw.h |   5 +
 src/libxrpl/ledger/helpers/MPTokenHelpers.cpp |  26 +-
 src/libxrpl/ledger/helpers/TokenHelpers.cpp   |  96 +-
 src/libxrpl/tx/invariants/MPTInvariant.cpp    |  40 +-
 src/libxrpl/tx/transactors/dex/AMMDeposit.cpp |  68 +-
 .../tx/transactors/dex/AMMWithdraw.cpp        |  67 +-
 .../lending/LoanBrokerCoverDeposit.cpp        |  24 +-
 .../lending/LoanBrokerCoverWithdraw.cpp       |  35 +-
 .../tx/transactors/vault/VaultDeposit.cpp     |  24 +-
 .../tx/transactors/vault/VaultWithdraw.cpp    |  53 +-
 src/test/app/AMMMPT_test.cpp                  | 222 ++++-
 src/test/app/AMM_test.cpp                     | 145 ++-
 src/test/app/Invariants_test.cpp              | 205 ++++
 src/test/app/LoanBroker_test.cpp              | 476 ++++++++-
 src/test/app/Loan_test.cpp                    |  21 +-
 src/test/app/MPToken_test.cpp                 |  51 +-
 src/test/app/Vault_test.cpp                   | 943 +++++++++++-------
 src/test/jtx/Env.h                            |  20 +
 src/test/jtx/impl/utility.cpp                 |   1 -
 src/test/jtx/utility.h                        |   2 +-
 21 files changed, 2007 insertions(+), 586 deletions(-)

diff --git a/include/xrpl/ledger/helpers/TokenHelpers.h b/include/xrpl/ledger/helpers/TokenHelpers.h
index f736e51d28..0c9871cd76 100644
--- a/include/xrpl/ledger/helpers/TokenHelpers.h
+++ b/include/xrpl/ledger/helpers/TokenHelpers.h
@@ -131,6 +131,75 @@ checkDeepFrozen(ReadView const& view, AccountID const& account, MPTIssue const&
 [[nodiscard]] TER
 checkDeepFrozen(ReadView const& view, AccountID const& account, Asset const& asset);
 
+/**
+ * Checks freeze compliance for withdrawing an asset from a pseudo-account (e.g. Vault, AMM,
+ * LoanBroker) to a destination account.
+ *
+ * Asserts that sourceAcct is a pseudo-account and that submitterAcct and dstAcct are not.
+ *
+ * Issuer exemption: returns tesSUCCESS immediately when dstAcct is the asset issuer — the issuer
+ * can always receive their own token, even when the pool is frozen.  Callers that need to block
+ * withdrawals from a frozen pool even for the issuer (e.g. because the pool math cannot handle it)
+ * must check checkFrozen(sourceAcct, asset) separately before calling this function.
+ *
+ * Otherwise checks, in order:
+ *   1. If the asset is globally frozen the remaining checks are redundant.
+ *   2. For MPT shares: The pseudo-account's vault share must not be transitively frozen via its
+ * underlying asset.
+ *   3. The pseudo-account's trustline / MPToken must not be frozen for sending.
+ *   4. Skipped when submitter == dst (self-withdrawal); a regular freeze should not prevent
+ * recovering one's own funds.
+ *   5. The destination must not be deep-frozen (cannot receive under any circumstance).
+ *
+ * For IOUs a regular individual freeze on the withdrawer does NOT block self-withdrawal; only deep
+ * freeze does.  For MPTs "locked" is equivalent to deep-frozen, so locked MPT holders are always
+ * blocked.
+ *
+ * @param view          Ledger view to read freeze state from.
+ * @param srcAcct       Pseudo-account the funds are withdrawn from (sender).
+ * @param submitterAcct Account that submitted the withdrawal transaction.
+ * @param dstAcct       Account receiving the withdrawn funds.
+ * @param asset         Asset being withdrawn.
+ * @return tesSUCCESS if the withdrawal is permitted, otherwise a freeze
+ *         result (tecFROZEN for IOUs, tecLOCKED for MPTs).
+ */
+[[nodiscard]] TER
+checkWithdrawFreeze(
+    ReadView const& view,
+    AccountID const& srcAcct,
+    AccountID const& submitterAcct,
+    AccountID const& dstAcct,
+    Asset const& asset);
+
+/**
+ * Checks freeze compliance for depositing an asset into a pseudo-account (e.g. Vault, AMM,
+ * LoanBroker).
+ *
+ *
+ * Checks, in order:
+ *   1. If the asset is globally frozen the remaining checks are redundant.
+ *   2. For MPT shares: the pseudo-account's vault share must not be transitively frozen via its
+ * underlying asset (returns tecLOCKED).
+ *   3. The depositor must not be individually frozen. Skipped when srcAcct is the asset issuer,
+ * since the issuer can always send its own asset.
+ *   4. The pseudo-account must not be individually frozen for the asset.  Unlike regular accounts,
+ * pseudo-accounts cannot receive deposits under a regular freeze because the deposited funds
+ * could not later be withdrawn.
+ *
+ * @param view    Ledger view to read freeze state from.
+ * @param srcAcct Depositor sending the funds.
+ * @param dstAcct Pseudo-account receiving the deposit.
+ * @param asset   Asset being deposited.
+ * @return tesSUCCESS if the deposit is permitted, otherwise a freeze result
+ *         (tecFROZEN for IOUs, tecLOCKED for MPTs).
+ */
+[[nodiscard]] TER
+checkDepositFreeze(
+    ReadView const& view,
+    AccountID const& srcAcct,
+    AccountID const& dstAcct,
+    Asset const& asset);
+
 //------------------------------------------------------------------------------
 //
 // Account balance functions (Asset-based dispatchers)
diff --git a/include/xrpl/tx/transactors/dex/AMMWithdraw.h b/include/xrpl/tx/transactors/dex/AMMWithdraw.h
index 6e88320eae..8b6d39349b 100644
--- a/include/xrpl/tx/transactors/dex/AMMWithdraw.h
+++ b/include/xrpl/tx/transactors/dex/AMMWithdraw.h
@@ -159,6 +159,11 @@ public:
         beast::Journal const& journal);
 
 private:
+    /** Returns IgnoreFreeze when the withdrawer is the issuer of a pool
+     *  asset (post-fixCleanup3_3_0), ZeroIfFrozen otherwise. */
+    [[nodiscard]] FreezeHandling
+    issuerFreezeHandling() const;
+
     std::pair<TER, bool>
     applyGuts(Sandbox& view);
 
diff --git a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
index a1af63a80f..2781902f5b 100644
--- a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
@@ -308,6 +308,18 @@ requireAuth(
     AuthType authType,
     std::uint8_t depth)
 {
+    bool const fix330Enabled = view.rules().enabled(fixCleanup3_3_0);
+    bool const featureSAVEnabled = view.rules().enabled(featureSingleAssetVault);
+    bool const featureMPTV2Enabled = view.rules().enabled(featureMPTokensV2);
+
+    // Pseudo-accounts (Vault, LoanBroker, AMM) hold assets on behalf of their participants.
+    // They are implicitly authorized for any MPT they hold, including vault shares whose
+    // underlying asset would otherwise require auth.
+    auto const isPseudoAccountExempt = [&] {
+        return (featureSAVEnabled || featureMPTV2Enabled) &&
+            isPseudoAccount(view, account, {&sfVaultID, &sfLoanBrokerID, &sfAMMID});
+    };
+
     auto const mptID = keylet::mptokenIssuance(mptIssue.getMptID());
     auto const sleIssuance = view.read(mptID);
     if (!sleIssuance)
@@ -319,7 +331,9 @@ requireAuth(
     if (mptIssuer == account)  // Issuer won't have MPToken
         return tesSUCCESS;
 
-    bool const featureSAVEnabled = view.rules().enabled(featureSingleAssetVault);
+    // Post-fix330: exempt before the recursive underlying-asset auth check.
+    if (fix330Enabled && isPseudoAccountExempt())
+        return tesSUCCESS;
 
     if (featureSAVEnabled)
     {
@@ -382,13 +396,9 @@ requireAuth(
         // belong to someone who is explicitly authorized e.g. a vault owner.
     }
 
-    bool const featureMPTV2Enabled = view.rules().enabled(featureMPTokensV2);
-    if (featureSAVEnabled || featureMPTV2Enabled)
-    {
-        // Implicitly authorize Vault, LoanBroker, and AMM pseudo-accounts
-        if (isPseudoAccount(view, account, {&sfVaultID, &sfLoanBrokerID, &sfAMMID}))
-            return tesSUCCESS;
-    }
+    // Pre-fix330: exempt after domain/sleToken checks, preserving prior behavior.
+    if (!fix330Enabled && isPseudoAccountExempt())
+        return tesSUCCESS;
 
     // mptoken must be authorized if issuance enabled requireAuth
     if (sleIssuance->isFlag(lsfMPTRequireAuth) &&
diff --git a/src/libxrpl/ledger/helpers/TokenHelpers.cpp b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
index f0a0220e1e..b9adfbd3e6 100644
--- a/src/libxrpl/ledger/helpers/TokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
@@ -6,6 +6,7 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
@@ -34,14 +35,6 @@
 
 namespace xrpl {
 
-// Forward declaration for function that remains in View.h/cpp
-bool
-isLPTokenFrozen(
-    ReadView const& view,
-    AccountID const& account,
-    Asset const& asset,
-    Asset const& asset2);
-
 //------------------------------------------------------------------------------
 //
 // Freeze checking (Asset-based)
@@ -164,6 +157,90 @@ checkDeepFrozen(ReadView const& view, AccountID const& account, Asset const& ass
         [&](auto const& issue) { return checkDeepFrozen(view, account, issue); }, asset.value());
 }
 
+[[nodiscard]] TER
+checkWithdrawFreeze(
+    ReadView const& view,
+    AccountID const& srcAcct,
+    AccountID const& submitterAcct,
+    AccountID const& dstAcct,
+    Asset const& asset)
+{
+    XRPL_ASSERT(
+        isPseudoAccount(view, srcAcct), "xrpl::checkWithdrawFreeze : source is a pseudo-account");
+    XRPL_ASSERT(
+        !isPseudoAccount(view, submitterAcct),
+        "xrpl::checkWithdrawFreeze : submitter is not a pseudo-account");
+    XRPL_ASSERT(
+        !isPseudoAccount(view, dstAcct),
+        "xrpl::checkWithdrawFreeze : destination is not a pseudo-account");
+
+    // Funds can always be sent to the issuer
+    if (dstAcct == asset.getIssuer())
+        return tesSUCCESS;
+
+    // If the asset is globally frozen, other checks are redundant
+    if (auto const ret = checkGlobalFrozen(view, asset); !isTesSuccess(ret))
+        return ret;
+
+    // Special case for shares - check if the shares (and the transitive asset) is not frozen
+    if (asset.holds<MPTIssue>() &&
+        isVaultPseudoAccountFrozen(view, srcAcct, asset.get<MPTIssue>(), 0))
+    {
+        return tecLOCKED;
+    }
+
+    // The transfer is from Submitter to Destination via Source (pseudo-account)
+    // Both Source and Submitter must not be frozen to allow sending funds
+    if (auto const ret = checkIndividualFrozen(view, srcAcct, asset); !isTesSuccess(ret))
+        return ret;
+
+    // Check submitter's individual freeze only when Submitter != Destination (a regular freeze
+    // should not block self-withdrawal).
+    if (submitterAcct != dstAcct)
+    {
+        if (auto const ret = checkIndividualFrozen(view, submitterAcct, asset); !isTesSuccess(ret))
+            return ret;
+    }
+
+    // The destination account must not be deep frozen to receive the funds
+    return checkDeepFrozen(view, dstAcct, asset);
+}
+
+[[nodiscard]] TER
+checkDepositFreeze(
+    ReadView const& view,
+    AccountID const& srcAcct,
+    AccountID const& dstAcct,
+    Asset const& asset)
+{
+    XRPL_ASSERT(
+        isPseudoAccount(view, dstAcct),
+        "xrpl::checkDepositFreeze : destination is a pseudo-account");
+    XRPL_ASSERT(
+        !isPseudoAccount(view, srcAcct),
+        "xrpl::checkDepositFreeze : source is not a pseudo-account");
+
+    if (auto const ret = checkGlobalFrozen(view, asset); !isTesSuccess(ret))
+        return ret;
+
+    // Special case for shares - check if the shares and the transitive asset is not frozen
+    if (asset.holds<MPTIssue>() &&
+        isVaultPseudoAccountFrozen(view, dstAcct, asset.get<MPTIssue>(), 0))
+    {
+        return tecLOCKED;
+    }
+
+    if (srcAcct != asset.getIssuer())
+    {
+        if (auto const ret = checkIndividualFrozen(view, srcAcct, asset); !isTesSuccess(ret))
+            return ret;
+    }
+
+    // Unlike regular accounts, pseudo-accounts cannot receive deposits under a regular freeze
+    // because those funds cannot be later withdrawn
+    return checkIndividualFrozen(view, dstAcct, asset);
+}
+
 //------------------------------------------------------------------------------
 //
 // Account balance functions
@@ -776,7 +853,8 @@ directSendNoLimitMultiIOU(
         if (senderID == issuer || receiverID == issuer || issuer == noAccount())
         {
             // Direct send: redeeming IOUs and/or sending own IOUs.
-            if (auto const ter = directSendNoFeeIOU(view, senderID, receiverID, amount, false, j))
+            if (auto const ter = directSendNoFeeIOU(view, senderID, receiverID, amount, false, j);
+                !isTesSuccess(ter))
                 return ter;
             actual += amount;
             // Do not add amount to takeFromSender, because directSendNoFeeIOU took
diff --git a/src/libxrpl/tx/invariants/MPTInvariant.cpp b/src/libxrpl/tx/invariants/MPTInvariant.cpp
index 1176594bbf..278c7a7858 100644
--- a/src/libxrpl/tx/invariants/MPTInvariant.cpp
+++ b/src/libxrpl/tx/invariants/MPTInvariant.cpp
@@ -4,6 +4,8 @@
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
@@ -509,6 +511,15 @@ ValidMPTTransfer::isAuthorized(
     AccountID const& holder,
     bool reqAuth) const
 {
+    // Pseudo-accounts (Vault, LoanBroker, AMM) hold assets on behalf of their
+    // participants and are implicitly authorized for any MPT they hold,
+    // including vault shares whose underlying asset would otherwise require
+    // auth.  Exempt them here rather than relying on requireAuth: the recursive
+    // share -> underlying descent in requireAuth fails for a pseudo-account
+    // that holds the share but not the underlying.
+    if (isPseudoAccount(view, holder, {&sfVaultID, &sfLoanBrokerID, &sfAMMID}))
+        return true;
+
     auto const key = keylet::mptoken(mptid, holder);
     auto const it = deletedAuthorized_.find(key.key);
     if (it != deletedAuthorized_.end())
@@ -524,6 +535,8 @@ ValidMPTTransfer::finalize(
     ReadView const& view,
     beast::Journal const& j)
 {
+    auto const fix330Enabled = view.rules().enabled(fixCleanup3_3_0);
+
     if (hasPrivilege(tx, OverrideFreeze))
         return true;
 
@@ -584,12 +597,29 @@ ValidMPTTransfer::finalize(
                     ++senders;
                 }
 
-                // Check once: if any involved account is frozen, the whole
-                // issuance transfer is considered frozen. Only need to check for
-                // frozen if there is a transfer of funds.
+                // Check once: if any involved account is frozen, the whole issuance transfer is
+                // considered frozen. Only need to check for frozen if there is a transfer of funds.
+                //
+                // Post-fix330: full isFrozen() applies — vault-share transitive freeze is part of
+                // the freeze semantics for all changed holders.
+                //
+                // Pre-fix330: legacy AMM withdraw only checked individual freeze on the
+                // destination, not the transitive vault freeze.  All other paths (and the AMM
+                // account itself as sender) did apply the full check.
+                MPTIssue const issue{mptID};
+                auto const legacyAccountFrozen = [&] {
+                    if (isGlobalFrozen(view, issue) || isIndividualFrozen(view, account, issue))
+                        return true;
+                    bool const isReceiver =
+                        !value.amtBefore.has_value() || *value.amtAfter > *value.amtBefore;
+                    if (txnType == ttAMM_WITHDRAW && isReceiver)
+                        return false;
+                    return isVaultPseudoAccountFrozen(view, account, issue, 0);
+                };
+                bool const accountFrozen =
+                    fix330Enabled ? isFrozen(view, account, issue) : legacyAccountFrozen();
                 if (!invalidTransfer &&
-                    (isFrozen(view, account, MPTIssue{mptID}) ||
-                     !isAuthorized(view, mptID, account, reqAuth)))
+                    (accountFrozen || !isAuthorized(view, mptID, account, reqAuth)))
                 {
                     invalidTransfer = true;
                 }
diff --git a/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp b/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
index 3665850f2d..ff7fec019a 100644
--- a/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
@@ -251,7 +251,36 @@ AMMDeposit::preclaim(PreclaimContext const& ctx)
             : tecUNFUNDED_AMM;
     };
 
-    if (ctx.view.rules().enabled(featureAMMClawback))
+    auto const amount = ctx.tx[~sfAmount];
+    auto const amount2 = ctx.tx[~sfAmount2];
+    auto const ammAccountID = ammSle->getAccountID(sfAccount);
+
+    if (ctx.view.rules().enabled(fixCleanup3_3_0))
+    {
+        // Unified deposit freeze check for both pool assets.
+        // AMMDeposit is not allowed if either asset is frozen.
+        auto checkAsset = [&](Asset const& asset) -> TER {
+            if (auto const ter = requireAuth(ctx.view, asset, accountID, AuthType::WeakAuth))
+            {
+                JLOG(ctx.j.debug()) << "AMM Deposit: account is not authorized, " << asset;
+                return ter;
+            }
+            if (auto const ter = checkDepositFreeze(ctx.view, accountID, ammAccountID, asset))
+            {
+                JLOG(ctx.j.debug())
+                    << "AMM Deposit: frozen, " << to_string(accountID) << " " << to_string(asset);
+                return ter;
+            }
+            return tesSUCCESS;
+        };
+
+        if (auto const ter = checkAsset(ctx.tx[sfAsset]))
+            return ter;
+
+        if (auto const ter = checkAsset(ctx.tx[sfAsset2]))
+            return ter;
+    }
+    else if (ctx.view.rules().enabled(featureAMMClawback))
     {
         // Check if either of the assets is frozen, AMMDeposit is not allowed
         // if either asset is frozen
@@ -283,10 +312,6 @@ AMMDeposit::preclaim(PreclaimContext const& ctx)
             return ter;
     }
 
-    auto const amount = ctx.tx[~sfAmount];
-    auto const amount2 = ctx.tx[~sfAmount2];
-    auto const ammAccountID = ammSle->getAccountID(sfAccount);
-
     auto checkAmount = [&](std::optional<STAmount> const& amount, bool checkBalance) -> TER {
         if (amount)
         {
@@ -301,21 +326,26 @@ AMMDeposit::preclaim(PreclaimContext const& ctx)
                 return ter;
                 // LCOV_EXCL_STOP
             }
-            // AMM account or currency frozen
-            if (auto const ter = checkFrozen(ctx.view, ammAccountID, amount->asset());
-                !isTesSuccess(ter))
+            if (!ctx.view.rules().enabled(fixCleanup3_3_0))
             {
-                JLOG(ctx.j.debug()) << "AMM Deposit: AMM account or currency is frozen or locked, "
-                                    << to_string(accountID);
-                return ter;
-            }
-            // Account frozen
-            if (auto const ter = checkIndividualFrozen(ctx.view, accountID, amount->asset());
-                !isTesSuccess(ter))
-            {
-                JLOG(ctx.j.debug()) << "AMM Deposit: account is frozen or locked, "
-                                    << to_string(accountID) << " " << to_string(amount->asset());
-                return ter;
+                // AMM account or currency frozen
+                if (auto const ter = checkFrozen(ctx.view, ammAccountID, amount->asset());
+                    !isTesSuccess(ter))
+                {
+                    JLOG(ctx.j.debug())
+                        << "AMM Deposit: AMM account or currency is frozen or locked, "
+                        << to_string(accountID);
+                    return ter;
+                }
+                // Account frozen
+                if (auto const ter = checkIndividualFrozen(ctx.view, accountID, amount->asset());
+                    !isTesSuccess(ter))
+                {
+                    JLOG(ctx.j.debug())
+                        << "AMM Deposit: account is frozen or locked, " << to_string(accountID)
+                        << " " << to_string(amount->asset());
+                    return ter;
+                }
             }
             if (checkBalance)
             {
diff --git a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
index 6cbcfb1e50..f26164c5fe 100644
--- a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
@@ -238,21 +238,36 @@ AMMWithdraw::preclaim(PreclaimContext const& ctx)
                     << "AMM Withdraw: account is not authorized, " << amount->asset();
                 return ter;
             }
-            // AMM account or currency frozen
-            if (auto const ter = checkFrozen(ctx.view, ammAccountID, amount->asset());
-                !isTesSuccess(ter))
+            if (ctx.view.rules().enabled(fixCleanup3_3_0))
             {
-                JLOG(ctx.j.debug()) << "AMM Withdraw: AMM account or currency is frozen or locked, "
-                                    << to_string(accountID);
-                return ter;
+                if (auto const ret = checkWithdrawFreeze(
+                        ctx.view, ammAccountID, accountID, accountID, amount->asset()))
+                {
+                    JLOG(ctx.j.debug()) << "AMM Withdraw: frozen, " << to_string(accountID) << " "
+                                        << to_string(amount->asset());
+                    return ret;
+                }
             }
-            // Account frozen
-            if (auto const ter = checkIndividualFrozen(ctx.view, accountID, amount->asset());
-                !isTesSuccess(ter))
+            else
             {
-                JLOG(ctx.j.debug()) << "AMM Withdraw: account is frozen or locked, "
-                                    << to_string(accountID) << " " << to_string(amount->asset());
-                return ter;
+                // AMM account or currency frozen
+                if (auto const ter = checkFrozen(ctx.view, ammAccountID, amount->asset());
+                    !isTesSuccess(ter))
+                {
+                    JLOG(ctx.j.debug())
+                        << "AMM Withdraw: AMM account or currency is frozen or locked, "
+                        << to_string(accountID);
+                    return ter;
+                }
+                // Account frozen
+                if (auto const ter = checkIndividualFrozen(ctx.view, accountID, amount->asset());
+                    !isTesSuccess(ter))
+                {
+                    JLOG(ctx.j.debug())
+                        << "AMM Withdraw: account is frozen or locked, " << to_string(accountID)
+                        << " " << to_string(amount->asset());
+                    return ter;
+                }
             }
         }
         return tesSUCCESS;
@@ -302,6 +317,25 @@ AMMWithdraw::preclaim(PreclaimContext const& ctx)
     return tesSUCCESS;
 }
 
+FreezeHandling
+AMMWithdraw::issuerFreezeHandling() const
+{
+    // When the withdrawer is the issuer of a pool asset, the issuer can
+    // always receive their own token — even when the pool is frozen.
+    // Use IgnoreFreeze so ammHolds returns real balances instead of zero.
+    if (!ctx_.view().rules().enabled(fixCleanup3_3_0))
+        return FreezeHandling::ZeroIfFrozen;
+
+    auto const asset1 = Asset{ctx_.tx[sfAsset]};
+    auto const asset2 = Asset{ctx_.tx[sfAsset2]};
+    if (!asset1.native() && accountID_ == asset1.getIssuer())
+        return FreezeHandling::IgnoreFreeze;
+    if (!asset2.native() && accountID_ == asset2.getIssuer())
+        return FreezeHandling::IgnoreFreeze;
+
+    return FreezeHandling::ZeroIfFrozen;
+}
+
 std::pair<TER, bool>
 AMMWithdraw::applyGuts(Sandbox& sb)
 {
@@ -329,18 +363,19 @@ AMMWithdraw::applyGuts(Sandbox& sb)
 
     auto const tfee = getTradingFee(ctx_.view(), *ammSle, accountID_);
 
+    auto const freezeHandling = issuerFreezeHandling();
+
     auto const expected = ammHolds(
         sb,
         *ammSle,
         amount ? amount->asset() : std::optional<Asset>{},
         amount2 ? amount2->asset() : std::optional<Asset>{},
-        FreezeHandling::ZeroIfFrozen,
+        freezeHandling,
         AuthHandling::ZeroIfUnauthorized,
         ctx_.journal);
     if (!expected)
         return {expected.error(), false};
     auto const [amountBalance, amount2Balance, lptAMMBalance] = *expected;
-
     auto const subTxType = ctx_.tx.getFlags() & tfWithdrawSubTx;
 
     auto const [result, newLPTokenBalance] = [&,
@@ -469,7 +504,7 @@ AMMWithdraw::withdraw(
         lpTokensAMMBalance,
         lpTokensWithdraw,
         tfee,
-        FreezeHandling::ZeroIfFrozen,
+        issuerFreezeHandling(),
         AuthHandling::ZeroIfUnauthorized,
         isWithdrawAll(ctx_.tx),
         preFeeBalance_,
@@ -756,7 +791,7 @@ AMMWithdraw::equalWithdrawTokens(
         lpTokens,
         lpTokensWithdraw,
         tfee,
-        FreezeHandling::ZeroIfFrozen,
+        issuerFreezeHandling(),
         AuthHandling::ZeroIfUnauthorized,
         isWithdrawAll(ctx_.tx),
         preFeeBalance_,
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
index 76a5493a73..69b28b57af 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
@@ -43,6 +43,8 @@ LoanBrokerCoverDeposit::preflight(PreflightContext const& ctx)
 TER
 LoanBrokerCoverDeposit::preclaim(PreclaimContext const& ctx)
 {
+    auto const fix320Enabled = ctx.view.rules().enabled(fixCleanup3_2_0);
+    auto const fix330Enabled = ctx.view.rules().enabled(fixCleanup3_3_0);
     auto const& tx = ctx.tx;
 
     auto const account = tx[sfAccount];
@@ -77,12 +79,21 @@ LoanBrokerCoverDeposit::preclaim(PreclaimContext const& ctx)
     // Cannot transfer a non-transferable Asset
     if (auto const ret = canTransfer(ctx.view, vaultAsset, account, pseudoAccountID))
         return ret;
-    // Cannot transfer a frozen Asset
-    if (auto const ret = checkFrozen(ctx.view, account, vaultAsset))
-        return ret;
-    // Pseudo-account cannot receive if asset is deep frozen
-    if (auto const ret = checkDeepFrozen(ctx.view, pseudoAccountID, vaultAsset))
-        return ret;
+
+    if (fix330Enabled)
+    {
+        if (auto const ret = checkDepositFreeze(ctx.view, account, pseudoAccountID, vaultAsset))
+            return ret;
+    }
+    else
+    {
+        if (auto const ret = checkFrozen(ctx.view, account, vaultAsset))
+            return ret;
+
+        if (auto const ret = checkDeepFrozen(ctx.view, pseudoAccountID, vaultAsset))
+            return ret;
+    }
+
     // Cannot transfer unauthorized asset
     if (auto const ret = requireAuth(ctx.view, vaultAsset, account, AuthType::StrongAuth))
         return ret;
@@ -92,7 +103,6 @@ LoanBrokerCoverDeposit::preclaim(PreclaimContext const& ctx)
     // `sfCoverAvailable  +=` could credit the broker more than the depositor paid  Computing it
     // here in preclaim lets  us reject sub-cover-scale dust early with tecPRECISION_LOSS instead of
     // failing only in  doApply.
-    bool const fix320Enabled = ctx.view.rules().enabled(fixCleanup3_2_0);
     auto const roundedAmount = [&]() -> STAmount {
         if (!fix320Enabled)
             return tx[sfAmount];
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
index 426f77cc70..008857a4ad 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
@@ -55,6 +55,8 @@ LoanBrokerCoverWithdraw::preflight(PreflightContext const& ctx)
 TER
 LoanBrokerCoverWithdraw::preclaim(PreclaimContext const& ctx)
 {
+    auto const fix320Enabled = ctx.view.rules().enabled(fixCleanup3_2_0);
+    auto const fix330Enabled = ctx.view.rules().enabled(fixCleanup3_3_0);
     auto const& tx = ctx.tx;
 
     auto const account = tx[sfAccount];
@@ -103,8 +105,7 @@ LoanBrokerCoverWithdraw::preclaim(PreclaimContext const& ctx)
     // the lsfMPTCanTransfer flag check, so an issuer cannot trap a broker's
     // first-loss capital. Other transferability checks (IOU NoRipple, freeze,
     // requireAuth) still apply.
-    auto const waive = ctx.view.rules().enabled(fixCleanup3_2_0) ? WaiveMPTCanTransfer::Yes
-                                                                 : WaiveMPTCanTransfer::No;
+    auto const waive = fix320Enabled ? WaiveMPTCanTransfer::Yes : WaiveMPTCanTransfer::No;
     if (auto const ret = canTransfer(ctx.view, vaultAsset, pseudoAccountID, dstAcct, waive))
         return ret;
 
@@ -125,22 +126,30 @@ LoanBrokerCoverWithdraw::preclaim(PreclaimContext const& ctx)
     if (auto const ter = requireAuth(ctx.view, vaultAsset, dstAcct, authType))
         return ter;
 
-    // Check for freezes, unless sending directly to the issuer
-    if (dstAcct != vaultAsset.getIssuer())
+    if (fix330Enabled)
     {
-        // Cannot send a frozen Asset
-        if (auto const ret = checkFrozen(ctx.view, pseudoAccountID, vaultAsset))
-            return ret;
-        // Destination account cannot receive if asset is deep frozen
-        if (auto const ret = checkDeepFrozen(ctx.view, dstAcct, vaultAsset))
+        if (auto const ret =
+                checkWithdrawFreeze(ctx.view, pseudoAccountID, account, dstAcct, vaultAsset))
             return ret;
     }
+    else
+    {  // Check for freezes, unless sending directly to the issuer
+        if (dstAcct != vaultAsset.getIssuer())
+        {
+            // Cannot send a frozen Asset
+            if (auto const ret = checkFrozen(ctx.view, pseudoAccountID, vaultAsset))
+                return ret;
+            // Destination account cannot receive if asset is deep frozen
+            if (auto const ret = checkDeepFrozen(ctx.view, dstAcct, vaultAsset))
+                return ret;
+        }
+    }
 
     auto const coverAvail = sleBroker->at(sfCoverAvailable);
     // Cover Rate is in 1/10 bips units
     auto const currentDebtTotal = sleBroker->at(sfDebtTotal);
     auto const minimumCover = [&]() {
-        if (ctx.view.rules().enabled(fixCleanup3_2_0))
+        if (fix320Enabled)
         {
             return minimumBrokerCover(
                 currentDebtTotal, TenthBips32{sleBroker->at(sfCoverRateMinimum)}, vault);
@@ -159,11 +168,15 @@ LoanBrokerCoverWithdraw::preclaim(PreclaimContext const& ctx)
     if ((coverAvail - amount) < minimumCover)
         return tecINSUFFICIENT_FUNDS;
 
+    auto const freezeHandling = fix330Enabled && dstAcct == vaultAsset.getIssuer()
+        ? FreezeHandling::IgnoreFreeze
+        : FreezeHandling::ZeroIfFrozen;
+
     if (accountHolds(
             ctx.view,
             pseudoAccountID,
             vaultAsset,
-            FreezeHandling::ZeroIfFrozen,
+            freezeHandling,
             AuthHandling::ZeroIfUnauthorized,
             ctx.j) < amount)
         return tecINSUFFICIENT_FUNDS;
diff --git a/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp b/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
index b70543d280..d5eb80b84d 100644
--- a/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
@@ -63,6 +63,9 @@ VaultDeposit::preflight(PreflightContext const& ctx)
 TER
 VaultDeposit::preclaim(PreclaimContext const& ctx)
 {
+    auto const fix320Enabled = ctx.view.rules().enabled(fixCleanup3_2_0);
+    auto const fix330Enabled = ctx.view.rules().enabled(fixCleanup3_3_0);
+
     auto const vault = ctx.view.read(keylet::vault(ctx.tx[sfVaultID]));
     if (!vault)
         return tecNO_ENTRY;
@@ -107,13 +110,21 @@ VaultDeposit::preclaim(PreclaimContext const& ctx)
         // LCOV_EXCL_STOP
     }
 
-    // Cannot deposit inside Vault an Asset frozen for the depositor
-    if (isFrozen(ctx.view, account, vaultAsset))
-        return vaultAsset.holds<Issue>() ? tecFROZEN : tecLOCKED;
+    if (fix330Enabled)
+    {
+        if (auto const ret = checkDepositFreeze(ctx.view, account, vaultAccount, vaultAsset))
+            return ret;
+    }
+    else
+    {
+        // Cannot deposit inside Vault an Asset frozen for the depositor
+        if (isFrozen(ctx.view, account, vaultAsset))
+            return vaultAsset.holds<Issue>() ? tecFROZEN : tecLOCKED;
 
-    // Cannot deposit if the shares of the vault are frozen
-    if (isFrozen(ctx.view, account, vaultShare))
-        return tecLOCKED;
+        // Cannot deposit if the shares of the vault are frozen
+        if (isFrozen(ctx.view, account, vaultShare))
+            return tecLOCKED;
+    }
 
     if (vault->isFlag(lsfVaultPrivate) && account != vault->at(sfOwner))
     {
@@ -141,7 +152,6 @@ VaultDeposit::preclaim(PreclaimContext const& ctx)
     if (auto const ter = requireAuth(ctx.view, vaultAsset, account); !isTesSuccess(ter))
         return ter;
 
-    bool const fix320Enabled = ctx.view.rules().enabled(fixCleanup3_2_0);
     auto const roundedAmount = fix320Enabled ? roundToVaultScale(amount, vault) : amount;
 
     if (fix320Enabled && roundedAmount == beast::kZero)
diff --git a/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp b/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
index 815d8ccd5b..3d30005876 100644
--- a/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
@@ -65,6 +65,10 @@ VaultWithdraw::preflight(PreflightContext const& ctx)
 TER
 VaultWithdraw::preclaim(PreclaimContext const& ctx)
 {
+    auto const fix313Enabled = ctx.view.rules().enabled(fixCleanup3_1_3);
+    auto const fix320Enabled = ctx.view.rules().enabled(fixCleanup3_2_0);
+    auto const fix330Enabled = ctx.view.rules().enabled(fixCleanup3_3_0);
+
     auto const vault = ctx.view.read(keylet::vault(ctx.tx[sfVaultID]));
     if (!vault)
         return tecNO_ENTRY;
@@ -82,8 +86,7 @@ VaultWithdraw::preclaim(PreclaimContext const& ctx)
     // lsfMPTCanTransfer flag check, so an issuer cannot trap depositor funds.
     // Other transferability checks (IOU NoRipple, freeze, requireAuth) still
     // apply.
-    auto const waive = ctx.view.rules().enabled(fixCleanup3_2_0) ? WaiveMPTCanTransfer::Yes
-                                                                 : WaiveMPTCanTransfer::No;
+    auto const waive = fix320Enabled ? WaiveMPTCanTransfer::Yes : WaiveMPTCanTransfer::No;
     if (auto ter = canTransfer(ctx.view, vaultAsset, vaultAccount, dstAcct, waive);
         !isTesSuccess(ter))
     {
@@ -100,7 +103,7 @@ VaultWithdraw::preclaim(PreclaimContext const& ctx)
         // LCOV_EXCL_STOP
     }
 
-    if (ctx.view.rules().enabled(fixCleanup3_1_3) && amount.asset() == vaultShare)
+    if (fix313Enabled && amount.asset() == vaultShare)
     {
         // Post-fixCleanup3_1_3: if the user specified shares, convert
         // to the equivalent asset amount before checking withdrawal
@@ -160,15 +163,30 @@ VaultWithdraw::preclaim(PreclaimContext const& ctx)
     if (auto const ter = requireAuth(ctx.view, vaultAsset, dstAcct, authType); !isTesSuccess(ter))
         return ter;
 
-    // Cannot withdraw from a Vault an Asset frozen for the destination account
-    if (auto const ret = checkFrozen(ctx.view, dstAcct, vaultAsset))
-        return ret;
-
-    // Cannot return shares to the vault, if the underlying asset was frozen for
-    // the submitter
-    if (auto const ret = checkFrozen(ctx.view, account, Asset{vaultShare}))
-        return ret;
+    if (fix330Enabled)
+    {
+        // checkWithdrawFreeze checks the underlying asset on the source
+        // (vault pseudo-account), the submitter, and the destination.
+        // A separate share-level freeze check is unnecessary: vault shares
+        // are issued by the vault pseudo-account, which cannot submit
+        // MPTokenIssuanceSet to individually lock a holder's MPToken.
+        // The only way shares become locked is transitively via the
+        // underlying asset, which checkWithdrawFreeze covers.
+        if (auto const ret =
+                checkWithdrawFreeze(ctx.view, vaultAccount, account, dstAcct, vaultAsset))
+            return ret;
+    }
+    else
+    {
+        // Cannot withdraw from a Vault an Asset frozen for the destination account
+        if (auto const ret = checkFrozen(ctx.view, dstAcct, vaultAsset))
+            return ret;
 
+        // Cannot return shares to the vault, if the underlying asset was frozen for
+        // the submitter
+        if (auto const ret = checkFrozen(ctx.view, account, Asset{vaultShare}))
+            return ret;
+    }
     return tesSUCCESS;
 }
 
@@ -254,8 +272,14 @@ VaultWithdraw::doApply()
         return tecPATH_DRY;
     }
 
-    if (accountHolds(
-            view(), accountID_, share, FreezeHandling::ZeroIfFrozen, AuthHandling::IgnoreAuth, j_) <
+    // Post-fixCleanup3_3_0: preclaim already validated all freeze conditions
+    // (checkWithdrawFreeze), so IgnoreFreeze avoids a redundant check that
+    // would incorrectly return zero for vault pseudo-accounts whose shares
+    // are frozen via a transitively frozen underlying asset.
+    auto const freezeHandling = view().rules().enabled(fixCleanup3_3_0)
+        ? FreezeHandling::IgnoreFreeze
+        : FreezeHandling::ZeroIfFrozen;
+    if (accountHolds(view(), accountID_, share, freezeHandling, AuthHandling::IgnoreAuth, j_) <
         sharesRedeemed)
     {
         JLOG(j_.debug()) << "VaultWithdraw: account doesn't hold enough shares";
@@ -358,10 +382,9 @@ VaultWithdraw::doApply()
         // else quietly ignore, account balance is not zero
     }
 
-    auto const dstAcct = ctx_.tx[~sfDestination].value_or(accountID_);
-
     associateAsset(*vault, vaultAsset);
 
+    auto const dstAcct = ctx_.tx[~sfDestination].value_or(accountID_);
     return doWithdraw(
         view(), ctx_.tx, accountID_, dstAcct, vaultAccount, preFeeBalance_, assetsWithdrawn, j_);
 }
diff --git a/src/test/app/AMMMPT_test.cpp b/src/test/app/AMMMPT_test.cpp
index 5b576b41e4..9ff6c65c17 100644
--- a/src/test/app/AMMMPT_test.cpp
+++ b/src/test/app/AMMMPT_test.cpp
@@ -18,10 +18,12 @@
 #include <test/jtx/ter.h>
 #include <test/jtx/trust.h>
 #include <test/jtx/txflags.h>
+#include <test/jtx/vault.h>
 
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/helpers/AMMHelpers.h>
@@ -46,6 +48,7 @@
 #include <chrono>
 #include <cstdint>
 #include <functional>
+#include <initializer_list>
 #include <memory>
 #include <optional>
 #include <string>
@@ -726,13 +729,14 @@ private:
 
             ammAlice.deposit(carol_, 1'000, std::nullopt, std::nullopt, Ter(tecLOCKED));
 
-            if (!features[featureAMMClawback])
+            // Post-fixCleanup3_3_0 a locked holder cannot deposit the other
+            // (non-locked) token either, matching featureAMMClawback.
+            if (!features[featureAMMClawback] && !features[fixCleanup3_3_0])
             {
                 ammAlice.deposit(carol_, USD(100), std::nullopt, std::nullopt, std::nullopt);
             }
             else
             {
-                // Carol can not deposit non-frozen token either
                 ammAlice.deposit(
                     carol_, USD(100), std::nullopt, std::nullopt, std::nullopt, Ter(tecLOCKED));
             }
@@ -753,8 +757,15 @@ private:
                 gw_, STAmount{Issue{gw_["USD"].currency, ammAlice.ammAccount()}, 0}, tfSetFreeze));
             env.close();
 
-            // Can deposit non-frozen token
-            ammAlice.deposit(carol_, btc(100), std::nullopt, std::nullopt, std::nullopt);
+            // Post-fixCleanup3_3_0 the deposit checks both pool assets, so the
+            // non-frozen token cannot be deposited while the AMM's USD is frozen.
+            ammAlice.deposit(
+                carol_,
+                btc(100),
+                std::nullopt,
+                std::nullopt,
+                std::nullopt,
+                features[fixCleanup3_3_0] ? Ter(tecFROZEN) : Ter(tesSUCCESS));
 
             // Cannot deposit frozen token
             ammAlice.deposit(carol_, 1'000'000, std::nullopt, std::nullopt, Ter(tecFROZEN));
@@ -773,8 +784,15 @@ private:
             // Individually lock AMM
             btc.set({.holder = ammAlice.ammAccount(), .flags = tfMPTLock});
 
-            // Can deposit non-frozen token
-            ammAlice.deposit(carol_, USD(100), std::nullopt, std::nullopt, std::nullopt);
+            // Post-fixCleanup3_3_0 the non-locked token cannot be deposited
+            // while the AMM's BTC is locked.
+            ammAlice.deposit(
+                carol_,
+                USD(100),
+                std::nullopt,
+                std::nullopt,
+                std::nullopt,
+                features[fixCleanup3_3_0] ? Ter(tecLOCKED) : Ter(tesSUCCESS));
 
             // Can not deposit locked token
             ammAlice.deposit(carol_, 1'000, std::nullopt, std::nullopt, Ter(tecLOCKED));
@@ -788,7 +806,9 @@ private:
             ammAlice.deposit(carol_, btc(100), std::nullopt, std::nullopt, std::nullopt);
         }
 
-        // Individually lock MPT (AMM) account with MPT/MPT AMM
+        // Individually lock MPT (AMM) account with MPT/MPT AMM.
+        // This block always runs with all amendments (incl. fixCleanup3_3_0),
+        // so the deposit checks both pool assets unconditionally.
         {
             Env env{*this};
             env.fund(XRP(10'000), gw_, alice_, carol_);
@@ -826,8 +846,10 @@ private:
             // Individually lock MPT BTC (AMM) account
             btc.set({.holder = ammAlice.ammAccount(), .flags = tfMPTLock});
 
-            // Can deposit non-locked token USD
-            ammAlice.deposit(carol_, usd(100), std::nullopt, std::nullopt, std::nullopt);
+            // Post-fixCleanup3_3_0 the non-locked token USD cannot be deposited
+            // while the AMM's BTC is locked.
+            ammAlice.deposit(
+                carol_, usd(100), std::nullopt, std::nullopt, std::nullopt, Ter(tecLOCKED));
 
             // Can not deposit locked token BTC
             ammAlice.deposit(carol_, 1'000, std::nullopt, std::nullopt, Ter(tecLOCKED));
@@ -843,8 +865,10 @@ private:
             // Individually Lock MPT USD (AMM) account
             usd.set({.holder = ammAlice.ammAccount(), .flags = tfMPTLock});
 
-            // Can deposit non-locked token BTC
-            ammAlice.deposit(carol_, btc(100), std::nullopt, std::nullopt, std::nullopt);
+            // Post-fixCleanup3_3_0 the non-locked token BTC cannot be deposited
+            // while the AMM's USD is locked.
+            ammAlice.deposit(
+                carol_, btc(100), std::nullopt, std::nullopt, std::nullopt, Ter(tecLOCKED));
 
             // Can not deposit locked token USD
             ammAlice.deposit(carol_, 1'000, std::nullopt, std::nullopt, Ter(tecLOCKED));
@@ -876,7 +900,9 @@ private:
             AMM amm(env, alice, XRP(10'000), btc(10'000));
             env.close();
 
-            if (!features[featureAMMClawback])
+            // Post-fixCleanup3_3_0 the deposit requires authorization for both
+            // pool assets, so the unauthorized MPT blocks the XRP deposit too.
+            if (!features[featureAMMClawback] && !features[fixCleanup3_3_0])
             {
                 amm.deposit(carol, XRP(10), std::nullopt, std::nullopt, std::nullopt);
             }
@@ -6863,6 +6889,173 @@ private:
         BEAST_EXPECT(!amm.ammExists());
     }
 
+    void
+    testAMMWithVaultShares()
+    {
+        testcase("AMM with vault shares — underlying freeze blocks share withdrawal");
+        using namespace jtx;
+        // AMMTestBase::testableAmendments() strips featureSingleAssetVault,
+        // but vault shares require it. Use the global jtx set directly.
+        FeatureBitset const all{jtx::testableAmendments()};
+
+        // When alice's underlying asset is individually frozen:
+        //
+        // Deposit (post-fixCleanup3_3_0): checkDepositFreeze checks the AMM
+        //   pseudo-account's underlying, not alice's — deposit is allowed.
+        //   Pre-fix: featureAMMClawback calls isFrozen(alice, share) which
+        //   descends via isVaultPseudoAccountFrozen(alice,...) and finds the
+        //   frozen underlying — deposit is blocked.
+        //
+        // Withdrawal (post-fixCleanup3_3_0): checkWithdrawFreeze ends with
+        //   checkDeepFrozen(alice, share) which calls isFrozen(alice, share)
+        //   and finds the frozen underlying — withdrawal is blocked.
+        //   Pre-fix: the old path only checks the AMM account's MPToken lock,
+        //   which is unset — withdrawal succeeds.
+
+        auto runIOU = [&](FeatureBitset const& features) {
+            bool const fix330 = features[fixCleanup3_3_0];
+            Env env{*this, envconfig(), features, nullptr, beast::Severity::Disabled};
+
+            env.fund(XRP(100'000), gw_, alice_);
+            env(fset(gw_, asfDefaultRipple));
+            env.close();
+
+            PrettyAsset const iou = gw_["IOU"];
+            env.trust(iou(1'000'000), alice_);
+            env(pay(gw_, alice_, iou(10'000)));
+            env.close();
+
+            Vault const vault{env};
+            auto [createTx, vaultKeylet] = vault.create({.owner = alice_, .asset = iou});
+            env(createTx);
+            env.close();
+
+            // 200 IOU → 200,000,000 vault shares (IOU vault scale = 6)
+            env(vault.deposit({.depositor = alice_, .id = vaultKeylet.key, .amount = iou(200)}));
+            env.close();
+
+            auto const shareMPTID = env.le(vaultKeylet)->at(sfShareMPTID);
+            // Use half the shares for the AMM; alice keeps the other half.
+            STAmount const shareAmt{MPTIssue{shareMPTID}, 100'000'000};
+            // Pool: XRP(100) = 1e8 drops, shares = 1e8 → LP ≈ 1e8
+            AMM amm{env, alice_, XRP(100), shareAmt};
+            env.close();
+
+            // Freeze alice's IOU trustline (individual freeze on underlying).
+            env(trust(gw_, iou(0), alice_, tfSetFreeze));
+            env.close();
+
+            // post-fix330: checkDepositFreeze checks AMM pseudo's underlying
+            //              (not alice's) → deposit is allowed
+            // pre-fix330:  featureAMMClawback path calls isFrozen(alice, share)
+            //              which descends to alice's frozen IOU → tecLOCKED
+            amm.deposit(
+                {.account = alice_,
+                 .asset1In = XRP(1),
+                 .err = Ter(fix330 ? TER(tesSUCCESS) : TER(tecLOCKED))});
+
+            // post-fix330: checkWithdrawFreeze → checkDeepFrozen(alice, share)
+            //              descends to alice's frozen IOU → tecLOCKED
+            // pre-fix330:  the AMM pseudo-account is not authorized for the
+            //              share's underlying (requireAuth recurses share→IOU
+            //              and the AMM holds no IOU trustline), so
+            //              accountHolds(ZeroIfUnauthorized) reports the pool's
+            //              share balance as 0 and the withdrawal math fails →
+            //              tecAMM_FAILED.  Vault shares deposited into an AMM are
+            //              only withdrawable once fixCleanup3_3_0 exempts the
+            //              pseudo-account from the recursive auth check.
+            amm.withdraw(
+                {.account = alice_,
+                 .tokens = 1'000,
+                 .err = Ter(fix330 ? TER(tecLOCKED) : TER(tecAMM_FAILED))});
+
+            env(trust(gw_, iou(0), alice_, tfClearFreeze));
+            env.close();
+
+            // Lifting the freeze lets the deposit through in both cases.  The
+            // withdrawal only succeeds post-fix330; pre-fix330 the share balance
+            // remains inaccessible to the unauthorized pseudo-account, so the
+            // shares stay stuck → tecAMM_FAILED.
+            amm.deposit({.account = alice_, .asset1In = XRP(1)});
+            amm.withdraw(
+                {.account = alice_,
+                 .tokens = 1'000,
+                 .err = Ter(fix330 ? TER(tesSUCCESS) : TER(tecAMM_FAILED))});
+        };
+
+        runIOU(all);
+        runIOU(all - fixCleanup3_3_0);
+
+        auto runMPT = [&](FeatureBitset const& features) {
+            bool const fix330 = features[fixCleanup3_3_0];
+            // Expected freeze failures fire invariant checks that log at Error;
+            // silence them so the test output stays clean.
+            Env env{*this, envconfig(), features, nullptr, beast::Severity::Disabled};
+
+            env.fund(XRP(100'000), gw_, alice_);
+            env.close();
+
+            MPTTester mptt{env, gw_, kMptInitNoFund};
+            mptt.create({.flags = kMptDexFlags | tfMPTCanLock});
+            PrettyAsset const mpt = mptt.issuanceID();
+            mptt.authorize({.account = alice_});
+            env(pay(gw_, alice_, mpt(30'000)));
+            env.close();
+
+            Vault const vault{env};
+            auto [createTx, vaultKeylet] = vault.create({.owner = alice_, .asset = mpt});
+            env(createTx);
+            env.close();
+
+            // 20000 MPT → 20000 vault shares (MPT vault scale = 0)
+            env(vault.deposit({.depositor = alice_, .id = vaultKeylet.key, .amount = mpt(20'000)}));
+            env.close();
+
+            auto const shareMPTID = env.le(vaultKeylet)->at(sfShareMPTID);
+            // Use half the shares for the AMM; alice keeps the other half.
+            // Pool: XRP(100) = 1e8 drops, shares = 10000 → LP ≈ 1e6
+            STAmount const shareAmt{MPTIssue{shareMPTID}, 10'000};
+            AMM amm{env, alice_, XRP(100), shareAmt};
+            env.close();
+
+            // Lock alice's underlying MPT (individual lock).
+            mptt.set({.holder = alice_, .flags = tfMPTLock});
+
+            // Same pre/post-fix330 semantics as the IOU case above.
+            amm.deposit(
+                {.account = alice_,
+                 .asset1In = XRP(1),
+                 .err = Ter(fix330 ? TER(tesSUCCESS) : TER(tecLOCKED))});
+
+            // {.tokens = 1'000} → frac = 1000/1e6 = 0.001
+            // XRP out = 1e8 * 0.001 = 1e5 drops, shares out = 10000 * 0.001 = 10
+            // post-fix330: checkWithdrawFreeze sees alice's locked underlying
+            //              MPT via the share → tecLOCKED.
+            // pre-fix330:  the AMM pseudo-account is unauthorized for the
+            //              share's underlying MPT (it holds no underlying
+            //              MPToken), so accountHolds(ZeroIfUnauthorized) zeros
+            //              the pool's share balance and the math fails →
+            //              tecAMM_FAILED.
+            amm.withdraw(
+                {.account = alice_,
+                 .tokens = 1'000,
+                 .err = Ter(fix330 ? TER(tecLOCKED) : TER(tecAMM_FAILED))});
+
+            mptt.set({.holder = alice_, .flags = tfMPTUnlock});
+
+            // Unlocking lets the deposit through; the withdrawal only succeeds
+            // post-fix330 (pre-fix330 the shares remain stuck → tecAMM_FAILED).
+            amm.deposit({.account = alice_, .asset1In = XRP(1)});
+            amm.withdraw(
+                {.account = alice_,
+                 .tokens = 1'000,
+                 .err = Ter(fix330 ? TER(tesSUCCESS) : TER(tecAMM_FAILED))});
+        };
+
+        runMPT(all);
+        runMPT(all - fixCleanup3_3_0);
+    }
+
     void
     testAMMDepositWithFrozenAssets()
     {
@@ -7085,8 +7278,8 @@ private:
         FeatureBitset const all{jtx::testableAmendments()};
         testInstanceCreate();
         testInvalidInstance();
-        testInvalidDeposit(all);
-        testInvalidDeposit(all - featureAMMClawback);
+        for (auto const& f : jtx::amendmentCombinations({fixCleanup3_3_0, featureAMMClawback}, all))
+            testInvalidDeposit(f);
         testDeposit();
         testInvalidWithdraw();
         testWithdraw();
@@ -7113,6 +7306,7 @@ private:
         testLPTokenBalance(all);
         testLPTokenBalance(all - fixAMMv1_3);
         testAMMDepositWithFrozenAssets();
+        testAMMWithVaultShares();
         testAutoDelete();
     }
 };
diff --git a/src/test/app/AMM_test.cpp b/src/test/app/AMM_test.cpp
index b01d58ddff..3672c4a68a 100644
--- a/src/test/app/AMM_test.cpp
+++ b/src/test/app/AMM_test.cpp
@@ -57,6 +57,7 @@
 #include <cstdint>
 #include <cstring>
 #include <functional>
+#include <initializer_list>
 #include <memory>
 #include <optional>
 #include <stdexcept>
@@ -85,6 +86,13 @@ private:
         return jtx::testableAmendments() - featureSingleAssetVault - featureLendingProtocol;
     }
 
+    // Seed from the local testableAmendments() which strips SAV and Lending.
+    static std::vector<FeatureBitset>
+    amendmentCombinations(std::initializer_list<uint256> features)
+    {
+        return jtx::amendmentCombinations(features, testableAmendments());
+    }
+
     void
     testInstanceCreate()
     {
@@ -746,18 +754,19 @@ private:
         testAMM(
             [&](AMM& ammAlice, Env& env) {
                 env(fset(gw_, asfGlobalFreeze));
-                if (!features[featureAMMClawback])
+                auto const freezeBlocksAll =
+                    features[featureAMMClawback] || features[fixCleanup3_3_0];
+                if (!freezeBlocksAll)
                 {
                     // If the issuer set global freeze, the holder still can
-                    // deposit the other non-frozen token when AMMClawback is
-                    // not enabled.
+                    // deposit the other non-frozen token when neither
+                    // AMMClawback nor fixCleanup3_3_0 is enabled.
                     ammAlice.deposit(carol_, XRP(100));
                 }
                 else
                 {
                     // If the issuer set global freeze, the holder cannot
-                    // deposit the other non-frozen token when AMMClawback is
-                    // enabled.
+                    // deposit the other non-frozen token.
                     ammAlice.deposit(
                         carol_, XRP(100), std::nullopt, std::nullopt, std::nullopt, Ter(tecFROZEN));
                 }
@@ -786,16 +795,18 @@ private:
             [&](AMM& ammAlice, Env& env) {
                 env(trust(gw_, carol_["USD"](0), tfSetFreeze));
                 env.close();
-                if (!features[featureAMMClawback])
+                auto const freezeBlocksAll =
+                    features[featureAMMClawback] || features[fixCleanup3_3_0];
+                if (!freezeBlocksAll)
                 {
-                    // Can deposit non-frozen token if AMMClawback is not
-                    // enabled
+                    // Can deposit non-frozen token if neither AMMClawback
+                    // nor fixCleanup3_3_0 is enabled
                     ammAlice.deposit(carol_, XRP(100));
                 }
                 else
                 {
                     // Cannot deposit non-frozen token if the other token is
-                    // frozen when AMMClawback is enabled
+                    // frozen
                     ammAlice.deposit(
                         carol_, XRP(100), std::nullopt, std::nullopt, std::nullopt, Ter(tecFROZEN));
                 }
@@ -810,8 +821,18 @@ private:
                     STAmount{Issue{gw_["USD"].currency, ammAlice.ammAccount()}, 0},
                     tfSetFreeze));
                 env.close();
-                // Can deposit non-frozen token
-                ammAlice.deposit(carol_, XRP(100));
+                // Post-fixCleanup3_3_0: checkDepositFreeze checks both pool
+                // assets against the AMM account, so depositing the
+                // non-frozen token is also blocked.
+                if (!features[fixCleanup3_3_0])
+                {
+                    ammAlice.deposit(carol_, XRP(100));
+                }
+                else
+                {
+                    ammAlice.deposit(
+                        carol_, XRP(100), std::nullopt, std::nullopt, std::nullopt, Ter(tecFROZEN));
+                }
                 ammAlice.deposit(carol_, 1'000'000, std::nullopt, std::nullopt, Ter(tecFROZEN));
                 ammAlice.deposit(
                     carol_, USD(100), std::nullopt, std::nullopt, std::nullopt, Ter(tecFROZEN));
@@ -861,11 +882,10 @@ private:
             AMM amm(env, alice_, XRP(10), gw_["USD"](10), Ter(tesSUCCESS));
             env.close();
 
-            if (features[featureAMMClawback])
+            if (features[featureAMMClawback] || features[fixCleanup3_3_0])
             {
-                // if featureAMMClawback is enabled, bob_ can not deposit XRP
-                // because he's not authorized to hold the paired token
-                // gw_["USD"].
+                // bob_ can not deposit XRP because he's not authorized to
+                // hold the paired token gw_["USD"].
                 amm.deposit(
                     bob_, XRP(10), std::nullopt, std::nullopt, std::nullopt, Ter(tecNO_AUTH));
             }
@@ -1734,36 +1754,57 @@ private:
         });
 
         // Globally frozen asset
-        testAMM([&](AMM& ammAlice, Env& env) {
-            ammAlice.deposit({.account = gw_, .asset1In = USD(1'000), .asset2In = XRP(1'000)});
-            env(fset(gw_, asfGlobalFreeze));
-            env.close();
-            // Can withdraw non-frozen token
-            for (auto const& account : {alice_, gw_})
-            {
-                ammAlice.withdraw(account, XRP(100));
-                ammAlice.withdraw(account, USD(100), std::nullopt, std::nullopt, Ter(tecFROZEN));
-                ammAlice.withdraw(account, 1'000, std::nullopt, std::nullopt, Ter(tecFROZEN));
-            }
-        });
+        testAMM(
+            [&](AMM& ammAlice, Env& env) {
+                auto const fix330 = env.current()->rules().enabled(fixCleanup3_3_0);
+                ammAlice.deposit({.account = gw_, .asset1In = USD(1'000), .asset2In = XRP(1'000)});
+                env(fset(gw_, asfGlobalFreeze));
+                env.close();
+                // Can withdraw non-frozen token
+                for (auto const& account : {alice_, gw_})
+                {
+                    ammAlice.withdraw(account, XRP(100));
+                    // Post-fixCleanup3_3_0 the issuer can withdraw their own
+                    // frozen token from the pool.
+                    auto const frozenErr =
+                        (fix330 && account == gw_) ? Ter(tesSUCCESS) : Ter(tecFROZEN);
+                    ammAlice.withdraw(account, USD(100), std::nullopt, std::nullopt, frozenErr);
+                    ammAlice.withdraw(account, 1'000, std::nullopt, std::nullopt, frozenErr);
+                }
+            },
+            std::nullopt,
+            0,
+            std::nullopt,
+            amendmentCombinations({fixCleanup3_3_0}));
 
         // Individually frozen (AMM) account
-        testAMM([&](AMM& ammAlice, Env& env) {
-            env(trust(gw_, alice_["USD"](0), tfSetFreeze));
-            env.close();
-            // Can withdraw non-frozen token
-            ammAlice.withdraw(alice_, XRP(100));
-            ammAlice.withdraw(alice_, 1'000, std::nullopt, std::nullopt, Ter(tecFROZEN));
-            ammAlice.withdraw(alice_, USD(100), std::nullopt, std::nullopt, Ter(tecFROZEN));
-            env(trust(gw_, alice_["USD"](0), tfClearFreeze));
-            // Individually frozen AMM
-            env(trust(
-                gw_, STAmount{Issue{gw_["USD"].currency, ammAlice.ammAccount()}, 0}, tfSetFreeze));
-            // Can withdraw non-frozen token
-            ammAlice.withdraw(alice_, XRP(100));
-            ammAlice.withdraw(alice_, 1'000, std::nullopt, std::nullopt, Ter(tecFROZEN));
-            ammAlice.withdraw(alice_, USD(100), std::nullopt, std::nullopt, Ter(tecFROZEN));
-        });
+        testAMM(
+            [&](AMM& ammAlice, Env& env) {
+                auto const fix330 = env.current()->rules().enabled(fixCleanup3_3_0);
+                env(trust(gw_, alice_["USD"](0), tfSetFreeze));
+                env.close();
+                // Can withdraw non-frozen token
+                ammAlice.withdraw(alice_, XRP(100));
+                // Post-fixCleanup3_3_0 regular freeze no longer blocks
+                // self-withdrawal; only deep freeze does.
+                auto const indivFreezeErr = fix330 ? Ter(tesSUCCESS) : Ter(tecFROZEN);
+                ammAlice.withdraw(alice_, 1'000, std::nullopt, std::nullopt, indivFreezeErr);
+                ammAlice.withdraw(alice_, USD(100), std::nullopt, std::nullopt, indivFreezeErr);
+                env(trust(gw_, alice_["USD"](0), tfClearFreeze));
+                // Individually frozen AMM — still blocked regardless of
+                // fixCleanup3_3_0 because the AMM account itself is frozen.
+                env(trust(
+                    gw_,
+                    STAmount{Issue{gw_["USD"].currency, ammAlice.ammAccount()}, 0},
+                    tfSetFreeze));
+                ammAlice.withdraw(alice_, XRP(100));
+                ammAlice.withdraw(alice_, 1'000, std::nullopt, std::nullopt, Ter(tecFROZEN));
+                ammAlice.withdraw(alice_, USD(100), std::nullopt, std::nullopt, Ter(tecFROZEN));
+            },
+            std::nullopt,
+            0,
+            std::nullopt,
+            amendmentCombinations({fixCleanup3_3_0}));
 
         // Carol withdraws more than she owns
         testAMM([&](AMM& ammAlice, Env&) {
@@ -6659,11 +6700,11 @@ private:
             });
         }
 
-        if (features[featureAMMClawback])
+        if (features[featureAMMClawback] || features[fixCleanup3_3_0])
         {
             // Deposit one asset which is not the frozen token,
-            // but the other asset is frozen. We should get tecFROZEN error
-            // when feature AMMClawback is enabled.
+            // but the other asset is frozen. tecFROZEN when either
+            // AMMClawback or fixCleanup3_3_0 is enabled.
             Env env(*this, features);
             testAMMDeposit(env, [&](AMM& amm) {
                 amm.deposit(
@@ -6673,8 +6714,8 @@ private:
         else
         {
             // Deposit one asset which is not the frozen token,
-            // but the other asset is frozen. We will get tecSUCCESS
-            // when feature AMMClawback is not enabled.
+            // but the other asset is frozen. tesSUCCESS only when
+            // neither AMMClawback nor fixCleanup3_3_0 is enabled.
             Env env(*this, features);
             testAMMDeposit(env, [&](AMM& amm) {
                 amm.deposit(
@@ -7197,8 +7238,8 @@ private:
         FeatureBitset const all{testableAmendments()};
         testInvalidInstance();
         testInstanceCreate();
-        testInvalidDeposit(all);
-        testInvalidDeposit(all - featureAMMClawback);
+        for (auto const& f : amendmentCombinations({fixCleanup3_3_0, featureAMMClawback}))
+            testInvalidDeposit(f);
         testDeposit();
         testInvalidWithdraw();
         testWithdraw();
@@ -7248,8 +7289,8 @@ private:
         testAMMClawback(all - featureAMMClawback - featureSingleAssetVault);
         testAMMClawback(all - featureAMMClawback);
         testAMMClawback(all - fixAMMv1_1 - fixAMMv1_3 - featureAMMClawback);
-        testAMMDepositWithFrozenAssets(all);
-        testAMMDepositWithFrozenAssets(all - featureAMMClawback);
+        for (auto const& f : amendmentCombinations({fixCleanup3_3_0, featureAMMClawback}))
+            testAMMDepositWithFrozenAssets(f);
         testAMMDepositWithFrozenAssets(all - fixAMMv1_1 - featureAMMClawback);
         testAMMDepositWithFrozenAssets(all - fixAMMv1_1 - fixAMMv1_3 - featureAMMClawback);
         testFixReserveCheckOnWithdrawal(all);
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 804cfaebfc..6aa17c7840 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -4,6 +4,7 @@
 #include <test/jtx/TestHelpers.h>
 #include <test/jtx/amount.h>
 #include <test/jtx/fee.h>
+#include <test/jtx/flags.h>
 #include <test/jtx/mpt.h>
 #include <test/jtx/pay.h>
 #include <test/jtx/permissioned_domains.h>
@@ -4598,6 +4599,210 @@ class Invariants_test : public beast::unit_test::Suite
                 }
             }
         }
+
+        // Vault-share transfer: ValidMPTTransfer gates isVaultPseudoAccountFrozen
+        // on fixCleanup3_3_0.  Pre-amendment, vault-share transfers are allowed
+        // even when the underlying asset is individually frozen for the sender;
+        // post-amendment they are blocked.
+        {
+            Account const gw{"gw"};
+            MPTID shareID{};
+
+            auto const preclose = [&](Account const& a1, Account const& a2, Env& env) -> bool {
+                env.fund(XRP(1'000), gw);
+                env.trust(gw["IOU"](10'000), a1);
+                env.trust(gw["IOU"](10'000), a2);
+                env.close();
+                env(pay(gw, a1, gw["IOU"](500)));
+                env(pay(gw, a2, gw["IOU"](500)));
+                env.close();
+
+                PrettyAsset const iou = gw["IOU"];
+                Vault const vault{env};
+                auto [createTx, vaultKeylet] = vault.create({.owner = a1, .asset = iou});
+                env(createTx);
+                env.close();
+                // Both a1 and a2 deposit IOU, each receiving vault shares.
+                env(vault.deposit({.depositor = a1, .id = vaultKeylet.key, .amount = iou(100)}));
+                env(vault.deposit({.depositor = a2, .id = vaultKeylet.key, .amount = iou(100)}));
+                env.close();
+
+                shareID = env.le(vaultKeylet)->at(sfShareMPTID);
+
+                // Freeze a2's IOU trustline from the issuer side.
+                // a2 is the receiver in the simulated AMM withdraw; the
+                // distinction under test is that pre-fix330 the invariant
+                // does not apply the transitive vault freeze to receivers.
+                env(trust(gw, gw["IOU"](0), a2, tfSetFreeze));
+                env.close();
+                return true;
+            };
+
+            // Simulate a vault-share transfer: a1 sends 10 shares to a2.
+            auto const precheck =
+                [&](Account const& a1, Account const& a2, ApplyContext& ac) -> bool {
+                auto sle1 = ac.view().peek(keylet::mptoken(shareID, a1.id()));
+                auto sle2 = ac.view().peek(keylet::mptoken(shareID, a2.id()));
+                if (!sle1 || !sle2)
+                    return false;
+                (*sle1)[sfMPTAmount] -= 10;
+                (*sle2)[sfMPTAmount] += 10;
+                ac.view().update(sle1);
+                ac.view().update(sle2);
+                return true;
+            };
+
+            // post-fixCleanup3_3_0: full isFrozen() applies to all holders;
+            // isVaultPseudoAccountFrozen finds a2's underlying IOU frozen →
+            // invalidTransfer → invariant fires.
+            doInvariantCheck(
+                Env{*this, defaultAmendments()},
+                {{"invalid MPToken transfer between holders"}},
+                precheck,
+                XRPAmount{},
+                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                preclose);
+
+            // pre-fixCleanup3_3_0: legacy AMM withdraw only checked
+            // checkIndividualFrozen on the destination, not the transitive
+            // vault freeze; a2 as receiver is exempt → invariant passes.
+            doInvariantCheck(
+                Env{*this, defaultAmendments() - fixCleanup3_3_0},
+                {},
+                precheck,
+                XRPAmount{},
+                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
+                {tesSUCCESS, tesSUCCESS},
+                preclose);
+        }
+
+        // Side-specific vault-share AMM_WITHDRAW invariant tests.
+        // Both cases use a real vault (IOU underlying) and a real AMM whose
+        // pool includes vault shares.  precheck simulates an AMM_WITHDRAW by
+        // transferring 10 vault shares from the AMM pseudo-account to a2.
+        {
+            MPTID shareID{};
+            AccountID ammAcctID{};
+            AccountID vaultPseudoID{};
+            Account const gw{"gw"};
+
+            // Simulate AMM_WITHDRAW: AMM pseudo-account sends 10 vault shares
+            // to a2.  The AMM pseudo is the sender (decreasing balance);
+            // a2 is the receiver (increasing balance).
+            auto const precheck2 =
+                [&](Account const& /*a1*/, Account const& a2, ApplyContext& ac) -> bool {
+                auto sleAMM = ac.view().peek(keylet::mptoken(shareID, ammAcctID));
+                auto sle2 = ac.view().peek(keylet::mptoken(shareID, a2.id()));
+                if (!sleAMM || !sle2)
+                    return false;
+                (*sleAMM)[sfMPTAmount] -= 10;
+                (*sle2)[sfMPTAmount] += 10;
+                ac.view().update(sleAMM);
+                ac.view().update(sle2);
+                return true;
+            };
+
+            // Shared vault + AMM setup: a1 deposits 500 IOU into a vault and
+            // creates an AMM with XRP + 100 vault shares, giving the AMM
+            // pseudo-account a vault-share MPToken balance.
+            auto const setupVaultAMM = [&](Account const& a1, Account const& a2, Env& env) -> bool {
+                env.fund(XRP(1'000), gw);
+                env(fset(gw, asfDefaultRipple));
+                env.close();
+
+                env.trust(gw["IOU"](10'000), a1);
+                env.trust(gw["IOU"](10'000), a2);
+                env.close();
+                env(pay(gw, a1, gw["IOU"](1'000)));
+                env(pay(gw, a2, gw["IOU"](500)));
+                env.close();
+
+                Vault const vault{env};
+                auto [createTx, vaultKeylet] = vault.create({.owner = a1, .asset = gw["IOU"]});
+                env(createTx);
+                env.close();
+
+                env(vault.deposit(
+                    {.depositor = a1, .id = vaultKeylet.key, .amount = gw["IOU"](500)}));
+                env(vault.deposit(
+                    {.depositor = a2, .id = vaultKeylet.key, .amount = gw["IOU"](200)}));
+                env.close();
+
+                shareID = env.le(vaultKeylet)->at(sfShareMPTID);
+                vaultPseudoID = env.le(vaultKeylet)->at(sfAccount);
+
+                // a1 creates AMM with XRP + 100 vault shares; the AMM
+                // pseudo-account receives an MPToken record for shareID.
+                AMM const amm(env, a1, XRP(100), STAmount{MPTIssue{shareID}, 100});
+                ammAcctID = amm.ammAccount();
+                return true;
+            };
+
+            // Case 1: freeze the vault pseudo-account's IOU trustline.
+            // isVaultPseudoAccountFrozen(ammAcct) calls isAnyFrozen({vaultPseudo,
+            // ammAcct}, IOU); since vaultPseudo is frozen it returns true.  The
+            // AMM sender has a decreasing balance (not a receiver) so it is
+            // never exempt from the check — invariant fires both pre- and
+            // post-fixCleanup3_3_0.
+            auto const preclose3 = [&](Account const& a1, Account const& a2, Env& env) -> bool {
+                if (!setupVaultAMM(a1, a2, env))
+                    return false;
+                env(trust(gw, gw["IOU"](0), Account{"vaultPseudo", vaultPseudoID}, tfSetFreeze));
+                env.close();
+                return true;
+            };
+
+            doInvariantCheck(
+                Env{*this, defaultAmendments()},
+                {{"invalid MPToken transfer between holders"}},
+                precheck2,
+                XRPAmount{},
+                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                preclose3);
+
+            doInvariantCheck(
+                Env{*this, defaultAmendments() - fixCleanup3_3_0},
+                {{"invalid MPToken transfer between holders"}},
+                precheck2,
+                XRPAmount{},
+                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                preclose3);
+
+            // Case 2: freeze a2's (receiver's) IOU trustline.
+            // isVaultPseudoAccountFrozen(a2) → isAnyFrozen({vaultPseudo, a2},
+            // IOU) → true.  The AMM sender's check passes (vaultPseudo and
+            // ammAcct are not frozen).  Pre-fix330: receiver is exempt from
+            // isVaultPseudoAccountFrozen in ttAMM_WITHDRAW → passes.
+            // Post-fix330: full isFrozen() applied to a2 → fires.
+            auto const preclose4 = [&](Account const& a1, Account const& a2, Env& env) -> bool {
+                if (!setupVaultAMM(a1, a2, env))
+                    return false;
+                env(trust(gw, gw["IOU"](0), a2, tfSetFreeze));
+                env.close();
+                return true;
+            };
+
+            doInvariantCheck(
+                Env{*this, defaultAmendments()},
+                {{"invalid MPToken transfer between holders"}},
+                precheck2,
+                XRPAmount{},
+                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                preclose4);
+
+            doInvariantCheck(
+                Env{*this, defaultAmendments() - fixCleanup3_3_0},
+                {},
+                precheck2,
+                XRPAmount{},
+                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
+                {tesSUCCESS, tesSUCCESS},
+                preclose4);
+        }
     }
 
     void
diff --git a/src/test/app/LoanBroker_test.cpp b/src/test/app/LoanBroker_test.cpp
index 671f98a901..bdc950eeff 100644
--- a/src/test/app/LoanBroker_test.cpp
+++ b/src/test/app/LoanBroker_test.cpp
@@ -936,11 +936,7 @@ class LoanBroker_test : public beast::unit_test::Suite
             env.close();
             env(coverDeposit(alice, brokerKeylet.key, vaultInfo.asset(10)),
                 Ter(tecINSUFFICIENT_FUNDS));
-
-            // preclaim: tecFROZEN
-            env(fset(issuer, asfGlobalFreeze));
-            env.close();
-            env(coverDeposit(alice, brokerKeylet.key, vaultInfo.asset(10)), Ter(tecFROZEN));
+            // Freeze/lock tests are in testCoverDepositFreezes/testCoverWithdrawFreezes
         }
         else
         {
@@ -966,35 +962,20 @@ class LoanBroker_test : public beast::unit_test::Suite
             // preclaim: tecDST_TAG_NEEDED
             Account const dest{"dest"};
             env.fund(XRP(1'000), dest);
+
             env(fset(dest, asfRequireDest));
-            env.close();
             env(coverWithdraw(alice, brokerKeylet.key, asset(10)),
                 kDestination(dest),
                 Ter(tecDST_TAG_NEEDED));
+            env(fclear(dest, asfRequireDest));
 
             // preclaim: tecNO_PERMISSION
-            env(fclear(dest, asfRequireDest));
             env(fset(dest, asfDepositAuth));
-            env.close();
             env(coverWithdraw(alice, brokerKeylet.key, asset(10)),
                 kDestination(dest),
                 Ter(tecNO_PERMISSION));
-
-            // preclaim: tecFROZEN
-            env(trust(dest, asset(1'000)));
             env(fclear(dest, asfDepositAuth));
-            env(fset(issuer, asfGlobalFreeze));
-            env.close();
-            env(coverWithdraw(alice, brokerKeylet.key, asset(10)),
-                kDestination(dest),
-                Ter(tecFROZEN));
-
-            // preclaim:: tecFROZEN (deep frozen)
-            env(fclear(issuer, asfGlobalFreeze));
-            env(trust(issuer, asset(1'000), dest, tfSetFreeze | tfSetDeepFreeze));
-            env(coverWithdraw(alice, brokerKeylet.key, asset(10)),
-                kDestination(dest),
-                Ter(tecFROZEN));
+            // Freeze/lock tests are in testCoverDepositFreezes/testCoverWithdrawFreezes
 
             // preclaim: tecPSEUDO_ACCOUNT
             env(coverWithdraw(alice, brokerKeylet.key, asset(10)),
@@ -1784,6 +1765,444 @@ class LoanBroker_test : public beast::unit_test::Suite
         BEAST_EXPECT(aliceBalanceAfter == aliceBalanceBefore);
     }
 
+    void
+    testCoverDepositFreezes()
+    {
+        using namespace jtx;
+        using namespace loanBroker;
+
+        Account const issuer{"issuer"};
+        Account const alice{"alice"};
+
+        // === IOU ===
+        {
+            testcase("LoanBrokerCoverDeposit IOU freeze checks");
+            Env env(*this);
+            Vault const vault{env};
+
+            env.fund(XRP(100'000), issuer, alice);
+            env(trust(alice, issuer["IOU"](1'000'000)));
+            env.close();
+            PrettyAsset const asset(issuer["IOU"]);
+            env(pay(issuer, alice, asset(100'000)));
+            env.close();
+
+            auto [tx, vaultKeylet] = vault.create({.owner = alice, .asset = asset});
+            env(tx);
+            env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = asset(50)}));
+            env.close();
+
+            auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
+            env(set(alice, vaultKeylet.key));
+            env.close();
+
+            auto const broker = env.le(brokerKeylet);
+            if (!BEAST_EXPECT(broker))
+                return;
+            Account const brokerPseudo("pseudo", broker->at(sfAccount));
+
+            env(coverDeposit(alice, brokerKeylet.key, asset(10)));
+            env.close();
+
+            auto runTests = [&]() {
+                auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+
+                // Global freeze
+                env(fset(issuer, asfGlobalFreeze));
+                env(coverDeposit(alice, brokerKeylet.key, asset(1)), Ter(tecFROZEN));
+                env(fclear(issuer, asfGlobalFreeze));
+
+                // Source regular freeze
+                env(trust(issuer, asset(0), alice, tfSetFreeze));
+                env(coverDeposit(alice, brokerKeylet.key, asset(1)), Ter(tecFROZEN));
+                env(trust(issuer, asset(0), alice, tfClearFreeze));
+
+                // Source deep freeze
+                env(trust(issuer, asset(0), alice, tfSetFreeze | tfSetDeepFreeze));
+                env(coverDeposit(alice, brokerKeylet.key, asset(1)), Ter(tecFROZEN));
+                env(trust(issuer, asset(0), alice, tfClearFreeze | tfClearDeepFreeze));
+
+                // Pseudo regular freeze — post-fix blocks, pre-fix allows (BUG)
+                TER const pseudoTer = fix330Enabled ? TER(tecFROZEN) : TER(tesSUCCESS);
+                env(trust(issuer, asset(0), brokerPseudo, tfSetFreeze));
+                env(coverDeposit(alice, brokerKeylet.key, asset(1)), Ter(pseudoTer));
+                env(trust(issuer, asset(0), brokerPseudo, tfClearFreeze));
+
+                // Pseudo deep freeze
+                env(trust(issuer, asset(0), brokerPseudo, tfSetFreeze | tfSetDeepFreeze));
+                env(coverDeposit(alice, brokerKeylet.key, asset(1)), Ter(tecFROZEN));
+                env(trust(issuer, asset(0), brokerPseudo, tfClearFreeze | tfClearDeepFreeze));
+            };
+
+            runTests();
+            env.disableFeature(fixCleanup3_3_0);
+            runTests();
+            env.enableFeature(fixCleanup3_3_0);
+        }
+
+        // === MPT ===
+        {
+            testcase("LoanBrokerCoverDeposit MPT lock checks");
+            Env env(*this);
+            Vault const vault{env};
+
+            env.fund(XRP(100'000), issuer, alice);
+            env.close();
+
+            MPTTester mptt{env, issuer, kMptInitNoFund};
+            mptt.create({.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock});
+            PrettyAsset const mpt{mptt.issuanceID()};
+
+            mptt.authorize({.account = alice});
+            env(pay(issuer, alice, mpt(100'000)));
+            env.close();
+
+            auto [tx, vaultKeylet] = vault.create({.owner = alice, .asset = mpt});
+            env(tx);
+            env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = mpt(50)}));
+            env.close();
+
+            auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
+            env(set(alice, vaultKeylet.key));
+            env.close();
+
+            auto const broker = env.le(brokerKeylet);
+            if (!BEAST_EXPECT(broker))
+                return;
+            Account const brokerPseudo("pseudo", broker->at(sfAccount));
+
+            env(coverDeposit(alice, brokerKeylet.key, mpt(10)));
+            env.close();
+
+            // For MPT isDeepFrozen == isFrozen, so all locks block in
+            // both pre- and post-fix. No behavioral difference.
+            auto runTests = [&]() {
+                // Global lock
+                mptt.set({.flags = tfMPTLock});
+                env.close();
+                env(coverDeposit(alice, brokerKeylet.key, mpt(1)), Ter(tecLOCKED));
+                mptt.set({.flags = tfMPTUnlock});
+                env.close();
+
+                // Source (alice) individual lock
+                mptt.set({.holder = alice, .flags = tfMPTLock});
+                env.close();
+                env(coverDeposit(alice, brokerKeylet.key, mpt(1)), Ter(tecLOCKED));
+                mptt.set({.holder = alice, .flags = tfMPTUnlock});
+                env.close();
+
+                // Pseudo individual lock
+                mptt.set({.holder = brokerPseudo, .flags = tfMPTLock});
+                env.close();
+                env(coverDeposit(alice, brokerKeylet.key, mpt(1)), Ter(tecLOCKED));
+                mptt.set({.holder = brokerPseudo, .flags = tfMPTUnlock});
+                env.close();
+            };
+
+            runTests();
+            env.disableFeature(fixCleanup3_3_0);
+            runTests();
+            env.enableFeature(fixCleanup3_3_0);
+        }
+    }
+
+    // Focused demonstration: a cover-withdraw submitter under a regular
+    // individual IOU freeze can still withdraw to themselves (self-withdrawal).
+    //
+    // Pre-fixCleanup3_3_0: the old code only checked the pseudo-account source
+    // and the destination for deep-freeze; it did not check the submitter's
+    // individual freeze at all. Self-withdrawal therefore always succeeded.
+    // Post-fixCleanup3_3_0: checkWithdrawFreeze explicitly skips the submitter
+    // freeze check when submitter == destination, preserving the same result.
+    void
+    testCoverWithdrawSelfWhileFrozen()
+    {
+        testcase("LoanBrokerCoverWithdraw IOU self-withdrawal while individually frozen");
+
+        using namespace jtx;
+        using namespace loanBroker;
+
+        Account const issuer{"issuer"};
+        Account const alice{"alice"};
+        Account const dest{"dest"};
+        Env env{*this};
+        Vault const vault{env};
+
+        env.fund(XRP(100'000), issuer, alice, dest);
+        env(trust(alice, issuer["IOU"](1'000'000)));
+        env(trust(dest, issuer["IOU"](1'000'000)));
+        env.close();
+
+        PrettyAsset const asset(issuer["IOU"]);
+        env(pay(issuer, alice, asset(100'000)));
+        env.close();
+
+        auto [vaultTx, vaultKeylet] = vault.create({.owner = alice, .asset = asset});
+        env(vaultTx);
+        env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = asset(50)}));
+        env.close();
+
+        auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
+        env(set(alice, vaultKeylet.key));
+        env.close();
+
+        env(coverDeposit(alice, brokerKeylet.key, asset(10)));
+        env.close();
+
+        auto runTests = [&]() {
+            auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+
+            // Set a regular individual freeze on alice's IOU trustline.
+            env(trust(issuer, asset(0), alice, tfSetFreeze));
+            env.close();
+
+            // Self-withdrawal: submitter == destination (no sfDestination in tx).
+            // Both pre- and post-fixCleanup3_3_0 this succeeds:
+            //   pre-fix:  old code never checked the submitter's freeze.
+            //   post-fix: checkWithdrawFreeze skips submitter when submitter==dst.
+            env(coverWithdraw(alice, brokerKeylet.key, asset(1)), Ter(tesSUCCESS));
+
+            // Withdrawal to a third party is blocked by the submitter freeze
+            // under fixCleanup3_3_0; pre-fix it was not checked.
+            env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                kDestination(dest),
+                Ter(fix330Enabled ? TER(tecFROZEN) : TER(tesSUCCESS)));
+
+            env(trust(issuer, asset(0), alice, tfClearFreeze));
+            env.close();
+        };
+
+        runTests();
+        env.disableFeature(fixCleanup3_3_0);
+        runTests();
+        env.enableFeature(fixCleanup3_3_0);
+    }
+
+    void
+    testCoverWithdrawFreezes()
+    {
+        using namespace jtx;
+        using namespace loanBroker;
+
+        Account const issuer{"issuer"};
+        Account const alice{"alice"};
+
+        // === IOU ===
+        {
+            testcase("LoanBrokerCoverWithdraw IOU freeze checks");
+            Env env(*this);
+            Vault const vault{env};
+
+            env.fund(XRP(100'000), issuer, alice);
+            env(trust(alice, issuer["IOU"](1'000'000)));
+            env.close();
+            PrettyAsset const asset(issuer["IOU"]);
+            env(pay(issuer, alice, asset(100'000)));
+            env.close();
+
+            auto [tx, vaultKeylet] = vault.create({.owner = alice, .asset = asset});
+            env(tx);
+            env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = asset(50)}));
+            env.close();
+
+            auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
+            env(set(alice, vaultKeylet.key));
+            env.close();
+
+            auto const broker = env.le(brokerKeylet);
+            if (!BEAST_EXPECT(broker))
+                return;
+            Account const brokerPseudo("pseudo", broker->at(sfAccount));
+
+            env(coverDeposit(alice, brokerKeylet.key, asset(10)));
+            env.close();
+
+            Account const dest{"dest"};
+            env.fund(XRP(1'000), dest);
+            env(trust(dest, asset(1'000)));
+
+            auto runTests = [&]() {
+                auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+                TER const expectedTec = fix330Enabled ? TER(tecFROZEN) : TER(tesSUCCESS);
+
+                // Global freeze
+                env(fset(issuer, asfGlobalFreeze));
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                    kDestination(dest),
+                    Ter(tecFROZEN));
+                env(fclear(issuer, asfGlobalFreeze));
+
+                // Source (pseudo) regular freeze
+                env(trust(issuer, asset(0), brokerPseudo, tfSetFreeze));
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                    kDestination(dest),
+                    Ter(tecFROZEN));
+                env(trust(issuer, asset(0), brokerPseudo, tfClearFreeze));
+
+                // Source (pseudo) deep freeze
+                env(trust(issuer, asset(0), brokerPseudo, tfSetFreeze | tfSetDeepFreeze));
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                    kDestination(dest),
+                    Ter(tecFROZEN));
+                env(trust(issuer, asset(0), brokerPseudo, tfClearFreeze | tfClearDeepFreeze));
+
+                // Submitter regular freeze → dest
+                env(trust(issuer, asset(0), alice, tfSetFreeze));
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                    kDestination(dest),
+                    Ter(expectedTec));
+                // Submitter regular freeze → self: always allowed
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)), Ter(tesSUCCESS));
+                env(trust(issuer, asset(0), alice, tfClearFreeze));
+                env(coverDeposit(
+                    alice, brokerKeylet.key, asset(isTesSuccess(expectedTec) ? 2 : 1)));
+
+                // Submitter deep freeze → dest
+                env(trust(issuer, asset(0), alice, tfSetFreeze | tfSetDeepFreeze));
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                    kDestination(dest),
+                    Ter(expectedTec));
+                // Submitter deep freeze → self: blocked (checkDeepFrozen)
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)), Ter(tecFROZEN));
+                env(trust(issuer, asset(0), alice, tfClearFreeze | tfClearDeepFreeze));
+                if (isTesSuccess(expectedTec))
+                    env(coverDeposit(alice, brokerKeylet.key, asset(1)));
+
+                // Destination regular freeze: only deep freeze blocks
+                env(trust(issuer, asset(0), dest, tfSetFreeze));
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                    kDestination(dest),
+                    Ter(tesSUCCESS));
+                env(trust(issuer, asset(0), dest, tfClearFreeze));
+                env(coverDeposit(alice, brokerKeylet.key, asset(1)));
+
+                // Destination deep freeze
+                env(trust(issuer, asset(0), dest, tfSetFreeze | tfSetDeepFreeze));
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                    kDestination(dest),
+                    Ter(tecFROZEN));
+                env(trust(issuer, asset(0), dest, tfClearFreeze | tfClearDeepFreeze));
+
+                // Submitter frozen → issuer: bypasses all freeze checks
+                env(trust(issuer, asset(0), alice, tfSetFreeze));
+                env(coverWithdraw(alice, brokerKeylet.key, asset(1)),
+                    kDestination(issuer),
+                    Ter(tesSUCCESS));
+                env(trust(issuer, asset(0), alice, tfClearFreeze));
+                env(coverDeposit(alice, brokerKeylet.key, asset(1)));
+            };
+
+            runTests();
+            env.disableFeature(fixCleanup3_3_0);
+            runTests();
+            env.enableFeature(fixCleanup3_3_0);
+        }
+
+        // === MPT ===
+        {
+            testcase("LoanBrokerCoverWithdraw MPT lock checks");
+            Env env(*this);
+            Vault const vault{env};
+
+            env.fund(XRP(100'000), issuer, alice);
+            env.close();
+
+            MPTTester mptt{env, issuer, kMptInitNoFund};
+            mptt.create({.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock});
+            PrettyAsset const mpt{mptt.issuanceID()};
+
+            mptt.authorize({.account = alice});
+            env(pay(issuer, alice, mpt(100'000)));
+            env.close();
+
+            auto [tx, vaultKeylet] = vault.create({.owner = alice, .asset = mpt});
+            env(tx);
+            env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = mpt(50)}));
+            env.close();
+
+            auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
+            env(set(alice, vaultKeylet.key));
+            env.close();
+
+            auto const broker = env.le(brokerKeylet);
+            if (!BEAST_EXPECT(broker))
+                return;
+            Account const brokerPseudo("pseudo", broker->at(sfAccount));
+
+            env(coverDeposit(alice, brokerKeylet.key, mpt(10)));
+            env.close();
+
+            Account const dest{"dest"};
+            env.fund(XRP(1'000), dest);
+            mptt.authorize({.account = dest});
+            env.close();
+
+            auto runTests = [&]() {
+                auto const withFix = env.current()->rules().enabled(fixCleanup3_3_0);
+                // Only submitter-to-dest differs: post-fix blocks, pre-fix
+                // doesn't (BUG). All other locks block in both because for
+                // MPT isDeepFrozen == isFrozen.
+                TER const submitterToDest = withFix ? TER(tecLOCKED) : TER(tesSUCCESS);
+
+                // Global lock
+                mptt.set({.flags = tfMPTLock});
+                env.close();
+                env(coverWithdraw(alice, brokerKeylet.key, mpt(1)),
+                    kDestination(dest),
+                    Ter(tecLOCKED));
+                mptt.set({.flags = tfMPTUnlock});
+                env.close();
+
+                // Source (pseudo) individual lock
+                mptt.set({.holder = brokerPseudo, .flags = tfMPTLock});
+                env.close();
+                env(coverWithdraw(alice, brokerKeylet.key, mpt(1)),
+                    kDestination(dest),
+                    Ter(tecLOCKED));
+                mptt.set({.holder = brokerPseudo, .flags = tfMPTUnlock});
+                env.close();
+
+                // Submitter individual lock → dest
+                mptt.set({.holder = alice, .flags = tfMPTLock});
+                env.close();
+                env(coverWithdraw(alice, brokerKeylet.key, mpt(1)),
+                    kDestination(dest),
+                    Ter(submitterToDest));
+                // Submitter individual lock → self: blocked
+                env(coverWithdraw(alice, brokerKeylet.key, mpt(1)), Ter(tecLOCKED));
+                mptt.set({.holder = alice, .flags = tfMPTUnlock});
+                env.close();
+                if (isTesSuccess(submitterToDest))
+                    env(coverDeposit(alice, brokerKeylet.key, mpt(1)));
+                env.close();
+
+                // Dest individual lock: blocked
+                mptt.set({.holder = dest, .flags = tfMPTLock});
+                env.close();
+                env(coverWithdraw(alice, brokerKeylet.key, mpt(1)),
+                    kDestination(dest),
+                    Ter(tecLOCKED));
+                mptt.set({.holder = dest, .flags = tfMPTUnlock});
+                env.close();
+
+                // Submitter locked → issuer: bypasses all freeze checks
+                mptt.set({.holder = alice, .flags = tfMPTLock});
+                env.close();
+                env(coverWithdraw(alice, brokerKeylet.key, mpt(1)),
+                    kDestination(issuer),
+                    Ter(tesSUCCESS));
+                mptt.set({.holder = alice, .flags = tfMPTUnlock});
+                env(coverDeposit(alice, brokerKeylet.key, mpt(1)));
+                env.close();
+            };
+
+            runTests();
+            env.disableFeature(fixCleanup3_3_0);
+            runTests();
+            env.enableFeature(fixCleanup3_3_0);
+        }
+    }
+
     void
     testRIPD4274IOU()
     {
@@ -2244,6 +2663,13 @@ public:
     void
     run() override
     {
+        testInvalidLoanBrokerCoverClawback();
+        testInvalidLoanBrokerCoverDeposit();
+        testInvalidLoanBrokerCoverWithdraw();
+        testCoverDepositFreezes();
+        testCoverWithdrawFreezes();
+        testCoverWithdrawSelfWhileFrozen();
+
         testCoverPrecisionGuard();
 
         testLoanBrokerSetDebtMaximum();
@@ -2251,9 +2677,6 @@ public:
 
         testDisabled();
         testLifecycle();
-        testInvalidLoanBrokerCoverClawback();
-        testInvalidLoanBrokerCoverDeposit();
-        testInvalidLoanBrokerCoverWithdraw();
         testInvalidLoanBrokerDelete();
         testInvalidLoanBrokerSet();
         testRequireAuth();
@@ -2268,7 +2691,6 @@ public:
 
         testLoanBrokerDeleteFrozenIOU(all_);
         testLoanBrokerDeleteFrozenIOU(all_ - fixCleanup3_2_0);
-
         // TODO: Write clawback failure tests with an issuer / MPT that doesn't
         // have the right flags set.
     }
diff --git a/src/test/app/Loan_test.cpp b/src/test/app/Loan_test.cpp
index 1b0dd414e1..56a7cab47a 100644
--- a/src/test/app/Loan_test.cpp
+++ b/src/test/app/Loan_test.cpp
@@ -92,23 +92,6 @@ protected:
     // even if they are set to unsupported.
 
     FeatureBitset const all_{jtx::testableAmendments()};
-
-    // All 2^N permutations of `all_` with each subset of the given features
-    // excluded. The first entry is always `all_` itself (empty exclusion);
-    // the last excludes every feature in the list.
-    std::vector<FeatureBitset>
-    amendmentCombinations(std::initializer_list<uint256> features) const
-    {
-        std::vector<FeatureBitset> result{all_};
-        for (auto const& f : features)
-        {
-            auto const n = result.size();
-            for (std::size_t i = 0; i < n; ++i)
-                result.push_back(result[i] - f);
-        }
-        return result;
-    }
-
     std::string const iouCurrency_{"IOU"};
 
     void
@@ -8624,8 +8607,8 @@ public:
     run() override
     {
         runAmendmentIndependent();
-        for (auto const& features :
-             amendmentCombinations({fixCleanup3_1_3, fixCleanup3_2_0, featureMPTokensV2}))
+        for (auto const& features : jtx::amendmentCombinations(
+                 {fixCleanup3_1_3, fixCleanup3_2_0, featureMPTokensV2}, all_))
             runAmendmentSensitive(features);
     }
 };
diff --git a/src/test/app/MPToken_test.cpp b/src/test/app/MPToken_test.cpp
index bfb80d3e36..323184aa36 100644
--- a/src/test/app/MPToken_test.cpp
+++ b/src/test/app/MPToken_test.cpp
@@ -7461,21 +7461,42 @@ class MPToken_test : public beast::unit_test::Suite
 
                 // MPTLock is set
                 usd.set({.flags = tfMPTLock});
-                // carol and issuer can't withdraw
-                for (auto const& account : {carol, gw})
-                {
-                    amm.withdraw(
-                        {.account = account,
-                         .asset1Out = usd(1),
-                         .asset2Out = eur(1),
-                         .err = Ter(tecLOCKED)});
-                    amm.withdraw({.account = account, .tokens = 1'000, .err = Ter(tecLOCKED)});
-                    // can single withdraw another asset
-                    amm.withdraw(
-                        {.account = account,
-                         .asset1Out = eur(1),
-                         .assets = std::make_pair(eur, usd)});
-                }
+                auto const fix330 = env.current()->rules().enabled(fixCleanup3_3_0);
+
+                // carol can't withdraw the locked token (any withdrawal type)
+                amm.withdraw(
+                    {.account = carol,
+                     .asset1Out = usd(1),
+                     .asset2Out = eur(1),
+                     .err = Ter(tecLOCKED)});
+                amm.withdraw({.account = carol, .tokens = 1'000, .err = Ter(tecLOCKED)});
+                // can single withdraw the non-locked asset
+                amm.withdraw(
+                    {.account = carol, .asset1Out = eur(1), .assets = std::make_pair(eur, usd)});
+
+                // post-fixCleanup3_3_0 the issuer can redeem even when locked.
+                // Each successful withdrawal burns LP tokens, so replenish between
+                // each type to keep gw's LP balance stable.
+                auto const gwLockErr = fix330 ? Ter(tesSUCCESS) : Ter(tecLOCKED);
+                auto const replenish = [&](IOUAmount tokens) {
+                    usd.set({.flags = tfMPTUnlock});
+                    amm.deposit({.account = gw, .tokens = tokens});
+                    usd.set({.flags = tfMPTLock});
+                };
+
+                amm.withdraw(
+                    {.account = gw, .asset1Out = usd(1), .asset2Out = eur(1), .err = gwLockErr});
+                if (fix330)
+                    replenish(IOUAmount{1});
+
+                amm.withdraw({.account = gw, .tokens = 1'000, .err = gwLockErr});
+                if (fix330)
+                    replenish(IOUAmount{1'000});
+
+                // can single withdraw the non-locked asset
+                amm.withdraw(
+                    {.account = gw, .asset1Out = eur(1), .assets = std::make_pair(eur, usd)});
+
                 usd.set({.flags = tfMPTUnlock});
 
                 // MPTRequireAuth is set
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index 4643bc8555..6fefcfc404 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -1573,6 +1573,7 @@ class Vault_test : public beast::unit_test::Suite
             bool enableClawback = true;
             bool requireAuth = true;
             int initialXRP = 1000;
+            FeatureBitset features = testableAmendments();
         };
 
         auto testCase = [this](
@@ -1585,7 +1586,7 @@ class Vault_test : public beast::unit_test::Suite
                                 Vault& vault,
                                 MPTTester& mptt)> test,
                             CaseArgs args = {}) {
-            Env env{*this, testableAmendments()};
+            Env env{*this, args.features};
             Account const issuer{"issuer"};
             Account const owner{"owner"};
             Account const depositor{"depositor"};
@@ -1632,6 +1633,8 @@ class Vault_test : public beast::unit_test::Suite
             env(tx, Ter(tecNO_ENTRY));
         });
 
+        // Freeze/lock tests are in testVaultDepositFreeze/testVaultWithdrawFreeze
+
         testCase([this](
                      Env& env,
                      Account const& issuer,
@@ -1646,81 +1649,6 @@ class Vault_test : public beast::unit_test::Suite
             env(tx, Ter(tecLOCKED));
         });
 
-        testCase([this](
-                     Env& env,
-                     Account const& issuer,
-                     Account const& owner,
-                     Account const& depositor,
-                     Asset const& asset,
-                     Vault& vault,
-                     MPTTester& mptt) {
-            testcase("MPT global lock blocks deposit");
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-
-            mptt.set({.account = issuer, .flags = tfMPTLock});
-            env.close();
-
-            tx = vault.deposit({.depositor = depositor, .id = keylet.key, .amount = asset(100)});
-            env(tx, Ter{tecLOCKED});
-            env.close();
-
-            // Can delete empty vault, even if global lock
-            tx = vault.del({.owner = owner, .id = keylet.key});
-            env(tx);
-        });
-
-        testCase([this](
-                     Env& env,
-                     Account const& issuer,
-                     Account const& owner,
-                     Account const& depositor,
-                     Asset const& asset,
-                     Vault& vault,
-                     MPTTester& mptt) {
-            testcase("MPT global lock blocks withdrawal");
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-            tx = vault.deposit({.depositor = depositor, .id = keylet.key, .amount = asset(100)});
-            env(tx);
-            env.close();
-
-            // Check that the OutstandingAmount field of MPTIssuance
-            // accounts for the issued shares.
-            auto v = env.le(keylet);
-            BEAST_EXPECT(v);
-            MPTID const share = (*v)[sfShareMPTID];
-            auto issuance = env.le(keylet::mptokenIssuance(share));
-            BEAST_EXPECT(issuance);
-            Number const outstandingShares = issuance->at(sfOutstandingAmount);
-            BEAST_EXPECT(outstandingShares == 100);
-
-            mptt.set({.account = issuer, .flags = tfMPTLock});
-            env.close();
-
-            tx = vault.withdraw({.depositor = depositor, .id = keylet.key, .amount = asset(100)});
-            env(tx, Ter(tecLOCKED));
-
-            tx[sfDestination] = issuer.human();
-            env(tx, Ter(tecLOCKED));
-
-            // Clawback is still permitted, even with global lock
-            tx = vault.clawback(
-                {.issuer = issuer, .id = keylet.key, .holder = depositor, .amount = asset(0)});
-            env(tx);
-            env.close();
-
-            // Clawback removed shares MPToken
-            auto const mptSle = env.le(keylet::mptoken(share, depositor.id()));
-            BEAST_EXPECT(mptSle == nullptr);
-
-            // Can delete empty vault, even if global lock
-            tx = vault.del({.owner = owner, .id = keylet.key});
-            env(tx);
-        });
-
         testCase([this](
                      Env& env,
                      Account const& issuer,
@@ -2155,57 +2083,6 @@ class Vault_test : public beast::unit_test::Suite
             env(vault.del({.owner = owner, .id = keylet.key}));
         });
 
-        testCase([this](
-                     Env& env,
-                     Account const& issuer,
-                     Account const& owner,
-                     Account const& depositor,
-                     Asset const& asset,
-                     Vault& vault,
-                     MPTTester& mptt) {
-            testcase("MPT lock of vault pseudo-account");
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-
-            auto const vaultAccount = [&env, keylet = keylet, this]() -> AccountID {
-                auto const vault = env.le(keylet);
-                BEAST_EXPECT(vault != nullptr);
-                return vault->at(sfAccount);
-            }();
-
-            tx = vault.deposit({.depositor = depositor, .id = keylet.key, .amount = asset(100)});
-            env(tx);
-            env.close();
-
-            tx = [&]() {
-                json::Value jv;
-                jv[jss::Account] = issuer.human();
-                jv[sfMPTokenIssuanceID] = to_string(asset.get<MPTIssue>().getMptID());
-                jv[jss::Holder] = toBase58(vaultAccount);
-                jv[jss::TransactionType] = jss::MPTokenIssuanceSet;
-                jv[jss::Flags] = tfMPTLock;
-                return jv;
-            }();
-            env(tx);
-            env.close();
-
-            tx = vault.deposit({.depositor = depositor, .id = keylet.key, .amount = asset(100)});
-            env(tx, Ter(tecLOCKED));
-
-            tx = vault.withdraw({.depositor = depositor, .id = keylet.key, .amount = asset(100)});
-            env(tx, Ter(tecLOCKED));
-
-            // Clawback works, even when locked
-            tx = vault.clawback(
-                {.issuer = issuer, .id = keylet.key, .holder = depositor, .amount = asset(100)});
-            env(tx);
-
-            // Can delete an empty vault even when asset is locked.
-            tx = vault.del({.owner = owner, .id = keylet.key});
-            env(tx);
-        });
-
         {
             testcase("MPT shares to a vault");
 
@@ -2438,6 +2315,7 @@ class Vault_test : public beast::unit_test::Suite
             Number initialIOU = 200;
             double transferRate = 1.0;
             bool charlieRipple = true;
+            FeatureBitset features = testableAmendments();
         };
 
         auto testCase = [&, this](
@@ -2451,7 +2329,7 @@ class Vault_test : public beast::unit_test::Suite
                                 PrettyAsset const& asset,
                                 std::function<MPTID(xrpl::Keylet)> issuanceId)> test,
                             CaseArgs args = {}) {
-            Env env{*this, testableAmendments()};
+            Env env{*this, args.features};
             Account const owner{"owner"};
             Account const issuer{"issuer"};
             Account const charlie{"charlie"};
@@ -2543,83 +2421,6 @@ class Vault_test : public beast::unit_test::Suite
             env.close();
         });
 
-        testCase([&, this](
-                     Env& env,
-                     Account const& owner,
-                     Account const& issuer,
-                     Account const& charlie,
-                     auto vaultAccount,
-                     Vault& vault,
-                     PrettyAsset const& asset,
-                     auto issuanceId) {
-            testcase("IOU frozen trust line to vault account");
-
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-
-            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
-            env.close();
-
-            Asset const share = Asset(issuanceId(keylet));
-
-            // Freeze the trustline to the vault
-            auto trustSet = [&, account = vaultAccount(keylet)]() {
-                json::Value jv;
-                jv[jss::Account] = issuer.human();
-                {
-                    auto& ja = jv[jss::LimitAmount] =
-                        asset(0).value().getJson(JsonOptions::Values::None);
-                    ja[jss::issuer] = toBase58(account);
-                }
-                jv[jss::TransactionType] = jss::TrustSet;
-                jv[jss::Flags] = tfSetFreeze;
-                return jv;
-            }();
-            env(trustSet);
-            env.close();
-
-            {
-                // Note, the "frozen" state of the trust line to vault account
-                // is reported as  "locked" state of the vault shares, because
-                // this state is attached to shares by means of the transitive
-                // isFrozen.
-                auto tx =
-                    vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(80)});
-                env(tx, Ter{tecLOCKED});
-            }
-
-            {
-                auto tx =
-                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(100)});
-                env(tx, Ter{tecLOCKED});
-
-                // also when trying to withdraw to a 3rd party
-                tx[sfDestination] = charlie.human();
-                env(tx, Ter{tecLOCKED});
-                env.close();
-            }
-
-            {
-                // Clawback works, even when locked
-                auto tx = vault.clawback(
-                    {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = asset(50)});
-                env(tx);
-                env.close();
-            }
-
-            // Clear the frozen state
-            trustSet[jss::Flags] = tfClearFreeze;
-            env(trustSet);
-            env.close();
-
-            env(vault.withdraw(
-                {.depositor = owner, .id = keylet.key, .amount = share(50'000'000)}));
-
-            env(vault.del({.owner = owner, .id = keylet.key}));
-            env.close();
-        });
-
         testCase(
             [&, this](
                 Env& env,
@@ -2681,65 +2482,6 @@ class Vault_test : public beast::unit_test::Suite
             },
             CaseArgs{.transferRate = 1.25});
 
-        testCase([&, this](
-                     Env& env,
-                     Account const& owner,
-                     Account const& issuer,
-                     Account const& charlie,
-                     auto,
-                     Vault& vault,
-                     PrettyAsset const& asset,
-                     auto&&...) {
-            testcase("IOU frozen trust line to depositor");
-
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-
-            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
-            env.close();
-
-            // Withdraw to 3rd party works
-            auto const withdrawToCharlie = [&](xrpl::Keylet keylet) {
-                auto tx =
-                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(10)});
-                tx[sfDestination] = charlie.human();
-                return tx;
-            }(keylet);
-            env(withdrawToCharlie);
-
-            // Freeze the owner
-            env(trust(issuer, asset(0), owner, tfSetFreeze));
-            env.close();
-
-            // Cannot withdraw
-            auto const withdraw =
-                vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(10)});
-            env(withdraw, Ter{tecFROZEN});
-
-            // Cannot withdraw to 3rd party
-            env(withdrawToCharlie, Ter{tecLOCKED});
-            env.close();
-
-            {
-                // Cannot deposit some more
-                auto tx =
-                    vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(10)});
-                env(tx, Ter{tecFROZEN});
-            }
-
-            {
-                // Clawback still works
-                auto tx = vault.clawback(
-                    {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = asset(0)});
-                env(tx);
-                env.close();
-            }
-
-            env(vault.del({.owner = owner, .id = keylet.key}));
-            env.close();
-        });
-
         testCase([&, this](
                      Env& env,
                      Account const& owner,
@@ -3031,102 +2773,6 @@ class Vault_test : public beast::unit_test::Suite
                 env.close();
             },
             CaseArgs{.initialXRP = acctReserve + (incReserve * 4) + 1});
-
-        testCase([&, this](
-                     Env& env,
-                     Account const& owner,
-                     Account const& issuer,
-                     Account const& charlie,
-                     auto,
-                     Vault& vault,
-                     PrettyAsset const& asset,
-                     auto&&...) {
-            testcase("IOU frozen trust line to 3rd party");
-
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-
-            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
-            env.close();
-
-            // Withdraw to 3rd party works
-            auto const withdrawToCharlie = [&](xrpl::Keylet keylet) {
-                auto tx =
-                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(10)});
-                tx[sfDestination] = charlie.human();
-                return tx;
-            }(keylet);
-            env(withdrawToCharlie);
-
-            // Freeze the 3rd party
-            env(trust(issuer, asset(0), charlie, tfSetFreeze));
-            env.close();
-
-            // Can withdraw
-            auto const withdraw =
-                vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(10)});
-            env(withdraw);
-            env.close();
-
-            // Cannot withdraw to 3rd party
-            env(withdrawToCharlie, Ter{tecFROZEN});
-            env.close();
-
-            env(vault.clawback(
-                {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = asset(0)}));
-            env.close();
-
-            env(vault.del({.owner = owner, .id = keylet.key}));
-            env.close();
-        });
-
-        testCase([&, this](
-                     Env& env,
-                     Account const& owner,
-                     Account const& issuer,
-                     Account const& charlie,
-                     auto,
-                     Vault& vault,
-                     PrettyAsset const& asset,
-                     auto&&...) {
-            testcase("IOU global freeze");
-
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-
-            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
-            env.close();
-
-            env(fset(issuer, asfGlobalFreeze));
-            env.close();
-
-            {
-                // Cannot withdraw
-                auto tx =
-                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(10)});
-                env(tx, Ter{tecFROZEN});
-
-                // Cannot withdraw to 3rd party
-                tx[sfDestination] = charlie.human();
-                env(tx, Ter{tecFROZEN});
-                env.close();
-
-                // Cannot deposit some more
-                tx = vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(10)});
-
-                env(tx, Ter{tecFROZEN});
-            }
-
-            // Clawback is permitted
-            env(vault.clawback(
-                {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = asset(0)}));
-            env.close();
-
-            env(vault.del({.owner = owner, .id = keylet.key}));
-            env.close();
-        });
     }
 
     void
@@ -7824,6 +7470,579 @@ class Vault_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testVaultDepositFreeze()
+    {
+        using namespace test::jtx;
+
+        Account const issuer{"issuer"};
+        Account const owner{"owner"};
+
+        // === IOU ===
+        {
+            testcase("VaultDeposit IOU freeze checks");
+            Env env{*this};
+            Vault vault{env};
+
+            env.fund(XRP(100'000), issuer, owner);
+            env(fset(issuer, asfAllowTrustLineClawback));
+            env.close();
+            PrettyAsset const asset = issuer["IOU"];
+            env.trust(asset(1'000'000), owner);
+            env(pay(issuer, owner, asset(100'000)));
+            env.close();
+
+            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
+            env(tx);
+            env.close();
+            auto const vaultAcct = Account("vault", env.le(keylet)->at(sfAccount));
+
+            // Initial deposit so the vault pseudo-account has a trustline
+            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
+            env.close();
+
+            auto runTests = [&]() {
+                auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+
+                // Global freeze
+                env(fset(issuer, asfGlobalFreeze));
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(tecFROZEN));
+                env(fclear(issuer, asfGlobalFreeze));
+
+                // Depositor regular freeze
+                env(trust(issuer, asset(0), owner, tfSetFreeze));
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(tecFROZEN));
+                env(trust(issuer, asset(0), owner, tfClearFreeze));
+
+                // Depositor deep freeze
+                env(trust(issuer, asset(0), owner, tfSetFreeze | tfSetDeepFreeze));
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(tecFROZEN));
+                env(trust(issuer, asset(0), owner, tfClearFreeze | tfClearDeepFreeze));
+
+                // Vault-account regular freeze
+                // Post-fix: checkDepositFreeze catches it → tecFROZEN
+                // Pre-fix: not checked directly, but the transitive share
+                //          check triggers → tecLOCKED
+                {
+                    auto trustSet = [&]() {
+                        json::Value jv;
+                        jv[jss::Account] = issuer.human();
+                        {
+                            auto& ja = jv[jss::LimitAmount] =
+                                asset(0).value().getJson(JsonOptions::Values::None);
+                            ja[jss::issuer] = toBase58(vaultAcct.id());
+                        }
+                        jv[jss::TransactionType] = jss::TrustSet;
+                        return jv;
+                    }();
+
+                    trustSet[jss::Flags] = tfSetFreeze;
+                    env(trustSet);
+                    env.close();
+
+                    TER const expected = fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED);
+                    env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                        Ter(expected));
+
+                    trustSet[jss::Flags] = tfClearFreeze;
+                    env(trustSet);
+                    env.close();
+                }
+
+                // Vault-account deep freeze
+                {
+                    auto trustSet = [&]() {
+                        json::Value jv;
+                        jv[jss::Account] = issuer.human();
+                        {
+                            auto& ja = jv[jss::LimitAmount] =
+                                asset(0).value().getJson(JsonOptions::Values::None);
+                            ja[jss::issuer] = toBase58(vaultAcct.id());
+                        }
+                        jv[jss::TransactionType] = jss::TrustSet;
+                        return jv;
+                    }();
+
+                    trustSet[jss::Flags] = tfSetFreeze | tfSetDeepFreeze;
+                    env(trustSet);
+                    env.close();
+
+                    env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                        Ter(fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED)));
+
+                    trustSet[jss::Flags] = tfClearFreeze | tfClearDeepFreeze;
+                    env(trustSet);
+                    env.close();
+                }
+
+                // Clawback works while frozen
+                env(fset(issuer, asfGlobalFreeze));
+                env(vault.clawback(
+                    {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = asset(1)}));
+                env(fclear(issuer, asfGlobalFreeze));
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
+                env.close();
+            };
+
+            runTests();
+            env.disableFeature(fixCleanup3_3_0);
+            runTests();
+            env.enableFeature(fixCleanup3_3_0);
+        }
+
+        // === MPT ===
+        {
+            testcase("VaultDeposit MPT lock checks");
+            Env env{*this};
+            Vault vault{env};
+
+            env.fund(XRP(100'000), issuer, owner);
+            env.close();
+
+            MPTTester mptt{env, issuer, kMptInitNoFund};
+            mptt.create(
+                {.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth});
+            PrettyAsset const mpt{mptt.issuanceID()};
+
+            mptt.authorize({.account = owner});
+            mptt.authorize({.account = issuer, .holder = owner});
+            env.close();
+            env(pay(issuer, owner, mpt(100'000)));
+            env.close();
+
+            auto [tx, keylet] = vault.create({.owner = owner, .asset = mpt});
+            env(tx);
+            env.close();
+            auto const vaultAcctID = env.le(keylet)->at(sfAccount);
+            Account const vaultAcct("vault", vaultAcctID);
+
+            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(100)}));
+            env.close();
+
+            // For MPT isDeepFrozen == isFrozen, so all locks block in
+            // both pre- and post-fix.
+            auto runTests = [&]() {
+                // Global lock
+                mptt.set({.flags = tfMPTLock});
+                env.close();
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
+                    Ter(tecLOCKED));
+                mptt.set({.flags = tfMPTUnlock});
+                env.close();
+
+                // Depositor individual lock
+                mptt.set({.holder = owner, .flags = tfMPTLock});
+                env.close();
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
+                    Ter(tecLOCKED));
+                mptt.set({.holder = owner, .flags = tfMPTUnlock});
+                env.close();
+
+                // Vault pseudo-account individual lock
+                mptt.set({.holder = vaultAcct, .flags = tfMPTLock});
+                env.close();
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
+                    Ter(tecLOCKED));
+                mptt.set({.holder = vaultAcct, .flags = tfMPTUnlock});
+                env.close();
+
+                // Clawback works while locked
+                mptt.set({.flags = tfMPTLock});
+                env.close();
+                env(vault.clawback(
+                    {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = mpt(1)}));
+                mptt.set({.flags = tfMPTUnlock});
+                env.close();
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
+                env.close();
+            };
+
+            runTests();
+            env.disableFeature(fixCleanup3_3_0);
+            runTests();
+            env.enableFeature(fixCleanup3_3_0);
+        }
+    }
+
+    // Focused demonstration: a depositor under a regular individual IOU freeze
+    // can still withdraw to themselves (self-withdrawal), but is blocked from
+    // withdrawing to a third party.
+    //
+    // Pre-fixCleanup3_3_0: both the self-withdrawal AND the third-party
+    // withdrawal were blocked because the old code checked checkFrozen on the
+    // destination regardless of whether it was the submitter.
+    // Post-fixCleanup3_3_0: checkWithdrawFreeze skips the submitter freeze
+    // check when submitter == destination, so self-withdrawal succeeds.
+    void
+    testVaultSelfWithdrawWhileFrozen()
+    {
+        testcase("VaultWithdraw IOU self-withdrawal while individually frozen");
+
+        using namespace test::jtx;
+
+        Account const issuer{"issuer"};
+        Account const owner{"owner"};
+        Account const charlie{"charlie"};
+        Env env{*this};
+        Vault vault{env};
+
+        env.fund(XRP(100'000), issuer, owner, charlie);
+        env(fset(issuer, asfAllowTrustLineClawback));
+        env.close();
+
+        PrettyAsset const asset = issuer["IOU"];
+        env.trust(asset(1'000'000), owner);
+        env.trust(asset(1'000'000), charlie);
+        env(pay(issuer, owner, asset(100'000)));
+        env.close();
+
+        auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
+        env(tx);
+        env.close();
+
+        env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(10)}));
+        env.close();
+
+        auto runTests = [&]() {
+            auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+
+            // Set a regular individual freeze on the owner's IOU trustline.
+            env(trust(issuer, asset(0), owner, tfSetFreeze));
+            env.close();
+
+            // Self-withdrawal: submitter == destination, so the submitter
+            // freeze check is skipped.
+            // Post-fix: tesSUCCESS.  Pre-fix: tecFROZEN.
+            env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                Ter(fix330Enabled ? TER(tesSUCCESS) : TER(tecFROZEN)));
+
+            // Withdrawal to a third party is blocked: submitter != destination
+            // so the submitter freeze check applies.
+            {
+                auto withdrawToCharlie =
+                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                withdrawToCharlie[sfDestination] = charlie.human();
+                // Post-fix: tecFROZEN (checkIndividualFrozen on submitter).
+                // Pre-fix: tecLOCKED (isFrozen on the vault share).
+                env(withdrawToCharlie, Ter(fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED)));
+            }
+
+            env(trust(issuer, asset(0), owner, tfClearFreeze));
+            env.close();
+        };
+
+        runTests();
+        env.disableFeature(fixCleanup3_3_0);
+        runTests();
+        env.enableFeature(fixCleanup3_3_0);
+    }
+
+    void
+    testVaultWithdrawFreeze()
+    {
+        using namespace test::jtx;
+
+        Account const issuer{"issuer"};
+        Account const owner{"owner"};
+
+        // === IOU ===
+        {
+            testcase("VaultWithdraw IOU freeze checks");
+            Env env{*this};
+            Vault vault{env};
+
+            env.fund(XRP(100'000), issuer, owner);
+            env(fset(issuer, asfAllowTrustLineClawback));
+            env.close();
+            PrettyAsset const asset = issuer["IOU"];
+            env.trust(asset(1'000'000), owner);
+            env(pay(issuer, owner, asset(100'000)));
+            env.close();
+
+            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
+            env(tx);
+            env.close();
+            auto const vaultAcct = Account("vault", env.le(keylet)->at(sfAccount));
+
+            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
+            env.close();
+
+            Account const charlie{"charlie"};
+            env.fund(XRP(10'000), charlie);
+            env.trust(asset(1'000'000), charlie);
+            env.close();
+
+            auto runTests = [&]() {
+                auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+                // Post-fix: submitter freeze blocks withdraw to 3rd party
+                // Pre-fix: submitter's IOU freeze not checked, but
+                //          checkFrozen(depositor, share) may trigger tecLOCKED
+                TER const submitterTo3rd = fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED);
+
+                // Global freeze → self-withdraw
+                env(fset(issuer, asfGlobalFreeze));
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(tecFROZEN));
+                // Global freeze → withdraw to 3rd party
+                {
+                    auto withdrawToCharlie =
+                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                    withdrawToCharlie[sfDestination] = charlie.human();
+                    env(withdrawToCharlie, Ter(tecFROZEN));
+                }
+                env(fclear(issuer, asfGlobalFreeze));
+
+                // Vault-account regular freeze
+                {
+                    auto trustSet = [&]() {
+                        json::Value jv;
+                        jv[jss::Account] = issuer.human();
+                        {
+                            auto& ja = jv[jss::LimitAmount] =
+                                asset(0).value().getJson(JsonOptions::Values::None);
+                            ja[jss::issuer] = toBase58(vaultAcct.id());
+                        }
+                        jv[jss::TransactionType] = jss::TrustSet;
+                        return jv;
+                    }();
+
+                    trustSet[jss::Flags] = tfSetFreeze;
+                    env(trustSet);
+                    env.close();
+
+                    TER const vaultAcctFreeze = fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED);
+
+                    // Self-withdraw
+                    env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                        Ter(vaultAcctFreeze));
+                    // Withdraw to 3rd party
+                    {
+                        auto withdrawToCharlie = vault.withdraw(
+                            {.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                        withdrawToCharlie[sfDestination] = charlie.human();
+                        env(withdrawToCharlie, Ter(vaultAcctFreeze));
+                    }
+
+                    trustSet[jss::Flags] = tfClearFreeze;
+                    env(trustSet);
+                    env.close();
+                }
+
+                // Depositor regular freeze → self-withdraw
+                env(trust(issuer, asset(0), owner, tfSetFreeze));
+                // Post-fix: self-withdraw allowed (submitter==dst skip)
+                // Pre-fix: isFrozen(depositor, iou) catches it
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(fix330Enabled ? TER(tesSUCCESS) : TER(tecFROZEN)));
+
+                // Depositor regular freeze → withdraw to 3rd party
+                {
+                    auto withdrawTo3rd =
+                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                    withdrawTo3rd[sfDestination] = charlie.human();
+                    env(withdrawTo3rd, Ter(submitterTo3rd));
+                }
+                env(trust(issuer, asset(0), owner, tfClearFreeze));
+                // Replenish what was withdrawn
+                if (fix330Enabled)
+                {
+                    env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
+                }
+                env.close();
+
+                // Depositor deep freeze → self-withdraw blocked
+                env(trust(issuer, asset(0), owner, tfSetFreeze | tfSetDeepFreeze));
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(fix330Enabled ? TER(tecFROZEN) : TER(tecFROZEN)));
+                env(trust(issuer, asset(0), owner, tfClearFreeze | tfClearDeepFreeze));
+
+                // Destination regular freeze → withdraw to 3rd party
+                env(trust(issuer, asset(0), charlie, tfSetFreeze));
+                // Self-withdraw unaffected by charlie's freeze
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
+                {
+                    auto withdrawToCharlie =
+                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                    withdrawToCharlie[sfDestination] = charlie.human();
+                    // Post-fix: regular freeze on dst allowed
+                    // Pre-fix: checkFrozen(dst, iou) catches it
+                    env(withdrawToCharlie, Ter(fix330Enabled ? TER(tesSUCCESS) : TER(tecFROZEN)));
+                }
+                env(trust(issuer, asset(0), charlie, tfClearFreeze));
+                // Replenish: 1 for self-withdraw + 1 if charlie withdraw succeeded
+                env(vault.deposit(
+                    {.depositor = owner,
+                     .id = keylet.key,
+                     .amount = asset(fix330Enabled ? 2 : 1)}));
+                env.close();
+
+                // Destination deep freeze → withdraw to 3rd party blocked
+                env(trust(issuer, asset(0), charlie, tfSetFreeze | tfSetDeepFreeze));
+                {
+                    auto withdrawToCharlie =
+                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                    withdrawToCharlie[sfDestination] = charlie.human();
+                    env(withdrawToCharlie, Ter(tecFROZEN));
+                }
+                // Destination deep freeze → self-withdraw unaffected
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
+                env(trust(issuer, asset(0), charlie, tfClearFreeze | tfClearDeepFreeze));
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
+                env.close();
+
+                // Clawback works while frozen
+                env(fset(issuer, asfGlobalFreeze));
+                env(vault.clawback(
+                    {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = asset(1)}));
+                env(fclear(issuer, asfGlobalFreeze));
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
+                env.close();
+            };
+
+            runTests();
+            env.disableFeature(fixCleanup3_3_0);
+            runTests();
+            env.enableFeature(fixCleanup3_3_0);
+        }
+
+        // === MPT ===
+        {
+            testcase("VaultWithdraw MPT lock checks");
+            Env env{*this};
+            Vault vault{env};
+
+            env.fund(XRP(100'000), issuer, owner);
+            env.close();
+
+            MPTTester mptt{env, issuer, kMptInitNoFund};
+            mptt.create(
+                {.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth});
+            PrettyAsset const mpt{mptt.issuanceID()};
+
+            mptt.authorize({.account = owner});
+            mptt.authorize({.account = issuer, .holder = owner});
+            env.close();
+            env(pay(issuer, owner, mpt(100'000)));
+            env.close();
+
+            auto [tx, keylet] = vault.create({.owner = owner, .asset = mpt});
+            env(tx);
+            env.close();
+            Account const vaultAcct("vault", env.le(keylet)->at(sfAccount));
+
+            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(100)}));
+            env.close();
+
+            Account const charlie{"charlie"};
+            env.fund(XRP(10'000), charlie);
+            env.close();
+            mptt.authorize({.account = charlie});
+            mptt.authorize({.account = issuer, .holder = charlie});
+            env.close();
+
+            auto runTests = [&]() {
+                auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+
+                // Global lock
+                mptt.set({.flags = tfMPTLock});
+                env.close();
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
+                    Ter(tecLOCKED));
+
+                // Global lock → withdraw to issuer
+                // Post-fix: bypasses freeze checks, but accountHolds
+                //           on the pseudo returns 0 under global lock
+                // Pre-fix: checkFrozen(dst=issuer) catches global lock
+                {
+                    auto withdrawToIssuer =
+                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)});
+                    withdrawToIssuer[sfDestination] = issuer.human();
+                    env(withdrawToIssuer, Ter(fix330Enabled ? TER(tesSUCCESS) : TER(tecLOCKED)));
+                }
+                mptt.set({.flags = tfMPTUnlock});
+                env.close();
+                if (fix330Enabled)
+                {
+                    env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
+                }
+                env.close();
+
+                // Vault pseudo-account individual lock
+                mptt.set({.holder = vaultAcct, .flags = tfMPTLock});
+                env.close();
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
+                    Ter(tecLOCKED));
+                mptt.set({.holder = vaultAcct, .flags = tfMPTUnlock});
+                env.close();
+
+                // Depositor individual lock → self-withdraw blocked
+                // (isDeepFrozen == isFrozen for MPT)
+                mptt.set({.holder = owner, .flags = tfMPTLock});
+                env.close();
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
+                    Ter(tecLOCKED));
+                // Depositor lock → withdraw to 3rd party also blocked
+                {
+                    auto withdrawToCharlie =
+                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)});
+                    withdrawToCharlie[sfDestination] = charlie.human();
+                    env(withdrawToCharlie, Ter(tecLOCKED));
+                }
+
+                // Depositor lock → withdraw to issuer
+                // Post-fix: issuer bypass in checkWithdrawFreezes
+                // Pre-fix: checkFrozen(depositor, share) blocks transitively
+                {
+                    auto withdrawToIssuer =
+                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)});
+                    withdrawToIssuer[sfDestination] = issuer.human();
+                    env(withdrawToIssuer, Ter(fix330Enabled ? TER(tesSUCCESS) : TER(tecLOCKED)));
+                }
+                mptt.set({.holder = owner, .flags = tfMPTUnlock});
+                env.close();
+                if (fix330Enabled)
+                {
+                    env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
+                }
+                env.close();
+
+                // 3rd party destination lock → withdraw to 3rd party blocked
+                mptt.set({.holder = charlie, .flags = tfMPTLock});
+                env.close();
+                {
+                    auto withdrawToCharlie =
+                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)});
+                    withdrawToCharlie[sfDestination] = charlie.human();
+                    env(withdrawToCharlie, Ter{tecLOCKED});
+                }
+                // 3rd party lock → self-withdraw unaffected
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
+                mptt.set({.holder = charlie, .flags = tfMPTUnlock});
+                env.close();
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
+                env.close();
+
+                // Clawback works while locked
+                mptt.set({.flags = tfMPTLock});
+                env.close();
+                env(vault.clawback(
+                    {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = mpt(1)}));
+                mptt.set({.flags = tfMPTUnlock});
+                env.close();
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
+                env.close();
+            };
+
+            runTests();
+            env.disableFeature(fixCleanup3_3_0);
+            runTests();
+            env.enableFeature(fixCleanup3_3_0);
+        }
+    }
+
 public:
     void
     run() override
@@ -7864,6 +8083,10 @@ public:
         testWithdrawSoleShareholderPartialFixedSharesUsesFullPrice();
         testWithdrawSoleShareholderLoanRepaymentExit();
 
+        testVaultDepositFreeze();
+        testVaultWithdrawFreeze();
+        testVaultSelfWithdrawWhileFrozen();
+
         testReferenceHolding();
         testHoldingDeletionBlocked();
     }
diff --git a/src/test/jtx/Env.h b/src/test/jtx/Env.h
index 3d813d993c..aca6074c4a 100644
--- a/src/test/jtx/Env.h
+++ b/src/test/jtx/Env.h
@@ -96,6 +96,26 @@ testableAmendments()
     return kIds;
 }
 
+/**
+ * Returns all 2^N permutations of a seed FeatureBitset with each subset of
+ * the given features excluded.  The seed is included as the first element.
+ *
+ * Useful for running a test over every combination of optional amendments
+ * so that each case is exercised both with and without each feature.
+ */
+inline std::vector<FeatureBitset>
+amendmentCombinations(std::initializer_list<uint256> features, FeatureBitset seed)
+{
+    std::vector<FeatureBitset> result{seed};
+    for (auto const& f : features)
+    {
+        auto const n = result.size();
+        for (std::size_t i = 0; i < n; ++i)
+            result.push_back(result[i] - f);
+    }
+    return result;
+}
+
 //------------------------------------------------------------------------------
 
 class SuiteLogs : public Logs
diff --git a/src/test/jtx/impl/utility.cpp b/src/test/jtx/impl/utility.cpp
index 9256242417..7da419c6e7 100644
--- a/src/test/jtx/impl/utility.cpp
+++ b/src/test/jtx/impl/utility.cpp
@@ -100,5 +100,4 @@ cmdToJSONRPC(std::vector<std::string> const& args, beast::Journal j, unsigned in
         jv[jss::id] = paramsObj[jss::id];
     return jv;
 }
-
 }  // namespace xrpl::test::jtx
diff --git a/src/test/jtx/utility.h b/src/test/jtx/utility.h
index 535e14cf1d..c3ed91f672 100644
--- a/src/test/jtx/utility.h
+++ b/src/test/jtx/utility.h
@@ -7,6 +7,7 @@
 #include <xrpl/protocol/STObject.h>
 
 #include <stdexcept>
+#include <vector>
 
 namespace xrpl::test::jtx {
 
@@ -50,5 +51,4 @@ fillSeq(json::Value& jv, ReadView const& view);
 /** Given an xrpld unit test rpc command, return the corresponding JSON. */
 json::Value
 cmdToJSONRPC(std::vector<std::string> const& args, beast::Journal j, unsigned int apiVersion);
-
 }  // namespace xrpl::test::jtx

From fd8a9152437c3fa42922428e7029828cf54b1b88 Mon Sep 17 00:00:00 2001
From: yinyiqian1 <yqian@ripple.com>
Date: Fri, 26 Jun 2026 18:26:53 -0400
Subject: [PATCH 020/100] fix: Use trustline balance direction to validate IOU
 PaymentMint/PaymentBurn (#7584)

---
 include/xrpl/protocol/Permissions.h           |   2 +-
 src/libxrpl/protocol/Permissions.cpp          |  22 +-
 .../tx/transactors/payment/Payment.cpp        |  59 +++-
 src/test/app/Delegate_test.cpp                | 318 ++++++++++++++++--
 4 files changed, 365 insertions(+), 36 deletions(-)

diff --git a/include/xrpl/protocol/Permissions.h b/include/xrpl/protocol/Permissions.h
index eb161ef7ad..c6f464082d 100644
--- a/include/xrpl/protocol/Permissions.h
+++ b/include/xrpl/protocol/Permissions.h
@@ -106,7 +106,7 @@ public:
     txToPermissionType(TxType type);
 
     // tx type value is permission value minus one
-    [[nodiscard]] static TxType
+    [[nodiscard]] static std::optional<TxType>
     permissionToTxType(std::uint32_t value);
 
     /**
diff --git a/src/libxrpl/protocol/Permissions.cpp b/src/libxrpl/protocol/Permissions.cpp
index 3aa9705b03..80aa1b1f4e 100644
--- a/src/libxrpl/protocol/Permissions.cpp
+++ b/src/libxrpl/protocol/Permissions.cpp
@@ -13,6 +13,7 @@
 #include <algorithm>
 #include <cstdint>
 #include <functional>
+#include <limits>
 #include <optional>
 #include <stdexcept>
 #include <string>
@@ -152,9 +153,11 @@ Permission::getPermissionName(std::uint32_t value) const
         return granular;
 
     // not a granular permission, check if it maps to a transaction type
-    auto const txType = permissionToTxType(value);
-    if (auto const* item = TxFormats::getInstance().findByType(txType); item != nullptr)
-        return item->getName();
+    if (auto const txType = permissionToTxType(value))
+    {
+        if (auto const* item = TxFormats::getInstance().findByType(*txType); item != nullptr)
+            return item->getName();
+    }
 
     return std::nullopt;
 }
@@ -231,7 +234,10 @@ Permission::isDelegable(std::uint32_t permissionValue, Rules const& rules) const
     }
 
     auto const txType = permissionToTxType(permissionValue);
-    auto const txIt = txDelegationMap_.find(txType);
+    if (!txType)
+        return false;
+
+    auto const txIt = txDelegationMap_.find(*txType);
 
     // Tx-level permissions require the transaction type itself to be delegable, and
     // the corresponding amendment enabled.
@@ -245,10 +251,14 @@ Permission::txToPermissionType(TxType const type)
     return static_cast<uint32_t>(type) + 1;
 }
 
-TxType
+std::optional<TxType>
 Permission::permissionToTxType(uint32_t value)
 {
-    XRPL_ASSERT(value > 0, "xrpl::Permission::permissionToTxType : value is greater than 0");
+    // Values outside this range [1, 65536] would silently truncate when cast to
+    // uint16_t, for example, 65537 would become 1, mapping to the Payment transaction.
+    if (value == 0 || value > std::numeric_limits<std::uint16_t>::max() + 1u)
+        return std::nullopt;
+
     return static_cast<TxType>(value - 1);
 }
 
diff --git a/src/libxrpl/tx/transactors/payment/Payment.cpp b/src/libxrpl/tx/transactors/payment/Payment.cpp
index 9a9a01ec19..7f1e4d8079 100644
--- a/src/libxrpl/tx/transactors/payment/Payment.cpp
+++ b/src/libxrpl/tx/transactors/payment/Payment.cpp
@@ -283,16 +283,59 @@ Payment::checkGranularSemantics(
     if (tx.isFieldPresent(sfSendMax) && tx[sfSendMax].asset() != amountAsset)
         return terNO_DELEGATE_PERMISSION;
 
-    // PaymentMint and PaymentBurn apply to both IOU and MPT direct payments.
-    if (heldGranularPermissions.contains(PaymentMint) && !isXRP(amountAsset) &&
-        amountAsset.getIssuer() == tx[sfAccount])
-        return tesSUCCESS;
+    if (isXRP(amountAsset))
+        return terNO_DELEGATE_PERMISSION;
 
-    if (heldGranularPermissions.contains(PaymentBurn) && !isXRP(amountAsset) &&
-        amountAsset.getIssuer() == tx[sfDestination])
-        return tesSUCCESS;
+    return amountAsset.visit(
+        [&](MPTIssue const& mptIssue) -> NotTEC {
+            // For MPT payments, the MPTokenIssuanceID encodes the issuer unambiguously,
+            // unlike IOU, there is no endpoint aliasing where either side of the
+            // trustline can appear as the issuer.
+            if (heldGranularPermissions.contains(PaymentMint) &&
+                mptIssue.getIssuer() == tx[sfAccount])
+                return tesSUCCESS;
+            if (heldGranularPermissions.contains(PaymentBurn) &&
+                mptIssue.getIssuer() == tx[sfDestination])
+                return tesSUCCESS;
+            return terNO_DELEGATE_PERMISSION;
+        },
+        [&](Issue const& issue) -> NotTEC {
+            // For IOU payments, either endpoint may be encoded as the issuer in
+            // sfAmount. PaySteps normalizes those endpoint aliases, so sfAmount.issuer
+            // alone does not reliably identify whether the transaction issues or redeems
+            // IOUs. We determine PaymentMint vs PaymentBurn from the trustline balance
+            // direction instead.
+            auto const account = tx[sfAccount];
+            auto const destination = tx[sfDestination];
 
-    return terNO_DELEGATE_PERMISSION;
+            // Reject if neither endpoint is the issuer.
+            if (issue.getIssuer() != account && issue.getIssuer() != destination)
+                return terNO_DELEGATE_PERMISSION;
+
+            auto const sle = view.read(keylet::trustLine(account, destination, issue.currency));
+            if (!sle)
+                return terNO_DELEGATE_PERMISSION;
+
+            bool const accountIsLow = (account < destination);
+            auto const destLimit = sle->getFieldAmount(accountIsLow ? sfHighLimit : sfLowLimit);
+            auto const rawBalance = sle->getFieldAmount(sfBalance);
+            bool const accountIsHolder =
+                accountIsLow ? rawBalance > beast::kZero : rawBalance < beast::kZero;
+
+            // PaymentMint requires the destination to be the holder and the account to be the
+            // issuer. destLimit > 0: destination is willing to hold account's IOUs (account is the
+            // issuer). !accountIsHolder: DirectStepI will issue, not redeem.
+            if (heldGranularPermissions.contains(PaymentMint) && destLimit > beast::kZero &&
+                !accountIsHolder)
+                return tesSUCCESS;
+
+            // PaymentBurn requires the source account to be the holder and the destination to be
+            // the issuer. accountIsHolder: DirectStepI will redeem, not issue.
+            if (heldGranularPermissions.contains(PaymentBurn) && accountIsHolder)
+                return tesSUCCESS;
+
+            return terNO_DELEGATE_PERMISSION;
+        });
 }
 
 TER
diff --git a/src/test/app/Delegate_test.cpp b/src/test/app/Delegate_test.cpp
index 6e80577797..f68f813853 100644
--- a/src/test/app/Delegate_test.cpp
+++ b/src/test/app/Delegate_test.cpp
@@ -53,6 +53,7 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 #include <memory>
 #include <string>
 #include <tuple>
@@ -1105,10 +1106,43 @@ class Delegate_test : public beast::unit_test::Suite
             env(delegate::set(alice, bob, {"PaymentBurn"}));
             env.close();
 
-            env(pay(alice, gw, usd(30)), Sendmax(usd(30)), delegate::As(bob));
+            env(pay(alice, gw, usd(30)), delegate::As(bob));
             env.require(Balance(alice, usd(20)));
         }
 
+        // PaymentBurn is authorized by balance direction, not trust limit.
+        // holder is allowed to burn even if trust limit is 0.
+        {
+            Env env(*this);
+            Account const alice{"alice"};
+            Account const bob{"bob"};
+            Account const gw{"gateway"};
+            auto const gwUSD = gw["USD"];
+            auto const aliceUSD = alice["USD"];
+
+            env.fund(XRP(10000), alice, bob, gw);
+            env.trust(gwUSD(200), alice);
+            env.close();
+
+            env(pay(gw, alice, gwUSD(50)));
+            env.require(Balance(alice, gwUSD(50)));
+            env.close();
+
+            env(delegate::set(alice, bob, {"PaymentBurn"}));
+            env.close();
+
+            env.trust(gwUSD(0), alice);
+            env.close();
+            BEAST_EXPECT(env.limit(alice, gwUSD.issue()) == gwUSD(0));
+
+            env(trust(gw, aliceUSD(200)));
+            env.close();
+
+            env(pay(alice, gw, gwUSD(30)), delegate::As(bob));
+            env.require(Balance(alice, gwUSD(20)));
+            env.require(Balance(gw, aliceUSD(-20)));
+        }
+
         // Test invalid fields or flags not allowed in granular permission template
         {
             Env env(*this, features);
@@ -1184,22 +1218,22 @@ class Delegate_test : public beast::unit_test::Suite
             mpt.authorize({.account = alice});
             mpt.authorize({.account = bob});
 
-            auto const MPT = mpt["MPT"];  // NOLINT(readability-identifier-naming)
-            env(pay(gw, alice, MPT(500)));
-            env(pay(gw, bob, MPT(500)));
+            auto const gwMPT = mpt["MPT"];
+            env(pay(gw, alice, gwMPT(500)));
+            env(pay(gw, bob, gwMPT(500)));
             env.close();
-            auto aliceMPT = env.balance(alice, MPT);
-            auto bobMPT = env.balance(bob, MPT);
+            auto aliceMPT = env.balance(alice, gwMPT);
+            auto bobMPT = env.balance(bob, gwMPT);
 
             // PaymentMint
             {
                 env(delegate::set(gw, bob, {"PaymentMint"}));
                 env.close();
 
-                env(pay(gw, alice, MPT(50)), delegate::As(bob));
-                BEAST_EXPECT(env.balance(alice, MPT) == aliceMPT + MPT(50));
-                BEAST_EXPECT(env.balance(bob, MPT) == bobMPT);
-                aliceMPT = env.balance(alice, MPT);
+                env(pay(gw, alice, gwMPT(50)), delegate::As(bob));
+                BEAST_EXPECT(env.balance(alice, gwMPT) == aliceMPT + gwMPT(50));
+                BEAST_EXPECT(env.balance(bob, gwMPT) == bobMPT);
+                aliceMPT = env.balance(alice, gwMPT);
             }
 
             // PaymentBurn
@@ -1207,26 +1241,235 @@ class Delegate_test : public beast::unit_test::Suite
                 env(delegate::set(alice, bob, {"PaymentBurn"}));
                 env.close();
 
-                env(pay(alice, gw, MPT(50)), delegate::As(bob));
-                BEAST_EXPECT(env.balance(alice, MPT) == aliceMPT - MPT(50));
-                BEAST_EXPECT(env.balance(bob, MPT) == bobMPT);
-                aliceMPT = env.balance(alice, MPT);
+                env(pay(alice, gw, gwMPT(50)), delegate::As(bob));
+                BEAST_EXPECT(env.balance(alice, gwMPT) == aliceMPT - gwMPT(50));
+                BEAST_EXPECT(env.balance(bob, gwMPT) == bobMPT);
+                aliceMPT = env.balance(alice, gwMPT);
             }
 
             // Grant both granular permissions and tx level permission.
             {
                 env(delegate::set(alice, bob, {"PaymentBurn", "PaymentMint", "Payment"}));
                 env.close();
-                env(pay(alice, gw, MPT(50)), delegate::As(bob));
-                BEAST_EXPECT(env.balance(alice, MPT) == aliceMPT - MPT(50));
-                BEAST_EXPECT(env.balance(bob, MPT) == bobMPT);
-                aliceMPT = env.balance(alice, MPT);
-                env(pay(alice, bob, MPT(100)), delegate::As(bob));
-                BEAST_EXPECT(env.balance(alice, MPT) == aliceMPT - MPT(100));
-                BEAST_EXPECT(env.balance(bob, MPT) == bobMPT + MPT(100));
+                env(pay(alice, gw, gwMPT(50)), delegate::As(bob));
+                BEAST_EXPECT(env.balance(alice, gwMPT) == aliceMPT - gwMPT(50));
+                BEAST_EXPECT(env.balance(bob, gwMPT) == bobMPT);
+                aliceMPT = env.balance(alice, gwMPT);
+                env(pay(alice, bob, gwMPT(100)), delegate::As(bob));
+                BEAST_EXPECT(env.balance(alice, gwMPT) == aliceMPT - gwMPT(100));
+                BEAST_EXPECT(env.balance(bob, gwMPT) == bobMPT + gwMPT(100));
             }
         }
 
+        // PaymentMint/PaymentBurn must not trust IOU issuer aliases.
+        // In a direct IOU payment, sfAmount.issuer may be encoded as either
+        // endpoint, and PaySteps normalizes those aliases to the same execution.
+        // These cases ensure a delegate cannot flip the encoded issuer to turn a
+        // mint into an apparent burn, or a burn into an apparent mint.
+        {
+            Env env(*this);
+            Account const alice{"alice"};
+            Account const bob{"bob"};
+            Account const gw{"gateway"};
+            auto const gwUSD = gw["USD"];
+            auto const aliceUSD = alice["USD"];
+
+            env.fund(XRP(10000), alice, bob, gw);
+            env.trust(gwUSD(200), alice);
+            env.close();
+
+            // Alice holds 100 USD issued by gw.
+            env(pay(gw, alice, gwUSD(100)));
+            env.close();
+            env.require(Balance(alice, gwUSD(100)));
+
+            // Delegate with only PaymentBurn tries to mint by encoding
+            // Amount.issuer as the destination alias, alice. The actual issuer
+            // is gw, so this requires PaymentMint and must be rejected.
+            {
+                env(delegate::set(gw, bob, {"PaymentBurn"}));
+                env.close();
+
+                // Amount.issuer = alice (destination), rejected because gw is
+                // the actual issuer and PaymentMint is required.
+                env(pay(gw, alice, aliceUSD(50)),
+                    delegate::As(bob),
+                    Ter(terNO_DELEGATE_PERMISSION));
+                env.require(Balance(alice, gwUSD(100)));
+
+                // Fails because bob holds PaymentBurn, not PaymentMint.
+                env(pay(gw, alice, gwUSD(50)), delegate::As(bob), Ter(terNO_DELEGATE_PERMISSION));
+                env.require(Balance(alice, gwUSD(100)));
+            }
+
+            // Delegate with only PaymentMint tries to burn by encoding
+            // Amount.issuer as the source alias, alice. The actual issuer is
+            // gw, so this requires PaymentBurn and must be rejected.
+            {
+                env(delegate::set(alice, bob, {"PaymentMint"}));
+                env.close();
+
+                // Amount.issuer = alice (account), rejected because gw is the
+                // actual issuer and PaymentBurn is required.
+                env(pay(alice, gw, aliceUSD(50)),
+                    delegate::As(bob),
+                    Ter(terNO_DELEGATE_PERMISSION));
+                env.require(Balance(alice, gwUSD(100)));
+
+                // Fails because bob holds PaymentMint, not PaymentBurn.
+                env(pay(alice, gw, gwUSD(50)), delegate::As(bob), Ter(terNO_DELEGATE_PERMISSION));
+                env.require(Balance(alice, gwUSD(100)));
+            }
+        }
+
+        // Neither account nor destination is issuer.
+        // PaymentMint and PaymentBurn do not authorize these payments.
+        {
+            // IOU
+            {
+                Env env(*this);
+                Account const alice{"alice"};
+                Account const bob{"bob"};
+                Account const gw{"gateway"};
+                Account const gw2{"gateway2"};
+                auto const gwUSD = gw["USD"];
+
+                env.fund(XRP(10000), alice, bob, gw, gw2);
+                env.close();
+
+                env.trust(gwUSD(200), alice);
+                env.close();
+
+                env(pay(gw, alice, gwUSD(100)));
+                env.close();
+
+                env(delegate::set(alice, bob, {"PaymentMint", "PaymentBurn"}));
+                env.close();
+
+                env(pay(alice, gw, gw2["USD"](50)),
+                    delegate::As(bob),
+                    Ter(terNO_DELEGATE_PERMISSION));
+            }
+
+            // MPT
+            {
+                Env env(*this, features);
+                Account const alice{"alice"};
+                Account const bob{"bob"};
+                Account const gw{"gateway"};
+                Account const gw2{"gateway2"};
+
+                env.fund(XRP(10000), gw2);
+                env.close();
+
+                MPTTester mpt(env, gw, {.holders = {alice, bob}});
+                mpt.create({.ownerCount = 1, .flags = tfMPTCanTransfer});
+
+                mpt.authorize({.account = alice});
+                mpt.authorize({.account = bob});
+
+                auto const gwMPT = mpt["MPT"];
+                env(pay(gw, alice, gwMPT(500)));
+                env(pay(gw, bob, gwMPT(500)));
+                env.close();
+
+                env(delegate::set(alice, bob, {"PaymentMint", "PaymentBurn"}));
+                env.close();
+
+                env(pay(alice, gw2, gwMPT(50)), delegate::As(bob), Ter(terNO_DELEGATE_PERMISSION));
+            }
+        }
+
+        // IOU issuer is an endpoint, but no trustline exists.
+        {
+            Env env(*this);
+            Account const alice{"alice"};
+            Account const bob{"bob"};
+            Account const gw{"gateway"};
+
+            env.fund(XRP(10000), alice, bob, gw);
+            env.close();
+
+            env(delegate::set(alice, bob, {"PaymentMint", "PaymentBurn"}));
+            env.close();
+
+            env(pay(alice, gw, alice["USD"](50)),
+                delegate::As(bob),
+                Ter(terNO_DELEGATE_PERMISSION));
+        }
+
+        // Both trust limits (who is the designated issuer) and balance direction
+        // (which way DirectStepI executes) must be checked. Neither alone is sufficient.
+        {
+            Env env(*this);
+            Account const alice{"alice"};
+            Account const bob{"bob"};
+            Account const gw{"gateway"};
+            auto const gwUSD = gw["USD"];
+            auto const aliceUSD = alice["USD"];
+
+            env.fund(XRP(10000), alice, bob, gw);
+
+            // Alice trusts gw but holds zero gw-issued USD. With balance == 0,
+            // DirectStepI would issue rather than redeem, so PaymentBurn must
+            // be rejected even though Alice's trust limit to gw is positive.
+            {
+                env.trust(gwUSD(200), alice);
+                env.close();
+
+                // Alice has nothing to burn.
+                env(delegate::set(alice, bob, {"PaymentBurn"}));
+                env.close();
+
+                env(pay(alice, gw, gwUSD(50)), delegate::As(bob), Ter(terNO_DELEGATE_PERMISSION));
+                env(pay(alice, gw, aliceUSD(50)),
+                    delegate::As(bob),
+                    Ter(terNO_DELEGATE_PERMISSION));
+            }
+
+            // Set up a trust line where gw holds alice-issued USD. DirectStepI
+            // would redeem rather than issue, so PaymentMint must be rejected
+            // even though the endpoint identity matches.
+            {
+                // Gw sets trust to accept alice-issued USD.
+                env(trust(gw, aliceUSD(200)));
+                env.close();
+
+                // Alice issues her own USD to gw; now gw holds alice's IOUs.
+                env(pay(alice, gw, aliceUSD(100)));
+                env.close();
+
+                // In gw's view, accountHolds(gw, USD, alice) > 0, so DirectStepI redeems.
+                // PaymentMint must be rejected because the step would redeem, not issue.
+                env(delegate::set(gw, bob, {"PaymentMint"}));
+                env.close();
+
+                env(pay(gw, alice, gwUSD(50)), delegate::As(bob), Ter(terNO_DELEGATE_PERMISSION));
+                env(pay(gw, alice, aliceUSD(50)),
+                    delegate::As(bob),
+                    Ter(terNO_DELEGATE_PERMISSION));
+            }
+        }
+
+        // Alice trusts gw but gw is not willing to hold alice's IOU (destLimit == 0).
+        {
+            Env env(*this);
+            Account const alice{"alice"};
+            Account const bob{"bob"};
+            Account const gw{"gateway"};
+            env.fund(XRP(10000), alice, bob, gw);
+            env.trust(gw["USD"](200), alice);
+            env.close();
+
+            env(delegate::set(alice, bob, {"PaymentMint"}));
+            env.close();
+
+            env(pay(alice, gw, gw["USD"](50)), delegate::As(bob), Ter(terNO_DELEGATE_PERMISSION));
+            env(pay(alice, gw, alice["USD"](50)),
+                delegate::As(bob),
+                Ter(terNO_DELEGATE_PERMISSION));
+        }
+
         // Verify granular permissions of different tx types in the same SLE are scoped
         // correctly. AccountSet permissions don't apply to Payment and vice versa
         {
@@ -2617,6 +2860,38 @@ class Delegate_test : public beast::unit_test::Suite
         BEAST_EXPECT(granularPermissions.empty());
     }
 
+    void
+    testPermissionToTxType()
+    {
+        testcase("test Permission to Tx type");
+
+        // 0 is not a valid permission value
+        BEAST_EXPECT(!Permission::permissionToTxType(0));
+
+        // 1 maps to Payment transaction
+        BEAST_EXPECT(Permission::permissionToTxType(1) == ttPAYMENT);
+
+        // UINT16_MAX+1 is the maximum possible tx-level permission value
+        constexpr uint32_t maxTxPermission = std::numeric_limits<uint16_t>::max() + 1u;
+        BEAST_EXPECT(Permission::permissionToTxType(maxTxPermission).has_value());
+
+        // exceeding maximum value should return nullopt
+        BEAST_EXPECT(!Permission::permissionToTxType(maxTxPermission + 1));
+
+        // All granular permission values should return nullopt since they do not map to a TxType.
+        for (auto const gp : {
+#pragma push_macro("GRANULAR_PERMISSION")
+#undef GRANULAR_PERMISSION
+#define GRANULAR_PERMISSION(type, txType, value, ...) GranularPermissionType::type,
+#include <xrpl/protocol/detail/permissions.macro>
+#undef GRANULAR_PERMISSION
+#pragma pop_macro("GRANULAR_PERMISSION")
+             })
+        {
+            BEAST_EXPECT(!Permission::permissionToTxType(static_cast<uint32_t>(gp)));
+        }
+    }
+
     void
     run() override
     {
@@ -2647,6 +2922,7 @@ class Delegate_test : public beast::unit_test::Suite
         testTxDelegableCount();
         testNonDelegableTxWithDelegate(all);
         testDelegateUtilsNullptrCheck();
+        testPermissionToTxType();
     }
 };
 BEAST_DEFINE_TESTSUITE(Delegate, app, xrpl);

From 768d7603b1633d5d9a83801f04de789640882385 Mon Sep 17 00:00:00 2001
From: Shawn Xie <35279399+shawnxie999@users.noreply.github.com>
Date: Fri, 26 Jun 2026 21:20:38 -0400
Subject: [PATCH 021/100] feat: Confidential Transfer for MPT (#5860)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: chuanshanjida <chuanshanjida@outlook.com>
Co-authored-by: Ed Hennis <ed@ripple.com>
Co-authored-by: Jingchen <a1q123456@users.noreply.github.com>
Co-authored-by: Denis Angell <dangell@transia.co>
Co-authored-by: Bart <bthomee@users.noreply.github.com>
Co-authored-by: yinyiqian1 <yqian@ripple.com>
Co-authored-by: Vito Tumas <5780819+Tapanito@users.noreply.github.com>
Co-authored-by: Bronek Kozicki <brok@incorrekt.com>
Co-authored-by: Mayukha Vadari <mvadari@ripple.com>
Co-authored-by: Valentin Balaschenko <13349202+vlntb@users.noreply.github.com>
Co-authored-by: tequ <git@tequ.dev>
Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Co-authored-by: Peter Chen <34582813+PeterChen13579@users.noreply.github.com>
Co-authored-by: Bart <11445373+bthomee@users.noreply.github.com>
Co-authored-by: Zhiyuan Wang <96991820+Kassaking7@users.noreply.github.com>
Co-authored-by: Alex Kremer <akremer@ripple.com>
Co-authored-by: Sergey Kuznetsov <skuznetsov@ripple.com>
Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gregory Tsipenyuk <gregtatcam@users.noreply.github.com>
Co-authored-by: chuanshanjida <chuanshanjida@outlook.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Peter Chen <ychen@ripple.com>
Co-authored-by: Timothy Banks <timothyaaronbanks@gmail.com>
Co-authored-by: Timothy Banks <tbanks@ripple.com>
---
 CMakeLists.txt                                |    2 +
 conan.lock                                    |    1 +
 conanfile.py                                  |    2 +
 cspell.config.yaml                            |   11 +
 .../xrpl/ledger/helpers/CredentialHelpers.h   |   33 +
 include/xrpl/protocol/ConfidentialTransfer.h  |  431 +
 include/xrpl/protocol/LedgerFormats.h         |    6 +-
 include/xrpl/protocol/Protocol.h              |   62 +
 include/xrpl/protocol/TER.h                   |    6 +
 include/xrpl/protocol/TxFlags.h               |   11 +-
 include/xrpl/protocol/detail/features.macro   |    2 +-
 .../xrpl/protocol/detail/ledger_entries.macro |   23 +-
 include/xrpl/protocol/detail/secp256k1.h      |    5 +-
 include/xrpl/protocol/detail/sfields.macro    |   18 +
 .../xrpl/protocol/detail/transactions.macro   |   87 +
 include/xrpl/protocol/jss.h                   |  330 +-
 .../protocol_autogen/ledger_entries/MPToken.h |  210 +
 .../ledger_entries/MPTokenIssuance.h          |  105 +
 .../transactions/ConfidentialMPTClawback.h    |  201 +
 .../transactions/ConfidentialMPTConvert.h     |  336 +
 .../transactions/ConfidentialMPTConvertBack.h |  310 +
 .../transactions/ConfidentialMPTMergeInbox.h  |  129 +
 .../transactions/ConfidentialMPTSend.h        |  408 +
 .../transactions/MPTokenIssuanceSet.h         |   74 +
 include/xrpl/tx/Transactor.h                  |    5 +
 include/xrpl/tx/invariants/InvariantCheck.h   |    1 +
 include/xrpl/tx/invariants/MPTInvariant.h     |  171 +-
 .../token/ConfidentialMPTClawback.h           |   59 +
 .../token/ConfidentialMPTConvert.h            |   61 +
 .../token/ConfidentialMPTConvertBack.h        |   62 +
 .../token/ConfidentialMPTMergeInbox.h         |   63 +
 .../transactors/token/ConfidentialMPTSend.h   |   72 +
 .../ledger/helpers/CredentialHelpers.cpp      |   54 +-
 src/libxrpl/ledger/helpers/MPTokenHelpers.cpp |    9 +
 src/libxrpl/ledger/helpers/TokenHelpers.cpp   |    3 +-
 src/libxrpl/protocol/ConfidentialTransfer.cpp |  487 +
 src/libxrpl/protocol/PublicKey.cpp            |    3 +-
 src/libxrpl/protocol/TER.cpp                  |    2 +
 src/libxrpl/tx/Transactor.cpp                 |    9 +
 src/libxrpl/tx/invariants/MPTInvariant.cpp    |  302 +
 .../token/ConfidentialMPTClawback.cpp         |  210 +
 .../token/ConfidentialMPTConvert.cpp          |  350 +
 .../token/ConfidentialMPTConvertBack.cpp      |  319 +
 .../token/ConfidentialMPTMergeInbox.cpp       |  150 +
 .../transactors/token/ConfidentialMPTSend.cpp |  445 +
 .../tx/transactors/token/MPTokenAuthorize.cpp |   19 +
 .../token/MPTokenIssuanceCreate.cpp           |   14 +-
 .../transactors/token/MPTokenIssuanceSet.cpp  |  118 +-
 .../app/ConfidentialTransferExtended_test.cpp | 2595 ++++++
 src/test/app/ConfidentialTransfer_test.cpp    | 8208 +++++++++++++++++
 src/test/app/Delegate_test.cpp                |    4 +-
 src/test/app/Invariants_test.cpp              |  249 +
 src/test/app/MPToken_test.cpp                 |    3 +-
 src/test/app/Vault_test.cpp                   |   42 +
 src/test/jtx/ConfidentialTransfer.h           |  496 +
 src/test/jtx/batch.h                          |   40 +-
 src/test/jtx/impl/batch.cpp                   |   11 +
 src/test/jtx/impl/mpt.cpp                     | 1931 +++-
 src/test/jtx/impl/utility.cpp                 |   18 +-
 src/test/jtx/mpt.h                            |  442 +-
 .../ledger_entries/MPTokenIssuanceTests.cpp   |   81 +
 .../ledger_entries/MPTokenTests.cpp           |  162 +
 .../ConfidentialMPTClawbackTests.cpp          |  194 +
 .../ConfidentialMPTConvertBackTests.cpp       |  303 +
 .../ConfidentialMPTConvertTests.cpp           |  309 +
 .../ConfidentialMPTMergeInboxTests.cpp        |  146 +
 .../transactions/ConfidentialMPTSendTests.cpp |  363 +
 .../transactions/MPTokenIssuanceSetTests.cpp  |   42 +
 68 files changed, 21177 insertions(+), 253 deletions(-)
 create mode 100644 include/xrpl/protocol/ConfidentialTransfer.h
 create mode 100644 include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h
 create mode 100644 include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h
 create mode 100644 include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h
 create mode 100644 include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h
 create mode 100644 include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h
 create mode 100644 include/xrpl/tx/transactors/token/ConfidentialMPTClawback.h
 create mode 100644 include/xrpl/tx/transactors/token/ConfidentialMPTConvert.h
 create mode 100644 include/xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h
 create mode 100644 include/xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h
 create mode 100644 include/xrpl/tx/transactors/token/ConfidentialMPTSend.h
 create mode 100644 src/libxrpl/protocol/ConfidentialTransfer.cpp
 create mode 100644 src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp
 create mode 100644 src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp
 create mode 100644 src/libxrpl/tx/transactors/token/ConfidentialMPTConvertBack.cpp
 create mode 100644 src/libxrpl/tx/transactors/token/ConfidentialMPTMergeInbox.cpp
 create mode 100644 src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp
 create mode 100644 src/test/app/ConfidentialTransferExtended_test.cpp
 create mode 100644 src/test/app/ConfidentialTransfer_test.cpp
 create mode 100644 src/test/jtx/ConfidentialTransfer.h
 create mode 100644 src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTClawbackTests.cpp
 create mode 100644 src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTConvertBackTests.cpp
 create mode 100644 src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTConvertTests.cpp
 create mode 100644 src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTMergeInboxTests.cpp
 create mode 100644 src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTSendTests.cpp

diff --git a/CMakeLists.txt b/CMakeLists.txt
index bdc62442b3..1e8befcc8f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -90,6 +90,7 @@ find_package(ed25519 REQUIRED)
 find_package(gRPC REQUIRED)
 find_package(LibArchive REQUIRED)
 find_package(lz4 REQUIRED)
+find_package(mpt-crypto REQUIRED)
 find_package(nudb REQUIRED)
 find_package(OpenSSL REQUIRED)
 find_package(secp256k1 REQUIRED)
@@ -102,6 +103,7 @@ target_link_libraries(
     INTERFACE
         ed25519::ed25519
         lz4::lz4
+        mpt-crypto::mpt-crypto
         OpenSSL::Crypto
         OpenSSL::SSL
         secp256k1::secp256k1
diff --git a/conan.lock b/conan.lock
index 45dd145914..b6ddfa4e58 100644
--- a/conan.lock
+++ b/conan.lock
@@ -12,6 +12,7 @@
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
         "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
         "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
+        "mpt-crypto/0.4.0-rc2#a580f2f9ad0e795de696aa62d54fb9af%1782425834.488828",
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
         "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
         "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
diff --git a/conanfile.py b/conanfile.py
index 2733d4fc9c..aec4f9eab0 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -30,6 +30,7 @@ class Xrpl(ConanFile):
         "ed25519/2015.03",
         "grpc/1.81.1",
         "libarchive/3.8.7",
+        "mpt-crypto/0.4.0-rc2",
         "nudb/2.0.9",
         "openssl/3.6.3",
         "secp256k1/0.7.1",
@@ -208,6 +209,7 @@ class Xrpl(ConanFile):
             "grpc::grpc++",
             "libarchive::libarchive",
             "lz4::lz4",
+            "mpt-crypto::mpt-crypto",
             "nudb::nudb",
             "openssl::crypto",
             "protobuf::libprotobuf",
diff --git a/cspell.config.yaml b/cspell.config.yaml
index 8273df6c98..c120c31855 100644
--- a/cspell.config.yaml
+++ b/cspell.config.yaml
@@ -60,6 +60,7 @@ words:
   - autobridging
   - bimap
   - bindir
+  - blindings
   - bookdir
   - Bougalis
   - Britto
@@ -95,6 +96,7 @@ words:
   - daria
   - dcmake
   - dearmor
+  - decryptor
   - dedented
   - deleteme
   - demultiplexer
@@ -106,6 +108,7 @@ words:
   - distro
   - doxyfile
   - dxrpl
+  - elgamal
   - enabled
   - enablerepo
   - endmacro
@@ -119,6 +122,7 @@ words:
   - fmtdur
   - fsanitize
   - funclets
+  - Gamal
   - gcov
   - gcovr
   - ghead
@@ -216,6 +220,7 @@ words:
   - partitioner
   - paychan
   - paychans
+  - Pedersen
   - permdex
   - perminute
   - permissioned
@@ -239,6 +244,10 @@ words:
   - Raphson
   - rcflags
   - replayer
+  - rerandomize
+  - rerandomization
+  - rerandomized
+  - rerandomizes
   - rerere
   - retriable
   - RIPD
@@ -255,6 +264,7 @@ words:
   - sahyadri
   - Satoshi
   - scons
+  - Schnorr
   - secp
   - sendq
   - seqit
@@ -285,6 +295,7 @@ words:
   - stvar
   - stvector
   - stxchainattestations
+  - summands
   - superpeer
   - superpeers
   - takergets
diff --git a/include/xrpl/ledger/helpers/CredentialHelpers.h b/include/xrpl/ledger/helpers/CredentialHelpers.h
index 0cfbbde538..d6b797ce34 100644
--- a/include/xrpl/ledger/helpers/CredentialHelpers.h
+++ b/include/xrpl/ledger/helpers/CredentialHelpers.h
@@ -63,6 +63,39 @@ checkArray(STArray const& credentials, unsigned maxSize, beast::Journal j);
 TER
 verifyValidDomain(ApplyView& view, AccountID const& account, uint256 domainID, beast::Journal j);
 
+/**
+ * @brief Check whether src is authorized to deposit to dst.
+ *
+ * @param tx Transaction containing optional credential IDs.
+ * @param view Read-only ledger view.
+ * @param src Source account.
+ * @param dst Destination account.
+ * @param sleDst Destination AccountRoot, if it exists.
+ * @param j Journal for diagnostics.
+ * @return tesSUCCESS if the deposit is allowed, otherwise an authorization
+ *         error.
+ */
+TER
+checkDepositPreauth(
+    STTx const& tx,
+    ReadView const& view,
+    AccountID const& src,
+    AccountID const& dst,
+    std::shared_ptr<SLE const> const& sleDst,
+    beast::Journal j);
+
+/**
+ * @brief Remove expired credentials referenced by the transaction.
+ *
+ * @param tx Transaction containing optional sfCredentialIDs.
+ * @param view Mutable ledger view.
+ * @param j Journal for diagnostics.
+ * @return tesSUCCESS if no referenced credentials expired, tecEXPIRED if any
+ *         were removed, or an error from credential deletion.
+ */
+TER
+cleanupExpiredCredentials(STTx const& tx, ApplyView& view, beast::Journal j);
+
 // Check expired credentials and for existing DepositPreauth ledger object
 TER
 verifyDepositPreauth(
diff --git a/include/xrpl/protocol/ConfidentialTransfer.h b/include/xrpl/protocol/ConfidentialTransfer.h
new file mode 100644
index 0000000000..5b1bcbf606
--- /dev/null
+++ b/include/xrpl/protocol/ConfidentialTransfer.h
@@ -0,0 +1,431 @@
+#pragma once
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
+#include <xrpl/protocol/detail/secp256k1.h>
+
+#include <secp256k1_mpt.h>
+
+#include <cstdint>
+#include <limits>
+
+namespace xrpl {
+
+/**
+ * @brief Bundles an ElGamal public key with its associated encrypted amount.
+ *
+ * Used to represent a recipient in confidential transfers, containing both
+ * the recipient's ElGamal public key and the ciphertext encrypting the
+ * transfer amount under that key.
+ */
+struct ConfidentialRecipient
+{
+    /** @brief The recipient's ElGamal public key (size=xrpl::kEcPubKeyLength). */
+    Slice publicKey;
+
+    /**
+     * @brief The encrypted amount ciphertext
+     * (size=xrpl::kEcGamalEncryptedTotalLength).
+     */
+    Slice encryptedAmount;
+};
+
+/**
+ * @brief Holds two secp256k1 public key components representing an ElGamal
+ * ciphertext (C1, C2).
+ */
+struct EcPair
+{
+    /** @brief First ElGamal ciphertext component. */
+    secp256k1_pubkey c1;
+
+    /** @brief Second ElGamal ciphertext component. */
+    secp256k1_pubkey c2;
+};
+
+/**
+ * @brief Increments the confidential balance version counter on an MPToken.
+ *
+ * The version counter is used to prevent replay attacks by binding proofs
+ * to a specific state of the account's confidential balance. Wraps to 0
+ * on overflow (defined behavior for unsigned integers).
+ *
+ * @param mptoken The MPToken ledger entry to update.
+ */
+inline void
+incrementConfidentialVersion(STObject& mptoken)
+{
+    // Retrieve current version and increment, wrapping back to 0 at UINT32_MAX.
+    // The wrap is computed explicitly rather than relying on unsigned overflow
+    // of `+ 1u`, as it trips the unsigned-integer-overflow sanitizer in the UBSan CI build.
+    auto const current = mptoken[~sfConfidentialBalanceVersion].valueOr(0u);
+    mptoken[sfConfidentialBalanceVersion] =
+        current == std::numeric_limits<std::uint32_t>::max() ? 0u : current + 1u;
+}
+
+/**
+ * @brief Generates the context hash for ConfidentialMPTSend transactions.
+ *
+ * Creates a unique 256-bit hash that binds the zero-knowledge proofs to
+ * this specific send transaction, preventing proof reuse across transactions.
+ *
+ * @param account     The sender's account ID.
+ * @param issuanceID  The MPToken Issuance ID.
+ * @param sequence    The transaction sequence number or ticket number.
+ * @param destination The destination account ID.
+ * @param version     The sender's confidential balance version.
+ * @return A 256-bit context hash unique to this transaction.
+ */
+uint256
+getSendContextHash(
+    AccountID const& account,
+    uint192 const& issuanceID,
+    std::uint32_t sequence,
+    AccountID const& destination,
+    std::uint32_t version);
+
+/**
+ * @brief Generates the context hash for ConfidentialMPTClawback transactions.
+ *
+ * Creates a unique 256-bit hash that binds the equality proof to this
+ * specific clawback transaction.
+ *
+ * @param account    The issuer's account ID.
+ * @param issuanceID The MPToken Issuance ID.
+ * @param sequence   The transaction sequence number or ticket number.
+ * @param holder     The holder's account ID being clawed back from.
+ * @return A 256-bit context hash unique to this transaction.
+ */
+uint256
+getClawbackContextHash(
+    AccountID const& account,
+    uint192 const& issuanceID,
+    std::uint32_t sequence,
+    AccountID const& holder);
+
+/**
+ * @brief Generates the context hash for ConfidentialMPTConvert transactions.
+ *
+ * Creates a unique 256-bit hash that binds the Schnorr proof (for key
+ * registration) to this specific convert transaction.
+ *
+ * @param account    The holder's account ID.
+ * @param issuanceID The MPToken Issuance ID.
+ * @param sequence   The transaction sequence number or a ticket number.
+ * @return A 256-bit context hash unique to this transaction.
+ */
+uint256
+getConvertContextHash(AccountID const& account, uint192 const& issuanceID, std::uint32_t sequence);
+
+/**
+ * @brief Generates the context hash for ConfidentialMPTConvertBack transactions.
+ *
+ * Creates a unique 256-bit hash that binds the zero-knowledge proofs to
+ * this specific convert-back transaction.
+ *
+ * @param account    The holder's account ID.
+ * @param issuanceID The MPToken Issuance ID.
+ * @param sequence   The transaction sequence number or a ticket number.
+ * @param version    The holder's confidential balance version.
+ * @return A 256-bit context hash unique to this transaction.
+ */
+uint256
+getConvertBackContextHash(
+    AccountID const& account,
+    uint192 const& issuanceID,
+    std::uint32_t sequence,
+    std::uint32_t version);
+
+/**
+ * @brief Parses an ElGamal ciphertext into two secp256k1 public key components.
+ *
+ * Breaks an encrypted amount (size=xrpl::kEcGamalEncryptedTotalLength, two
+ * compressed EC points of size=xrpl::kEcCiphertextComponentLength) into
+ * a pair containing (C1, C2) for use in cryptographic operations.
+ *
+ * @param buffer The buffer containing the compressed ciphertext
+ *               (size=xrpl::kEcGamalEncryptedTotalLength).
+ * @return The parsed pair (c1, c2) if successful, std::nullopt if the buffer is invalid.
+ */
+std::optional<EcPair>
+makeEcPair(Slice const& buffer);
+
+/**
+ * @brief Serializes an EcPair into compressed form.
+ *
+ * Converts an EcPair (C1, C2) back into a buffer
+ * (size=xrpl::kEcGamalEncryptedTotalLength) containing two compressed EC
+ * points (size=xrpl::kEcCiphertextComponentLength each).
+ *
+ * @param pair The EcPair to serialize.
+ * @return The buffer (size=xrpl::kEcGamalEncryptedTotalLength), or std::nullopt
+ *         if serialization fails.
+ */
+std::optional<Buffer>
+serializeEcPair(EcPair const& pair);
+
+/**
+ * @brief Verifies that a buffer contains two valid, parsable EC public keys.
+ *
+ * @param buffer The input buffer containing two concatenated components.
+ * @return true if both components can be parsed successfully, false otherwise.
+ */
+bool
+isValidCiphertext(Slice const& buffer);
+
+/**
+ * @brief Verifies that a buffer contains a valid, parsable compressed EC point.
+ *
+ * Can be used to validate both compressed public keys and Pedersen commitments.
+ * Fails early if the prefix byte is not 0x02 or 0x03.
+ *
+ * @param buffer The input buffer containing a compressed EC point
+ *               (size=xrpl::kCompressedEcPointLength).
+ * @return true if the point can be parsed successfully, false otherwise.
+ */
+bool
+isValidCompressedECPoint(Slice const& buffer);
+
+/**
+ * @brief Homomorphically adds two ElGamal ciphertexts.
+ *
+ * Uses the additive homomorphic property of ElGamal encryption to compute
+ * Enc(a + b) from Enc(a) and Enc(b) without decryption.
+ *
+ * @param a The first ciphertext (size=xrpl::kEcGamalEncryptedTotalLength).
+ * @param b The second ciphertext (size=xrpl::kEcGamalEncryptedTotalLength).
+ * @return The resulting ciphertext Enc(a + b), or std::nullopt on failure.
+ */
+std::optional<Buffer>
+homomorphicAdd(Slice const& a, Slice const& b);
+
+/**
+ * @brief Homomorphically subtracts two ElGamal ciphertexts.
+ *
+ * Uses the additive homomorphic property of ElGamal encryption to compute
+ * Enc(a - b) from Enc(a) and Enc(b) without decryption.
+ *
+ * @param a The minuend ciphertext (size=xrpl::kEcGamalEncryptedTotalLength).
+ * @param b The subtrahend ciphertext (size=xrpl::kEcGamalEncryptedTotalLength).
+ * @return The resulting ciphertext Enc(a - b), or std::nullopt on failure.
+ */
+std::optional<Buffer>
+homomorphicSubtract(Slice const& a, Slice const& b);
+
+/**
+ * @brief Re-randomizes an ElGamal ciphertext without changing its plaintext.
+ *
+ * Adds Enc(0; randomness) under the supplied public key to the ciphertext.
+ * This is used when a public, deterministic scalar must perturb ciphertext
+ * randomness while preserving ledger reproducibility.
+ *
+ * @param ciphertext The ciphertext to re-randomize
+ *                   (size=xrpl::kEcGamalEncryptedTotalLength).
+ * @param pubKeySlice The ElGamal public key matching the ciphertext recipient.
+ * @param randomness The scalar used as zero-encryption randomness
+ *                   (size=xrpl::kEcScalarLength).
+ * @return The re-randomized ciphertext, or std::nullopt on failure.
+ */
+std::optional<Buffer>
+rerandomizeCiphertext(Slice const& ciphertext, Slice const& pubKeySlice, Slice const& randomness);
+
+/**
+ * @brief Encrypts an amount using ElGamal encryption.
+ *
+ * Produces a ciphertext C = (C1, C2) where C1 = r*G and C2 = m*G + r*Pk,
+ * using the provided blinding factor r.
+ *
+ * @param amt            The plaintext amount to encrypt.
+ * @param pubKeySlice    The recipient's ElGamal public key (size=xrpl::kEcPubKeyLength).
+ * @param blindingFactor The randomness used as blinding factor r
+ *                       (size=xrpl::ecBlindingFactorLength).
+ * @return The ciphertext (size=xrpl::kEcGamalEncryptedTotalLength), or std::nullopt on failure.
+ */
+std::optional<Buffer>
+encryptAmount(uint64_t const amt, Slice const& pubKeySlice, Slice const& blindingFactor);
+
+/**
+ * @brief Generates the canonical zero encryption for a specific MPToken.
+ *
+ * Creates a deterministic encryption of zero that is unique to the account
+ * and MPT issuance. Used to initialize confidential balance fields.
+ *
+ * @param pubKeySlice The holder's ElGamal public key (size=xrpl::kEcPubKeyLength).
+ * @param account     The account ID of the token holder.
+ * @param mptId       The MPToken Issuance ID.
+ * @return The canonical zero ciphertext (size=xrpl::kEcGamalEncryptedTotalLength), or std::nullopt
+ * on failure.
+ */
+std::optional<Buffer>
+encryptCanonicalZeroAmount(Slice const& pubKeySlice, AccountID const& account, MPTID const& mptId);
+
+/**
+ * @brief Verifies a Schnorr proof of knowledge of an ElGamal private key.
+ *
+ * Proves that the submitter knows the secret key corresponding to the
+ * provided public key, without revealing the secret key itself.
+ *
+ * @param pubKeySlice The ElGamal public key (size=xrpl::kEcPubKeyLength).
+ * @param proofSlice  The Schnorr proof (size=xrpl::ecSchnorrProofLength).
+ * @param contextHash The 256-bit context hash binding the proof.
+ * @return tesSUCCESS if valid, or an error code otherwise.
+ */
+TER
+verifySchnorrProof(Slice const& pubKeySlice, Slice const& proofSlice, uint256 const& contextHash);
+
+/**
+ * @brief Validates the format of encrypted amount fields in a transaction.
+ *
+ * Checks that all ciphertext fields in the transaction object have the
+ * correct length and contain valid EC points. This function is only used
+ * by ConfidentialMPTConvert and ConfidentialMPTConvertBack transactions.
+ *
+ * @param object The transaction object containing encrypted amount fields.
+ * @return tesSUCCESS if all formats are valid, temMALFORMED if required fields
+ *         are missing, or temBAD_CIPHERTEXT if format validation fails.
+ */
+NotTEC
+checkEncryptedAmountFormat(STObject const& object);
+
+/**
+ * @brief Verifies revealed amount encryptions for all recipients.
+ *
+ * Validates that the same amount was correctly encrypted for the holder,
+ * issuer, and optionally the auditor using their respective public keys.
+ *
+ * @param amount         The revealed plaintext amount.
+ * @param blindingFactor The blinding factor used in all encryptions
+ *                       (size=xrpl::ecBlindingFactorLength).
+ * @param holder         The holder's public key and encrypted amount.
+ * @param issuer         The issuer's public key and encrypted amount.
+ * @param auditor        Optional auditor's public key and encrypted amount.
+ * @return tesSUCCESS if all encryptions are valid, or an error code otherwise.
+ */
+TER
+verifyRevealedAmount(
+    uint64_t const amount,
+    Slice const& blindingFactor,
+    ConfidentialRecipient const& holder,
+    ConfidentialRecipient const& issuer,
+    std::optional<ConfidentialRecipient> const& auditor);
+
+/**
+ * @brief Returns the number of recipients in a confidential transfer.
+ *
+ * Returns 4 if an auditor is present (sender, destination, issuer, auditor),
+ * or 3 if no auditor (sender, destination, issuer).
+ *
+ * @param hasAuditor Whether the issuance has an auditor configured.
+ * @return The number of recipients (3 or 4).
+ */
+constexpr uint8_t
+getConfidentialRecipientCount(bool hasAuditor)
+{
+    return hasAuditor ? 4 : 3;
+}
+
+/**
+ * @brief Verifies a compact sigma clawback proof.
+ *
+ * Proves that the issuer knows the exact amount encrypted in the holder's
+ * balance ciphertext. Used in ConfidentialMPTClawback to verify the issuer
+ * can decrypt the balance using their private key.
+ *
+ * @param amount      The revealed plaintext amount.
+ * @param proof       The zero-knowledge proof bytes (ecClawbackProofLength).
+ * @param pubKeySlice The issuer's ElGamal public key (kEcPubKeyLength bytes).
+ * @param ciphertext  The issuer's encrypted balance on the holder's account
+ *                    (kEcGamalEncryptedTotalLength bytes).
+ * @param contextHash The 256-bit context hash binding the proof.
+ * @return tesSUCCESS if the proof is valid, or an error code otherwise.
+ */
+TER
+verifyClawbackProof(
+    uint64_t const amount,
+    Slice const& proof,
+    Slice const& pubKeySlice,
+    Slice const& ciphertext,
+    uint256 const& contextHash);
+
+/**
+ * @brief Generates a cryptographically secure blinding factor
+ * (size=xrpl::kEcBlindingFactorLength).
+ *
+ * Produces random bytes suitable for use as an ElGamal blinding factor
+ * or Pedersen commitment randomness.
+ *
+ * @return A buffer containing the random blinding factor
+ *         (size=xrpl::kEcBlindingFactorLength).
+ */
+Buffer
+generateBlindingFactor();
+
+/**
+ * @brief Verifies all zero-knowledge proofs for a ConfidentialMPTSend transaction.
+ *
+ * This function calls mpt_verify_send_proof API in the mpt-crypto utility lib, which verifies the
+ * equality proof, amount linkage, balance linkage, and range proof.
+ * Equality proof: Proves the same value is encrypted for the sender, receiver, issuer, and auditor.
+ * Amount linkage: Proves the send amount matches the amount Pedersen commitment.
+ * Balance linkage: Proves the sender's balance matches the balance Pedersen
+ * commitment.
+ * Range proof: Proves the amount and the remaining balance are within range [0, 2^64-1].
+ *
+ * @param proof             The full proof blob.
+ * @param sender            The sender's public key and encrypted amount.
+ * @param destination       The destination's public key and encrypted amount.
+ * @param issuer            The issuer's public key and encrypted amount.
+ * @param auditor           The auditor's public key and encrypted amount if present.
+ * @param spendingBalance   The sender's current spending balance ciphertext.
+ * @param amountCommitment  The Pedersen commitment to the send amount.
+ * @param balanceCommitment The Pedersen commitment to the sender's balance.
+ * @param contextHash       The context hash binding the proof.
+ * @return tesSUCCESS if all proofs are valid, or an error code otherwise.
+ */
+TER
+verifySendProof(
+    Slice const& proof,
+    ConfidentialRecipient const& sender,
+    ConfidentialRecipient const& destination,
+    ConfidentialRecipient const& issuer,
+    std::optional<ConfidentialRecipient> const& auditor,
+    Slice const& spendingBalance,
+    Slice const& amountCommitment,
+    Slice const& balanceCommitment,
+    uint256 const& contextHash);
+
+/**
+ * @brief Verifies all zero-knowledge proofs for a ConfidentialMPTConvertBack transaction.
+ *
+ * This function calls mpt_verify_convert_back_proof API in the mpt-crypto utility lib, which
+ * verifies the balance linkage proof and range proof. Balance linkage proof: proves the balance
+ * commitment matches the spending ciphertext. Range proof: proves the remaining balance after
+ * convert back is within range [0, 2^64-1].
+ *
+ * @param proof             The full proof blob.
+ * @param pubKeySlice       The holder's public key.
+ * @param spendingBalance   The holder's spending balance ciphertext.
+ * @param balanceCommitment The Pedersen commitment to the balance.
+ * @param amount            The amount being converted back to public.
+ * @param contextHash       The context hash binding the proof.
+ * @return tesSUCCESS if all proofs are valid, or an error code otherwise.
+ */
+TER
+verifyConvertBackProof(
+    Slice const& proof,
+    Slice const& pubKeySlice,
+    Slice const& spendingBalance,
+    Slice const& balanceCommitment,
+    uint64_t amount,
+    uint256 const& contextHash);
+
+}  // namespace xrpl
diff --git a/include/xrpl/protocol/LedgerFormats.h b/include/xrpl/protocol/LedgerFormats.h
index c1274e9e91..70afd12f34 100644
--- a/include/xrpl/protocol/LedgerFormats.h
+++ b/include/xrpl/protocol/LedgerFormats.h
@@ -177,7 +177,8 @@ enum LedgerEntryType : std::uint16_t {
         LSF_FLAG(lsfMPTCanEscrow, 0x00000008)                                                                                      \
         LSF_FLAG(lsfMPTCanTrade, 0x00000010)                                                                                       \
         LSF_FLAG(lsfMPTCanTransfer, 0x00000020)                                                                                    \
-        LSF_FLAG(lsfMPTCanClawback, 0x00000040))                                                                                   \
+        LSF_FLAG(lsfMPTCanClawback, 0x00000040)                                                                                    \
+        LSF_FLAG(lsfMPTCanHoldConfidentialBalance, 0x00000080))                                                                         \
                                                                                                                                    \
     LEDGER_OBJECT(MPTokenIssuanceMutable,                                                                                          \
         LSF_FLAG(lsmfMPTCanEnableCanLock, 0x00000002)                                                                              \
@@ -186,8 +187,9 @@ enum LedgerEntryType : std::uint16_t {
         LSF_FLAG(lsmfMPTCanEnableCanTrade, 0x00000010)                                                                             \
         LSF_FLAG(lsmfMPTCanEnableCanTransfer, 0x00000020)                                                                          \
         LSF_FLAG(lsmfMPTCanEnableCanClawback, 0x00000040)                                                                          \
+        LSF_FLAG(lsmfMPTCannotEnableCanHoldConfidentialBalance, 0x00000080)                                                                          \
         LSF_FLAG(lsmfMPTCanMutateMetadata, 0x00010000)                                                                             \
-        LSF_FLAG(lsmfMPTCanMutateTransferFee, 0x00020000))                                                                         \
+        LSF_FLAG(lsmfMPTCanMutateTransferFee, 0x00020000))                                                            \
                                                                                                                                    \
     LEDGER_OBJECT(MPToken,                                                                                                         \
         LSF_FLAG2(lsfMPTLocked, 0x00000001)                                                                                        \
diff --git a/include/xrpl/protocol/Protocol.h b/include/xrpl/protocol/Protocol.h
index 6a96b2ccbe..7eac92e83c 100644
--- a/include/xrpl/protocol/Protocol.h
+++ b/include/xrpl/protocol/Protocol.h
@@ -4,6 +4,10 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/protocol/Units.h>
 
+#include <mpt_protocol.h>
+#include <secp256k1_mpt.h>
+
+#include <cstddef>
 #include <cstdint>
 
 namespace xrpl {
@@ -307,4 +311,62 @@ constexpr std::size_t kPermissionMaxSize = 10;
 /** The maximum number of transactions that can be in a batch. */
 constexpr std::size_t kMaxBatchTxCount = 8;
 
+/** Length of a secp256k1 scalar in bytes. */
+constexpr std::size_t kEcScalarLength = kMPT_SCALAR_SIZE;
+
+/** Length of EC point (compressed) */
+constexpr std::size_t kCompressedEcPointLength = 33;
+
+/** Length of one compressed EC point component in an EC ElGamal ciphertext. */
+constexpr std::size_t kEcCiphertextComponentLength = kMPT_ELGAMAL_CIPHER_SIZE;
+
+/** EC ElGamal ciphertext length: two compressed EC points concatenated. */
+constexpr std::size_t kEcGamalEncryptedTotalLength = kMPT_ELGAMAL_TOTAL_SIZE;
+
+/** Length of EC public key (compressed) */
+constexpr std::size_t kEcPubKeyLength = kMPT_PUBKEY_SIZE;
+
+/** Length of EC private key in bytes */
+constexpr std::size_t kEcPrivKeyLength = kMPT_PRIVKEY_SIZE;
+
+/** Length of the EC blinding factor in bytes */
+constexpr std::size_t kEcBlindingFactorLength = kMPT_BLINDING_FACTOR_SIZE;
+
+/** Length of Schnorr ZKProof for public key registration (compact form) in bytes */
+constexpr std::size_t kEcSchnorrProofLength = kMPT_SCHNORR_PROOF_SIZE;
+
+/** Length of Pedersen Commitment (compressed) */
+constexpr std::size_t kEcPedersenCommitmentLength = kMPT_PEDERSEN_COMMIT_SIZE;
+
+/** Length of single bulletproof (range proof for 1 commitment) in bytes */
+constexpr std::size_t kEcSingleBulletproofLength = kMPT_SINGLE_BULLETPROOF_SIZE;
+
+/** Length of double bulletproof (range proof for 2 commitments) in bytes */
+constexpr std::size_t kEcDoubleBulletproofLength = kMPT_DOUBLE_BULLETPROOF_SIZE;
+
+/** Length of the compact sigma proof component for ConfidentialMPTSend. */
+constexpr std::size_t kEcSendSigmaProofLength = SECP256K1_COMPACT_STANDARD_PROOF_SIZE;
+
+/**  192 bytes compact sigma proof + 754 bytes double bulletproof. */
+constexpr std::size_t kEcSendProofLength = kEcSendSigmaProofLength + kEcDoubleBulletproofLength;
+
+/** Length of the compact sigma proof component for ConfidentialMPTConvertBack. */
+constexpr std::size_t kEcConvertBackSigmaProofLength = SECP256K1_COMPACT_CONVERTBACK_PROOF_SIZE;
+
+/**  128 bytes compact sigma proof + 688 bytes single bulletproof. */
+constexpr std::size_t kEcConvertBackProofLength =
+    kEcConvertBackSigmaProofLength + kEcSingleBulletproofLength;
+
+/** Length of the ZKProof for ConfidentialMPTClawback. */
+constexpr std::size_t kEcClawbackProofLength = SECP256K1_COMPACT_CLAWBACK_PROOF_SIZE;
+
+/** Extra base fee multiplier charged to confidential MPT transactions. */
+constexpr std::uint32_t kConfidentialFeeMultiplier = 9;
+
+/** Compressed EC point prefix for even y-coordinate */
+constexpr std::uint8_t kEcCompressedPrefixEvenY = 0x02;
+
+/** Compressed EC point prefix for odd y-coordinate */
+constexpr std::uint8_t kEcCompressedPrefixOddY = 0x03;
+
 }  // namespace xrpl
diff --git a/include/xrpl/protocol/TER.h b/include/xrpl/protocol/TER.h
index 072bd4778f..84c344ea76 100644
--- a/include/xrpl/protocol/TER.h
+++ b/include/xrpl/protocol/TER.h
@@ -128,6 +128,7 @@ enum TEMcodes : TERUnderlyingType {
     temBAD_TRANSFER_FEE,
     temINVALID_INNER_BATCH,
     temBAD_MPT,
+    temBAD_CIPHERTEXT,
 };
 
 //------------------------------------------------------------------------------
@@ -358,6 +359,11 @@ enum TECcodes : TERUnderlyingType {
     tecLIMIT_EXCEEDED = 195,
     tecPSEUDO_ACCOUNT = 196,
     tecPRECISION_LOSS = 197,
+    // DEPRECATED: This error code tecNO_DELEGATE_PERMISSION is reserved for
+    // backward compatibility with historical data on non-prod networks, can be
+    // reclaimed after those networks reset.
+    tecNO_DELEGATE_PERMISSION = 198,
+    tecBAD_PROOF = 199,
 };
 
 //------------------------------------------------------------------------------
diff --git a/include/xrpl/protocol/TxFlags.h b/include/xrpl/protocol/TxFlags.h
index f9c7bc1a5d..461afd24e7 100644
--- a/include/xrpl/protocol/TxFlags.h
+++ b/include/xrpl/protocol/TxFlags.h
@@ -140,7 +140,8 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
         TF_FLAG(tfMPTCanEscrow, lsfMPTCanEscrow)                                                                                                               \
         TF_FLAG(tfMPTCanTrade, lsfMPTCanTrade)                                                                                                                 \
         TF_FLAG(tfMPTCanTransfer, lsfMPTCanTransfer)                                                                                                           \
-        TF_FLAG(tfMPTCanClawback, lsfMPTCanClawback),                                                                                                          \
+        TF_FLAG(tfMPTCanClawback, lsfMPTCanClawback)                                                                                                           \
+        TF_FLAG(tfMPTCanHoldConfidentialBalance, lsfMPTCanHoldConfidentialBalance),                                                                                                            \
         MASK_ADJ(0))                                                                                                                                           \
                                                                                                                                                                \
     TRANSACTION(MPTokenAuthorize,                                                                                                                              \
@@ -349,10 +350,13 @@ inline constexpr FlagValue tmfMPTCanEnableCanTransfer = lsmfMPTCanEnableCanTrans
 inline constexpr FlagValue tmfMPTCanEnableCanClawback = lsmfMPTCanEnableCanClawback;
 inline constexpr FlagValue tmfMPTCanMutateMetadata = lsmfMPTCanMutateMetadata;
 inline constexpr FlagValue tmfMPTCanMutateTransferFee = lsmfMPTCanMutateTransferFee;
+inline constexpr FlagValue tmfMPTCannotEnableCanHoldConfidentialBalance =
+    lsmfMPTCannotEnableCanHoldConfidentialBalance;
 inline constexpr FlagValue tmfMPTokenIssuanceCreateMutableMask =
     ~(tmfMPTCanEnableCanLock | tmfMPTCanEnableRequireAuth | tmfMPTCanEnableCanEscrow |
       tmfMPTCanEnableCanTrade | tmfMPTCanEnableCanTransfer | tmfMPTCanEnableCanClawback |
-      tmfMPTCanMutateMetadata | tmfMPTCanMutateTransferFee);
+      tmfMPTCanMutateMetadata | tmfMPTCanMutateTransferFee |
+      tmfMPTCannotEnableCanHoldConfidentialBalance);
 
 // MPTokenIssuanceSet MutableFlags:
 // Enable mutable capability flags. These flags are one-way: once enabled,
@@ -364,9 +368,10 @@ inline constexpr FlagValue tmfMPTSetCanEscrow = 0x00000004;
 inline constexpr FlagValue tmfMPTSetCanTrade = 0x00000008;
 inline constexpr FlagValue tmfMPTSetCanTransfer = 0x00000010;
 inline constexpr FlagValue tmfMPTSetCanClawback = 0x00000020;
+inline constexpr FlagValue tmfMPTSetCanHoldConfidentialBalance = 0x00000040;
 inline constexpr FlagValue tmfMPTokenIssuanceSetMutableMask =
     ~(tmfMPTSetCanLock | tmfMPTSetRequireAuth | tmfMPTSetCanEscrow | tmfMPTSetCanTrade |
-      tmfMPTSetCanTransfer | tmfMPTSetCanClawback);
+      tmfMPTSetCanTransfer | tmfMPTSetCanClawback | tmfMPTSetCanHoldConfidentialBalance);
 
 // Prior to fixRemoveNFTokenAutoTrustLine, transfer of an NFToken between accounts allowed a
 // TrustLine to be added to the issuer of that token without explicit permission from that issuer.
diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index 2b6beaa671..a9b237be32 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -14,7 +14,7 @@
 
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
-
+XRPL_FEATURE(ConfidentialTransfer,        Supported::No, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_3_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_2_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(MPTokensV2,                  Supported::No,  VoteBehavior::DefaultNo)
diff --git a/include/xrpl/protocol/detail/ledger_entries.macro b/include/xrpl/protocol/detail/ledger_entries.macro
index e0ea1a61c3..2f403708c3 100644
--- a/include/xrpl/protocol/detail/ledger_entries.macro
+++ b/include/xrpl/protocol/detail/ledger_entries.macro
@@ -401,19 +401,28 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
     {sfDomainID,                 SoeOptional},
     {sfMutableFlags,             SoeDefault},
     {sfReferenceHolding,         SoeOptional},
+    {sfIssuerEncryptionKey,      SoeOptional},
+    {sfAuditorEncryptionKey,     SoeOptional},
+    {sfConfidentialOutstandingAmount, SoeDefault},
 }))
 
 /** A ledger object which tracks MPToken
     \sa keylet::mptoken
  */
 LEDGER_ENTRY(ltMPTOKEN, 0x007f, MPToken, mptoken, ({
-    {sfAccount,                  SoeRequired},
-    {sfMPTokenIssuanceID,        SoeRequired},
-    {sfMPTAmount,                SoeDefault},
-    {sfLockedAmount,             SoeOptional},
-    {sfOwnerNode,                SoeRequired},
-    {sfPreviousTxnID,            SoeRequired},
-    {sfPreviousTxnLgrSeq,        SoeRequired},
+    {sfAccount,                     SoeRequired},
+    {sfMPTokenIssuanceID,           SoeRequired},
+    {sfMPTAmount,                   SoeDefault},
+    {sfLockedAmount,                SoeOptional},
+    {sfOwnerNode,                   SoeRequired},
+    {sfPreviousTxnID,               SoeRequired},
+    {sfPreviousTxnLgrSeq,           SoeRequired},
+    {sfConfidentialBalanceInbox,    SoeOptional},
+    {sfConfidentialBalanceSpending, SoeOptional},
+    {sfConfidentialBalanceVersion,  SoeDefault},
+    {sfIssuerEncryptedBalance,      SoeOptional},
+    {sfAuditorEncryptedBalance,     SoeOptional},
+    {sfHolderEncryptionKey,         SoeOptional},
 }))
 
 /** A ledger object which tracks Oracle
diff --git a/include/xrpl/protocol/detail/secp256k1.h b/include/xrpl/protocol/detail/secp256k1.h
index 17dfa3ff25..5ca9033eae 100644
--- a/include/xrpl/protocol/detail/secp256k1.h
+++ b/include/xrpl/protocol/detail/secp256k1.h
@@ -11,7 +11,10 @@ secp256k1Context()
     struct Holder
     {
         secp256k1_context* impl;
-        Holder() : impl(secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN))
+        // SECP256K1_CONTEXT_SIGN and SECP256K1_CONTEXT_VERIFY were deprecated.
+        // All contexts support both signing and verification, so
+        // SECP256K1_CONTEXT_NONE is the correct flag to use.
+        Holder() : impl(secp256k1_context_create(SECP256K1_CONTEXT_NONE))
         {
         }
 
diff --git a/include/xrpl/protocol/detail/sfields.macro b/include/xrpl/protocol/detail/sfields.macro
index 01bb4fc480..0d453eea11 100644
--- a/include/xrpl/protocol/detail/sfields.macro
+++ b/include/xrpl/protocol/detail/sfields.macro
@@ -113,6 +113,7 @@ TYPED_SFIELD(sfInterestRate,             UINT32,    65) // 1/10 basis points (bi
 TYPED_SFIELD(sfLateInterestRate,         UINT32,    66) // 1/10 basis points (bips)
 TYPED_SFIELD(sfCloseInterestRate,        UINT32,    67) // 1/10 basis points (bips)
 TYPED_SFIELD(sfOverpaymentInterestRate,  UINT32,    68) // 1/10 basis points (bips)
+TYPED_SFIELD(sfConfidentialBalanceVersion, UINT32,  69)
 
 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)
@@ -146,6 +147,7 @@ TYPED_SFIELD(sfSubjectNode,              UINT64,    28)
 TYPED_SFIELD(sfLockedAmount,             UINT64,    29, SField::kSmdBaseTen|SField::kSmdDefault)
 TYPED_SFIELD(sfVaultNode,                UINT64,    30)
 TYPED_SFIELD(sfLoanBrokerNode,           UINT64,    31)
+TYPED_SFIELD(sfConfidentialOutstandingAmount, UINT64, 32, SField::kSmdBaseTen|SField::kSmdDefault)
 
 // 128-bit
 TYPED_SFIELD(sfEmailHash,                UINT128,    1)
@@ -206,6 +208,7 @@ TYPED_SFIELD(sfLoanBrokerID,             UINT256,   37,
     SField::kSmdPseudoAccount | SField::kSmdDefault)
 TYPED_SFIELD(sfLoanID,                   UINT256,   38)
 TYPED_SFIELD(sfReferenceHolding,         UINT256,   39)
+TYPED_SFIELD(sfBlindingFactor,           UINT256,   40)
 
 // number (common)
 TYPED_SFIELD(sfNumber,                   NUMBER,     1)
@@ -299,6 +302,21 @@ TYPED_SFIELD(sfAssetClass,               VL,        28)
 TYPED_SFIELD(sfProvider,                 VL,        29)
 TYPED_SFIELD(sfMPTokenMetadata,          VL,        30)
 TYPED_SFIELD(sfCredentialType,           VL,        31)
+TYPED_SFIELD(sfConfidentialBalanceInbox,    VL,     32)
+TYPED_SFIELD(sfConfidentialBalanceSpending, VL,     33)
+TYPED_SFIELD(sfIssuerEncryptedBalance,      VL,     34)
+TYPED_SFIELD(sfIssuerEncryptionKey,         VL,     35)
+TYPED_SFIELD(sfHolderEncryptionKey,         VL,     36)
+TYPED_SFIELD(sfZKProof,                     VL,     37)
+TYPED_SFIELD(sfHolderEncryptedAmount,       VL,     38)
+TYPED_SFIELD(sfIssuerEncryptedAmount,       VL,     39)
+TYPED_SFIELD(sfSenderEncryptedAmount,       VL,     40)
+TYPED_SFIELD(sfDestinationEncryptedAmount,  VL,     41)
+TYPED_SFIELD(sfAuditorEncryptedBalance,     VL,     42)
+TYPED_SFIELD(sfAuditorEncryptedAmount,      VL,     43)
+TYPED_SFIELD(sfAuditorEncryptionKey,        VL,     44)
+TYPED_SFIELD(sfAmountCommitment,            VL,     45)
+TYPED_SFIELD(sfBalanceCommitment,           VL,     46)
 
 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)
diff --git a/include/xrpl/protocol/detail/transactions.macro b/include/xrpl/protocol/detail/transactions.macro
index dbaaf46083..8a3b0ff2ce 100644
--- a/include/xrpl/protocol/detail/transactions.macro
+++ b/include/xrpl/protocol/detail/transactions.macro
@@ -735,6 +735,8 @@ TRANSACTION(ttMPTOKEN_ISSUANCE_SET, 56, MPTokenIssuanceSet,
     {sfMPTokenMetadata, SoeOptional},
     {sfTransferFee, SoeOptional},
     {sfMutableFlags, SoeOptional},
+    {sfIssuerEncryptionKey, SoeOptional},
+    {sfAuditorEncryptionKey, SoeOptional},
 }))
 
 /** This transaction type authorizes a MPToken instance */
@@ -1077,6 +1079,91 @@ TRANSACTION(ttLOAN_PAY, 84, LoanPay,
     {sfAmount, SoeRequired, SoeMptSupported},
 }))
 
+/** This transaction type converts into confidential MPT balance. */
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/token/ConfidentialMPTConvert.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_MPT_CONVERT, 85, ConfidentialMPTConvert,
+    Delegation::Delegable,
+    featureConfidentialTransfer,
+    NoPriv,
+    ({
+    {sfMPTokenIssuanceID, SoeRequired},
+    {sfMPTAmount, SoeRequired},
+    {sfHolderEncryptionKey, SoeOptional},
+    {sfHolderEncryptedAmount, SoeRequired},
+    {sfIssuerEncryptedAmount, SoeRequired},
+    {sfAuditorEncryptedAmount, SoeOptional},
+    {sfBlindingFactor, SoeRequired},
+    {sfZKProof, SoeOptional},
+}))
+
+/** This transaction type merges MPT inbox. */
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_MPT_MERGE_INBOX, 86, ConfidentialMPTMergeInbox,
+    Delegation::Delegable,
+    featureConfidentialTransfer,
+    NoPriv,
+    ({
+    {sfMPTokenIssuanceID, SoeRequired},
+}))
+
+/** This transaction type converts back into public MPT balance. */
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_MPT_CONVERT_BACK, 87, ConfidentialMPTConvertBack,
+    Delegation::Delegable,
+    featureConfidentialTransfer,
+    NoPriv,
+    ({
+    {sfMPTokenIssuanceID, SoeRequired},
+    {sfMPTAmount, SoeRequired},
+    {sfHolderEncryptedAmount, SoeRequired},
+    {sfIssuerEncryptedAmount, SoeRequired},
+    {sfAuditorEncryptedAmount, SoeOptional},
+    {sfBlindingFactor, SoeRequired},
+    {sfZKProof, SoeRequired},
+    {sfBalanceCommitment, SoeRequired},
+}))
+
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/token/ConfidentialMPTSend.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_MPT_SEND, 88, ConfidentialMPTSend,
+    Delegation::Delegable,
+    featureConfidentialTransfer,
+    NoPriv,
+    ({
+    {sfMPTokenIssuanceID, SoeRequired},
+    {sfDestination, SoeRequired},
+    {sfDestinationTag, SoeOptional},
+    {sfSenderEncryptedAmount, SoeRequired},
+    {sfDestinationEncryptedAmount, SoeRequired},
+    {sfIssuerEncryptedAmount, SoeRequired},
+    {sfAuditorEncryptedAmount, SoeOptional},
+    {sfZKProof, SoeRequired},
+    {sfAmountCommitment, SoeRequired},
+    {sfBalanceCommitment, SoeRequired},
+    {sfCredentialIDs, SoeOptional},
+}))
+
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/token/ConfidentialMPTClawback.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_MPT_CLAWBACK, 89, ConfidentialMPTClawback,
+    Delegation::Delegable,
+    featureConfidentialTransfer,
+    NoPriv,
+    ({
+    {sfMPTokenIssuanceID, SoeRequired},
+    {sfHolder, SoeRequired},
+    {sfMPTAmount, SoeRequired},
+    {sfZKProof, SoeRequired},
+}))
+
 /** This system-generated transaction type is used to update the status of the various amendments.
 
     For details, see: https://xrpl.org/amendments.html
diff --git a/include/xrpl/protocol/jss.h b/include/xrpl/protocol/jss.h
index 8a2a112542..191ed385f3 100644
--- a/include/xrpl/protocol/jss.h
+++ b/include/xrpl/protocol/jss.h
@@ -137,6 +137,7 @@ JSS(authorized_credentials);      // in: ledger_entry DepositPreauth
 JSS(auth_accounts);               // out: amm_info
 JSS(auth_change);                 // out: AccountInfo
 JSS(auth_change_queued);          // out: AccountInfo
+JSS(auditor_encrypted_balance);   // out: mpt_holders (confidential MPT)
 JSS(available);                   // out: ValidatorList
 JSS(avg_bps_recv);                // out: Peers
 JSS(avg_bps_sent);                // out: Peers
@@ -161,9 +162,6 @@ JSS(build_path);                  // in: TransactionSign
 JSS(build_version);               // out: NetworkOPs
 JSS(cancel_after);                // out: AccountChannels
 JSS(can_delete);                  // out: CanDelete
-JSS(mpt_amount);                  // out: mpt_holders
-JSS(mpt_issuance_id);             // in: Payment, mpt_holders
-JSS(mptoken_index);               // out: mpt_holders
 JSS(changes);                     // out: BookChanges
 JSS(channel_id);                  // out: AccountChannels
 JSS(channels);                    // out: AccountChannels
@@ -185,165 +183,170 @@ JSS(command);                     // in: RPCHandler
 JSS(common);                      // out: RPC server_definitions
 JSS(complete);                    // out: NetworkOPs, InboundLedger
 JSS(complete_ledgers);            // out: NetworkOPs, PeerImp
-JSS(consensus);                   // out: NetworkOPs, LedgerConsensus
-JSS(converge_time);               // out: NetworkOPs
-JSS(converge_time_s);             // out: NetworkOPs
-JSS(cookie);                      // out: NetworkOPs
-JSS(count);                       // in: AccountTx*, ValidatorList
-JSS(counters);                    // in/out: retrieve counters
-JSS(credentials);                 // in: deposit_authorized
-JSS(credential_type);             // in: LedgerEntry DepositPreauth
-JSS(ctid);                        // in/out: Tx RPC
-JSS(currency_a);                  // out: BookChanges
-JSS(currency_b);                  // out: BookChanges
-JSS(currency);                    // in: paths/PathRequest, STAmount
-                                  // out: STPathSet, STAmount, AccountLines
-JSS(current);                     // out: OwnerInfo
-JSS(current_activities);          //
-JSS(current_ledger_size);         // out: TxQ
-JSS(current_queue_size);          // out: TxQ
-JSS(data);                        // out: LedgerData
-JSS(date);                        // out: tx/Transaction, NetworkOPs
-JSS(dbKBLedger);                  // out: getCounts
-JSS(dbKBTotal);                   // out: getCounts
-JSS(dbKBTransaction);             // out: getCounts
-JSS(debug_signing);               // in: TransactionSign
-JSS(deletion_blockers_only);      // in: AccountObjects
-JSS(delivered_amount);            // out: insertDeliveredAmount
-JSS(deposit_authorized);          // out: deposit_authorized
-JSS(deprecated);                  //
-JSS(descending);                  // in: AccountTx*
-JSS(description);                 // in/out: Reservations
-JSS(destination);                 // in: nft_buy_offers, nft_sell_offers
-JSS(destination_account);         // in: PathRequest, RipplePathFind, account_lines
-                                  // out: AccountChannels
-JSS(destination_amount);          // in: PathRequest, RipplePathFind
-JSS(destination_currencies);      // in: PathRequest, RipplePathFind
-JSS(destination_tag);             // in: PathRequest
-                                  // out: AccountChannels
-JSS(details);                     // out: Manifest, server_info
-JSS(dir_entry);                   // out: DirectoryEntryIterator
-JSS(dir_index);                   // out: DirectoryEntryIterator
-JSS(dir_root);                    // out: DirectoryEntryIterator
-JSS(discounted_fee);              // out: amm_info
-JSS(domain);                      // out: ValidatorInfo, Manifest
-JSS(drops);                       // out: TxQ
-JSS(duration_us);                 // out: NetworkOPs
-JSS(effective);                   // out: ValidatorList
-                                  // in: UNL
-JSS(enabled);                     // out: AmendmentTable
-JSS(engine_result);               // out: NetworkOPs, TransactionSign, Submit
-JSS(engine_result_code);          // out: NetworkOPs, TransactionSign, Submit
-JSS(engine_result_message);       // out: NetworkOPs, TransactionSign, Submit
-JSS(entire_set);                  // out: get_aggregate_price
-JSS(ephemeral_key);               // out: ValidatorInfo
-                                  // in/out: Manifest
-JSS(error);                       // out: error
-JSS(errored);                     //
-JSS(error_code);                  // out: error
-JSS(error_exception);             // out: Submit
-JSS(error_message);               // out: error
-JSS(expand);                      // in: handler/Ledger
-JSS(expected_date);               // out: any (warnings)
-JSS(expected_date_UTC);           // out: any (warnings)
-JSS(expected_ledger_size);        // out: TxQ
-JSS(expiration);                  // out: AccountOffers, AccountChannels, ValidatorList, amm_info
-JSS(fail_hard);                   // in: Sign, Submit
-JSS(failed);                      // out: InboundLedger
-JSS(feature);                     // in: Feature
-JSS(features);                    // out: Feature
-JSS(fee_base);                    // out: NetworkOPs
-JSS(fee_div_max);                 // in: TransactionSign
-JSS(fee_level);                   // out: AccountInfo
-JSS(fee_mult_max);                // in: TransactionSign
-JSS(fee_ref);                     // out: NetworkOPs, DEPRECATED
-JSS(fetch_pack);                  // out: NetworkOPs
-JSS(FIELDS);                      // out: RPC server_definitions
-                                  // matches definitions.json format
-JSS(first);                       // out: rpc/Version
-JSS(finished);                    //
-JSS(fix_txns);                    // in: LedgerCleaner
-JSS(flags);                       // out: AccountOffers, NetworkOPs
-JSS(forward);                     // in: AccountTx
-JSS(freeze);                      // out: AccountLines
-JSS(freeze_peer);                 // out: AccountLines
-JSS(deep_freeze);                 // out: AccountLines
-JSS(deep_freeze_peer);            // out: AccountLines
-JSS(frozen_balances);             // out: GatewayBalances
-JSS(full);                        // in: LedgerClearer, handlers/Ledger
-JSS(full_reply);                  // out: PathFind
-JSS(fullbelow_size);              // out: GetCounts
-JSS(git);                         // out: server_info
-JSS(good);                        // out: RPCVersion
-JSS(hash);                        // out: NetworkOPs, InboundLedger, LedgerToJson, STTx; field
-JSS(have_header);                 // out: InboundLedger
-JSS(have_state);                  // out: InboundLedger
-JSS(have_transactions);           // out: InboundLedger
-JSS(high);                        // out: BookChanges
-JSS(highest_sequence);            // out: AccountInfo
-JSS(highest_ticket);              // out: AccountInfo
-JSS(historical_perminute);        // historical_perminute.
-JSS(holders);                     // out: MPTHolders
-JSS(hostid);                      // out: NetworkOPs
-JSS(hotwallet);                   // in: GatewayBalances
-JSS(id);                          // websocket.
-JSS(ident);                       // in: AccountCurrencies, AccountInfo, OwnerInfo
-JSS(ignore_default);              // in: AccountLines
-JSS(in);                          // out: OverlayImpl
-JSS(inLedger);                    // out: tx/Transaction
-JSS(inbound);                     // out: PeerImp
-JSS(index);                       // in: LedgerEntry
-                                  // out: STLedgerEntry, LedgerEntry, TxHistory, LedgerData
-JSS(info);                        // out: ServerInfo, ConsensusInfo, FetchInfo
-JSS(initial_sync_duration_us);    //
-JSS(internal_command);            // in: Internal
-JSS(invalid_API_version);         // out: Many, when a request has an invalid version
-JSS(io_latency_ms);               // out: NetworkOPs
-JSS(ip);                          // in: Connect, out: OverlayImpl
-JSS(is_burned);                   // out: nft_info (clio)
-JSS(isSerialized);                // out: RPC server_definitions
-                                  // matches definitions.json format
-JSS(isSigningField);              // out: RPC server_definitions
-                                  // matches definitions.json format
-JSS(isVLEncoded);                 // out: RPC server_definitions
-                                  // matches definitions.json format
-JSS(issuer);                      // in: RipplePathFind, Subscribe, Unsubscribe, BookOffers
-                                  // out: STPathSet, STAmount
-JSS(job);                         //
-JSS(job_queue);                   //
-JSS(jobs);                        //
-JSS(jsonrpc);                     // json version
-JSS(jq_trans_overflow);           // JobQueue transaction limit overflow.
-JSS(kept);                        // out: SubmitTransaction
-JSS(key);                         // out
-JSS(key_type);                    // in/out: WalletPropose, TransactionSign
-JSS(latency);                     // out: PeerImp
-JSS(last);                        // out: RPCVersion
-JSS(last_close);                  // out: NetworkOPs
-JSS(last_refresh_time);           // out: ValidatorSite
-JSS(last_refresh_status);         // out: ValidatorSite
-JSS(last_refresh_message);        // out: ValidatorSite
-JSS(ledger);                      // in: NetworkOPs, LedgerCleaner, RPCHelpers
-                                  // out: NetworkOPs, PeerImp
-JSS(ledger_current_index);        // out: NetworkOPs, RPCHelpers, LedgerCurrent, LedgerAccept,
-                                  //      AccountLines
-JSS(ledger_data);                 // out: LedgerHeader
-JSS(ledger_hash);                 // in: RPCHelpers, LedgerRequest, RipplePathFind,
-                                  //     TransactionEntry, handlers/Ledger
-                                  // out: NetworkOPs, RPCHelpers, LedgerClosed, LedgerData,
-                                  //      AccountLines
-JSS(ledger_hit_rate);             // out: GetCounts
-JSS(ledger_index);                // in/out: many
-JSS(ledger_index_max);            // in, out: AccountTx*
-JSS(ledger_index_min);            // in, out: AccountTx*
-JSS(ledger_max);                  // in, out: AccountTx*
-JSS(ledger_min);                  // in, out: AccountTx*
-JSS(ledger_time);                 // out: NetworkOPs
-JSS(LEDGER_ENTRY_TYPES);          // out: RPC server_definitions
-                                  // matches definitions.json format
-JSS(LEDGER_ENTRY_FLAGS);          // out: RPC server_definitions
-JSS(LEDGER_ENTRY_FORMATS);        // out: RPC server_definitions
-JSS(levels);                      // LogLevels
+JSS(confidential_balance_inbox);  // out: mpt_holders (confidential MPT)
+JSS(confidential_balance_spending);  // out: mpt_holders (confidential MPT)
+JSS(confidential_balance_version);   // out: mpt_holders (confidential MPT)
+JSS(consensus);                      // out: NetworkOPs, LedgerConsensus
+JSS(converge_time);                  // out: NetworkOPs
+JSS(converge_time_s);                // out: NetworkOPs
+JSS(cookie);                         // out: NetworkOPs
+JSS(count);                          // in: AccountTx*, ValidatorList
+JSS(counters);                       // in/out: retrieve counters
+JSS(credentials);                    // in: deposit_authorized
+JSS(credential_type);                // in: LedgerEntry DepositPreauth
+JSS(ctid);                           // in/out: Tx RPC
+JSS(currency_a);                     // out: BookChanges
+JSS(currency_b);                     // out: BookChanges
+JSS(currency);                       // in: paths/PathRequest, STAmount
+                                     // out: STPathSet, STAmount, AccountLines
+JSS(current);                        // out: OwnerInfo
+JSS(current_activities);             //
+JSS(current_ledger_size);            // out: TxQ
+JSS(current_queue_size);             // out: TxQ
+JSS(data);                           // out: LedgerData
+JSS(date);                           // out: tx/Transaction, NetworkOPs
+JSS(dbKBLedger);                     // out: getCounts
+JSS(dbKBTotal);                      // out: getCounts
+JSS(dbKBTransaction);                // out: getCounts
+JSS(debug_signing);                  // in: TransactionSign
+JSS(deletion_blockers_only);         // in: AccountObjects
+JSS(delivered_amount);               // out: insertDeliveredAmount
+JSS(deposit_authorized);             // out: deposit_authorized
+JSS(deprecated);                     //
+JSS(descending);                     // in: AccountTx*
+JSS(description);                    // in/out: Reservations
+JSS(destination);                    // in: nft_buy_offers, nft_sell_offers
+JSS(destination_account);            // in: PathRequest, RipplePathFind, account_lines
+                                     // out: AccountChannels
+JSS(destination_amount);             // in: PathRequest, RipplePathFind
+JSS(destination_currencies);         // in: PathRequest, RipplePathFind
+JSS(destination_tag);                // in: PathRequest
+                                     // out: AccountChannels
+JSS(details);                        // out: Manifest, server_info
+JSS(dir_entry);                      // out: DirectoryEntryIterator
+JSS(dir_index);                      // out: DirectoryEntryIterator
+JSS(dir_root);                       // out: DirectoryEntryIterator
+JSS(discounted_fee);                 // out: amm_info
+JSS(domain);                         // out: ValidatorInfo, Manifest
+JSS(drops);                          // out: TxQ
+JSS(duration_us);                    // out: NetworkOPs
+JSS(effective);                      // out: ValidatorList
+                                     // in: UNL
+JSS(enabled);                        // out: AmendmentTable
+JSS(engine_result);                  // out: NetworkOPs, TransactionSign, Submit
+JSS(engine_result_code);             // out: NetworkOPs, TransactionSign, Submit
+JSS(engine_result_message);          // out: NetworkOPs, TransactionSign, Submit
+JSS(entire_set);                     // out: get_aggregate_price
+JSS(ephemeral_key);                  // out: ValidatorInfo
+                                     // in/out: Manifest
+JSS(error);                          // out: error
+JSS(errored);                        //
+JSS(error_code);                     // out: error
+JSS(error_exception);                // out: Submit
+JSS(error_message);                  // out: error
+JSS(expand);                         // in: handler/Ledger
+JSS(expected_date);                  // out: any (warnings)
+JSS(expected_date_UTC);              // out: any (warnings)
+JSS(expected_ledger_size);           // out: TxQ
+JSS(expiration);                     // out: AccountOffers, AccountChannels, ValidatorList, amm_info
+JSS(fail_hard);                      // in: Sign, Submit
+JSS(failed);                         // out: InboundLedger
+JSS(feature);                        // in: Feature
+JSS(features);                       // out: Feature
+JSS(fee_base);                       // out: NetworkOPs
+JSS(fee_div_max);                    // in: TransactionSign
+JSS(fee_level);                      // out: AccountInfo
+JSS(fee_mult_max);                   // in: TransactionSign
+JSS(fee_ref);                        // out: NetworkOPs, DEPRECATED
+JSS(fetch_pack);                     // out: NetworkOPs
+JSS(FIELDS);                         // out: RPC server_definitions
+                                     // matches definitions.json format
+JSS(first);                          // out: rpc/Version
+JSS(finished);                       //
+JSS(fix_txns);                       // in: LedgerCleaner
+JSS(flags);                          // out: AccountOffers, NetworkOPs
+JSS(forward);                        // in: AccountTx
+JSS(freeze);                         // out: AccountLines
+JSS(freeze_peer);                    // out: AccountLines
+JSS(deep_freeze);                    // out: AccountLines
+JSS(deep_freeze_peer);               // out: AccountLines
+JSS(frozen_balances);                // out: GatewayBalances
+JSS(full);                           // in: LedgerClearer, handlers/Ledger
+JSS(full_reply);                     // out: PathFind
+JSS(fullbelow_size);                 // out: GetCounts
+JSS(git);                            // out: server_info
+JSS(good);                           // out: RPCVersion
+JSS(hash);                           // out: NetworkOPs, InboundLedger, LedgerToJson, STTx; field
+JSS(have_header);                    // out: InboundLedger
+JSS(have_state);                     // out: InboundLedger
+JSS(have_transactions);              // out: InboundLedger
+JSS(high);                           // out: BookChanges
+JSS(highest_sequence);               // out: AccountInfo
+JSS(highest_ticket);                 // out: AccountInfo
+JSS(historical_perminute);           // historical_perminute.
+JSS(holders);                        // out: MPTHolders
+JSS(holder_encryption_key);          // out: mpt_holders (confidential MPT)
+JSS(hostid);                         // out: NetworkOPs
+JSS(hotwallet);                      // in: GatewayBalances
+JSS(id);                             // websocket.
+JSS(ident);                          // in: AccountCurrencies, AccountInfo, OwnerInfo
+JSS(ignore_default);                 // in: AccountLines
+JSS(in);                             // out: OverlayImpl
+JSS(inLedger);                       // out: tx/Transaction
+JSS(inbound);                        // out: PeerImp
+JSS(index);                          // in: LedgerEntry
+                                     // out: STLedgerEntry, LedgerEntry, TxHistory, LedgerData
+JSS(info);                           // out: ServerInfo, ConsensusInfo, FetchInfo
+JSS(initial_sync_duration_us);       //
+JSS(internal_command);               // in: Internal
+JSS(invalid_API_version);            // out: Many, when a request has an invalid version
+JSS(io_latency_ms);                  // out: NetworkOPs
+JSS(ip);                             // in: Connect, out: OverlayImpl
+JSS(is_burned);                      // out: nft_info (clio)
+JSS(isSerialized);                   // out: RPC server_definitions
+                                     // matches definitions.json format
+JSS(isSigningField);                 // out: RPC server_definitions
+                                     // matches definitions.json format
+JSS(isVLEncoded);                    // out: RPC server_definitions
+                                     // matches definitions.json format
+JSS(issuer);                         // in: RipplePathFind, Subscribe, Unsubscribe, BookOffers
+                                     // out: STPathSet, STAmount
+JSS(issuer_encrypted_balance);       // out: mpt_holders (confidential MPT)
+JSS(job);                            //
+JSS(job_queue);                      //
+JSS(jobs);                           //
+JSS(jsonrpc);                        // json version
+JSS(jq_trans_overflow);              // JobQueue transaction limit overflow.
+JSS(kept);                           // out: SubmitTransaction
+JSS(key);                            // out
+JSS(key_type);                       // in/out: WalletPropose, TransactionSign
+JSS(latency);                        // out: PeerImp
+JSS(last);                           // out: RPCVersion
+JSS(last_close);                     // out: NetworkOPs
+JSS(last_refresh_time);              // out: ValidatorSite
+JSS(last_refresh_status);            // out: ValidatorSite
+JSS(last_refresh_message);           // out: ValidatorSite
+JSS(ledger);                         // in: NetworkOPs, LedgerCleaner, RPCHelpers
+                                     // out: NetworkOPs, PeerImp
+JSS(ledger_current_index);           // out: NetworkOPs, RPCHelpers, LedgerCurrent, LedgerAccept,
+                                     //      AccountLines
+JSS(ledger_data);                    // out: LedgerHeader
+JSS(ledger_hash);                    // in: RPCHelpers, LedgerRequest, RipplePathFind,
+                                     //     TransactionEntry, handlers/Ledger
+                                     // out: NetworkOPs, RPCHelpers, LedgerClosed, LedgerData,
+                                     //      AccountLines
+JSS(ledger_hit_rate);                // out: GetCounts
+JSS(ledger_index);                   // in/out: many
+JSS(ledger_index_max);               // in, out: AccountTx*
+JSS(ledger_index_min);               // in, out: AccountTx*
+JSS(ledger_max);                     // in, out: AccountTx*
+JSS(ledger_min);                     // in, out: AccountTx*
+JSS(ledger_time);                    // out: NetworkOPs
+JSS(LEDGER_ENTRY_TYPES);             // out: RPC server_definitions
+                                     // matches definitions.json format
+JSS(LEDGER_ENTRY_FLAGS);             // out: RPC server_definitions
+JSS(LEDGER_ENTRY_FORMATS);           // out: RPC server_definitions
+JSS(levels);                         // LogLevels
 JSS(limit);                       // in/out: AccountTx*, AccountOffers, AccountLines, AccountObjects
                                   // in: LedgerData, BookOffers
 JSS(limit_peer);                  // out: AccountLines
@@ -401,6 +404,9 @@ JSS(min_ledger);                  // in: LedgerCleaner
 JSS(minimum_fee);                 // out: TxQ
 JSS(minimum_level);               // out: TxQ
 JSS(missingCommand);              // error
+JSS(mpt_amount);                  // out: mpt_holders
+JSS(mpt_issuance_id);             // in: Payment, mpt_holders
+JSS(mptoken_index);               // out: mpt_holders
 JSS(mpt_issuance_id_a);           // out: BookChanges
 JSS(mpt_issuance_id_b);           // out: BookChanges
 JSS(name);                        // out: AmendmentTableImpl, PeerImp
diff --git a/include/xrpl/protocol_autogen/ledger_entries/MPToken.h b/include/xrpl/protocol_autogen/ledger_entries/MPToken.h
index 0d394020f7..379cfe53f5 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/MPToken.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/MPToken.h
@@ -147,6 +147,150 @@ public:
     {
         return this->sle_->at(sfPreviousTxnLgrSeq);
     }
+
+    /**
+     * @brief Get sfConfidentialBalanceInbox (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getConfidentialBalanceInbox() const
+    {
+        if (hasConfidentialBalanceInbox())
+            return this->sle_->at(sfConfidentialBalanceInbox);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfConfidentialBalanceInbox is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasConfidentialBalanceInbox() const
+    {
+        return this->sle_->isFieldPresent(sfConfidentialBalanceInbox);
+    }
+
+    /**
+     * @brief Get sfConfidentialBalanceSpending (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getConfidentialBalanceSpending() const
+    {
+        if (hasConfidentialBalanceSpending())
+            return this->sle_->at(sfConfidentialBalanceSpending);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfConfidentialBalanceSpending is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasConfidentialBalanceSpending() const
+    {
+        return this->sle_->isFieldPresent(sfConfidentialBalanceSpending);
+    }
+
+    /**
+     * @brief Get sfConfidentialBalanceVersion (SoeDefault)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getConfidentialBalanceVersion() const
+    {
+        if (hasConfidentialBalanceVersion())
+            return this->sle_->at(sfConfidentialBalanceVersion);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfConfidentialBalanceVersion is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasConfidentialBalanceVersion() const
+    {
+        return this->sle_->isFieldPresent(sfConfidentialBalanceVersion);
+    }
+
+    /**
+     * @brief Get sfIssuerEncryptedBalance (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getIssuerEncryptedBalance() const
+    {
+        if (hasIssuerEncryptedBalance())
+            return this->sle_->at(sfIssuerEncryptedBalance);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfIssuerEncryptedBalance is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasIssuerEncryptedBalance() const
+    {
+        return this->sle_->isFieldPresent(sfIssuerEncryptedBalance);
+    }
+
+    /**
+     * @brief Get sfAuditorEncryptedBalance (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getAuditorEncryptedBalance() const
+    {
+        if (hasAuditorEncryptedBalance())
+            return this->sle_->at(sfAuditorEncryptedBalance);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfAuditorEncryptedBalance is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasAuditorEncryptedBalance() const
+    {
+        return this->sle_->isFieldPresent(sfAuditorEncryptedBalance);
+    }
+
+    /**
+     * @brief Get sfHolderEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getHolderEncryptionKey() const
+    {
+        if (hasHolderEncryptionKey())
+            return this->sle_->at(sfHolderEncryptionKey);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfHolderEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasHolderEncryptionKey() const
+    {
+        return this->sle_->isFieldPresent(sfHolderEncryptionKey);
+    }
 };
 
 /**
@@ -270,6 +414,72 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfConfidentialBalanceInbox (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setConfidentialBalanceInbox(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfConfidentialBalanceInbox] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfConfidentialBalanceSpending (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setConfidentialBalanceSpending(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfConfidentialBalanceSpending] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfConfidentialBalanceVersion (SoeDefault)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setConfidentialBalanceVersion(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfConfidentialBalanceVersion] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfIssuerEncryptedBalance (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setIssuerEncryptedBalance(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfIssuerEncryptedBalance] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAuditorEncryptedBalance (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setAuditorEncryptedBalance(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfAuditorEncryptedBalance] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfHolderEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setHolderEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfHolderEncryptionKey] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the completed MPToken wrapper.
      * @param index The ledger entry index.
diff --git a/include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h b/include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h
index d493ac779c..b6c77093ac 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h
@@ -302,6 +302,78 @@ public:
     {
         return this->sle_->isFieldPresent(sfReferenceHolding);
     }
+
+    /**
+     * @brief Get sfIssuerEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getIssuerEncryptionKey() const
+    {
+        if (hasIssuerEncryptionKey())
+            return this->sle_->at(sfIssuerEncryptionKey);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfIssuerEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasIssuerEncryptionKey() const
+    {
+        return this->sle_->isFieldPresent(sfIssuerEncryptionKey);
+    }
+
+    /**
+     * @brief Get sfAuditorEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getAuditorEncryptionKey() const
+    {
+        if (hasAuditorEncryptionKey())
+            return this->sle_->at(sfAuditorEncryptionKey);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfAuditorEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasAuditorEncryptionKey() const
+    {
+        return this->sle_->isFieldPresent(sfAuditorEncryptionKey);
+    }
+
+    /**
+     * @brief Get sfConfidentialOutstandingAmount (SoeDefault)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT64::type::value_type>
+    getConfidentialOutstandingAmount() const
+    {
+        if (hasConfidentialOutstandingAmount())
+            return this->sle_->at(sfConfidentialOutstandingAmount);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfConfidentialOutstandingAmount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasConfidentialOutstandingAmount() const
+    {
+        return this->sle_->isFieldPresent(sfConfidentialOutstandingAmount);
+    }
 };
 
 /**
@@ -504,6 +576,39 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfIssuerEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceBuilder&
+    setIssuerEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfIssuerEncryptionKey] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAuditorEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceBuilder&
+    setAuditorEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfAuditorEncryptionKey] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfConfidentialOutstandingAmount (SoeDefault)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceBuilder&
+    setConfidentialOutstandingAmount(std::decay_t<typename SF_UINT64::type::value_type> const& value)
+    {
+        object_[sfConfidentialOutstandingAmount] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the completed MPTokenIssuance wrapper.
      * @param index The ledger entry index.
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h
new file mode 100644
index 0000000000..2b16590649
--- /dev/null
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h
@@ -0,0 +1,201 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/TransactionBase.h>
+#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::transactions {
+
+class ConfidentialMPTClawbackBuilder;
+
+/**
+ * @brief Transaction: ConfidentialMPTClawback
+ *
+ * Type: ttCONFIDENTIAL_MPT_CLAWBACK (89)
+ * Delegable: Delegation::Delegable
+ * Amendment: featureConfidentialTransfer
+ * Privileges: NoPriv
+ *
+ * Immutable wrapper around STTx providing type-safe field access.
+ * Use ConfidentialMPTClawbackBuilder to construct new transactions.
+ */
+class ConfidentialMPTClawback : public TransactionBase
+{
+public:
+    static constexpr xrpl::TxType txType = ttCONFIDENTIAL_MPT_CLAWBACK;
+
+    /**
+     * @brief Construct a ConfidentialMPTClawback transaction wrapper from an existing STTx object.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    explicit ConfidentialMPTClawback(std::shared_ptr<STTx const> tx)
+        : TransactionBase(std::move(tx))
+    {
+        // Verify transaction type
+        if (tx_->getTxnType() != txType)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTClawback");
+        }
+    }
+
+    // Transaction-specific field getters
+
+    /**
+     * @brief Get sfMPTokenIssuanceID (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT192::type::value_type
+    getMPTokenIssuanceID() const
+    {
+        return this->tx_->at(sfMPTokenIssuanceID);
+    }
+
+    /**
+     * @brief Get sfHolder (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_ACCOUNT::type::value_type
+    getHolder() const
+    {
+        return this->tx_->at(sfHolder);
+    }
+
+    /**
+     * @brief Get sfMPTAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT64::type::value_type
+    getMPTAmount() const
+    {
+        return this->tx_->at(sfMPTAmount);
+    }
+
+    /**
+     * @brief Get sfZKProof (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getZKProof() const
+    {
+        return this->tx_->at(sfZKProof);
+    }
+};
+
+/**
+ * @brief Builder for ConfidentialMPTClawback transactions.
+ *
+ * Provides a fluent interface for constructing transactions with method chaining.
+ * Uses STObject internally for flexible transaction construction.
+ * Inherits common field setters from TransactionBuilderBase.
+ */
+class ConfidentialMPTClawbackBuilder : public TransactionBuilderBase<ConfidentialMPTClawbackBuilder>
+{
+public:
+    /**
+     * @brief Construct a new ConfidentialMPTClawbackBuilder with required fields.
+     * @param account The account initiating the transaction.
+     * @param mPTokenIssuanceID The sfMPTokenIssuanceID field value.
+     * @param holder The sfHolder field value.
+     * @param mPTAmount The sfMPTAmount field value.
+     * @param zKProof The sfZKProof field value.
+     * @param sequence Optional sequence number for the transaction.
+     * @param fee Optional fee for the transaction.
+     */
+    ConfidentialMPTClawbackBuilder(SF_ACCOUNT::type::value_type account,
+                     std::decay_t<typename SF_UINT192::type::value_type> const& mPTokenIssuanceID,                     std::decay_t<typename SF_ACCOUNT::type::value_type> const& holder,                     std::decay_t<typename SF_UINT64::type::value_type> const& mPTAmount,                     std::decay_t<typename SF_VL::type::value_type> const& zKProof,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
+                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
+)
+        : TransactionBuilderBase<ConfidentialMPTClawbackBuilder>(ttCONFIDENTIAL_MPT_CLAWBACK, account, sequence, fee)
+    {
+        setMPTokenIssuanceID(mPTokenIssuanceID);
+        setHolder(holder);
+        setMPTAmount(mPTAmount);
+        setZKProof(zKProof);
+    }
+
+    /**
+     * @brief Construct a ConfidentialMPTClawbackBuilder from an existing STTx object.
+     * @param tx The existing transaction to copy from.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    ConfidentialMPTClawbackBuilder(std::shared_ptr<STTx const> tx)
+    {
+        if (tx->getTxnType() != ttCONFIDENTIAL_MPT_CLAWBACK)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTClawbackBuilder");
+        }
+        object_ = *tx;
+    }
+
+    /** @brief Transaction-specific field setters */
+
+    /**
+     * @brief Set sfMPTokenIssuanceID (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTClawbackBuilder&
+    setMPTokenIssuanceID(std::decay_t<typename SF_UINT192::type::value_type> const& value)
+    {
+        object_[sfMPTokenIssuanceID] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfHolder (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTClawbackBuilder&
+    setHolder(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfHolder] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfMPTAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTClawbackBuilder&
+    setMPTAmount(std::decay_t<typename SF_UINT64::type::value_type> const& value)
+    {
+        object_[sfMPTAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfZKProof (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTClawbackBuilder&
+    setZKProof(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfZKProof] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the ConfidentialMPTClawback wrapper.
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @return The constructed transaction wrapper.
+     */
+    ConfidentialMPTClawback
+    build(PublicKey const& publicKey, SecretKey const& secretKey)
+    {
+        sign(publicKey, secretKey);
+        return ConfidentialMPTClawback{std::make_shared<STTx>(std::move(object_))};
+    }
+};
+
+}  // namespace xrpl::transactions
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h
new file mode 100644
index 0000000000..f7a4cb601a
--- /dev/null
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h
@@ -0,0 +1,336 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/TransactionBase.h>
+#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::transactions {
+
+class ConfidentialMPTConvertBuilder;
+
+/**
+ * @brief Transaction: ConfidentialMPTConvert
+ *
+ * Type: ttCONFIDENTIAL_MPT_CONVERT (85)
+ * Delegable: Delegation::Delegable
+ * Amendment: featureConfidentialTransfer
+ * Privileges: NoPriv
+ *
+ * Immutable wrapper around STTx providing type-safe field access.
+ * Use ConfidentialMPTConvertBuilder to construct new transactions.
+ */
+class ConfidentialMPTConvert : public TransactionBase
+{
+public:
+    static constexpr xrpl::TxType txType = ttCONFIDENTIAL_MPT_CONVERT;
+
+    /**
+     * @brief Construct a ConfidentialMPTConvert transaction wrapper from an existing STTx object.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    explicit ConfidentialMPTConvert(std::shared_ptr<STTx const> tx)
+        : TransactionBase(std::move(tx))
+    {
+        // Verify transaction type
+        if (tx_->getTxnType() != txType)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTConvert");
+        }
+    }
+
+    // Transaction-specific field getters
+
+    /**
+     * @brief Get sfMPTokenIssuanceID (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT192::type::value_type
+    getMPTokenIssuanceID() const
+    {
+        return this->tx_->at(sfMPTokenIssuanceID);
+    }
+
+    /**
+     * @brief Get sfMPTAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT64::type::value_type
+    getMPTAmount() const
+    {
+        return this->tx_->at(sfMPTAmount);
+    }
+
+    /**
+     * @brief Get sfHolderEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getHolderEncryptionKey() const
+    {
+        if (hasHolderEncryptionKey())
+        {
+            return this->tx_->at(sfHolderEncryptionKey);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfHolderEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasHolderEncryptionKey() const
+    {
+        return this->tx_->isFieldPresent(sfHolderEncryptionKey);
+    }
+
+    /**
+     * @brief Get sfHolderEncryptedAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getHolderEncryptedAmount() const
+    {
+        return this->tx_->at(sfHolderEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfIssuerEncryptedAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getIssuerEncryptedAmount() const
+    {
+        return this->tx_->at(sfIssuerEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfAuditorEncryptedAmount (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getAuditorEncryptedAmount() const
+    {
+        if (hasAuditorEncryptedAmount())
+        {
+            return this->tx_->at(sfAuditorEncryptedAmount);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfAuditorEncryptedAmount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasAuditorEncryptedAmount() const
+    {
+        return this->tx_->isFieldPresent(sfAuditorEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfBlindingFactor (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT256::type::value_type
+    getBlindingFactor() const
+    {
+        return this->tx_->at(sfBlindingFactor);
+    }
+
+    /**
+     * @brief Get sfZKProof (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getZKProof() const
+    {
+        if (hasZKProof())
+        {
+            return this->tx_->at(sfZKProof);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfZKProof is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasZKProof() const
+    {
+        return this->tx_->isFieldPresent(sfZKProof);
+    }
+};
+
+/**
+ * @brief Builder for ConfidentialMPTConvert transactions.
+ *
+ * Provides a fluent interface for constructing transactions with method chaining.
+ * Uses STObject internally for flexible transaction construction.
+ * Inherits common field setters from TransactionBuilderBase.
+ */
+class ConfidentialMPTConvertBuilder : public TransactionBuilderBase<ConfidentialMPTConvertBuilder>
+{
+public:
+    /**
+     * @brief Construct a new ConfidentialMPTConvertBuilder with required fields.
+     * @param account The account initiating the transaction.
+     * @param mPTokenIssuanceID The sfMPTokenIssuanceID field value.
+     * @param mPTAmount The sfMPTAmount field value.
+     * @param holderEncryptedAmount The sfHolderEncryptedAmount field value.
+     * @param issuerEncryptedAmount The sfIssuerEncryptedAmount field value.
+     * @param blindingFactor The sfBlindingFactor field value.
+     * @param sequence Optional sequence number for the transaction.
+     * @param fee Optional fee for the transaction.
+     */
+    ConfidentialMPTConvertBuilder(SF_ACCOUNT::type::value_type account,
+                     std::decay_t<typename SF_UINT192::type::value_type> const& mPTokenIssuanceID,                     std::decay_t<typename SF_UINT64::type::value_type> const& mPTAmount,                     std::decay_t<typename SF_VL::type::value_type> const& holderEncryptedAmount,                     std::decay_t<typename SF_VL::type::value_type> const& issuerEncryptedAmount,                     std::decay_t<typename SF_UINT256::type::value_type> const& blindingFactor,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
+                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
+)
+        : TransactionBuilderBase<ConfidentialMPTConvertBuilder>(ttCONFIDENTIAL_MPT_CONVERT, account, sequence, fee)
+    {
+        setMPTokenIssuanceID(mPTokenIssuanceID);
+        setMPTAmount(mPTAmount);
+        setHolderEncryptedAmount(holderEncryptedAmount);
+        setIssuerEncryptedAmount(issuerEncryptedAmount);
+        setBlindingFactor(blindingFactor);
+    }
+
+    /**
+     * @brief Construct a ConfidentialMPTConvertBuilder from an existing STTx object.
+     * @param tx The existing transaction to copy from.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    ConfidentialMPTConvertBuilder(std::shared_ptr<STTx const> tx)
+    {
+        if (tx->getTxnType() != ttCONFIDENTIAL_MPT_CONVERT)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTConvertBuilder");
+        }
+        object_ = *tx;
+    }
+
+    /** @brief Transaction-specific field setters */
+
+    /**
+     * @brief Set sfMPTokenIssuanceID (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBuilder&
+    setMPTokenIssuanceID(std::decay_t<typename SF_UINT192::type::value_type> const& value)
+    {
+        object_[sfMPTokenIssuanceID] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfMPTAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBuilder&
+    setMPTAmount(std::decay_t<typename SF_UINT64::type::value_type> const& value)
+    {
+        object_[sfMPTAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfHolderEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBuilder&
+    setHolderEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfHolderEncryptionKey] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfHolderEncryptedAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBuilder&
+    setHolderEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfHolderEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfIssuerEncryptedAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBuilder&
+    setIssuerEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfIssuerEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAuditorEncryptedAmount (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBuilder&
+    setAuditorEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfAuditorEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfBlindingFactor (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBuilder&
+    setBlindingFactor(std::decay_t<typename SF_UINT256::type::value_type> const& value)
+    {
+        object_[sfBlindingFactor] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfZKProof (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBuilder&
+    setZKProof(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfZKProof] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the ConfidentialMPTConvert wrapper.
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @return The constructed transaction wrapper.
+     */
+    ConfidentialMPTConvert
+    build(PublicKey const& publicKey, SecretKey const& secretKey)
+    {
+        sign(publicKey, secretKey);
+        return ConfidentialMPTConvert{std::make_shared<STTx>(std::move(object_))};
+    }
+};
+
+}  // namespace xrpl::transactions
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h
new file mode 100644
index 0000000000..68bf326645
--- /dev/null
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h
@@ -0,0 +1,310 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/TransactionBase.h>
+#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::transactions {
+
+class ConfidentialMPTConvertBackBuilder;
+
+/**
+ * @brief Transaction: ConfidentialMPTConvertBack
+ *
+ * Type: ttCONFIDENTIAL_MPT_CONVERT_BACK (87)
+ * Delegable: Delegation::Delegable
+ * Amendment: featureConfidentialTransfer
+ * Privileges: NoPriv
+ *
+ * Immutable wrapper around STTx providing type-safe field access.
+ * Use ConfidentialMPTConvertBackBuilder to construct new transactions.
+ */
+class ConfidentialMPTConvertBack : public TransactionBase
+{
+public:
+    static constexpr xrpl::TxType txType = ttCONFIDENTIAL_MPT_CONVERT_BACK;
+
+    /**
+     * @brief Construct a ConfidentialMPTConvertBack transaction wrapper from an existing STTx object.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    explicit ConfidentialMPTConvertBack(std::shared_ptr<STTx const> tx)
+        : TransactionBase(std::move(tx))
+    {
+        // Verify transaction type
+        if (tx_->getTxnType() != txType)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTConvertBack");
+        }
+    }
+
+    // Transaction-specific field getters
+
+    /**
+     * @brief Get sfMPTokenIssuanceID (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT192::type::value_type
+    getMPTokenIssuanceID() const
+    {
+        return this->tx_->at(sfMPTokenIssuanceID);
+    }
+
+    /**
+     * @brief Get sfMPTAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT64::type::value_type
+    getMPTAmount() const
+    {
+        return this->tx_->at(sfMPTAmount);
+    }
+
+    /**
+     * @brief Get sfHolderEncryptedAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getHolderEncryptedAmount() const
+    {
+        return this->tx_->at(sfHolderEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfIssuerEncryptedAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getIssuerEncryptedAmount() const
+    {
+        return this->tx_->at(sfIssuerEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfAuditorEncryptedAmount (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getAuditorEncryptedAmount() const
+    {
+        if (hasAuditorEncryptedAmount())
+        {
+            return this->tx_->at(sfAuditorEncryptedAmount);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfAuditorEncryptedAmount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasAuditorEncryptedAmount() const
+    {
+        return this->tx_->isFieldPresent(sfAuditorEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfBlindingFactor (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT256::type::value_type
+    getBlindingFactor() const
+    {
+        return this->tx_->at(sfBlindingFactor);
+    }
+
+    /**
+     * @brief Get sfZKProof (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getZKProof() const
+    {
+        return this->tx_->at(sfZKProof);
+    }
+
+    /**
+     * @brief Get sfBalanceCommitment (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getBalanceCommitment() const
+    {
+        return this->tx_->at(sfBalanceCommitment);
+    }
+};
+
+/**
+ * @brief Builder for ConfidentialMPTConvertBack transactions.
+ *
+ * Provides a fluent interface for constructing transactions with method chaining.
+ * Uses STObject internally for flexible transaction construction.
+ * Inherits common field setters from TransactionBuilderBase.
+ */
+class ConfidentialMPTConvertBackBuilder : public TransactionBuilderBase<ConfidentialMPTConvertBackBuilder>
+{
+public:
+    /**
+     * @brief Construct a new ConfidentialMPTConvertBackBuilder with required fields.
+     * @param account The account initiating the transaction.
+     * @param mPTokenIssuanceID The sfMPTokenIssuanceID field value.
+     * @param mPTAmount The sfMPTAmount field value.
+     * @param holderEncryptedAmount The sfHolderEncryptedAmount field value.
+     * @param issuerEncryptedAmount The sfIssuerEncryptedAmount field value.
+     * @param blindingFactor The sfBlindingFactor field value.
+     * @param zKProof The sfZKProof field value.
+     * @param balanceCommitment The sfBalanceCommitment field value.
+     * @param sequence Optional sequence number for the transaction.
+     * @param fee Optional fee for the transaction.
+     */
+    ConfidentialMPTConvertBackBuilder(SF_ACCOUNT::type::value_type account,
+                     std::decay_t<typename SF_UINT192::type::value_type> const& mPTokenIssuanceID,                     std::decay_t<typename SF_UINT64::type::value_type> const& mPTAmount,                     std::decay_t<typename SF_VL::type::value_type> const& holderEncryptedAmount,                     std::decay_t<typename SF_VL::type::value_type> const& issuerEncryptedAmount,                     std::decay_t<typename SF_UINT256::type::value_type> const& blindingFactor,                     std::decay_t<typename SF_VL::type::value_type> const& zKProof,                     std::decay_t<typename SF_VL::type::value_type> const& balanceCommitment,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
+                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
+)
+        : TransactionBuilderBase<ConfidentialMPTConvertBackBuilder>(ttCONFIDENTIAL_MPT_CONVERT_BACK, account, sequence, fee)
+    {
+        setMPTokenIssuanceID(mPTokenIssuanceID);
+        setMPTAmount(mPTAmount);
+        setHolderEncryptedAmount(holderEncryptedAmount);
+        setIssuerEncryptedAmount(issuerEncryptedAmount);
+        setBlindingFactor(blindingFactor);
+        setZKProof(zKProof);
+        setBalanceCommitment(balanceCommitment);
+    }
+
+    /**
+     * @brief Construct a ConfidentialMPTConvertBackBuilder from an existing STTx object.
+     * @param tx The existing transaction to copy from.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    ConfidentialMPTConvertBackBuilder(std::shared_ptr<STTx const> tx)
+    {
+        if (tx->getTxnType() != ttCONFIDENTIAL_MPT_CONVERT_BACK)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTConvertBackBuilder");
+        }
+        object_ = *tx;
+    }
+
+    /** @brief Transaction-specific field setters */
+
+    /**
+     * @brief Set sfMPTokenIssuanceID (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBackBuilder&
+    setMPTokenIssuanceID(std::decay_t<typename SF_UINT192::type::value_type> const& value)
+    {
+        object_[sfMPTokenIssuanceID] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfMPTAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBackBuilder&
+    setMPTAmount(std::decay_t<typename SF_UINT64::type::value_type> const& value)
+    {
+        object_[sfMPTAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfHolderEncryptedAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBackBuilder&
+    setHolderEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfHolderEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfIssuerEncryptedAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBackBuilder&
+    setIssuerEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfIssuerEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAuditorEncryptedAmount (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBackBuilder&
+    setAuditorEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfAuditorEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfBlindingFactor (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBackBuilder&
+    setBlindingFactor(std::decay_t<typename SF_UINT256::type::value_type> const& value)
+    {
+        object_[sfBlindingFactor] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfZKProof (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBackBuilder&
+    setZKProof(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfZKProof] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfBalanceCommitment (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTConvertBackBuilder&
+    setBalanceCommitment(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfBalanceCommitment] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the ConfidentialMPTConvertBack wrapper.
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @return The constructed transaction wrapper.
+     */
+    ConfidentialMPTConvertBack
+    build(PublicKey const& publicKey, SecretKey const& secretKey)
+    {
+        sign(publicKey, secretKey);
+        return ConfidentialMPTConvertBack{std::make_shared<STTx>(std::move(object_))};
+    }
+};
+
+}  // namespace xrpl::transactions
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h
new file mode 100644
index 0000000000..bb932080d8
--- /dev/null
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h
@@ -0,0 +1,129 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/TransactionBase.h>
+#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::transactions {
+
+class ConfidentialMPTMergeInboxBuilder;
+
+/**
+ * @brief Transaction: ConfidentialMPTMergeInbox
+ *
+ * Type: ttCONFIDENTIAL_MPT_MERGE_INBOX (86)
+ * Delegable: Delegation::Delegable
+ * Amendment: featureConfidentialTransfer
+ * Privileges: NoPriv
+ *
+ * Immutable wrapper around STTx providing type-safe field access.
+ * Use ConfidentialMPTMergeInboxBuilder to construct new transactions.
+ */
+class ConfidentialMPTMergeInbox : public TransactionBase
+{
+public:
+    static constexpr xrpl::TxType txType = ttCONFIDENTIAL_MPT_MERGE_INBOX;
+
+    /**
+     * @brief Construct a ConfidentialMPTMergeInbox transaction wrapper from an existing STTx object.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    explicit ConfidentialMPTMergeInbox(std::shared_ptr<STTx const> tx)
+        : TransactionBase(std::move(tx))
+    {
+        // Verify transaction type
+        if (tx_->getTxnType() != txType)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTMergeInbox");
+        }
+    }
+
+    // Transaction-specific field getters
+
+    /**
+     * @brief Get sfMPTokenIssuanceID (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT192::type::value_type
+    getMPTokenIssuanceID() const
+    {
+        return this->tx_->at(sfMPTokenIssuanceID);
+    }
+};
+
+/**
+ * @brief Builder for ConfidentialMPTMergeInbox transactions.
+ *
+ * Provides a fluent interface for constructing transactions with method chaining.
+ * Uses STObject internally for flexible transaction construction.
+ * Inherits common field setters from TransactionBuilderBase.
+ */
+class ConfidentialMPTMergeInboxBuilder : public TransactionBuilderBase<ConfidentialMPTMergeInboxBuilder>
+{
+public:
+    /**
+     * @brief Construct a new ConfidentialMPTMergeInboxBuilder with required fields.
+     * @param account The account initiating the transaction.
+     * @param mPTokenIssuanceID The sfMPTokenIssuanceID field value.
+     * @param sequence Optional sequence number for the transaction.
+     * @param fee Optional fee for the transaction.
+     */
+    ConfidentialMPTMergeInboxBuilder(SF_ACCOUNT::type::value_type account,
+                     std::decay_t<typename SF_UINT192::type::value_type> const& mPTokenIssuanceID,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
+                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
+)
+        : TransactionBuilderBase<ConfidentialMPTMergeInboxBuilder>(ttCONFIDENTIAL_MPT_MERGE_INBOX, account, sequence, fee)
+    {
+        setMPTokenIssuanceID(mPTokenIssuanceID);
+    }
+
+    /**
+     * @brief Construct a ConfidentialMPTMergeInboxBuilder from an existing STTx object.
+     * @param tx The existing transaction to copy from.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    ConfidentialMPTMergeInboxBuilder(std::shared_ptr<STTx const> tx)
+    {
+        if (tx->getTxnType() != ttCONFIDENTIAL_MPT_MERGE_INBOX)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTMergeInboxBuilder");
+        }
+        object_ = *tx;
+    }
+
+    /** @brief Transaction-specific field setters */
+
+    /**
+     * @brief Set sfMPTokenIssuanceID (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTMergeInboxBuilder&
+    setMPTokenIssuanceID(std::decay_t<typename SF_UINT192::type::value_type> const& value)
+    {
+        object_[sfMPTokenIssuanceID] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the ConfidentialMPTMergeInbox wrapper.
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @return The constructed transaction wrapper.
+     */
+    ConfidentialMPTMergeInbox
+    build(PublicKey const& publicKey, SecretKey const& secretKey)
+    {
+        sign(publicKey, secretKey);
+        return ConfidentialMPTMergeInbox{std::make_shared<STTx>(std::move(object_))};
+    }
+};
+
+}  // namespace xrpl::transactions
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h
new file mode 100644
index 0000000000..2d8a77d56f
--- /dev/null
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h
@@ -0,0 +1,408 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/TransactionBase.h>
+#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::transactions {
+
+class ConfidentialMPTSendBuilder;
+
+/**
+ * @brief Transaction: ConfidentialMPTSend
+ *
+ * Type: ttCONFIDENTIAL_MPT_SEND (88)
+ * Delegable: Delegation::Delegable
+ * Amendment: featureConfidentialTransfer
+ * Privileges: NoPriv
+ *
+ * Immutable wrapper around STTx providing type-safe field access.
+ * Use ConfidentialMPTSendBuilder to construct new transactions.
+ */
+class ConfidentialMPTSend : public TransactionBase
+{
+public:
+    static constexpr xrpl::TxType txType = ttCONFIDENTIAL_MPT_SEND;
+
+    /**
+     * @brief Construct a ConfidentialMPTSend transaction wrapper from an existing STTx object.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    explicit ConfidentialMPTSend(std::shared_ptr<STTx const> tx)
+        : TransactionBase(std::move(tx))
+    {
+        // Verify transaction type
+        if (tx_->getTxnType() != txType)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTSend");
+        }
+    }
+
+    // Transaction-specific field getters
+
+    /**
+     * @brief Get sfMPTokenIssuanceID (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT192::type::value_type
+    getMPTokenIssuanceID() const
+    {
+        return this->tx_->at(sfMPTokenIssuanceID);
+    }
+
+    /**
+     * @brief Get sfDestination (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_ACCOUNT::type::value_type
+    getDestination() const
+    {
+        return this->tx_->at(sfDestination);
+    }
+
+    /**
+     * @brief Get sfDestinationTag (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getDestinationTag() const
+    {
+        if (hasDestinationTag())
+        {
+            return this->tx_->at(sfDestinationTag);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfDestinationTag is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasDestinationTag() const
+    {
+        return this->tx_->isFieldPresent(sfDestinationTag);
+    }
+
+    /**
+     * @brief Get sfSenderEncryptedAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getSenderEncryptedAmount() const
+    {
+        return this->tx_->at(sfSenderEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfDestinationEncryptedAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getDestinationEncryptedAmount() const
+    {
+        return this->tx_->at(sfDestinationEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfIssuerEncryptedAmount (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getIssuerEncryptedAmount() const
+    {
+        return this->tx_->at(sfIssuerEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfAuditorEncryptedAmount (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getAuditorEncryptedAmount() const
+    {
+        if (hasAuditorEncryptedAmount())
+        {
+            return this->tx_->at(sfAuditorEncryptedAmount);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfAuditorEncryptedAmount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasAuditorEncryptedAmount() const
+    {
+        return this->tx_->isFieldPresent(sfAuditorEncryptedAmount);
+    }
+
+    /**
+     * @brief Get sfZKProof (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getZKProof() const
+    {
+        return this->tx_->at(sfZKProof);
+    }
+
+    /**
+     * @brief Get sfAmountCommitment (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getAmountCommitment() const
+    {
+        return this->tx_->at(sfAmountCommitment);
+    }
+
+    /**
+     * @brief Get sfBalanceCommitment (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_VL::type::value_type
+    getBalanceCommitment() const
+    {
+        return this->tx_->at(sfBalanceCommitment);
+    }
+
+    /**
+     * @brief Get sfCredentialIDs (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VECTOR256::type::value_type>
+    getCredentialIDs() const
+    {
+        if (hasCredentialIDs())
+        {
+            return this->tx_->at(sfCredentialIDs);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfCredentialIDs is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasCredentialIDs() const
+    {
+        return this->tx_->isFieldPresent(sfCredentialIDs);
+    }
+};
+
+/**
+ * @brief Builder for ConfidentialMPTSend transactions.
+ *
+ * Provides a fluent interface for constructing transactions with method chaining.
+ * Uses STObject internally for flexible transaction construction.
+ * Inherits common field setters from TransactionBuilderBase.
+ */
+class ConfidentialMPTSendBuilder : public TransactionBuilderBase<ConfidentialMPTSendBuilder>
+{
+public:
+    /**
+     * @brief Construct a new ConfidentialMPTSendBuilder with required fields.
+     * @param account The account initiating the transaction.
+     * @param mPTokenIssuanceID The sfMPTokenIssuanceID field value.
+     * @param destination The sfDestination field value.
+     * @param senderEncryptedAmount The sfSenderEncryptedAmount field value.
+     * @param destinationEncryptedAmount The sfDestinationEncryptedAmount field value.
+     * @param issuerEncryptedAmount The sfIssuerEncryptedAmount field value.
+     * @param zKProof The sfZKProof field value.
+     * @param amountCommitment The sfAmountCommitment field value.
+     * @param balanceCommitment The sfBalanceCommitment field value.
+     * @param sequence Optional sequence number for the transaction.
+     * @param fee Optional fee for the transaction.
+     */
+    ConfidentialMPTSendBuilder(SF_ACCOUNT::type::value_type account,
+                     std::decay_t<typename SF_UINT192::type::value_type> const& mPTokenIssuanceID,                     std::decay_t<typename SF_ACCOUNT::type::value_type> const& destination,                     std::decay_t<typename SF_VL::type::value_type> const& senderEncryptedAmount,                     std::decay_t<typename SF_VL::type::value_type> const& destinationEncryptedAmount,                     std::decay_t<typename SF_VL::type::value_type> const& issuerEncryptedAmount,                     std::decay_t<typename SF_VL::type::value_type> const& zKProof,                     std::decay_t<typename SF_VL::type::value_type> const& amountCommitment,                     std::decay_t<typename SF_VL::type::value_type> const& balanceCommitment,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
+                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
+)
+        : TransactionBuilderBase<ConfidentialMPTSendBuilder>(ttCONFIDENTIAL_MPT_SEND, account, sequence, fee)
+    {
+        setMPTokenIssuanceID(mPTokenIssuanceID);
+        setDestination(destination);
+        setSenderEncryptedAmount(senderEncryptedAmount);
+        setDestinationEncryptedAmount(destinationEncryptedAmount);
+        setIssuerEncryptedAmount(issuerEncryptedAmount);
+        setZKProof(zKProof);
+        setAmountCommitment(amountCommitment);
+        setBalanceCommitment(balanceCommitment);
+    }
+
+    /**
+     * @brief Construct a ConfidentialMPTSendBuilder from an existing STTx object.
+     * @param tx The existing transaction to copy from.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    ConfidentialMPTSendBuilder(std::shared_ptr<STTx const> tx)
+    {
+        if (tx->getTxnType() != ttCONFIDENTIAL_MPT_SEND)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTSendBuilder");
+        }
+        object_ = *tx;
+    }
+
+    /** @brief Transaction-specific field setters */
+
+    /**
+     * @brief Set sfMPTokenIssuanceID (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setMPTokenIssuanceID(std::decay_t<typename SF_UINT192::type::value_type> const& value)
+    {
+        object_[sfMPTokenIssuanceID] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfDestination (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setDestination(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfDestination] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfDestinationTag (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setDestinationTag(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfDestinationTag] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfSenderEncryptedAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setSenderEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfSenderEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfDestinationEncryptedAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setDestinationEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfDestinationEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfIssuerEncryptedAmount (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setIssuerEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfIssuerEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAuditorEncryptedAmount (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setAuditorEncryptedAmount(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfAuditorEncryptedAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfZKProof (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setZKProof(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfZKProof] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAmountCommitment (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setAmountCommitment(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfAmountCommitment] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfBalanceCommitment (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setBalanceCommitment(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfBalanceCommitment] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfCredentialIDs (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTSendBuilder&
+    setCredentialIDs(std::decay_t<typename SF_VECTOR256::type::value_type> const& value)
+    {
+        object_[sfCredentialIDs] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the ConfidentialMPTSend wrapper.
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @return The constructed transaction wrapper.
+     */
+    ConfidentialMPTSend
+    build(PublicKey const& publicKey, SecretKey const& secretKey)
+    {
+        sign(publicKey, secretKey);
+        return ConfidentialMPTSend{std::make_shared<STTx>(std::move(object_))};
+    }
+};
+
+}  // namespace xrpl::transactions
diff --git a/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h b/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h
index a92521173b..8099af1148 100644
--- a/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h
+++ b/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h
@@ -187,6 +187,58 @@ public:
     {
         return this->tx_->isFieldPresent(sfMutableFlags);
     }
+
+    /**
+     * @brief Get sfIssuerEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getIssuerEncryptionKey() const
+    {
+        if (hasIssuerEncryptionKey())
+        {
+            return this->tx_->at(sfIssuerEncryptionKey);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfIssuerEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasIssuerEncryptionKey() const
+    {
+        return this->tx_->isFieldPresent(sfIssuerEncryptionKey);
+    }
+
+    /**
+     * @brief Get sfAuditorEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getAuditorEncryptionKey() const
+    {
+        if (hasAuditorEncryptionKey())
+        {
+            return this->tx_->at(sfAuditorEncryptionKey);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfAuditorEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasAuditorEncryptionKey() const
+    {
+        return this->tx_->isFieldPresent(sfAuditorEncryptionKey);
+    }
 };
 
 /**
@@ -297,6 +349,28 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfIssuerEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceSetBuilder&
+    setIssuerEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfIssuerEncryptionKey] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAuditorEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceSetBuilder&
+    setAuditorEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfAuditorEncryptionKey] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the MPTokenIssuanceSet wrapper.
      * @param publicKey The public key for signing.
diff --git a/include/xrpl/tx/Transactor.h b/include/xrpl/tx/Transactor.h
index 470571eb48..02fedfe970 100644
--- a/include/xrpl/tx/Transactor.h
+++ b/include/xrpl/tx/Transactor.h
@@ -7,6 +7,7 @@
 #include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/applySteps.h>
 
+#include <cstdint>
 #include <tuple>
 #include <utility>
 
@@ -186,6 +187,10 @@ public:
     static XRPAmount
     calculateBaseFee(ReadView const& view, STTx const& tx);
 
+    // Returns the base fee plus extra base fee units, not scaled for load.
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx, std::uint32_t extraBaseFeeMultiplier);
+
     /* Do NOT define an invokePreflight function in a derived class.
        Instead, define:
 
diff --git a/include/xrpl/tx/invariants/InvariantCheck.h b/include/xrpl/tx/invariants/InvariantCheck.h
index 9378062726..8931d189fd 100644
--- a/include/xrpl/tx/invariants/InvariantCheck.h
+++ b/include/xrpl/tx/invariants/InvariantCheck.h
@@ -413,6 +413,7 @@ using InvariantChecks = std::tuple<
     ValidLoanBroker,
     ValidLoan,
     ValidVault,
+    ValidConfidentialMPToken,
     ValidMPTPayment,
     ValidAmounts,
     ValidMPTTransfer>;
diff --git a/include/xrpl/tx/invariants/MPTInvariant.h b/include/xrpl/tx/invariants/MPTInvariant.h
index b4b76a290f..aa90f1b8ef 100644
--- a/include/xrpl/tx/invariants/MPTInvariant.h
+++ b/include/xrpl/tx/invariants/MPTInvariant.h
@@ -36,17 +36,42 @@ class ValidMPTIssuance
     std::vector<std::shared_ptr<SLE const>> deletedHoldings_;
 
 public:
+    /**
+     * @brief Track MPT issuance and holding creations, deletions, and
+     * mutations.
+     *
+     * @param isDelete Whether the ledger entry is being deleted.
+     * @param before The ledger entry before transaction application.
+     * @param after The ledger entry after transaction application.
+     */
     void
-    visitEntry(bool, SLE::const_ref, SLE::const_ref);
+    visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after);
 
+    /**
+     * @brief Verify MPT issuance invariants after transaction application.
+     *
+     * @param tx The transaction being checked.
+     * @param result The transaction result code.
+     * @param fee The fee charged by the transaction.
+     * @param view The ledger view after transaction application.
+     * @param j Journal used for diagnostics.
+     * @return true if the invariant checks pass, otherwise false.
+     */
     [[nodiscard]] bool
-    finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&) const;
+    finalize(
+        STTx const& tx,
+        TER const result,
+        XRPAmount const fee,
+        ReadView const& view,
+        beast::Journal const& j) const;
 };
 
-/** Verify:
- *    - OutstandingAmount <= MaximumAmount for any MPT
- *    - OutstandingAmount after = OutstandingAmount before +
- *         sum (MPT after - MPT before) - this is total MPT credit/debit
+/**
+ * @brief Verify public MPT amount and outstanding amount accounting.
+ *
+ * Checks that OutstandingAmount does not exceed MaximumAmount and that
+ * OutstandingAmount after application equals OutstandingAmount before
+ * application plus the net holder balance delta.
  */
 class ValidMPTPayment
 {
@@ -64,11 +89,104 @@ class ValidMPTPayment
     hash_map<uint192, MPTData> data_;
 
 public:
+    /**
+     * @brief Track MPT amount and outstanding amount changes.
+     *
+     * @param isDelete Whether the ledger entry is being deleted.
+     * @param before The ledger entry before transaction application.
+     * @param after The ledger entry after transaction application.
+     */
     void
-    visitEntry(bool, SLE::const_ref, SLE::const_ref);
+    visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after);
 
+    /**
+     * @brief Verify public MPT payment accounting invariants.
+     *
+     * @param tx The transaction being checked.
+     * @param result The transaction result code.
+     * @param fee The fee charged by the transaction.
+     * @param view The ledger view after transaction application.
+     * @param j Journal used for diagnostics.
+     * @return true if the invariant checks pass, otherwise false.
+     */
     bool
-    finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&);
+    finalize(
+        STTx const& tx,
+        TER const result,
+        XRPAmount const fee,
+        ReadView const& view,
+        beast::Journal const& j);
+};
+
+/**
+ * @brief Invariants: Confidential MPToken consistency
+ *
+ * - Convert/ConvertBack symmetry:
+ * Regular MPToken balance change (±X) == COA (Confidential Outstanding Amount) change (∓X)
+ * - Cannot delete MPToken with non-zero confidential state:
+ * Cannot delete if sfIssuerEncryptedBalance exists
+ * Cannot delete if sfConfidentialBalanceInbox and sfConfidentialBalanceSpending exist
+ * - Privacy flag consistency:
+ * MPToken confidential balance fields can only be created or changed if
+ * lsfMPTCanHoldConfidentialBalance is set on the issuance.
+ * - Encrypted field existence consistency:
+ * If sfConfidentialBalanceSpending/sfConfidentialBalanceInbox exists, then
+ * sfIssuerEncryptedBalance must also exist (and vice versa). If
+ * sfAuditorEncryptedBalance exists, then those core encrypted balance fields
+ * must also exist.
+ * - COA <= OutstandingAmount:
+ * Confidential outstanding balance cannot exceed total outstanding.
+ * - Verifies sfConfidentialBalanceVersion is changed whenever sfConfidentialBalanceSpending is
+ * modified on an MPToken.
+ */
+class ValidConfidentialMPToken
+{
+    struct Changes
+    {
+        std::int64_t mptAmountDelta = 0;
+        std::int64_t coaDelta = 0;
+        std::int64_t outstandingDelta = 0;
+        SLE::const_pointer issuance;
+        bool deletedWithEncrypted = false;
+        bool badConsistency = false;
+        bool badCOA = false;
+        bool changesConfidentialFields = false;
+        bool badVersion = false;
+    };
+    std::map<uint192, Changes> changes_;
+
+public:
+    /**
+     * @brief Track confidential MPT balance, issuance, and version changes.
+     *
+     * @param isDelete Whether the ledger entry is being deleted.
+     * @param before The ledger entry before transaction application.
+     * @param after The ledger entry after transaction application.
+     */
+    void
+    visitEntry(
+        bool isDelete,
+        std::shared_ptr<SLE const> const& before,
+        std::shared_ptr<SLE const> const& after);
+
+    /**
+     * @brief Verify confidential MPT accounting and encrypted-field
+     * invariants.
+     *
+     * @param tx The transaction being checked.
+     * @param result The transaction result code.
+     * @param fee The fee charged by the transaction.
+     * @param view The ledger view after transaction application.
+     * @param j Journal used for diagnostics.
+     * @return true if the invariant checks pass, otherwise false.
+     */
+    bool
+    finalize(
+        STTx const& tx,
+        TER const result,
+        XRPAmount const fee,
+        ReadView const& view,
+        beast::Journal const& j);
 };
 
 class ValidMPTTransfer
@@ -85,11 +203,36 @@ class ValidMPTTransfer
     hash_map<uint256, bool> deletedAuthorized_;
 
 public:
+    /**
+     * @brief Track MPT balance changes and deleted authorization state.
+     *
+     * @param isDelete Whether the ledger entry is being deleted.
+     * @param before The ledger entry before transaction application.
+     * @param after The ledger entry after transaction application.
+     */
     void
-    visitEntry(bool, std::shared_ptr<SLE const> const&, std::shared_ptr<SLE const> const&);
+    visitEntry(
+        bool isDelete,
+        std::shared_ptr<SLE const> const& before,
+        std::shared_ptr<SLE const> const& after);
 
+    /**
+     * @brief Verify MPT transfer authorization invariants.
+     *
+     * @param tx The transaction being checked.
+     * @param result The transaction result code.
+     * @param fee The fee charged by the transaction.
+     * @param view The ledger view after transaction application.
+     * @param j Journal used for diagnostics.
+     * @return true if the invariant checks pass, otherwise false.
+     */
     bool
-    finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&);
+    finalize(
+        STTx const& tx,
+        TER const result,
+        XRPAmount const fee,
+        ReadView const& view,
+        beast::Journal const& j);
 
 private:
     /**
@@ -99,7 +242,13 @@ private:
      * finalize() runs, so their authorization state is captured during
      * visitEntry() and stored in deletedAuthorized_. For deleted MPTokens,
      * returns true if reqAuth is false or lsfMPTAuthorized was set at deletion.
-     * For existing MPTokens, returns the result of requireAuth()
+     * For existing MPTokens, returns the result of requireAuth().
+     *
+     * @param view The ledger view after transaction application.
+     * @param mptid The MPToken issuance ID.
+     * @param holder The holder account being checked.
+     * @param requireAuth Whether the issuance requires explicit authorization.
+     * @return true if the holder is authorized, otherwise false.
      */
     [[nodiscard]] bool
     isAuthorized(
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTClawback.h b/include/xrpl/tx/transactors/token/ConfidentialMPTClawback.h
new file mode 100644
index 0000000000..ff6f76e8ea
--- /dev/null
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTClawback.h
@@ -0,0 +1,59 @@
+#pragma once
+
+#include <xrpl/tx/Transactor.h>
+
+namespace xrpl {
+
+/**
+ * @brief Allows an MPT issuer to clawback confidential balances from a holder.
+ *
+ * This transaction enables the issuer of an MPToken Issuance (with clawback
+ * enabled) to reclaim confidential tokens from a holder's account. Unlike
+ * regular clawback, the issuer cannot see the holder's balance directly.
+ * Instead, the issuer must provide a zero-knowledge proof that demonstrates
+ * they know the exact encrypted balance amount.
+ *
+ * @par Cryptographic Operations:
+ * - **Equality Proof Verification**: Verifies that the issuer's revealed
+ *   amount matches the holder's encrypted balance using the issuer's
+ *   ElGamal private key.
+ *
+ * @see ConfidentialMPTSend, ConfidentialMPTConvert
+ */
+class ConfidentialMPTClawback : public Transactor
+{
+public:
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
+
+    explicit ConfidentialMPTClawback(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+
+    void
+    visitInvariantEntry(
+        bool isDelete,
+        std::shared_ptr<SLE const> const& before,
+        std::shared_ptr<SLE const> const& after) override;
+
+    [[nodiscard]] bool
+    finalizeInvariants(
+        STTx const& tx,
+        TER result,
+        XRPAmount fee,
+        ReadView const& view,
+        beast::Journal const& j) override;
+};
+
+}  // namespace xrpl
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTConvert.h b/include/xrpl/tx/transactors/token/ConfidentialMPTConvert.h
new file mode 100644
index 0000000000..2e2591844f
--- /dev/null
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTConvert.h
@@ -0,0 +1,61 @@
+#pragma once
+
+#include <xrpl/tx/Transactor.h>
+
+namespace xrpl {
+
+/**
+ * @brief Converts public (plaintext) MPT balance to confidential (encrypted)
+ * balance.
+ *
+ * This transaction allows a token holder to convert their publicly visible
+ * MPToken balance into an encrypted confidential balance. Once converted,
+ * the balance can only be spent using ConfidentialMPTSend transactions and
+ * remains hidden from public view on the ledger.
+ *
+ * @par Cryptographic Operations:
+ * - **Schnorr Proof Verification**: When registering a new ElGamal public key,
+ *   verifies proof of knowledge of the corresponding private key.
+ * - **Revealed Amount Verification**: Verifies that the provided encrypted
+ *   amounts (for holder, issuer, and optionally auditor) all encrypt the
+ *   same plaintext amount using the provided blinding factor.
+ *
+ * @see ConfidentialMPTConvertBack, ConfidentialMPTSend
+ */
+class ConfidentialMPTConvert : public Transactor
+{
+public:
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
+
+    explicit ConfidentialMPTConvert(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+
+    void
+    visitInvariantEntry(
+        bool isDelete,
+        std::shared_ptr<SLE const> const& before,
+        std::shared_ptr<SLE const> const& after) override;
+
+    [[nodiscard]] bool
+    finalizeInvariants(
+        STTx const& tx,
+        TER result,
+        XRPAmount fee,
+        ReadView const& view,
+        beast::Journal const& j) override;
+};
+
+}  // namespace xrpl
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h b/include/xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h
new file mode 100644
index 0000000000..cb4b6295a0
--- /dev/null
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h
@@ -0,0 +1,62 @@
+#pragma once
+
+#include <xrpl/tx/Transactor.h>
+
+namespace xrpl {
+
+/**
+ * @brief Converts confidential (encrypted) MPT balance back to public
+ * (plaintext) balance.
+ *
+ * This transaction allows a token holder to convert their encrypted
+ * confidential balance back into a publicly visible MPToken balance. The
+ * holder must prove they have sufficient confidential balance without
+ * revealing the actual balance amount.
+ *
+ * @par Cryptographic Operations:
+ * - **Revealed Amount Verification**: Verifies that the provided encrypted
+ *   amounts correctly encrypt the conversion amount.
+ * - **Pedersen Linkage Proof**: Verifies that the provided balance commitment
+ *   correctly links to the holder's encrypted spending balance.
+ * - **Bulletproof Range Proof**: Verifies that the remaining balance (after
+ *   conversion) is non-negative, ensuring the holder has sufficient funds.
+ *
+ * @see ConfidentialMPTConvert, ConfidentialMPTSend
+ */
+class ConfidentialMPTConvertBack : public Transactor
+{
+public:
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
+
+    explicit ConfidentialMPTConvertBack(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+
+    void
+    visitInvariantEntry(
+        bool isDelete,
+        std::shared_ptr<SLE const> const& before,
+        std::shared_ptr<SLE const> const& after) override;
+
+    [[nodiscard]] bool
+    finalizeInvariants(
+        STTx const& tx,
+        TER result,
+        XRPAmount fee,
+        ReadView const& view,
+        beast::Journal const& j) override;
+};
+
+}  // namespace xrpl
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h b/include/xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h
new file mode 100644
index 0000000000..585c273e12
--- /dev/null
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h
@@ -0,0 +1,63 @@
+#pragma once
+
+#include <xrpl/tx/Transactor.h>
+
+namespace xrpl {
+
+/**
+ * @brief Merges the confidential inbox balance into the spending balance.
+ *
+ * In the confidential transfer system, incoming funds are deposited into an
+ * "inbox" balance that the recipient cannot immediately spend. This prevents
+ * front-running attacks where an attacker could invalidate a pending
+ * transaction by sending funds to the sender. This transaction merges the
+ * inbox into the spending balance, making those funds available for spending.
+ *
+ * @par Cryptographic Operations:
+ * - **Homomorphic Addition**: Adds the encrypted inbox balance to the
+ *   encrypted spending balance using ElGamal homomorphic properties.
+ * - **Zero Encryption**: Resets the inbox to an encryption of zero.
+ *
+ * @note This transaction requires no zero-knowledge proofs because it only
+ *       combines encrypted values that the holder already owns. The
+ *       homomorphic properties of ElGamal encryption ensure correctness.
+ *
+ * @see ConfidentialMPTSend, ConfidentialMPTConvert
+ */
+class ConfidentialMPTMergeInbox : public Transactor
+{
+public:
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
+
+    explicit ConfidentialMPTMergeInbox(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+
+    void
+    visitInvariantEntry(
+        bool isDelete,
+        std::shared_ptr<SLE const> const& before,
+        std::shared_ptr<SLE const> const& after) override;
+
+    [[nodiscard]] bool
+    finalizeInvariants(
+        STTx const& tx,
+        TER result,
+        XRPAmount fee,
+        ReadView const& view,
+        beast::Journal const& j) override;
+};
+
+}  // namespace xrpl
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTSend.h b/include/xrpl/tx/transactors/token/ConfidentialMPTSend.h
new file mode 100644
index 0000000000..72599ab987
--- /dev/null
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTSend.h
@@ -0,0 +1,72 @@
+#pragma once
+
+#include <xrpl/tx/Transactor.h>
+
+namespace xrpl {
+
+/**
+ * @brief Transfers confidential MPT tokens between holders privately.
+ *
+ * This transaction enables private token transfers where the transfer amount
+ * is hidden from public view. Both sender and recipient must have initialized
+ * confidential balances. The transaction provides encrypted amounts for all
+ * parties (sender, destination, issuer, and optionally auditor) along with
+ * zero-knowledge proofs that verify correctness without revealing the amount.
+ *
+ * @par Cryptographic Operations:
+ * - **Multi-Ciphertext Equality Proof**: Verifies that all encrypted amounts
+ *   (sender, destination, issuer, auditor) encrypt the same plaintext value.
+ * - **Amount Pedersen Linkage Proof**: Verifies that the amount commitment
+ *   correctly links to the sender's encrypted amount.
+ * - **Balance Pedersen Linkage Proof**: Verifies that the balance commitment
+ *   correctly links to the sender's encrypted spending balance.
+ * - **Bulletproof Range Proof**: Verifies remaining balance and
+ *   transfer amount are non-negative.
+ *
+ * @note Funds are deposited into the destination's inbox, not spending
+ *       balance. The recipient must call ConfidentialMPTMergeInbox to make
+ *       received funds spendable.
+ *
+ * @see ConfidentialMPTMergeInbox, ConfidentialMPTConvert,
+ * ConfidentialMPTConvertBack
+ */
+class ConfidentialMPTSend : public Transactor
+{
+public:
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
+
+    explicit ConfidentialMPTSend(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static bool
+    checkExtraFeatures(PreflightContext const& ctx);
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+
+    void
+    visitInvariantEntry(
+        bool isDelete,
+        std::shared_ptr<SLE const> const& before,
+        std::shared_ptr<SLE const> const& after) override;
+
+    [[nodiscard]] bool
+    finalizeInvariants(
+        STTx const& tx,
+        TER result,
+        XRPAmount fee,
+        ReadView const& view,
+        beast::Journal const& j) override;
+};
+
+}  // namespace xrpl
diff --git a/src/libxrpl/ledger/helpers/CredentialHelpers.cpp b/src/libxrpl/ledger/helpers/CredentialHelpers.cpp
index ca5876f88a..6fc2faf03e 100644
--- a/src/libxrpl/ledger/helpers/CredentialHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/CredentialHelpers.cpp
@@ -346,9 +346,9 @@ verifyValidDomain(ApplyView& view, AccountID const& account, uint256 domainID, b
 }
 
 TER
-verifyDepositPreauth(
+checkDepositPreauth(
     STTx const& tx,
-    ApplyView& view,
+    ReadView const& view,
     AccountID const& src,
     AccountID const& dst,
     SLE::const_ref sleDst,
@@ -360,9 +360,27 @@ verifyDepositPreauth(
     //  2. If src is deposit preauthorized by dst (either by account or by
     //  credentials).
 
-    bool const credentialsPresent = tx.isFieldPresent(sfCredentialIDs);
+    if (sleDst && ((sleDst->getFlags() & lsfDepositAuth) != 0u))
+    {
+        if (src != dst)
+        {
+            if (!view.exists(keylet::depositPreauth(dst, src)))
+            {
+                return !tx.isFieldPresent(sfCredentialIDs)
+                    ? tecNO_PERMISSION
+                    : credentials::authorizedDepositPreauth(
+                          view, tx.getFieldV256(sfCredentialIDs), dst);
+            }
+        }
+    }
 
-    if (credentialsPresent)
+    return tesSUCCESS;
+}
+
+TER
+cleanupExpiredCredentials(STTx const& tx, ApplyView& view, beast::Journal j)
+{
+    if (tx.isFieldPresent(sfCredentialIDs))
     {
         auto const foundExpired =
             credentials::removeExpired(view, tx.getFieldV256(sfCredentialIDs), j);
@@ -372,20 +390,22 @@ verifyDepositPreauth(
             return tecEXPIRED;
     }
 
-    if (sleDst && sleDst->isFlag(lsfDepositAuth))
-    {
-        if (src != dst)
-        {
-            if (!view.exists(keylet::depositPreauth(dst, src)))
-            {
-                return !credentialsPresent ? tecNO_PERMISSION
-                                           : credentials::authorizedDepositPreauth(
-                                                 view, tx.getFieldV256(sfCredentialIDs), dst);
-            }
-        }
-    }
-
     return tesSUCCESS;
 }
 
+TER
+verifyDepositPreauth(
+    STTx const& tx,
+    ApplyView& view,
+    AccountID const& src,
+    AccountID const& dst,
+    SLE::const_ref sleDst,
+    beast::Journal j)
+{
+    if (auto const err = cleanupExpiredCredentials(tx, view, j); !isTesSuccess(err))
+        return err;
+
+    return checkDepositPreauth(tx, view, src, dst, sleDst, j);
+}
+
 }  // namespace xrpl
diff --git a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
index 2781902f5b..3c4e55a16e 100644
--- a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
@@ -290,6 +290,15 @@ removeEmptyHolding(
         (view.rules().enabled(fixCleanup3_1_3) && (*mptoken)[~sfLockedAmount].valueOr(0) != 0))
         return tecHAS_OBLIGATIONS;
 
+    // Don't delete if the token still has confidential balances
+    if (mptoken->isFieldPresent(sfConfidentialBalanceInbox) ||
+        mptoken->isFieldPresent(sfConfidentialBalanceSpending) ||
+        mptoken->isFieldPresent(sfIssuerEncryptedBalance) ||
+        mptoken->isFieldPresent(sfAuditorEncryptedBalance))
+    {
+        return tecHAS_OBLIGATIONS;
+    }
+
     return authorizeMPToken(
         view,
         {},  // priorBalance
diff --git a/src/libxrpl/ledger/helpers/TokenHelpers.cpp b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
index b9adfbd3e6..2ecde25754 100644
--- a/src/libxrpl/ledger/helpers/TokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
@@ -426,7 +426,8 @@ accountHolds(
         // Only if auth check is needed, as it needs to do an additional read
         // operation. Note featureSingleAssetVault will affect error codes.
         if (zeroIfUnauthorized == AuthHandling::ZeroIfUnauthorized &&
-            view.rules().enabled(featureSingleAssetVault))
+            (view.rules().enabled(featureSingleAssetVault) ||
+             view.rules().enabled(featureConfidentialTransfer)))
         {
             if (auto const err = requireAuth(view, mptIssue, account, AuthType::StrongAuth);
                 !isTesSuccess(err))
diff --git a/src/libxrpl/protocol/ConfidentialTransfer.cpp b/src/libxrpl/protocol/ConfidentialTransfer.cpp
new file mode 100644
index 0000000000..0baff1e33a
--- /dev/null
+++ b/src/libxrpl/protocol/ConfidentialTransfer.cpp
@@ -0,0 +1,487 @@
+#include <xrpl/protocol/ConfidentialTransfer.h>
+
+#include <xrpl/basics/Buffer.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <openssl/rand.h>
+#include <utility/mpt_utility.h>
+
+#include <mpt_protocol.h>
+#include <secp256k1.h>
+#include <secp256k1_mpt.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <optional>
+#include <stdexcept>
+#include <vector>
+
+namespace xrpl {
+namespace {
+
+account_id
+toAccountId(AccountID const& account)
+{
+    account_id res;
+    std::memcpy(res.bytes, account.data(), kMPT_ACCOUNT_ID_SIZE);
+    return res;
+}
+
+mpt_issuance_id
+toIssuanceId(uint192 const& issuance)
+{
+    mpt_issuance_id res;
+    std::memcpy(res.bytes, issuance.data(), kMPT_ISSUANCE_ID_SIZE);
+    return res;
+}
+
+/**
+ * @brief Pack a ConfidentialRecipient (public key + ElGamal ciphertext) into the
+ * secp256k1-mpt participant struct. Callers MUST have already validated that
+ * r.publicKey.size() == kEcPubKeyLength and
+ * r.encryptedAmount.size() == kEcGamalEncryptedTotalLength;
+ */
+mpt_confidential_participant
+toParticipant(ConfidentialRecipient const& r)
+{
+    mpt_confidential_participant p{};
+    std::memcpy(p.pubkey, r.publicKey.data(), kEcPubKeyLength);
+    std::memcpy(p.ciphertext, r.encryptedAmount.data(), kEcGamalEncryptedTotalLength);
+    return p;
+}
+
+}  // namespace
+
+uint256
+getSendContextHash(
+    AccountID const& account,
+    uint192 const& issuanceID,
+    std::uint32_t sequence,
+    AccountID const& destination,
+    std::uint32_t version)
+{
+    uint256 result;
+    mpt_get_send_context_hash(
+        toAccountId(account),
+        toIssuanceId(issuanceID),
+        sequence,
+        toAccountId(destination),
+        version,
+        result.data());
+    return result;
+}
+
+uint256
+getClawbackContextHash(
+    AccountID const& account,
+    uint192 const& issuanceID,
+    std::uint32_t sequence,
+    AccountID const& holder)
+{
+    uint256 result;
+    mpt_get_clawback_context_hash(
+        toAccountId(account),
+        toIssuanceId(issuanceID),
+        sequence,
+        toAccountId(holder),
+        result.data());
+    return result;
+}
+
+uint256
+getConvertContextHash(AccountID const& account, uint192 const& issuanceID, std::uint32_t sequence)
+{
+    uint256 result;
+    mpt_get_convert_context_hash(
+        toAccountId(account), toIssuanceId(issuanceID), sequence, result.data());
+    return result;
+}
+
+uint256
+getConvertBackContextHash(
+    AccountID const& account,
+    uint192 const& issuanceID,
+    std::uint32_t sequence,
+    std::uint32_t version)
+{
+    uint256 result;
+    mpt_get_convert_back_context_hash(
+        toAccountId(account), toIssuanceId(issuanceID), sequence, version, result.data());
+    return result;
+}
+
+std::optional<EcPair>
+makeEcPair(Slice const& buffer)
+{
+    if (buffer.length() != 2 * kEcCiphertextComponentLength)
+        return std::nullopt;  // LCOV_EXCL_LINE
+
+    auto parsePubKey = [](Slice const& slice, secp256k1_pubkey& out) {
+        return secp256k1_ec_pubkey_parse(secp256k1Context(), &out, slice.data(), slice.length());
+    };
+
+    Slice const s1{buffer.data(), kEcCiphertextComponentLength};
+    Slice const s2{buffer.data() + kEcCiphertextComponentLength, kEcCiphertextComponentLength};
+
+    EcPair pair{};
+    if (parsePubKey(s1, pair.c1) != 1 || parsePubKey(s2, pair.c2) != 1)
+        return std::nullopt;
+
+    return pair;
+}
+
+std::optional<Buffer>
+serializeEcPair(EcPair const& pair)
+{
+    auto serializePubKey = [](secp256k1_pubkey const& pub, unsigned char* out) {
+        size_t outLen = kEcCiphertextComponentLength;  // 33 bytes
+        auto const ret = secp256k1_ec_pubkey_serialize(
+            secp256k1Context(), out, &outLen, &pub, SECP256K1_EC_COMPRESSED);
+        return ret == 1 && outLen == kEcCiphertextComponentLength;
+    };
+
+    Buffer buffer(kEcGamalEncryptedTotalLength);
+    auto const ptr = buffer.data();
+    bool const res1 = serializePubKey(pair.c1, ptr);
+    bool const res2 = serializePubKey(pair.c2, ptr + kEcCiphertextComponentLength);
+
+    if (!res1 || !res2)
+        return std::nullopt;
+
+    return buffer;
+}
+
+bool
+isValidCiphertext(Slice const& buffer)
+{
+    return makeEcPair(buffer).has_value();
+}
+
+bool
+isValidCompressedECPoint(Slice const& buffer)
+{
+    if (buffer.size() != kCompressedEcPointLength)
+        return false;
+
+    // Compressed EC points must start with 0x02 or 0x03
+    if (buffer[0] != kEcCompressedPrefixEvenY && buffer[0] != kEcCompressedPrefixOddY)
+        return false;
+
+    secp256k1_pubkey point;
+    return secp256k1_ec_pubkey_parse(secp256k1Context(), &point, buffer.data(), buffer.size()) == 1;
+}
+
+std::optional<Buffer>
+homomorphicAdd(Slice const& a, Slice const& b)
+{
+    if (a.length() != kEcGamalEncryptedTotalLength || b.length() != kEcGamalEncryptedTotalLength)
+        return std::nullopt;
+
+    auto const pairA = makeEcPair(a);
+    auto const pairB = makeEcPair(b);
+
+    if (!pairA || !pairB)
+        return std::nullopt;
+
+    EcPair sum{};
+    if (auto res = secp256k1_elgamal_add(
+            secp256k1Context(), &sum.c1, &sum.c2, &pairA->c1, &pairA->c2, &pairB->c1, &pairB->c2);
+        res != 1)
+    {
+        return std::nullopt;
+    }
+
+    return serializeEcPair(sum);
+}
+
+std::optional<Buffer>
+homomorphicSubtract(Slice const& a, Slice const& b)
+{
+    if (a.length() != kEcGamalEncryptedTotalLength || b.length() != kEcGamalEncryptedTotalLength)
+        return std::nullopt;
+
+    auto const pairA = makeEcPair(a);
+    auto const pairB = makeEcPair(b);
+
+    if (!pairA || !pairB)
+        return std::nullopt;
+
+    EcPair diff{};
+    if (auto const res = secp256k1_elgamal_subtract(
+            secp256k1Context(), &diff.c1, &diff.c2, &pairA->c1, &pairA->c2, &pairB->c1, &pairB->c2);
+        res != 1)
+    {
+        return std::nullopt;
+    }
+
+    return serializeEcPair(diff);
+}
+
+std::optional<Buffer>
+rerandomizeCiphertext(Slice const& ciphertext, Slice const& pubKeySlice, Slice const& randomness)
+{
+    auto zero = encryptAmount(0, pubKeySlice, randomness);
+    if (!zero)
+        return std::nullopt;
+
+    return homomorphicAdd(ciphertext, *zero);
+}
+
+Buffer
+generateBlindingFactor()
+{
+    unsigned char blindingFactor[kEcBlindingFactorLength];
+
+    // todo: might need to be updated using another RNG
+    if (RAND_bytes(blindingFactor, kEcBlindingFactorLength) != 1)
+        Throw<std::runtime_error>("Failed to generate random number");
+
+    return Buffer(blindingFactor, kEcBlindingFactorLength);
+}
+
+std::optional<Buffer>
+encryptAmount(uint64_t const amt, Slice const& pubKeySlice, Slice const& blindingFactor)
+{
+    if (blindingFactor.size() != kEcBlindingFactorLength || pubKeySlice.size() != kEcPubKeyLength)
+        return std::nullopt;
+
+    Buffer out(kEcGamalEncryptedTotalLength);
+    if (mpt_encrypt_amount(amt, pubKeySlice.data(), blindingFactor.data(), out.data()) != 0)
+        return std::nullopt;
+
+    return out;
+}
+
+std::optional<Buffer>
+encryptCanonicalZeroAmount(Slice const& pubKeySlice, AccountID const& account, MPTID const& mptId)
+{
+    if (pubKeySlice.size() != kEcPubKeyLength)
+        return std::nullopt;  // LCOV_EXCL_LINE
+
+    EcPair pair{};
+    secp256k1_pubkey pubKey;
+    if (auto res = secp256k1_ec_pubkey_parse(
+            secp256k1Context(), &pubKey, pubKeySlice.data(), kEcPubKeyLength);
+        res != 1)
+    {
+        return std::nullopt;  // LCOV_EXCL_LINE
+    }
+
+    if (auto res = generate_canonical_encrypted_zero(
+            secp256k1Context(), &pair.c1, &pair.c2, &pubKey, account.data(), mptId.data());
+        res != 1)
+    {
+        return std::nullopt;  // LCOV_EXCL_LINE
+    }
+
+    return serializeEcPair(pair);
+}
+
+TER
+verifyRevealedAmount(
+    uint64_t const amount,
+    Slice const& blindingFactor,
+    ConfidentialRecipient const& holder,
+    ConfidentialRecipient const& issuer,
+    std::optional<ConfidentialRecipient> const& auditor)
+{
+    if (blindingFactor.size() != kEcBlindingFactorLength ||
+        holder.publicKey.size() != kEcPubKeyLength ||
+        holder.encryptedAmount.size() != kEcGamalEncryptedTotalLength ||
+        issuer.publicKey.size() != kEcPubKeyLength ||
+        issuer.encryptedAmount.size() != kEcGamalEncryptedTotalLength)
+    {
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    auto const holderP = toParticipant(holder);
+    auto const issuerP = toParticipant(issuer);
+    mpt_confidential_participant auditorP{};
+    mpt_confidential_participant const* auditorPtr = nullptr;
+    if (auditor)
+    {
+        if (auditor->publicKey.size() != kEcPubKeyLength ||
+            auditor->encryptedAmount.size() != kEcGamalEncryptedTotalLength)
+        {
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+        }
+        auditorP = toParticipant(*auditor);
+        auditorPtr = &auditorP;
+    }
+
+    if (mpt_verify_revealed_amount(amount, blindingFactor.data(), &holderP, &issuerP, auditorPtr) !=
+        0)
+    {
+        return tecBAD_PROOF;
+    }
+
+    return tesSUCCESS;
+}
+
+NotTEC
+checkEncryptedAmountFormat(STObject const& object)
+{
+    // Current usage of this function is only for ConfidentialMPTConvert and
+    // ConfidentialMPTConvertBack transactions, which already enforce that these fields
+    // are present.
+    if (!object.isFieldPresent(sfHolderEncryptedAmount) ||
+        !object.isFieldPresent(sfIssuerEncryptedAmount))
+    {
+        return temMALFORMED;  // LCOV_EXCL_LINE
+    }
+
+    if (object[sfHolderEncryptedAmount].length() != kEcGamalEncryptedTotalLength ||
+        object[sfIssuerEncryptedAmount].length() != kEcGamalEncryptedTotalLength)
+    {
+        return temBAD_CIPHERTEXT;
+    }
+
+    bool const hasAuditor = object.isFieldPresent(sfAuditorEncryptedAmount);
+    if (hasAuditor && object[sfAuditorEncryptedAmount].length() != kEcGamalEncryptedTotalLength)
+        return temBAD_CIPHERTEXT;
+
+    if (!isValidCiphertext(object[sfHolderEncryptedAmount]) ||
+        !isValidCiphertext(object[sfIssuerEncryptedAmount]))
+    {
+        return temBAD_CIPHERTEXT;
+    }
+
+    if (hasAuditor && !isValidCiphertext(object[sfAuditorEncryptedAmount]))
+        return temBAD_CIPHERTEXT;
+
+    return tesSUCCESS;
+}
+
+TER
+verifySchnorrProof(Slice const& pubKeySlice, Slice const& proofSlice, uint256 const& contextHash)
+{
+    if (proofSlice.size() != kEcSchnorrProofLength || pubKeySlice.size() != kEcPubKeyLength)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    if (mpt_verify_convert_proof(proofSlice.data(), pubKeySlice.data(), contextHash.data()) != 0)
+        return tecBAD_PROOF;
+
+    return tesSUCCESS;
+}
+
+TER
+verifyClawbackProof(
+    uint64_t const amount,
+    Slice const& proof,
+    Slice const& pubKeySlice,
+    Slice const& ciphertext,
+    uint256 const& contextHash)
+{
+    if (ciphertext.size() != kEcGamalEncryptedTotalLength ||
+        pubKeySlice.size() != kEcPubKeyLength || proof.size() != kEcClawbackProofLength)
+    {
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    if (mpt_verify_clawback_proof(
+            proof.data(), amount, pubKeySlice.data(), ciphertext.data(), contextHash.data()) != 0)
+    {
+        return tecBAD_PROOF;
+    }
+
+    return tesSUCCESS;
+}
+
+TER
+verifySendProof(
+    Slice const& proof,
+    ConfidentialRecipient const& sender,
+    ConfidentialRecipient const& destination,
+    ConfidentialRecipient const& issuer,
+    std::optional<ConfidentialRecipient> const& auditor,
+    Slice const& spendingBalance,
+    Slice const& amountCommitment,
+    Slice const& balanceCommitment,
+    uint256 const& contextHash)
+{
+    auto const recipientCount = getConfidentialRecipientCount(auditor.has_value());
+    if (proof.size() != kEcSendProofLength || sender.publicKey.size() != kEcPubKeyLength ||
+        sender.encryptedAmount.size() != kEcGamalEncryptedTotalLength ||
+        destination.publicKey.size() != kEcPubKeyLength ||
+        destination.encryptedAmount.size() != kEcGamalEncryptedTotalLength ||
+        issuer.publicKey.size() != kEcPubKeyLength ||
+        issuer.encryptedAmount.size() != kEcGamalEncryptedTotalLength ||
+        spendingBalance.size() != kEcGamalEncryptedTotalLength ||
+        amountCommitment.size() != kEcPedersenCommitmentLength ||
+        balanceCommitment.size() != kEcPedersenCommitmentLength)
+    {
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    std::vector<mpt_confidential_participant> participants;
+    participants.reserve(recipientCount);
+    participants.push_back(toParticipant(sender));
+    participants.push_back(toParticipant(destination));
+    participants.push_back(toParticipant(issuer));
+    if (auditor)
+    {
+        if (auditor->publicKey.size() != kEcPubKeyLength ||
+            auditor->encryptedAmount.size() != kEcGamalEncryptedTotalLength)
+        {
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+        }
+        participants.push_back(toParticipant(*auditor));
+    }
+    if (participants.size() != recipientCount)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    if (mpt_verify_send_proof(
+            proof.data(),
+            participants.data(),
+            recipientCount,
+            spendingBalance.data(),
+            amountCommitment.data(),
+            balanceCommitment.data(),
+            contextHash.data()) != 0)
+    {
+        return tecBAD_PROOF;
+    }
+
+    return tesSUCCESS;
+}
+
+TER
+verifyConvertBackProof(
+    Slice const& proof,
+    Slice const& pubKeySlice,
+    Slice const& spendingBalance,
+    Slice const& balanceCommitment,
+    uint64_t amount,
+    uint256 const& contextHash)
+{
+    if (proof.size() != kEcConvertBackProofLength || pubKeySlice.size() != kEcPubKeyLength ||
+        spendingBalance.size() != kEcGamalEncryptedTotalLength ||
+        balanceCommitment.size() != kEcPedersenCommitmentLength)
+    {
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    if (mpt_verify_convert_back_proof(
+            proof.data(),
+            pubKeySlice.data(),
+            spendingBalance.data(),
+            balanceCommitment.data(),
+            amount,
+            contextHash.data()) != 0)
+    {
+        return tecBAD_PROOF;
+    }
+
+    return tesSUCCESS;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/protocol/PublicKey.cpp b/src/libxrpl/protocol/PublicKey.cpp
index 7472f059e9..c6e6c1d324 100644
--- a/src/libxrpl/protocol/PublicKey.cpp
+++ b/src/libxrpl/protocol/PublicKey.cpp
@@ -5,6 +5,7 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/strHex.h>
 #include <xrpl/protocol/KeyType.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/detail/secp256k1.h>
 #include <xrpl/protocol/digest.h>
@@ -211,7 +212,7 @@ publicKeyType(Slice const& slice)
         if (slice[0] == 0xED)
             return KeyType::Ed25519;
 
-        if (slice[0] == 0x02 || slice[0] == 0x03)
+        if (slice[0] == kEcCompressedPrefixEvenY || slice[0] == kEcCompressedPrefixOddY)
             return KeyType::Secp256k1;
     }
 
diff --git a/src/libxrpl/protocol/TER.cpp b/src/libxrpl/protocol/TER.cpp
index 6b8dfc6811..e5c1d17b1a 100644
--- a/src/libxrpl/protocol/TER.cpp
+++ b/src/libxrpl/protocol/TER.cpp
@@ -106,6 +106,7 @@ transResults()
         MAKE_ERROR(tecLIMIT_EXCEEDED,                "Limit exceeded."),
         MAKE_ERROR(tecPSEUDO_ACCOUNT,                "This operation is not allowed against a pseudo-account."),
         MAKE_ERROR(tecPRECISION_LOSS,                "The amounts used by the transaction cannot interact."),
+        MAKE_ERROR(tecBAD_PROOF,                     "Proof cannot be verified"),
 
         MAKE_ERROR(tefALREADY,                     "The exact transaction was already in this ledger."),
         MAKE_ERROR(tefBAD_ADD_AUTH,                "Not authorized to add account."),
@@ -199,6 +200,7 @@ transResults()
         MAKE_ERROR(temARRAY_TOO_LARGE,           "Malformed: Array is too large."),
         MAKE_ERROR(temBAD_TRANSFER_FEE,          "Malformed: Transfer fee is outside valid range."),
         MAKE_ERROR(temINVALID_INNER_BATCH,       "Malformed: Invalid inner batch transaction."),
+        MAKE_ERROR(temBAD_CIPHERTEXT,            "Malformed: Invalid ciphertext."),
 
         MAKE_ERROR(terRETRY,                  "Retry transaction."),
         MAKE_ERROR(terFUNDS_SPENT,            "DEPRECATED."),
diff --git a/src/libxrpl/tx/Transactor.cpp b/src/libxrpl/tx/Transactor.cpp
index 3a10b7124f..9ab8779f03 100644
--- a/src/libxrpl/tx/Transactor.cpp
+++ b/src/libxrpl/tx/Transactor.cpp
@@ -356,6 +356,15 @@ Transactor::calculateBaseFee(ReadView const& view, STTx const& tx)
     return baseFee + (signerCount * baseFee);
 }
 
+XRPAmount
+Transactor::calculateBaseFee(
+    ReadView const& view,
+    STTx const& tx,
+    std::uint32_t extraBaseFeeMultiplier)
+{
+    return calculateBaseFee(view, tx) + view.fees().base * extraBaseFeeMultiplier;
+}
+
 // Returns the fee in fee units, not scaled for load.
 XRPAmount
 Transactor::calculateOwnerReserveFee(ReadView const& view, STTx const& tx)
diff --git a/src/libxrpl/tx/invariants/MPTInvariant.cpp b/src/libxrpl/tx/invariants/MPTInvariant.cpp
index 278c7a7858..26bee4effb 100644
--- a/src/libxrpl/tx/invariants/MPTInvariant.cpp
+++ b/src/libxrpl/tx/invariants/MPTInvariant.cpp
@@ -1,7 +1,9 @@
 #include <xrpl/tx/invariants/MPTInvariant.h>
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/View.h>
@@ -23,11 +25,46 @@
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/invariants/InvariantCheckPrivilege.h>
 
+#include <algorithm>
+#include <array>
 #include <cstddef>
 #include <cstdint>
 #include <memory>
+
 namespace xrpl {
 
+namespace {
+constexpr auto kConfidentialMptTxTypes = std::to_array<TxType>({
+    ttCONFIDENTIAL_MPT_SEND,
+    ttCONFIDENTIAL_MPT_CONVERT,
+    ttCONFIDENTIAL_MPT_CONVERT_BACK,
+    ttCONFIDENTIAL_MPT_MERGE_INBOX,
+    ttCONFIDENTIAL_MPT_CLAWBACK,
+});
+
+// Clamp to the cap (== INT64_MAX) before the signed conversion. Invariant
+// tests can inject INT64_MAX + 1, which would result in undefined behavior
+// under UBSan if converted directly.
+std::int64_t
+toSignedMPTAmount(std::uint64_t amount)
+{
+    return static_cast<std::int64_t>(std::min(amount, kMaxMpTokenAmount));
+}
+
+std::int64_t
+addMPTAmountDelta(std::int64_t delta, std::uint64_t amount)
+{
+    return delta + toSignedMPTAmount(amount);
+}
+
+std::int64_t
+subtractMPTAmountDelta(std::int64_t delta, std::uint64_t amount)
+{
+    return delta - toSignedMPTAmount(amount);
+}
+
+}  // namespace
+
 void
 ValidMPTIssuance::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after)
 {
@@ -438,6 +475,16 @@ ValidMPTPayment::finalize(
 {
     if (isTesSuccess(result))
     {
+        // Confidential transactions are validated by ValidConfidentialMPToken.
+        // They modify encrypted fields and sfConfidentialOutstandingAmount
+        // rather than sfMPTAmount/sfOutstandingAmount in the standard way,
+        // so ValidMPTPayment's accounting does not apply to them.
+        if (std::ranges::find(kConfidentialMptTxTypes, tx.getTxnType()) !=
+            kConfidentialMptTxTypes.end())
+        {
+            return true;
+        }
+
         bool const invariantPasses = !view.rules().enabled(featureMPTokensV2);
         if (overflow_)
         {
@@ -468,6 +515,261 @@ ValidMPTPayment::finalize(
     return true;
 }
 
+void
+ValidConfidentialMPToken::visitEntry(
+    bool isDelete,
+    std::shared_ptr<SLE const> const& before,
+    std::shared_ptr<SLE const> const& after)
+{
+    // Helper to get MPToken Issuance ID safely
+    auto const getMptID = [](std::shared_ptr<SLE const> const& sle) -> uint192 {
+        if (!sle)
+            return beast::kZero;
+        if (sle->getType() == ltMPTOKEN)
+            return sle->getFieldH192(sfMPTokenIssuanceID);
+        if (sle->getType() == ltMPTOKEN_ISSUANCE)
+            return makeMptID(sle->getFieldU32(sfSequence), sle->getAccountID(sfIssuer));
+        return beast::kZero;
+    };
+
+    if (before && before->getType() == ltMPTOKEN)
+    {
+        uint192 const id = getMptID(before);
+        auto& change = changes_[id];
+        change.mptAmountDelta =
+            subtractMPTAmountDelta(change.mptAmountDelta, before->getFieldU64(sfMPTAmount));
+
+        // Cannot delete MPToken with non-zero confidential state or non-zero public amount
+        if (isDelete)
+        {
+            bool const hasPublicBalance = before->getFieldU64(sfMPTAmount) > 0;
+            bool const hasEncryptedFields = before->isFieldPresent(sfConfidentialBalanceSpending) ||
+                before->isFieldPresent(sfConfidentialBalanceInbox) ||
+                before->isFieldPresent(sfIssuerEncryptedBalance) ||
+                before->isFieldPresent(sfAuditorEncryptedBalance);
+
+            if (hasPublicBalance || hasEncryptedFields)
+                changes_[id].deletedWithEncrypted = true;
+        }
+    }
+
+    if (after && after->getType() == ltMPTOKEN)
+    {
+        uint192 const id = getMptID(after);
+        auto& change = changes_[id];
+        change.mptAmountDelta =
+            addMPTAmountDelta(change.mptAmountDelta, after->getFieldU64(sfMPTAmount));
+
+        // Encrypted field existence consistency
+        bool const hasIssuerBalance = after->isFieldPresent(sfIssuerEncryptedBalance);
+        bool const hasHolderInbox = after->isFieldPresent(sfConfidentialBalanceInbox);
+        bool const hasHolderSpending = after->isFieldPresent(sfConfidentialBalanceSpending);
+        bool const hasAuditorBalance = after->isFieldPresent(sfAuditorEncryptedBalance);
+
+        // The core encrypted balances must all exist or not exist at the same time. The auditor
+        // balance is optional, but cannot exist without the core fields.
+        if (hasHolderInbox != hasHolderSpending || hasHolderInbox != hasIssuerBalance ||
+            (hasAuditorBalance && !hasIssuerBalance))
+            changes_[id].badConsistency = true;
+
+        auto const confidentialBalanceFieldChanged = [&before, &after](auto const& field) {
+            auto const afterValue = (*after)[~field];
+            if (!afterValue)
+                return false;
+
+            if (!before || before->getType() != ltMPTOKEN)
+                return true;  // LCOV_EXCL_LINE
+
+            return (*before)[~field] != afterValue;
+        };
+
+        if (confidentialBalanceFieldChanged(sfConfidentialBalanceInbox) ||
+            confidentialBalanceFieldChanged(sfConfidentialBalanceSpending) ||
+            confidentialBalanceFieldChanged(sfIssuerEncryptedBalance) ||
+            confidentialBalanceFieldChanged(sfAuditorEncryptedBalance))
+        {
+            changes_[id].changesConfidentialFields = true;
+        }
+    }
+
+    if (before && before->getType() == ltMPTOKEN_ISSUANCE)
+    {
+        uint192 const id = getMptID(before);
+        auto& change = changes_[id];
+        if (before->isFieldPresent(sfConfidentialOutstandingAmount))
+        {
+            change.coaDelta = subtractMPTAmountDelta(
+                change.coaDelta, before->getFieldU64(sfConfidentialOutstandingAmount));
+        }
+        change.outstandingDelta = subtractMPTAmountDelta(
+            change.outstandingDelta, before->getFieldU64(sfOutstandingAmount));
+    }
+
+    if (after && after->getType() == ltMPTOKEN_ISSUANCE)
+    {
+        uint192 const id = getMptID(after);
+        auto& change = changes_[id];
+
+        bool const hasCOA = after->isFieldPresent(sfConfidentialOutstandingAmount);
+        std::uint64_t const coa = (*after)[~sfConfidentialOutstandingAmount].value_or(0);
+        std::uint64_t const oa = after->getFieldU64(sfOutstandingAmount);
+
+        if (hasCOA)
+            change.coaDelta = addMPTAmountDelta(change.coaDelta, coa);
+
+        change.outstandingDelta = addMPTAmountDelta(change.outstandingDelta, oa);
+        change.issuance = after;
+
+        // COA <= OutstandingAmount
+        if (coa > oa)
+            change.badCOA = true;
+    }
+
+    if (before && after && before->getType() == ltMPTOKEN && after->getType() == ltMPTOKEN)
+    {
+        uint192 const id = getMptID(after);
+
+        // sfConfidentialBalanceVersion must change when spending changes
+        auto const spendingBefore = (*before)[~sfConfidentialBalanceSpending];
+        auto const spendingAfter = (*after)[~sfConfidentialBalanceSpending];
+        auto const versionBefore = (*before)[~sfConfidentialBalanceVersion];
+        auto const versionAfter = (*after)[~sfConfidentialBalanceVersion];
+
+        if (spendingBefore.has_value() && spendingBefore != spendingAfter)
+        {
+            if (versionBefore == versionAfter)
+                changes_[id].badVersion = true;
+        }
+    }
+}
+
+bool
+ValidConfidentialMPToken::finalize(
+    STTx const& tx,
+    TER const result,
+    XRPAmount const,
+    ReadView const& view,
+    beast::Journal const& j)
+{
+    if (result != tesSUCCESS)
+        return true;
+
+    for (auto const& [id, checks] : changes_)
+    {
+        // Find the MPTokenIssuance
+        auto const issuance = [&]() -> std::shared_ptr<SLE const> {
+            if (checks.issuance)
+                return checks.issuance;
+            return view.read(keylet::mptokenIssuance(id));
+        }();
+
+        // Skip all invariance checks if issuance doesn't exist because that means the MPT has been
+        // deleted
+        if (!issuance)
+            continue;
+
+        // Cannot delete MPToken with non-zero confidential state
+        if (checks.deletedWithEncrypted)
+        {
+            if ((*issuance)[~sfConfidentialOutstandingAmount].value_or(0) > 0)
+            {
+                JLOG(j.fatal())
+                    << "Invariant failed: MPToken deleted with encrypted fields while COA > 0";
+                return false;
+            }
+        }
+
+        // Encrypted field existence consistency
+        if (checks.badConsistency)
+        {
+            JLOG(j.fatal()) << "Invariant failed: MPToken encrypted field "
+                               "existence inconsistency";
+            return false;
+        }
+
+        // COA <= OutstandingAmount
+        if (checks.badCOA)
+        {
+            JLOG(j.fatal()) << "Invariant failed: Confidential outstanding amount "
+                               "exceeds total outstanding amount";
+            return false;
+        }
+
+        // Confidential balance fields may remain on a holder MPToken after all
+        // confidential balances have returned to zero. Only creating or
+        // changing those fields requires the issuance privacy flag.
+        if (checks.changesConfidentialFields)
+        {
+            if (!issuance->isFlag(lsfMPTCanHoldConfidentialBalance))
+            {
+                JLOG(j.fatal()) << "Invariant failed: MPToken has encrypted "
+                                   "fields but Issuance does not have "
+                                   "lsfMPTCanHoldConfidentialBalance set";
+                return false;
+            }
+        }
+
+        // We only enforce this when Confidential Outstanding Amount changes (Convert, ConvertBack,
+        // ConfidentialClawback). This avoids falsely failing on Escrow or AMM operations that lock
+        // public tokens outside of ltMPTOKEN. Convert / ConvertBack:
+        // - COA and MPTAmount must have opposite deltas, which cancel each other out to zero.
+        // - OA remains unchanged.
+        // - Therefore, the net delta on both sides of the equation is zero.
+        //
+        // Clawback:
+        // - MPTAmount remains unchanged.
+        // - COA and OA must have identical deltas (mirrored on each side).
+        // - The equation remains balanced as both sides have equal offsets.
+        if (checks.coaDelta != 0)
+        {
+            if (checks.mptAmountDelta + checks.coaDelta != checks.outstandingDelta)
+            {
+                JLOG(j.fatal()) << "Invariant failed: Token conservation "
+                                   "violation for MPT "
+                                << to_string(id);
+                return false;
+            }
+        }
+        else if (
+            std::ranges::find(kConfidentialMptTxTypes, tx.getTxnType()) !=
+            kConfidentialMptTxTypes.end())
+        {
+            // Confidential Txns should not modify public MPTAmount balance
+            // if Confidential Amount Delta is 0
+            if (checks.mptAmountDelta != 0)
+            {
+                JLOG(j.fatal()) << "Invariant failed: MPTAmount changed by confidential "
+                                   "transaction that should not modify this field."
+                                << to_string(id);
+                return false;
+            }
+
+            // Among confidential MPT transactions, only ConfidentialMPTSend and
+            // ConfidentialMPTMergeInbox leave coaDelta unmodified. Therefore, if a confidential MPT
+            // transaction reaches here, it must be one of these two types, neither of which will
+            // modify sfOutstandingAmount
+            if (checks.outstandingDelta != 0)
+            {
+                JLOG(j.fatal()) << "Invariant failed: OutstandingAmount changed "
+                                   "by confidential transaction that should not "
+                                   "modify it for MPT "
+                                << to_string(id);
+                return false;
+            }
+        }
+
+        if (checks.badVersion)
+        {
+            JLOG(j.fatal())
+                << "Invariant failed: MPToken sfConfidentialBalanceVersion not updated when "
+                   "sfConfidentialBalanceSpending changed";
+            return false;
+        }
+    }
+
+    return true;
+}
+
 void
 ValidMPTTransfer::visitEntry(
     bool isDelete,
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp
new file mode 100644
index 0000000000..e0d1d28a8f
--- /dev/null
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp
@@ -0,0 +1,210 @@
+#include <xrpl/tx/transactors/token/ConfidentialMPTClawback.h>
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <memory>
+#include <utility>
+
+namespace xrpl {
+
+NotTEC
+ConfidentialMPTClawback::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    auto const account = ctx.tx[sfAccount];
+
+    // Only issuer can clawback
+    if (account != MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer())
+        return temMALFORMED;
+
+    // Cannot clawback from self
+    if (account == ctx.tx[sfHolder])
+        return temMALFORMED;
+
+    // Check invalid claw amount
+    auto const clawAmount = ctx.tx[sfMPTAmount];
+    if (clawAmount == 0 || clawAmount > kMaxMpTokenAmount)
+        return temBAD_AMOUNT;
+
+    // Verify proof length
+    if (ctx.tx[sfZKProof].length() != kEcClawbackProofLength)
+        return temMALFORMED;
+
+    return tesSUCCESS;
+}
+
+XRPAmount
+ConfidentialMPTClawback::calculateBaseFee(ReadView const& view, STTx const& tx)
+{
+    return Transactor::calculateBaseFee(view, tx, kConfidentialFeeMultiplier);
+}
+
+TER
+ConfidentialMPTClawback::preclaim(PreclaimContext const& ctx)
+{
+    // Check if sender account exists
+    auto const account = ctx.tx[sfAccount];
+    if (!ctx.view.exists(keylet::account(account)))
+        return terNO_ACCOUNT;
+
+    // Check if holder account exists
+    auto const holder = ctx.tx[sfHolder];
+    if (!ctx.view.exists(keylet::account(holder)))
+        return tecNO_TARGET;
+
+    // Check if MPT issuance exists
+    auto const mptIssuanceID = ctx.tx[sfMPTokenIssuanceID];
+    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    // Sanity check: account must be the same as issuer
+    if (sleIssuance->getAccountID(sfIssuer) != account)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    // Check if issuance has issuer ElGamal public key
+    if (!sleIssuance->isFieldPresent(sfIssuerEncryptionKey))
+        return tecNO_PERMISSION;
+
+    // Check if clawback is allowed
+    if (!sleIssuance->isFlag(lsfMPTCanClawback))
+        return tecNO_PERMISSION;
+
+    // Check if issuance allows confidential transfer
+    if (!sleIssuance->isFlag(lsfMPTCanHoldConfidentialBalance))
+        return tecNO_PERMISSION;
+
+    // Check holder's MPToken
+    auto const sleHolderMPToken = ctx.view.read(keylet::mptoken(mptIssuanceID, holder));
+    if (!sleHolderMPToken)
+        return tecOBJECT_NOT_FOUND;
+
+    // Check if holder has confidential balances to claw back
+    if (!sleHolderMPToken->isFieldPresent(sfIssuerEncryptedBalance))
+        return tecNO_PERMISSION;
+
+    // Check if Holder has ElGamal public Key
+    if (!sleHolderMPToken->isFieldPresent(sfHolderEncryptionKey))
+        return tecNO_PERMISSION;
+
+    // Sanity check: claw amount can not exceed confidential outstanding amount
+    // or total outstanding amount (prevents underflow in doApply)
+    auto const amount = ctx.tx[sfMPTAmount];
+    if (amount > (*sleIssuance)[~sfConfidentialOutstandingAmount].value_or(0) ||
+        amount > (*sleIssuance)[sfOutstandingAmount])
+        return tecINSUFFICIENT_FUNDS;
+
+    auto const contextHash =
+        getClawbackContextHash(account, mptIssuanceID, ctx.tx.getSeqProxy().value(), holder);
+
+    // Verify the revealed confidential amount by the issuer matches the exact
+    // confidential balance of the holder.
+    return verifyClawbackProof(
+        amount,
+        ctx.tx[sfZKProof],
+        (*sleIssuance)[sfIssuerEncryptionKey],
+        (*sleHolderMPToken)[sfIssuerEncryptedBalance],
+        contextHash);
+}
+
+TER
+ConfidentialMPTClawback::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+    auto const holder = ctx_.tx[sfHolder];
+
+    auto sleIssuance = view().peek(keylet::mptokenIssuance(mptIssuanceID));
+    auto sleHolderMPToken = view().peek(keylet::mptoken(mptIssuanceID, holder));
+
+    if (!sleIssuance || !sleHolderMPToken)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const clawAmount = ctx_.tx[sfMPTAmount];
+
+    auto const holderPubKey = (*sleHolderMPToken)[sfHolderEncryptionKey];
+    auto const issuerPubKey = (*sleIssuance)[sfIssuerEncryptionKey];
+
+    // After clawback, the balance should be encrypted zero.
+    auto const encZeroForHolder = encryptCanonicalZeroAmount(holderPubKey, holder, mptIssuanceID);
+    if (!encZeroForHolder)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto encZeroForIssuer = encryptCanonicalZeroAmount(issuerPubKey, holder, mptIssuanceID);
+    if (!encZeroForIssuer)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    // Set holder's confidential balances to encrypted zero
+    (*sleHolderMPToken)[sfConfidentialBalanceInbox] = *encZeroForHolder;
+    (*sleHolderMPToken)[sfConfidentialBalanceSpending] = *encZeroForHolder;
+    (*sleHolderMPToken)[sfIssuerEncryptedBalance] = std::move(*encZeroForIssuer);
+    incrementConfidentialVersion(*sleHolderMPToken);
+
+    if (sleHolderMPToken->isFieldPresent(sfAuditorEncryptedBalance))
+    {
+        // Sanity check: the issuance must have an auditor public key if
+        // auditing is enabled.
+        if (!sleIssuance->isFieldPresent(sfAuditorEncryptionKey))
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const auditorPubKey = (*sleIssuance)[sfAuditorEncryptionKey];
+
+        auto encZeroForAuditor = encryptCanonicalZeroAmount(auditorPubKey, holder, mptIssuanceID);
+
+        if (!encZeroForAuditor)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        (*sleHolderMPToken)[sfAuditorEncryptedBalance] = std::move(*encZeroForAuditor);
+    }
+
+    // Decrease Global Confidential Outstanding Amount
+    auto const oldCOA = (*sleIssuance)[sfConfidentialOutstandingAmount];
+    if (clawAmount > oldCOA)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    (*sleIssuance)[sfConfidentialOutstandingAmount] = oldCOA - clawAmount;
+
+    // Decrease Global Total Outstanding Amount
+    auto const oldOA = (*sleIssuance)[sfOutstandingAmount];
+    if (clawAmount > oldOA)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    (*sleIssuance)[sfOutstandingAmount] = oldOA - clawAmount;
+
+    view().update(sleHolderMPToken);
+    view().update(sleIssuance);
+
+    return tesSUCCESS;
+}
+
+void
+ConfidentialMPTClawback::visitInvariantEntry(
+    bool,
+    std::shared_ptr<SLE const> const&,
+    std::shared_ptr<SLE const> const&)
+{
+}
+
+bool
+ConfidentialMPTClawback::finalizeInvariants(
+    STTx const&,
+    TER,
+    XRPAmount,
+    ReadView const&,
+    beast::Journal const&)
+{
+    return true;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp
new file mode 100644
index 0000000000..44e2596325
--- /dev/null
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp
@@ -0,0 +1,350 @@
+#include <xrpl/tx/transactors/token/ConfidentialMPTConvert.h>
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <memory>
+#include <optional>
+#include <utility>
+
+namespace xrpl {
+
+NotTEC
+ConfidentialMPTConvert::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    // issuer cannot convert
+    if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
+        return temMALFORMED;
+
+    if (ctx.tx[sfMPTAmount] > kMaxMpTokenAmount)
+        return temBAD_AMOUNT;
+
+    if (ctx.tx.isFieldPresent(sfHolderEncryptionKey))
+    {
+        if (!isValidCompressedECPoint(ctx.tx[sfHolderEncryptionKey]))
+            return temMALFORMED;
+
+        // proof of knowledge of the secret key corresponding to the provided
+        // public key is needed when holder ec public key is being set.
+        if (!ctx.tx.isFieldPresent(sfZKProof))
+            return temMALFORMED;
+
+        // verify schnorr proof length when registering holder ec public key
+        if (ctx.tx[sfZKProof].size() != kEcSchnorrProofLength)
+            return temMALFORMED;
+    }
+    else
+    {
+        // Either both sfHolderEncryptionKey and sfZKProof should be present, or both should be
+        // absent.
+        if (ctx.tx.isFieldPresent(sfZKProof))
+            return temMALFORMED;
+    }
+
+    // check encrypted amount format after the above basic checks
+    // this check is more expensive so put it at the end
+    if (auto const res = checkEncryptedAmountFormat(ctx.tx); !isTesSuccess(res))
+        return res;
+
+    return tesSUCCESS;
+}
+
+XRPAmount
+ConfidentialMPTConvert::calculateBaseFee(ReadView const& view, STTx const& tx)
+{
+    return Transactor::calculateBaseFee(view, tx, kConfidentialFeeMultiplier);
+}
+
+TER
+ConfidentialMPTConvert::preclaim(PreclaimContext const& ctx)
+{
+    auto const account = ctx.tx[sfAccount];
+    auto const issuanceID = ctx.tx[sfMPTokenIssuanceID];
+    auto const amount = ctx.tx[sfMPTAmount];
+
+    // ensure that issuance exists
+    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(issuanceID));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleIssuance->isFlag(lsfMPTCanHoldConfidentialBalance) ||
+        !sleIssuance->isFieldPresent(sfIssuerEncryptionKey))
+    {
+        return tecNO_PERMISSION;
+    }
+
+    // already checked in preflight, but should also check that issuer on the
+    // issuance isn't the account either
+    if (sleIssuance->getAccountID(sfIssuer) == account)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    bool const hasAuditor = ctx.tx.isFieldPresent(sfAuditorEncryptedAmount);
+    bool const requiresAuditor = sleIssuance->isFieldPresent(sfAuditorEncryptionKey);
+
+    // tx must include auditor ciphertext if the issuance has enabled
+    // auditing, and must not include it if auditing is not enabled
+    if (requiresAuditor != hasAuditor)
+        return tecNO_PERMISSION;
+
+    auto const sleMptoken = ctx.view.read(keylet::mptoken(issuanceID, account));
+    if (!sleMptoken)
+        return tecOBJECT_NOT_FOUND;
+
+    auto const mptIssue = MPTIssue{issuanceID};
+
+    // Explicit freeze and auth checks are required because accountHolds
+    // with ZeroIfFrozen/ZeroIfUnauthorized only implicitly rejects
+    // non-zero amounts. A zero-amount convert would bypass those implicit
+    // checks, allowing frozen or unauthorized accounts to register ElGamal
+    // keys and initialize confidential balance fields.
+
+    // Check lock
+    if (auto const ter = checkFrozen(ctx.view, account, mptIssue); !isTesSuccess(ter))
+        return ter;
+
+    // Check auth
+    if (auto const ter = requireAuth(ctx.view, mptIssue, account); !isTesSuccess(ter))
+        return ter;
+
+    auto const mptAmount =
+        STAmount(MPTAmount{static_cast<MPTAmount::value_type>(amount)}, mptIssue);
+    if (accountHolds(
+            ctx.view,
+            account,
+            mptIssue,
+            FreezeHandling::ZeroIfFrozen,
+            AuthHandling::ZeroIfUnauthorized,
+            ctx.j) < mptAmount)
+    {
+        return tecINSUFFICIENT_FUNDS;
+    }
+
+    auto const hasHolderKeyOnLedger = sleMptoken->isFieldPresent(sfHolderEncryptionKey);
+    auto const hasHolderKeyInTx = ctx.tx.isFieldPresent(sfHolderEncryptionKey);
+
+    // must have pk to convert
+    if (!hasHolderKeyOnLedger && !hasHolderKeyInTx)
+        return tecNO_PERMISSION;
+
+    // can't update if there's already a pk
+    if (hasHolderKeyOnLedger && hasHolderKeyInTx)
+        return tecDUPLICATE;
+
+    // Run all verifications before returning any error to prevent timing attacks
+    // that could reveal which proof failed.
+    bool valid = true;
+
+    Slice holderPubKey;
+    if (hasHolderKeyInTx)
+    {
+        holderPubKey = ctx.tx[sfHolderEncryptionKey];
+
+        auto const contextHash =
+            getConvertContextHash(account, issuanceID, ctx.tx.getSeqProxy().value());
+
+        if (auto const ter = verifySchnorrProof(holderPubKey, ctx.tx[sfZKProof], contextHash);
+            !isTesSuccess(ter))
+        {
+            valid = false;
+        }
+    }
+    else
+    {
+        holderPubKey = (*sleMptoken)[sfHolderEncryptionKey];
+    }
+
+    std::optional<ConfidentialRecipient> auditor;
+    if (hasAuditor)
+    {
+        auditor.emplace(
+            ConfidentialRecipient{
+                .publicKey = (*sleIssuance)[sfAuditorEncryptionKey],
+                .encryptedAmount = ctx.tx[sfAuditorEncryptedAmount],
+            });
+    }
+
+    auto const blindingFactor = ctx.tx[sfBlindingFactor];
+    if (auto const ter = verifyRevealedAmount(
+            amount,
+            Slice(blindingFactor.data(), blindingFactor.size()),
+            {
+                .publicKey = holderPubKey,
+                .encryptedAmount = ctx.tx[sfHolderEncryptedAmount],
+            },
+            {
+                .publicKey = (*sleIssuance)[sfIssuerEncryptionKey],
+                .encryptedAmount = ctx.tx[sfIssuerEncryptedAmount],
+            },
+            auditor);
+        !isTesSuccess(ter))
+    {
+        valid = false;
+    }
+
+    if (!valid)
+        return tecBAD_PROOF;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialMPTConvert::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+
+    auto sleMptoken = view().peek(keylet::mptoken(mptIssuanceID, accountID_));
+    if (!sleMptoken)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto sleIssuance = view().peek(keylet::mptokenIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const amtToConvert = ctx_.tx[sfMPTAmount];
+    auto const amt = (*sleMptoken)[~sfMPTAmount].valueOr(0);
+
+    if (ctx_.tx.isFieldPresent(sfHolderEncryptionKey))
+        (*sleMptoken)[sfHolderEncryptionKey] = ctx_.tx[sfHolderEncryptionKey];
+
+    // Converting decreases regular balance and increases confidential outstanding.
+    // The confidential outstanding tracks total tokens in confidential form globally.
+    auto const currentCOA = (*sleIssuance)[~sfConfidentialOutstandingAmount].valueOr(0);
+    if (amtToConvert > kMaxMpTokenAmount - currentCOA)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    (*sleMptoken)[sfMPTAmount] = amt - amtToConvert;
+    (*sleIssuance)[sfConfidentialOutstandingAmount] = currentCOA + amtToConvert;
+
+    auto const holderEc = ctx_.tx[sfHolderEncryptedAmount];
+    auto const issuerEc = ctx_.tx[sfIssuerEncryptedAmount];
+    auto const auditorEc = ctx_.tx[~sfAuditorEncryptedAmount];
+
+    // Two cases for Convert:
+    // 1. Holder already has confidential balances -> homomorphically add to inbox
+    // 2. First-time convert -> initialize all confidential balance fields
+    if (sleMptoken->isFieldPresent(sfIssuerEncryptedBalance) &&
+        sleMptoken->isFieldPresent(sfConfidentialBalanceInbox) &&
+        sleMptoken->isFieldPresent(sfConfidentialBalanceSpending))
+    {
+        // Case 1: Add to existing inbox balance (holder will merge later)
+        {
+            auto sum = homomorphicAdd(holderEc, (*sleMptoken)[sfConfidentialBalanceInbox]);
+            if (!sum)
+            {
+                // LCOV_EXCL_START
+                JLOG(ctx_.journal.error())
+                    << "ConfidentialMPTConvert failed homomorphic add for holder inbox.";
+                return tecINTERNAL;
+                // LCOV_EXCL_STOP
+            }
+
+            (*sleMptoken)[sfConfidentialBalanceInbox] = std::move(*sum);
+        }
+
+        // homomorphically add issuer's encrypted balance
+        {
+            auto sum = homomorphicAdd(issuerEc, (*sleMptoken)[sfIssuerEncryptedBalance]);
+            if (!sum)
+            {
+                // LCOV_EXCL_START
+                JLOG(ctx_.journal.error())
+                    << "ConfidentialMPTConvert failed homomorphic add for issuer balance.";
+                return tecINTERNAL;
+                // LCOV_EXCL_STOP
+            }
+
+            (*sleMptoken)[sfIssuerEncryptedBalance] = std::move(*sum);
+        }
+
+        // homomorphically add auditor's encrypted balance
+        if (auditorEc)
+        {
+            if (!sleMptoken->isFieldPresent(sfAuditorEncryptedBalance))
+                return tecINTERNAL;  // LCOV_EXCL_LINE
+
+            auto sum = homomorphicAdd(*auditorEc, (*sleMptoken)[sfAuditorEncryptedBalance]);
+            if (!sum)
+            {
+                // LCOV_EXCL_START
+                JLOG(ctx_.journal.error())
+                    << "ConfidentialMPTConvert failed homomorphic add for auditor balance.";
+                return tecINTERNAL;
+                // LCOV_EXCL_STOP
+            }
+
+            (*sleMptoken)[sfAuditorEncryptedBalance] = std::move(*sum);
+        }
+    }
+    else if (
+        !sleMptoken->isFieldPresent(sfIssuerEncryptedBalance) &&
+        !sleMptoken->isFieldPresent(sfConfidentialBalanceInbox) &&
+        !sleMptoken->isFieldPresent(sfConfidentialBalanceSpending) &&
+        !sleMptoken->isFieldPresent(sfAuditorEncryptedBalance))
+    {
+        // Case 2: First-time convert - initialize all confidential fields
+        (*sleMptoken)[sfConfidentialBalanceInbox] = holderEc;
+        (*sleMptoken)[sfIssuerEncryptedBalance] = issuerEc;
+        (*sleMptoken)[sfConfidentialBalanceVersion] = 0;
+
+        if (auditorEc)
+            (*sleMptoken)[sfAuditorEncryptedBalance] = *auditorEc;
+
+        // Spending balance starts at zero. Must use canonical zero encryption
+        // (deterministic ciphertext) so the ledger state is reproducible.
+        auto zeroBalance = encryptCanonicalZeroAmount(
+            (*sleMptoken)[sfHolderEncryptionKey], accountID_, mptIssuanceID);
+
+        if (!zeroBalance)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        (*sleMptoken)[sfConfidentialBalanceSpending] = std::move(*zeroBalance);
+    }
+    else
+    {
+        // both sfIssuerEncryptedBalance and sfConfidentialBalanceInbox should
+        // exist together
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    view().update(sleIssuance);
+    view().update(sleMptoken);
+    return tesSUCCESS;
+}
+
+void
+ConfidentialMPTConvert::visitInvariantEntry(
+    bool,
+    std::shared_ptr<SLE const> const&,
+    std::shared_ptr<SLE const> const&)
+{
+}
+
+bool
+ConfidentialMPTConvert::finalizeInvariants(
+    STTx const&,
+    TER,
+    XRPAmount,
+    ReadView const&,
+    beast::Journal const&)
+{
+    return true;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTConvertBack.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTConvertBack.cpp
new file mode 100644
index 0000000000..d6fed78833
--- /dev/null
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTConvertBack.cpp
@@ -0,0 +1,319 @@
+#include <xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h>
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <memory>
+#include <optional>
+#include <utility>
+
+namespace xrpl {
+
+NotTEC
+ConfidentialMPTConvertBack::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    // issuer cannot convert back
+    if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
+        return temMALFORMED;
+
+    if (ctx.tx[sfMPTAmount] == 0 || ctx.tx[sfMPTAmount] > kMaxMpTokenAmount)
+        return temBAD_AMOUNT;
+
+    if (!isValidCompressedECPoint(ctx.tx[sfBalanceCommitment]))
+        return temMALFORMED;
+
+    // check encrypted amount format after the above basic checks
+    // this check is more expensive so put it at the end
+    if (auto const res = checkEncryptedAmountFormat(ctx.tx); !isTesSuccess(res))
+        return res;
+
+    // ConvertBack proof = compact sigma proof (128 bytes) + single bulletproof (688 bytes)
+    if (ctx.tx[sfZKProof].size() != kEcConvertBackProofLength)
+        return temMALFORMED;
+
+    return tesSUCCESS;
+}
+
+XRPAmount
+ConfidentialMPTConvertBack::calculateBaseFee(ReadView const& view, STTx const& tx)
+{
+    return Transactor::calculateBaseFee(view, tx, kConfidentialFeeMultiplier);
+}
+
+/**
+ * Verifies the cryptographic proofs for a ConvertBack transaction.
+ *
+ * This function verifies three proofs:
+ * 1. Revealed amount proof: verifies the encrypted amounts (holder, issuer,
+ *    auditor) all encrypt the same revealed amount using the blinding factor.
+ * 2. Pedersen linkage proof: verifies the balance commitment is derived from
+ *    the holder's encrypted spending balance.
+ * 3. Bulletproof (range proof): verifies the remaining balance (balance - amount)
+ *    is non-negative, preventing overdrafts.
+ *
+ * All proofs are verified before returning any error to prevent timing attacks.
+ */
+static TER
+verifyProofs(
+    STTx const& tx,
+    std::shared_ptr<SLE const> const& issuance,
+    std::shared_ptr<SLE const> const& mptoken)
+{
+    if (!mptoken->isFieldPresent(sfHolderEncryptionKey))
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const mptIssuanceID = tx[sfMPTokenIssuanceID];
+    auto const account = tx[sfAccount];
+    auto const amount = tx[sfMPTAmount];
+    auto const blindingFactor = tx[sfBlindingFactor];
+    auto const holderPubKey = (*mptoken)[sfHolderEncryptionKey];
+
+    auto const contextHash = getConvertBackContextHash(
+        account,
+        mptIssuanceID,
+        tx.getSeqProxy().value(),
+        (*mptoken)[~sfConfidentialBalanceVersion].value_or(0));
+
+    // Prepare Auditor Info
+    std::optional<ConfidentialRecipient> auditor;
+    bool const hasAuditor = issuance->isFieldPresent(sfAuditorEncryptionKey);
+    if (hasAuditor)
+    {
+        auditor.emplace(
+            ConfidentialRecipient{
+                .publicKey = (*issuance)[sfAuditorEncryptionKey],
+                .encryptedAmount = tx[sfAuditorEncryptedAmount],
+            });
+    }
+
+    // Run all verifications before returning any error to prevent timing attacks
+    // that could reveal which proof failed.
+    bool valid = true;
+
+    if (auto const ter = verifyRevealedAmount(
+            amount,
+            Slice(blindingFactor.data(), blindingFactor.size()),
+            {
+                .publicKey = holderPubKey,
+                .encryptedAmount = tx[sfHolderEncryptedAmount],
+            },
+            {
+                .publicKey = (*issuance)[sfIssuerEncryptionKey],
+                .encryptedAmount = tx[sfIssuerEncryptedAmount],
+            },
+            auditor);
+        !isTesSuccess(ter))
+    {
+        valid = false;
+    }
+
+    if (auto const ter = verifyConvertBackProof(
+            tx[sfZKProof],
+            holderPubKey,
+            (*mptoken)[sfConfidentialBalanceSpending],
+            tx[sfBalanceCommitment],
+            amount,
+            contextHash);
+        !isTesSuccess(ter))
+    {
+        valid = false;
+    }
+
+    if (!valid)
+        return tecBAD_PROOF;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialMPTConvertBack::preclaim(PreclaimContext const& ctx)
+{
+    auto const mptIssuanceID = ctx.tx[sfMPTokenIssuanceID];
+    auto const account = ctx.tx[sfAccount];
+    auto const amount = ctx.tx[sfMPTAmount];
+
+    // ensure that issuance exists
+    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleIssuance->isFlag(lsfMPTCanHoldConfidentialBalance) ||
+        !sleIssuance->isFieldPresent(sfIssuerEncryptionKey))
+        return tecNO_PERMISSION;
+
+    bool const hasAuditor = ctx.tx.isFieldPresent(sfAuditorEncryptedAmount);
+    bool const requiresAuditor = sleIssuance->isFieldPresent(sfAuditorEncryptionKey);
+
+    // tx must include auditor ciphertext if the issuance has enabled
+    // auditing
+    if (requiresAuditor && !hasAuditor)
+        return tecNO_PERMISSION;
+
+    // if auditing is not supported then user should not upload auditor
+    // ciphertext
+    if (!requiresAuditor && hasAuditor)
+        return tecNO_PERMISSION;
+
+    // already checked in preflight, but should also check that issuer on
+    // the issuance isn't the account either
+    if (sleIssuance->getAccountID(sfIssuer) == account)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sleMptoken = ctx.view.read(keylet::mptoken(mptIssuanceID, account));
+    if (!sleMptoken)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleMptoken->isFieldPresent(sfHolderEncryptionKey) ||
+        !sleMptoken->isFieldPresent(sfConfidentialBalanceSpending) ||
+        !sleMptoken->isFieldPresent(sfIssuerEncryptedBalance))
+    {
+        return tecNO_PERMISSION;
+    }
+
+    // Sanity check: holder's MPToken must have auditor balance field if auditing
+    // is enabled
+    if (requiresAuditor && !sleMptoken->isFieldPresent(sfAuditorEncryptedBalance))
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    // if the total circulating confidential balance is smaller than what the
+    // holder is trying to convert back, we know for sure this txn should
+    // fail
+    if ((*sleIssuance)[~sfConfidentialOutstandingAmount].value_or(0) < amount)
+        return tecINSUFFICIENT_FUNDS;
+
+    // Check lock
+    MPTIssue const mptIssue(mptIssuanceID);
+    if (auto const ter = checkFrozen(ctx.view, account, mptIssue); !isTesSuccess(ter))
+        return ter;
+
+    // Check auth
+    if (auto const ter = requireAuth(ctx.view, mptIssue, account); !isTesSuccess(ter))
+        return ter;
+
+    if (auto const res = verifyProofs(ctx.tx, sleIssuance, sleMptoken); !isTesSuccess(res))
+        return res;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialMPTConvertBack::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+
+    auto sleMptoken = view().peek(keylet::mptoken(mptIssuanceID, accountID_));
+    if (!sleMptoken)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto sleIssuance = view().peek(keylet::mptokenIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const amtToConvertBack = ctx_.tx[sfMPTAmount];
+    auto const amt = (*sleMptoken)[~sfMPTAmount].valueOr(0);
+
+    // Converting back increases regular balance and decreases confidential
+    // outstanding. This is the inverse of Convert.
+    if (amt > kMaxMpTokenAmount - amtToConvertBack)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    (*sleMptoken)[sfMPTAmount] = amt + amtToConvertBack;
+
+    auto const coa = (*sleIssuance)[~sfConfidentialOutstandingAmount].valueOr(0);
+    if (coa < amtToConvertBack)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    (*sleIssuance)[sfConfidentialOutstandingAmount] = coa - amtToConvertBack;
+
+    std::optional<Slice> const auditorEc = ctx_.tx[~sfAuditorEncryptedAmount];
+
+    // homomorphically subtract holder's encrypted balance
+    {
+        auto res = homomorphicSubtract(
+            (*sleMptoken)[sfConfidentialBalanceSpending], ctx_.tx[sfHolderEncryptedAmount]);
+        if (!res)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTConvertBack failed homomorphic subtract for holder spending "
+                   "balance.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleMptoken)[sfConfidentialBalanceSpending] = std::move(*res);
+    }
+
+    // homomorphically subtract issuer's encrypted balance
+    {
+        auto res = homomorphicSubtract(
+            (*sleMptoken)[sfIssuerEncryptedBalance], ctx_.tx[sfIssuerEncryptedAmount]);
+        if (!res)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTConvertBack failed homomorphic subtract for issuer balance.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleMptoken)[sfIssuerEncryptedBalance] = std::move(*res);
+    }
+
+    if (auditorEc)
+    {
+        auto res = homomorphicSubtract(
+            (*sleMptoken)[sfAuditorEncryptedBalance], ctx_.tx[sfAuditorEncryptedAmount]);
+        if (!res)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTConvertBack failed homomorphic subtract for auditor balance.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleMptoken)[sfAuditorEncryptedBalance] = std::move(*res);
+    }
+
+    incrementConfidentialVersion(*sleMptoken);
+
+    view().update(sleIssuance);
+    view().update(sleMptoken);
+    return tesSUCCESS;
+}
+
+void
+ConfidentialMPTConvertBack::visitInvariantEntry(
+    bool,
+    std::shared_ptr<SLE const> const&,
+    std::shared_ptr<SLE const> const&)
+{
+}
+
+bool
+ConfidentialMPTConvertBack::finalizeInvariants(
+    STTx const&,
+    TER,
+    XRPAmount,
+    ReadView const&,
+    beast::Journal const&)
+{
+    return true;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTMergeInbox.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTMergeInbox.cpp
new file mode 100644
index 0000000000..02c759c521
--- /dev/null
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTMergeInbox.cpp
@@ -0,0 +1,150 @@
+#include <xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h>
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <memory>
+#include <utility>
+
+namespace xrpl {
+
+NotTEC
+ConfidentialMPTMergeInbox::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    // issuer cannot merge
+    if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
+        return temMALFORMED;
+
+    return tesSUCCESS;
+}
+
+XRPAmount
+ConfidentialMPTMergeInbox::calculateBaseFee(ReadView const& view, STTx const& tx)
+{
+    return Transactor::calculateBaseFee(view, tx, kConfidentialFeeMultiplier);
+}
+
+TER
+ConfidentialMPTMergeInbox::preclaim(PreclaimContext const& ctx)
+{
+    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(ctx.tx[sfMPTokenIssuanceID]));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleIssuance->isFlag(lsfMPTCanHoldConfidentialBalance))
+        return tecNO_PERMISSION;
+
+    // already checked in preflight, but should also check that issuer on the
+    // issuance isn't the account either
+    if (sleIssuance->getAccountID(sfIssuer) == ctx.tx[sfAccount])
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sleMptoken =
+        ctx.view.read(keylet::mptoken(ctx.tx[sfMPTokenIssuanceID], ctx.tx[sfAccount]));
+    if (!sleMptoken)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleMptoken->isFieldPresent(sfConfidentialBalanceInbox) ||
+        !sleMptoken->isFieldPresent(sfConfidentialBalanceSpending) ||
+        !sleMptoken->isFieldPresent(sfHolderEncryptionKey))
+    {
+        return tecNO_PERMISSION;
+    }
+
+    // Check lock
+    auto const account = ctx.tx[sfAccount];
+    MPTIssue const mptIssue(ctx.tx[sfMPTokenIssuanceID]);
+    if (auto const ter = checkFrozen(ctx.view, account, mptIssue); !isTesSuccess(ter))
+        return ter;
+
+    // Check auth
+    if (auto const ter = requireAuth(ctx.view, mptIssue, account); !isTesSuccess(ter))
+        return ter;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialMPTMergeInbox::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+    auto sleMptoken = view().peek(keylet::mptoken(mptIssuanceID, accountID_));
+    if (!sleMptoken)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    // sanity check
+    if (!sleMptoken->isFieldPresent(sfConfidentialBalanceSpending) ||
+        !sleMptoken->isFieldPresent(sfConfidentialBalanceInbox) ||
+        !sleMptoken->isFieldPresent(sfHolderEncryptionKey))
+    {
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    // Merge inbox into spending: spending = spending + inbox
+    // This allows holder to use received funds. Without merging, incoming
+    // transfers sit in inbox and cannot be spent or converted back.
+    auto sum = homomorphicAdd(
+        (*sleMptoken)[sfConfidentialBalanceSpending], (*sleMptoken)[sfConfidentialBalanceInbox]);
+    if (!sum)
+    {
+        // LCOV_EXCL_START
+        JLOG(ctx_.journal.error())
+            << "ConfidentialMPTMergeInbox failed homomorphic add for inbox merge.";
+        return tecINTERNAL;
+        // LCOV_EXCL_STOP
+    }
+
+    (*sleMptoken)[sfConfidentialBalanceSpending] = std::move(*sum);
+
+    // Reset inbox to encrypted zero. Must use canonical zero encryption
+    // (deterministic ciphertext) so the ledger state is reproducible.
+    auto zeroEncryption =
+        encryptCanonicalZeroAmount((*sleMptoken)[sfHolderEncryptionKey], accountID_, mptIssuanceID);
+
+    if (!zeroEncryption)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    (*sleMptoken)[sfConfidentialBalanceInbox] = std::move(*zeroEncryption);
+
+    incrementConfidentialVersion(*sleMptoken);
+
+    view().update(sleMptoken);
+    return tesSUCCESS;
+}
+
+void
+ConfidentialMPTMergeInbox::visitInvariantEntry(
+    bool,
+    std::shared_ptr<SLE const> const&,
+    std::shared_ptr<SLE const> const&)
+{
+}
+
+bool
+ConfidentialMPTMergeInbox::finalizeInvariants(
+    STTx const&,
+    TER,
+    XRPAmount,
+    ReadView const&,
+    beast::Journal const&)
+{
+    return true;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp
new file mode 100644
index 0000000000..302b7d239b
--- /dev/null
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp
@@ -0,0 +1,445 @@
+#include <xrpl/tx/transactors/token/ConfidentialMPTSend.h>
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/CredentialHelpers.h>
+#include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <memory>
+#include <optional>
+#include <utility>
+
+namespace xrpl {
+
+bool
+ConfidentialMPTSend::checkExtraFeatures(PreflightContext const& ctx)
+{
+    return !ctx.tx.isFieldPresent(sfCredentialIDs) || ctx.rules.enabled(featureCredentials);
+}
+
+NotTEC
+ConfidentialMPTSend::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    auto const account = ctx.tx[sfAccount];
+    auto const issuer = MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer();
+
+    // ConfidentialMPTSend only allows holder to holder, holder to second account,
+    // and second account to holder transfers. So issuer cannot be the sender.
+    if (account == issuer)
+        return temMALFORMED;
+
+    // Can not send to self
+    if (account == ctx.tx[sfDestination])
+        return temMALFORMED;
+
+    // Issuer cannot be the destination
+    if (ctx.tx[sfDestination] == issuer)
+        return temMALFORMED;
+
+    // Check the length of the encrypted amounts
+    if (ctx.tx[sfSenderEncryptedAmount].length() != kEcGamalEncryptedTotalLength ||
+        ctx.tx[sfDestinationEncryptedAmount].length() != kEcGamalEncryptedTotalLength ||
+        ctx.tx[sfIssuerEncryptedAmount].length() != kEcGamalEncryptedTotalLength)
+    {
+        return temBAD_CIPHERTEXT;
+    }
+
+    bool const hasAuditor = ctx.tx.isFieldPresent(sfAuditorEncryptedAmount);
+    if (hasAuditor && ctx.tx[sfAuditorEncryptedAmount].length() != kEcGamalEncryptedTotalLength)
+        return temBAD_CIPHERTEXT;
+
+    // Check the length of the ZKProof (fixed size regardless of recipient count)
+    if (ctx.tx[sfZKProof].length() != kEcSendProofLength)
+        return temMALFORMED;
+
+    // Check the Pedersen commitments are valid
+    if (!isValidCompressedECPoint(ctx.tx[sfBalanceCommitment]) ||
+        !isValidCompressedECPoint(ctx.tx[sfAmountCommitment]))
+    {
+        return temMALFORMED;
+    }
+
+    // Check the encrypted amount formats, this is more expensive so put it at
+    // the end
+    if (!isValidCiphertext(ctx.tx[sfSenderEncryptedAmount]) ||
+        !isValidCiphertext(ctx.tx[sfDestinationEncryptedAmount]) ||
+        !isValidCiphertext(ctx.tx[sfIssuerEncryptedAmount]))
+    {
+        return temBAD_CIPHERTEXT;
+    }
+
+    if (hasAuditor && !isValidCiphertext(ctx.tx[sfAuditorEncryptedAmount]))
+        return temBAD_CIPHERTEXT;
+
+    if (auto const err = credentials::checkFields(ctx.tx, ctx.j); !isTesSuccess(err))
+        return err;
+
+    return tesSUCCESS;
+}
+
+XRPAmount
+ConfidentialMPTSend::calculateBaseFee(ReadView const& view, STTx const& tx)
+{
+    return Transactor::calculateBaseFee(view, tx, kConfidentialFeeMultiplier);
+}
+
+namespace detail {
+
+static TER
+verifySendProofs(
+    PreclaimContext const& ctx,
+    std::shared_ptr<SLE const> const& sleSenderMPToken,
+    std::shared_ptr<SLE const> const& sleDestinationMPToken,
+    std::shared_ptr<SLE const> const& sleIssuance)
+{
+    // Sanity check
+    if (!sleSenderMPToken || !sleDestinationMPToken || !sleIssuance)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const hasAuditor = ctx.tx.isFieldPresent(sfAuditorEncryptedAmount);
+
+    std::optional<ConfidentialRecipient> auditor;
+    if (hasAuditor)
+    {
+        auditor.emplace(
+            ConfidentialRecipient{
+                .publicKey = (*sleIssuance)[sfAuditorEncryptionKey],
+                .encryptedAmount = ctx.tx[sfAuditorEncryptedAmount],
+            });
+    }
+
+    auto const contextHash = getSendContextHash(
+        ctx.tx[sfAccount],
+        ctx.tx[sfMPTokenIssuanceID],
+        ctx.tx.getSeqProxy().value(),
+        ctx.tx[sfDestination],
+        (*sleSenderMPToken)[~sfConfidentialBalanceVersion].value_or(0));
+
+    return verifySendProof(
+        ctx.tx[sfZKProof],
+        {
+            .publicKey = (*sleSenderMPToken)[sfHolderEncryptionKey],
+            .encryptedAmount = ctx.tx[sfSenderEncryptedAmount],
+        },
+        {
+            .publicKey = (*sleDestinationMPToken)[sfHolderEncryptionKey],
+            .encryptedAmount = ctx.tx[sfDestinationEncryptedAmount],
+        },
+        {
+            .publicKey = (*sleIssuance)[sfIssuerEncryptionKey],
+            .encryptedAmount = ctx.tx[sfIssuerEncryptedAmount],
+        },
+        auditor,
+        (*sleSenderMPToken)[sfConfidentialBalanceSpending],
+        ctx.tx[sfAmountCommitment],
+        ctx.tx[sfBalanceCommitment],
+        contextHash);
+}
+
+}  // namespace detail
+
+TER
+ConfidentialMPTSend::preclaim(PreclaimContext const& ctx)
+{
+    // Check if sender account exists
+    auto const account = ctx.tx[sfAccount];
+    if (!ctx.view.exists(keylet::account(account)))
+        return terNO_ACCOUNT;
+
+    // Check if destination account exists
+    auto const destination = ctx.tx[sfDestination];
+    auto const sleDst = ctx.view.read(keylet::account(destination));
+    if (!sleDst)
+        return tecNO_TARGET;
+
+    // Check destination tag
+    if (((sleDst->getFlags() & lsfRequireDestTag) != 0u) &&
+        !ctx.tx.isFieldPresent(sfDestinationTag))
+    {
+        return tecDST_TAG_NEEDED;
+    }
+
+    // Check if MPT issuance exists
+    auto const mptIssuanceID = ctx.tx[sfMPTokenIssuanceID];
+    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    // Check if the issuance allows transfer
+    if (!sleIssuance->isFlag(lsfMPTCanTransfer))
+        return tecNO_AUTH;
+
+    // Check if issuance allows confidential transfer
+    if (!sleIssuance->isFlag(lsfMPTCanHoldConfidentialBalance))
+        return tecNO_PERMISSION;
+
+    // Sanity check: transfer fee must be 0 for confidential MPTs. This should
+    // be unreachable in valid ledger state because MPTokenIssuanceCreate and
+    // MPTokenIssuanceSet enforce it.
+    if ((*sleIssuance)[~sfTransferFee].value_or(0) > 0)
+        return tecNO_PERMISSION;
+
+    // Check if issuance has issuer ElGamal public key
+    if (!sleIssuance->isFieldPresent(sfIssuerEncryptionKey))
+        return tecNO_PERMISSION;
+
+    bool const hasAuditor = ctx.tx.isFieldPresent(sfAuditorEncryptedAmount);
+    bool const requiresAuditor = sleIssuance->isFieldPresent(sfAuditorEncryptionKey);
+
+    // Tx must include auditor ciphertext if the issuance has enabled
+    // auditing, and must not include it if auditing is not enabled
+    if (requiresAuditor != hasAuditor)
+        return tecNO_PERMISSION;
+
+    // Sanity check: issuer isn't the sender
+    if (sleIssuance->getAccountID(sfIssuer) == ctx.tx[sfAccount])
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    // Check sender's MPToken existence
+    auto const sleSenderMPToken = ctx.view.read(keylet::mptoken(mptIssuanceID, account));
+    if (!sleSenderMPToken)
+        return tecOBJECT_NOT_FOUND;
+
+    // Check sender's MPToken has necessary fields for confidential send
+    if (!sleSenderMPToken->isFieldPresent(sfHolderEncryptionKey) ||
+        !sleSenderMPToken->isFieldPresent(sfConfidentialBalanceSpending) ||
+        !sleSenderMPToken->isFieldPresent(sfIssuerEncryptedBalance))
+    {
+        return tecNO_PERMISSION;
+    }
+
+    // Check destination's MPToken existence
+    auto const sleDestinationMPToken = ctx.view.read(keylet::mptoken(mptIssuanceID, destination));
+    if (!sleDestinationMPToken)
+        return tecOBJECT_NOT_FOUND;
+
+    // Check destination's MPToken has necessary fields for confidential send
+    if (!sleDestinationMPToken->isFieldPresent(sfHolderEncryptionKey) ||
+        !sleDestinationMPToken->isFieldPresent(sfConfidentialBalanceInbox) ||
+        !sleDestinationMPToken->isFieldPresent(sfIssuerEncryptedBalance))
+    {
+        return tecNO_PERMISSION;
+    }
+
+    // Sanity check: Both MPTokens' auditor fields must be present if auditing
+    // is enabled
+    if (requiresAuditor &&
+        (!sleSenderMPToken->isFieldPresent(sfAuditorEncryptedBalance) ||
+         !sleDestinationMPToken->isFieldPresent(sfAuditorEncryptedBalance)))
+    {
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    // Check lock
+    MPTIssue const mptIssue(mptIssuanceID);
+    if (auto const ter = checkFrozen(ctx.view, account, mptIssue); !isTesSuccess(ter))
+        return ter;
+
+    if (auto const ter = checkFrozen(ctx.view, destination, mptIssue); !isTesSuccess(ter))
+        return ter;
+
+    // Check auth
+    if (auto const ter = requireAuth(ctx.view, mptIssue, account); !isTesSuccess(ter))
+        return ter;
+
+    if (auto const ter = requireAuth(ctx.view, mptIssue, destination); !isTesSuccess(ter))
+        return ter;
+
+    if (auto const err = credentials::valid(ctx.tx, ctx.view, ctx.tx[sfAccount], ctx.j);
+        !isTesSuccess(err))
+        return err;
+
+    // Check deposit preauth before the expensive ZK proof verification.
+    // Uses read-only view.
+    auto const preauthErr =
+        checkDepositPreauth(ctx.tx, ctx.view, account, destination, sleDst, ctx.j);
+    if (!isTesSuccess(preauthErr))
+        return preauthErr;
+
+    return detail::verifySendProofs(ctx, sleSenderMPToken, sleDestinationMPToken, sleIssuance);
+}
+
+TER
+ConfidentialMPTSend::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+    auto const destination = ctx_.tx[sfDestination];
+
+    auto sleSenderMPToken = view().peek(keylet::mptoken(mptIssuanceID, accountID_));
+    auto sleDestinationMPToken = view().peek(keylet::mptoken(mptIssuanceID, destination));
+    auto const sleIssuance = view().read(keylet::mptokenIssuance(mptIssuanceID));
+
+    auto const sleDestAcct = view().read(keylet::account(destination));
+
+    if (!sleSenderMPToken || !sleDestinationMPToken || !sleIssuance || !sleDestAcct)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    // Deposit preauth authorization was already verified in preclaim.
+    // Remove any expired credentials.
+    if (auto err = cleanupExpiredCredentials(ctx_.tx, ctx_.view(), ctx_.journal);
+        !isTesSuccess(err))
+        return err;
+
+    auto const senderEc = ctx_.tx[sfSenderEncryptedAmount];
+    auto const destEc = ctx_.tx[sfDestinationEncryptedAmount];
+    auto const issuerEc = ctx_.tx[sfIssuerEncryptedAmount];
+    auto const proof = ctx_.tx[sfZKProof];
+    Slice const sendChallenge{proof.data(), kEcBlindingFactorLength};
+
+    auto const auditorEc = ctx_.tx[~sfAuditorEncryptedAmount];
+
+    // Subtract from sender's spending balance
+    {
+        auto const curSpending = (*sleSenderMPToken)[sfConfidentialBalanceSpending];
+        auto newSpending = homomorphicSubtract(curSpending, senderEc);
+        if (!newSpending)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTSend failed homomorphic subtract for sender spending balance.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleSenderMPToken)[sfConfidentialBalanceSpending] = std::move(*newSpending);
+    }
+
+    // Subtract from issuer's balance
+    {
+        auto const curIssuerEnc = (*sleSenderMPToken)[sfIssuerEncryptedBalance];
+        auto newIssuerEnc = homomorphicSubtract(curIssuerEnc, issuerEc);
+        if (!newIssuerEnc)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTSend failed homomorphic subtract for sender issuer balance.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleSenderMPToken)[sfIssuerEncryptedBalance] = std::move(*newIssuerEnc);
+    }
+
+    // Subtract from auditor's balance if present
+    if (auditorEc)
+    {
+        auto const curAuditorEnc = (*sleSenderMPToken)[sfAuditorEncryptedBalance];
+        auto newAuditorEnc = homomorphicSubtract(curAuditorEnc, *auditorEc);
+        if (!newAuditorEnc)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTSend failed homomorphic subtract for sender auditor balance.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleSenderMPToken)[sfAuditorEncryptedBalance] = std::move(*newAuditorEnc);
+    }
+
+    // Add to destination's inbox balance
+    {
+        auto rerandomizedDestEc = rerandomizeCiphertext(
+            destEc, (*sleDestinationMPToken)[sfHolderEncryptionKey], sendChallenge);
+        if (!rerandomizedDestEc)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const curInbox = (*sleDestinationMPToken)[sfConfidentialBalanceInbox];
+        auto newInbox = homomorphicAdd(curInbox, *rerandomizedDestEc);
+        if (!newInbox)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTSend failed homomorphic add for destination inbox.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleDestinationMPToken)[sfConfidentialBalanceInbox] = std::move(*newInbox);
+    }
+
+    // Add to issuer's balance
+    {
+        auto rerandomizedIssuerEc =
+            rerandomizeCiphertext(issuerEc, (*sleIssuance)[sfIssuerEncryptionKey], sendChallenge);
+        if (!rerandomizedIssuerEc)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const curIssuerEnc = (*sleDestinationMPToken)[sfIssuerEncryptedBalance];
+        auto newIssuerEnc = homomorphicAdd(curIssuerEnc, *rerandomizedIssuerEc);
+        if (!newIssuerEnc)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTSend failed homomorphic add for destination issuer balance.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleDestinationMPToken)[sfIssuerEncryptedBalance] = std::move(*newIssuerEnc);
+    }
+
+    // Add to auditor's balance if present
+    if (auditorEc)
+    {
+        auto rerandomizedAuditorEc = rerandomizeCiphertext(
+            *auditorEc, (*sleIssuance)[sfAuditorEncryptionKey], sendChallenge);
+        if (!rerandomizedAuditorEc)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const curAuditorEnc = (*sleDestinationMPToken)[sfAuditorEncryptedBalance];
+        auto newAuditorEnc = homomorphicAdd(curAuditorEnc, *rerandomizedAuditorEc);
+        if (!newAuditorEnc)
+        {
+            // LCOV_EXCL_START
+            JLOG(ctx_.journal.error())
+                << "ConfidentialMPTSend failed homomorphic add for destination auditor balance.";
+            return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        (*sleDestinationMPToken)[sfAuditorEncryptedBalance] = std::move(*newAuditorEnc);
+    }
+
+    // increment sender version only; receiver version is not modified by incoming sends
+    incrementConfidentialVersion(*sleSenderMPToken);
+
+    view().update(sleSenderMPToken);
+    view().update(sleDestinationMPToken);
+    return tesSUCCESS;
+}
+
+void
+ConfidentialMPTSend::visitInvariantEntry(
+    bool,
+    std::shared_ptr<SLE const> const&,
+    std::shared_ptr<SLE const> const&)
+{
+}
+
+bool
+ConfidentialMPTSend::finalizeInvariants(
+    STTx const&,
+    TER,
+    XRPAmount,
+    ReadView const&,
+    beast::Journal const&)
+{
+    return true;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp b/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
index e1d9daaada..6db37515cb 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
@@ -83,6 +83,25 @@ MPTokenAuthorize::preclaim(PreclaimContext const& ctx)
             if (ctx.view.rules().enabled(featureSingleAssetVault) && sleMpt->isFlag(lsfMPTLocked))
                 return tecNO_PERMISSION;
 
+            if (ctx.view.rules().enabled(featureConfidentialTransfer))
+            {
+                auto const sleMptIssuance =
+                    ctx.view.read(keylet::mptokenIssuance(ctx.tx[sfMPTokenIssuanceID]));
+
+                // if there still existing encrypted balances of MPT in
+                // circulation
+                if (sleMptIssuance &&
+                    (*sleMptIssuance)[~sfConfidentialOutstandingAmount].value_or(0) != 0)
+                {
+                    // this MPT still has encrypted balance, since we don't know
+                    // if it's non-zero or not, we won't allow deletion of
+                    // MPToken
+                    if (sleMpt->isFieldPresent(sfConfidentialBalanceInbox) ||
+                        sleMpt->isFieldPresent(sfConfidentialBalanceSpending))
+                        return tecHAS_OBLIGATIONS;
+                }
+            }
+
             return tesSUCCESS;
         }
 
diff --git a/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp b/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
index 68956a533d..e30127b688 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
@@ -37,7 +37,15 @@ MPTokenIssuanceCreate::checkExtraFeatures(PreflightContext const& ctx)
     if (ctx.tx.isFieldPresent(sfMutableFlags) && !ctx.rules.enabled(featureDynamicMPT))
         return false;
 
-    return true;
+    if (ctx.tx.isFlag(tfMPTCanHoldConfidentialBalance) &&
+        !ctx.rules.enabled(featureConfidentialTransfer))
+        return false;
+
+    // can not set tmfMPTCannotEnableCanHoldConfidentialBalance without featureConfidentialTransfer
+    auto const mutableFlags = ctx.tx[~sfMutableFlags];
+    return !mutableFlags ||
+        ((*mutableFlags & tmfMPTCannotEnableCanHoldConfidentialBalance) == 0u) ||
+        ctx.rules.enabled(featureConfidentialTransfer);
 }
 
 std::uint32_t
@@ -70,6 +78,10 @@ MPTokenIssuanceCreate::preflight(PreflightContext const& ctx)
         // must also be set.
         if (fee > 0u && !ctx.tx.isFlag(tfMPTCanTransfer))
             return temMALFORMED;
+
+        // Confidential amounts are encrypted so transfer rate is disallowed.
+        if (fee > 0u && ctx.tx.isFlag(tfMPTCanHoldConfidentialBalance))
+            return temBAD_TRANSFER_FEE;
     }
 
     if (auto const domain = ctx.tx[~sfDomainID])
diff --git a/src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp b/src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp
index e200c9762a..d526251069 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp
@@ -5,6 +5,7 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
@@ -74,11 +75,27 @@ MPTokenIssuanceSet::preflight(PreflightContext const& ctx)
     auto const metadata = ctx.tx[~sfMPTokenMetadata];
     auto const transferFee = ctx.tx[~sfTransferFee];
     auto const isMutate = mutableFlags || metadata || transferFee;
+    auto const hasIssuerElGamalKey = ctx.tx.isFieldPresent(sfIssuerEncryptionKey);
+    auto const hasAuditorElGamalKey = ctx.tx.isFieldPresent(sfAuditorEncryptionKey);
+    auto const txFlags = ctx.tx.getFlags();
+
+    bool const enablePrivacy =
+        mutableFlags && (*mutableFlags & tmfMPTSetCanHoldConfidentialBalance) != 0u;
+
+    auto const hasDomain = ctx.tx.isFieldPresent(sfDomainID);
+    auto const hasHolder = ctx.tx.isFieldPresent(sfHolder);
 
     if (isMutate && !ctx.rules.enabled(featureDynamicMPT))
         return temDISABLED;
 
-    if (ctx.tx.isFieldPresent(sfDomainID) && ctx.tx.isFieldPresent(sfHolder))
+    if ((hasIssuerElGamalKey || hasAuditorElGamalKey || enablePrivacy) &&
+        !ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    if (hasDomain && hasHolder)
+        return temMALFORMED;
+
+    if (enablePrivacy && hasHolder)
         return temMALFORMED;
 
     // fails if both flags are set
@@ -90,10 +107,12 @@ MPTokenIssuanceSet::preflight(PreflightContext const& ctx)
     if (holderID && accountID == holderID)
         return temMALFORMED;
 
-    if (ctx.rules.enabled(featureSingleAssetVault) || ctx.rules.enabled(featureDynamicMPT))
+    if (ctx.rules.enabled(featureSingleAssetVault) || ctx.rules.enabled(featureDynamicMPT) ||
+        ctx.rules.enabled(featureConfidentialTransfer))
     {
         // Is this transaction actually changing anything ?
-        if (ctx.tx.getFlags() == 0 && !ctx.tx.isFieldPresent(sfDomainID) && !isMutate)
+        if (txFlags == 0 && !hasDomain && !hasIssuerElGamalKey && !hasAuditorElGamalKey &&
+            !isMutate)
             return temMALFORMED;
     }
 
@@ -110,6 +129,9 @@ MPTokenIssuanceSet::preflight(PreflightContext const& ctx)
         if (transferFee && *transferFee > kMaxTransferFee)
             return temBAD_TRANSFER_FEE;
 
+        if (transferFee && *transferFee > 0u && enablePrivacy)
+            return temBAD_TRANSFER_FEE;
+
         if (metadata && metadata->length() > kMaxMpTokenMetadataLength)
             return temMALFORMED;
 
@@ -120,6 +142,18 @@ MPTokenIssuanceSet::preflight(PreflightContext const& ctx)
         }
     }
 
+    if (hasHolder && (hasIssuerElGamalKey || hasAuditorElGamalKey))
+        return temMALFORMED;
+
+    if (hasAuditorElGamalKey && !hasIssuerElGamalKey)
+        return temMALFORMED;
+
+    if (hasIssuerElGamalKey && !isValidCompressedECPoint(ctx.tx[sfIssuerEncryptionKey]))
+        return temMALFORMED;
+
+    if (hasAuditorElGamalKey && !isValidCompressedECPoint(ctx.tx[sfAuditorEncryptionKey]))
+        return temMALFORMED;
+
     return tesSUCCESS;
 }
 
@@ -181,12 +215,20 @@ MPTokenIssuanceSet::preclaim(PreclaimContext const& ctx)
         return currentMutableFlags & mutableFlag;
     };
 
-    if (auto const mutableFlags = ctx.tx[~sfMutableFlags])
+    auto const mutableFlags = ctx.tx[~sfMutableFlags];
+    // Whether the transaction is enabling confidential amounts.
+    bool const enablesConfidentialAmount =
+        mutableFlags && (*mutableFlags & tmfMPTSetCanHoldConfidentialBalance) != 0u;
+    if (mutableFlags)
     {
         if (std::ranges::any_of(kMptMutabilityFlags, [mutableFlags, &isMutableFlag](auto const& f) {
                 return !isMutableFlag(f.canEnableFlag) && ((*mutableFlags & f.setFlag) != 0u);
             }))
             return tecNO_PERMISSION;
+
+        if (enablesConfidentialAmount &&
+            isMutableFlag(lsmfMPTCannotEnableCanHoldConfidentialBalance))
+            return tecNO_PERMISSION;
     }
 
     if (!isMutableFlag(lsmfMPTCanMutateMetadata) && ctx.tx.isFieldPresent(sfMPTokenMetadata))
@@ -201,10 +243,55 @@ MPTokenIssuanceSet::preclaim(PreclaimContext const& ctx)
         if (fee > 0u && !sleMptIssuance->isFlag(lsfMPTCanTransfer))
             return tecNO_PERMISSION;
 
+        // Cannot set a non-zero TransferFee on an issuance that has confidential
+        // transfer enabled
+        if (fee > 0u && sleMptIssuance->isFlag(lsfMPTCanHoldConfidentialBalance))
+            return tecNO_PERMISSION;
+
         if (!isMutableFlag(lsmfMPTCanMutateTransferFee))
             return tecNO_PERMISSION;
     }
 
+    // cannot update issuer public key
+    if (ctx.tx.isFieldPresent(sfIssuerEncryptionKey) &&
+        sleMptIssuance->isFieldPresent(sfIssuerEncryptionKey))
+    {
+        return tecNO_PERMISSION;
+    }
+
+    // cannot update auditor public key
+    if (ctx.tx.isFieldPresent(sfAuditorEncryptionKey) &&
+        sleMptIssuance->isFieldPresent(sfAuditorEncryptionKey))
+    {
+        return tecNO_PERMISSION;  // LCOV_EXCL_LINE
+    }
+
+    if (enablesConfidentialAmount && sleMptIssuance->isFieldPresent(sfTransferFee) &&
+        (*sleMptIssuance)[sfTransferFee] > 0u)
+        return tecNO_PERMISSION;
+
+    // Encryption keys can only be set if confidential amounts are already
+    // enabled on the issuance OR if the transaction is enabling it
+    if (ctx.tx.isFieldPresent(sfIssuerEncryptionKey) &&
+        !sleMptIssuance->isFlag(lsfMPTCanHoldConfidentialBalance) && !enablesConfidentialAmount)
+    {
+        return tecNO_PERMISSION;
+    }
+
+    if (ctx.tx.isFieldPresent(sfAuditorEncryptionKey) &&
+        !sleMptIssuance->isFlag(lsfMPTCanHoldConfidentialBalance) && !enablesConfidentialAmount)
+    {
+        return tecNO_PERMISSION;
+    }
+
+    // cannot upload key if there's circulating supply of COA
+    if ((ctx.tx.isFieldPresent(sfIssuerEncryptionKey) ||
+         ctx.tx.isFieldPresent(sfAuditorEncryptionKey) || enablesConfidentialAmount) &&
+        (*sleMptIssuance)[~sfConfidentialOutstandingAmount].value_or(0) > 0)
+    {
+        return tecNO_PERMISSION;  // LCOV_EXCL_LINE
+    }
+
     return tesSUCCESS;
 }
 
@@ -249,6 +336,9 @@ MPTokenIssuanceSet::doApply()
                 flagsOut |= f.ledgerFlag;
             }
         }
+
+        if ((mutableFlags & tmfMPTSetCanHoldConfidentialBalance) != 0u)
+            flagsOut |= lsfMPTCanHoldConfidentialBalance;
     }
 
     if (flagsIn != flagsOut)
@@ -300,6 +390,26 @@ MPTokenIssuanceSet::doApply()
         }
     }
 
+    if (auto const pubKey = ctx_.tx[~sfIssuerEncryptionKey])
+    {
+        // This is enforced in preflight.
+        XRPL_ASSERT(
+            sle->getType() == ltMPTOKEN_ISSUANCE,
+            "MPTokenIssuanceSet::doApply : modifying MPTokenIssuance");
+
+        sle->setFieldVL(sfIssuerEncryptionKey, *pubKey);
+    }
+
+    if (auto const pubKey = ctx_.tx[~sfAuditorEncryptionKey])
+    {
+        // This is enforced in preflight.
+        XRPL_ASSERT(
+            sle->getType() == ltMPTOKEN_ISSUANCE,
+            "MPTokenIssuanceSet::doApply : modifying MPTokenIssuance");
+
+        sle->setFieldVL(sfAuditorEncryptionKey, *pubKey);
+    }
+
     view().update(sle);
 
     return tesSUCCESS;
diff --git a/src/test/app/ConfidentialTransferExtended_test.cpp b/src/test/app/ConfidentialTransferExtended_test.cpp
new file mode 100644
index 0000000000..0aee7516c9
--- /dev/null
+++ b/src/test/app/ConfidentialTransferExtended_test.cpp
@@ -0,0 +1,2595 @@
+#include <test/jtx/AMM.h>
+#include <test/jtx/Account.h>
+#include <test/jtx/ConfidentialTransfer.h>
+#include <test/jtx/Env.h>
+#include <test/jtx/TestHelpers.h>
+#include <test/jtx/amount.h>
+#include <test/jtx/batch.h>
+#include <test/jtx/credentials.h>
+#include <test/jtx/delegate.h>
+#include <test/jtx/deposit.h>
+#include <test/jtx/flags.h>
+#include <test/jtx/mpt.h>
+#include <test/jtx/owners.h>
+#include <test/jtx/ter.h>
+#include <test/jtx/ticket.h>
+
+#include <xrpl/basics/Buffer.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/strHex.h>
+#include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/jss.h>
+
+#include <chrono>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace xrpl {
+
+class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
+{
+    void
+    testSendDepositPreauth(FeatureBitset features)
+    {
+        testcase("Send deposit preauth");
+        using namespace test::jtx;
+
+        // When an account enables lsfDepositAuth (via asfDepositAuth flag),
+        // it requires explicit authorization before accepting incoming payments.
+        //
+        // There are two authorization mechanisms:
+        //
+        // 1. DIRECT ACCOUNT AUTHORIZATION (deposit::auth)
+        //    - Bob directly authorizes Carol: deposit::auth(bob, carol)
+        //    - Simple 1-to-1 trust relationship
+        //    - Carol can send to Bob without credentials
+        //
+        // 2. CREDENTIAL-BASED AUTHORIZATION (deposit::authCredentials)
+        //    - A trusted third party (dpIssuer) issues credentials
+        //    - Bob authorizes a credential TYPE from an issuer
+        //    - Anyone holding that credential can send to Bob
+        //    - Requires sender to include credential ID in transaction
+
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dpIssuer("dpIssuer");
+        char const credType[] = "KYC_VERIFIED";
+
+        // Create and accept credential for an account
+        auto createCredential = [&](Env& env, Account const& subject) -> std::string {
+            env(credentials::create(subject, dpIssuer, credType));
+            env.close();
+            env(credentials::accept(subject, dpIssuer, credType));
+            env.close();
+            auto const jv = credentials::ledgerEntry(env, subject, dpIssuer, credType);
+            return jv[jss::result][jss::index].asString();
+        };
+
+        // TEST 1: Direct Account Authorization
+        {
+            Env env(*this, features);
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+            env(fset(bob, asfDepositAuth));
+            env.close();
+
+            // Carol cannot send to Bob without authorization
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .err = tecNO_PERMISSION,
+            });
+
+            // Bob directly authorizes Carol
+            env(deposit::auth(bob, carol));
+            env.close();
+
+            // Now Carol can send to Bob
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+            });
+            mpt.mergeInbox({
+                .account = bob,
+            });
+
+            // Bob revokes Carol's authorization
+            env(deposit::unauth(bob, carol));
+            env.close();
+
+            // Carol can no longer send to Bob
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // TEST 2: Credential-Based Authorization
+        {
+            Env env(*this, features);
+            env.fund(XRP(50000), dpIssuer);
+            env.close();
+
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+            env(fset(bob, asfDepositAuth));
+            env.close();
+
+            auto const credIdx = createCredential(env, carol);
+
+            // Carol cannot send yet - Bob hasn't authorized this credential type
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{credIdx}},
+                .err = tecNO_PERMISSION,
+            });
+
+            // Bob authorizes the credential type from dpIssuer
+            env(deposit::authCredentials(bob, {{.issuer = dpIssuer, .credType = credType}}));
+            env.close();
+
+            // Carol still cannot send without including credential
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .err = tecNO_PERMISSION,
+            });
+
+            // Carol CAN send when including her credential
+            mpt.send({.account = carol, .dest = bob, .amt = 10, .credentials = {{credIdx}}});
+            mpt.mergeInbox({
+                .account = bob,
+            });
+        }
+
+        // TEST 3: Direct Auth Takes Precedence Over Credentials
+        {
+            Env env(*this, features);
+            env.fund(XRP(50000), dpIssuer);
+            env.close();
+
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+            env(fset(bob, asfDepositAuth));
+            env.close();
+
+            auto const credIdx = createCredential(env, carol);
+
+            // Bob directly authorizes Carol (no credential needed)
+            env(deposit::auth(bob, carol));
+            env.close();
+
+            // Carol can send without credentials (direct auth)
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+            });
+            mpt.mergeInbox({
+                .account = bob,
+            });
+
+            // Carol can also send WITH credentials (still works)
+            mpt.send({.account = carol, .dest = bob, .amt = 10, .credentials = {{credIdx}}});
+            mpt.mergeInbox({
+                .account = bob,
+            });
+
+            // Bob revokes direct authorization
+            env(deposit::unauth(bob, carol));
+            env.close();
+
+            // Carol cannot send without credentials anymore
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .err = tecNO_PERMISSION,
+            });
+
+            // But credential-based auth not set up, so this also fails
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{credIdx}},
+                .err = tecNO_PERMISSION,
+            });
+
+            // Bob authorizes the credential type
+            env(deposit::authCredentials(bob, {{.issuer = dpIssuer, .credType = credType}}));
+            env.close();
+
+            // Now Carol can send with credentials
+            mpt.send({.account = carol, .dest = bob, .amt = 10, .credentials = {{credIdx}}});
+        }
+
+        auto const expireTime = 30;
+
+        // Lambda function that returns the credential index after creating a
+        // credential that expires shortly after the current ledger time.
+        auto createExpiringCredential = [&](Env& env, Account const& subject) -> std::string {
+            auto jv = credentials::create(subject, dpIssuer, credType);
+            auto const expiry =
+                env.current()->header().parentCloseTime.time_since_epoch().count() + expireTime;
+            jv[sfExpiration.jsonName] = expiry;
+            env(jv);
+            env.close();
+            env(credentials::accept(subject, dpIssuer, credType));
+            env.close();
+            auto const credentials = credentials::ledgerEntry(env, subject, dpIssuer, credType);
+            return credentials[jss::result][jss::index].asString();
+        };
+
+        auto credentialDeleted = [&](Env& env, Account const& subject) -> bool {
+            auto const credentials = credentials::ledgerEntry(env, subject, dpIssuer, credType);
+            return credentials[jss::result].isMember(jss::error) &&
+                credentials[jss::result][jss::error] == "entryNotFound";
+        };
+
+        // TEST 4: Expired credential with matching depositPreauth entry.
+        // checkDepositPreauth in preclaim returns tesSUCCESS (the expired
+        // credential still exists and matches the depositPreauth key), so ZK
+        // proofs run. cleanupExpiredCredentials in doApply then removes the
+        // expired credential and returns tecEXPIRED.
+        {
+            Env env(*this, features);
+            env.fund(XRP(50000), dpIssuer);
+            env.close();
+
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+            env(fset(bob, asfDepositAuth));
+            env.close();
+
+            auto const credIdx = createExpiringCredential(env, carol);
+
+            // Bob authorizes carol's credential type
+            env(deposit::authCredentials(bob, {{.issuer = dpIssuer, .credType = credType}}));
+            env.close();
+
+            // Advance ledger past credential expiration
+            env.close(std::chrono::seconds(expireTime));
+
+            // Send fails with tecEXPIRED; the expired credential is cleaned up
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{credIdx}},
+                .err = tecEXPIRED,
+            });
+            env.close();
+
+            BEAST_EXPECT(credentialDeleted(env, carol));
+        }
+
+        // TEST 5: Expired credential, destination has no depositAuth.
+        // checkDepositPreauth in preclaim returns tesSUCCESS even with expired credentials,
+        // because we want to keep the checkDepositPreauth part before the expensive proof
+        // verification. cleanupExpiredCredentials in doApply removes the expired credential and
+        // returns tecEXPIRED.
+        {
+            Env env(*this, features);
+            env.fund(XRP(50000), dpIssuer);
+            env.close();
+
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+
+            auto const credIdx = createExpiringCredential(env, carol);
+
+            // Advance ledger past credential expiration
+            env.close(std::chrono::seconds(expireTime));
+
+            // Send fails with tecEXPIRED; the expired credential is cleaned up
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{credIdx}},
+                .err = tecEXPIRED,
+            });
+            env.close();
+
+            BEAST_EXPECT(credentialDeleted(env, carol));
+        }
+
+        // TEST 6: Expired credential, depositAuth enabled but credential
+        // not authorized by bob.
+        // checkDepositPreauth in preclaim calls checkDepositPreauth which
+        // finds no match and returns tecNO_PERMISSION. doApply never runs, so
+        // the expired credential is not cleaned up by this transaction. This is
+        // a deliberate tradeoff: allowing doApply to run solely for cleanup
+        // would require bypassing the preclaim short-circuit, forcing every
+        // validator to run the expensive ZK proof verification before
+        // discovering the authorization failure. Expired credentials here will
+        // be cleaned up opportunistically by a future transaction that
+        // references them.
+        {
+            Env env(*this, features);
+            env.fund(XRP(50000), dpIssuer);
+            env.close();
+
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+            env(fset(bob, asfDepositAuth));
+            env.close();
+
+            auto const credIdx = createExpiringCredential(env, carol);
+
+            // Advance ledger past credential expiration
+            env.close(std::chrono::seconds(expireTime));
+
+            // Fails with tecNO_PERMISSION.
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{credIdx}},
+                .err = tecNO_PERMISSION,
+            });
+            env.close();
+
+            // Expired credential is not deleted
+            BEAST_EXPECT(!credentialDeleted(env, carol));
+        }
+    }
+
+    void
+    testSendCredentialValidation(FeatureBitset features)
+    {
+        testcase("Send credential validation");
+        using namespace test::jtx;
+
+        // Tests for credentials::checkFields (preflight) and
+        // credentials::valid (preclaim) validation.
+        //
+        // Preflight checks (temMALFORMED):
+        //   - Empty credentials array
+        //   - Array size exceeds maxCredentialsArraySize (8)
+        //   - Duplicate credential IDs in array
+        //
+        // Preclaim checks (tecBAD_CREDENTIALS):
+        //   - Credential doesn't exist
+        //   - Credential doesn't belong to source account
+        //   - Credential not accepted (lsfAccepted flag not set)
+
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dpIssuer("dpIssuer");
+        char const credType[] = "KYC";
+
+        // TEST 1: Preflight - Empty Credentials Array
+        {
+            Env env(*this, features);
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = std::vector<std::string>{},
+                .err = temMALFORMED,
+            });
+        }
+
+        // TEST 2: Preflight - Credentials Array Too Large
+        {
+            Env env(*this, features);
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+
+            std::vector<std::string> tooManyCredentials;
+            tooManyCredentials.reserve(9);
+            for (int i = 0; i < 9; ++i)
+                tooManyCredentials.push_back(to_string(uint256(i)));
+
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = tooManyCredentials,
+                .err = temMALFORMED,
+            });
+        }
+
+        // TEST 3: Preflight - Duplicate Credentials
+        {
+            Env env(*this, features);
+            env.fund(XRP(50000), dpIssuer);
+            env.close();
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+
+            env(credentials::create(carol, dpIssuer, credType));
+            env.close();
+            env(credentials::accept(carol, dpIssuer, credType));
+            env.close();
+
+            auto const jv = credentials::ledgerEntry(env, carol, dpIssuer, credType);
+            std::string const credIdx = jv[jss::result][jss::index].asString();
+
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{credIdx, credIdx}},
+                .err = temMALFORMED,
+            });
+        }
+
+        // TEST 4: Preclaim - Credential Doesn't Exist
+        {
+            Env env(*this, features);
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+
+            std::string const fakeCredIdx = to_string(uint256(999));
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{fakeCredIdx}},
+                .err = tecBAD_CREDENTIALS,
+            });
+        }
+
+        // TEST 5: Preclaim - Credential Doesn't Belong to Source Account
+        {
+            Env env(*this, features);
+            env.fund(XRP(50000), dpIssuer);
+            env.close();
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+
+            // Create credential for BOB (not carol)
+            env(credentials::create(bob, dpIssuer, credType));
+            env.close();
+            env(credentials::accept(bob, dpIssuer, credType));
+            env.close();
+
+            auto const jv = credentials::ledgerEntry(env, bob, dpIssuer, credType);
+            std::string const credIdx = jv[jss::result][jss::index].asString();
+
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{credIdx}},
+                .err = tecBAD_CREDENTIALS,
+            });
+        }
+
+        // TEST 6: Preclaim - Credential Not Accepted
+        {
+            Env env(*this, features);
+            env.fund(XRP(50000), dpIssuer);
+            env.close();
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+
+            // Create credential but DON'T accept it
+            env(credentials::create(carol, dpIssuer, credType));
+            env.close();
+
+            auto const jv = credentials::ledgerEntry(env, carol, dpIssuer, credType);
+            std::string const credIdx = jv[jss::result][jss::index].asString();
+
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{credIdx}},
+                .err = tecBAD_CREDENTIALS,
+            });
+        }
+
+        // TEST 7: Preflight - sfCredentialIDs requires featureCredentials.
+        // Even with featureConfidentialTransfer enabled, supplying
+        // CredentialIDs while featureCredentials is disabled must be
+        // rejected in preflight via checkExtraFeatures.
+        {
+            Env env(*this, features - featureCredentials);
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50},
+                 {.account = carol, .payAmount = 100, .convertAmount = 50}}};
+            auto& mpt = confEnv.mpt;
+
+            auto constexpr kCredIdx =
+                "48004829F915654A81B11C4AB8218D96FED67F209B58328A72314FB6EA288BE4";
+
+            mpt.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 10,
+                .credentials = {{kCredIdx}},
+                .err = temDISABLED,
+            });
+        }
+    }
+
+    // Bob creates the AMM, but Bob is not the MPT holder checked below.
+    // The AMM has its own pseudo-account (`ammHolder`) that can hold the
+    // public MPT pool balance. That pseudo-account cannot normally
+    // initialize confidential state because the confidential txn's must be
+    // signed by sfAccount, and the AMM pseudo-account has no signing key.
+    // So this is a construction/impossibility test: public AMM MPT state exists
+    // but the corresponding confidential AMM clawback flow is not normally reachable.
+    void
+    testAMMHolderCannotHaveConfidentialStateClawback(FeatureBitset features)
+    {
+        testcase("AMM holder cannot have confidential state");
+        using namespace test::jtx;
+
+        Account const alice("alice");
+        Account const bob("bob");
+
+        for (bool const enablePseudoAccount : {false, true})
+        {
+            Env env{
+                *this,
+                enablePseudoAccount ? features | featureSingleAssetVault
+                                    : features - featureSingleAssetVault};
+
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .flags = kMptDexFlags | tfMPTCanClawback | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({.account = bob});
+            mptAlice.pay(alice, bob, 1'000);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            AMM const amm(env, bob, XRP(100), mptAlice(100));
+            Account const ammHolder("amm", amm.ammAccount());
+            auto const ammSle = env.le(keylet::account(ammHolder.id()));
+
+            BEAST_EXPECT(ammSle && ammSle->isFieldPresent(sfAMMID));
+            BEAST_EXPECT(mptAlice.getBalance(ammHolder) == 100);
+
+            BEAST_EXPECT(!mptAlice.getEncryptedBalance(ammHolder, MPTTester::holderEncryptedInbox));
+            BEAST_EXPECT(
+                !mptAlice.getEncryptedBalance(ammHolder, MPTTester::holderEncryptedSpending));
+            BEAST_EXPECT(
+                !mptAlice.getEncryptedBalance(ammHolder, MPTTester::issuerEncryptedBalance));
+            BEAST_EXPECT(
+                !mptAlice.getEncryptedBalance(ammHolder, MPTTester::auditorEncryptedBalance));
+
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = ammHolder,
+                .amt = 100,
+                .proof = strHex(gMakeZeroBuffer(kEcClawbackProofLength)),
+                .err = tecNO_PERMISSION,
+            });
+        }
+    }
+
+    // Exercises every Confidential Transfer transaction type (MPTokenIssuanceSet,
+    // Convert, MergeInbox, Send, ConvertBack) using tickets instead of regular account
+    // sequence numbers.
+    void
+    testWithTickets(FeatureBitset features)
+    {
+        testcase("Confidential transfer with tickets");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.authorize({.account = carol});
+        mptAlice.pay(alice, bob, 100);
+        mptAlice.pay(alice, carol, 100);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.generateKeyPair(carol);
+
+        // MPTokenIssuanceSet with ticket, registers alice's issuer key.
+        {
+            std::uint32_t const ticketSeq = env.seq(alice) + 1;
+            env(ticket::create(alice, 1));
+            mptAlice.set({.issuerPubKey = mptAlice.getPubKey(alice), .ticketSeq = ticketSeq});
+        }
+
+        // ConfidentialMPTConvert with ticket, first convert registers bob's key.
+        {
+            std::uint32_t const ticketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+            mptAlice.convert({
+                .account = bob,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .ticketSeq = ticketSeq,
+            });
+            env.require(MptBalance(mptAlice, bob, 50));
+        }
+
+        // ConfidentialMPTConvert with ticket
+        {
+            std::uint32_t const ticketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+            mptAlice.convert({.account = bob, .amt = 20, .ticketSeq = ticketSeq});
+            env.require(MptBalance(mptAlice, bob, 30));
+        }
+
+        // ConfidentialMPTMergeInbox with ticket.
+        {
+            std::uint32_t const ticketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+            mptAlice.mergeInbox({.account = bob, .ticketSeq = ticketSeq});
+        }
+
+        mptAlice.convert({.account = carol, .amt = 50, .holderPubKey = mptAlice.getPubKey(carol)});
+        mptAlice.mergeInbox({.account = carol});
+
+        // ConfidentialMPTSend with ticket.
+        {
+            std::uint32_t const ticketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+            mptAlice.send({.account = bob, .dest = carol, .amt = 10, .ticketSeq = ticketSeq});
+        }
+
+        // Merge carol's inbox so her spending balance includes the received send.
+        mptAlice.mergeInbox({.account = carol});
+
+        // ConfidentialMPTConvertBack with ticket.
+        // The convertBack proof context hash must use the ticket sequence.
+        {
+            std::uint32_t const ticketSeq = env.seq(carol) + 1;
+            env(ticket::create(carol, 1));
+            mptAlice.convertBack({.account = carol, .amt = 10, .ticketSeq = ticketSeq});
+            // carol converted 50, received 10 from bob, then converted back 10 → public 60
+            env.require(MptBalance(mptAlice, carol, 60));
+        }
+    }
+
+    // Verifies that cryptographic proofs in Convert transactions are bound to
+    // the ticket sequence rather than the account sequence.
+    // A proof built with the ticket sequence passes.
+    void
+    testConvertTicketProofBinding(FeatureBitset features)
+    {
+        testcase("Convert proof binds to ticket sequence");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .holderCount = 0,
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.pay(alice, bob, 100);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+        mptAlice.generateKeyPair(bob);
+
+        uint64_t const amt = 30;
+        Buffer const bf = generateBlindingFactor();
+        Buffer const holderCt = mptAlice.encryptAmount(bob, amt, bf);
+        Buffer const issuerCt = mptAlice.encryptAmount(alice, amt, bf);
+
+        std::uint32_t const ticketSeq1 = env.seq(bob) + 1;
+        env(ticket::create(bob, 1));
+
+        // Invalid: Schnorr proof built with the account seq (env.seq(bob)) rather
+        // than the ticket seq (ticketSeq1).
+        {
+            BEAST_EXPECT(env.seq(bob) != ticketSeq1);
+            uint256 const badCtxHash =
+                getConvertContextHash(bob, mptAlice.issuanceID(), env.seq(bob));
+            auto const badProof = requireOptional(
+                mptAlice.getSchnorrProof(bob, badCtxHash), "Missing Schnorr Proof.");
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = amt,
+                .proof = strHex(badProof),
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = holderCt,
+                .issuerEncryptedAmt = issuerCt,
+                .blindingFactor = bf,
+                .ticketSeq = ticketSeq1,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        std::uint32_t const ticketSeq2 = env.seq(bob) + 1;
+        env(ticket::create(bob, 1));
+
+        // Valid: proof auto-generated by convert() using ticketSeq2; context hashes match.
+        mptAlice.convert({
+            .account = bob,
+            .amt = amt,
+            .holderPubKey = mptAlice.getPubKey(bob),
+            .holderEncryptedAmt = holderCt,
+            .issuerEncryptedAmt = issuerCt,
+            .blindingFactor = bf,
+            .ticketSeq = ticketSeq2,
+        });
+        env.require(MptBalance(mptAlice, bob, 70));
+    }
+
+    // Exercises ticket-specific error codes for confidential transfer transactions:
+    void
+    testDestinationTag(FeatureBitset features)
+    {
+        testcase("test Destination Tag");
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}},
+            tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance};
+        auto& mptAlice = confEnv.mpt;
+
+        // Set RequireDest on carol
+        env(fset(carol, asfRequireDest));
+        env.close();
+
+        // Send without destination tag — rejected
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 10,
+            .proof = getTrivialSendProofHex(),
+            .senderEncryptedAmt = getTrivialCiphertext(),
+            .destEncryptedAmt = getTrivialCiphertext(),
+            .issuerEncryptedAmt = getTrivialCiphertext(),
+            .amountCommitment = getTrivialCommitment(),
+            .balanceCommitment = getTrivialCommitment(),
+            .err = tecDST_TAG_NEEDED,
+        });
+
+        // Send with destination tag — succeeds (passes preclaim,
+        // reaches ZKP verification with the real proof)
+        mptAlice.send({.account = bob, .dest = carol, .amt = 10, .destinationTag = 42});
+
+        // Verify the destination tag is in the confirmed transaction
+        auto const tx = env.tx();
+        BEAST_EXPECT(tx);
+        BEAST_EXPECT(tx->isFieldPresent(sfDestinationTag));
+        BEAST_EXPECT((*tx)[sfDestinationTag] == 42);
+
+        env(fclear(carol, asfRequireDest));
+        env.close();
+
+        // Send without destination tag when not required — succeeds
+        mptAlice.mergeInbox({.account = carol});
+        mptAlice.send({.account = bob, .dest = carol, .amt = 10});
+    }
+
+    // terPRE_TICKET when the ticket doesn't exist yet, and tefNO_TICKET when
+    // the ticket has already been consumed or was never created.
+    void
+    testTicketErrors(FeatureBitset features)
+    {
+        testcase("Confidential transfer ticket errors");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .holderCount = 0,
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.pay(alice, bob, 100);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+        mptAlice.generateKeyPair(bob);
+
+        // Give bob an inbox balance so MergeInbox has something to merge.
+        mptAlice.convert({.account = bob, .amt = 10, .holderPubKey = mptAlice.getPubKey(bob)});
+
+        // Use MergeInbox as the confidential transfer transaction under test
+        // so that ticket errors are isolated from cryptographic verification.
+
+        // terPRE_TICKET: ticket sequence is far in the future and hasn't been created.
+        mptAlice.mergeInbox(
+            {.account = bob, .ticketSeq = env.seq(bob) + 100, .err = terPRE_TICKET});
+
+        // Create one ticket and use it successfully.
+        std::uint32_t const ticketSeq = env.seq(bob) + 1;
+        env(ticket::create(bob, 1));
+        mptAlice.mergeInbox({.account = bob, .ticketSeq = ticketSeq});
+
+        // tefNO_TICKET: attempt to reuse the same (already-consumed) ticket.
+        mptAlice.mergeInbox({.account = bob, .ticketSeq = ticketSeq, .err = tefNO_TICKET});
+
+        // tefNO_TICKET: ticket sequence is in the past but was never created.
+        mptAlice.mergeInbox({.account = bob, .ticketSeq = 1, .err = tefNO_TICKET});
+    }
+
+    // Bob sends 100 MPT to Carol. Carol Merge Inbox. Carol sends 50 MPT to Dave.
+    // Inner 3rd txn (Carol sends to Dave) fails because the proof is built with
+    // when Carols's spending balance is 0. (before she received funds from Bob)
+    //
+    // Also tests Bob sending to two recipients (Carol and Dave) in a single
+    // batch. Even though Bob has enough balance for both, the second send's
+    // balance-linkage proof becomes incorrect once inner 1 updates Bob's encrypted
+    // spending, so fails
+    void
+    testBatchConfidentialSend(FeatureBitset features)
+    {
+        testcase("Batch confidential send - merge inbox dependency");
+        using namespace test::jtx;
+
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            // bob = A (100 spending), carol = B (0), dave = C (0)
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            // Build the batch:
+            //   Batch Txn 1 bob -> carol 100 : valid proof, bob spending=100
+            //   Batch Txn 2 carol -> mergeInbox : valid JV
+            //   Batch Txn 3 carol->dave 50  : Invalid
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            // 3 signers, Bob, Carol, Dave
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 3);
+
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 100}, bobSeq + 1);
+            auto const jv2 = mpt.mergeInboxJV({.account = carol});
+            auto const jv3 = mpt.sendJV({.account = carol, .dest = dave, .amt = 50}, carolSeq + 1);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Inner(jv3, carolSeq + 1),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // AllOrNothing: inner 3 fails
+            // bob's spending must remain 100; carol's inbox must remain 0.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+        }
+
+        // Bob sends to two recipients (Carol and Dave) in one batch.
+        // Bob has 150, enough for both sends individually.  However, batch txn 1
+        // changes Bob's encrypted spending on the ledger; batch txn 2 was built
+        // against the old enc(150) so its balance-linkage proof is stale.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 150, 0);
+
+            // tfAllOrNothing — rejects the whole batch as 2nd txn proof is incorrect
+            {
+                auto const bobSeq = env.seq(bob);
+                auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+                auto const jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 50}, bobSeq + 1);
+                auto const jv2 = mpt.sendJV({.account = bob, .dest = dave, .amt = 60}, bobSeq + 2);
+
+                env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                    batch::Inner(jv1, bobSeq + 1),
+                    batch::Inner(jv2, bobSeq + 2),
+                    Ter(tesSUCCESS));
+                env.close();
+
+                // Nothing applied: bob stays 150, carol and dave inbox stay 0.
+                BEAST_EXPECT(
+                    mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 150);
+                BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+                BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 0);
+            }
+
+            // If we change batch mode to be tfIndependent — txn 1 applies, inner 2 fails.
+            {
+                auto const bobSeq = env.seq(bob);
+                auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+                auto const jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 50}, bobSeq + 1);
+                auto const jv2 = mpt.sendJV({.account = bob, .dest = dave, .amt = 60}, bobSeq + 2);
+
+                env(batch::outer(bob, bobSeq, batchFee, tfIndependent),
+                    batch::Inner(jv1, bobSeq + 1),
+                    batch::Inner(jv2, bobSeq + 2),
+                    Ter(tesSUCCESS));
+                env.close();
+
+                // bob 150→100, carol inbox 0→50
+                BEAST_EXPECT(
+                    mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+                BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 50);
+                // dave gets nothing
+                BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 0);
+            }
+        }
+
+        // Now, Bob sends Confidential MPT to 2 accounts in one batch.
+        // However this time, the second txn proof is calculated using the
+        // correct encrypted(spending) proof, so it should pass.
+        {
+            // bob has exactly enough for both sends.
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 200, 0);
+
+            {
+                auto const bobSeq = env.seq(bob);
+                auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+                // jv1 is built against the current ledger state (spending=200).
+                auto const jv1 =
+                    mpt.sendJV({.account = bob, .dest = carol, .amt = 100}, bobSeq + 1);
+
+                // Compute post-jv1 state without touching the ledger.
+                auto const chain1 = mpt.chainAfterSend(bob, 100, jv1);
+
+                // jv2 proof is built against predicted spending=100, version=N+1.
+                auto const jv2 =
+                    mpt.sendJV({.account = bob, .dest = dave, .amt = 100}, bobSeq + 2, chain1);
+
+                env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                    batch::Inner(jv1, bobSeq + 1),
+                    batch::Inner(jv2, bobSeq + 2),
+                    Ter(tesSUCCESS));
+                env.close();
+
+                // Both txns applied: bob 200→0, carol inbox=100, dave inbox=100.
+                BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 0);
+                BEAST_EXPECT(
+                    mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 100);
+                BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 100);
+            }
+
+            // Now Bob has 150, but tries to send two 100 in one batch.
+            // This fails because Bob doesn't have enough MPT balance.
+            {
+                Env env2{*this, features};
+                Account const alice2("alice");
+                Account const bob2("bob");
+                Account const carol2("carol");
+                Account const dave2("dave");
+
+                MPTTester mpt2(env2, alice2, {.holders = {bob2, carol2, dave2}});
+                setupBatchEnv(mpt2, alice2, bob2, carol2, dave2, 150, 0);
+
+                auto const bobSeq = env2.seq(bob2);
+                auto const batchFee = batch::calcConfidentialBatchFee(env2, 0, 2);
+
+                auto const jv1 =
+                    mpt2.sendJV({.account = bob2, .dest = carol2, .amt = 100}, bobSeq + 1);
+                auto const chain1 = mpt2.chainAfterSend(bob2, 100, jv1);
+
+                auto const jv2 =
+                    mpt2.sendJV({.account = bob2, .dest = dave2, .amt = 100}, bobSeq + 2, chain1);
+
+                env2(
+                    batch::outer(bob2, bobSeq, batchFee, tfAllOrNothing),
+                    batch::Inner(jv1, bobSeq + 1),
+                    batch::Inner(jv2, bobSeq + 2),
+                    Ter(tesSUCCESS));
+                env2.close();
+
+                // AllOrNothing: inner 2 fails → nothing applied.
+                BEAST_EXPECT(
+                    mpt2.getDecryptedBalance(bob2, MPTTester::holderEncryptedSpending) == 150);
+                BEAST_EXPECT(
+                    mpt2.getDecryptedBalance(carol2, MPTTester::holderEncryptedInbox) == 0);
+                BEAST_EXPECT(mpt2.getDecryptedBalance(dave2, MPTTester::holderEncryptedInbox) == 0);
+            }
+        }
+    }
+    void
+    testBatchConfidentialConvertAndConvertBack(FeatureBitset features)
+    {
+        testcase("Batch confidential convert and convertBack");
+        using namespace test::jtx;
+
+        // convert + convertBack in one AllOrNothing batch, both valid.
+        //
+        // Bob has regular=50, spending=100.
+        // jv1: convert 50 regular → inbox  (Schnorr proof; does NOT touch spending/version)
+        // jv2: convertBack 30 spending → regular  (proof against spending=100, version=V)
+        //
+        // Since jv1 leaves spending and version unchanged, jv2's proof is still
+        // valid when it executes, so both inner txns succeed.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            // bob: spending=100, regular=0 after setupBatchEnv;
+            // pay 50 more to give bob regular MPT to convert in the batch.
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+            mpt.pay(alice, bob, 50);
+
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+            // jv1: convert 50 regular MPT into confidential inbox
+            auto const jv1 = mpt.convertJV({.account = bob, .amt = 50}, bobSeq + 1);
+            // jv2: convert 30 spending back to regular MPT
+            auto const jv2 = mpt.convertBackJV({.account = bob, .amt = 30}, bobSeq + 2);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, bobSeq + 2),
+                Ter(tesSUCCESS));
+            env.close();
+
+            //   regular (mptAmount): 50 (pre) - 50 (convert) + 30 (convertBack) = 30
+            //   spending balance: 100 - 30 = 70
+            //   inbox:    0   + 50 (from convert) = 50
+            env.require(MptBalance(mpt, bob, 30));
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 70);
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedInbox) == 50);
+        }
+
+        // convert + mergeInbox + convertBack, stale convertBack proof.
+        //
+        // jv1: convert 50 regular → inbox
+        // jv2: mergeInbox (inbox 50 → spending, version V → V+1)
+        // jv3: convertBack 30 (proof built against spending=100, version=V)
+        //
+        // After jv2 applies, spending=150 and version=V+1, so jv3's
+        // proof is stale.  AllOrNothing rejects the whole batch.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+            mpt.pay(alice, bob, 50);
+
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 3);
+
+            auto const jv1 = mpt.convertJV({.account = bob, .amt = 50}, bobSeq + 1);
+            auto const jv2 = mpt.mergeInboxJV({.account = bob});
+            // jv3 proof is built against spending=100, version=V (pre-batch)
+            auto const jv3 = mpt.convertBackJV({.account = bob, .amt = 30}, bobSeq + 3);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, bobSeq + 2),
+                batch::Inner(jv3, bobSeq + 3),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // jv3 fails so nothing is applied.
+            env.require(MptBalance(mpt, bob, 50));
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedInbox) == 0);
+        }
+    }
+
+    // Tests a batch containing all four confidential MPT operations, Send,
+    // Convert, ConvertBack, and MergeInbox in a single AllOrNothing batch.
+    void
+    testBatchConfidentialMixTransactions(FeatureBitset features)
+    {
+        testcase("Batch confidential mixed operations");
+        using namespace test::jtx;
+
+        // send(bob→carol) + convert(carol) + convertBack(dave)
+        //  + mergeInbox(carol) in one AllOrNothing batch.
+        //
+        // Setup:
+        //   bob:   spending=100, regular=0
+        //   carol: spending=0,   regular=50
+        //   dave:  spending=50,  regular=0
+        //
+        // After the batch:
+        //   bob   spending: 100 -> 70  (sent 30 to carol)
+        //   carol inbox:    0+30(send)+50(convert)=80 -> merged -> spending=80, inbox=0
+        //   dave  spending: 50 -> 30; regular: 0 -> 20
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            // bob: spending=100. carol: key registered, spending=0.
+            // dave: key registered, spending=0 initially.
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+            // Give carol 50 regular MPT to convert in the batch.
+            mpt.pay(alice, carol, 50);
+            // Give dave 50 regular MPT then convert to confidential spending.
+            mpt.pay(alice, dave, 50);
+            mpt.convert({.account = dave, .amt = 50});
+            mpt.mergeInbox({.account = dave});
+
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const daveSeq = env.seq(dave);
+            // 2 extra signers (carol, dave), 4 inner txns
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 2, 4);
+
+            // jv1: bob sends 30 to carol
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 30}, bobSeq + 1);
+            // jv2: carol converts her 50 regular MPT to confidential
+            auto const jv2 = mpt.convertJV({.account = carol, .amt = 50}, carolSeq);
+            // jv3: dave converts 20 spending back to regular MPT
+            auto const jv3 = mpt.convertBackJV({.account = dave, .amt = 20}, daveSeq);
+            // jv4: carol merges inbox into spending
+            //   (inbox = 30 from jv1 + 50 from jv2 = 80 at execution time)
+            auto const jv4 = mpt.mergeInboxJV({.account = carol});
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Inner(jv3, daveSeq),
+                batch::Inner(jv4, carolSeq + 1),
+                batch::Sig(carol, dave),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // All four applied:
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 70);
+            // carol's inbox was merged: spending=80, inbox=0
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 80);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+            // dave: spending=30, regular=20
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedSpending) == 30);
+            env.require(MptBalance(mpt, dave, 20));
+        }
+
+        // bob send + bob convertBack in one AllOrNothing batch.
+        //
+        // The Send applies first and increments Bob's version counter.
+        // The ConvertBack proof was built against the pre-Send (spending=100,
+        // version=V), so batch txn is rejected.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+            // jv1: bob sends 30 to carol (spending 100->70, version V->V+1)
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 30}, bobSeq + 1);
+            // jv2: bob convertBack 40 , proof built against spending=100, version=V
+            auto const jv2 = mpt.convertBackJV({.account = bob, .amt = 40}, bobSeq + 2);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, bobSeq + 2),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // AllOrNothing: jv2 fails (stale proof) → nothing applied.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+        }
+    }
+
+    // Verifies that batch transactions work correctly when tickets are used instead
+    // of sequence numbers
+    void
+    testBatchAllOrNothing(FeatureBitset features)
+    {
+        testcase("Batch confidential MPT - all or nothing");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+
+        MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+        // bob=100 spending, carol=60 spending, dave=0
+        setupBatchEnv(mpt, alice, bob, carol, dave, 100, 60);
+
+        // bob sends dave 10, carol sends dave 5, independent, both valid.
+        {
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = dave, .amt = 10}, bobSeq + 1);
+            auto const jv2 = mpt.sendJV({.account = carol, .dest = dave, .amt = 5}, carolSeq);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Both txn applied: bob's balance 100→90, carol 60→55, dave inbox 0→15
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 90);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 55);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 15);
+        }
+    }
+
+    void
+    testBatchOnlyOne(FeatureBitset features)
+    {
+        testcase("Batch confidential MPT - only one");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+
+        MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+        // bob=100 spending, carol=60 spending, dave=0
+        setupBatchEnv(mpt, alice, bob, carol, dave, 100, 60);
+
+        // bob sends dave 200 (invalid), carol sends dave 300 (invalid)
+        {
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+
+            // Both proofs fail range check (amount > balance)
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = dave, .amt = 200}, bobSeq + 1);
+            auto const jv2 = mpt.sendJV({.account = carol, .dest = dave, .amt = 300}, carolSeq);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfOnlyOne),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // No success found → nothing applied; balances unchanged
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 60);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 0);
+        }
+
+        // bob sends dave 200 (invalid), carol sends dave 5 (valid)
+        {
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+
+            auto jv1 = mpt.sendJV({.account = bob, .dest = dave, .amt = 200}, bobSeq + 1);
+            auto jv2 = mpt.sendJV({.account = carol, .dest = dave, .amt = 5}, carolSeq);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfOnlyOne),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Only carol's send applied: carol 60→55, dave inbox 0→5, bob unchanged
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 55);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 5);
+        }
+    }
+
+    void
+    testBatchUntilFailure(FeatureBitset features)
+    {
+        testcase("Batch confidential MPT - until failure");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+
+        MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+        // bob=100 spending, carol=60 spending, dave=0
+        setupBatchEnv(mpt, alice, bob, carol, dave, 100, 60);
+
+        // first fails → none applied
+        // Bob sends Dave 200 (invalid — stops immediately)
+        {
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = dave, .amt = 200}, bobSeq + 1);
+            auto const jv2 = mpt.sendJV({.account = carol, .dest = dave, .amt = 5}, carolSeq);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfUntilFailure),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 60);
+        }
+
+        // Bob sends dave 10, Carol sends dave 5 — both valid and independent
+        {
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = dave, .amt = 10}, bobSeq + 1);
+            auto const jv2 = mpt.sendJV({.account = carol, .dest = dave, .amt = 5}, carolSeq);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfUntilFailure),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Both applied: bob 100→90, carol 60→55, dave inbox 0→15
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 90);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 55);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 15);
+        }
+    }
+
+    void
+    testBatchIndependent(FeatureBitset features)
+    {
+        testcase("Batch confidential MPT - independent");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+
+        MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+        // bob=100 spending, carol=60 spending, dave=0
+        setupBatchEnv(mpt, alice, bob, carol, dave, 100, 60);
+
+        // Bob sends dave 10 (valid), Carol sends dave 300
+        // (invalid), Carol sends Dave 5 (valid). Carol's
+        // balance is still 60 because the preceding send failed).
+        {
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 3);
+
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = dave, .amt = 10}, bobSeq + 1);
+
+            // Carol trying to send dave 300 but own balance only 60
+            auto const jv2 = mpt.sendJV({.account = carol, .dest = dave, .amt = 300}, carolSeq);
+            auto const jv3 = mpt.sendJV({.account = carol, .dest = dave, .amt = 5}, carolSeq + 1);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfIndependent),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Inner(jv3, carolSeq + 1),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // inner 1 (bob→dave 10) applied: bob 100→90
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 90);
+            // inner 2 failed (carol not changed), inner 3 applied: carol 60→55
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 55);
+            // dave inbox: 10 (from bob) + 5 (from carol inner 3) = 15
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 15);
+        }
+    }
+
+    // Tests batching ConfidentialMPTConvert and a ConfidentialMPTConvertBack
+    // in the same batch transaction. Because Convert only modifies the inbox
+    // (never the spending balance or the version counter), a ConvertBack proof
+    // built against the pre-batch spending balance is still valid when both
+    // appear in the same batch.
+    void
+    testBatchWithTickets(FeatureBitset features)
+    {
+        testcase("Batch confidential MPT with tickets");
+        using namespace test::jtx;
+
+        // outer batch uses a ticket.
+        // The inner send proofs are still bound to regular account sequences.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            // Bob creates one ticket to use for the outer batch.
+            std::uint32_t const outerTicketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+            env.close();
+
+            auto const bobSeq = env.seq(bob);
+            // 0 extra signers: all inner txns are from bob;
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+            // When the outer uses a ticket (seq=0), inner txns start from bobSeq, bobSeq+1.
+            // jv2 must use chain state predicted after jv1 since both sends are from bob.
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 40}, bobSeq);
+            auto const chain1 = mpt.chainAfterSend(bob, 40, jv1);
+            auto const jv2 =
+                mpt.sendJV({.account = bob, .dest = dave, .amt = 20}, bobSeq + 1, chain1);
+
+            env(batch::outer(bob, 0, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq),
+                batch::Inner(jv2, bobSeq + 1),
+                ticket::Use(outerTicketSeq),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Both sends applied: bob 100→40, carol inbox=40, dave inbox=20.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 40);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 40);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 20);
+        }
+
+        // inner transactions each consume their own ticket.
+        // The send proof context hash must be bound to the ticket sequence, not the
+        // account sequence. sendJV receives the ticket seq as its `seq` parameter.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            // Bob creates two tickets for the two inner sends.
+            std::uint32_t const ticketSeq1 = env.seq(bob) + 1;
+            std::uint32_t const ticketSeq2 = env.seq(bob) + 2;
+            env(ticket::create(bob, 2));
+            env.close();
+
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+            // jv1: proof bound to ticketSeq1.
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 40}, ticketSeq1);
+            // jv2: proof bound to ticketSeq2, spending state predicted after jv1.
+            auto const chain1 = mpt.chainAfterSend(bob, 40, jv1);
+            auto const jv2 =
+                mpt.sendJV({.account = bob, .dest = dave, .amt = 30}, ticketSeq2, chain1);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, 0, ticketSeq1),
+                batch::Inner(jv2, 0, ticketSeq2),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Both sends applied: bob 100→30, carol inbox=40, dave inbox=30.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 30);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 40);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 30);
+        }
+
+        // inner send uses wrong sequence (account seq instead of ticket seq)
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            std::uint32_t const ticketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+            env.close();
+
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+            // Proof intentionally built with account seq (bobSeq+1) instead of ticketSeq.
+            auto const badJV = mpt.sendJV({.account = bob, .dest = carol, .amt = 40}, bobSeq + 1);
+            auto const jv2 = mpt.mergeInboxJV({.account = bob});
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(badJV, 0, ticketSeq),
+                batch::Inner(jv2, bobSeq + 1),
+                Ter(tesSUCCESS));
+            env.close();
+
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+        }
+    }
+
+    // Basic tests of confidential transfer through delegation. Verifies that a delegated account
+    // with the appropriate permissions can execute confidential transfer transactions
+    // on behalf of the delegator.
+    void
+    testConfidentialDelegation(FeatureBitset features)
+    {
+        testcase("Confidential transfers through delegation");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        Account const carol{"carol"};
+        Account const dave{"dave"};
+
+        MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+        env.fund(XRP(10000), dave);
+        env.close();
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanClawback |
+                tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.authorize({.account = carol});
+        mptAlice.pay(alice, bob, 200);
+        mptAlice.pay(alice, carol, 100);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.generateKeyPair(carol);
+        mptAlice.set({.issuerPubKey = mptAlice.getPubKey(alice)});
+
+        // Bob delegates Convert, MergeInbox to dave.
+        env(delegate::set(bob, dave, {"ConfidentialMPTConvert", "ConfidentialMPTMergeInbox"}));
+        env.close();
+
+        // Carol has no permission from bob to convert on his behalf.
+        mptAlice.convert({
+            .account = bob,
+            .amt = 10,
+            .holderPubKey = mptAlice.getPubKey(bob),
+            .delegate = carol,
+            .err = terNO_DELEGATE_PERMISSION,
+        });
+
+        // Dave executes Convert on behalf of bob, registering bob's key.
+        mptAlice.convert({
+            .account = bob,
+            .amt = 100,
+            .holderPubKey = mptAlice.getPubKey(bob),
+            .delegate = dave,
+        });
+        env.require(MptBalance(mptAlice, bob, 100));
+
+        // Dave executes Convert again on behalf of bob (no key registration).
+        mptAlice.convert({.account = bob, .amt = 50, .delegate = dave});
+
+        // Dave executes MergeInbox on behalf of bob.
+        mptAlice.mergeInbox({.account = bob, .delegate = dave});
+
+        // Carol converts and merge inbox.
+        mptAlice.convert({
+            .account = carol,
+            .amt = 100,
+            .holderPubKey = mptAlice.getPubKey(carol),
+        });
+        mptAlice.mergeInbox({.account = carol});
+
+        // Dave does not have permission to send on behalf of bob.
+        mptAlice.send(
+            {.account = bob,
+             .dest = carol,
+             .amt = 10,
+             .delegate = dave,
+             .err = terNO_DELEGATE_PERMISSION});
+
+        // Bob delegates ConfidentialMPTSend to dave.
+        env(delegate::set(
+            bob,
+            dave,
+            {"ConfidentialMPTConvert", "ConfidentialMPTMergeInbox", "ConfidentialMPTSend"}));
+        env.close();
+
+        // Dave executes Send on behalf of bob.
+        mptAlice.send({.account = bob, .dest = carol, .amt = 10, .delegate = dave});
+        mptAlice.mergeInbox({.account = carol});
+
+        // Dave does not have permission to convert back on behalf of bob.
+        mptAlice.convertBack(
+            {.account = bob, .amt = 10, .delegate = dave, .err = terNO_DELEGATE_PERMISSION});
+
+        // Bob delegates ConfidentialMPTConvertBack to dave.
+        env(delegate::set(
+            bob,
+            dave,
+            {"ConfidentialMPTConvert",
+             "ConfidentialMPTMergeInbox",
+             "ConfidentialMPTSend",
+             "ConfidentialMPTConvertBack"}));
+        env.close();
+
+        // Dave executes ConvertBack on behalf of bob.
+        mptAlice.convertBack({.account = bob, .amt = 10, .delegate = dave});
+
+        // Dave does not have permission to clawback on behalf of alice.
+        mptAlice.confidentialClaw(
+            {.holder = bob, .amt = 130, .delegate = dave, .err = terNO_DELEGATE_PERMISSION});
+
+        // Alice delegates ConfidentialMPTClawback to dave.
+        env(delegate::set(alice, dave, {"ConfidentialMPTClawback"}));
+        env.close();
+
+        // Dave executes Clawback on behalf of alice.
+        mptAlice.confidentialClaw({.holder = bob, .amt = 130, .delegate = dave});
+    }
+
+    // Verifies that revoking delegation prevents further delegated operations.
+    void
+    testDelegationRevocation(FeatureBitset features)
+    {
+        testcase("Confidential delegation revocation");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        Account const carol{"carol"};
+
+        MPTTester mptAlice(env, alice, {.holders = {bob}});
+        env.fund(XRP(10000), carol);
+        env.close();
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.pay(alice, bob, 100);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.set({.issuerPubKey = mptAlice.getPubKey(alice)});
+
+        // Creating the Delegate SLE consumes one owner reserve slot for bob.
+        auto const bobOwnersBefore = ownerCount(env, bob);
+        env(delegate::set(bob, carol, {"ConfidentialMPTConvert", "ConfidentialMPTMergeInbox"}));
+        env.close();
+        env.require(Owners(bob, bobOwnersBefore + 1));
+
+        // Carol converts and merge inbox on behalf of bob.
+        mptAlice.convert({
+            .account = bob,
+            .amt = 50,
+            .holderPubKey = mptAlice.getPubKey(bob),
+            .delegate = carol,
+        });
+        mptAlice.mergeInbox({.account = bob, .delegate = carol});
+
+        // Bob revokes all permissions, deletes the Delegate SLE, releasing the reserve.
+        env(delegate::set(bob, carol, std::vector<std::string>{}));
+        env.close();
+        env.require(Owners(bob, bobOwnersBefore));
+
+        // Carol can no longer convert on behalf of bob.
+        mptAlice.convert({
+            .account = bob,
+            .amt = 30,
+            .delegate = carol,
+            .err = terNO_DELEGATE_PERMISSION,
+        });
+
+        // Bob can still convert by himself.
+        mptAlice.convert({.account = bob, .amt = 30});
+    }
+
+    // Verifies that a delegated confidential transfer works correctly when an
+    // auditor is configured on the issuance.
+    void
+    testDelegationWithAuditor(FeatureBitset features)
+    {
+        testcase("Confidential delegation with auditor");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        Account const carol{"carol"};
+        Account const dave{"dave"};
+        Account const auditor{"auditor"};
+
+        MPTTester mptAlice(env, alice, {.holders = {bob, carol}, .auditor = auditor});
+        env.fund(XRP(10000), dave);
+        env.close();
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.authorize({.account = carol});
+        mptAlice.pay(alice, bob, 100);
+        mptAlice.pay(alice, carol, 100);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.generateKeyPair(carol);
+        mptAlice.generateKeyPair(auditor);
+        mptAlice.set({
+            .issuerPubKey = mptAlice.getPubKey(alice),
+            .auditorPubKey = mptAlice.getPubKey(auditor),
+        });
+
+        // Bob delegates Convert and Send permissions to dave.
+        env(delegate::set(bob, dave, {"ConfidentialMPTSend", "ConfidentialMPTConvert"}));
+        env.close();
+
+        // Dave converts on behalf of bob.
+        mptAlice.convert({
+            .account = bob,
+            .amt = 50,
+            .holderPubKey = mptAlice.getPubKey(bob),
+            .delegate = dave,
+        });
+        mptAlice.mergeInbox({.account = bob});
+
+        mptAlice.convert({
+            .account = carol,
+            .amt = 50,
+            .holderPubKey = mptAlice.getPubKey(carol),
+        });
+        mptAlice.mergeInbox({.account = carol});
+
+        // Dave sends on behalf of bob.
+        mptAlice.send({.account = bob, .dest = carol, .amt = 20, .delegate = dave});
+        mptAlice.send({.account = bob, .dest = carol, .amt = 10, .delegate = dave});
+
+        // Bob delegates ConvertBack and Send permissions to auditor.
+        env(delegate::set(bob, auditor, {"ConfidentialMPTSend", "ConfidentialMPTConvertBack"}));
+        env.close();
+
+        // auditor can send and convert back on behalf of bob as well.
+        mptAlice.send({.account = bob, .dest = carol, .amt = 10, .delegate = auditor});
+        mptAlice.convertBack({.account = bob, .amt = 10, .delegate = auditor});
+    }
+
+    // Verifies that a non-issuer delegating clawback to a third party does not
+    // allow that party to execute clawback, since clawback is issuer-only.
+    void
+    testDelegationClawbackIssuerOnly(FeatureBitset features)
+    {
+        testcase("Confidential clawback delegation requires issuer");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        Account const carol{"carol"};
+        Account const dave{"dave"};
+
+        ConfidentialEnv const confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 100, .convertAmount = 50},
+             {.account = carol, .payAmount = 100, .convertAmount = 100}},
+            tfMPTCanTransfer | tfMPTCanClawback | tfMPTCanHoldConfidentialBalance};
+        auto& mptAlice = confEnv.mpt;
+        env.fund(XRP(10000), dave);
+        env.close();
+
+        // Bob delegates Clawback permission to dave.
+        env(delegate::set(bob, dave, {"ConfidentialMPTClawback"}));
+        env.close();
+
+        // Dave attempts clawback on behalf of bob targetting bob, but since bob is not the issuer,
+        // the transaction should be rejected.
+        {
+            json::Value jv;
+            jv[jss::Account] = bob.human();
+            jv[jss::TransactionType] = jss::ConfidentialMPTClawback;
+            jv[sfMPTokenIssuanceID] = to_string(mptAlice.issuanceID());
+            jv[sfHolder] = bob.human();
+            jv[sfMPTAmount.jsonName] = "50";
+            jv[sfZKProof.jsonName] = std::string(kEcClawbackProofLength * 2, '0');
+            env(jv, delegate::As(dave), Ter(temMALFORMED));
+        }
+
+        // Dave attempts clawback on behalf of bob targeting carol, but since bob is not the issuer,
+        // the transaction should be rejected.
+        {
+            json::Value jv;
+            jv[jss::Account] = bob.human();
+            jv[jss::TransactionType] = jss::ConfidentialMPTClawback;
+            jv[sfMPTokenIssuanceID] = to_string(mptAlice.issuanceID());
+            jv[sfHolder] = carol.human();
+            jv[sfMPTAmount.jsonName] = "100";
+            jv[sfZKProof.jsonName] = std::string(kEcClawbackProofLength * 2, '0');
+            env(jv, delegate::As(dave), Ter(temMALFORMED));
+        }
+    }
+
+    // Batch with delegated ConfidentialMPTSend txs, covering stale and updated inner
+    // send proofs.
+    void
+    testBatchDelegatedSend(FeatureBitset features)
+    {
+        testcase("Batch ConfidentialMPTSend with delegation");
+        using namespace test::jtx;
+
+        // AllOrNothing: two delegated sends from bob via dave, second proof is
+        // stale once the first send updates bob's spending, whole batch rolls back.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            env(delegate::set(bob, dave, {"ConfidentialMPTSend"}));
+            env.close();
+
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+            // jv1: proof against spending balance 100
+            auto jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 60}, bobSeq + 1);
+            jv1[jss::Delegate] = dave.human();
+            // jv2: proof also against spending balance 100, which is stale once jv1 applies
+            auto jv2 = mpt.sendJV({.account = bob, .dest = dave, .amt = 60}, bobSeq + 2);
+            jv2[jss::Delegate] = dave.human();
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, bobSeq + 2),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Stale proof on jv2, AllOrNothing rolls back everything.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 0);
+        }
+
+        // AllOrNothing: two delegated sends with correctly chained proofs both apply.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            env(delegate::set(bob, dave, {"ConfidentialMPTSend"}));
+            env.close();
+
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+            // jv1: proof against spending balance 100.
+            auto jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 40}, bobSeq + 1);
+            jv1[jss::Delegate] = dave.human();
+            auto const chain1 = mpt.chainAfterSend(bob, 40, jv1);
+            // jv2: proof against predicted spending balance 60.
+            auto jv2 = mpt.sendJV({.account = bob, .dest = dave, .amt = 40}, bobSeq + 2, chain1);
+            jv2[jss::Delegate] = dave.human();
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, bobSeq + 2),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Both inner tx applied
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 20);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 40);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 40);
+        }
+    }
+
+    // Test missing delegation permission inside a batch.
+    void
+    testBatchDelegationMissingPermission(FeatureBitset features)
+    {
+        testcase("Batch delegation missing permission");
+        using namespace test::jtx;
+
+        // AllOrNothing: dave has no Send permission from bob, so the delegated
+        // inner send fails. The whole batch rolls back.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 60);
+
+            // Bob grants dave only MergeInbox, not Send.
+            env(delegate::set(bob, dave, {"ConfidentialMPTMergeInbox"}));
+            env.close();
+
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+
+            // jv1: direct send from carol (valid proof).
+            auto const jv1 = mpt.sendJV({.account = carol, .dest = dave, .amt = 30}, carolSeq);
+            // jv2: delegated send, fails because dave has no Send permission.
+            auto jv2 = mpt.sendJV({.account = bob, .dest = carol, .amt = 50}, bobSeq + 1);
+            jv2[jss::Delegate] = dave.human();
+
+            env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, carolSeq),
+                batch::Inner(jv2, bobSeq + 1),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // jv1 applied in the batch view, then jv2 failed, so
+            // AllOrNothing discards both inner effects.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 60);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 0);
+        }
+
+        // Independent: the delegated confidential send is skipped because lack of permission. The
+        // send from carol still applies.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 60);
+
+            // Bob does not grant dave any permissions.
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+
+            auto jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 50}, bobSeq + 1);
+            jv1[jss::Delegate] = dave.human();
+            auto const jv2 = mpt.sendJV({.account = carol, .dest = dave, .amt = 30}, carolSeq);
+
+            env(batch::outer(bob, bobSeq, batchFee, tfIndependent),
+                batch::Inner(jv1, bobSeq + 1),
+                batch::Inner(jv2, carolSeq),
+                batch::Sig(carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // jv1 failed and jv2 applied.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 30);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 30);
+        }
+    }
+
+    // Test batch outer signer is the delegated account.
+    void
+    testBatchDelegatedSendWithDelegateAsOuterAccount(FeatureBitset features)
+    {
+        testcase("Test batch delegated send with delegate as outer account");
+        using namespace test::jtx;
+
+        // Dave has delegation permission, but the inner Account is bob.
+        // Without bob's BatchSigner, the batch is rejected.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            env(delegate::set(bob, dave, {"ConfidentialMPTSend"}));
+            env.close();
+
+            auto const daveSeq = env.seq(dave);
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+
+            auto jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 40}, bobSeq);
+            jv1[jss::Delegate] = dave.human();
+            auto const jv2 = mpt.mergeInboxJV({.account = dave});
+
+            env(batch::outer(dave, daveSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq),
+                batch::Inner(jv2, daveSeq + 1),
+                Ter(temBAD_SIGNER));
+            env.close();
+
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+        }
+
+        // Dave submits a mixed batch: bob signs inner tx1, and
+        // dave is the Delegate account signing for inner tx2.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 0);
+
+            env(delegate::set(bob, dave, {"ConfidentialMPTSend"}));
+            env.close();
+
+            auto const daveSeq = env.seq(dave);
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+
+            auto const jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 40}, bobSeq);
+            auto const chain1 = mpt.chainAfterSend(bob, 40, jv1);
+            auto jv2 = mpt.sendJV({.account = bob, .dest = carol, .amt = 30}, bobSeq + 1, chain1);
+            jv2[jss::Delegate] = dave.human();
+
+            // Dave is outer; bob signs because his account appears in inner txns.
+            env(batch::outer(dave, daveSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq),
+                batch::Inner(jv2, bobSeq + 1),
+                batch::Sig(bob),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Both sends applied: bob 100→30, carol inbox=70.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 30);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 70);
+        }
+
+        // Verify the delegator Bob's BatchSigner does not bypass the missing delegation permission.
+        // The delegated inner send fails.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+
+            MPTTester mpt(env, alice, {.holders = {bob, carol, dave}});
+            setupBatchEnv(mpt, alice, bob, carol, dave, 100, 60);
+
+            // Bob does not grant dave any permissions.
+            auto const daveSeq = env.seq(dave);
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 2, 2);
+
+            auto jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 50}, bobSeq);
+            jv1[jss::Delegate] = dave.human();
+            auto const jv2 = mpt.sendJV({.account = carol, .dest = dave, .amt = 30}, carolSeq);
+
+            env(batch::outer(dave, daveSeq, batchFee, tfAllOrNothing),
+                batch::Inner(jv1, bobSeq),
+                batch::Inner(jv2, carolSeq),
+                batch::Sig(bob, carol),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // jv1 fails before jv2 is attempted.
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 60);
+            BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 0);
+        }
+    }
+
+    // Mixed batch with delegated and non-delegated inner confidential MPT transactions.
+    void
+    testBatchDelegatedConfidentialMix(FeatureBitset features)
+    {
+        testcase("Batch delegated confidential multiple operations");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+        Account const erin("erin");
+        Account const frank("frank");
+
+        MPTTester mpt(env, alice, {.holders = {bob, carol, dave, frank}});
+        setupBatchEnv(mpt, alice, bob, carol, dave, 100, 60);
+        mpt.pay(alice, bob, 50);
+        env.fund(XRP(10000), erin);
+        env.close();
+
+        mpt.authorize({.account = frank});
+        mpt.pay(alice, frank, 40);
+        mpt.generateKeyPair(frank);
+
+        env(delegate::set(bob, dave, {"ConfidentialMPTConvert", "ConfidentialMPTConvertBack"}));
+        env(delegate::set(carol, erin, {"ConfidentialMPTSend"}));
+        env(delegate::set(bob, erin, {"ConfidentialMPTMergeInbox"}));
+        env.close();
+
+        auto const daveSeq = env.seq(dave);
+        auto const bobSeq = env.seq(bob);
+        auto const carolSeq = env.seq(carol);
+        auto const frankSeq = env.seq(frank);
+        auto const batchFee = batch::calcConfidentialBatchFee(env, 3, 6);
+
+        // Dave submits the batch. Bob's convert and convertback use Dave as Delegate;
+        // Carol's send and Bob's mergeInbox use Erin as Delegate. Frank's
+        // convert and mergeInbox are non-delegated.
+        auto jv1 = mpt.convertBackJV({.account = bob, .amt = 30}, bobSeq);
+        jv1[jss::Delegate] = dave.human();
+        auto jv2 = mpt.convertJV({.account = bob, .amt = 20}, bobSeq + 1);
+        jv2[jss::Delegate] = dave.human();
+        auto jv3 = mpt.sendJV({.account = carol, .dest = bob, .amt = 15}, carolSeq);
+        jv3[jss::Delegate] = erin.human();
+        auto const jv4 = mpt.convertJV(
+            {.account = frank, .amt = 25, .holderPubKey = mpt.getPubKey(frank)}, frankSeq);
+        auto const jv5 = mpt.mergeInboxJV({.account = frank});
+        auto jv6 = mpt.mergeInboxJV({.account = bob});
+        jv6[jss::Delegate] = erin.human();
+
+        env(batch::outer(dave, daveSeq, batchFee, tfAllOrNothing),
+            batch::Inner(jv1, bobSeq),
+            batch::Inner(jv2, bobSeq + 1),
+            batch::Inner(jv3, carolSeq),
+            batch::Inner(jv4, frankSeq),
+            batch::Inner(jv5, frankSeq + 1),
+            batch::Inner(jv6, bobSeq + 2),
+            batch::Sig(bob, carol, frank),
+            Ter(tesSUCCESS));
+        env.close();
+
+        env.require(MptBalance(mpt, bob, 60));
+        BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 105);
+        BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedInbox) == 0);
+        env.require(MptBalance(mpt, carol, 0));
+        BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedSpending) == 45);
+        BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+        env.require(MptBalance(mpt, frank, 15));
+        BEAST_EXPECT(mpt.getDecryptedBalance(frank, MPTTester::holderEncryptedSpending) == 25);
+        BEAST_EXPECT(mpt.getDecryptedBalance(frank, MPTTester::holderEncryptedInbox) == 0);
+        env.require(MptBalance(mpt, dave, 0));
+        BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedSpending) == 0);
+        BEAST_EXPECT(mpt.getDecryptedBalance(dave, MPTTester::holderEncryptedInbox) == 0);
+        auto const outstandingBalance = mpt.getIssuanceOutstandingBalance();
+        BEAST_EXPECT(outstandingBalance && *outstandingBalance == 250);
+        BEAST_EXPECT(mpt.getIssuanceConfidentialBalance() == 175);
+    }
+
+    // Test invalid scenarios for delegation with tickets.
+    void
+    testInvalidDelegationWithTickets(FeatureBitset features)
+    {
+        testcase("Invalid cases for delegation with tickets");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        MPTTester mptAlice(env, alice, {.holders = {bob}});
+        env.fund(XRP(10000), carol);
+        env.close();
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance | tfMPTCanClawback,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.pay(alice, bob, 200);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.set({.issuerPubKey = mptAlice.getPubKey(alice)});
+
+        // Bob grants carol permissions.
+        env(delegate::set(bob, carol, {"ConfidentialMPTConvert"}));
+        env.close();
+
+        uint64_t const amt = 10;
+        auto const bf = generateBlindingFactor();
+        auto const holderCt = mptAlice.encryptAmount(bob, amt, bf);
+        auto const issuerCt = mptAlice.encryptAmount(alice, amt, bf);
+
+        // Invalid: proof built with wrong ticket sequence (ticketSeq + 1).
+        {
+            auto const ticketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+
+            auto const badCtxHash =
+                getConvertContextHash(bob, mptAlice.issuanceID(), ticketSeq + 1);
+            auto const badProof = requireOptional(
+                mptAlice.getSchnorrProof(bob, badCtxHash), "Missing Schnorr Proof.");
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = amt,
+                .proof = strHex(badProof),
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = holderCt,
+                .issuerEncryptedAmt = issuerCt,
+                .blindingFactor = bf,
+                .delegate = carol,
+                .ticketSeq = ticketSeq,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Invalid: proof built with account sequence instead of ticket sequence.
+        {
+            auto const ticketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+            auto const badCtxHash = getConvertContextHash(bob, mptAlice.issuanceID(), env.seq(bob));
+            auto const badProof = requireOptional(
+                mptAlice.getSchnorrProof(bob, badCtxHash), "Missing Schnorr Proof.");
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = amt,
+                .proof = strHex(badProof),
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = holderCt,
+                .issuerEncryptedAmt = issuerCt,
+                .blindingFactor = bf,
+                .delegate = carol,
+                .ticketSeq = ticketSeq,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Invalid: ticket sequence is far in the future and hasn't been created yet.
+        {
+            mptAlice.convert({
+                .account = bob,
+                .amt = amt,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = holderCt,
+                .issuerEncryptedAmt = issuerCt,
+                .blindingFactor = bf,
+                .delegate = carol,
+                .ticketSeq = env.seq(bob) + 100,
+                .err = terPRE_TICKET,
+            });
+        }
+
+        // Invalid: ticket sequence is in the past but was never created.
+        {
+            mptAlice.convert({
+                .account = bob,
+                .amt = amt,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = holderCt,
+                .issuerEncryptedAmt = issuerCt,
+                .blindingFactor = bf,
+                .delegate = carol,
+                .ticketSeq = 1,
+                .err = tefNO_TICKET,
+            });
+        }
+
+        // Invalid: the delegated account, carol, creates a ticket and uses it.
+        {
+            auto const carolTicketSeq = env.seq(carol) + 1;
+            env(ticket::create(carol, 1));
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = amt,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = holderCt,
+                .issuerEncryptedAmt = issuerCt,
+                .blindingFactor = bf,
+                .delegate = carol,
+                .ticketSeq = carolTicketSeq,
+                .err = tefNO_TICKET,
+            });
+        }
+
+        // Invalid: proof bound to a ticket sequence but submitted without a ticket,
+        // using account sequence.
+        {
+            auto const ticketSeq = env.seq(bob) + 1;
+            env(ticket::create(bob, 1));
+
+            // Build proof using ticketSeq.
+            auto const ctxHashForTicket =
+                getConvertContextHash(bob, mptAlice.issuanceID(), ticketSeq);
+            auto const proof = requireOptional(
+                mptAlice.getSchnorrProof(bob, ctxHashForTicket), "Missing Schnorr Proof.");
+
+            // Submit without ticket.
+            mptAlice.convert({
+                .account = bob,
+                .amt = amt,
+                .proof = strHex(proof),
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = holderCt,
+                .issuerEncryptedAmt = issuerCt,
+                .blindingFactor = bf,
+                .delegate = carol,
+                .err = tecBAD_PROOF,
+            });
+        }
+    }
+
+    // Verifies that delegation works correctly when the delegating account uses
+    // tickets instead of regular sequence numbers. The proof must bind to the
+    // ticket sequence, not the account sequence.
+    void
+    testDelegationWithTickets(FeatureBitset features)
+    {
+        testcase("Confidential delegation with tickets");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+        MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+        env.fund(XRP(10000), dave);
+        env.close();
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance | tfMPTCanClawback,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.authorize({.account = carol});
+        mptAlice.pay(alice, bob, 200);
+        mptAlice.pay(alice, carol, 100);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.generateKeyPair(carol);
+        mptAlice.set({.issuerPubKey = mptAlice.getPubKey(alice)});
+
+        // Bob grants dave permissions.
+        env(delegate::set(
+            bob,
+            dave,
+            {"ConfidentialMPTConvert",
+             "ConfidentialMPTMergeInbox",
+             "ConfidentialMPTSend",
+             "ConfidentialMPTConvertBack"}));
+        // Alice grants dave permission to clawback on her behalf.
+        env(delegate::set(alice, dave, {"ConfidentialMPTClawback"}));
+        env.close();
+
+        // Dave executes Convert on behalf of bob using ticket.
+        auto ticketSeq = env.seq(bob) + 1;
+        env(ticket::create(bob, 1));
+        BEAST_EXPECT(env.seq(bob) != ticketSeq);
+        mptAlice.convert({
+            .account = bob,
+            .amt = 100,
+            .holderPubKey = mptAlice.getPubKey(bob),
+            .delegate = dave,
+            .ticketSeq = ticketSeq,
+        });
+        env.require(MptBalance(mptAlice, bob, 100));
+
+        // MergeInbox using ticket with delegation.
+        ticketSeq = env.seq(bob) + 1;
+        env(ticket::create(bob, 1));
+        BEAST_EXPECT(env.seq(bob) != ticketSeq);
+        mptAlice.mergeInbox({.account = bob, .delegate = dave, .ticketSeq = ticketSeq});
+
+        // Carol converts and merges inbox to receive from bob.
+        mptAlice.convert({
+            .account = carol,
+            .amt = 50,
+            .holderPubKey = mptAlice.getPubKey(carol),
+        });
+        mptAlice.mergeInbox({.account = carol});
+
+        // Send using ticket with delegation.
+        ticketSeq = env.seq(bob) + 1;
+        env(ticket::create(bob, 1));
+        BEAST_EXPECT(env.seq(bob) != ticketSeq);
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 20,
+            .delegate = dave,
+            .ticketSeq = ticketSeq,
+        });
+
+        // ConvertBack using ticket with delegation.
+        ticketSeq = env.seq(bob) + 1;
+        env(ticket::create(bob, 1));
+        BEAST_EXPECT(env.seq(bob) != ticketSeq);
+        mptAlice.convertBack({
+            .account = bob,
+            .amt = 10,
+            .delegate = dave,
+            .ticketSeq = ticketSeq,
+        });
+
+        // Clawback using ticket with delegation.
+        ticketSeq = env.seq(alice) + 1;
+        env(ticket::create(alice, 1));
+        BEAST_EXPECT(env.seq(alice) != ticketSeq);
+        mptAlice.confidentialClaw({
+            .holder = bob,
+            .amt = 70,
+            .delegate = dave,
+            .ticketSeq = ticketSeq,
+        });
+    }
+
+    void
+    testWithFeats(FeatureBitset features)
+    {
+        // DepositAuth, credentials, and destination tag interactions.
+        testSendDepositPreauth(features);
+        testSendCredentialValidation(features);
+        testDestinationTag(features);
+
+        // AMM/pseudo-account interaction.
+        testAMMHolderCannotHaveConfidentialStateClawback(features);
+
+        // Ticket interactions.
+        testWithTickets(features);
+        testConvertTicketProofBinding(features);
+        testTicketErrors(features);
+
+        // Batch interactions.
+        testBatchConfidentialSend(features);
+        testBatchConfidentialConvertAndConvertBack(features);
+        testBatchConfidentialMixTransactions(features);
+        testBatchAllOrNothing(features);
+        testBatchOnlyOne(features);
+        testBatchUntilFailure(features);
+        testBatchIndependent(features);
+        testBatchWithTickets(features);
+
+        // Permission delegation interactions.
+        testConfidentialDelegation(features);
+        testDelegationRevocation(features);
+        testDelegationWithAuditor(features);
+        testDelegationClawbackIssuerOnly(features);
+        testBatchDelegatedSend(features);
+        testBatchDelegationMissingPermission(features);
+        testBatchDelegatedSendWithDelegateAsOuterAccount(features);
+        testBatchDelegatedConfidentialMix(features);
+        testInvalidDelegationWithTickets(features);
+        testDelegationWithTickets(features);
+    }
+
+public:
+    void
+    run() override
+    {
+        using namespace test::jtx;
+        FeatureBitset const all{testableAmendments()};
+
+        testWithFeats(all);
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(ConfidentialTransferExtended, app, xrpl);
+
+}  // namespace xrpl
diff --git a/src/test/app/ConfidentialTransfer_test.cpp b/src/test/app/ConfidentialTransfer_test.cpp
new file mode 100644
index 0000000000..e6faf0a2ae
--- /dev/null
+++ b/src/test/app/ConfidentialTransfer_test.cpp
@@ -0,0 +1,8208 @@
+#include <test/jtx/Account.h>
+#include <test/jtx/ConfidentialTransfer.h>
+#include <test/jtx/Env.h>
+#include <test/jtx/amount.h>
+#include <test/jtx/flags.h>
+#include <test/jtx/mpt.h>
+#include <test/jtx/pay.h>
+#include <test/jtx/ter.h>
+#include <test/jtx/vault.h>
+
+#include <xrpl/basics/Buffer.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/basics/strHex.h>
+#include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/tx/apply.h>
+
+#include <openssl/evp.h>
+#include <utility/mpt_utility.h>
+
+#include <secp256k1.h>
+#include <secp256k1_mpt.h>
+
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <functional>
+#include <initializer_list>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <utility>
+
+namespace xrpl {
+
+class ConfidentialTransfer_test : public ConfidentialTransferTestBase
+{
+    void
+    testConvert(FeatureBitset features)
+    {
+        testcase("Convert");
+        using namespace test::jtx;
+
+        // Basic convert test
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 0,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 20,
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 40,
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 40,
+            });
+        }
+
+        // Edge case: minimum amount (1)
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 1);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+            mptAlice.convert({
+                .account = bob,
+                .amt = 0,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 1,
+            });
+        }
+
+        // Edge case: kMaxMpTokenAmount
+        // Using raw JSON to avoid automatic decryption checks in MPTTester
+        // which don't work for very large amounts (brute-force decryption is slow)
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, kMaxMpTokenAmount);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            // First convert with amt=0 to register public key (uses MPTTester)
+            mptAlice.convert({
+                .account = bob,
+                .amt = 0,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            // Second convert with kMaxMpTokenAmount using raw JSON
+            Buffer const blindingFactor = generateBlindingFactor();
+            auto const holderCiphertext =
+                mptAlice.encryptAmount(bob, kMaxMpTokenAmount, blindingFactor);
+            auto const issuerCiphertext =
+                mptAlice.encryptAmount(alice, kMaxMpTokenAmount, blindingFactor);
+
+            json::Value jv;
+            jv[jss::Account] = bob.human();
+            jv[jss::TransactionType] = jss::ConfidentialMPTConvert;
+            jv[sfMPTokenIssuanceID] = to_string(mptAlice.issuanceID());
+            jv[sfMPTAmount.jsonName] = std::to_string(kMaxMpTokenAmount);
+            jv[sfHolderEncryptedAmount.jsonName] = strHex(holderCiphertext);
+            jv[sfIssuerEncryptedAmount.jsonName] = strHex(issuerCiphertext);
+            jv[sfBlindingFactor.jsonName] = strHex(blindingFactor);
+
+            env(jv, Ter(tesSUCCESS));
+
+            // Verify the public balance was reduced
+            env.require(MptBalance(mptAlice, bob, 0));
+        }
+    }
+
+    void
+    testConvertWithAuditor(FeatureBitset features)
+    {
+        testcase("Convert with auditor");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const auditor("auditor");
+        MPTTester mptAlice(
+            env,
+            alice,
+            {
+                .holders = {bob},
+                .auditor = auditor,
+            });
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+        });
+
+        mptAlice.authorize({
+            .account = bob,
+        });
+        mptAlice.pay(alice, bob, 100);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(auditor);
+
+        mptAlice.set({
+            .account = alice,
+            .issuerPubKey = mptAlice.getPubKey(alice),
+            .auditorPubKey = mptAlice.getPubKey(auditor),
+        });
+
+        mptAlice.generateKeyPair(bob);
+
+        mptAlice.convert({
+            .account = bob,
+            .amt = 0,
+            .holderPubKey = mptAlice.getPubKey(bob),
+        });
+
+        mptAlice.convert({
+            .account = bob,
+            .amt = 20,
+        });
+
+        mptAlice.convert({
+            .account = bob,
+            .amt = 30,
+        });
+    }
+
+    void
+    testConvertPreflight(FeatureBitset features)
+    {
+        testcase("Convert preflight");
+        using namespace test::jtx;
+
+        // Alice (issuer) tries to convert her own tokens - should fail
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            MPTTester mptAlice(env, alice);
+
+            mptAlice.create({
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.convert({
+                .account = alice,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(alice),
+                .err = temMALFORMED,
+            });
+        }
+
+        {
+            Env env{*this, features - featureConfidentialTransfer};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .err = temDISABLED,
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = temDISABLED,
+            });
+        }
+
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = alice,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = temMALFORMED,
+            });
+
+            // Holder encrypted amount is empty (length 0)
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = Buffer{},
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // Issuer encrypted amount is empty (length 0)
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .issuerEncryptedAmt = Buffer{},
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // Auditor encrypted amount has invalid length (must be 66 bytes)
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .auditorEncryptedAmt = gMakeZeroBuffer(10),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // Auditor encrypted amount has correct length but invalid data
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .auditorEncryptedAmt = getBadCiphertext(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // Amount exceeds maximum allowed MPT amount
+            mptAlice.convert({
+                .account = bob,
+                .amt = kMaxMpTokenAmount + 1,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = temBAD_AMOUNT,
+            });
+
+            // Holder encrypted amount has correct length but invalid data
+            mptAlice.convert({
+                .account = bob,
+                .amt = 1,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = getBadCiphertext(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // Issuer encrypted amount has correct length but invalid data (not
+            // a valid EC point)
+            mptAlice.convert({
+                .account = bob,
+                .amt = 1,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .issuerEncryptedAmt = getBadCiphertext(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // Holder public key is invalid (empty buffer)
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = Buffer{},
+                .err = temMALFORMED,
+            });
+
+            // Holder public key has correct length but invalid EC point data
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = gMakeZeroBuffer(kEcPubKeyLength),
+                .err = temMALFORMED,
+            });
+        }
+
+        // when registering holder pub key, the transaction must include a
+        // Schnorr proof of knowledge for the corresponding secret key
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .fillSchnorrProof = false,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = temMALFORMED,
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 0,
+                .fillSchnorrProof = false,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = temMALFORMED,
+            });
+
+            // proof length is invalid
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .proof = std::string(10, 'A'),
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = temMALFORMED,
+            });
+        }
+
+        // when holder pub key already registered, Schnorr proof must not be
+        // provided
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            // this will register bob's pub key,
+            // and convert 10 to confidential balance
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            // proof must not be provided after pub key was registered
+            mptAlice.convert({
+                .account = bob,
+                .amt = 20,
+                .fillSchnorrProof = true,
+                .err = temMALFORMED,
+            });
+        }
+    }
+
+    void
+    testConvertInvalidProofContextBinding(FeatureBitset features)
+    {
+        testcase("Convert proof context binding");
+        using namespace test::jtx;
+
+        auto runBadProof = [&](auto makeContextHash) {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({.account = bob});
+            mptAlice.authorize({.account = carol});
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            auto const proof =
+                mptAlice.getSchnorrProof(bob, makeContextHash(env, mptAlice, alice, bob, carol));
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .proof = strHex(requireOptional(proof, "Missing proof")),
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecBAD_PROOF,
+            });
+        };
+
+        // Wrong account in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const& carol) {
+            return getConvertContextHash(carol.id(), mpt.issuanceID(), env.seq(bob));
+        });
+
+        // Wrong issuance ID in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const&,
+                        Account const& alice,
+                        Account const& bob,
+                        Account const&) {
+            return getConvertContextHash(
+                bob.id(), makeMptID(env.seq(alice) + 100, alice), env.seq(bob));
+        });
+
+        // Wrong transaction sequence in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const&) {
+            return getConvertContextHash(bob.id(), mpt.issuanceID(), env.seq(bob) + 1);
+        });
+    }
+
+    void
+    testSet(FeatureBitset features)
+    {
+        testcase("Set");
+        using namespace test::jtx;
+
+        // Set keys on issuance that already has confidential amounts enabled
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const auditor("auditor");
+            MPTTester mptAlice(env, alice, {.holders = {}, .auditor = auditor});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(auditor);
+
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .auditorPubKey = mptAlice.getPubKey(auditor),
+            });
+        }
+
+        // Enable confidential amounts flag only (no keys)
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            MPTTester mptAlice(env, alice, {.holders = {}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+            });
+        }
+
+        // Set keys when enabling confidential amounts in the same tx
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const auditor("auditor");
+            MPTTester mptAlice(env, alice, {.holders = {}, .auditor = auditor});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(auditor);
+
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .auditorPubKey = mptAlice.getPubKey(auditor),
+            });
+
+            // Verify lsfMPTCanHoldConfidentialBalance flag is set
+            BEAST_EXPECT(mptAlice.checkFlags(
+                lsfMPTCanTransfer | lsfMPTCanLock | lsfMPTCanHoldConfidentialBalance));
+
+            // Verify keys are persisted on the issuance
+            auto const sle = env.le(keylet::mptokenIssuance(mptAlice.issuanceID()));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->isFieldPresent(sfIssuerEncryptionKey));
+            BEAST_EXPECT(sle->isFieldPresent(sfAuditorEncryptionKey));
+        }
+    }
+
+    void
+    testSetPreflight(FeatureBitset features)
+    {
+        testcase("Set preflight");
+        using namespace test::jtx;
+
+        {
+            Env env{*this, features - featureConfidentialTransfer};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .err = temDISABLED,
+            });
+        }
+
+        // pub key is invalid
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            // Issuer pub key is invalid (empty)
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = Buffer{},
+                .err = temMALFORMED,
+            });
+
+            // Issuer pub key has correct length but invalid EC point data
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = gMakeZeroBuffer(kEcPubKeyLength),
+                .err = temMALFORMED,
+            });
+
+            // Auditor key is invalid length
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .auditorPubKey = gMakeZeroBuffer(10),
+                .err = temMALFORMED,
+            });
+
+            // Auditor key has correct length but invalid EC point data
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .auditorPubKey = gMakeZeroBuffer(kEcPubKeyLength),
+                .err = temMALFORMED,
+            });
+
+            // Cannot set auditor key without issuer key
+            mptAlice.set({
+                .account = alice,
+                .auditorPubKey = mptAlice.getPubKey(alice),
+                .err = temMALFORMED,
+            });
+
+            // Cannot set Holder and issuer Keys in the same transaction
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .err = temMALFORMED,
+            });
+
+            // Cannot set Holder and auditor Keys in the same transaction
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .auditorPubKey = mptAlice.getPubKey(alice),
+                .err = temMALFORMED,
+            });
+        }
+    }
+
+    void
+    testSetPreclaim(FeatureBitset features)
+    {
+        testcase("Set preclaim");
+        using namespace test::jtx;
+
+        // Cannot set issuer key if confidential amounts not enabled
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            MPTTester mptAlice(env, alice, {.holders = {}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Cannot update issuer public key once set
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            // First set issuer key - should succeed
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+            });
+
+            // Try to update issuer key - should fail
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(bob),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Cannot update issuer and auditor public keys once set
+        // Note: trying to set only auditor key fails in preflight (temMALFORMED)
+        // so we must provide both keys, which fails on issuer key check first
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const auditor("auditor");
+            MPTTester mptAlice(env, alice, {.holders = {bob}, .auditor = auditor});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(auditor);
+
+            // Set issuer and auditor keys - should succeed
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .auditorPubKey = mptAlice.getPubKey(auditor),
+            });
+
+            // Try to update both keys - fails on issuer key check first
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(bob),
+                .auditorPubKey = mptAlice.getPubKey(alice),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Cannot set auditor key if confidential amounts not enabled
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const auditor("auditor");
+            MPTTester mptAlice(env, alice, {.holders = {}, .auditor = auditor});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(auditor);
+
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .auditorPubKey = mptAlice.getPubKey(auditor),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Cannot set keys when mutation of canConfidentialAmount is disallowed
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            MPTTester mptAlice(env, alice, {.holders = {}});
+
+            // Create with tmfMPTCannotEnableCanHoldConfidentialBalance
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+                .mutableFlags = tmfMPTCannotEnableCanHoldConfidentialBalance,
+            });
+
+            mptAlice.generateKeyPair(alice);
+
+            // Trying to enable confidential amounts and set keys fails
+            // because the issuance cannot mutate canConfidentialAmount
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Set issuer key first, then auditor key in a separate tx
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const auditor("auditor");
+            MPTTester mptAlice(env, alice, {.holders = {}, .auditor = auditor});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(auditor);
+
+            // Set issuer key only
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+            });
+
+            // Set auditor key in a separate tx - requires issuer key in tx
+            // (preflight enforces auditor key requires issuer key)
+            // This fails because issuer key is already set on ledger
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .auditorPubKey = mptAlice.getPubKey(auditor),
+                .err = tecNO_PERMISSION,
+            });
+        }
+    }
+
+    void
+    testTransferFee(FeatureBitset features)
+    {
+        testcase("test transfer fee");
+        using namespace test::jtx;
+
+        // MPTokenIssuanceCreate: cannot create with both TransferFee > 0 and
+        // tfMPTCanHoldConfidentialBalance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            MPTTester mptAlice(env, alice, {.holders = {}});
+
+            mptAlice.create({
+                .transferFee = 100,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+                .err = temBAD_TRANSFER_FEE,
+            });
+
+            // transferFee being 0 is allowed, even with tfMPTCanHoldConfidentialBalance
+            mptAlice.create({
+                .transferFee = 0,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+        }
+
+        // MPTokenIssuanceSet (preflight): cannot enable confidential amounts and
+        // set TransferFee > 0 in the same transaction
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            MPTTester mptAlice(env, alice, {.holders = {}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+                .mutableFlags = tmfMPTCanMutateTransferFee,
+            });
+
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+                .transferFee = 100,
+                .err = temBAD_TRANSFER_FEE,
+            });
+        }
+
+        // MPTokenIssuanceSet (preclaim): cannot enable confidential amounts on
+        // an issuance that already has a non-zero TransferFee
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            MPTTester mptAlice(env, alice, {.holders = {}});
+
+            mptAlice.create({
+                .transferFee = 100,
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+                .mutableFlags = tmfMPTCanMutateTransferFee,
+            });
+
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // MPTokenIssuanceSet (preclaim): cannot set TransferFee > 0 on an
+        // issuance that already has lsfMPTCanHoldConfidentialBalance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            MPTTester mptAlice(env, alice, {.holders = {}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+                .mutableFlags = tmfMPTCanMutateTransferFee,
+            });
+
+            mptAlice.set({
+                .account = alice,
+                .transferFee = 100,
+                .err = tecNO_PERMISSION,
+            });
+
+            // Setting transfer fee to 0 is allowed, but have no effect.
+            mptAlice.set({
+                .account = alice,
+                .transferFee = 0,
+            });
+        }
+    }
+
+    void
+    testConvertPreclaim(FeatureBitset features)
+    {
+        testcase("Convert preclaim");
+        using namespace test::jtx;
+
+        // tfMPTCanHoldConfidentialBalance is not set on issuance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // issuer has not uploaded their sfIssuerEncryptionKey
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // issuance does not exist
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.destroy();
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecOBJECT_NOT_FOUND,
+            });
+        }
+
+        // bob has not created MPToken
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecOBJECT_NOT_FOUND,
+            });
+        }
+
+        // Verification of Issuer and and holder ciphertexts
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = getTrivialCiphertext(),
+                .err = tecBAD_PROOF,
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .issuerEncryptedAmt = getTrivialCiphertext(),
+                .err = tecBAD_PROOF,
+            });
+
+            std::uint64_t const amount = 10;
+            Buffer const blindingFactor = generateBlindingFactor();
+            Buffer const holderCiphertext = mptAlice.encryptAmount(bob, amount, blindingFactor);
+
+            // Holder ciphertext is valid for the amount and
+            // blinding factor, but the issuer ciphertext is encrypted under a
+            // different public key than the registered issuer key.
+            Buffer const wrongIssuerCiphertext =
+                mptAlice.encryptAmount(carol, amount, blindingFactor);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = amount,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .holderEncryptedAmt = holderCiphertext,
+                .issuerEncryptedAmt = wrongIssuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // trying to convert more than what bob has
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 200,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecINSUFFICIENT_FUNDS,
+            });
+        }
+
+        // holder cannot upload pk again
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({.account = bob, .amt = 10, .holderPubKey = mptAlice.getPubKey(bob)});
+
+            // cannot upload pk again
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecDUPLICATE,
+            });
+        }
+
+        // cannot convert if locked
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTLock,
+            });
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecLOCKED,
+            });
+
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnlock,
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+        }
+
+        // cannot convert if unauth
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth |
+                    tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            // Unauthorize bob
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnauthorize,
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecNO_AUTH,
+            });
+
+            // auth bob
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+        }
+
+        // frozen account cannot bypass freeze check with amount=0
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            // lock bob
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTLock,
+            });
+
+            mptAlice.generateKeyPair(bob);
+
+            // amount=0 should still be rejected when locked
+            mptAlice.convert({
+                .account = bob,
+                .amt = 0,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecLOCKED,
+            });
+        }
+
+        // unauthorized account cannot bypass auth check with amount=0
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth |
+                    tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            // Unauthorize bob
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnauthorize,
+            });
+
+            // amount=0 should still be rejected when unauthorized
+            mptAlice.convert({
+                .account = bob,
+                .amt = 0,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecNO_AUTH,
+            });
+        }
+
+        // cannot convert if auditor key is set, but auditor amount is not
+        // provided
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const auditor("auditor");
+            MPTTester mptAlice(
+                env,
+                alice,
+                {
+                    .holders = {bob},
+                    .auditor = auditor,
+                });
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(auditor);
+
+            mptAlice.set(
+                {.account = alice,
+                 .issuerPubKey = mptAlice.getPubKey(alice),
+                 .auditorPubKey = mptAlice.getPubKey(auditor)});
+
+            // no auditor encrypted amt provided
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .fillAuditorEncryptedAmt = false,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // cannot convert if tx include auditor ciphertext, but does not have
+        // auditing enabled
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            // there is no auditor key set
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .auditorEncryptedAmt = getTrivialCiphertext(),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Auditor key set successfully, auditor ciphertext mathematically
+        // correct, but contains invalid data (mismatching amount).
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const auditor("auditor");
+            MPTTester mptAlice(
+                env,
+                alice,
+                {
+                    .holders = {bob},
+                    .auditor = auditor,
+                });
+
+            mptAlice.create({
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(auditor);
+
+            mptAlice.set(
+                {.account = alice,
+                 .issuerPubKey = mptAlice.getPubKey(alice),
+                 .auditorPubKey = mptAlice.getPubKey(auditor)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .auditorEncryptedAmt = getTrivialCiphertext(),
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // invalid proof when registering holder pub key
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .proof = std::string(kEcSchnorrProofLength * 2, 'A'),
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // no holder key on ledger and no key in tx
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            // bob has not registered a holder key, and doesn't provide one
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // all public balance already converted, try to convert more
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            // convert entire public balance
+            mptAlice.convert({
+                .account = bob,
+                .amt = 100,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            env.require(MptBalance(mptAlice, bob, 0));
+
+            // try to convert 1 more — no public balance left
+            mptAlice.convert({
+                .account = bob,
+                .amt = 1,
+                .err = tecINSUFFICIENT_FUNDS,
+            });
+        }
+    }
+
+    void
+    testMergeInbox(FeatureBitset features)
+    {
+        testcase("Merge inbox");
+        using namespace test::jtx;
+
+        // Merge with an empty inbox should succeed as a no-op.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({.account = bob});
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 40,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.mergeInbox({.account = bob});
+            // Inbox is empty after the first merge; the second merge is a no-op.
+            mptAlice.mergeInbox({.account = bob});
+        }
+
+        // Makes sure if merge inbox version is UINT32_MAX, the next merge wraps
+        // the version back to 0.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({.account = bob});
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+            });
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 40,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            // Force the on-ledger version to UINT32_MAX, then apply a merge and
+            // confirm the version wraps around to 0.
+            auto const wrappedFrom = std::numeric_limits<std::uint32_t>::max();
+            auto const jt = env.jt(mptAlice.mergeInboxJV({.account = bob}));
+            BEAST_EXPECT(env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal) {
+                auto const sle = std::const_pointer_cast<SLE>(
+                    view.read(keylet::mptoken(mptAlice.issuanceID(), bob.id())));
+                if (!sle)
+                    return false;
+
+                (*sle)[sfConfidentialBalanceVersion] = wrappedFrom;
+                view.rawReplace(sle);
+
+                auto const result = xrpl::apply(env.app(), view, *jt.stx, TapNone, env.journal);
+                BEAST_EXPECT(result.ter == tesSUCCESS);
+                return result.applied;
+            }));
+
+            BEAST_EXPECT(mptAlice.getMPTokenVersion(bob) == 0);
+        }
+    }
+
+    void
+    testMergeInboxPreflight(FeatureBitset features)
+    {
+        testcase("Merge inbox preflight");
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+        });
+
+        mptAlice.authorize({
+            .account = bob,
+        });
+        mptAlice.pay(alice, bob, 100);
+
+        mptAlice.generateKeyPair(alice);
+
+        mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+        mptAlice.generateKeyPair(bob);
+
+        mptAlice.convert({
+            .account = bob,
+            .amt = 40,
+            .holderPubKey = mptAlice.getPubKey(bob),
+        });
+
+        mptAlice.mergeInbox({
+            .account = alice,
+            .err = temMALFORMED,
+        });
+
+        env.disableFeature(featureConfidentialTransfer);
+        env.close();
+
+        mptAlice.mergeInbox({
+            .account = bob,
+            .err = temDISABLED,
+        });
+    }
+
+    void
+    testMergeInboxPreclaim(FeatureBitset features)
+    {
+        testcase("Merge inbox preclaim");
+        using namespace test::jtx;
+
+        // issuance does not exist
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.destroy();
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.mergeInbox({
+                .account = bob,
+                .err = tecOBJECT_NOT_FOUND,
+            });
+        }
+
+        // tfMPTCanHoldConfidentialBalance is not set on issuance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.mergeInbox({
+                .account = bob,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // no mptoken
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.mergeInbox({
+                .account = bob,
+                .err = tecOBJECT_NOT_FOUND,
+            });
+        }
+
+        // bob doesn't have encrypted balances
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.mergeInbox({
+                .account = bob,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // holder is locked
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            // lock bob
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTLock,
+            });
+
+            mptAlice.mergeInbox({
+                .account = bob,
+                .err = tecLOCKED,
+            });
+
+            // unlock bob
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnlock,
+            });
+
+            // should succeed now
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+        }
+
+        // holder not authorized
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance |
+                    tfMPTRequireAuth,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            // unauthorize bob
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnauthorize,
+            });
+
+            mptAlice.mergeInbox({
+                .account = bob,
+                .err = tecNO_AUTH,
+            });
+
+            // authorize bob again
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+
+            // should succeed now
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+        }
+    }
+
+    void
+    testSend(FeatureBitset features)
+    {
+        testcase("test confidential send");
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 100, .convertAmount = 60},
+             {.account = carol, .payAmount = 50, .convertAmount = 20}}};
+        auto& mptAlice = confEnv.mpt;
+
+        // bob sends 10 to carol
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 10,
+        });
+
+        // bob sends 1 to carol again
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 1,
+        });
+
+        mptAlice.mergeInbox({
+            .account = carol,
+        });
+
+        // carol sends 15 back to bob
+        mptAlice.send({
+            .account = carol,
+            .dest = bob,
+            .amt = 15,
+        });
+    }
+
+    void
+    testSendWithAuditor(FeatureBitset features)
+    {
+        testcase("test confidential send with auditor");
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const auditor("auditor");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 100, .convertAmount = 60},
+             {.account = carol, .payAmount = 50, .convertAmount = 20}},
+            tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            auditor};
+        auto& mptAlice = confEnv.mpt;
+
+        // bob sends 10 to carol
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 10,
+        });
+
+        // bob sends 1 to carol again
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 1,
+        });
+
+        mptAlice.mergeInbox({
+            .account = carol,
+        });
+
+        // carol sends 15 back to bob
+        mptAlice.send({
+            .account = carol,
+            .dest = bob,
+            .amt = 15,
+        });
+    }
+
+    void
+    testSendPreflight(FeatureBitset features)
+    {
+        testcase("test ConfidentialMPTSend Preflight");
+        using namespace test::jtx;
+
+        // test disabled
+        {
+            Env env{*this, features - featureConfidentialTransfer};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create();
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .senderEncryptedAmt = gMakeZeroBuffer(kEcGamalEncryptedTotalLength),
+                .destEncryptedAmt = gMakeZeroBuffer(kEcGamalEncryptedTotalLength),
+                .issuerEncryptedAmt = gMakeZeroBuffer(kEcGamalEncryptedTotalLength),
+                .err = temDISABLED,
+            });
+        }
+
+        // test malformed
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 50);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.convert({
+                .account = carol,
+                .amt = 40,
+                .holderPubKey = mptAlice.getPubKey(carol),
+            });
+
+            // issuer can not be the same as sender
+            mptAlice.send({
+                .account = alice,
+                .dest = carol,
+                .amt = 10,
+                .err = temMALFORMED,
+            });
+
+            // can not send to self
+            mptAlice.send({
+                .account = bob,
+                .dest = bob,
+                .amt = 10,
+                .err = temMALFORMED,
+            });
+
+            // can not send to issuer
+            mptAlice.send({
+                .account = bob,
+                .dest = alice,
+                .amt = 10,
+                .err = temMALFORMED,
+            });
+
+            // sender encrypted amount wrong length
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .senderEncryptedAmt = gMakeZeroBuffer(10),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // dest encrypted amount wrong length
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .destEncryptedAmt = gMakeZeroBuffer(10),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // issuer encrypted amount wrong length
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .issuerEncryptedAmt = gMakeZeroBuffer(10),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // sender encrypted amount malformed
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = gMakeZeroBuffer(kEcGamalEncryptedTotalLength),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // dest encrypted amount malformed
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .destEncryptedAmt = gMakeZeroBuffer(kEcGamalEncryptedTotalLength),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // issuer encrypted amount malformed
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .issuerEncryptedAmt = gMakeZeroBuffer(kEcGamalEncryptedTotalLength),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // invalid proof length
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = std::string(10, 'A'),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temMALFORMED,
+            });
+
+            // invalid amount Pedersen commitment length
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .amountCommitment = gMakeZeroBuffer(100),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temMALFORMED,
+            });
+
+            // invalid balance Pedersen commitment length
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = gMakeZeroBuffer(100),
+                .err = temMALFORMED,
+            });
+
+            // amount Pedersen commitment has correct length but invalid EC point data
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .amountCommitment = gMakeZeroBuffer(kEcPedersenCommitmentLength),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temMALFORMED,
+            });
+
+            // balance Pedersen commitment has correct length but invalid EC point data
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = gMakeZeroBuffer(kEcPedersenCommitmentLength),
+                .err = temMALFORMED,
+            });
+        }
+
+        // test bad ciphertext
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const auditor("auditor");
+            MPTTester mptAlice(
+                env,
+                alice,
+                {
+                    .holders = {bob, carol},
+                    .auditor = auditor,
+                });
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.generateKeyPair(auditor);
+
+            mptAlice.set(
+                {.account = alice,
+                 .issuerPubKey = mptAlice.getPubKey(alice),
+                 .auditorPubKey = mptAlice.getPubKey(auditor)});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 50);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.convert({
+                .account = carol,
+                .amt = 40,
+                .holderPubKey = mptAlice.getPubKey(carol),
+            });
+
+            // auditor encrypted amount wrong length
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .auditorEncryptedAmt = gMakeZeroBuffer(10),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // auditor encrypted amount (correct length, invalid data)
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .auditorEncryptedAmt = getBadCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+        }
+    }
+
+    void
+    testSendPreclaim(FeatureBitset features)
+    {
+        testcase("test ConfidentialMPTSend Preclaim");
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+        Account const eve("eve");
+        MPTTester mptAlice(env, alice, {.holders = {bob, carol, dave, eve}});
+
+        // authorize bob, carol, dave (not eve)
+        mptAlice.create({
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth |
+                tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({
+            .account = bob,
+        });
+        mptAlice.authorize({
+            .account = alice,
+            .holder = bob,
+        });
+        mptAlice.authorize({
+            .account = carol,
+        });
+        mptAlice.authorize({
+            .account = alice,
+            .holder = carol,
+        });
+        mptAlice.authorize({
+            .account = dave,
+        });
+        mptAlice.authorize({
+            .account = alice,
+            .holder = dave,
+        });
+
+        // fund bob, carol (not dave or eve)
+        mptAlice.pay(alice, bob, 100);
+        mptAlice.pay(alice, carol, 50);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.generateKeyPair(carol);
+        mptAlice.generateKeyPair(dave);
+        mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+        // bob and carol convert some funds to confidential
+        mptAlice.convert({
+            .account = bob,
+            .amt = 60,
+            .holderPubKey = mptAlice.getPubKey(bob),
+            .err = tesSUCCESS,
+        });
+        mptAlice.convert({
+            .account = carol,
+            .amt = 20,
+            .holderPubKey = mptAlice.getPubKey(carol),
+            .err = tesSUCCESS,
+        });
+
+        // bob and carol merge inbox
+        mptAlice.mergeInbox({
+            .account = bob,
+        });
+        mptAlice.mergeInbox({
+            .account = carol,
+        });
+
+        // issuance not found
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+            mptAlice.generateKeyPair(alice);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            // destroy the issuance
+            mptAlice.destroy();
+
+            json::Value jv;
+            jv[jss::Account] = bob.human();
+            jv[jss::Destination] = carol.human();
+            jv[jss::TransactionType] = jss::ConfidentialMPTSend;
+            jv[sfMPTokenIssuanceID] = to_string(mptAlice.issuanceID());
+            jv[sfSenderEncryptedAmount] = strHex(getTrivialCiphertext());
+            jv[sfDestinationEncryptedAmount] = strHex(getTrivialCiphertext());
+            jv[sfIssuerEncryptedAmount] = strHex(getTrivialCiphertext());
+            jv[sfAmountCommitment] = strHex(getTrivialCommitment());
+            jv[sfBalanceCommitment] = strHex(getTrivialCommitment());
+            jv[sfZKProof] = getTrivialSendProofHex();
+
+            env(jv, Ter(tecOBJECT_NOT_FOUND));
+        }
+
+        // destination does not exist
+        {
+            Account const unknown("unknown");
+            mptAlice.send({
+                .account = bob,
+                .dest = unknown,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = getTrivialCiphertext(),
+                .destEncryptedAmt = getTrivialCiphertext(),
+                .issuerEncryptedAmt = getTrivialCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = tecNO_TARGET,
+            });
+        }
+
+        // destination requires destination tag but none provided
+        {
+            env(fset(carol, asfRequireDest));
+            env.close();
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = getTrivialCiphertext(),
+                .destEncryptedAmt = getTrivialCiphertext(),
+                .issuerEncryptedAmt = getTrivialCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = tecDST_TAG_NEEDED,
+            });
+
+            env(fclear(carol, asfRequireDest));
+            env.close();
+        }
+
+        // dave exists, but has no confidential fields (never converted)
+        {
+            mptAlice.send({
+                .account = bob,
+                .dest = dave,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = getTrivialCiphertext(),
+                .destEncryptedAmt = getTrivialCiphertext(),
+                .issuerEncryptedAmt = getTrivialCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = tecNO_PERMISSION,
+            });
+            mptAlice.send({
+                .account = dave,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = getTrivialCiphertext(),
+                .destEncryptedAmt = getTrivialCiphertext(),
+                .issuerEncryptedAmt = getTrivialCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // destination exists but has no MPT object.
+        {
+            mptAlice.send({
+                .account = bob,
+                .dest = eve,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = getTrivialCiphertext(),
+                .destEncryptedAmt = getTrivialCiphertext(),
+                .issuerEncryptedAmt = getTrivialCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = tecOBJECT_NOT_FOUND,
+            });
+        }
+
+        // issuance is locked globally
+        {
+            // lock issuance
+            mptAlice.set({
+                .account = alice,
+                .flags = tfMPTLock,
+            });
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .err = tecLOCKED,
+            });
+            // unlock issuance
+            mptAlice.set({
+                .account = alice,
+                .flags = tfMPTUnlock,
+            });
+            // now can send
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 1,
+            });
+        }
+
+        // sender is locked
+        {
+            // lock bob
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTLock,
+            });
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .err = tecLOCKED,
+            });
+            // unlock bob
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnlock,
+            });
+            // now can send
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 2,
+            });
+        }
+
+        // destination is locked
+        {
+            // lock carol
+            mptAlice.set({
+                .account = alice,
+                .holder = carol,
+                .flags = tfMPTLock,
+            });
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .err = tecLOCKED,
+            });
+            // unlock carol
+            mptAlice.set({
+                .account = alice,
+                .holder = carol,
+                .flags = tfMPTUnlock,
+            });
+            // now can send
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 3,
+            });
+        }
+
+        // sender not authorized
+        {
+            // unauthorize bob
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnauthorize,
+            });
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .err = tecNO_AUTH,
+            });
+            // authorize bob again
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+            // now can send
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 4,
+            });
+        }
+
+        // destination not authorized
+        {
+            // unauthorize carol
+            mptAlice.authorize({
+                .account = alice,
+                .holder = carol,
+                .flags = tfMPTUnauthorize,
+            });
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .err = tecNO_AUTH,
+            });
+            // authorize carol again
+            mptAlice.authorize({
+                .account = alice,
+                .holder = carol,
+            });
+            // now can send
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 5,
+            });
+        }
+
+        // cannot send when MPTCanTransfer is not set
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 60},
+                 {.account = carol, .payAmount = 50, .convertAmount = 20}},
+                tfMPTCanLock | tfMPTCanHoldConfidentialBalance};
+            auto& mptAlice = confEnv.mpt;
+
+            // bob sends 10 to carol
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,  // will be encrypted internally
+                .err = tecNO_AUTH,
+            });
+        }
+
+        // Confidential MPTs should not have a transfer fee. Force malformed
+        // ledger state to cover the defensive preclaim check.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 60},
+                 {.account = carol, .payAmount = 50, .convertAmount = 20}}};
+            auto& mptAlice = confEnv.mpt;
+
+            BEAST_EXPECT(env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal) {
+                auto const issuance = std::const_pointer_cast<SLE>(
+                    view.read(keylet::mptokenIssuance(mptAlice.issuanceID())));
+                if (!issuance)
+                    return false;
+
+                issuance->setFieldU16(sfTransferFee, 1);
+                view.rawReplace(issuance);
+                return true;
+            }));
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // bad proof
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 60},
+                 {.account = carol, .payAmount = 50, .convertAmount = 20}}};
+            auto& mptAlice = confEnv.mpt;
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // No Auditor key set, but auditor encrypted amt provided
+        {
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .auditorEncryptedAmt = getTrivialCiphertext(),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Auditor CipherText is Valid, but does not match the Txn Amount
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const auditor("auditor");
+            MPTTester mptAlice(
+                env,
+                alice,
+                {
+                    .holders = {bob, carol},
+                    .auditor = auditor,
+                });
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.generateKeyPair(auditor);
+
+            mptAlice.set(
+                {.account = alice,
+                 .issuerPubKey = mptAlice.getPubKey(alice),
+                 .auditorPubKey = mptAlice.getPubKey(auditor)});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 50);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.convert({
+                .account = carol,
+                .amt = 40,
+                .holderPubKey = mptAlice.getPubKey(carol),
+            });
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .auditorEncryptedAmt = getTrivialCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = tecBAD_PROOF,
+            });
+        }
+    }
+
+    void
+    testSendRangeProof(FeatureBitset features)
+    {
+        testcase("test ConfidentialMPTSend Range Proof");
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 1000, .convertAmount = 60},
+             {.account = carol, .payAmount = 1000, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        {
+            // Bob has 60, tries to send 70. Invalid remaining balance.
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 70,
+                .err = tecBAD_PROOF,
+            });
+
+            // Bob has 60, tries to send 61. Invalid remaining balance.
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 61,
+                .err = tecBAD_PROOF,
+            });
+
+            // Bob has 60, sends 60. Remainder is exactly 0. Valid remaining balance.
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 60,
+                .err = tesSUCCESS,
+            });
+        }
+
+        {
+            // Bob converts 100.
+            mptAlice.convert({
+                .account = bob,
+                .amt = 100,
+            });
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+
+            // Bob has 100, tries to send 2^64-1. Invalid remaining balance.
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = std::numeric_limits<std::uint64_t>::max(),
+                .err = tecBAD_PROOF,
+            });
+
+            // Bob sends 1, remaining 99.
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 1,
+                .err = tesSUCCESS,
+            });
+
+            // Bob sends 100, but only has 99. Invalid remaining balance.
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 100,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // send when spending balance is 0 (key registered, inbox merged, but nothing converted)
+        {
+            // Register keys only (amt=0) for both parties — spending stays 0.
+            Env env2{*this, features};
+            Account const alice2("alice"), bob2("bob"), carol2("carol");
+            ConfidentialEnv zeroEnv{
+                env2,
+                alice2,
+                {{.account = bob2, .payAmount = 100, .convertAmount = 0},
+                 {.account = carol2, .payAmount = 50, .convertAmount = 0}}};
+            auto& mptAlice2 = zeroEnv.mpt;
+
+            // Trying to send any amount with 0 spending balance must fail:
+            // the range proof for < 0 is invalid.
+            mptAlice2.send({
+                .account = bob2,
+                .dest = carol2,
+                .amt = 1,
+                .err = tecBAD_PROOF,
+            });
+
+            BEAST_EXPECT(
+                mptAlice2.getDecryptedBalance(bob2, MPTTester::holderEncryptedSpending) == 0);
+        }
+
+        // todo: test m exceeding range, require using scala and refactor
+    }
+
+    /* The equality proof library and range proof library do not
+     * support generating proofs for amt=0 (they require a positive witness).
+     * To test the VERIFIER without crashing the helper, we bypass normal proof
+     * generation by supplying explicit ciphertexts, commitments, and a dummy
+     * (all-zero) proof.  The preflight has no temBAD_AMOUNT guard for
+     * ConfidentialMPTSend, so all validation occurs in verifySendProofs.
+     */
+    void
+    testSendZeroAmount(FeatureBitset features)
+    {
+        testcase("Send: zero amount — equality and range proof verifier behavior");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+        mptAlice.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({.account = bob});
+        mptAlice.authorize({.account = carol});
+        mptAlice.pay(alice, bob, 100);
+        mptAlice.pay(alice, carol, 50);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.generateKeyPair(carol);
+
+        mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+        mptAlice.convert({.account = bob, .amt = 100, .holderPubKey = mptAlice.getPubKey(bob)});
+        mptAlice.mergeInbox({.account = bob});
+
+        mptAlice.convert({.account = carol, .amt = 50, .holderPubKey = mptAlice.getPubKey(carol)});
+        mptAlice.mergeInbox({.account = carol});
+
+        Buffer const bf = generateBlindingFactor();
+
+        // equality proof verification for amt=0.
+        // Encrypt 0 under each participant's key.  The amount commitment is
+        // getTrivialCommitment() — a valid EC point that passes preflight's
+        // isValidCompressedECPoint check but is not the true PC for amt=0.
+        // The dummy ZKProof's equality component must be rejected by
+        // verifyMultiCiphertextEqualityProof.
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 0,
+            .proof = getTrivialSendProofHex(),
+            .senderEncryptedAmt = mptAlice.encryptAmount(bob, 0, bf),
+            .destEncryptedAmt = mptAlice.encryptAmount(carol, 0, bf),
+            .issuerEncryptedAmt = mptAlice.encryptAmount(alice, 0, bf),
+            .amountCommitment = getTrivialCommitment(),
+            .balanceCommitment = getTrivialCommitment(),
+            .err = tecBAD_PROOF,
+        });
+
+        // range proof verification for amt=0.
+        // Identical construction; focuses on the bulletproof range check
+        // embedded in ZKProof.  The range proof for amount=0 with a dummy
+        // (all-zero) proof must also be rejected.
+        Buffer const bf2 = generateBlindingFactor();
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 0,
+            .proof = getTrivialSendProofHex(),
+            .senderEncryptedAmt = mptAlice.encryptAmount(bob, 0, bf2),
+            .destEncryptedAmt = mptAlice.encryptAmount(carol, 0, bf2),
+            .issuerEncryptedAmt = mptAlice.encryptAmount(alice, 0, bf2),
+            .amountCommitment = getTrivialCommitment(),
+            .balanceCommitment = getTrivialCommitment(),
+            .err = tecBAD_PROOF,
+        });
+
+        // All rejected sends must leave balances unchanged.
+        BEAST_EXPECT(mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
+        BEAST_EXPECT(mptAlice.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+    }
+
+    void
+    testDelete(FeatureBitset features)
+    {
+        testcase("Delete");
+        using namespace test::jtx;
+
+        // cannot delete mptoken where it has encrypted balance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 100,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+                .flags = tfMPTUnauthorize,
+                .err = tecHAS_OBLIGATIONS,
+            });
+        }
+
+        // cannot delete mptoken where it has encrypted balance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 100,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.convert({
+                .account = carol,
+                .amt = 0,
+                .holderPubKey = mptAlice.getPubKey(carol),
+            });
+
+            // carol cannot delete even if he has encrypted zero amount
+            mptAlice.authorize({
+                .account = carol,
+                .flags = tfMPTUnauthorize,
+                .err = tecHAS_OBLIGATIONS,
+            });
+        }
+
+        // can delete mptoken if outstanding confidential balance is zero
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 0,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+                .flags = tfMPTUnauthorize,
+            });
+        }
+
+        // can delete mptoken if issuance has been destroyed and has
+        // encrypted zero balance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 0,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.destroy();
+
+            mptAlice.authorize({
+                .account = bob,
+                .flags = tfMPTUnauthorize,
+            });
+        }
+        // test with convert back and delete
+        // can delete mptoken if converted back (COA returns to zero)
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 100}}};
+            auto& mptAlice = confEnv.mpt;
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 100,
+            });
+
+            mptAlice.pay(bob, alice, 100);
+
+            // Should be able to delete as Confidential Outstanding amount is 0
+            mptAlice.authorize({
+                .account = bob,
+                .flags = tfMPTUnauthorize,
+            });
+        }
+
+        // removeEmptyHolding: vault share MPToken with confidential balance
+        // fields should not be deleted on VaultWithdraw
+        {
+            Env env{*this, features | featureSingleAssetVault};
+            Account const issuer("issuer");
+            Account const owner("owner");
+            Account const depositor("depositor");
+
+            MPTTester mptt{env, issuer, {.holders = {owner, depositor}}};
+            mptt.create({
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanClawback,
+            });
+            PrettyAsset const asset = mptt.issuanceID();
+            mptt.authorize({.account = owner});
+            mptt.authorize({.account = depositor});
+            env(pay(issuer, depositor, asset(1000)));
+            env.close();
+
+            test::jtx::Vault const vault{env};
+            auto [tx, vaultKeylet] = vault.create({.owner = owner, .asset = asset});
+            env(tx);
+            env.close();
+
+            // Get the share MPTID from vault
+            auto const vaultSle = env.le(vaultKeylet);
+            BEAST_EXPECT(vaultSle != nullptr);
+            auto const share = vaultSle->at(sfShareMPTID);
+
+            // Depositor deposits into vault
+            tx = vault.deposit(
+                {.depositor = depositor, .id = vaultKeylet.key, .amount = asset(100)});
+            env(tx);
+            env.close();
+
+            // Verify depositor has share tokens
+            auto shareMpt = env.le(keylet::mptoken(share, depositor.id()));
+            BEAST_EXPECT(shareMpt != nullptr);
+
+            // Inject confidential balance fields on the share MPToken
+            // to simulate a scenario where vault shares somehow have
+            // confidential balances
+            env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal) {
+                // Set lsfMPTCanHoldConfidentialBalance on the share issuance
+                // so the invariant allows encrypted fields on the MPToken
+                auto issuance =
+                    std::const_pointer_cast<SLE>(view.read(keylet::mptokenIssuance(share)));
+                if (!issuance)
+                    return false;
+                issuance->setFlag(lsfMPTCanHoldConfidentialBalance);
+                view.rawReplace(issuance);
+
+                auto const k = keylet::mptoken(share, depositor.id());
+                auto const sle = std::const_pointer_cast<SLE>(view.read(k));
+                if (!sle)
+                    return false;
+                // Inject dummy confidential balance fields
+                Buffer dummyCiphertext(kEcGamalEncryptedTotalLength);
+                std::memset(dummyCiphertext.data(), 0, kEcGamalEncryptedTotalLength);
+                dummyCiphertext.data()[0] = kEcCompressedPrefixEvenY;
+                dummyCiphertext.data()[kEcCiphertextComponentLength] = kEcCompressedPrefixEvenY;
+                dummyCiphertext.data()[kEcCiphertextComponentLength - 1] = 0x01;
+                dummyCiphertext.data()[kEcGamalEncryptedTotalLength - 1] = 0x01;
+                sle->setFieldVL(sfConfidentialBalanceSpending, dummyCiphertext);
+                sle->setFieldVL(sfConfidentialBalanceInbox, dummyCiphertext);
+                sle->setFieldVL(sfIssuerEncryptedBalance, dummyCiphertext);
+                view.rawReplace(sle);
+                return true;
+            });
+
+            // Withdraw everything - which should fail because of the confidential balance fields
+            tx = vault.withdraw(
+                {.depositor = depositor, .id = vaultKeylet.key, .amount = asset(100)});
+            env(tx);
+
+            // The share MPToken should still exist because the
+            // withdrawal failed due to confidential balance obligations
+            shareMpt = env.le(keylet::mptoken(share, depositor.id()));
+            BEAST_EXPECT(shareMpt != nullptr);
+        }
+    }
+
+    void
+    testConvertBack(FeatureBitset features)
+    {
+        testcase("Convert back");
+        using namespace test::jtx;
+
+        // Basic convert back test
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 40}}};
+            auto& mptAlice = confEnv.mpt;
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+            });
+        }
+
+        // Edge case: minimum amount (1)
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 2, .convertAmount = 2}}};
+            auto& mptAlice = confEnv.mpt;
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 1,
+            });
+        }
+
+        // Edge case: kMaxMpTokenAmount
+        // Using raw JSON to avoid automatic decryption checks in MPTTester
+        // which don't work for very large amounts (brute-force decryption is slow)
+        // TODO: improve this test once there is bounded decryption or optimized decryption for
+        // large amounts
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, kMaxMpTokenAmount);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            // Convert kMaxMpTokenAmount to confidential using raw JSON
+            Buffer const convertBlindingFactor = generateBlindingFactor();
+            auto const convertHolderCiphertext =
+                mptAlice.encryptAmount(bob, kMaxMpTokenAmount, convertBlindingFactor);
+            auto const convertIssuerCiphertext =
+                mptAlice.encryptAmount(alice, kMaxMpTokenAmount, convertBlindingFactor);
+            auto const convertContextHash =
+                getConvertContextHash(bob.id(), mptAlice.issuanceID(), env.seq(bob));
+            auto const schnorrProof = requireOptional(
+                mptAlice.getSchnorrProof(bob, convertContextHash), "Missing schnorr proof");
+
+            {
+                json::Value jv;
+                jv[jss::Account] = bob.human();
+                jv[jss::TransactionType] = jss::ConfidentialMPTConvert;
+                jv[sfMPTokenIssuanceID] = to_string(mptAlice.issuanceID());
+                jv[sfMPTAmount.jsonName] = std::to_string(kMaxMpTokenAmount);
+                jv[sfHolderEncryptionKey.jsonName] =
+                    strHex(requireOptional(mptAlice.getPubKey(bob), "Missing holder public key"));
+                jv[sfHolderEncryptedAmount.jsonName] = strHex(convertHolderCiphertext);
+                jv[sfIssuerEncryptedAmount.jsonName] = strHex(convertIssuerCiphertext);
+                jv[sfBlindingFactor.jsonName] = strHex(convertBlindingFactor);
+                jv[sfZKProof.jsonName] = strHex(schnorrProof);
+
+                env(jv, Ter(tesSUCCESS));
+            }
+
+            // Merge inbox using raw JSON - moves funds from inbox to spending balance
+            {
+                json::Value jv;
+                jv[jss::Account] = bob.human();
+                jv[jss::TransactionType] = jss::ConfidentialMPTMergeInbox;
+                jv[sfMPTokenIssuanceID] = to_string(mptAlice.issuanceID());
+
+                env(jv, Ter(tesSUCCESS));
+            }
+
+            // ConvertBack kMaxMpTokenAmount - 1 using raw JSON
+            // After convert + merge, spending balance = kMaxMpTokenAmount
+            // We convert back kMaxMpTokenAmount - 1 to leave remainder of 1
+            std::uint64_t const convertBackAmt = kMaxMpTokenAmount - 1;
+
+            Buffer const convertBackBlindingFactor = generateBlindingFactor();
+            auto const convertBackHolderCiphertext =
+                mptAlice.encryptAmount(bob, convertBackAmt, convertBackBlindingFactor);
+            auto const convertBackIssuerCiphertext =
+                mptAlice.encryptAmount(alice, convertBackAmt, convertBackBlindingFactor);
+
+            // Get the encrypted spending balance from ledger (no decryption needed)
+            auto const encryptedSpendingBalance = requireOptional(
+                mptAlice.getEncryptedBalance(bob, MPTTester::holderEncryptedSpending),
+                "Missing encrypted spending balance");
+
+            // Generate pedersen commitment for the known spending balance
+            Buffer const pcBlindingFactor = generateBlindingFactor();
+            Buffer const pedersenCommitment =
+                mptAlice.getPedersenCommitment(kMaxMpTokenAmount, pcBlindingFactor);
+
+            // Generate the proof using known spending balance value
+            auto const version = mptAlice.getMPTokenVersion(bob);
+            uint256 const convertBackContextHash =
+                getConvertBackContextHash(bob.id(), mptAlice.issuanceID(), env.seq(bob), version);
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                convertBackAmt,
+                convertBackContextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = kMaxMpTokenAmount,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            {
+                json::Value jv;
+                jv[jss::Account] = bob.human();
+                jv[jss::TransactionType] = jss::ConfidentialMPTConvertBack;
+                jv[sfMPTokenIssuanceID] = to_string(mptAlice.issuanceID());
+                jv[sfMPTAmount.jsonName] = std::to_string(convertBackAmt);
+                jv[sfHolderEncryptedAmount.jsonName] = strHex(convertBackHolderCiphertext);
+                jv[sfIssuerEncryptedAmount.jsonName] = strHex(convertBackIssuerCiphertext);
+                jv[sfBlindingFactor.jsonName] = strHex(convertBackBlindingFactor);
+                jv[sfBalanceCommitment.jsonName] = strHex(pedersenCommitment);
+                jv[sfZKProof.jsonName] = strHex(proof);
+
+                env(jv, Ter(tesSUCCESS));
+            }
+
+            // Verify the public balance was restored (minus 1 remaining in confidential)
+            env.require(MptBalance(mptAlice, bob, convertBackAmt));
+        }
+    }
+
+    void
+    testConvertBackWithAuditor(FeatureBitset features)
+    {
+        testcase("Convert back with auditor");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const auditor("auditor");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 100, .convertAmount = 40}},
+            tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            auditor};
+        auto& mptAlice = confEnv.mpt;
+
+        mptAlice.convertBack({
+            .account = bob,
+            .amt = 30,
+        });
+    }
+
+    void
+    testConvertBackPreflight(FeatureBitset features)
+    {
+        testcase("Convert back preflight");
+        using namespace test::jtx;
+
+        {
+            Env env{*this, features - featureConfidentialTransfer};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .err = temDISABLED,
+            });
+        }
+
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 40}}};
+            auto& mptAlice = confEnv.mpt;
+
+            mptAlice.convertBack({
+                .account = alice,
+                .amt = 30,
+                .err = temMALFORMED,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 0,
+                .err = temBAD_AMOUNT,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = kMaxMpTokenAmount + 1,
+                .err = temBAD_AMOUNT,
+            });
+
+            // Balance commitment has correct length but invalid EC point data
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .pedersenCommitment = gMakeZeroBuffer(kEcPedersenCommitmentLength),
+                .err = temMALFORMED,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .holderEncryptedAmt = Buffer{},
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .issuerEncryptedAmt = Buffer{},
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .holderEncryptedAmt = getBadCiphertext(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .issuerEncryptedAmt = getBadCiphertext(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .auditorEncryptedAmt = gMakeZeroBuffer(10),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .auditorEncryptedAmt = getBadCiphertext(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // invalid proof length
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .proof = Buffer{},
+                .err = temMALFORMED,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .proof = gMakeZeroBuffer(100),
+                .err = temMALFORMED,
+            });
+        }
+    }
+
+    void
+    testConvertBackPreclaim(FeatureBitset features)
+    {
+        testcase("Convert back preclaim");
+        using namespace test::jtx;
+
+        // issuance does not exist
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.destroy();
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .err = tecOBJECT_NOT_FOUND,
+            });
+        }
+
+        // tfMPTCanHoldConfidentialBalance is not set on issuance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // no mptoken
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .err = tecOBJECT_NOT_FOUND,
+            });
+        }
+
+        // mptoken exists but lacks confidential fields
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            // Bob's MPToken lacks the confidential fields
+            auto const sleBobMpt = env.le(keylet::mptoken(mptAlice.issuanceID(), bob.id()));
+            BEAST_EXPECT(sleBobMpt);
+            BEAST_EXPECT(!sleBobMpt->isFieldPresent(sfHolderEncryptionKey));
+            BEAST_EXPECT(!sleBobMpt->isFieldPresent(sfConfidentialBalanceSpending));
+            BEAST_EXPECT(!sleBobMpt->isFieldPresent(sfIssuerEncryptedBalance));
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 30,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // bob tries to convert back more than COA
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 40,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+
+            mptAlice.convert({
+                .account = carol,
+                .amt = 40,
+                .holderPubKey = mptAlice.getPubKey(carol),
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 300,
+                .err = tecINSUFFICIENT_FUNDS,
+            });
+        }
+
+        // cannot convert if locked or unauth
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth |
+                    tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 40,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTLock,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+                .err = tecLOCKED,
+            });
+
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnlock,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+            });
+
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnauthorize,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+                .err = tecNO_AUTH,
+            });
+
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+            });
+        }
+
+        // Verification of holder and issuer ciphertexts during convertBack
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 50}}};
+            auto& mptAlice = confEnv.mpt;
+
+            // Holder encrypted amount is valid format but mathematically incorrect for this
+            // convertBack
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+                .holderEncryptedAmt = getTrivialCiphertext(),
+                .err = tecBAD_PROOF,
+            });
+
+            // Issuer encrypted amount is valid format but mathematically incorrect for this
+            // convertBack
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+                .issuerEncryptedAmt = getTrivialCiphertext(),
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Alice has NOT set an auditor key, but Bob provides
+        // auditorEncryptedAmt
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 50}}};
+            auto& mptAlice = confEnv.mpt;
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+                // Provide valid ciphertext to pass preflight
+                .auditorEncryptedAmt = getTrivialCiphertext(),
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // we set the auditor key, but convertBack omits auditorEncryptedAmt
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const auditor("auditor");
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50}},
+                tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+                auditor};
+            auto& mptAlice = confEnv.mpt;
+
+            // ConvertBack WITHOUT auditorEncryptedAmt
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+                .fillAuditorEncryptedAmt = false,
+                .err = tecNO_PERMISSION,
+            });
+
+            // ConvertBack where auditor ciphertext mathematically
+            // correct, but contains invalid data (mismatching amount).
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = 10,
+                .auditorEncryptedAmt = getTrivialCiphertext(),
+                .err = tecBAD_PROOF,
+            });
+        }
+    }
+
+    void
+    testClawback(FeatureBitset features)
+    {
+        testcase("test ConfidentialMPTClawback");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+        MPTTester mptAlice(env, alice, {.holders = {bob, carol, dave}});
+
+        mptAlice.create({
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanClawback |
+                tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({
+            .account = bob,
+        });
+        mptAlice.pay(alice, bob, 100);
+        mptAlice.authorize({
+            .account = carol,
+        });
+        mptAlice.pay(alice, carol, 200);
+        mptAlice.authorize({
+            .account = dave,
+        });
+        mptAlice.pay(alice, dave, 300);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.generateKeyPair(carol);
+        mptAlice.generateKeyPair(dave);
+        mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+        // setup bob.
+        // after setup, bob's spending balance is 60, inbox balance is 0.
+        {
+            // bob converts 60 to confidential
+            mptAlice.convert({.account = bob, .amt = 60, .holderPubKey = mptAlice.getPubKey(bob)});
+
+            // bob merge inbox
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+        }
+
+        // setup carol.
+        // after setup, carol's spending balance is 120, inbox balance is 0.
+        {
+            // carol converts 120 to confidential
+            mptAlice.convert(
+                {.account = carol, .amt = 120, .holderPubKey = mptAlice.getPubKey(carol)});
+
+            // carol merge inbox
+            mptAlice.mergeInbox({
+                .account = carol,
+            });
+        }
+
+        // setup dave.
+        // dave will not merge inbox.
+        // after setup, dave's inbox balance is 200, spending balance is 0.
+        mptAlice.convert({.account = dave, .amt = 200, .holderPubKey = mptAlice.getPubKey(dave)});
+
+        // setup: carol confidential send 50 to bob.
+        // after send, bob's inbox balance is 50, spending balance
+        // remains 60. carol's inbox balance remains 0, spending balance
+        // drops to 70.
+        mptAlice.send({
+            .account = carol,
+            .dest = bob,
+            .amt = 50,
+        });
+
+        // Confidential clawback is burn/reduce outstanding amount.
+        // The holder public balance is unchanged, and OA/COA decrease.
+        auto const preBobPublicBalance = mptAlice.getBalance(bob);
+        auto const preOutstandingAmount = mptAlice.getIssuanceOutstandingBalance();
+        auto const preConfidentialOutstandingAmount = mptAlice.getIssuanceConfidentialBalance();
+        BEAST_EXPECT(!env.le(keylet::mptoken(mptAlice.issuanceID(), alice.id())));
+
+        // alice clawback all confidential balance from bob, 110 in total.
+        // bob has balance in both inbox and spending. These balances should
+        // become zero after clawback, which is verified in the
+        // confidentialClaw function.
+        mptAlice.confidentialClaw({
+            .account = alice,
+            .holder = bob,
+            .amt = 110,
+        });
+        BEAST_EXPECT(mptAlice.getBalance(bob) == preBobPublicBalance);
+        auto const postOutstandingAmount = mptAlice.getIssuanceOutstandingBalance();
+        BEAST_EXPECT(
+            preOutstandingAmount && postOutstandingAmount &&
+            *postOutstandingAmount == *preOutstandingAmount - 110);
+        BEAST_EXPECT(
+            mptAlice.getIssuanceConfidentialBalance() == preConfidentialOutstandingAmount - 110);
+        BEAST_EXPECT(!env.le(keylet::mptoken(mptAlice.issuanceID(), alice.id())));
+
+        // alice clawback all confidential balance from carol, which is 70.
+        // carol only has balance in spending.
+        mptAlice.confidentialClaw({
+            .account = alice,
+            .holder = carol,
+            .amt = 70,
+        });
+
+        // alice clawback all confidential balance from dave, which is 200.
+        // dave only has balance in inbox.
+        mptAlice.confidentialClaw({
+            .account = alice,
+            .holder = dave,
+            .amt = 200,
+        });
+    }
+
+    void
+    testClawbackWithAuditor(FeatureBitset features)
+    {
+        testcase("test ConfidentialMPTClawback with auditor");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+        Account const auditor("auditor");
+        MPTTester mptAlice(
+            env,
+            alice,
+            {
+                .holders = {bob, carol, dave},
+                .auditor = auditor,
+            });
+
+        mptAlice.create({
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanClawback |
+                tfMPTCanHoldConfidentialBalance,
+        });
+        mptAlice.authorize({
+            .account = bob,
+        });
+        mptAlice.pay(alice, bob, 100);
+        mptAlice.authorize({
+            .account = carol,
+        });
+        mptAlice.pay(alice, carol, 200);
+        mptAlice.authorize({
+            .account = dave,
+        });
+        mptAlice.pay(alice, dave, 300);
+
+        mptAlice.generateKeyPair(alice);
+        mptAlice.generateKeyPair(bob);
+        mptAlice.generateKeyPair(carol);
+        mptAlice.generateKeyPair(dave);
+        mptAlice.generateKeyPair(auditor);
+        mptAlice.set(
+            {.account = alice,
+             .issuerPubKey = mptAlice.getPubKey(alice),
+             .auditorPubKey = mptAlice.getPubKey(auditor)});
+
+        // setup bob.
+        // after setup, bob's spending balance is 60, inbox balance is 0.
+        {
+            // bob converts 60 to confidential
+            mptAlice.convert({.account = bob, .amt = 60, .holderPubKey = mptAlice.getPubKey(bob)});
+
+            // bob merge inbox
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+        }
+
+        // setup carol.
+        // after setup, carol's spending balance is 120, inbox balance is 0.
+        {
+            // carol converts 120 to confidential
+            mptAlice.convert(
+                {.account = carol, .amt = 120, .holderPubKey = mptAlice.getPubKey(carol)});
+
+            // carol merge inbox
+            mptAlice.mergeInbox({
+                .account = carol,
+            });
+        }
+
+        // setup dave.
+        // dave will not merge inbox.
+        // after setup, dave's inbox balance is 200, spending balance is 0.
+        mptAlice.convert({.account = dave, .amt = 200, .holderPubKey = mptAlice.getPubKey(dave)});
+
+        // setup: carol confidential send 50 to bob.
+        // after send, bob's inbox balance is 50, spending balance
+        // remains 60. carol's inbox balance remains 0, spending balance
+        // drops to 70.
+        mptAlice.send({
+            .account = carol,
+            .dest = bob,
+            .amt = 50,
+        });
+
+        // alice clawback all confidential balance from bob, 110 in total.
+        // bob has balance in both inbox and spending. These balances should
+        // become zero after clawback, which is verified in the
+        // confidentialClaw function.
+        mptAlice.confidentialClaw({
+            .account = alice,
+            .holder = bob,
+            .amt = 110,
+        });
+
+        // alice clawback all confidential balance from carol, which is 70.
+        // carol only has balance in spending.
+        mptAlice.confidentialClaw({
+            .account = alice,
+            .holder = carol,
+            .amt = 70,
+        });
+
+        // alice clawback all confidential balance from dave, which is 200.
+        // dave only has balance in inbox.
+        mptAlice.confidentialClaw({
+            .account = alice,
+            .holder = dave,
+            .amt = 200,
+        });
+    }
+
+    void
+    testClawbackInvalidProofContextBinding(FeatureBitset features)
+    {
+        testcase("ConfidentialMPTClawback context binding");
+        using namespace test::jtx;
+
+        auto runBadProof = [&](auto makeContextHash) {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 60}},
+                tfMPTCanTransfer | tfMPTCanLock | tfMPTCanClawback |
+                    tfMPTCanHoldConfidentialBalance};
+            auto& mptAlice = confEnv.mpt;
+
+            auto const privKey = mptAlice.getPrivKey(alice);
+            if (!BEAST_EXPECT(privKey.has_value()))
+                return;
+
+            auto const proof = mptAlice.getClawbackProof(
+                bob,
+                60,
+                requireOptionalRef(privKey, "Missing private key"),
+                makeContextHash(env, mptAlice, alice, bob, carol));
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 60,
+                .proof = strHex(requireOptional(proof, "Missing proof")),
+                .err = tecBAD_PROOF,
+            });
+        };
+
+        // Wrong account (issuer) in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const& alice,
+                        Account const& bob,
+                        Account const& carol) {
+            return getClawbackContextHash(carol.id(), mpt.issuanceID(), env.seq(alice), bob.id());
+        });
+
+        // Wrong issuance ID in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const&,
+                        Account const& alice,
+                        Account const& bob,
+                        Account const&) {
+            return getClawbackContextHash(
+                alice.id(), makeMptID(env.seq(alice) + 100, alice), env.seq(alice), bob.id());
+        });
+
+        // Wrong transaction sequence in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const& alice,
+                        Account const& bob,
+                        Account const&) {
+            return getClawbackContextHash(
+                alice.id(), mpt.issuanceID(), env.seq(alice) + 1, bob.id());
+        });
+
+        // Wrong holder in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const& alice,
+                        Account const&,
+                        Account const& carol) {
+            return getClawbackContextHash(alice.id(), mpt.issuanceID(), env.seq(alice), carol.id());
+        });
+    }
+
+    // Bob creates the AMM, but Bob is not the MPT holder checked below.
+    // The AMM has its own pseudo-account (`ammHolder`) that can hold the
+    // public MPT pool balance. That pseudo-account cannot normally
+    // initialize confidential state because the confidential txn's must be
+    // signed by sfAccount, and the AMM pseudo-account has no signing key.
+    // So this is a construction/impossibility test: public AMM MPT state exists
+    // but the corresponding confidential AMM clawback flow is not normally reachable.
+    void
+    testClawbackPreflight(FeatureBitset features)
+    {
+        testcase("test ConfidentialMPTClawback Preflight");
+        using namespace test::jtx;
+
+        // test feature disabled
+        {
+            Env env{*this, features - featureConfidentialTransfer};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create();
+            mptAlice.authorize({
+                .account = bob,
+            });
+
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 10,
+                .proof = "123",
+                .err = temDISABLED,
+            });
+        }
+
+        // test malformed
+        {
+            // set up
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 50);
+
+            // only issuer can clawback
+            mptAlice.confidentialClaw({
+                .account = carol,
+                .holder = bob,
+                .amt = 10,
+                .err = temMALFORMED,
+            });
+
+            // invalid issuance ID, whose issuer is not alice
+            {
+                json::Value jv;
+                jv[jss::Account] = alice.human();
+                jv[sfHolder] = bob.human();
+                jv[jss::TransactionType] = jss::ConfidentialMPTClawback;
+                jv[sfMPTAmount] = std::to_string(10);
+                jv[sfZKProof] = "123";
+
+                // wrong issuance ID
+                jv[sfMPTokenIssuanceID] = "00000004AE123A8556F3CF91154711376AFB0F894F832B3E";
+
+                env(jv, Ter(temMALFORMED));
+            }
+
+            // issuer cannot clawback from self
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = alice,
+                .amt = 10,
+                .err = temMALFORMED,
+            });
+
+            // invalid amount
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 0,
+                .err = temBAD_AMOUNT,
+            });
+
+            // invalid proof length
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 10,
+                .proof = "123",
+                .err = temMALFORMED,
+            });
+        }
+    }
+
+    void
+    testClawbackPreclaim(FeatureBitset features)
+    {
+        testcase("Clawback Preclaim Errors");
+        using namespace test::jtx;
+
+        {
+            // set up, alice is the issuer, bob and carol are authorized
+            // holders. dave is not authorized. bob has confidential
+            // balance, carol does not.
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            Account const dave("dave");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol, dave}});
+
+            mptAlice.create({
+                .flags = tfMPTCanTransfer | tfMPTCanClawback | tfMPTRequireAuth |
+                    tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+            });
+            mptAlice.authorize({
+                .account = carol,
+            });
+            mptAlice.authorize({
+                .account = alice,
+                .holder = carol,
+            });
+
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 50);
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 60,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+
+            // holder does not exist
+            {
+                Account const unknown("unknown");
+                mptAlice.confidentialClaw({
+                    .account = alice,
+                    .holder = unknown,
+                    .amt = 10,
+                    .err = tecNO_TARGET,
+                });
+            }
+
+            // dave does not hold mpt at all, no MPT object
+            {
+                mptAlice.confidentialClaw({
+                    .account = alice,
+                    .holder = dave,
+                    .amt = 10,
+                    .err = tecOBJECT_NOT_FOUND,
+                });
+            }
+
+            // carol has no confidential balance
+            {
+                mptAlice.confidentialClaw({
+                    .account = alice,
+                    .holder = carol,
+                    .amt = 10,
+                    .err = tecNO_PERMISSION,
+                });
+            }
+        }
+
+        // lsfMPTCanClawback not set
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.generateKeyPair(alice);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 10,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // no issuer key
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+            mptAlice.create({
+                .flags = tfMPTCanClawback | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.generateKeyPair(alice);
+
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 10,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // issuance not found
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+            mptAlice.create({
+                .flags = tfMPTCanClawback | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.generateKeyPair(alice);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            // destroy the issuance
+            mptAlice.destroy();
+
+            json::Value jv;
+            jv[jss::Account] = alice.human();
+            jv[sfHolder] = bob.human();
+            jv[jss::TransactionType] = jss::ConfidentialMPTClawback;
+            jv[sfMPTAmount] = std::to_string(10);
+            std::string const dummyProof(kEcClawbackProofLength * 2, '0');
+            jv[sfZKProof] = dummyProof;
+            jv[sfMPTokenIssuanceID] = to_string(mptAlice.issuanceID());
+
+            env(jv, Ter(tecOBJECT_NOT_FOUND));
+        }
+
+        // After setup, bob has confidential balance 60 in spending.
+        std::uint32_t const setupFlags = tfMPTCanTransfer | tfMPTCanClawback | tfMPTRequireAuth |
+            tfMPTCanLock | tfMPTCanHoldConfidentialBalance;
+        std::string const dummyClawbackProof(kEcClawbackProofLength * 2, '0');
+
+        auto removeMPTokenField =
+            [&](Env& env, MPTTester const& mpt, Account const& holder, SField const& field) {
+                BEAST_EXPECT(env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal) {
+                    auto const sle = std::const_pointer_cast<SLE>(
+                        view.read(keylet::mptoken(mpt.issuanceID(), holder.id())));
+                    if (!sle)
+                        return false;
+
+                    sle->makeFieldAbsent(field);
+                    view.rawReplace(sle);
+                    return true;
+                }));
+            };
+
+        // After global COA is drained to zero, a further confidential clawback
+        // fails because the amount exceeds the remaining confidential
+        // outstanding amount.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 60}}, setupFlags};
+            auto& mptAlice = confEnv.mpt;
+
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 60,
+            });
+
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 1,
+                .proof = dummyClawbackProof,
+                .err = tecINSUFFICIENT_FUNDS,
+            });
+        }
+
+        // Missing issuer encrypted balance should fail before proof
+        // verification.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 60}}, setupFlags};
+            auto& mptAlice = confEnv.mpt;
+
+            removeMPTokenField(env, mptAlice, bob, sfIssuerEncryptedBalance);
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 60,
+                .proof = dummyClawbackProof,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Missing holder encryption key should fail before proof verification.
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 60}}, setupFlags};
+            auto& mptAlice = confEnv.mpt;
+
+            removeMPTokenField(env, mptAlice, bob, sfHolderEncryptionKey);
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 60,
+                .proof = dummyClawbackProof,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // lock should not block clawback. lock bob individually
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 60}}, setupFlags};
+            auto& mptAlice = confEnv.mpt;
+            mptAlice.set({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTLock,
+            });
+
+            // clawback should still work
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 60,
+            });
+        }
+
+        // lock globally
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 60}}, setupFlags};
+            auto& mptAlice = confEnv.mpt;
+            mptAlice.set({
+                .account = alice,
+                .flags = tfMPTLock,
+            });
+
+            // clawback should still work
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 60,
+            });
+        }
+
+        // unauthorize should not block clawback
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 60}}, setupFlags};
+            auto& mptAlice = confEnv.mpt;
+
+            // unauthorize bob
+            mptAlice.authorize({
+                .account = alice,
+                .holder = bob,
+                .flags = tfMPTUnauthorize,
+            });
+            // clawback should still work
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 60,
+            });
+        }
+
+        // insufficient funds, clawback amount exceeding confidential
+        // outstanding amount
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 60}}, setupFlags};
+            auto& mptAlice = confEnv.mpt;
+
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 10000,
+                .err = tecINSUFFICIENT_FUNDS,
+            });
+        }
+    }
+
+    void
+    testClawbackProof(FeatureBitset features)
+    {
+        testcase("ConfidentialMPTClawback Proof");
+        using namespace test::jtx;
+
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+
+        // lambda function to set up MPT with alice as issuer, bob and carol
+        // as authorized holders, and fund 1000 mpt to bob and 2000 mpt to
+        // carol.
+        auto setupEnv = [&](Env& env) -> MPTTester {
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .flags = tfMPTCanTransfer | tfMPTCanClawback | tfMPTCanHoldConfidentialBalance,
+            });
+
+            for (auto const& [acct, amt] : {std::pair{bob, 1000}, {carol, 2000}})
+            {
+                mptAlice.authorize({
+                    .account = acct,
+                });
+                mptAlice.pay(alice, acct, amt);
+                mptAlice.generateKeyPair(acct);
+            }
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            return mptAlice;
+        };
+
+        // lambda function to test a set of bad clawback amounts that should
+        // return tecBAD_PROOF
+        auto checkBadProofs =
+            [&](MPTTester& mpt, Account const& holder, std::initializer_list<uint64_t> amts) {
+                for (auto const badAmt : amts)
+                {
+                    mpt.confidentialClaw({
+                        .account = alice,
+                        .holder = holder,
+                        .amt = badAmt,
+                        .err = tecBAD_PROOF,
+                    });
+                }
+            };
+
+        // SCENARIO 1: clawback from inbox only or spending only balances.
+        // bob converts 500 and merge inbox,
+        // carol converts 1000, but not merge inbox.
+        // after setup, bob has 500 in spending, carol has 1000 in inbox.
+        {
+            Env env{*this, features};
+            auto mptAlice = setupEnv(env);
+
+            // bob converts and merges
+            mptAlice.convert({.account = bob, .amt = 500, .holderPubKey = mptAlice.getPubKey(bob)});
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+            // carol converts without merge
+            mptAlice.convert(
+                {.account = carol, .amt = 1000, .holderPubKey = mptAlice.getPubKey(carol)});
+
+            // verify proof fails with invalid clawback amount
+            // bob: 500 in Spending, 0 in Inbox
+            checkBadProofs(
+                mptAlice,
+                bob,
+                {
+                    1,
+                    10,
+                    70,
+                    100,
+                    110,
+                    200,
+                    499,
+                    501,
+                    600,
+                });
+
+            // carol: 1000 in Inbox, 0 in Spending
+            checkBadProofs(
+                mptAlice,
+                carol,
+                {
+                    1,
+                    10,
+                    50,
+                    500,
+                    777,
+                    850,
+                    999,
+                    1001,
+                    1200,
+                });
+
+            // clawback with correct amount that passes proof verification
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 500,
+            });
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = carol,
+                .amt = 1000,
+            });
+        }
+
+        // SCENARIO 2: clawback from mixed inbox and spending balances.
+        // bob converts 300 to confidential and merge inbox,
+        // carol converts 400 to confidential and merge inbox,
+        // bob sends 100 to carol, carol sends 100 to bob.
+        // After setup, bob has 100 in inbox and 200 in spending;
+        // carol has 100 in inbox and 300 in spending.
+        {
+            Env env{*this, features};
+            auto mptAlice = setupEnv(env);
+
+            mptAlice.convert({.account = bob, .amt = 300, .holderPubKey = mptAlice.getPubKey(bob)});
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+            mptAlice.convert(
+                {.account = carol, .amt = 400, .holderPubKey = mptAlice.getPubKey(carol)});
+            mptAlice.mergeInbox({
+                .account = carol,
+            });
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 100,
+            });
+            mptAlice.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 100,
+            });
+
+            // verify proof fails with invalid clawback amount
+            // bob: 100 in inbox, 200 in spending
+            checkBadProofs(
+                mptAlice,
+                bob,
+                {
+                    1,
+                    10,
+                    50,
+                    100,
+                    200,
+                    299,
+                    301,
+                    400,
+                });
+
+            // proof failure for incorrect amount when clawbacking from
+            // carol carol: 100 in inbox, 300 in spending
+            checkBadProofs(
+                mptAlice,
+                carol,
+                {
+                    1,
+                    10,
+                    50,
+                    100,
+                    300,
+                    399,
+                    401,
+                    501,
+                });
+
+            // clawback with correct amount that passes proof verification
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 300,
+            });
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = carol,
+                .amt = 400,
+            });
+        }
+
+        // SCENARIO 3: the clawback proof omits the holder's confidential
+        // balance version. A proof generated before the version advances is
+        // still accepted, because getClawbackContextHash has no version
+        // component.
+        {
+            Env env{*this, features};
+            auto mptAlice = setupEnv(env);
+
+            mptAlice.convert({.account = bob, .amt = 500, .holderPubKey = mptAlice.getPubKey(bob)});
+            mptAlice.mergeInbox({
+                .account = bob,
+            });
+
+            auto const privKey = mptAlice.getPrivKey(alice);
+            if (!BEAST_EXPECT(privKey.has_value()))
+                return;
+
+            auto const proof = mptAlice.getClawbackProof(
+                bob,
+                500,
+                requireOptionalRef(privKey, "Missing private key"),
+                getClawbackContextHash(
+                    alice.id(), mptAlice.issuanceID(), env.seq(alice), bob.id()));
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            // Advance bob's balance version after the proof is generated. An
+            // empty-inbox merge leaves the balance unchanged but still bumps
+            // sfConfidentialBalanceVersion.
+            auto const versionBefore = mptAlice.getMPTokenVersion(bob);
+            mptAlice.mergeInbox({.account = bob});
+            BEAST_EXPECT(mptAlice.getMPTokenVersion(bob) != versionBefore);
+
+            // The stale-version proof is still accepted.
+            mptAlice.confidentialClaw({
+                .account = alice,
+                .holder = bob,
+                .amt = 500,
+                .proof = strHex(requireOptional(proof, "Missing proof")),
+            });
+        }
+    }
+
+    void
+    testPublicTransfersAfterClearingConfidentialFlag(FeatureBitset features)
+    {
+        testcase("Public transfers after clearing Confidential Flag");
+        using namespace test::jtx;
+
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+
+        // After clearing the confidential flag, all four public MPT operations
+        // must succeed regardless of which confidential path left encrypted-zero
+        // fields on bob's MPToken.
+        auto runPublicPayments = [&](MPTTester& mpt) {
+            mpt.pay(bob, carol, 10);
+            mpt.pay(carol, bob, 5);
+            mpt.pay(alice, bob, 1);
+            mpt.pay(carol, alice, 5);
+        };
+
+        auto drainAndDeleteBobMPToken = [&](Env& env, MPTTester& mpt) {
+            auto const bobBalance = mpt.getBalance(bob);
+            BEAST_EXPECT(bobBalance > 0);
+
+            mpt.pay(bob, alice, bobBalance);
+            BEAST_EXPECT(mpt.getBalance(bob) == 0);
+
+            mpt.authorize({.account = bob, .flags = tfMPTUnauthorize});
+            BEAST_EXPECT(!env.le(keylet::mptoken(mpt.issuanceID(), bob.id())));
+        };
+
+        // Alice pays Bob 100 public, Bob converts 50 confidential
+        // Bob converts 50 back to public, and make sure can receive public payments
+        {
+            Env env{*this, features};
+            ConfidentialEnv ct{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50}},
+                tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance};
+
+            env.fund(XRP(1'000), carol);
+            ct.mpt.authorize({.account = carol});
+            ct.mpt.pay(alice, carol, 50);
+
+            ct.mpt.convertBack({.account = bob, .amt = 50});
+
+            runPublicPayments(ct.mpt);
+            drainAndDeleteBobMPToken(env, ct.mpt);
+        }
+
+        // Same path as above but with Auditor
+        {
+            Env env{*this, features};
+            Account const auditor("auditor");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}, .auditor = auditor});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({.account = bob});
+            mptAlice.authorize({.account = carol});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 50);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(auditor);
+            mptAlice.set(
+                {.account = alice,
+                 .issuerPubKey = mptAlice.getPubKey(alice),
+                 .auditorPubKey = mptAlice.getPubKey(auditor)});
+
+            mptAlice.convert({
+                .account = bob,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(bob),
+            });
+            mptAlice.mergeInbox({.account = bob});
+            mptAlice.convertBack({.account = bob, .amt = 50});
+
+            runPublicPayments(mptAlice);
+            drainAndDeleteBobMPToken(env, mptAlice);
+        }
+
+        // Confidential clawback leaves encrypted-zero fields;
+        // the public balance remaining after the clawback must stay usable.
+        {
+            Env env{*this, features};
+            ConfidentialEnv ct{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 50}},
+                tfMPTCanTransfer | tfMPTCanClawback | tfMPTCanHoldConfidentialBalance};
+
+            env.fund(XRP(1'000), carol);
+            ct.mpt.authorize({.account = carol});
+            ct.mpt.pay(alice, carol, 50);
+
+            ct.mpt.confidentialClaw({.account = alice, .holder = bob, .amt = 50});
+
+            runPublicPayments(ct.mpt);
+            drainAndDeleteBobMPToken(env, ct.mpt);
+        }
+    }
+
+    void
+    testMutatePrivacy(FeatureBitset features)
+    {
+        testcase("mutate lsfMPTCanHoldConfidentialBalance");
+        using namespace test::jtx;
+
+        // can not create mpt issuance with tmfMPTCannotEnableCanHoldConfidentialBalance
+        // when featureDynamicMPT is disabled
+        {
+            Env env{*this, features - featureDynamicMPT};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 0,
+                .mutableFlags = tmfMPTCannotEnableCanHoldConfidentialBalance,
+                .err = temDISABLED,
+            });
+        }
+
+        // can not create mpt issuance with tmfMPTCannotEnableCanHoldConfidentialBalance when
+        // featureConfidentialTransfer is disabled
+        {
+            Env env{*this, features - featureConfidentialTransfer};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 0,
+                .mutableFlags = tmfMPTCannotEnableCanHoldConfidentialBalance,
+                .err = temDISABLED,
+            });
+        }
+
+        // if lsmfMPTCannotEnableCanHoldConfidentialBalance is set, can not set/clear
+        // lsfMPTCanHoldConfidentialBalance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer,
+                .mutableFlags = tmfMPTCannotEnableCanHoldConfidentialBalance,
+            });
+
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+                .err = tecNO_PERMISSION,
+            });
+        }
+
+        // Toggle lsfMPTCanHoldConfidentialBalance
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+                .mutableFlags = tmfMPTCanEnableCanLock,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            auto holderPubKeySet = false;
+            auto verifyToggle = [&](TER expectedResult, uint64_t amt) {
+                if (!holderPubKeySet)
+                {
+                    mptAlice.convert({
+                        .account = bob,
+                        .amt = amt,
+                        .holderPubKey = mptAlice.getPubKey(bob),
+                        .err = expectedResult,
+                    });
+                }
+                else
+                {
+                    mptAlice.convert({
+                        .account = bob,
+                        .amt = amt,
+                        .err = expectedResult,
+                    });
+                }
+
+                if (expectedResult == tesSUCCESS)
+                {
+                    holderPubKeySet = true;
+                    mptAlice.mergeInbox({
+                        .account = bob,
+                    });
+
+                    // make sure there's no confidential outstanding balance
+                    // for the next toggle test
+                    mptAlice.convertBack({
+                        .account = bob,
+                        .amt = amt,
+                    });
+                }
+            };
+
+            // set lsfMPTCanHoldConfidentialBalance, but no effect because
+            // lsfMPTCanHoldConfidentialBalance was already set
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+            });
+            verifyToggle(tesSUCCESS, 10);
+
+            // set tmfMPTSetCanHoldConfidentialBalance again
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+            });
+            verifyToggle(tesSUCCESS, 30);
+        }
+
+        // can not mutate lsfPrivacy when there's confidential
+        // outstanding amount
+        {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+
+            // lsmfMPTCannotEnableCanHoldConfidentialBalance is false by default,
+            // so that lsfMPTCanHoldConfidentialBalance can be mutated
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({
+                .account = bob,
+            });
+            mptAlice.pay(alice, bob, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            // bob convert 50 to confidential
+            mptAlice.convert({.account = bob, .amt = 50, .holderPubKey = mptAlice.getPubKey(bob)});
+
+            // set lsfMPTCanHoldConfidentialBalance should fail because of
+            // confidential outstanding balance
+            mptAlice.set({
+                .account = alice,
+                .mutableFlags = tmfMPTSetCanHoldConfidentialBalance,
+                .err = tecNO_PERMISSION,
+            });
+        }
+    }
+
+    void
+    testConvertBackPedersenProof(FeatureBitset features)
+    {
+        testcase("Convert back pedersen proof");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        ConfidentialEnv confEnv{
+            env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 40}}};
+        auto& mptAlice = confEnv.mpt;
+
+        // for ease of understanding, generate all the fields here instead of
+        // autofilling
+        uint64_t const amt = 10;
+        Buffer const blindingFactor = generateBlindingFactor();
+        Buffer const pcBlindingFactor = generateBlindingFactor();
+
+        auto const spendingBalance = requireOptional(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing spending balance");
+        auto const encryptedSpendingBalance = requireOptional(
+            mptAlice.getEncryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing encrypted spending balance");
+        BEAST_EXPECT(!encryptedSpendingBalance.empty());
+
+        Buffer const pedersenCommitment =
+            mptAlice.getPedersenCommitment(spendingBalance, pcBlindingFactor);
+        Buffer const issuerCiphertext = mptAlice.encryptAmount(alice, amt, blindingFactor);
+        Buffer const bobCiphertext = mptAlice.encryptAmount(bob, amt, blindingFactor);
+        auto const version = mptAlice.getMPTokenVersion(bob);
+
+        // These tests verify that the compact ConvertBack proof validation
+        // correctly rejects proofs generated with incorrect parameters.
+        // The compact proof simultaneously verifies balance ownership,
+        // commitment linkage, and that remaining balance is non-negative.
+
+        // Test 1: Proof generated with wrong pedersen commitment value.
+        // The proof uses PC(1, rho) but the transaction submits PC(balance, rho).
+        // Verification fails because the proof doesn't match the submitted commitment.
+        {
+            uint256 const contextHash =
+                getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), version);
+            Buffer const badPedersenCommitment =
+                mptAlice.getPedersenCommitment(1, pcBlindingFactor);
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                contextHash,
+                {
+                    .pedersenCommitment = badPedersenCommitment,  // wrong pedersen commitment
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Test 2: Proof generated with wrong blinding factor (rho).
+        // The pedersen commitment PC = balance*G + rho*H requires the same rho
+        // used in proof generation. Using a different rho breaks the linkage.
+        {
+            uint256 const contextHash =
+                getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), version);
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = generateBlindingFactor(),  // wrong blinding factor
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Test 3: Proof generated with wrong balance value.
+        // The proof claims balance=1 but the encrypted spending balance contains
+        // the actual balance. Verification fails because the values don't match.
+        {
+            uint256 const contextHash =
+                getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), version);
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = 1,  // wrong balance
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Test 4: Correct proof but wrong pedersen commitment in transaction.
+        // The proof is generated correctly, but the transaction submits a
+        // different pedersen commitment. Verification fails because the
+        // submitted commitment doesn't match what the proof was generated for.
+        {
+            uint256 const contextHash =
+                getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), version);
+            Buffer const badPedersenCommitment =
+                mptAlice.getPedersenCommitment(1, pcBlindingFactor);
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = badPedersenCommitment,  // wrong pedersen commitment
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Test 5: Proof generated with wrong context hash.
+        // The context hash binds the proof to a specific transaction (account,
+        // sequence, issuanceID, amount, version). Using a different context hash
+        // makes the proof invalid for this transaction, preventing replay attacks.
+        {
+            uint256 const badContextHash{1};
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                badContextHash,  // wrong context hash
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Test 6: Correct proof to verify the test setup is valid.
+        // All parameters are correct, so the transaction should succeed.
+        {
+            uint256 const contextHash =
+                getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), version);
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+            });
+        }
+    }
+
+    void
+    testConvertBackBulletproof(FeatureBitset features)
+    {
+        testcase("Convert back bulletproof");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        ConfidentialEnv confEnv{
+            env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 40}}};
+        auto& mptAlice = confEnv.mpt;
+
+        // for ease of understanding, generate all the fields here instead of
+        // autofilling
+        uint64_t const amt = 10;
+        Buffer const blindingFactor = generateBlindingFactor();
+        Buffer const pcBlindingFactor = generateBlindingFactor();
+
+        auto const spendingBalance = requireOptional(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing spending balance");
+        auto const encryptedSpendingBalance = requireOptional(
+            mptAlice.getEncryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing encrypted spending balance");
+        BEAST_EXPECT(!encryptedSpendingBalance.empty());
+
+        Buffer const pedersenCommitment =
+            mptAlice.getPedersenCommitment(spendingBalance, pcBlindingFactor);
+        Buffer const issuerCiphertext = mptAlice.encryptAmount(alice, amt, blindingFactor);
+        Buffer const bobCiphertext = mptAlice.encryptAmount(bob, amt, blindingFactor);
+        auto const version = mptAlice.getMPTokenVersion(bob);
+
+        // These tests verify that the compact ConvertBack proof (sigma + bulletproof)
+        // correctly rejects proofs generated with incorrect parameters.
+        // The compact proof simultaneously verifies balance ownership, commitment
+        // linkage, and that the remaining balance is non-negative.
+
+        // Test 1: Proof generated with wrong balance value.
+        // The sigma proof claims balance=1 but the spending balance contains the
+        // actual balance. The compact proof's balance-linkage check fails.
+        {
+            uint256 const contextHash =
+                getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), version);
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = 1,  // wrong balance (actual balance is ~40)
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Test 2: Proof generated with wrong blinding factor (rho).
+        // The compact sigma proof must use the same blinding factor (rho) as the
+        // Pedersen commitment PC = balance*G + rho*H. Using a different rho
+        // creates an inconsistency the verifier detects.
+        {
+            uint256 const contextHash =
+                getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), version);
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = generateBlindingFactor(),  // wrong blinding factor
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Test 3: Proof generated with wrong context hash.
+        // The context hash binds the proof to a specific transaction (account,
+        // sequence, issuanceID, amount, version). Using a different context hash
+        // makes the proof invalid for this transaction, preventing replay attacks.
+        {
+            uint256 const badContextHash{1};
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                badContextHash,  // wrong context hash
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Test 4: Correct proof to verify the test setup is valid.
+        // All parameters are correct, so the transaction should succeed.
+        {
+            uint256 const contextHash =
+                getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), version);
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+            });
+        }
+    }
+
+    // A convert-back proof is bound to (account, issuance, sequence, version) via
+    // the Fiat-Shamir context hash. Crafting a proof against any single wrong
+    // variable and submitting it with the real parameters must be rejected
+    // with tecBAD_PROOF
+    void
+    testConvertBackInvalidProofContextBinding(FeatureBitset features)
+    {
+        testcase("ConvertBack proof context binding");
+        using namespace test::jtx;
+
+        auto runBadProof = [&](auto makeContextHash) {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            ConfidentialEnv confEnv{
+                env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 40}}};
+            auto& mptAlice = confEnv.mpt;
+
+            std::uint64_t const amt = 10;
+            Buffer const blindingFactor = generateBlindingFactor();
+            Buffer const pcBlindingFactor = generateBlindingFactor();
+
+            auto const spendingBalance =
+                mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending);
+            auto const encryptedSpendingBalance =
+                mptAlice.getEncryptedBalance(bob, MPTTester::holderEncryptedSpending);
+            if (!BEAST_EXPECT(spendingBalance && encryptedSpendingBalance))
+                return;
+
+            Buffer const pedersenCommitment = mptAlice.getPedersenCommitment(
+                requireOptional(spendingBalance, "Missing spending balance"), pcBlindingFactor);
+            Buffer const issuerCiphertext = mptAlice.encryptAmount(alice, amt, blindingFactor);
+            Buffer const bobCiphertext = mptAlice.encryptAmount(bob, amt, blindingFactor);
+            auto const version = mptAlice.getMPTokenVersion(bob);
+
+            Buffer const proof = mptAlice.getConvertBackProof(
+                bob,
+                amt,
+                makeContextHash(env, mptAlice, alice, bob, carol, version),
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = requireOptional(spendingBalance, "Missing spending balance"),
+                    .encryptedAmt = requireOptionalRef(
+                        encryptedSpendingBalance, "Missing encrypted spending balance"),
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            mptAlice.convertBack({
+                .account = bob,
+                .amt = amt,
+                .proof = proof,
+                .holderEncryptedAmt = bobCiphertext,
+                .issuerEncryptedAmt = issuerCiphertext,
+                .blindingFactor = blindingFactor,
+                .pedersenCommitment = pedersenCommitment,
+                .err = tecBAD_PROOF,
+            });
+        };
+
+        // Wrong account in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const& carol,
+                        std::uint32_t version) {
+            return getConvertBackContextHash(carol.id(), mpt.issuanceID(), env.seq(bob), version);
+        });
+
+        // Wrong issuance ID in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const&,
+                        Account const& alice,
+                        Account const& bob,
+                        Account const&,
+                        std::uint32_t version) {
+            return getConvertBackContextHash(
+                bob.id(), makeMptID(env.seq(alice) + 100, alice), env.seq(bob), version);
+        });
+
+        // Wrong transaction sequence in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const&,
+                        std::uint32_t version) {
+            return getConvertBackContextHash(bob.id(), mpt.issuanceID(), env.seq(bob) + 1, version);
+        });
+
+        // Wrong balance version in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const&,
+                        std::uint32_t version) {
+            return getConvertBackContextHash(bob.id(), mpt.issuanceID(), env.seq(bob), version + 1);
+        });
+    }
+
+    // This test simulates a valid proof π extracted from a transaction
+    // for amount m1 is reused in a new transaction for a different
+    // amount m2 with different ciphertexts. It confirms the context hash
+    // recomputation fails due to the ciphertext binding mismatch, resulting
+    // in tecBAD_PROOF.
+    void
+    testConvertBackProofCiphertextBinding(FeatureBitset features)
+    {
+        testcase("ConvertBack: proof ciphertext binding");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob");
+        ConfidentialEnv confEnv{
+            env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        auto const spendingBalance = requireOptional(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing spending balance");
+        auto const encryptedSpendingBalance = requireOptional(
+            mptAlice.getEncryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing encrypted spending balance");
+        auto const version = mptAlice.getMPTokenVersion(bob);
+        Buffer const pcBlindingFactor = generateBlindingFactor();
+        Buffer const pedersenCommitment =
+            mptAlice.getPedersenCommitment(spendingBalance, pcBlindingFactor);
+
+        // Generate a valid proof pi for Amount m1 = 10
+        uint64_t const amtA = 10;
+        uint32_t const currentSeq = env.seq(bob);
+        uint256 const contextHashA =
+            getConvertBackContextHash(bob, mptAlice.issuanceID(), currentSeq, version);
+
+        Buffer const proofA = mptAlice.getConvertBackProof(
+            bob,
+            amtA,
+            contextHashA,
+            {
+                .pedersenCommitment = pedersenCommitment,
+                .amt = spendingBalance,
+                .encryptedAmt = encryptedSpendingBalance,
+                .blindingFactor = pcBlindingFactor,
+            });
+
+        // Construct Transaction B with Amount m2 = 20 and attach Proof pi
+        uint64_t const amtB = 20;
+        Buffer const blindingFactorB = generateBlindingFactor();
+        Buffer const bobCiphertextB = mptAlice.encryptAmount(bob, amtB, blindingFactorB);
+        Buffer const issuerCiphertextB = mptAlice.encryptAmount(alice, amtB, blindingFactorB);
+
+        // We attempt to verify the proof pi (for amt 10) against the new ciphertexts (for amt 20).
+        mptAlice.convertBack({
+            .account = bob,
+            .amt = amtB,
+            .proof = proofA,  // Extracted/Reused proof from Transaction A
+            .holderEncryptedAmt = bobCiphertextB,
+            .issuerEncryptedAmt = issuerCiphertextB,
+            .blindingFactor = blindingFactorB,
+            .pedersenCommitment = pedersenCommitment,
+            .err = tecBAD_PROOF,  // Expected failure
+        });
+    }
+
+    // This test simulates a valid proof π and ciphertext are
+    // tied to version v, but are reused after an inbox merge has incremented
+    // the CBS version to v+1. It confirms the validator rejects the transaction
+    // before acceptance due to the ContextID mismatch.
+    void
+    testConvertBackProofVersionMismatch(FeatureBitset features)
+    {
+        testcase("ConvertBack: proof version mismatch");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob");
+        ConfidentialEnv confEnv{
+            env, alice, {{.account = bob, .payAmount = 1000, .convertAmount = 100}}};
+        auto& mptAlice = confEnv.mpt;
+
+        auto const versionV = mptAlice.getMPTokenVersion(bob);
+        auto const spendingBalanceV = requireOptional(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing spending balance");
+        auto const encryptedSpendingBalanceV = requireOptional(
+            mptAlice.getEncryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing encrypted spending balance");
+
+        // Parameters for the intended ConvertBack transaction
+        uint64_t const amt = 10;
+        Buffer const blindingFactor = generateBlindingFactor();
+        Buffer const pcBlindingFactor = generateBlindingFactor();
+        Buffer const pedersenCommitment =
+            mptAlice.getPedersenCommitment(spendingBalanceV, pcBlindingFactor);
+        Buffer const issuerCiphertext = mptAlice.encryptAmount(alice, amt, blindingFactor);
+        Buffer const bobCiphertext = mptAlice.encryptAmount(bob, amt, blindingFactor);
+
+        // State Change: Increment version to v+1
+        // Converting more funds and merging increments the sfConfidentialBalanceVersion
+        mptAlice.convert({
+            .account = bob,
+            .amt = 50,
+        });
+        mptAlice.mergeInbox({
+            .account = bob,
+        });
+
+        BEAST_EXPECT(mptAlice.getMPTokenVersion(bob) > versionV);
+
+        // Attack: Attempt to reuse proof tied to Version v at ledger Version v+1
+        uint32_t const currentSeq = env.seq(bob);
+        // Proof is explicitly generated using the outdated Version v
+        uint256 const oldContextHash =
+            getConvertBackContextHash(bob, mptAlice.issuanceID(), currentSeq, versionV);
+
+        Buffer const oldProof = mptAlice.getConvertBackProof(
+            bob,
+            amt,
+            oldContextHash,
+            {
+                .pedersenCommitment = pedersenCommitment,
+                .amt = spendingBalanceV,
+                .encryptedAmt = encryptedSpendingBalanceV,
+                .blindingFactor = pcBlindingFactor,
+            });
+
+        // Submit and verify failure
+        mptAlice.convertBack({
+            .account = bob,
+            .amt = amt,
+            .proof = oldProof,
+            .holderEncryptedAmt = bobCiphertext,
+            .issuerEncryptedAmt = issuerCiphertext,
+            .blindingFactor = blindingFactor,
+            .pedersenCommitment = pedersenCommitment,
+            .err = tecBAD_PROOF,  // Fails because TransactionContextID differs
+        });
+    }
+
+    /* This test simulates an attack where the holder ciphertext is modified
+     * via homomorphic addition (adding Encrypted_amt(1)) while leaving the issuer
+     * ciphertext unchanged. It confirms that the validator detects the
+     * mismatch between the re-computed ciphertexts and the submitted ones,
+     * resulting in tecBAD_PROOF.   */
+    void
+    testConvertBackHomomorphicCiphertextModification(FeatureBitset features)
+    {
+        testcase("ConvertBack: homomorphic ciphertext modification");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob");
+        ConfidentialEnv confEnv{
+            env, alice, {{.account = bob, .payAmount = 100, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        // Prepare valid parameters for a ConvertBack of 10
+        uint64_t const amt = 10;
+        Buffer const bf = generateBlindingFactor();
+
+        auto const holderCipherText = mptAlice.encryptAmount(bob, amt, bf);
+        auto const issuerCipherText = mptAlice.encryptAmount(alice, amt, bf);
+
+        // Generate a "Delta" ciphertext (Encrypting 1)
+        // We use Bob's key because we are tampering with Bob's (Holder's) field
+        Buffer const deltaBf = generateBlindingFactor();
+        auto const deltaCipherText = mptAlice.encryptAmount(bob, 1, deltaBf);
+
+        // Homomorphically add Delta to HolderCipherText: Tampered = Enc(10) + Enc(1) = Enc(11)
+        Buffer tamperedHolderCipherText = requireOptional(
+            homomorphicAdd(holderCipherText, deltaCipherText), "Missing tampered ciphertext");
+
+        // Generate a valid proof for the ORIGINAL amount (10)
+        auto const spendingBal = requireOptional(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing spending balance");
+        auto const spendingBalEnc = requireOptional(
+            mptAlice.getEncryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing encrypted spending balance");
+        Buffer const pcBf = generateBlindingFactor();
+        auto const pedersenCommitment = mptAlice.getPedersenCommitment(spendingBal, pcBf);
+
+        auto const currentVersion = mptAlice.getMPTokenVersion(bob);
+        // Uses the new signature: Account, IssuanceID, Sequence, Version
+        uint256 const contextHash =
+            getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), currentVersion);
+
+        Buffer const proof = mptAlice.getConvertBackProof(
+            bob,
+            amt,
+            contextHash,
+            {
+                .pedersenCommitment = pedersenCommitment,
+                .amt = spendingBal,
+                .encryptedAmt = spendingBalEnc,
+                .blindingFactor = pcBf,
+            });
+
+        // Submit transaction with Divergent Ciphertexts
+        // Holder Ciphertext encrypts 11. Issuer Ciphertext encrypts 10.
+        // The consistency check (re-encryption of `amt` with `bf`) will match Issuer but FAIL for
+        // Holder.
+        mptAlice.convertBack({
+            .account = bob,
+            .amt = amt,
+            .proof = proof,
+            .holderEncryptedAmt = tamperedHolderCipherText,  // Tampered (11)
+            .issuerEncryptedAmt = issuerCipherText,          // Original (10)
+            .blindingFactor = bf,
+            .pedersenCommitment = pedersenCommitment,
+            .err = tecBAD_PROOF,
+        });
+    }
+
+    /* This test verifies that xrpld correctly rejects attempts to
+     * overflow the maximum allowable token amount via homomorphic manipulation.
+     * It simulates an attack where an individual takes a valid ciphertext encrypting
+     * the maximum amount (kMaxMpTokenAmount) and homomorphically adds an encryption of
+     * 1 to it, producing a ciphertext for MAX+1. The test confirms that the Bulletproof
+     * range proof or inner-product constraints detect this overflow and invalidate the
+     * transaction, preserving the supply invariant. */
+    void
+    testSendHomomorphicOverflow(FeatureBitset features)
+    {
+        testcase("Send: homomorphic overflow attack via Enc(MAX) + Enc(1)");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 100, .convertAmount = 100},
+             {.account = carol, .payAmount = 50, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        // Bob sends 10 to carol.  The send amount (10) and Bob's remaining balance
+        // (90) are both within [0, kMaxMpTokenAmount].  Range proof passes.
+        mptAlice.send({.account = bob, .dest = carol, .amt = 10});
+
+        // Bob's spending balance is 90 after the baseline send.
+        auto const bobSpendingBefore =
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending);
+        BEAST_EXPECT(bobSpendingBefore == 90);
+
+        // Construct Enc(kMaxMpTokenAmount) with Bob's public key.
+        Buffer const bf1 = generateBlindingFactor();
+        Buffer const encMax = mptAlice.encryptAmount(bob, kMaxMpTokenAmount, bf1);
+
+        // Construct Enc(1) with a separate blinding factor.
+        Buffer const bf2 = generateBlindingFactor();
+        Buffer const encOne = mptAlice.encryptAmount(bob, 1, bf2);
+
+        // Homomorphically add to produce CB_S_holder' = Enc(MAX) + Enc(1)
+        Buffer overflowedCt =
+            requireOptional(homomorphicAdd(encMax, encOne), "Missing overflowed ciphertext");
+
+        // Submit the send transaction with the tampered ciphertext.
+        // Setting amt = kMaxMpTokenAmount + 1 drives proof generation for the
+        // overflowed value.  The bulletproof range check [0, kMaxMpTokenAmount]
+        // rejects MAX+1; the validator must return tecBAD_PROOF.
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = kMaxMpTokenAmount + 1,
+            .senderEncryptedAmt = overflowedCt,
+            .err = tecBAD_PROOF,
+        });
+
+        auto const bobSpendingAfter =
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending);
+        BEAST_EXPECT(bobSpendingBefore == bobSpendingAfter);
+    }
+
+    /* This test ensures that the system prevents underflow attacks where a user
+     * attempts to create a negative balance through homomorphic subtraction. It
+     * simulates a scenario where an attacker takes a ciphertext encrypting zero
+     * and subtracts an encryption of 1, resulting in a value of -1.
+     * The test asserts that the range proof verification fails because the resulting
+     * value falls outside the valid non-negative range [0, kMaxMpTokenAmount],
+     * causing the validator to reject the transaction with tecBAD_PROOF. */
+    void
+    testConvertBackHomomorphicUnderflow(FeatureBitset features)
+    {
+        testcase("ConvertBack: homomorphic underflow attack via Enc(0) - Enc(1)");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob");
+        ConfidentialEnv confEnv{
+            env, alice, {{.account = bob, .payAmount = 10, .convertAmount = 10}}};
+        auto& mptAlice = confEnv.mpt;
+
+        // Converting back 1 from 10 leaves remaining balance = 9 (non-negative).
+        // Range proof [0, kMaxMpTokenAmount] passes.
+        mptAlice.convertBack({.account = bob, .amt = 1});
+
+        // Bob's spending balance is now 9; public balance is 1.
+        auto const bobSpendingBefore =
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending);
+        BEAST_EXPECT(bobSpendingBefore == 9);
+        auto const bobPublicBefore = mptAlice.getBalance(bob);
+        BEAST_EXPECT(bobPublicBefore == 1);
+
+        // Construct Enc(0) — the zero encrypted balance using Bob's key.
+        Buffer const bf1 = generateBlindingFactor();
+        Buffer const encZero = mptAlice.encryptAmount(bob, 0, bf1);
+
+        // Construct Enc(1) with a separate blinding factor.
+        Buffer const bf2 = generateBlindingFactor();
+        Buffer const encOne = mptAlice.encryptAmount(bob, 1, bf2);
+
+        // Homomorphically subtract to produce CB_S_holder' = Enc(0) − Enc(1)
+        // = Enc(−1), which lies below [0, kMaxMpTokenAmount].
+        Buffer underflowedCt =
+            requireOptional(homomorphicSubtract(encZero, encOne), "Missing underflowed ciphertext");
+
+        // The underflowed value as uint64_t: 0 - 1 wraps to 0xFFFFFFFFFFFFFFFF.
+        // Generate a real proof using this wrapped value. The validator must still reject it
+        // because 0xFFFFFFFFFFFFFFFE (remaining balance) is outside [0, kMaxMpTokenAmount].
+        constexpr std::uint64_t kUnderflowedAmt =
+            static_cast<std::uint64_t>(0) - static_cast<std::uint64_t>(1);
+
+        Buffer const pcBf = generateBlindingFactor();
+        Buffer const pedersenCommitment = mptAlice.getPedersenCommitment(kUnderflowedAmt, pcBf);
+
+        auto const currentVersion = mptAlice.getMPTokenVersion(bob);
+        uint256 const contextHash =
+            getConvertBackContextHash(bob, mptAlice.issuanceID(), env.seq(bob), currentVersion);
+
+        Buffer const proof = mptAlice.getConvertBackProof(
+            bob,
+            1,
+            contextHash,
+            {
+                .pedersenCommitment = pedersenCommitment,
+                .amt = kUnderflowedAmt,
+                .encryptedAmt = underflowedCt,
+                .blindingFactor = pcBf,
+            });
+
+        mptAlice.convertBack({
+            .account = bob,
+            .amt = 1,
+            .proof = proof,
+            .holderEncryptedAmt = underflowedCt,
+            .pedersenCommitment = pedersenCommitment,
+            .err = tecBAD_PROOF,
+        });
+
+        // Supply invariant: both public and confidential balances must be unchanged
+        // after the rejected attack.
+        BEAST_EXPECT(mptAlice.getBalance(bob) == bobPublicBefore);
+        auto const bobSpendingAfter =
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending);
+        BEAST_EXPECT(bobSpendingBefore == bobSpendingAfter);
+    }
+
+    // Confidential sends carry encrypted amounts and a zero-knowledge proof.
+    // Both are built from elliptic-curve math, so every coordinate in the
+    // transaction must be a real point on the secp256k1 curve. These three
+    // variants confirm the validator rejects garbage coordinates at the right
+    // stage before any expensive cryptographic verification runs.
+    void
+    testSendInvalidCurvePoints(FeatureBitset features)
+    {
+        testcase("Send: off-curve EC points");
+        using namespace test::jtx;
+
+        // Variant A: garbage coordinate in ciphertext / commitment fields
+        // getBadCiphertext() looks structurally valid (correct length, right
+        // prefix byte 0x02) but its x-coordinate is 0xFF...FF, which does not
+        // lie on secp256k1. Preflight must reject before any ledger access.
+        {
+            Account const alice("alice"), bob("bob"), carol("carol");
+            Env env{*this, features};
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 60},
+                 {.account = carol, .payAmount = 50, .convertAmount = 30}}};
+            auto& mptAlice = confEnv.mpt;
+
+            // sender's encrypted amount has an invalid coordinate
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = getBadCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // recipient's encrypted amount has an invalid coordinate
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .destEncryptedAmt = getBadCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // issuer's encrypted amount has an invalid coordinate
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .issuerEncryptedAmt = getBadCiphertext(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // The amount and balance commitments are single curve coordinates
+            // used to tie the proof to the transfer amount and sender balance.
+            // A commitment with a valid-looking prefix but an impossible
+            // x-coordinate must also be rejected.
+            Buffer badCommitment(kEcPedersenCommitmentLength);
+            std::memset(badCommitment.data(), 0xFF, kEcPedersenCommitmentLength);
+            badCommitment.data()[0] = kEcCompressedPrefixEvenY;
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .amountCommitment = badCommitment,
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temMALFORMED,
+            });
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = badCommitment,
+                .err = temMALFORMED,
+            });
+        }
+
+        // Variant B: garbage coordinates inside the ZKP proof blob
+        // The proof blob has the right total byte length (so it passes the
+        // length check at preflight), but every embedded coordinate is
+        // 0xFF...FF — impossible on secp256k1. The proof verifier must detect
+        // this and return tecBAD_PROOF without crashing.
+        {
+            Account const alice("alice"), bob("bob"), carol("carol");
+            Env env{*this, features};
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 60},
+                 {.account = carol, .payAmount = 50, .convertAmount = 30}}};
+            auto& mptAlice = confEnv.mpt;
+
+            Buffer badProof(kEcSendProofLength);
+            std::memset(badProof.data(), 0xFF, kEcSendProofLength);
+            badProof.data()[0] = kEcCompressedPrefixEvenY;
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = strHex(badProof),
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // Variant C: only one of the two ciphertext coordinates is bad
+        // Each encrypted amount is two coordinates back-to-back: C1 then C2.
+        // Both must be valid. These tests corrupt only one at a time to
+        // confirm both are checked independently.
+        {
+            Account const alice("alice"), bob("bob"), carol("carol");
+            Env env{*this, features};
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 60},
+                 {.account = carol, .payAmount = 50, .convertAmount = 30}}};
+            auto& mptAlice = confEnv.mpt;
+
+            // getTrivialCiphertext() has both C1 and C2 as valid (but trivial)
+            // curve coordinates.  We replace one half at a time with 0xFF...FF.
+            auto const& tc = getTrivialCiphertext();
+
+            // C1 = bad (0xFF...FF), C2 = valid trivial point
+            Buffer badC1goodC2(kEcGamalEncryptedTotalLength);
+            std::memset(badC1goodC2.data(), 0xFF, kEcGamalEncryptedTotalLength);
+            badC1goodC2.data()[0] = kEcCompressedPrefixEvenY;
+            std::memcpy(
+                badC1goodC2.data() + kEcCiphertextComponentLength,
+                tc.data() + kEcCiphertextComponentLength,
+                kEcCiphertextComponentLength);
+
+            // C1 = valid trivial point, C2 = bad (0xFF...FF)
+            Buffer goodC1badC2(kEcGamalEncryptedTotalLength);
+            std::memset(goodC1badC2.data(), 0xFF, kEcGamalEncryptedTotalLength);
+            std::memcpy(goodC1badC2.data(), tc.data(), kEcCiphertextComponentLength);
+            goodC1badC2.data()[kEcCiphertextComponentLength] = kEcCompressedPrefixEvenY;
+
+            // sender's encrypted amount — bad C1
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = badC1goodC2,
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // sender's encrypted amount — bad C2
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .senderEncryptedAmt = goodC1badC2,
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // recipient's encrypted amount — bad C1
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .destEncryptedAmt = badC1goodC2,
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+
+            // recipient's encrypted amount — bad C2
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .proof = getTrivialSendProofHex(),
+                .destEncryptedAmt = goodC1badC2,
+                .amountCommitment = getTrivialCommitment(),
+                .balanceCommitment = getTrivialCommitment(),
+                .err = temBAD_CIPHERTEXT,
+            });
+        }
+    }
+
+    // Reject points from the wrong elliptic curve (wrong-group injection).
+    //
+    // An attacker might submit coordinates that come from a completely
+    // different elliptic curve, for example, the one used in TLS
+    // certificates (NIST P-256). If those coordinates happen to also be
+    // valid points on secp256k1 (which is possible since both curves use
+    // 256-bit fields), the format check at preflight will pass. However,
+    // the zero-knowledge proof is built specifically for secp256k1: the
+    // math inside the proof only holds for the right curve, so any
+    // transaction carrying cross-curve data will still be rejected at
+    // proof verification (tecBAD_PROOF).
+    void
+    testSendWrongGroupPointInjection(FeatureBitset features)
+    {
+        testcase("Send: wrong-group point injection rejected");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 100, .convertAmount = 60},
+             {.account = carol, .payAmount = 50, .convertAmount = 30}}};
+        auto& mptAlice = confEnv.mpt;
+
+        // The x-coordinate of the NIST P-256 generator point — a real,
+        // well-known value from a different elliptic curve (used in TLS
+        // and certificates).  This x-coordinate is also a valid secp256k1
+        // point, so it passes preflight.  Rejection happens at proof
+        // verification because the ZKP is secp256k1-specific.
+        //
+        //   P-256 generator x:
+        //     6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296
+        static constexpr std::uint8_t kP256GeneratorX[32] = {
+            0x6B, 0x17, 0xD1, 0xF2, 0xE1, 0x2C, 0x42, 0x47, 0xF8, 0xBC, 0xE6,
+            0xE5, 0x63, 0xA4, 0x40, 0xF2, 0x77, 0x03, 0x7D, 0x81, 0x2D, 0xEB,
+            0x33, 0xA0, 0xF4, 0xA1, 0x39, 0x45, 0xD8, 0x98, 0xC2, 0x96,
+        };
+
+        // A 66-byte encrypted amount using the P-256 x-coordinate for both halves.
+        Buffer wrongGroupCt(kEcGamalEncryptedTotalLength);
+        wrongGroupCt.data()[0] = kEcCompressedPrefixEvenY;
+        std::memcpy(wrongGroupCt.data() + 1, kP256GeneratorX, 32);
+        wrongGroupCt.data()[kEcCiphertextComponentLength] = kEcCompressedPrefixEvenY;
+        std::memcpy(wrongGroupCt.data() + kEcCiphertextComponentLength + 1, kP256GeneratorX, 32);
+
+        // A 33-byte commitment using the same wrong-curve x-coordinate.
+        Buffer wrongGroupCommitment(kEcPedersenCommitmentLength);
+        wrongGroupCommitment.data()[0] = kEcCompressedPrefixEvenY;
+        std::memcpy(wrongGroupCommitment.data() + 1, kP256GeneratorX, 32);
+
+        // sender's encrypted amount uses a coordinate from the wrong curve
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 10,
+            .proof = getTrivialSendProofHex(),
+            .senderEncryptedAmt = wrongGroupCt,
+            .amountCommitment = getTrivialCommitment(),
+            .balanceCommitment = getTrivialCommitment(),
+            .err = tecBAD_PROOF,
+        });
+
+        // recipient's encrypted amount uses a coordinate from the wrong curve
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 10,
+            .proof = getTrivialSendProofHex(),
+            .destEncryptedAmt = wrongGroupCt,
+            .amountCommitment = getTrivialCommitment(),
+            .balanceCommitment = getTrivialCommitment(),
+            .err = tecBAD_PROOF,
+        });
+
+        // issuer's encrypted amount uses a coordinate from the wrong curve
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 10,
+            .proof = getTrivialSendProofHex(),
+            .issuerEncryptedAmt = wrongGroupCt,
+            .amountCommitment = getTrivialCommitment(),
+            .balanceCommitment = getTrivialCommitment(),
+            .err = tecBAD_PROOF,
+        });
+
+        // amount commitment uses a coordinate from the wrong curve
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 10,
+            .proof = getTrivialSendProofHex(),
+            .amountCommitment = wrongGroupCommitment,
+            .balanceCommitment = getTrivialCommitment(),
+            .err = tecBAD_PROOF,
+        });
+
+        // balance commitment uses a coordinate from the wrong curve
+        mptAlice.send({
+            .account = bob,
+            .dest = carol,
+            .amt = 10,
+            .proof = getTrivialSendProofHex(),
+            .amountCommitment = getTrivialCommitment(),
+            .balanceCommitment = wrongGroupCommitment,
+            .err = tecBAD_PROOF,
+        });
+    }
+
+    // Reject an all-zero "null" public key.
+    //
+    // Every account in a confidential transfer needs a real public key —
+    // a specific point on the secp256k1 curve derived from a secret number
+    // only that account knows. An all-zero key (33 bytes of 0x00) is not
+    // a real key. It has no secret behind it, and encrypting data to it
+    // would not actually hide anything. The validator must reject it at
+    // preflight so no account can ever register a broken key.
+    void
+    testConvertIdentityElementRejection(FeatureBitset features)
+    {
+        testcase("Convert: all-zero public key rejected");
+        using namespace test::jtx;
+
+        // 33 zero bytes — not a real public key; no valid secret maps to this.
+        Buffer const nullKey = gMakeZeroBuffer(kEcPubKeyLength);
+
+        // Recipient (holder) tries to register an all-zero key.
+        // Must be rejected so no account ends up with an unprotected balance.
+        {
+            Env env{*this, features};
+            Account const alice("alice"), bob("bob"), carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({.account = bob});
+            mptAlice.authorize({.account = carol});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 50);
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            // recipient (carol) tries to register an all-zero key
+            mptAlice.convert({
+                .account = carol,
+                .amt = 10,
+                .holderPubKey = nullKey,
+                .err = temMALFORMED,
+            });
+
+            // sender (bob) tries to register an all-zero key
+            mptAlice.convert({
+                .account = bob,
+                .amt = 10,
+                .holderPubKey = nullKey,
+                .err = temMALFORMED,
+            });
+        }
+
+        // Issuer tries to register an all-zero key.
+        // The issuer's key is used to encrypt the issuer's copy of every
+        // transfer amount.
+        {
+            Env env{*this, features};
+            Account const alice("alice"), bob("bob");
+            MPTTester mptAlice(env, alice, {.holders = {bob}});
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+            mptAlice.authorize({.account = bob});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = nullKey,
+                .err = temMALFORMED,
+            });
+        }
+    }
+
+    /* This test ensures that when sending confidential tokens, the encrypted
+     * amounts are securely locked to the correct accounts' official public keys.
+     *
+     * Attack scenario — Encrypting the issuer's copy with the wrong key:
+     * A sender correctly encrypts the hidden transfer amount for themselves
+     * and the receiver. However, they intentionally encrypt the issuer's
+     * copy of the data using the wrong public key (for example, using the
+     * receiver's key instead of the official issuer's key). */
+    void
+    testSendWrongIssuerPublicKey(FeatureBitset features)
+    {
+        testcase("Send: issuer ciphertext encrypted under wrong public key");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 100, .convertAmount = 100},
+             {.account = carol, .payAmount = 50, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        auto const bobSpendingBefore =
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending);
+
+        // issuer ciphertext encrypted under carol's holder key
+        // (should be under alice's registered issuer key).
+        {
+            Buffer const bf = generateBlindingFactor();
+            Buffer const wrongIssuerCt = mptAlice.encryptAmount(carol, 10, bf);
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .issuerEncryptedAmt = wrongIssuerCt,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // issuer ciphertext encrypted under bob's holder key
+        // (the sender's own key — still not the registered issuer key).
+        {
+            Buffer const bf = generateBlindingFactor();
+            Buffer const wrongIssuerCt = mptAlice.encryptAmount(bob, 10, bf);
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = 10,
+                .issuerEncryptedAmt = wrongIssuerCt,
+                .err = tecBAD_PROOF,
+            });
+        }
+
+        // all balances unchanged
+        BEAST_EXPECT(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) ==
+            bobSpendingBefore);
+        BEAST_EXPECT(mptAlice.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+    }
+
+    // This test verifies that the compact AND-composed Send sigma proof
+    // enforces the shared-randomness invariant across participants.
+    void
+    testSendSharedRandomnessViolation(FeatureBitset features)
+    {
+        testcase("divergent C1 across participants in ConfidentialMPTSend");
+        using namespace test::jtx;
+
+        Env env{*this, features};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const auditor("auditor");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 100, .convertAmount = 50},
+             {.account = carol, .payAmount = 50, .convertAmount = 50}},
+            tfMPTCanLock | tfMPTCanHoldConfidentialBalance | tfMPTCanTransfer,
+            auditor};
+        auto& mptAlice = confEnv.mpt;
+
+        // Send amount is 10.
+        uint64_t const amt = 10;
+
+        enum class Participant { Sender, Dest, Issuer, Auditor };
+
+        // This lambda submits a send transaction where one of the four ciphertexts
+        // is encrypted with different randomness than the one used to build the proof.
+        // Note: When divergent is nullopt, all participants
+        // will use the same randomness and expected to succeed, this is the
+        // control case that confirms the test setup itself is sound, the bad proof
+        // is actually from divergent randomness, not other causes.
+        auto submitWithDivergentC1 = [&](std::optional<Participant> divergent) {
+            ConfidentialSendSetup setup(mptAlice, bob, carol, alice, amt, std::cref(auditor));
+
+            auto const proofOpt =
+                requireOptional(setup.generateProof(mptAlice, env, bob, carol), "Missing proof");
+
+            // Re-encrypt one participant's ciphertext with divergent randomness.
+            Buffer senderCt = setup.senderAmt;
+            Buffer destCt = setup.destAmt;
+            Buffer issuerCt = setup.issuerAmt;
+            Buffer auditorCt =
+                requireOptionalRef(setup.auditorAmt, "Missing auditor encrypted amount");
+            if (divergent)
+            {
+                Buffer const bfDivergent = generateBlindingFactor();
+                switch (*divergent)
+                {
+                    case Participant::Sender:
+                        senderCt = mptAlice.encryptAmount(bob, amt, bfDivergent);
+                        break;
+                    case Participant::Dest:
+                        destCt = mptAlice.encryptAmount(carol, amt, bfDivergent);
+                        break;
+                    case Participant::Issuer:
+                        issuerCt = mptAlice.encryptAmount(alice, amt, bfDivergent);
+                        break;
+                    case Participant::Auditor:
+                        auditorCt = mptAlice.encryptAmount(auditor, amt, bfDivergent);
+                        break;
+                }
+            }
+
+            TER const expectedErr = divergent ? TER{tecBAD_PROOF} : TER{tesSUCCESS};
+
+            mptAlice.send({
+                .account = bob,
+                .dest = carol,
+                .amt = amt,
+                .proof = strHex(proofOpt),
+                .senderEncryptedAmt = senderCt,
+                .destEncryptedAmt = destCt,
+                .issuerEncryptedAmt = issuerCt,
+                .auditorEncryptedAmt = auditorCt,
+                .blindingFactor = setup.blindingFactor,
+                .amountCommitment = setup.amountCommitment,
+                .balanceCommitment = setup.balanceCommitment,
+                .err = expectedErr,
+            });
+
+            // Verify balances.
+            auto const spendingAfter =
+                mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending);
+            if (divergent)
+            {
+                BEAST_EXPECT(spendingAfter == setup.prevSpending);
+            }
+            else
+            {
+                BEAST_EXPECT(spendingAfter == setup.prevSpending - amt);
+            }
+        };
+
+        // This confirms the test setup is sound, if any of the divergent cases below
+        // fail, it is due to the C1 mismatch and not a setup bug.
+        submitWithDivergentC1(std::nullopt);
+
+        // Divergent C1 for different participants should all fail with tecBAD_PROOF:
+        submitWithDivergentC1(Participant::Sender);
+        submitWithDivergentC1(Participant::Dest);
+        submitWithDivergentC1(Participant::Issuer);
+        submitWithDivergentC1(Participant::Auditor);
+    }
+
+    void
+    testConfidentialMPTBaseFee(FeatureBitset features)
+    {
+        testcase("test confidential transactions fee");
+        using namespace test::jtx;
+
+        auto setup =
+            [&](MPTTester& mpt, Account const& alice, Account const& bob, Account const& carol) {
+                mpt.create({
+                    .ownerCount = 1,
+                    .flags = tfMPTCanLock | tfMPTCanHoldConfidentialBalance | tfMPTCanTransfer |
+                        tfMPTCanClawback,
+                });
+                mpt.authorize({.account = bob});
+                mpt.authorize({.account = carol});
+                mpt.pay(alice, bob, 100);
+                mpt.pay(alice, carol, 50);
+                mpt.generateKeyPair(alice);
+                mpt.generateKeyPair(bob);
+                mpt.generateKeyPair(carol);
+                mpt.set({.account = alice, .issuerPubKey = mpt.getPubKey(alice)});
+            };
+
+        // test expected base fee for confidential transactions
+        {
+            Env env{*this, features};
+            Account const alice("alice"), bob("bob"), carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+            setup(mptAlice, alice, bob, carol);
+
+            auto const baseFee = env.current()->fees().base;
+            auto const expectedFee = baseFee * (kConfidentialFeeMultiplier + 1);
+
+            // lambda function to submit confidential transaction and check fee charged to the
+            // account
+            auto checkFee = [&](Account const& acct, auto&& submitFn) {
+                auto const before = env.balance(acct);
+                submitFn();
+                auto const after = env.balance(acct);
+                BEAST_EXPECT(before - after == expectedFee);
+            };
+
+            checkFee(bob, [&]() {
+                mptAlice.convert(
+                    {.account = bob,
+                     .amt = 50,
+                     .holderPubKey = mptAlice.getPubKey(bob),
+                     .fee = expectedFee});
+            });
+            checkFee(carol, [&]() {
+                mptAlice.convert(
+                    {.account = carol,
+                     .amt = 10,
+                     .holderPubKey = mptAlice.getPubKey(carol),
+                     .fee = expectedFee});
+            });
+            checkFee(bob, [&]() { mptAlice.mergeInbox({.account = bob, .fee = expectedFee}); });
+            checkFee(carol, [&]() { mptAlice.mergeInbox({.account = carol, .fee = expectedFee}); });
+            checkFee(bob, [&]() {
+                mptAlice.send({.account = bob, .dest = carol, .amt = 5, .fee = expectedFee});
+            });
+            checkFee(bob, [&]() {
+                mptAlice.convertBack({.account = bob, .amt = 5, .fee = expectedFee});
+            });
+            checkFee(alice, [&]() {
+                mptAlice.confidentialClaw(
+                    {.account = alice, .holder = carol, .amt = 15, .fee = expectedFee});
+            });
+        }
+
+        // test insufficient fee for confidential transactions
+        {
+            Env env{*this, features};
+            Account const alice("alice"), bob("bob"), carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+            setup(mptAlice, alice, bob, carol);
+            auto const baseFee = env.current()->fees().base;
+            auto const expectedFee = baseFee * (kConfidentialFeeMultiplier + 1);
+
+            mptAlice.convert(
+                {.account = bob,
+                 .amt = 1,
+                 .holderPubKey = mptAlice.getPubKey(bob),
+                 .fee = expectedFee - 1,
+                 .err = telINSUF_FEE_P});
+            mptAlice.mergeInbox({.account = bob, .fee = baseFee, .err = telINSUF_FEE_P});
+            mptAlice.send(
+                {.account = bob,
+                 .dest = carol,
+                 .amt = 1,
+                 .fee = baseFee * kConfidentialFeeMultiplier,
+                 .err = telINSUF_FEE_P});
+            mptAlice.convertBack({.account = bob, .amt = 1, .fee = baseFee, .err = telINSUF_FEE_P});
+            mptAlice.confidentialClaw(
+                {.account = alice,
+                 .holder = carol,
+                 .amt = 1,
+                 .fee = baseFee,
+                 .err = telINSUF_FEE_P});
+        }
+
+        // test excessive fee for confidential transactions
+        {
+            Env env{*this, features};
+            Account const alice("alice"), bob("bob"), carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+            setup(mptAlice, alice, bob, carol);
+
+            auto const baseFee = env.current()->fees().base;
+            auto const highFee = baseFee * (kConfidentialFeeMultiplier + 1) * 2;
+            auto const bobBefore = env.balance(bob);
+            mptAlice.convert(
+                {.account = bob,
+                 .amt = 1,
+                 .holderPubKey = mptAlice.getPubKey(bob),
+                 .fee = highFee});
+            BEAST_EXPECT(env.balance(bob) == bobBefore - highFee);
+        }
+    }
+
+    void
+    testSendForgedEqualityProof(FeatureBitset features)
+    {
+        testcase("Send: forged equality proof");
+
+        // Test that modifying a ciphertext after proof generation causes
+        // verification to fail. The Fiat-Shamir challenge binds ciphertexts
+        // to the proof, so any modification invalidates the proof.
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, 10);
+
+        // Forge destination ciphertext (Enc(20) instead of Enc(10))
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            Buffer const forgedBlindingFactor = generateBlindingFactor();
+            auto const forgedDestAmt = mptAlice.encryptAmount(carol, 20, forgedBlindingFactor);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), tecBAD_PROOF);
+            args.destEncryptedAmt = forgedDestAmt;
+            mptAlice.send(args);
+        }
+
+        // Forge sender's ciphertext (Enc(5) instead of Enc(10))
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            Buffer const forgedBlindingFactor = generateBlindingFactor();
+            auto const forgedSenderAmt = mptAlice.encryptAmount(bob, 5, forgedBlindingFactor);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), tecBAD_PROOF);
+            args.senderEncryptedAmt = forgedSenderAmt;
+            mptAlice.send(args);
+        }
+
+        // Forge issuer's ciphertext (Enc(100) instead of Enc(10))
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            Buffer const forgedBlindingFactor = generateBlindingFactor();
+            auto const forgedIssuerAmt = mptAlice.encryptAmount(alice, 100, forgedBlindingFactor);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), tecBAD_PROOF);
+            args.issuerEncryptedAmt = forgedIssuerAmt;
+            mptAlice.send(args);
+        }
+    }
+
+    void
+    testSendForgedRangeProof(FeatureBitset features)
+    {
+        testcase("Send: forged range proof");
+
+        // Attack: send uint64_max tokens using Enc(uint64_max) ciphertexts
+        // and a corrupted bulletproof. Verifier rejects due to inner-product
+        // mismatch and Fiat-Shamir transcript divergence. Supply invariant
+        // is preserved.
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const badAmount = std::numeric_limits<uint64_t>::max();
+        Buffer const blindingFactor = generateBlindingFactor();
+
+        // Construct Enc(uint64_max) ciphertexts and commitment.
+        auto const senderAmt = mptAlice.encryptAmount(bob, badAmount, blindingFactor);
+        auto const destAmt = mptAlice.encryptAmount(carol, badAmount, blindingFactor);
+        auto const issuerAmt = mptAlice.encryptAmount(alice, badAmount, blindingFactor);
+        auto const amountCommitment = mptAlice.getPedersenCommitment(badAmount, blindingFactor);
+
+        // Balance commitment for Bob's actual balance.
+        auto const prevSpending = requireOptional(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing previous spending balance");
+        auto const balanceBlindingFactor = generateBlindingFactor();
+        auto const balanceCommitment =
+            mptAlice.getPedersenCommitment(prevSpending, balanceBlindingFactor);
+
+        // Generate a valid proof for a legitimate amount, then corrupt
+        // the bulletproof segment to simulate a forged range proof.
+        ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, 10);
+        auto const validProof = setup.generateProof(mptAlice, env, bob, carol);
+        if (!BEAST_EXPECT(validProof.has_value()))
+            return;
+
+        // Corrupt bulletproof bytes.
+        Buffer forgedProof = requireOptional(validProof, "Missing valid proof");
+        for (size_t i = kBulletproofOffset; i < forgedProof.size(); i += 7)
+            forgedProof.data()[i] ^= 0xFF;
+
+        // Submit — rejected due to commitment mismatch.
+        mptAlice.send(
+            {.account = bob,
+             .dest = carol,
+             .amt = badAmount,
+             .proof = strHex(forgedProof),
+             .senderEncryptedAmt = senderAmt,
+             .destEncryptedAmt = destAmt,
+             .issuerEncryptedAmt = issuerAmt,
+             .amountCommitment = amountCommitment,
+             .balanceCommitment = balanceCommitment,
+             .err = tecBAD_PROOF});
+
+        // Supply invariant: Bob's balance unchanged.
+        auto const postSpending = requireOptional(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing post spending balance");
+        BEAST_EXPECT(postSpending == prevSpending);
+    }
+
+    void
+    testSendNegativeValueMalleability(FeatureBitset features)
+    {
+        testcase("Send: negative value malleability");
+
+        // Attack: forge a bulletproof claiming remaining = (uint64_t)(-10).
+        // Bob has 10 tokens, sends 10. Honest remaining is 0, but the
+        // forged proof claims 0xFFFFFFFFFFFFFFF6. Rejected because
+        // PC(0) != PC(0xFFFFFFFFFFFFFFF6).
+
+        using namespace test::jtx;
+        // Bob converts exactly 10 tokens, leaving honest remaining = 0.
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 1000, .convertAmount = 10},
+             {.account = carol, .payAmount = 1000, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const sendAmount = 10;
+        uint64_t const negativeRemaining = static_cast<uint64_t>(-10);  // 0xFFFFFFFFFFFFFFF6
+
+        ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+        auto const ctxHash = getSendContextHash(
+            bob.id(), mptAlice.issuanceID(), env.seq(bob), carol.id(), setup.version);
+
+        auto const validProof = setup.generateProof(mptAlice, env, bob, carol);
+        if (!BEAST_EXPECT(validProof.has_value()))
+            return;
+
+        // Forge bulletproof for {10, 0xFFFFFFFFFFFFFFF6} and splice it in.
+        auto const forgedBulletproof = getForgedBulletproof(
+            {sendAmount, negativeRemaining},
+            {setup.amountBlindingFactor, setup.balanceBlindingFactor},
+            ctxHash);
+
+        Buffer forgedProof(requireOptionalRef(validProof, "Missing valid proof").size());
+        std::memcpy(
+            forgedProof.data(),
+            requireOptionalRef(validProof, "Missing valid proof").data(),
+            kBulletproofOffset);
+        std::memcpy(
+            forgedProof.data() + kBulletproofOffset,
+            forgedBulletproof.data(),
+            kEcDoubleBulletproofLength);
+
+        mptAlice.send(setup.sendArgs(bob, carol, forgedProof, tecBAD_PROOF));
+
+        // Supply invariant: Bob's balance unchanged.
+        auto const postSpending = requireOptional(
+            mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+            "Missing post spending balance");
+        BEAST_EXPECT(postSpending == setup.prevSpending);
+    }
+
+    void
+    testSendInvalidProofContextBinding(FeatureBitset features)
+    {
+        testcase("Send proof context binding");
+        using namespace test::jtx;
+
+        auto runBadProof = [&](auto makeContextHash) {
+            Env env{*this, features};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const carol("carol");
+            ConfidentialEnv confEnv{
+                env,
+                alice,
+                {{.account = bob, .payAmount = 100, .convertAmount = 40}, {.account = carol}}};
+            auto& mptAlice = confEnv.mpt;
+
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, 10);
+
+            auto const proof = mptAlice.getConfidentialSendProof(
+                bob,
+                setup.sendAmount,
+                setup.recipients,
+                setup.blindingFactor,
+                makeContextHash(env, mptAlice, alice, bob, carol, setup.version),
+                {
+                    .pedersenCommitment = setup.amountCommitment,
+                    .amt = setup.sendAmount,
+                    .encryptedAmt = setup.senderAmt,
+                    .blindingFactor = setup.amountBlindingFactor,
+                },
+                {
+                    .pedersenCommitment = setup.balanceCommitment,
+                    .amt = setup.prevSpending,
+                    .encryptedAmt = setup.prevEncryptedSpending,
+                    .blindingFactor = setup.balanceBlindingFactor,
+                });
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            mptAlice.send(setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), tecBAD_PROOF));
+        };
+
+        // Wrong sender account in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const& carol,
+                        std::uint32_t version) {
+            return getSendContextHash(
+                carol.id(), mpt.issuanceID(), env.seq(bob), carol.id(), version);
+        });
+
+        // Wrong issuance ID in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const&,
+                        Account const& alice,
+                        Account const& bob,
+                        Account const& carol,
+                        std::uint32_t version) {
+            return getSendContextHash(
+                bob.id(),
+                makeMptID(env.seq(alice) + 100, alice),
+                env.seq(bob),
+                carol.id(),
+                version);
+        });
+
+        // Wrong transaction sequence in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const& carol,
+                        std::uint32_t version) {
+            return getSendContextHash(
+                bob.id(), mpt.issuanceID(), env.seq(bob) + 1, carol.id(), version);
+        });
+
+        // Wrong destination in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const&,
+                        std::uint32_t version) {
+            return getSendContextHash(bob.id(), mpt.issuanceID(), env.seq(bob), bob.id(), version);
+        });
+
+        // Wrong balance version in the proof context.
+        runBadProof([&](Env& env,
+                        MPTTester const& mpt,
+                        Account const&,
+                        Account const& bob,
+                        Account const& carol,
+                        std::uint32_t version) {
+            return getSendContextHash(
+                bob.id(), mpt.issuanceID(), env.seq(bob), carol.id(), version + 1);
+        });
+    }
+
+    void
+    testSendFiatShamirBinding(FeatureBitset features)
+    {
+        testcase("Send: Fiat-Shamir Binding");
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, 10);
+
+        // Variant A: forged amount commitment.
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            auto const forgedBlindingFactor = generateBlindingFactor();
+            auto const forgedCommitment =
+                mptAlice.getPedersenCommitment(setup.sendAmount + 5, forgedBlindingFactor);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), tecBAD_PROOF);
+            args.amountCommitment = forgedCommitment;
+            mptAlice.send(args);
+        }
+
+        // Variant B: proof replay at a different sequence.
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            mptAlice.pay(bob, carol, 1);
+            env.close();
+
+            mptAlice.send(setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), tecBAD_PROOF));
+        }
+
+        // Variant C: tampered response scalars.
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            auto const& proofRef = requireOptionalRef(proof, "Missing proof");
+            Buffer tamperedProof(proofRef.size());
+            std::memcpy(tamperedProof.data(), proofRef.data(), proofRef.size());
+            size_t const tamperOffset = tamperedProof.size() / 2;
+            tamperedProof.data()[tamperOffset] ^= 0xFF;
+
+            mptAlice.send(setup.sendArgs(bob, carol, tamperedProof, tecBAD_PROOF));
+        }
+    }
+
+    void
+    testSendProofComponentReuse(FeatureBitset features)
+    {
+        testcase("Send: Proof Component Reuse");
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol"), dan("dan");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob},
+             {.account = carol, .payAmount = 1000, .convertAmount = 50},
+             {.account = dan, .payAmount = 1000, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const sendAmount = 10;
+
+        // Variant A: replay proof to same destination after sequence changes.
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            mptAlice.send(setup.sendArgs(bob, carol, requireOptionalRef(proof, "Missing proof")));
+            mptAlice.mergeInbox({.account = carol});
+
+            mptAlice.send(setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), tecBAD_PROOF));
+        }
+
+        // Variant B: replay proof to a different destination.
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            mptAlice.send(setup.sendArgs(bob, carol, requireOptionalRef(proof, "Missing proof")));
+            mptAlice.mergeInbox({.account = carol});
+
+            auto const destAmtDan = mptAlice.encryptAmount(dan, sendAmount, setup.blindingFactor);
+            auto const issuerAmtDan =
+                mptAlice.encryptAmount(alice, sendAmount, setup.blindingFactor);
+
+            auto args =
+                setup.sendArgs(bob, dan, requireOptionalRef(proof, "Missing proof"), tecBAD_PROOF);
+            args.destEncryptedAmt = destAmtDan;
+            args.issuerEncryptedAmt = issuerAmtDan;
+            mptAlice.send(args);
+        }
+    }
+
+    void
+    testSendSpecialWitnessValues(FeatureBitset features)
+    {
+        testcase("Send: special witness values");
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}}};
+        auto& mptAlice = confEnv.mpt;
+
+        ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, 10);
+
+        // Variant A: zero-valued response scalars.
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            Buffer forgedProof = requireOptionalRef(proof, "Missing proof");
+
+            static constexpr size_t kSigmaScalarSize = 32;
+            static constexpr size_t kChallengeOffset = 0;
+            static constexpr size_t kResponseOffset = kChallengeOffset + kSigmaScalarSize;
+            static constexpr size_t kResponseSize = 5 * kSigmaScalarSize;  // z_m..z_sk
+            std::memset(forgedProof.data() + kResponseOffset, 0, kResponseSize);
+
+            mptAlice.send(setup.sendArgs(bob, carol, forgedProof, tecBAD_PROOF));
+        }
+
+        // Variant B: identity element in ciphertext.
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            Buffer invalidCiphertext(kEcGamalEncryptedTotalLength);
+            std::memset(invalidCiphertext.data(), 0, kEcGamalEncryptedTotalLength);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), temBAD_CIPHERTEXT);
+            args.senderEncryptedAmt = invalidCiphertext;
+            mptAlice.send(args);
+        }
+
+        // Variant B2: identity element in commitment.
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            Buffer invalidCommitment(kEcPedersenCommitmentLength);
+            std::memset(invalidCommitment.data(), 0, kEcPedersenCommitmentLength);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(proof, "Missing proof"), temMALFORMED);
+            args.amountCommitment = invalidCommitment;
+            mptAlice.send(args);
+        }
+
+        // Variant C: boundary scalar (curve order).
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            Buffer forgedProof = requireOptionalRef(proof, "Missing proof");
+
+            static constexpr unsigned char kCurveOrder[32] = {
+                0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,  //
+                0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,  //
+                0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,  //
+                0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41   //
+            };
+
+            std::memcpy(forgedProof.data() + 32, kCurveOrder, 32);
+
+            mptAlice.send(setup.sendArgs(bob, carol, forgedProof, tecBAD_PROOF));
+        }
+
+        // Variant C2: overflow scalar (curve order + 1).
+        {
+            auto const proof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof.has_value()))
+                return;
+
+            Buffer forgedProof = requireOptionalRef(proof, "Missing proof");
+
+            static constexpr unsigned char kOverflowScalar[32] = {
+                0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,  //
+                0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,  //
+                0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,  //
+                0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x42   //
+            };
+
+            std::memcpy(forgedProof.data() + 32, kOverflowScalar, 32);
+
+            mptAlice.send(setup.sendArgs(bob, carol, forgedProof, tecBAD_PROOF));
+        }
+    }
+
+    void
+    testSendCrossStatementProofSubstitution(FeatureBitset features)
+    {
+        testcase("Send: cross-statement proof substitution");
+
+        // This test verifies that proofs generated for one protocol component
+        // cannot be used in place of another, and that proofs bound to
+        // different public parameters are rejected.
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}},
+            tfMPTCanLock | tfMPTCanHoldConfidentialBalance | tfMPTCanTransfer | tfMPTCanClawback};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const sendAmount = 10;
+
+        // Variant A: Swap proof type (cross-statement substitution)
+        // -----------------------------------------------------------------
+        // Attack: Generate a valid convertBack proof (compact sigma +
+        // single bulletproof) and attempt to use it as the ZK proof in a
+        // ConfidentialMPTSend transaction.
+        //
+        // Expected: The send proof has a different structure
+        // (equality + 2×pedersen + double bulletproof). Even if sized to
+        // match, the domain-separated Fiat-Shamir transcript differs,
+        // so verification equations fail.
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+            // Generate a valid convertBack proof for bob
+            auto const spendingBalance = requireOptional(
+                mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending),
+                "Missing spending balance");
+            auto const encryptedSpending = requireOptional(
+                mptAlice.getEncryptedBalance(bob, MPTTester::holderEncryptedSpending),
+                "Missing encrypted spending balance");
+
+            Buffer const pcBlindingFactor = generateBlindingFactor();
+            Buffer const pedersenCommitment =
+                mptAlice.getPedersenCommitment(spendingBalance, pcBlindingFactor);
+
+            auto const version = mptAlice.getMPTokenVersion(bob);
+            uint256 const convertBackCtxHash =
+                getConvertBackContextHash(bob.id(), mptAlice.issuanceID(), env.seq(bob), version);
+
+            Buffer const convertBackProof = mptAlice.getConvertBackProof(
+                bob,
+                sendAmount,
+                convertBackCtxHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = spendingBalance,
+                    .encryptedAmt = encryptedSpending,
+                    .blindingFactor = pcBlindingFactor,
+                });
+
+            // Resize the convertBack proof to match the expected send proof
+            // size so it passes preflight's size check and reaches the actual
+            // ZK verification in doApply.
+            auto const expectedSendSize = kEcSendProofLength;
+            Buffer resizedProof(expectedSendSize);
+            auto const copyLen = std::min(convertBackProof.size(), expectedSendSize);
+            std::memcpy(resizedProof.data(), convertBackProof.data(), copyLen);
+            // Zero-pad the rest (if convertBack proof is shorter)
+            if (copyLen < expectedSendSize)
+                std::memset(resizedProof.data() + copyLen, 0, expectedSendSize - copyLen);
+
+            mptAlice.send(setup.sendArgs(bob, carol, resizedProof, tecBAD_PROOF));
+        }
+
+        // Variant B: Valid proof bound to wrong public parameters
+        // -----------------------------------------------------------------
+        // Attack: Generate a valid send proof using a wrong context hash
+        // (computed with a different issuanceID). The proof is
+        // mathematically valid for the wrong statement, but when the
+        // verifier recomputes the Fiat-Shamir challenge using the correct
+        // issuanceID, the challenge differs and verification fails.
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+            // Compute context hash with a fabricated (wrong) issuanceID
+            uint192 const fakeIssuanceID{1};
+            auto const wrongCtxHash = getSendContextHash(
+                bob.id(), fakeIssuanceID, env.seq(bob), carol.id(), setup.version);
+
+            // Generate a proof that is valid for the wrong issuanceID
+            auto const wrongProof = mptAlice.getConfidentialSendProof(
+                bob,
+                sendAmount,
+                setup.recipients,
+                setup.blindingFactor,
+                wrongCtxHash,
+                {
+                    .pedersenCommitment = setup.amountCommitment,
+                    .amt = sendAmount,
+                    .encryptedAmt = setup.senderAmt,
+                    .blindingFactor = setup.amountBlindingFactor,
+                },
+                {
+                    .pedersenCommitment = setup.balanceCommitment,
+                    .amt = setup.prevSpending,
+                    .encryptedAmt = setup.prevEncryptedSpending,
+                    .blindingFactor = setup.balanceBlindingFactor,
+                });
+
+            if (!BEAST_EXPECT(wrongProof.has_value()))
+                return;
+
+            // Submit with the correct issuanceID — verifier recomputes
+            // the challenge using the real issuanceID, which differs from
+            // the one baked into the proof.
+            mptAlice.send(setup.sendArgs(
+                bob, carol, requireOptionalRef(wrongProof, "Missing wrong proof"), tecBAD_PROOF));
+        }
+    }
+
+    void
+    testSendCiphertextMalleability(FeatureBitset features)
+    {
+        testcase("Send: ciphertext malleability");
+
+        // Attack: replace ElGamal ciphertext Enc(m) with Enc(2m) to inflate
+        // the amount credited to the recipient. ElGamal is homomorphic, so
+        // scalar multiplication (C1, C2) → (k*C1, k*C2) decrypts to k*m.
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}},
+            tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const sendAmount = 10;
+
+        // Variant A: Post-signature tampering.
+        // Build a valid signed transaction, then replace the destination
+        // ciphertext with Enc(2m) in the serialized blob. The original
+        // signature no longer covers the modified data.
+        {
+            auto const seq = env.seq(bob);
+            auto jv = mptAlice.sendJV({.account = bob, .dest = carol, .amt = sendAmount}, seq);
+            auto jtx = env.jt(jv);
+            BEAST_EXPECT(jtx.stx);
+
+            // Serialize signed tx, deserialize into mutable STObject
+            Serializer s;
+            jtx.stx->add(s);
+            SerialIter sit(s.slice());
+            STObject obj(sit, sfTransaction);
+
+            // Replace dest ciphertext with Enc(2m) — a valid EC point
+            // encrypting an inflated amount under carol's key
+            Buffer const bf = generateBlindingFactor();
+            auto const inflatedCiphertext = mptAlice.encryptAmount(carol, sendAmount * 2, bf);
+            obj.setFieldVL(sfDestinationEncryptedAmount, inflatedCiphertext);
+
+            // Re-serialize with the original (now-stale) signature
+            Serializer tampered;
+            obj.add(tampered);
+
+            // Signature verification fails — rejected before ZKP check
+            auto const jr = env.rpc("submit", strHex(tampered.slice()));
+            BEAST_EXPECT(jr[jss::result][jss::error] == "invalidTransaction");
+        }
+
+        // Variant B: Re-signed with inflated ciphertext.
+        // Generate a valid proof for amount m, then replace the destination
+        // ciphertext with Enc(2m) and re-sign. Signature passes, but the
+        // compact sigma proof fails: the proof binds Enc(m) to the Pedersen
+        // commitment PC(m, r), so substituting Enc(2m) breaks the linkage.
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+            auto const ctxHash = getSendContextHash(
+                bob.id(), mptAlice.issuanceID(), env.seq(bob), carol.id(), setup.version);
+
+            auto const validProof = mptAlice.getConfidentialSendProof(
+                bob,
+                sendAmount,
+                setup.recipients,
+                setup.blindingFactor,
+                ctxHash,
+                {
+                    .pedersenCommitment = setup.amountCommitment,
+                    .amt = sendAmount,
+                    .encryptedAmt = setup.senderAmt,
+                    .blindingFactor = setup.amountBlindingFactor,
+                },
+                {
+                    .pedersenCommitment = setup.balanceCommitment,
+                    .amt = setup.prevSpending,
+                    .encryptedAmt = setup.prevEncryptedSpending,
+                    .blindingFactor = setup.balanceBlindingFactor,
+                });
+
+            if (!BEAST_EXPECT(validProof.has_value()))
+                return;
+
+            // Replace dest ciphertext with Enc(2m) using the same blinding
+            // factor — even with matching randomness the proof rejects
+            // because the committed plaintext differs
+            auto const inflatedDestAmt =
+                mptAlice.encryptAmount(carol, sendAmount * 2, setup.blindingFactor);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(validProof, "Missing valid proof"), tecBAD_PROOF);
+            args.destEncryptedAmt = inflatedDestAmt;
+            mptAlice.send(args);
+        }
+    }
+
+    void
+    testSendCiphertextNegation(FeatureBitset features)
+    {
+        testcase("Send: ciphertext negation");
+
+        // Attack: negate ciphertext -Enc(m) = (-C1, -C2) to reverse the
+        // transaction direction. Negation decrypts to the group-level
+        // additive inverse of m*G, effectively turning a credit into a debit.
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}},
+            tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const sendAmount = 10;
+
+        // Negate an ElGamal ciphertext by flipping the y-coordinate parity
+        // of both compressed EC points. For secp256k1 compressed form,
+        // prefix 0x02 means even-y and 0x03 means odd-y; negation
+        // swaps them: -P has the same x but opposite y.
+        auto negateCiphertext = [](Buffer const& ct) -> Buffer {
+            Buffer neg = ct;
+            neg.data()[0] ^= 0x01;                             // negate C1
+            neg.data()[kEcCiphertextComponentLength] ^= 0x01;  // negate C2
+            return neg;
+        };
+
+        // Variant A: Post-signature negation.
+        // Negate the destination ciphertext in the signed blob.
+        // Signature no longer covers the modified field.
+        {
+            auto const seq = env.seq(bob);
+            auto jv = mptAlice.sendJV({.account = bob, .dest = carol, .amt = sendAmount}, seq);
+            auto jtx = env.jt(jv);
+            BEAST_EXPECT(jtx.stx);
+
+            Serializer s;
+            jtx.stx->add(s);
+
+            SerialIter sit(s.slice());
+            STObject obj(sit, sfTransaction);
+
+            auto const origDestAmt = obj.getFieldVL(sfDestinationEncryptedAmount);
+            Buffer const origBuf(origDestAmt.data(), origDestAmt.size());
+            auto const negDestAmt = negateCiphertext(origBuf);
+            obj.setFieldVL(
+                sfDestinationEncryptedAmount, Slice(negDestAmt.data(), negDestAmt.size()));
+
+            Serializer tampered;
+            obj.add(tampered);
+
+            auto const jr = env.rpc("submit", strHex(tampered.slice()));
+            BEAST_EXPECT(jr[jss::result][jss::error] == "invalidTransaction");
+        }
+
+        // Variant B: Re-signed with all negated ciphertexts.
+        // Signature passes, but the compact sigma proof fails — the proof
+        // was generated for Enc(m), not Enc(-m).
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+            auto const validProof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(validProof.has_value()))
+                return;
+
+            // Negate all three ciphertexts: Enc(m) -> Enc(-m)
+            auto const negSenderAmt = negateCiphertext(setup.senderAmt);
+            auto const negDestAmt = negateCiphertext(setup.destAmt);
+            auto const negIssuerAmt = negateCiphertext(setup.issuerAmt);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(validProof, "Missing valid proof"), tecBAD_PROOF);
+            args.senderEncryptedAmt = negSenderAmt;
+            args.destEncryptedAmt = negDestAmt;
+            args.issuerEncryptedAmt = negIssuerAmt;
+            mptAlice.send(args);
+        }
+
+        // Variant C: Negate only the sender ciphertext.
+        // The verifier uses the sender ciphertext to derive the remainder
+        // commitment: Enc(b) - Enc(m) becomes Enc(b) - (-Enc(m)) = Enc(b+m).
+        // The bulletproof was generated for (b - m), not (b + m), so the
+        // aggregated range proof fails.
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+            auto const validProof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(validProof.has_value()))
+                return;
+
+            auto const negSenderAmt = negateCiphertext(setup.senderAmt);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(validProof, "Missing valid proof"), tecBAD_PROOF);
+            args.senderEncryptedAmt = negSenderAmt;
+            mptAlice.send(args);
+        }
+    }
+
+    void
+    testSendCiphertextCombination(FeatureBitset features)
+    {
+        testcase("Send: ciphertext combination");
+
+        // Attack: exploit ElGamal homomorphism to combine ciphertexts
+        // Enc(m1) + Enc(m2) = Enc(m1+m2), inflating the credited amount
+        // without knowing the private keys.
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob, .payAmount = 1000, .convertAmount = 200},
+             {.account = carol, .payAmount = 1000, .convertAmount = 100}},
+            tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const m1 = 10;
+        uint64_t const m2 = 5;
+
+        // Variant A: Post-signature combination.
+        // Add Enc(m2) to the signed destination ciphertext Enc(m1).
+        // The original signature doesn't cover the combined ciphertext.
+        {
+            auto const seq = env.seq(bob);
+            auto jv = mptAlice.sendJV({.account = bob, .dest = carol, .amt = m1}, seq);
+            auto jtx = env.jt(jv);
+            BEAST_EXPECT(jtx.stx);
+
+            Serializer s;
+            jtx.stx->add(s);
+
+            SerialIter sit(s.slice());
+            STObject obj(sit, sfTransaction);
+
+            auto const origDestCt = obj.getFieldVL(sfDestinationEncryptedAmount);
+
+            // Homomorphically add Enc(m2) to the original Enc(m1)
+            Buffer const bf2 = generateBlindingFactor();
+            auto const encM2 = mptAlice.encryptAmount(carol, m2, bf2);
+            auto const combined = requireOptional(
+                homomorphicAdd(
+                    Slice(origDestCt.data(), origDestCt.size()), Slice(encM2.data(), encM2.size())),
+                "Missing combined ciphertext");
+
+            obj.setFieldVL(sfDestinationEncryptedAmount, combined);
+
+            Serializer tampered;
+            obj.add(tampered);
+
+            auto const jr = env.rpc("submit", strHex(tampered.slice()));
+            BEAST_EXPECT(jr[jss::result][jss::error] == "invalidTransaction");
+        }
+
+        // Variant B: Re-signed with combined ciphertext.
+        // Generate a valid proof for m1, then replace dest ciphertext with
+        // Enc(m1) + Enc(m2). Sigma proof fails because the proof was
+        // generated for Enc(m1) only — the combined ciphertext has
+        // different randomness.
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, m1);
+
+            auto const validProof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(validProof.has_value()))
+                return;
+
+            // Homomorphically add Enc(m2) to the valid dest ciphertext
+            Buffer const bf2 = generateBlindingFactor();
+            auto const encM2 = mptAlice.encryptAmount(carol, m2, bf2);
+            auto const combinedDest = homomorphicAdd(setup.destAmt, encM2);
+            BEAST_EXPECT(combinedDest.has_value());
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(validProof, "Missing valid proof"), tecBAD_PROOF);
+            args.destEncryptedAmt = combinedDest;
+            mptAlice.send(args);
+        }
+
+        // Variant C: Cross-transaction ciphertext reuse.
+        // Execute a valid send of m1, then build a new send for m2 using
+        // a combined ciphertext oldEnc(m1) + newEnc(m2) = Enc(m1+m2),
+        // where oldEnc(m1) is the actual ciphertext from the previous tx.
+        // The proof was generated for the new transaction's context, but
+        // the ciphertext includes stale randomness from the old Enc(m1).
+        {
+            // Execute a valid send of m1, capturing the actual ciphertext used
+            ConfidentialSendSetup const setup1(mptAlice, bob, carol, alice, m1);
+            auto const proof1 = setup1.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof1.has_value()))
+                return;
+            mptAlice.send(setup1.sendArgs(bob, carol, requireOptionalRef(proof1, "Missing proof")));
+
+            ConfidentialSendSetup const setup2(mptAlice, bob, carol, alice, m2);
+
+            auto const proof2 = setup2.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof2.has_value()))
+                return;
+
+            // Combine the actual prior-tx Enc(m1) with the new Enc(m2)
+            auto const crossCombined = homomorphicAdd(setup1.destAmt, setup2.destAmt);
+            BEAST_EXPECT(crossCombined.has_value());
+
+            auto args = setup2.sendArgs(
+                bob, carol, requireOptionalRef(proof2, "Missing proof"), tecBAD_PROOF);
+            args.destEncryptedAmt = crossCombined;
+            mptAlice.send(args);
+        }
+    }
+
+    void
+    testSendCiphertextRerandomization(FeatureBitset features)
+    {
+        testcase("Send: ciphertext rerandomization");
+
+        // Attack: substitute the randomness component C1 of an ElGamal
+        // ciphertext (C1, C2) while keeping the message component C2
+        // unchanged. This "rerandomizes" the ciphertext to break
+        // linkability or forge fresh-looking ciphertexts.
+        //
+        // The compact sigma proof binds C1 to the shared randomness used
+        // across all recipients, so any C1 substitution breaks the proof.
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}},
+            tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const sendAmount = 10;
+
+        // Helper: replace C1 in a ciphertext with C1 from another
+        // ciphertext, keeping C2 unchanged. Returns a rerandomized
+        // ciphertext (C1', C2).
+        auto substituteC1 = [](Buffer const& target, Buffer const& source) -> Buffer {
+            Buffer result = target;
+            // Copy C1 (the first ciphertext component) from source.
+            std::memcpy(result.data(), source.data(), kEcCiphertextComponentLength);
+            return result;
+        };
+
+        // Variant A: Post-signature C1 substitution.
+        // Replace C1 in the dest ciphertext after signing.
+        // Signature no longer covers the modified ciphertext.
+        {
+            auto const seq = env.seq(bob);
+            auto jv = mptAlice.sendJV({.account = bob, .dest = carol, .amt = sendAmount}, seq);
+            auto jtx = env.jt(jv);
+            BEAST_EXPECT(jtx.stx);
+
+            Serializer s;
+            jtx.stx->add(s);
+            SerialIter sit(s.slice());
+            STObject obj(sit, sfTransaction);
+
+            // Generate a random C1' by encrypting a different amount
+            Buffer const bf2 = generateBlindingFactor();
+            auto const otherCt = mptAlice.encryptAmount(carol, 99, bf2);
+
+            // Replace C1 in the dest ciphertext
+            auto const origDestAmt = obj.getFieldVL(sfDestinationEncryptedAmount);
+            Buffer const origBuf(origDestAmt.data(), origDestAmt.size());
+            auto const rerandomized = substituteC1(origBuf, otherCt);
+            obj.setFieldVL(
+                sfDestinationEncryptedAmount, Slice(rerandomized.data(), rerandomized.size()));
+
+            Serializer tampered;
+            obj.add(tampered);
+
+            // Signature verification fails
+            auto const jr = env.rpc("submit", strHex(tampered.slice()));
+            BEAST_EXPECT(jr[jss::result][jss::error] == "invalidTransaction");
+        }
+
+        // Variant B: Re-signed C1 substitution.
+        // Replace C1 in the dest ciphertext with a fresh random point
+        // and re-sign. Sigma proof fails because the shared-randomness
+        // binding no longer holds — C1' wasn't generated with the same r
+        // used in the proof.
+        {
+            ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
+
+            auto const validProof = setup.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(validProof.has_value()))
+                return;
+
+            // Create a ciphertext with different randomness to get C1'
+            Buffer const bf2 = generateBlindingFactor();
+            auto const otherCt = mptAlice.encryptAmount(carol, sendAmount, bf2);
+
+            // Replace C1 in dest ciphertext, keep C2
+            auto const rerandomizedDest = substituteC1(setup.destAmt, otherCt);
+
+            auto args = setup.sendArgs(
+                bob, carol, requireOptionalRef(validProof, "Missing valid proof"), tecBAD_PROOF);
+            args.destEncryptedAmt = rerandomizedDest;
+            mptAlice.send(args);
+        }
+    }
+
+    void
+    testSendZeroRandomnessCiphertext(FeatureBitset features)
+    {
+        testcase("Send: zero randomness ciphertext");
+
+        // Setting r = 0 in ElGamal yields C1 = O (identity), C2 = mG —
+        // a deterministic ciphertext that reveals the plaintext.
+
+        using namespace test::jtx;
+        Env env{*this, features};
+        Account const alice("alice"), bob("bob"), carol("carol");
+        ConfidentialEnv confEnv{
+            env,
+            alice,
+            {{.account = bob}, {.account = carol, .payAmount = 1000, .convertAmount = 50}},
+            tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance};
+        auto& mptAlice = confEnv.mpt;
+
+        uint64_t const sendAmount = 10;
+
+        // -----------------------------------------------------------------
+        // Variant A: Post-signature zero-randomness substitution
+        // -----------------------------------------------------------------
+        // Construct a valid ConfidentialMPTSend transaction with proper
+        // ciphertexts and ZKPs, sign it, then replace the sender ciphertext
+        // with a deterministic form (C1 = 0x00...00, C2 = arbitrary).
+        // Since the identity element has no valid compressed encoding,
+        // the modified blob fails deserialization / signature check.
+        {
+            auto const seq = env.seq(bob);
+            auto jv = mptAlice.sendJV({.account = bob, .dest = carol, .amt = sendAmount}, seq);
+            auto jtx = env.jt(jv);
+            BEAST_EXPECT(jtx.stx);
+
+            // Serialize the signed transaction
+            Serializer s;
+            jtx.stx->add(s);
+            SerialIter sit(s.slice());
+            STObject obj(sit, sfTransaction);
+
+            // Replace sender ciphertext with zero-randomness form:
+            // C1 = all zeros (identity element — invalid encoding)
+            // C2 = valid trivial point (simulating mG)
+            Buffer zeroCiphertext(kEcGamalEncryptedTotalLength);
+            std::memset(zeroCiphertext.data(), 0, kEcGamalEncryptedTotalLength);
+            // C2 half: use a valid point so only C1 is the problem
+            auto const& tc = getTrivialCiphertext();
+            std::memcpy(
+                zeroCiphertext.data() + kEcCiphertextComponentLength,
+                tc.data() + kEcCiphertextComponentLength,
+                kEcCiphertextComponentLength);
+            obj.setFieldVL(sfSenderEncryptedAmount, zeroCiphertext);
+
+            // Re-serialize with the original (now-stale) signature
+            Serializer tampered;
+            obj.add(tampered);
+
+            // Signature verification fails because ciphertext fields are
+            // signed — transaction rejected before ZKP verification.
+            auto const jr = env.rpc("submit", strHex(tampered.slice()));
+            BEAST_EXPECT(jr[jss::result][jss::error] == "invalidTransaction");
+        }
+
+        // -----------------------------------------------------------------
+        // Variant B: Re-signed zero-randomness ciphertext
+        // -----------------------------------------------------------------
+        // Same zero-randomness ciphertext as Variant A (C1 = 0, C2 = mG),
+        // but submitted normally via send() which re-signs the transaction.
+        // Signature verification passes, but preflight's isValidCiphertext
+        // rejects it: the identity element has no valid compressed encoding
+        // on secp256k1, so secp256k1_ec_pubkey_parse fails on C1 = 0.
+        {
+            // Build zero-randomness ciphertext: C1 = all zeros (identity),
+            // C2 = valid trivial point (simulating mG)
+            Buffer zeroCiphertext(kEcGamalEncryptedTotalLength);
+            std::memset(zeroCiphertext.data(), 0, kEcGamalEncryptedTotalLength);
+            auto const& tc = getTrivialCiphertext();
+            std::memcpy(
+                zeroCiphertext.data() + kEcCiphertextComponentLength,
+                tc.data() + kEcCiphertextComponentLength,
+                kEcCiphertextComponentLength);
+
+            mptAlice.send(
+                {.account = bob,
+                 .dest = carol,
+                 .amt = sendAmount,
+                 .senderEncryptedAmt = zeroCiphertext,
+                 .err = temBAD_CIPHERTEXT});
+        }
+
+        // -----------------------------------------------------------------
+        // Variant C: Deterministic ciphertext reuse across transactions
+        // -----------------------------------------------------------------
+        // Construct two transactions using identical deterministic
+        // ciphertexts (same fixed blinding factor).  Even if a valid
+        // proof could be generated for one, it cannot be reused because
+        // the TransactionContextID (which includes account sequence)
+        // differs between transactions.
+        {
+            // First transaction: generate valid proof for sendAmount
+            ConfidentialSendSetup const setup1(mptAlice, bob, carol, alice, sendAmount);
+
+            auto const proof1 = setup1.generateProof(mptAlice, env, bob, carol);
+            if (!BEAST_EXPECT(proof1.has_value()))
+                return;
+
+            // Submit first transaction successfully
+            mptAlice.send(setup1.sendArgs(bob, carol, requireOptionalRef(proof1, "Missing proof")));
+
+            mptAlice.mergeInbox({.account = carol});
+
+            // Second transaction: reuse the same proof from tx1.
+            // The context hash includes the new account sequence, so the
+            // proof generated for the old sequence is invalid.
+            ConfidentialSendSetup const setup2(mptAlice, bob, carol, alice, sendAmount);
+
+            mptAlice.send(setup2.sendArgs(
+                bob, carol, requireOptionalRef(proof1, "Missing proof"), tecBAD_PROOF));
+        }
+    }
+
+    void
+    testSendRerandomizesRecipientInboxAgainstMergeCancellation(FeatureBitset features)
+    {
+        testcase("Send: recipient inbox rerandomization prevents merge cancellation");
+
+        using namespace test::jtx;
+
+        // Derive the deterministic canonical-zero randomness r0 used for
+        // Bob's first spending balance.
+        auto getCanonicalZeroBlindingFactor = [](AccountID const& account, MPTID const& mptID) {
+            Buffer scalar(kEcBlindingFactorLength);
+            std::array<unsigned char, 51> hashInput{};
+            std::memcpy(hashInput.data(), "EncZero", 7);
+            std::memcpy(hashInput.data() + 7, account.data(), account.size());
+            std::memcpy(hashInput.data() + 27, mptID.data(), mptID.size());
+
+            for (;;)
+            {
+                unsigned int mdLen = kEcBlindingFactorLength;
+                if (EVP_Digest(
+                        hashInput.data(),
+                        hashInput.size(),
+                        scalar.data(),
+                        &mdLen,
+                        EVP_sha256(),
+                        nullptr) != 1)
+                {
+                    Throw<std::runtime_error>("Failed to derive canonical zero blinding factor");
+                }
+
+                if (secp256k1_ec_seckey_verify(mpt_secp256k1_context(), scalar.data()))
+                    return scalar;
+
+                std::memcpy(hashInput.data(), scalar.data(), scalar.size());
+            }
+        };
+
+        // Pick randomness that would cancel Bob's MergeInbox C1 to infinity
+        // without receiver-side re-randomization.
+        auto negateScalarSum = [](Buffer const& lhs, Buffer const& rhs) {
+            Buffer sum(kEcBlindingFactorLength);
+            Buffer negated(kEcBlindingFactorLength);
+            secp256k1_mpt_scalar_add(sum.data(), lhs.data(), rhs.data());
+            secp256k1_mpt_scalar_negate(negated.data(), sum.data());
+            return negated;
+        };
+
+        // Without an auditor, target Bob's holder inbox. The crafted send
+        // randomness would make MergeInbox hit the point at infinity unless
+        // ConfidentialMPTSend re-randomizes the recipient ciphertext.
+        {
+            Env env{*this, features};
+            Account const alice("alice"), bob("bob"), carol("carol");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({.account = bob});
+            mptAlice.authorize({.account = carol});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.set({.account = alice, .issuerPubKey = mptAlice.getPubKey(alice)});
+
+            mptAlice.convert({
+                .account = carol,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(carol),
+            });
+            mptAlice.mergeInbox({.account = carol});
+
+            Buffer const convertBlindingFactor = generateBlindingFactor();
+            mptAlice.convert({
+                .account = bob,
+                .amt = 20,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .blindingFactor = convertBlindingFactor,
+            });
+
+            Buffer const canonicalZeroBlindingFactor =
+                getCanonicalZeroBlindingFactor(bob.id(), mptAlice.issuanceID());
+
+            // Holder inbox cancellation happens later in MergeInbox, when
+            // Bob's spending Enc(0; r0) is added to inbox Enc(25; -r0).
+            Buffer const maliciousSendBlindingFactor =
+                negateScalarSum(canonicalZeroBlindingFactor, convertBlindingFactor);
+
+            mptAlice.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 5,
+                .blindingFactor = maliciousSendBlindingFactor,
+            });
+
+            mptAlice.mergeInbox({.account = bob});
+
+            auto const bobSpending =
+                mptAlice.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending);
+            BEAST_EXPECT(bobSpending && *bobSpending == 25);
+        }
+
+        // With an auditor, verify the destination auditor balance is also
+        // re-randomized. Auditor balance is updated during send, and this crafted
+        // randomness would otherwise make that homomorphic sum hit infinity without
+        // re-randomization.
+        {
+            Env env{*this, features};
+            Account const alice("alice"), bob("bob"), carol("carol"), auditor("auditor");
+            MPTTester mptAlice(env, alice, {.holders = {bob, carol}, .auditor = auditor});
+
+            mptAlice.create({
+                .ownerCount = 1,
+                .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+            });
+
+            mptAlice.authorize({.account = bob});
+            mptAlice.authorize({.account = carol});
+            mptAlice.pay(alice, bob, 100);
+            mptAlice.pay(alice, carol, 100);
+
+            mptAlice.generateKeyPair(alice);
+            mptAlice.generateKeyPair(bob);
+            mptAlice.generateKeyPair(carol);
+            mptAlice.generateKeyPair(auditor);
+            mptAlice.set({
+                .account = alice,
+                .issuerPubKey = mptAlice.getPubKey(alice),
+                .auditorPubKey = mptAlice.getPubKey(auditor),
+            });
+
+            mptAlice.convert({
+                .account = carol,
+                .amt = 50,
+                .holderPubKey = mptAlice.getPubKey(carol),
+            });
+            mptAlice.mergeInbox({.account = carol});
+
+            Buffer const convertBlindingFactor = generateBlindingFactor();
+            mptAlice.convert({
+                .account = bob,
+                .amt = 20,
+                .holderPubKey = mptAlice.getPubKey(bob),
+                .blindingFactor = convertBlindingFactor,
+            });
+
+            // This would make the homomorphic sum hit infinity.
+            Buffer const maliciousSendBlindingFactor =
+                negateScalarSum(gMakeZeroBuffer(kEcBlindingFactorLength), convertBlindingFactor);
+
+            mptAlice.send({
+                .account = carol,
+                .dest = bob,
+                .amt = 5,
+                .blindingFactor = maliciousSendBlindingFactor,
+            });
+
+            auto const bobAuditor =
+                mptAlice.getDecryptedBalance(bob, MPTTester::auditorEncryptedBalance);
+            BEAST_EXPECT(bobAuditor && *bobAuditor == 25);
+        }
+    }
+
+    void
+    testWithFeats(FeatureBitset features)
+    {
+        // ConfidentialMPTConvert
+        testConvert(features);
+        testConvertPreflight(features);
+        testConvertInvalidProofContextBinding(features);
+        testConvertPreclaim(features);
+        testConvertWithAuditor(features);
+
+        // ConfidentialMPTMergeInbox
+        testMergeInbox(features);
+        testMergeInboxPreflight(features);
+        testMergeInboxPreclaim(features);
+
+        testSet(features);
+        testSetPreflight(features);
+        testSetPreclaim(features);
+
+        // ConfidentialMPTSend
+        testSend(features);
+        testSendPreflight(features);
+        testSendPreclaim(features);
+        testSendRangeProof(features);
+
+        testSendZeroAmount(features);
+        testSendWithAuditor(features);
+
+        // ConfidentialMPTClawback
+        testClawback(features);
+        testClawbackPreflight(features);
+        testClawbackPreclaim(features);
+        testClawbackProof(features);
+        testClawbackWithAuditor(features);
+        testClawbackInvalidProofContextBinding(features);
+
+        testDelete(features);
+
+        // ConfidentialMPTConvertBack
+        testConvertBack(features);
+        testConvertBackPreflight(features);
+        testConvertBackPreclaim(features);
+        testConvertBackWithAuditor(features);
+        testConvertBackPedersenProof(features);
+        testConvertBackBulletproof(features);
+
+        // Homomorphic operation tests
+        testSendHomomorphicOverflow(features);
+        testConvertBackHomomorphicCiphertextModification(features);
+        testConvertBackHomomorphicUnderflow(features);
+
+        // Invalid curve points
+        testSendInvalidCurvePoints(features);
+        testSendWrongGroupPointInjection(features);
+        testConvertIdentityElementRejection(features);
+        testSendWrongIssuerPublicKey(features);
+
+        // public and private txns
+        testPublicTransfersAfterClearingConfidentialFlag(features);
+
+        // Replay tests
+        testMutatePrivacy(features);
+        testConvertBackInvalidProofContextBinding(features);
+        testConvertBackProofCiphertextBinding(features);
+        testConvertBackProofVersionMismatch(features);
+
+        // Crafted-proof Tests
+        testSendSharedRandomnessViolation(features);
+
+        // Transaction Fee Tests
+        testConfidentialMPTBaseFee(features);
+
+        // TransferFee (transfer rate) Tests
+        testTransferFee(features);
+
+        // Zero knowledge proof tests
+        testSendInvalidProofContextBinding(features);
+        testSendForgedEqualityProof(features);
+        testSendForgedRangeProof(features);
+        testSendNegativeValueMalleability(features);
+        testSendFiatShamirBinding(features);
+        testSendProofComponentReuse(features);
+        testSendSpecialWitnessValues(features);
+        testSendCrossStatementProofSubstitution(features);
+
+        // Ciphertext malleability tests
+        testSendCiphertextMalleability(features);
+        testSendCiphertextNegation(features);
+        testSendCiphertextCombination(features);
+        testSendCiphertextRerandomization(features);
+        testSendZeroRandomnessCiphertext(features);
+        testSendRerandomizesRecipientInboxAgainstMergeCancellation(features);
+    }
+
+public:
+    void
+    run() override
+    {
+        using namespace test::jtx;
+        FeatureBitset const all{testableAmendments()};
+
+        testWithFeats(all);
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(ConfidentialTransfer, app, xrpl);
+
+}  // namespace xrpl
diff --git a/src/test/app/Delegate_test.cpp b/src/test/app/Delegate_test.cpp
index f68f813853..02ee0750d5 100644
--- a/src/test/app/Delegate_test.cpp
+++ b/src/test/app/Delegate_test.cpp
@@ -2747,7 +2747,9 @@ class Delegate_test : public beast::unit_test::Suite
         // DO NOT modify expectedDelegableCount unless all scenarios, including
         // edge cases, have been fully tested and verified.
         // ====================================================================
-        std::size_t const expectedDelegableCount = 51;
+        // Includes the five confidential MPT transaction types, which are
+        // explicitly marked Delegable in transactions.macro.
+        std::size_t const expectedDelegableCount = 56;
 
         BEAST_EXPECTS(
             delegableCount == expectedDelegableCount,
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 6aa17c7840..9fde52ecb2 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -5176,6 +5176,254 @@ class Invariants_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testConfidentialMPTTransfer()
+    {
+        using namespace test::jtx;
+        testcase << "ValidConfidentialMPToken";
+
+        MPTID mptID;
+
+        // Generate an MPT with privacy, issue 100 tokens to A2.
+        // Perform a confidential conversion to populate encrypted state.
+        auto const precloseConfidential =
+            [&mptID](Account const& a1, Account const& a2, Env& env) -> bool {
+            MPTTester mpt(env, a1, {.holders = {a2}, .fund = false});
+            mpt.create({.flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance});
+            mptID = mpt.issuanceID();
+
+            mpt.authorize({.account = a2});
+            mpt.pay(a1, a2, 100);
+
+            mpt.generateKeyPair(a1);
+            mpt.set({.account = a1, .issuerPubKey = mpt.getPubKey(a1)});
+
+            mpt.generateKeyPair(a2);
+            mpt.convert({
+                .account = a2,
+                .amt = 100,
+                .holderPubKey = mpt.getPubKey(a2),
+            });
+            return true;
+        };
+
+        // badDelete
+        doInvariantCheck(
+            {"MPToken deleted with encrypted fields while COA > 0"},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleToken = ac.view().peek(keylet::mptoken(mptID, a2.id()));
+                if (!sleToken)
+                    return false;
+                // Force an erase of the object while the COA remains 100
+                ac.view().erase(sleToken);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttMPTOKEN_AUTHORIZE, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+            precloseConfidential);
+
+        // badConsistency
+        doInvariantCheck(
+            {"MPToken encrypted field existence inconsistency"},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleToken = ac.view().peek(keylet::mptoken(mptID, a2.id()));
+                if (!sleToken)
+                    return false;
+                // Remove one of the required encrypted fields to create a mismatch
+                sleToken->makeFieldAbsent(sfIssuerEncryptedBalance);
+                ac.view().update(sleToken);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttMPTOKEN_AUTHORIZE, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            precloseConfidential);
+
+        doInvariantCheck(
+            {"MPToken encrypted field existence inconsistency"},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleToken = ac.view().peek(keylet::mptoken(mptID, a2.id()));
+                if (!sleToken)
+                    return false;
+                sleToken->makeFieldAbsent(sfIssuerEncryptedBalance);
+                sleToken->makeFieldAbsent(sfConfidentialBalanceInbox);
+                sleToken->makeFieldAbsent(sfConfidentialBalanceSpending);
+                sleToken->setFieldVL(sfAuditorEncryptedBalance, Blob{0x00});
+                ac.view().update(sleToken);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttMPTOKEN_AUTHORIZE, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            precloseConfidential);
+
+        // requiresPrivacyFlag
+        auto const precloseNoPrivacy = [&mptID](
+                                           Account const& a1, Account const& a2, Env& env) -> bool {
+            MPTTester mpt(env, a1, {.holders = {a2}, .fund = false});
+            // completely omitted the tfMPTCanHoldConfidentialBalance flag here.
+            mpt.create({.flags = tfMPTCanTransfer});
+            mptID = mpt.issuanceID();
+            mpt.authorize({.account = a2});
+            mpt.pay(a1, a2, 100);
+            return true;
+        };
+
+        doInvariantCheck(
+            {"MPToken has encrypted fields but Issuance does not have "
+             "lsfMPTCanHoldConfidentialBalance "
+             "set"},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleToken = ac.view().peek(keylet::mptoken(mptID, a2.id()));
+                if (!sleToken)
+                    return false;
+                // Inject all three encrypted fields consistently (inbox+spending+issuer must be
+                // in sync or badConsistency fires first and masks requiresPrivacyFlag).
+                sleToken->setFieldVL(sfConfidentialBalanceInbox, Blob{0x00});
+                sleToken->setFieldVL(sfConfidentialBalanceSpending, Blob{0x00});
+                sleToken->setFieldVL(sfIssuerEncryptedBalance, Blob{0x00});
+                ac.view().update(sleToken);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttMPTOKEN_AUTHORIZE, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            precloseNoPrivacy);
+
+        // badCOA
+        doInvariantCheck(
+            {"Confidential outstanding amount exceeds total outstanding amount"},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleIssuance = ac.view().peek(keylet::mptokenIssuance(mptID));
+                if (!sleIssuance)
+                    return false;
+                // Total outstanding is natively 100; bloat the COA over 100
+                sleIssuance->setFieldU64(sfConfidentialOutstandingAmount, 200);
+                ac.view().update(sleIssuance);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttMPTOKEN_ISSUANCE_SET, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            precloseConfidential);
+
+        // Conservation Violation
+        doInvariantCheck(
+            {"Token conservation violation for MPT"},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleIssuance = ac.view().peek(keylet::mptokenIssuance(mptID));
+                if (!sleIssuance)
+                    return false;
+
+                sleIssuance->setFieldU64(
+                    sfConfidentialOutstandingAmount,
+                    sleIssuance->getFieldU64(sfConfidentialOutstandingAmount) - 10);
+                ac.view().update(sleIssuance);
+
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttMPTOKEN_AUTHORIZE, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            precloseConfidential);
+
+        // Send/MergeInbox must not change OutstandingAmount (coaDelta == 0)
+        doInvariantCheck(
+            {"Invariant failed: OutstandingAmount changed "
+             "by confidential transaction that should not "
+             "modify it for MPT"},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleIssuance = ac.view().peek(keylet::mptokenIssuance(mptID));
+                if (!sleIssuance)
+                    return false;
+                sleIssuance->setFieldU64(
+                    sfOutstandingAmount, sleIssuance->getFieldU64(sfOutstandingAmount) + 1);
+                ac.view().update(sleIssuance);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttCONFIDENTIAL_MPT_SEND, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            precloseConfidential);
+
+        // Send/MergeInbox and zero-COA-delta confidential transactions must not
+        // change public holder MPTAmount.
+        doInvariantCheck(
+            {"Invariant failed: MPTAmount changed by confidential "
+             "transaction that should not modify this field."},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleToken = ac.view().peek(keylet::mptoken(mptID, a2.id()));
+                if (!sleToken)
+                    return false;
+                sleToken->setFieldU64(sfMPTAmount, sleToken->getFieldU64(sfMPTAmount) + 1);
+                ac.view().update(sleToken);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttCONFIDENTIAL_MPT_SEND, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            precloseConfidential);
+
+        // badVersion
+        doInvariantCheck(
+            {"MPToken sfConfidentialBalanceVersion not updated when sfConfidentialBalanceSpending "
+             "changed"},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                Blob const kChangedConfidentialSpending = {0xBA, 0xDD};
+                auto sleToken = ac.view().peek(keylet::mptoken(mptID, a2.id()));
+                if (!sleToken)
+                    return false;
+                sleToken->setFieldVL(sfConfidentialBalanceSpending, kChangedConfidentialSpending);
+
+                // DO NOT update sfConfidentialBalanceVersion
+                ac.view().update(sleToken);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttMPTOKEN_AUTHORIZE, [](STObject&) {}},
+            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            precloseConfidential);
+
+        // Skipping Deleted MPTs (Issuance deleted)
+        auto const precloseOrphan = [&mptID](
+                                        Account const& a1, Account const& a2, Env& env) -> bool {
+            MPTTester mpt(env, a1, {.holders = {a2}, .fund = false});
+            mpt.create({.flags = tfMPTCanTransfer | tfMPTCanHoldConfidentialBalance});
+            mptID = mpt.issuanceID();
+            mpt.authorize({.account = a2});
+
+            // Generate privacy keys and convert 0 amount so Bob has the encrypted fields
+            mpt.generateKeyPair(a1);
+            mpt.set({.account = a1, .issuerPubKey = mpt.getPubKey(a1)});
+            mpt.generateKeyPair(a2);
+            mpt.convert({
+                .account = a2,
+                .amt = 0,
+                .holderPubKey = mpt.getPubKey(a2),
+            });
+
+            // Immediately destroy the issuance. A2's empty, encrypted token object lives on.
+            mpt.destroy();
+            return true;
+        };
+
+        doInvariantCheck(
+            {},
+            [&mptID](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto sleToken = ac.view().peek(keylet::mptoken(mptID, a2.id()));
+                if (!sleToken)
+                    return false;
+                // Safely able to erase the deleted token.
+                ac.view().erase(sleToken);
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttMPTOKEN_AUTHORIZE, [](STObject&) {}},
+            {tesSUCCESS, tesSUCCESS},
+            precloseOrphan);
+    }
+
 public:
     void
     run() override
@@ -5204,6 +5452,7 @@ public:
         testValidPseudoAccounts();
         testValidLoanBroker();
         testVault();
+        testConfidentialMPTTransfer();
         testMPT();
         testInvariantOverwrite(defaultAmendments());
         testInvariantOverwrite(defaultAmendments() - fixCleanup3_1_3);
diff --git a/src/test/app/MPToken_test.cpp b/src/test/app/MPToken_test.cpp
index 323184aa36..15e17b4536 100644
--- a/src/test/app/MPToken_test.cpp
+++ b/src/test/app/MPToken_test.cpp
@@ -617,7 +617,8 @@ class MPToken_test : public beast::unit_test::Suite
             // (2)
             mptAlice.set({.account = alice, .flags = 0x00000008, .err = temINVALID_FLAG});
 
-            if (!features[featureSingleAssetVault] && !features[featureDynamicMPT])
+            if (!features[featureSingleAssetVault] && !features[featureDynamicMPT] &&
+                !features[featureConfidentialTransfer])
             {
                 // test invalid flags - nothing is being changed
                 mptAlice.set({.account = alice, .flags = 0x00000000, .err = tecNO_PERMISSION});
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index 6fefcfc404..dd28c7ec6e 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -39,6 +39,7 @@
 #include <xrpl/ledger/OpenView.h>
 #include <xrpl/ledger/Sandbox.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Feature.h>
@@ -5902,6 +5903,46 @@ class Vault_test : public beast::unit_test::Suite
         runTest(amendments);
     }
 
+    void
+    testRemoveEmptyHoldingConfidentialBalances()
+    {
+        testcase("removeEmptyHolding keeps MPToken with confidential balances");
+        using namespace test::jtx;
+
+        Env env{*this, testableAmendments()};
+
+        Account const issuer{"issuer"};
+        Account const holder{"holder"};
+        MPTTester mpt{env, issuer, {.holders = {holder}}};
+        mpt.create({.authorize = MPTCreate::allHolders});
+
+        auto const tokenKeylet = keylet::mptoken(mpt.issuanceID(), holder.id());
+        auto const encryptedBalanceFields = {
+            &sfConfidentialBalanceInbox,
+            &sfConfidentialBalanceSpending,
+            &sfIssuerEncryptedBalance,
+            &sfAuditorEncryptedBalance};
+
+        env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal j) {
+            for (auto const field : encryptedBalanceFields)
+            {
+                Sandbox sb(&view, TapNone);
+                auto const token = sb.peek(tokenKeylet);
+                if (!BEAST_EXPECT(token))
+                    return false;
+
+                token->setFieldVL(*field, gMakeZeroBuffer(kEcGamalEncryptedTotalLength));
+                sb.update(token);
+
+                BEAST_EXPECT(
+                    removeEmptyHolding(sb, holder.id(), MPTIssue(mpt.issuanceID()), j) ==
+                    tecHAS_OBLIGATIONS);
+                BEAST_EXPECT(sb.peek(tokenKeylet) != nullptr);
+            }
+            return true;
+        });
+    }
+
     // -----------------------------------------------------------------------
     // Helpers and tests: sole-shareholder / stuck-depositor (XLS-0065 +
     // fixCleanup3_2_0). The vault-level withdraw behavior is tested here;
@@ -8073,6 +8114,7 @@ public:
         testAssetsMaximum();
         testBug6LimitBypassWithShares();
         testRemoveEmptyHoldingLockedAmount();
+        testRemoveEmptyHoldingConfidentialBalances();
 
         testWithdrawSoleShareholderFixedAssetExit(all_ - fixCleanup3_2_0);
         testWithdrawSoleShareholderFixedAssetExit(all_);
diff --git a/src/test/jtx/ConfidentialTransfer.h b/src/test/jtx/ConfidentialTransfer.h
new file mode 100644
index 0000000000..b758683da6
--- /dev/null
+++ b/src/test/jtx/ConfidentialTransfer.h
@@ -0,0 +1,496 @@
+#pragma once
+
+#include <test/jtx/AMM.h>
+#include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
+#include <test/jtx/TestHelpers.h>
+#include <test/jtx/amount.h>
+#include <test/jtx/batch.h>
+#include <test/jtx/credentials.h>
+#include <test/jtx/delegate.h>
+#include <test/jtx/deposit.h>
+#include <test/jtx/flags.h>
+#include <test/jtx/mpt.h>
+#include <test/jtx/pay.h>
+#include <test/jtx/ter.h>
+#include <test/jtx/ticket.h>
+#include <test/jtx/vault.h>
+
+#include <xrpl/basics/Buffer.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/basics/strHex.h>
+#include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/jss.h>
+
+#include <utility/mpt_utility.h>
+
+#include <secp256k1.h>
+#include <secp256k1_mpt.h>
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <functional>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace xrpl {
+
+class ConfidentialTransferTestBase : public beast::unit_test::Suite
+{
+protected:
+    template <class T>
+    static T
+    requireOptional(std::optional<T> value, char const* message)
+    {
+        if (!value)
+            Throw<std::runtime_error>(message);
+        return std::move(*value);
+    }
+
+    template <class T>
+    static T const&
+    requireOptionalRef(std::optional<T> const& value, char const* message)
+    {
+        if (!value)
+            Throw<std::runtime_error>(message);
+        return *value;
+    }
+
+    // Offset where the bulletproof begins in a send proof blob.
+    // Proof layout: [compact_sigma | bulletproof]
+    static constexpr size_t kBulletproofOffset = kEcSendProofLength - kEcDoubleBulletproofLength;
+
+    // Generate a forged aggregated bulletproof (double bulletproof) for
+    // the given values and blinding factors. Used to test that splicing
+    // a bulletproof claiming a different remaining balance is rejected.
+    // secp256k1 convention: returns 1 on success, 0 on failure.
+    static Buffer
+    getForgedBulletproof(
+        std::array<uint64_t, 2> const& values,
+        std::array<Buffer, 2> const& blindingFactors,
+        uint256 const& contextHash)
+    {
+        auto* const ctx = mpt_secp256k1_context();
+
+        secp256k1_pubkey h;
+        secp256k1_mpt_get_h_generator(ctx, &h);
+
+        Buffer proof(kEcDoubleBulletproofLength);
+        size_t proofLen = kEcDoubleBulletproofLength;
+
+        unsigned char blindings[64];
+        std::memcpy(blindings, blindingFactors[0].data(), 32);
+        std::memcpy(blindings + 32, blindingFactors[1].data(), 32);
+
+        if (secp256k1_bulletproof_prove_agg(
+                ctx,
+                proof.data(),
+                &proofLen,
+                values.data(),
+                blindings,
+                2,
+                &h,
+                contextHash.data()) == 0)
+            Throw<std::runtime_error>("Failed to generate forged bulletproof");
+
+        return proof;
+    }
+
+    // Get a bad ciphertext with valid structure but cryptographic invalid for
+    // testing purposes. For preflight test purposes.
+    static Buffer const&
+    getBadCiphertext()
+    {
+        static Buffer const kBadCiphertext = []() {
+            Buffer buf(kEcGamalEncryptedTotalLength);
+            std::memset(buf.data(), 0xFF, kEcGamalEncryptedTotalLength);
+
+            buf.data()[0] = kEcCompressedPrefixEvenY;
+            buf.data()[kEcCiphertextComponentLength] = kEcCompressedPrefixEvenY;
+            return buf;
+        }();
+
+        return kBadCiphertext;
+    }
+
+    // Get a trivial buffer that is structurally and mathematically valid, but
+    // contains invalid data that does not match the ledger state. For preclaim
+    // test purposes.
+    static Buffer const&
+    getTrivialCiphertext()
+    {
+        static Buffer const kTrivialCiphertext = []() {
+            Buffer buf(kEcGamalEncryptedTotalLength);
+            std::memset(buf.data(), 0, kEcGamalEncryptedTotalLength);
+
+            buf.data()[0] = kEcCompressedPrefixEvenY;
+            buf.data()[kEcCiphertextComponentLength] = kEcCompressedPrefixEvenY;
+
+            buf.data()[kEcCiphertextComponentLength - 1] = 0x01;
+            buf.data()[kEcGamalEncryptedTotalLength - 1] = 0x01;
+
+            return buf;
+        }();
+
+        return kTrivialCiphertext;
+    }
+
+    // Returns a valid compressed EC point (33 bytes) that can pass preflight
+    // validation but contains invalid data for preclaim test purposes.
+    static Buffer const&
+    getTrivialCommitment()
+    {
+        static Buffer const kTrivialCommitment = []() {
+            Buffer buf(kEcPedersenCommitmentLength);
+            std::memset(buf.data(), 0, kEcPedersenCommitmentLength);
+
+            buf.data()[0] = kEcCompressedPrefixEvenY;
+            // Set last byte to make it a valid x-coordinate on the curve
+            buf.data()[kEcPedersenCommitmentLength - 1] = 0x01;
+
+            return buf;
+        }();
+
+        return kTrivialCommitment;
+    }
+
+    static std::string
+    getTrivialSendProofHex()
+    {
+        Buffer buf(kEcSendProofLength);
+        std::memset(buf.data(), 0, kEcSendProofLength);
+
+        for (std::size_t i = 0; i < kEcSendProofLength; i += kEcCiphertextComponentLength)
+        {
+            buf.data()[i] = kEcCompressedPrefixEvenY;
+            if (i + kEcCiphertextComponentLength - 1 < kEcSendProofLength)
+                buf.data()[i + kEcCiphertextComponentLength - 1] = 0x01;
+        }
+
+        return strHex(buf);
+    }
+
+    // Helper struct to encapsulate common setup for integration tests.
+    struct ConfidentialSendSetup
+    {
+        // Constants
+        uint64_t sendAmount;
+        size_t nRecipients;
+        uint32_t version;
+
+        // Blinding factors
+        Buffer blindingFactor;
+        Buffer amountBlindingFactor;
+        Buffer balanceBlindingFactor;
+
+        // Encrypted amounts
+        Buffer senderAmt;
+        Buffer destAmt;
+        Buffer issuerAmt;
+        std::optional<Buffer> auditorAmt;
+
+        // Commitments
+        Buffer amountCommitment;
+
+        // Long-lived pub key buffers (to avoid dangling Slice)
+        Buffer senderPubKey;
+        Buffer destPubKey;
+        Buffer issuerPubKey;
+        std::optional<Buffer> auditorPubKey;
+
+        // Balance data
+        uint64_t prevSpending;
+        Buffer prevEncryptedSpending;
+
+        // Balance commitment (declared after prevSpending for init order)
+        Buffer balanceCommitment;
+
+        // Recipients vector
+        std::vector<ConfidentialRecipient> recipients;
+
+        // Constructor that performs all common setup
+        ConfidentialSendSetup(
+            test::jtx::MPTTester& mpt,
+            test::jtx::Account const& sender,
+            test::jtx::Account const& dest,
+            test::jtx::Account const& issuer,
+            uint64_t amount,
+            std::optional<std::reference_wrapper<test::jtx::Account const>> auditor = std::nullopt)
+            : sendAmount(amount)
+            , nRecipients(auditor ? 4 : 3)
+            , version(mpt.getMPTokenVersion(sender))
+            , blindingFactor(generateBlindingFactor())
+            , amountBlindingFactor(blindingFactor)
+            , balanceBlindingFactor(generateBlindingFactor())
+            , senderAmt(mpt.encryptAmount(sender, amount, blindingFactor))
+            , destAmt(mpt.encryptAmount(dest, amount, blindingFactor))
+            , issuerAmt(mpt.encryptAmount(issuer, amount, blindingFactor))
+            , auditorAmt(
+                  auditor ? std::optional<Buffer>(
+                                mpt.encryptAmount(auditor->get(), amount, blindingFactor))
+                          : std::nullopt)
+            , amountCommitment(mpt.getPedersenCommitment(amount, amountBlindingFactor))
+            , senderPubKey(requireOptional(mpt.getPubKey(sender), "Missing sender public key"))
+            , destPubKey(requireOptional(mpt.getPubKey(dest), "Missing destination public key"))
+            , issuerPubKey(requireOptional(mpt.getPubKey(issuer), "Missing issuer public key"))
+            , auditorPubKey(auditor ? mpt.getPubKey(auditor->get()) : std::nullopt)
+            , prevSpending(requireOptional(
+                  mpt.getDecryptedBalance(sender, test::jtx::MPTTester::holderEncryptedSpending),
+                  "Missing sender spending balance"))
+            , prevEncryptedSpending(requireOptional(
+                  mpt.getEncryptedBalance(sender, test::jtx::MPTTester::holderEncryptedSpending),
+                  "Missing sender encrypted spending balance"))
+            , balanceCommitment(mpt.getPedersenCommitment(prevSpending, balanceBlindingFactor))
+        {
+            recipients.push_back({
+                .publicKey = Slice(senderPubKey),
+                .encryptedAmount = senderAmt,
+            });
+            recipients.push_back({
+                .publicKey = Slice(destPubKey),
+                .encryptedAmount = destAmt,
+            });
+            recipients.push_back({
+                .publicKey = Slice(issuerPubKey),
+                .encryptedAmount = issuerAmt,
+            });
+            if (auditor)
+            {
+                recipients.push_back({
+                    .publicKey =
+                        Slice(requireOptionalRef(auditorPubKey, "Missing auditor public key")),
+                    .encryptedAmount =
+                        requireOptionalRef(auditorAmt, "Missing auditor encrypted amount"),
+                });
+            }
+        }
+
+        // Generate proof with current account sequence
+        std::optional<Buffer>
+        generateProof(
+            test::jtx::MPTTester& mpt,
+            test::jtx::Env& env,
+            test::jtx::Account const& sender,
+            test::jtx::Account const& dest) const
+        {
+            auto const ctxHash = getSendContextHash(
+                sender.id(), mpt.issuanceID(), env.seq(sender), dest.id(), version);
+
+            return mpt.getConfidentialSendProof(
+                sender,
+                sendAmount,
+                recipients,
+                blindingFactor,
+                ctxHash,
+                {
+                    .pedersenCommitment = amountCommitment,
+                    .amt = sendAmount,
+                    .encryptedAmt = senderAmt,
+                    .blindingFactor = amountBlindingFactor,
+                },
+                {
+                    .pedersenCommitment = balanceCommitment,
+                    .amt = prevSpending,
+                    .encryptedAmt = prevEncryptedSpending,
+                    .blindingFactor = balanceBlindingFactor,
+                });
+        }
+
+        [[nodiscard]] test::jtx::MPTConfidentialSend
+        sendArgs(
+            test::jtx::Account const& sender,
+            test::jtx::Account const& dest,
+            Buffer const& proof,
+            std::optional<TER> err = std::nullopt) const
+        {
+            return {
+                .account = sender,
+                .dest = dest,
+                .amt = sendAmount,
+                .proof = strHex(proof),
+                .senderEncryptedAmt = senderAmt,
+                .destEncryptedAmt = destAmt,
+                .issuerEncryptedAmt = issuerAmt,
+                .auditorEncryptedAmt = auditorAmt,
+                .amountCommitment = amountCommitment,
+                .balanceCommitment = balanceCommitment,
+                .err = err,
+            };
+        }
+    };
+
+    // Helper that wraps the boilerplate setup: Env + MPT creation, funding, key
+    // generation, and seeding each holder with a confidential balance.
+    // The caller supplies the issuer and any number of holders.
+    struct ConfidentialEnv
+    {
+        // Per-holder configuration: the account, how much MPT to fund it
+        // with, and how much of that to convert to a confidential balance.
+        struct HolderInit
+        {
+            test::jtx::Account account;
+            std::uint64_t payAmount = 1000;
+            std::uint64_t convertAmount = 100;
+        };
+
+        test::jtx::MPTTester mpt;
+
+        ConfidentialEnv(
+            test::jtx::Env& env,
+            test::jtx::Account const& issuer,
+            std::vector<HolderInit> const& holders,
+            std::uint32_t flags = tfMPTCanLock | tfMPTCanHoldConfidentialBalance | tfMPTCanTransfer,
+            std::optional<test::jtx::Account> auditor = std::nullopt)
+            : mpt{env, issuer, {.holders = extractAccounts(holders), .auditor = auditor}}
+        {
+            mpt.create({.ownerCount = 1, .flags = flags});
+
+            for (auto const& h : holders)
+            {
+                mpt.authorize({.account = h.account});
+                if ((flags & tfMPTRequireAuth) != 0)
+                    mpt.authorize({.account = issuer, .holder = h.account});
+                mpt.pay(issuer, h.account, h.payAmount);
+            }
+
+            mpt.generateKeyPair(issuer);
+            for (auto const& h : holders)
+                mpt.generateKeyPair(h.account);
+            if (auditor)
+                mpt.generateKeyPair(requireOptionalRef(auditor, "Missing auditor"));
+
+            mpt.set({
+                .account = issuer,
+                .issuerPubKey = mpt.getPubKey(issuer),
+                .auditorPubKey = auditor
+                    ? mpt.getPubKey(requireOptionalRef(auditor, "Missing auditor"))
+                    : std::optional<Buffer>{},
+            });
+
+            for (auto const& h : holders)
+            {
+                mpt.convert({
+                    .account = h.account,
+                    .amt = h.convertAmount,
+                    .holderPubKey = mpt.getPubKey(h.account),
+                });
+                mpt.mergeInbox({.account = h.account});
+            }
+        }
+
+    private:
+        static std::vector<test::jtx::Account>
+        extractAccounts(std::vector<HolderInit> const& holders)
+        {
+            std::vector<test::jtx::Account> accounts;
+            accounts.reserve(holders.size());
+            for (auto const& h : holders)
+                accounts.push_back(h.account);
+            return accounts;
+        }
+    };
+
+    // Set up an MPT environment suitable for batch testing.
+    // alice is issuer; bob has 'bobAmt' in confidential spending; carol has
+    // 'carolAmt' in confidential spending; dave is initialised with pubkey but
+    // zero spending/inbox.
+    static void
+    setupBatchEnv(
+        test::jtx::MPTTester& mpt,
+        test::jtx::Account const& alice,
+        test::jtx::Account const& bob,
+        test::jtx::Account const& carol,
+        test::jtx::Account const& dave,
+        std::uint64_t bobAmt,
+        std::uint64_t carolAmt)
+    {
+        using namespace test::jtx;
+        mpt.create({
+            .ownerCount = 1,
+            .flags = tfMPTCanTransfer | tfMPTCanLock | tfMPTCanHoldConfidentialBalance,
+        });
+        mpt.authorize({.account = bob});
+        mpt.authorize({.account = carol});
+        mpt.authorize({.account = dave});
+
+        if (bobAmt > 0)
+            mpt.pay(alice, bob, bobAmt);
+        if (carolAmt > 0)
+            mpt.pay(alice, carol, carolAmt);
+
+        mpt.generateKeyPair(alice);
+        mpt.generateKeyPair(bob);
+        mpt.generateKeyPair(carol);
+        mpt.generateKeyPair(dave);
+
+        mpt.set({
+            .account = alice,
+            .issuerPubKey = mpt.getPubKey(alice),
+        });
+
+        if (bobAmt > 0)
+        {
+            mpt.convert({
+                .account = bob,
+                .amt = bobAmt,
+                .holderPubKey = mpt.getPubKey(bob),
+            });
+            mpt.mergeInbox({.account = bob});
+        }
+        else
+        {
+            mpt.convert({
+                .account = bob,
+                .amt = 0,
+                .holderPubKey = mpt.getPubKey(bob),
+            });
+        }
+
+        if (carolAmt > 0)
+        {
+            mpt.convert({
+                .account = carol,
+                .amt = carolAmt,
+                .holderPubKey = mpt.getPubKey(carol),
+            });
+            mpt.mergeInbox({.account = carol});
+        }
+        else
+        {
+            mpt.convert({
+                .account = carol,
+                .amt = 0,
+                .holderPubKey = mpt.getPubKey(carol),
+            });
+        }
+
+        // dave: register pubkey only (0 spending/inbox)
+        mpt.convert({
+            .account = dave,
+            .amt = 0,
+            .holderPubKey = mpt.getPubKey(dave),
+        });
+    }
+};
+
+}  // namespace xrpl
diff --git a/src/test/jtx/batch.h b/src/test/jtx/batch.h
index a80ce46b9c..0e78d409fa 100644
--- a/src/test/jtx/batch.h
+++ b/src/test/jtx/batch.h
@@ -14,18 +14,46 @@
 #include <optional>
 #include <utility>
 
-/** Batch operations */
+/** @brief Helpers for constructing Batch test transactions. */
 namespace xrpl::test::jtx::batch {
 
-/** Calculate Batch Fee. */
+/**
+ * @brief Calculate the expected outer Batch transaction fee.
+ *
+ * @param env The test environment providing ledger fee settings.
+ * @param numSigners Number of outer transaction signers.
+ * @param txns Number of inner transactions in the batch.
+ * @return The expected Batch fee.
+ */
 XRPAmount
 calcBatchFee(jtx::Env const& env, uint32_t const& numSigners, uint32_t const& txns = 0);
 
-/** Batch. */
+/**
+ * @brief Calculate the expected Batch fee when inner transactions are
+ * confidential MPT transactions.
+ *
+ * @param env The test environment providing ledger fee settings.
+ * @param numSigners Number of outer transaction signers.
+ * @param txns Number of confidential MPT inner transactions in the batch.
+ * @return The expected Batch fee including confidential transaction fee
+ *         multipliers.
+ */
+XRPAmount
+calcConfidentialBatchFee(jtx::Env const& env, uint32_t const& numSigners, uint32_t const& txns = 0);
+
+/**
+ * @brief Build an outer Batch transaction JSON object.
+ *
+ * @param account The account submitting the outer Batch transaction.
+ * @param seq The sequence number for the outer Batch transaction.
+ * @param fee The fee to set on the outer Batch transaction.
+ * @param flags The transaction flags to set.
+ * @return The outer Batch transaction JSON object.
+ */
 json::Value
 outer(jtx::Account const& account, uint32_t seq, STAmount const& fee, std::uint32_t flags);
 
-/** Adds a new Batch Txn on a JTx and autofills. */
+/** @brief Adds an inner Batch transaction to a JTx and autofills it. */
 class Inner
 {
 private:
@@ -75,7 +103,7 @@ public:
     }
 };
 
-/** Set a batch signature on a JTx. */
+/** @brief Sets the Batch transaction signers on a JTx. */
 class Sig
 {
 public:
@@ -98,7 +126,7 @@ public:
     operator()(Env&, JTx& jt) const;
 };
 
-/** Set a batch nested multi-signature on a JTx. */
+/** @brief Sets a nested multi-signature for a Batch transaction on a JTx. */
 class Msig
 {
 public:
diff --git a/src/test/jtx/impl/batch.cpp b/src/test/jtx/impl/batch.cpp
index 2f7a67b45a..66ca0c7d54 100644
--- a/src/test/jtx/impl/batch.cpp
+++ b/src/test/jtx/impl/batch.cpp
@@ -11,6 +11,7 @@
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/to_string.h>
 #include <xrpl/protocol/Batch.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
@@ -37,6 +38,16 @@ calcBatchFee(test::jtx::Env const& env, uint32_t const& numSigners, uint32_t con
     return ((numSigners + 2) * feeDrops) + feeDrops * txns;
 }
 
+XRPAmount
+calcConfidentialBatchFee(
+    test::jtx::Env const& env,
+    uint32_t const& numSigners,
+    uint32_t const& txns)
+{
+    XRPAmount const feeDrops = env.current()->fees().base;
+    return ((numSigners + 2) * feeDrops) + feeDrops * (kConfidentialFeeMultiplier + 1) * txns;
+}
+
 // Batch.
 json::Value
 outer(jtx::Account const& account, uint32_t seq, STAmount const& fee, std::uint32_t flags)
diff --git a/src/test/jtx/impl/mpt.cpp b/src/test/jtx/impl/mpt.cpp
index 84c5b5fbec..dddfc88c7f 100644
--- a/src/test/jtx/impl/mpt.cpp
+++ b/src/test/jtx/impl/mpt.cpp
@@ -10,6 +10,8 @@
 #include <test/jtx/ter.h>
 #include <test/jtx/trust.h>
 
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/StringUtilities.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/strHex.h>
@@ -18,8 +20,10 @@
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/TER.h>
@@ -27,9 +31,17 @@
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/jss.h>
 
+#include <utility/mpt_utility.h>
+
+#include <mpt_protocol.h>
+#include <secp256k1.h>
+#include <secp256k1_mpt.h>
+
 #include <algorithm>
 #include <array>
+#include <cstddef>
 #include <cstdint>
+#include <cstring>
 #include <functional>
 #include <optional>
 #include <stdexcept>
@@ -40,6 +52,47 @@
 #include <vector>
 
 namespace xrpl::test::jtx {
+namespace {
+
+constexpr std::uint64_t kElGamalDecryptRangeLow = 0;
+constexpr std::uint64_t kElGamalDecryptRangeHigh = 3000;
+
+/**
+ * @brief Returns a reference to the value held by an optional, throwing if it
+ *        is not an optional.
+ *
+ * @param opt The optional to unwrap.
+ * @param what Description used in the thrown exception if opt is empty.
+ * @return A const reference to the contained value.
+ */
+template <class T>
+[[nodiscard]] T const&
+requireValue(std::optional<T> const& opt, char const* what)
+{
+    if (!opt)
+        Throw<std::logic_error>(what);
+    return *opt;
+}
+
+/**
+ * @brief Helper function to convert a PedersenProofParams into the C library struct.
+ *
+ * @param params The Pedersen commitment proof parameters.
+ * @return The equivalent mpt_pedersen_proof_params for use with the C library.
+ */
+mpt_pedersen_proof_params
+makePedersenParams(PedersenProofParams const& params)
+{
+    mpt_pedersen_proof_params res{};
+    std::memcpy(
+        res.pedersen_commitment, params.pedersenCommitment.data(), kMPT_PEDERSEN_COMMIT_SIZE);
+    res.amount = params.amt;
+    std::memcpy(res.ciphertext, params.encryptedAmt.data(), kMPT_ELGAMAL_TOTAL_SIZE);
+    std::memcpy(res.blinding_factor, params.blindingFactor.data(), kMPT_BLINDING_FACTOR_SIZE);
+    return res;
+}
+
+}  // namespace
 
 struct MPTSetFlagMapping
 {
@@ -88,13 +141,20 @@ MPTTester::makeHolders(std::vector<Account> const& holders)
 }
 
 MPTTester::MPTTester(Env& env, Account issuer, MPTInit const& arg)
-    : env_(env), issuer_(std::move(issuer)), holders_(makeHolders(arg.holders)), close_(arg.close)
+    : env_(env)
+    , issuer_(std::move(issuer))
+    , holders_(makeHolders(arg.holders))
+    , auditor_(arg.auditor)
+    , close_(arg.close)
 {
     if (arg.fund)
     {
         env_.fund(arg.xrp, issuer_);
         for (auto const& it : holders_)
             env_.fund(arg.xrpHolders, it.second);
+
+        if (arg.auditor)
+            env_.fund(arg.xrp, *arg.auditor);
     }
     if (close_)
         env.close();
@@ -107,6 +167,9 @@ MPTTester::MPTTester(Env& env, Account issuer, MPTInit const& arg)
                 Throw<std::runtime_error>("Issuer can't be holder");
             env_.require(Owners(it.second, 0));
         }
+
+        if (arg.auditor)
+            env_.require(Owners(*arg.auditor, 0));
     }
     if (arg.create)
         create(*arg.create);
@@ -148,7 +211,12 @@ MPTTester::MPTTester(MPTInitDef const& arg)
     : MPTTester{
           arg.env,
           arg.issuer,
-          MPTInit{.fund = arg.fund, .close = arg.close, .create = makeMPTCreate(arg)}}
+          MPTInit{
+              .auditor = arg.auditor,
+              .fund = arg.fund,
+              .close = arg.close,
+              .create = makeMPTCreate(arg),
+          }}
 {
 }
 
@@ -401,6 +469,10 @@ MPTTester::setJV(MPTSet const& arg)
         jv[sfTransferFee] = *arg.transferFee;
     if (arg.metadata)
         jv[sfMPTokenMetadata] = strHex(*arg.metadata);
+    if (arg.issuerPubKey)
+        jv[sfIssuerEncryptionKey] = strHex(*arg.issuerPubKey);
+    if (arg.auditorPubKey)
+        jv[sfAuditorEncryptionKey] = strHex(*arg.auditorPubKey);
     jv[sfTransactionType] = jss::MPTokenIssuanceSet;
 
     return jv;
@@ -419,42 +491,92 @@ MPTTester::set(MPTSet const& arg)
          .transferFee = arg.transferFee,
          .metadata = arg.metadata,
          .delegate = arg.delegate,
-         .domainID = arg.domainID});
+         .domainID = arg.domainID,
+         .issuerPubKey = arg.issuerPubKey,
+         .auditorPubKey = arg.auditorPubKey});
     if (submit(arg, jv) == tesSUCCESS && ((arg.flags.value_or(0) != 0u) || arg.mutableFlags))
     {
-        auto require = [&](std::optional<Account> const& holder, bool unchanged) {
-            auto flags = getFlags(holder);
-            if (!unchanged)
-            {
-                if (arg.flags)
+        if (((arg.flags.value_or(0) != 0u) || arg.mutableFlags))
+        {
+            auto require = [&](std::optional<Account> const& holder, bool unchanged) {
+                auto flags = getFlags(holder);
+                if (!unchanged)
                 {
-                    if (*arg.flags & tfMPTLock)
+                    if (arg.flags)
                     {
-                        flags |= lsfMPTLocked;
-                    }
-                    else if (*arg.flags & tfMPTUnlock)
-                    {
-                        flags &= ~lsfMPTLocked;
-                    }
-                }
-
-                if (arg.mutableFlags)
-                {
-                    for (auto const& [setFlag, ledgerFlag] : mptSetFlagMappings)
-                    {
-                        if ((*arg.mutableFlags & setFlag) != 0u)
+                        if (*arg.flags & tfMPTLock)
                         {
-                            flags |= ledgerFlag;
+                            flags |= lsfMPTLocked;
+                        }
+                        else if (*arg.flags & tfMPTUnlock)
+                        {
+                            flags &= ~lsfMPTLocked;
                         }
                     }
+
+                    if (arg.mutableFlags)
+                    {
+                        for (auto const& [setFlag, ledgerFlag] : mptSetFlagMappings)
+                        {
+                            if ((*arg.mutableFlags & setFlag) != 0u)
+                            {
+                                flags |= ledgerFlag;
+                            }
+                        }
+
+                        if (*arg.mutableFlags & tmfMPTSetCanHoldConfidentialBalance)
+                            flags |= tfMPTCanHoldConfidentialBalance;
+                    }
                 }
+                env_.require(MptFlags(*this, flags, holder));
+            };
+            if (arg.account)
+                require(std::nullopt, arg.holder.has_value());
+            if (auto const account = (arg.holder ? std::get_if<Account>(&(*arg.holder)) : nullptr))
+                require(*account, false);
+
+            if (arg.issuerPubKey)
+            {
+                env_.require(RequireAny([&]() -> bool {
+                    return forObject([&](SLEP const& sle) -> bool {
+                        if (sle)
+                        {
+                            auto const issuerPubKey = getPubKey(issuer_);
+                            if (!issuerPubKey)
+                            {
+                                Throw<std::runtime_error>(
+                                    "MPTTester::set: issuer's pubkey is not set");
+                            }
+
+                            return strHex((*sle)[sfIssuerEncryptionKey]) == strHex(*issuerPubKey);
+                        }
+                        return false;
+                    });
+                }));
             }
-            env_.require(MptFlags(*this, flags, holder));
-        };
-        if (arg.account)
-            require(std::nullopt, arg.holder.has_value());
-        if (auto const account = (arg.holder ? std::get_if<Account>(&(*arg.holder)) : nullptr))
-            require(*account, false);
+            if (arg.auditorPubKey)
+            {
+                env_.require(RequireAny([&]() -> bool {
+                    return forObject([&](SLEP const& sle) -> bool {
+                        if (sle)
+                        {
+                            if (!auditor_.has_value())
+                                Throw<std::runtime_error>("MPTTester::set: auditor is not set");
+
+                            auto const auditorPubKey = getPubKey(*auditor_);
+                            if (!auditorPubKey)
+                            {
+                                Throw<std::runtime_error>(
+                                    "MPTTester::set: auditor's pubkey is not set");
+                            }
+
+                            return strHex((*sle)[sfAuditorEncryptionKey]) == strHex(*auditorPubKey);
+                        }
+                        return false;
+                    });
+                }));
+            }
+        }
     }
 }
 
@@ -495,6 +617,14 @@ MPTTester::checkMPTokenOutstandingAmount(std::int64_t expectedAmount) const
         [&](SLEP const& sle) { return expectedAmount == (*sle)[sfOutstandingAmount]; });
 }
 
+[[nodiscard]] bool
+MPTTester::checkIssuanceConfidentialBalance(std::int64_t expectedAmount) const
+{
+    return forObject([&](SLEP const& sle) {
+        return expectedAmount == (*sle)[~sfConfidentialOutstandingAmount].value_or(0);
+    });
+}
+
 [[nodiscard]] bool
 MPTTester::checkFlags(uint32_t const expectedFlags, std::optional<Account> const& holder) const
 {
@@ -641,6 +771,238 @@ MPTTester::getBalance(Account const& account) const
     return 0;
 }
 
+std::int64_t
+MPTTester::getIssuanceConfidentialBalance() const
+{
+    if (!id_)
+        Throw<std::runtime_error>("MPT has not been created");
+
+    if (auto const sle = env_.le(keylet::mptokenIssuance(*id_)))
+        return (*sle)[~sfConfidentialOutstandingAmount].value_or(0);
+
+    return 0;
+}
+
+std::optional<Buffer>
+MPTTester::getClawbackProof(
+    Account const& holder,
+    std::uint64_t amount,
+    Buffer const& privateKey,
+    uint256 const& contextHash) const
+{
+    if (!id_)
+        Throw<std::runtime_error>("MPT has not been created");
+
+    auto const sleHolder = env_.le(keylet::mptoken(*id_, holder.id()));
+    auto const sleIssuance = env_.le(keylet::mptokenIssuance(*id_));
+
+    if (!sleHolder || !sleIssuance)
+        return std::nullopt;
+
+    auto const ciphertextBlob = sleHolder->getFieldVL(sfIssuerEncryptedBalance);
+    if (ciphertextBlob.size() != kEcGamalEncryptedTotalLength)
+        return std::nullopt;
+
+    auto const pubKeyBlob = sleIssuance->getFieldVL(sfIssuerEncryptionKey);
+    if (pubKeyBlob.size() != kEcPubKeyLength)
+        return std::nullopt;
+
+    Buffer proof(kEcClawbackProofLength);
+
+    if (mpt_get_clawback_proof(
+            privateKey.data(),
+            pubKeyBlob.data(),
+            contextHash.data(),
+            amount,
+            ciphertextBlob.data(),
+            proof.data()) != 0)
+    {
+        return std::nullopt;
+    }
+
+    return proof;
+}
+
+std::optional<Buffer>
+MPTTester::getSchnorrProof(Account const& account, uint256 const& ctxHash) const
+{
+    auto const pubKey = getPubKey(account);
+    if (!pubKey || pubKey->size() != kEcPubKeyLength)
+        return std::nullopt;
+
+    auto const privKey = getPrivKey(account);
+    if (requireValue(privKey, "privKey").size() != kEcPrivKeyLength)
+        return std::nullopt;
+
+    Buffer proof(kEcSchnorrProofLength);
+
+    if (mpt_get_convert_proof(
+            requireValue(pubKey, "pubKey").data(),
+            requireValue(privKey, "privKey").data(),
+            ctxHash.data(),
+            proof.data()) != 0)
+        return std::nullopt;
+
+    return proof;
+}
+
+std::optional<Buffer>
+MPTTester::getConfidentialSendProof(
+    Account const& sender,
+    std::uint64_t const amount,
+    std::vector<ConfidentialRecipient> const& recipients,
+    Slice const& blindingFactor,
+    uint256 const& contextHash,
+    PedersenProofParams const& amountParams,
+    PedersenProofParams const& balanceParams) const
+{
+    auto const pedersenBalanceParams = makePedersenParams(balanceParams);
+
+    if (blindingFactor.size() != kEcBlindingFactorLength)
+        return std::nullopt;
+
+    auto const senderPrivKey = getPrivKey(sender);
+    if (!senderPrivKey)
+        return std::nullopt;
+
+    auto const senderPubKey = getPubKey(sender);
+    if (!senderPubKey || senderPubKey->size() != kEcPubKeyLength)
+        return std::nullopt;
+
+    if (amountParams.pedersenCommitment.size() != kEcPedersenCommitmentLength)
+        return std::nullopt;
+
+    // Build mpt_confidential_participant array
+    std::vector<mpt_confidential_participant> participants(recipients.size());
+    for (size_t i = 0; i < recipients.size(); ++i)
+    {
+        auto const& r = recipients[i];
+        if (r.encryptedAmount.size() != kEcGamalEncryptedTotalLength ||
+            r.publicKey.size() != kEcPubKeyLength)
+        {
+            return std::nullopt;
+        }
+        std::memcpy(participants[i].pubkey, r.publicKey.data(), kEcPubKeyLength);
+        std::memcpy(
+            participants[i].ciphertext, r.encryptedAmount.data(), kEcGamalEncryptedTotalLength);
+    }
+
+    size_t proofLen = kEcSendProofLength;
+    Buffer proof(proofLen);
+
+    if (mpt_get_confidential_send_proof(
+            senderPrivKey->data(),
+            senderPubKey->data(),
+            amount,
+            participants.data(),
+            recipients.size(),
+            blindingFactor.data(),
+            contextHash.data(),
+            amountParams.pedersenCommitment.data(),
+            &pedersenBalanceParams,
+            proof.data(),
+            &proofLen) != 0)
+        return std::nullopt;
+
+    return proof;
+}
+
+Buffer
+MPTTester::getPedersenCommitment(std::uint64_t const amount, Buffer const& pedersenBlindingFactor)
+{
+    // Blinding factor (rho) must be a 32-byte scalar
+    if (pedersenBlindingFactor.size() != kEcBlindingFactorLength)
+        Throw<std::runtime_error>("Invalid blinding factor size");
+
+    // secp256k1_mpt_pedersen_commit doesn't handle amount 0, return a trivial
+    // valid commitment for test purposes
+    if (amount == 0)
+    {
+        Buffer buf(kEcPedersenCommitmentLength);
+        std::memset(buf.data(), 0, kEcPedersenCommitmentLength);
+        buf.data()[0] = kEcCompressedPrefixEvenY;
+        buf.data()[kEcPedersenCommitmentLength - 1] = 0x01;
+        return buf;
+    }
+
+    Buffer buf(kEcPedersenCommitmentLength);
+
+    if (mpt_get_pedersen_commitment(amount, pedersenBlindingFactor.data(), buf.data()) != 0)
+        Throw<std::runtime_error>("Pedersen commitment generation failed");
+
+    return buf;
+}
+
+Buffer
+MPTTester::getConvertBackProof(
+    Account const& holder,
+    std::uint64_t const amount,
+    uint256 const& contextHash,
+    PedersenProofParams const& pcParams) const
+{
+    // Expected total proof length: compact sigma proof (128 bytes) + single bulletproof (688 bytes)
+    std::size_t constexpr kExpectedProofLength = kEcConvertBackProofLength;
+
+    auto const sleMptoken = env_.le(keylet::mptoken(issuanceID(), holder.id()));
+    if (!sleMptoken || !sleMptoken->isFieldPresent(sfConfidentialBalanceSpending))
+        return gMakeZeroBuffer(kExpectedProofLength);
+
+    auto const holderPubKey = getPubKey(holder);
+    auto const holderPrivKey = getPrivKey(holder);
+
+    if (!holderPubKey || !holderPrivKey)
+        return gMakeZeroBuffer(kExpectedProofLength);
+
+    auto const pedersenParams = makePedersenParams(pcParams);
+    Buffer proof(kExpectedProofLength);
+
+    if (mpt_get_convert_back_proof(
+            holderPrivKey->data(),
+            holderPubKey->data(),
+            contextHash.data(),
+            amount,
+            &pedersenParams,
+            proof.data()) != 0)
+        return gMakeZeroBuffer(kExpectedProofLength);
+
+    return proof;
+}
+
+std::optional<Buffer>
+MPTTester::getEncryptedBalance(Account const& account, EncryptedBalanceType option) const
+{
+    if (!id_)
+        Throw<std::runtime_error>("MPT has not been created");
+
+    if (auto const sle = env_.le(keylet::mptoken(*id_, account.id())))
+    {
+        if (option == holderEncryptedInbox && sle->isFieldPresent(sfConfidentialBalanceInbox))
+        {
+            return Buffer(
+                (*sle)[sfConfidentialBalanceInbox].data(),
+                (*sle)[sfConfidentialBalanceInbox].size());
+        }
+        if (option == holderEncryptedSpending && sle->isFieldPresent(sfConfidentialBalanceSpending))
+        {
+            return Buffer(
+                (*sle)[sfConfidentialBalanceSpending].data(),
+                (*sle)[sfConfidentialBalanceSpending].size());
+        }
+        if (option == issuerEncryptedBalance && sle->isFieldPresent(sfIssuerEncryptedBalance))
+        {
+            return Buffer(
+                (*sle)[sfIssuerEncryptedBalance].data(), (*sle)[sfIssuerEncryptedBalance].size());
+        }
+        if (option == auditorEncryptedBalance && sle->isFieldPresent(sfAuditorEncryptedBalance))
+        {
+            return Buffer(
+                (*sle)[sfAuditorEncryptedBalance].data(), (*sle)[sfAuditorEncryptedBalance].size());
+        }
+    }
+
+    return {};
+}
+
 std::uint32_t
 MPTTester::getFlags(std::optional<Account> const& holder) const
 {
@@ -667,4 +1029,1515 @@ MPTTester::operator()(std::int64_t amount) const
     return MPT("", issuanceID())(amount);
 }
 
+template <typename T>
+void
+MPTTester::fillConversionCiphertexts(
+    T const& arg,
+    json::Value& jv,
+    Buffer& holderCiphertext,
+    Buffer& issuerCiphertext,
+    std::optional<Buffer>& auditorCiphertext,
+    Buffer& blindingFactor) const
+{
+    blindingFactor = arg.blindingFactor ? *arg.blindingFactor : generateBlindingFactor();
+
+    // Handle Holder
+    if (arg.holderEncryptedAmt)
+    {
+        holderCiphertext = *arg.holderEncryptedAmt;
+    }
+    else
+    {
+        holderCiphertext = encryptAmount(
+            requireValue(arg.account, "account"), requireValue(arg.amt, "amt"), blindingFactor);
+    }
+
+    jv[sfHolderEncryptedAmount.jsonName] = strHex(holderCiphertext);
+
+    // Handle Issuer
+    if (arg.issuerEncryptedAmt)
+    {
+        issuerCiphertext = *arg.issuerEncryptedAmt;
+    }
+    else
+    {
+        issuerCiphertext = encryptAmount(issuer_, requireValue(arg.amt, "amt"), blindingFactor);
+    }
+
+    jv[sfIssuerEncryptedAmount.jsonName] = strHex(issuerCiphertext);
+
+    // Handle Auditor
+    if (arg.auditorEncryptedAmt)
+    {
+        auditorCiphertext = *arg.auditorEncryptedAmt;
+    }
+    else if (auditor_.has_value() && arg.fillAuditorEncryptedAmt.value_or(false))
+    {
+        auditorCiphertext = encryptAmount(
+            requireValue(auditor_, "auditor"), requireValue(arg.amt, "amt"), blindingFactor);
+    }
+
+    // Update auditor JSON only if ciphertext exists
+    if (auditorCiphertext)
+        jv[sfAuditorEncryptedAmount.jsonName] = strHex(*auditorCiphertext);
+}
+
+void
+MPTTester::convert(MPTConvert const& arg)
+{
+    json::Value jv;
+    if (arg.account)
+    {
+        jv[sfAccount] = arg.account->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Account not specified");
+    }
+
+    jv[jss::TransactionType] = jss::ConfidentialMPTConvert;
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else
+    {
+        if (!id_)
+            Throw<std::runtime_error>("MPT has not been created");
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+
+    if (arg.amt)
+        jv[sfMPTAmount.jsonName] = std::to_string(*arg.amt);
+    if (arg.holderPubKey)
+        jv[sfHolderEncryptionKey.jsonName] = strHex(*arg.holderPubKey);
+
+    Buffer holderCiphertext;
+    Buffer issuerCiphertext;
+    std::optional<Buffer> auditorCiphertext;
+    Buffer blindingFactor;
+
+    fillConversionCiphertexts(
+        arg, jv, holderCiphertext, issuerCiphertext, auditorCiphertext, blindingFactor);
+
+    jv[sfBlindingFactor.jsonName] = strHex(blindingFactor);
+    if (arg.proof)
+    {
+        jv[sfZKProof.jsonName] = *arg.proof;
+    }
+    else if (arg.fillSchnorrProof.value_or(arg.holderPubKey.has_value()))
+    {
+        // whether to automatically generate and attach a Schnorr proof:
+        // if fillSchnorrProof is explicitly set, follow its value;
+        // otherwise, default to generating the proof only if holder pub key is
+        // present.
+        auto const seq = arg.ticketSeq.value_or(env_.seq(*arg.account));
+        auto const contextHash =
+            getConvertContextHash(requireValue(arg.account, "account").id(), issuanceID(), seq);
+
+        auto const proof = getSchnorrProof(*arg.account, contextHash);
+        if (proof)
+        {
+            jv[sfZKProof.jsonName] = strHex(*proof);
+        }
+        else
+        {
+            jv[sfZKProof.jsonName] = strHex(gMakeZeroBuffer(kEcSchnorrProofLength));
+        }
+    }
+
+    auto const holderAmt = getBalance(*arg.account);
+    auto const prevConfidentialOutstanding = getIssuanceConfidentialBalance();
+
+    auto const prevInboxBalance = getDecryptedBalance(*arg.account, holderEncryptedInbox);
+    auto const prevSpendingBalance = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+    auto const prevIssuerBalance = getDecryptedBalance(*arg.account, issuerEncryptedBalance);
+
+    if (!prevInboxBalance || !prevSpendingBalance || !prevIssuerBalance)
+        Throw<std::runtime_error>("Failed to get Pre-convert balance");
+
+    std::optional<uint64_t> prevAuditorBalance;
+    if (arg.auditorEncryptedAmt || auditor_)
+    {
+        prevAuditorBalance = getDecryptedBalance(*arg.account, auditorEncryptedBalance);
+        if (!prevAuditorBalance)
+            Throw<std::runtime_error>("Failed to get Pre-convert balance");
+    }
+
+    auto const prevOutstanding = getIssuanceOutstandingBalance();
+
+    if (submit(arg, jv) == tesSUCCESS)
+    {
+        auto const postConfidentialOutstanding = getIssuanceConfidentialBalance();
+        auto const postOutstanding = getIssuanceOutstandingBalance();
+        env_.require(MptBalance(
+            *this, requireValue(arg.account, "account"), holderAmt - requireValue(arg.amt, "amt")));
+        env_.require(RequireAny([&]() -> bool {
+            return prevOutstanding && postOutstanding && *prevOutstanding == *postOutstanding;
+        }));
+        env_.require(RequireAny([&]() -> bool {
+            return prevConfidentialOutstanding + *arg.amt == postConfidentialOutstanding;
+        }));
+
+        env_.require(RequireAny([&]() -> bool {
+            return getEncryptedBalance(*arg.account, holderEncryptedInbox).has_value();
+        }));
+        env_.require(RequireAny([&]() -> bool {
+            return getEncryptedBalance(*arg.account, holderEncryptedSpending).has_value();
+        }));
+        env_.require(RequireAny([&]() -> bool {
+            return getEncryptedBalance(*arg.account, issuerEncryptedBalance).has_value();
+        }));
+
+        auto const postInboxBalance = getDecryptedBalance(*arg.account, holderEncryptedInbox);
+        auto const postIssuerBalance = getDecryptedBalance(*arg.account, issuerEncryptedBalance);
+        auto const postSpendingBalance = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+
+        if (!postInboxBalance || !postIssuerBalance || !postSpendingBalance)
+            Throw<std::runtime_error>("Failed to get post-convert balance");
+
+        if (arg.auditorEncryptedAmt || auditor_)
+        {
+            auto const postAuditorBalance =
+                getDecryptedBalance(*arg.account, auditorEncryptedBalance);
+
+            if (!postAuditorBalance)
+                Throw<std::runtime_error>("Failed to get post-convert auditor balance");
+
+            env_.require(RequireAny([&]() -> bool {
+                return getEncryptedBalance(*arg.account, auditorEncryptedBalance).has_value();
+            }));
+
+            // auditor's encrypted balance is updated correctly
+            env_.require(RequireAny(
+                [&]() -> bool { return *prevAuditorBalance + *arg.amt == *postAuditorBalance; }));
+        }
+        // spending balance should not change
+        env_.require(
+            RequireAny([&]() -> bool { return *postSpendingBalance == *prevSpendingBalance; }));
+
+        // issuer's encrypted balance is updated correctly
+        env_.require(RequireAny(
+            [&]() -> bool { return *prevIssuerBalance + *arg.amt == *postIssuerBalance; }));
+
+        // holder's inbox balance is updated correctly
+        env_.require(RequireAny(
+            [&]() -> bool { return *prevInboxBalance + *arg.amt == *postInboxBalance; }));
+
+        // sum of holder's inbox and spending balance should equal to issuer's
+        // encrypted balance
+        env_.require(RequireAny([&]() -> bool {
+            return *postInboxBalance + *postSpendingBalance == *postIssuerBalance;
+        }));
+
+        if (arg.holderPubKey)
+        {
+            env_.require(RequireAny([&]() -> bool {
+                return forObject(
+                    [&](SLEP const& sle) -> bool {
+                        if (sle)
+                        {
+                            auto const holderPubKey = getPubKey(*arg.account);
+                            if (!holderPubKey)
+                            {
+                                Throw<std::runtime_error>(
+                                    "MPTTester::convert: holder's pubkey is "
+                                    "not set");
+                            }
+
+                            return strHex((*sle)[sfHolderEncryptionKey]) == strHex(*holderPubKey);
+                        }
+                        return false;
+                    },
+                    arg.account);
+            }));
+        }
+    }
+}
+
+json::Value
+MPTTester::convertJV(MPTConvert const& arg, std::uint32_t seq)
+{
+    json::Value jv;
+    if (arg.account)
+    {
+        jv[sfAccount] = arg.account->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Account not specified");
+    }
+
+    jv[jss::TransactionType] = jss::ConfidentialMPTConvert;
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else
+    {
+        if (!id_)
+            Throw<std::runtime_error>("MPT has not been created");
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+
+    if (arg.amt)
+        jv[sfMPTAmount.jsonName] = std::to_string(*arg.amt);
+    if (arg.holderPubKey)
+        jv[sfHolderEncryptionKey.jsonName] = strHex(*arg.holderPubKey);
+
+    Buffer holderCiphertext;
+    Buffer issuerCiphertext;
+    std::optional<Buffer> auditorCiphertext;
+    Buffer blindingFactor;
+
+    fillConversionCiphertexts(
+        arg, jv, holderCiphertext, issuerCiphertext, auditorCiphertext, blindingFactor);
+
+    jv[sfBlindingFactor.jsonName] = strHex(blindingFactor);
+
+    if (arg.proof)
+    {
+        jv[sfZKProof.jsonName] = *arg.proof;
+    }
+    else if (arg.fillSchnorrProof.value_or(arg.holderPubKey.has_value()))
+    {
+        auto const contextHash =
+            getConvertContextHash(requireValue(arg.account, "account").id(), issuanceID(), seq);
+        auto const proof = getSchnorrProof(*arg.account, contextHash);
+        if (proof)
+        {
+            jv[sfZKProof.jsonName] = strHex(*proof);
+        }
+        else
+        {
+            jv[sfZKProof.jsonName] = strHex(gMakeZeroBuffer(kEcSchnorrProofLength));
+        }
+    }
+
+    return jv;
+}
+
+void
+MPTTester::send(MPTConfidentialSend const& arg)
+{
+    json::Value jv;
+    jv[jss::TransactionType] = jss::ConfidentialMPTSend;
+
+    if (arg.account)
+    {
+        jv[sfAccount] = arg.account->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Account not specified");
+    }
+
+    if (arg.dest)
+    {
+        jv[sfDestination] = arg.dest->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Destination not specified");
+    }
+
+    if (!arg.amt)
+        Throw<std::runtime_error>("Amount not specified for testing purposes");
+
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else
+    {
+        if (!id_)
+            Throw<std::runtime_error>("MPT has not been created");
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+
+    Buffer const blindingFactor =
+        arg.blindingFactor ? *arg.blindingFactor : generateBlindingFactor();
+
+    // fill in the encrypted amounts if not provided
+    auto const senderAmt = arg.senderEncryptedAmt
+        ? *arg.senderEncryptedAmt
+        : encryptAmount(*arg.account, *arg.amt, blindingFactor);
+    auto const destAmt = arg.destEncryptedAmt ? *arg.destEncryptedAmt
+                                              : encryptAmount(*arg.dest, *arg.amt, blindingFactor);
+    auto const issuerAmt = arg.issuerEncryptedAmt
+        ? *arg.issuerEncryptedAmt
+        : encryptAmount(issuer_, *arg.amt, blindingFactor);
+
+    std::optional<Buffer> auditorAmt;
+    if (arg.auditorEncryptedAmt)
+    {
+        auditorAmt = arg.auditorEncryptedAmt;
+    }
+    else if (auditor_.has_value() && arg.fillAuditorEncryptedAmt.value_or(false))
+    {
+        auditorAmt = encryptAmount(
+            requireValue(auditor_, "auditor"), requireValue(arg.amt, "amt"), blindingFactor);
+    }
+
+    jv[sfSenderEncryptedAmount] = strHex(senderAmt);
+    jv[sfDestinationEncryptedAmount] = strHex(destAmt);
+    jv[sfIssuerEncryptedAmount] = strHex(issuerAmt);
+    if (auditorAmt)
+        jv[sfAuditorEncryptedAmount] = strHex(*auditorAmt);
+
+    if (arg.credentials)
+    {
+        auto& arr(jv[sfCredentialIDs.jsonName] = json::ValueType::Array);
+        for (auto const& hash : *arg.credentials)
+            arr.append(hash);
+    }
+
+    // Version counters before send
+    auto const prevSenderVersion = getMPTokenVersion(*arg.account);
+    auto const prevDestVersion = getMPTokenVersion(*arg.dest);
+
+    // Sender's previous confidential state
+    auto const prevSenderInbox = getDecryptedBalance(*arg.account, holderEncryptedInbox);
+    auto const prevSenderSpending = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+    auto const prevSenderIssuer = getDecryptedBalance(*arg.account, issuerEncryptedBalance);
+    auto const prevSenderInboxEncrypted = getEncryptedBalance(*arg.account, holderEncryptedInbox);
+    auto const prevSenderSpendingEncrypted =
+        getEncryptedBalance(*arg.account, holderEncryptedSpending);
+    auto const prevSenderIssuerEncrypted =
+        getEncryptedBalance(*arg.account, issuerEncryptedBalance);
+    if (!prevSenderInbox || !prevSenderSpending || !prevSenderIssuer)
+        Throw<std::runtime_error>("Failed to get Pre-send balance");
+
+    std::optional<uint64_t> prevSenderAuditor;
+    auto const prevSenderAuditorEncrypted =
+        getEncryptedBalance(*arg.account, auditorEncryptedBalance);
+    if (arg.auditorEncryptedAmt || auditor_)
+    {
+        prevSenderAuditor = getDecryptedBalance(*arg.account, auditorEncryptedBalance);
+        if (!prevSenderAuditor)
+            Throw<std::runtime_error>("Failed to get Pre-send balance");
+    }
+
+    // Destination's previous confidential state
+    auto const prevDestInbox = getDecryptedBalance(*arg.dest, holderEncryptedInbox);
+    auto const prevDestSpending = getDecryptedBalance(*arg.dest, holderEncryptedSpending);
+    auto const prevDestIssuer = getDecryptedBalance(*arg.dest, issuerEncryptedBalance);
+    auto const prevDestInboxEncrypted = getEncryptedBalance(*arg.dest, holderEncryptedInbox);
+    auto const prevDestSpendingEncrypted = getEncryptedBalance(*arg.dest, holderEncryptedSpending);
+    auto const prevDestIssuerEncrypted = getEncryptedBalance(*arg.dest, issuerEncryptedBalance);
+    if (!prevDestInbox || !prevDestSpending || !prevDestIssuer)
+        Throw<std::runtime_error>("Failed to get Pre-send balance");
+
+    std::optional<uint64_t> prevDestAuditor;
+    auto const prevDestAuditorEncrypted = getEncryptedBalance(*arg.dest, auditorEncryptedBalance);
+    if (arg.auditorEncryptedAmt || auditor_)
+    {
+        prevDestAuditor = getDecryptedBalance(*arg.dest, auditorEncryptedBalance);
+        if (!prevDestAuditor)
+            Throw<std::runtime_error>("Failed to get Pre-send balance");
+    }
+
+    // Fill in the commitment if not provided
+    // The amount commitment must use the same blinding factor as the ElGamal
+    // encryption. The sigma proof links the two, so using different randomness
+    // for each would cause proof verification to fail.
+    Buffer amountCommitment, balanceCommitment;
+    if (arg.amountCommitment)
+    {
+        amountCommitment = *arg.amountCommitment;
+    }
+    else
+    {
+        amountCommitment = getPedersenCommitment(*arg.amt, blindingFactor);
+    }
+
+    jv[sfAmountCommitment] = strHex(amountCommitment);
+
+    auto const balanceBlindingFactor = generateBlindingFactor();
+    if (arg.balanceCommitment)
+    {
+        balanceCommitment = *arg.balanceCommitment;
+    }
+    else
+    {
+        balanceCommitment = getPedersenCommitment(*prevSenderSpending, balanceBlindingFactor);
+    }
+
+    jv[sfBalanceCommitment] = strHex(balanceCommitment);
+
+    // Fill in the proof if not provided
+    if (arg.proof)
+    {
+        jv[sfZKProof] = *arg.proof;
+    }
+    else
+    {
+        auto const version = getMPTokenVersion(*arg.account);
+        auto const seq = arg.ticketSeq.value_or(env_.seq(*arg.account));
+        auto const ctxHash = getSendContextHash(
+            requireValue(arg.account, "account").id(),
+            issuanceID(),
+            seq,
+            requireValue(arg.dest, "dest").id(),
+            version);
+
+        std::vector<ConfidentialRecipient> recipients;
+
+        auto const senderPubKey = getPubKey(*arg.account);
+        auto const destPubKey = getPubKey(*arg.dest);
+        auto const issuerPubKey = getPubKey(issuer_);
+
+        // If a key is missing, we skip adding the recipient. This intentionally
+        // causes proof generation to fail, triggering the dummy proof fallback.
+        if (senderPubKey)
+        {
+            recipients.push_back({
+                .publicKey = Slice(*senderPubKey),
+                .encryptedAmount = senderAmt,
+            });
+        }
+        if (destPubKey)
+        {
+            recipients.push_back({
+                .publicKey = Slice(*destPubKey),
+                .encryptedAmount = destAmt,
+            });
+        }
+        if (issuerPubKey)
+        {
+            recipients.push_back({
+                .publicKey = Slice(*issuerPubKey),
+                .encryptedAmount = issuerAmt,
+            });
+        }
+
+        std::optional<Buffer> auditorPubKey;
+        if (auditorAmt)
+        {
+            if (!auditor_)
+                Throw<std::runtime_error>("Auditor not registered");
+
+            auditorPubKey = getPubKey(*auditor_);
+            if (auditorPubKey)
+            {
+                recipients.push_back({
+                    .publicKey = Slice(*auditorPubKey),
+                    .encryptedAmount = *auditorAmt,
+                });
+            }
+        }
+
+        std::optional<Buffer> proof;
+
+        // Skip proof generation if encrypted balance is missing (e.g.,
+        // feature disabled), when the sender and destination are the same
+        // (malformed case causing pcm to be zero), or when spending balance
+        // is 0
+        if (arg.account != arg.dest && prevSenderSpendingEncrypted && *prevSenderSpending > 0)
+        {
+            proof = getConfidentialSendProof(
+                *arg.account,
+                *arg.amt,
+                recipients,
+                blindingFactor,
+                ctxHash,
+                {
+                    .pedersenCommitment = amountCommitment,
+                    .amt = *arg.amt,
+                    .encryptedAmt = senderAmt,
+                    .blindingFactor = blindingFactor,
+                },
+                {
+                    .pedersenCommitment = balanceCommitment,
+                    .amt = *prevSenderSpending,
+                    .encryptedAmt = *prevSenderSpendingEncrypted,
+                    .blindingFactor = balanceBlindingFactor,
+                });
+        }
+
+        if (proof)
+        {
+            jv[sfZKProof.jsonName] = strHex(*proof);
+        }
+        else
+        {
+            jv[sfZKProof.jsonName] = strHex(gMakeZeroBuffer(kEcSendProofLength));
+        }
+    }
+
+    auto const senderPubAmt = getBalance(*arg.account);
+    auto const destPubAmt = getBalance(*arg.dest);
+    auto const prevCOA = getIssuanceConfidentialBalance();
+    auto const prevOA = getIssuanceOutstandingBalance();
+
+    if (submit(arg, jv) == tesSUCCESS)
+    {
+        auto const postCOA = getIssuanceConfidentialBalance();
+        auto const postOA = getIssuanceOutstandingBalance();
+
+        // Sender's post confidential state
+        auto const postSenderInbox = getDecryptedBalance(*arg.account, holderEncryptedInbox);
+        auto const postSenderSpending = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+        auto const postSenderIssuer = getDecryptedBalance(*arg.account, issuerEncryptedBalance);
+
+        if (!postSenderInbox || !postSenderSpending || !postSenderIssuer)
+            Throw<std::runtime_error>("Failed to get Post-send balance");
+
+        // Destination's post confidential state
+        auto const postDestInbox = getDecryptedBalance(*arg.dest, holderEncryptedInbox);
+        auto const postDestSpending = getDecryptedBalance(*arg.dest, holderEncryptedSpending);
+        auto const postDestIssuer = getDecryptedBalance(*arg.dest, issuerEncryptedBalance);
+
+        if (!postDestInbox || !postDestSpending || !postDestIssuer)
+            Throw<std::runtime_error>("Failed to get Post-send balance");
+
+        // Public balances unchanged
+        env_.require(MptBalance(*this, *arg.account, senderPubAmt));
+        env_.require(MptBalance(*this, *arg.dest, destPubAmt));
+
+        // OA and COA unchanged
+        env_.require(RequireAny([&]() -> bool { return prevOA && postOA && *prevOA == *postOA; }));
+        env_.require(RequireAny([&]() -> bool { return prevCOA == postCOA; }));
+
+        // Verify sender changes
+        env_.require(RequireAny([&]() -> bool {
+            return *prevSenderSpending >= *arg.amt &&
+                *postSenderSpending == *prevSenderSpending - *arg.amt;
+        }));
+        env_.require(RequireAny([&]() -> bool { return postSenderInbox == prevSenderInbox; }));
+        env_.require(RequireAny([&]() -> bool {
+            return *prevSenderIssuer >= *arg.amt &&
+                *postSenderIssuer == *prevSenderIssuer - *arg.amt;
+        }));
+
+        // Verify destination changes
+        env_.require(
+            RequireAny([&]() -> bool { return *postDestInbox == *prevDestInbox + *arg.amt; }));
+        env_.require(RequireAny([&]() -> bool { return *postDestSpending == *prevDestSpending; }));
+        env_.require(
+            RequireAny([&]() -> bool { return *postDestIssuer == *prevDestIssuer + *arg.amt; }));
+
+        // Cross checks
+        env_.require(RequireAny(
+            [&]() -> bool { return *postSenderInbox + *postSenderSpending == *postSenderIssuer; }));
+        env_.require(RequireAny(
+            [&]() -> bool { return *postDestInbox + *postDestSpending == *postDestIssuer; }));
+
+        // Version: sender increments by 1; receiver version is unchanged by incoming sends
+        env_.require(RequireAny(
+            [&]() -> bool { return getMPTokenVersion(*arg.account) == prevSenderVersion + 1; }));
+        env_.require(
+            RequireAny([&]() -> bool { return getMPTokenVersion(*arg.dest) == prevDestVersion; }));
+
+        if (arg.auditorEncryptedAmt || auditor_)
+        {
+            auto const postSenderAuditor =
+                getDecryptedBalance(*arg.account, auditorEncryptedBalance);
+            auto const postDestAuditor = getDecryptedBalance(*arg.dest, auditorEncryptedBalance);
+            if (!postSenderAuditor || !postDestAuditor)
+                Throw<std::runtime_error>("Failed to get Post-send balance");
+
+            env_.require(RequireAny([&]() -> bool {
+                return *postSenderAuditor == *postSenderIssuer &&
+                    *postDestAuditor == *postDestIssuer;
+            }));
+
+            // verify sender
+            env_.require(RequireAny([&]() -> bool {
+                return prevSenderAuditor >= *arg.amt &&
+                    *postSenderAuditor == *prevSenderAuditor - *arg.amt;
+            }));
+
+            // verify dest
+            env_.require(RequireAny(
+                [&]() -> bool { return *postDestAuditor == *prevDestAuditor + *arg.amt; }));
+        }
+    }
+}
+
+json::Value
+MPTTester::sendJV(
+    MPTConfidentialSend const& arg,
+    std::uint32_t seq,
+    std::optional<ConfidentialSendChainState> chain)
+{
+    json::Value jv;
+    jv[jss::TransactionType] = jss::ConfidentialMPTSend;
+
+    if (arg.account)
+    {
+        jv[sfAccount] = arg.account->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Account not specified");
+    }
+
+    if (arg.dest)
+    {
+        jv[sfDestination] = arg.dest->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Destination not specified");
+    }
+
+    if (!arg.amt)
+        Throw<std::runtime_error>("Amount not specified for testing purposes");
+
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else
+    {
+        if (!id_)
+            Throw<std::runtime_error>("MPT has not been created");
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+
+    Buffer const blindingFactor =
+        arg.blindingFactor ? *arg.blindingFactor : generateBlindingFactor();
+
+    auto const senderAmt = arg.senderEncryptedAmt
+        ? *arg.senderEncryptedAmt
+        : encryptAmount(*arg.account, *arg.amt, blindingFactor);
+    auto const destAmt = arg.destEncryptedAmt ? *arg.destEncryptedAmt
+                                              : encryptAmount(*arg.dest, *arg.amt, blindingFactor);
+    auto const issuerAmt = arg.issuerEncryptedAmt
+        ? *arg.issuerEncryptedAmt
+        : encryptAmount(issuer_, *arg.amt, blindingFactor);
+
+    std::optional<Buffer> auditorAmt;
+    if (arg.auditorEncryptedAmt)
+    {
+        auditorAmt = arg.auditorEncryptedAmt;
+    }
+    else if (auditor_.has_value() && arg.fillAuditorEncryptedAmt.value_or(false))
+    {
+        auditorAmt = encryptAmount(
+            requireValue(auditor_, "auditor"), requireValue(arg.amt, "amt"), blindingFactor);
+    }
+
+    jv[sfSenderEncryptedAmount] = strHex(senderAmt);
+    jv[sfDestinationEncryptedAmount] = strHex(destAmt);
+    jv[sfIssuerEncryptedAmount] = strHex(issuerAmt);
+    if (auditorAmt)
+        jv[sfAuditorEncryptedAmount] = strHex(*auditorAmt);
+
+    if (arg.credentials)
+    {
+        auto& arr(jv[sfCredentialIDs.jsonName] = json::ValueType::Array);
+        for (auto const& hash : *arg.credentials)
+            arr.append(hash);
+    }
+
+    std::uint64_t prevSenderSpending = 0;
+    std::optional<Buffer> prevEncryptedSenderSpending;
+    std::uint32_t version = 0;
+    if (chain)
+    {
+        prevSenderSpending = chain->spending;
+        prevEncryptedSenderSpending = chain->encSpending;
+        version = chain->version;
+    }
+    else
+    {
+        auto const ledgerSpending = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+        if (!ledgerSpending)
+            Throw<std::runtime_error>("Failed to get sender spending balance");
+        prevSenderSpending = *ledgerSpending;
+        prevEncryptedSenderSpending = getEncryptedBalance(*arg.account, holderEncryptedSpending);
+        version = getMPTokenVersion(*arg.account);
+    }
+
+    // The amount commitment must use the same blinding factor as the tx ElGamal
+    // encryption blinding factor.
+    Buffer amountCommitment, balanceCommitment;
+    if (arg.amountCommitment)
+    {
+        amountCommitment = *arg.amountCommitment;
+    }
+    else
+    {
+        amountCommitment = getPedersenCommitment(*arg.amt, blindingFactor);
+    }
+
+    jv[sfAmountCommitment] = strHex(amountCommitment);
+
+    auto const balanceBlindingFactor = generateBlindingFactor();
+    if (arg.balanceCommitment)
+    {
+        balanceCommitment = *arg.balanceCommitment;
+    }
+    else
+    {
+        balanceCommitment = getPedersenCommitment(prevSenderSpending, balanceBlindingFactor);
+    }
+
+    jv[sfBalanceCommitment] = strHex(balanceCommitment);
+
+    if (arg.proof)
+    {
+        jv[sfZKProof.jsonName] = *arg.proof;
+    }
+    else
+    {
+        auto const ctxHash = getSendContextHash(
+            requireValue(arg.account, "account").id(),
+            issuanceID(),
+            seq,
+            requireValue(arg.dest, "dest").id(),
+            version);
+
+        std::vector<ConfidentialRecipient> recipients;
+
+        auto const senderPubKey = getPubKey(*arg.account);
+        auto const destPubKey = getPubKey(*arg.dest);
+        auto const issuerPubKey = getPubKey(issuer_);
+
+        if (senderPubKey)
+        {
+            recipients.push_back({
+                .publicKey = Slice(*senderPubKey),
+                .encryptedAmount = senderAmt,
+            });
+        }
+        if (destPubKey)
+        {
+            recipients.push_back({
+                .publicKey = Slice(*destPubKey),
+                .encryptedAmount = destAmt,
+            });
+        }
+        if (issuerPubKey)
+        {
+            recipients.push_back({
+                .publicKey = Slice(*issuerPubKey),
+                .encryptedAmount = issuerAmt,
+            });
+        }
+
+        std::optional<Buffer> auditorPubKey;
+        if (auditorAmt)
+        {
+            if (!auditor_)
+                Throw<std::runtime_error>("Auditor not registered");
+            auditorPubKey = getPubKey(*auditor_);
+            if (auditorPubKey)
+            {
+                recipients.push_back({
+                    .publicKey = Slice(*auditorPubKey),
+                    .encryptedAmount = *auditorAmt,
+                });
+            }
+        }
+
+        std::optional<Buffer> proof;
+
+        // Skip proof generation when spending balance is 0
+        if (arg.account != arg.dest && prevEncryptedSenderSpending && prevSenderSpending > 0)
+        {
+            proof = getConfidentialSendProof(
+                *arg.account,
+                *arg.amt,
+                recipients,
+                blindingFactor,
+                ctxHash,
+                {
+                    .pedersenCommitment = amountCommitment,
+                    .amt = *arg.amt,
+                    .encryptedAmt = senderAmt,
+                    .blindingFactor = blindingFactor,
+                },
+                {
+                    .pedersenCommitment = balanceCommitment,
+                    .amt = prevSenderSpending,
+                    .encryptedAmt = *prevEncryptedSenderSpending,
+                    .blindingFactor = balanceBlindingFactor,
+                });
+        }
+
+        if (proof)
+        {
+            jv[sfZKProof.jsonName] = strHex(*proof);
+        }
+        else
+        {
+            jv[sfZKProof.jsonName] = strHex(gMakeZeroBuffer(kEcSendProofLength));
+        }
+    }
+
+    return jv;
+}
+
+static Buffer
+parseSenderEncAmt(json::Value const& jv)
+{
+    auto const hexStr = jv[sfSenderEncryptedAmount.jsonName].asString();
+    auto const bytes = strUnHex(hexStr);
+    if (!bytes)
+        Throw<std::runtime_error>("chainAfterSend: invalid hex in sfSenderEncryptedAmount");
+    return Buffer(bytes->data(), bytes->size());
+}
+
+ConfidentialSendChainState
+MPTTester::chainAfterSend(Account const& sender, std::uint64_t sendAmt, json::Value const& jv) const
+{
+    auto const prevSpending = getDecryptedBalance(sender, holderEncryptedSpending);
+    auto const prevEncSpending = getEncryptedBalance(sender, holderEncryptedSpending);
+    auto const prevVersion = getMPTokenVersion(sender);
+
+    if (!prevSpending || !prevEncSpending)
+        Throw<std::runtime_error>("chainAfterSend: failed to read sender state from ledger");
+
+    Buffer const senderEncAmt = parseSenderEncAmt(jv);
+    auto chain = computeNextSendChainState(
+        *prevSpending, Slice(*prevEncSpending), prevVersion, sendAmt, Slice(senderEncAmt));
+    if (!chain)
+        Throw<std::runtime_error>("chainAfterSend: computeNextSendChainState failed");
+    return std::move(*chain);
+}
+
+std::optional<ConfidentialSendChainState>
+computeNextSendChainState(
+    std::uint64_t currentSpending,
+    Slice const& currentEncSpending,
+    std::uint32_t currentVersion,
+    std::uint64_t sendAmt,
+    Slice const& senderEncAmt)
+{
+    if (sendAmt > currentSpending)
+        return std::nullopt;  // LCOV_EXCL_LINE
+
+    auto newEncSpending = homomorphicSubtract(currentEncSpending, senderEncAmt);
+    if (!newEncSpending)
+        return std::nullopt;  // LCOV_EXCL_LINE
+
+    return ConfidentialSendChainState{
+        .spending = currentSpending - sendAmt,
+        .encSpending = std::move(*newEncSpending),
+        .version = currentVersion + 1,
+    };
+}
+
+void
+MPTTester::confidentialClaw(MPTConfidentialClawback const& arg)
+{
+    json::Value jv;
+    auto const account = arg.account ? *arg.account : issuer_;
+    jv[sfAccount] = account.human();
+
+    if (arg.holder)
+    {
+        jv[sfHolder] = arg.holder->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Holder not specified");
+    }
+
+    jv[jss::TransactionType] = jss::ConfidentialMPTClawback;
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else if (id_)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+    else
+    {
+        Throw<std::runtime_error>("MPT has not been created");
+    }
+
+    if (arg.amt)
+        jv[sfMPTAmount] = std::to_string(*arg.amt);
+
+    if (arg.proof)
+    {
+        jv[sfZKProof] = *arg.proof;
+    }
+    else
+    {
+        auto const seq = arg.ticketSeq ? *arg.ticketSeq : env_.seq(account);
+        auto const contextHash = getClawbackContextHash(
+            account.id(), issuanceID(), seq, requireValue(arg.holder, "holder").id());
+
+        auto const privKey = getPrivKey(account);
+        if (!privKey || privKey->size() != kEcPrivKeyLength)
+            Throw<std::runtime_error>("Failed to get clawback private key");
+
+        auto const proof = getClawbackProof(
+            requireValue(arg.holder, "holder"),
+            requireValue(arg.amt, "amt"),
+            requireValue(privKey, "privKey"),
+            contextHash);
+
+        if (proof)
+        {
+            jv[sfZKProof] = strHex(*proof);
+        }
+        else
+        {
+            jv[sfZKProof] = strHex(gMakeZeroBuffer(kEcClawbackProofLength));
+        }
+    }
+
+    auto const holderPubAmt = getBalance(*arg.holder);
+    auto const prevCOA = getIssuanceConfidentialBalance();
+    auto const prevOA = getIssuanceOutstandingBalance();
+    auto const prevVersion = getMPTokenVersion(*arg.holder);
+
+    if (submit(arg, jv) == tesSUCCESS)
+    {
+        auto const postCOA = getIssuanceConfidentialBalance();
+        auto const postOA = getIssuanceOutstandingBalance();
+        auto const postVersion = getMPTokenVersion(*arg.holder);
+
+        // Verify holder's public balance is unchanged
+        env_.require(MptBalance(*this, *arg.holder, holderPubAmt));
+
+        // Verify COA and OA are reduced correctly
+        env_.require(RequireAny(
+            [&]() -> bool { return prevCOA >= *arg.amt && postCOA == prevCOA - *arg.amt; }));
+        env_.require(RequireAny([&]() -> bool {
+            return prevOA && postOA && *prevOA >= *arg.amt && *postOA == *prevOA - *arg.amt;
+        }));
+
+        // Verify holder's confidential balances are zeroed out
+        env_.require(RequireAny(
+            [&]() -> bool { return getDecryptedBalance(*arg.holder, holderEncryptedInbox) == 0; }));
+        env_.require(RequireAny([&]() -> bool {
+            return getDecryptedBalance(*arg.holder, holderEncryptedSpending) == 0;
+        }));
+        env_.require(RequireAny([&]() -> bool {
+            return getDecryptedBalance(*arg.holder, issuerEncryptedBalance) == 0;
+        }));
+        env_.require(RequireAny([&]() -> bool {
+            return getDecryptedBalance(*arg.holder, auditorEncryptedBalance) == 0;
+        }));
+
+        // Verify version is incremented
+        env_.require(RequireAny([&]() -> bool { return postVersion == prevVersion + 1; }));
+    }
+}
+
+void
+MPTTester::generateKeyPair(Account const& account)
+{
+    unsigned char privKey[kEcPrivKeyLength];
+    secp256k1_pubkey pubKey;
+    if (secp256k1_elgamal_generate_keypair(secp256k1Context(), privKey, &pubKey) == 0)
+        Throw<std::runtime_error>("failed to generate key pair");
+
+    // Serialize public key to compressed format (33 bytes)
+    unsigned char compressedPubKey[kEcPubKeyLength];
+    size_t outLen = kEcPubKeyLength;
+    if (secp256k1_ec_pubkey_serialize(
+            secp256k1Context(), compressedPubKey, &outLen, &pubKey, SECP256K1_EC_COMPRESSED) != 1 ||
+        outLen != kEcPubKeyLength)
+    {
+        Throw<std::runtime_error>("failed to serialize public key");
+    }
+
+    pubKeys_.insert({account.id(), Buffer{compressedPubKey, kEcPubKeyLength}});
+    privKeys_.insert({account.id(), Buffer{privKey, kEcPrivKeyLength}});
+}
+
+std::optional<Buffer>
+MPTTester::getPubKey(Account const& account) const
+{
+    if (auto const it = pubKeys_.find(account.id()); it != pubKeys_.end())
+        return it->second;
+
+    return std::nullopt;
+}
+
+std::optional<Buffer>
+MPTTester::getPrivKey(Account const& account) const
+{
+    if (auto const it = privKeys_.find(account.id()); it != privKeys_.end())
+        return it->second;
+
+    return std::nullopt;
+}
+
+Buffer
+MPTTester::encryptAmount(Account const& account, uint64_t const amt, Buffer const& blindingFactor)
+    const
+{
+    if (auto const pubKey = getPubKey(account))
+    {
+        if (auto const result = xrpl::encryptAmount(amt, *pubKey, blindingFactor))
+            return *result;
+    }
+
+    // Return a dummy buffer on failure to allow testing of
+    // failures that occur prior to encryption.
+    return gMakeZeroBuffer(kEcGamalEncryptedTotalLength);
+}
+
+std::optional<uint64_t>
+MPTTester::decryptAmount(Account const& account, Buffer const& amt) const
+{
+    if (amt.size() != kEcGamalEncryptedTotalLength)
+        return std::nullopt;
+
+    auto const pair = makeEcPair(amt);
+    if (!pair)
+        return std::nullopt;
+
+    auto const privKey = getPrivKey(account);
+    if (!privKey || privKey->size() != kEcPrivKeyLength)
+        return std::nullopt;
+
+    uint64_t decryptedAmt = 0;
+    if (secp256k1_elgamal_decrypt(
+            secp256k1Context(),
+            &decryptedAmt,
+            &pair->c1,
+            &pair->c2,
+            privKey->data(),
+            kElGamalDecryptRangeLow,
+            kElGamalDecryptRangeHigh) == 0)
+    {
+        return std::nullopt;
+    }
+
+    return decryptedAmt;
+}
+
+std::optional<uint64_t>
+MPTTester::getDecryptedBalance(Account const& account, EncryptedBalanceType balanceType) const
+{
+    auto const encryptedAmt = getEncryptedBalance(account, balanceType);
+
+    // Return zero to test cases like Feature Disabled, where the ledger object
+    // does not exist.
+    if (!encryptedAmt)
+        return 0;
+
+    Account decryptor = account;
+
+    if (balanceType == issuerEncryptedBalance)
+    {
+        decryptor = issuer_;
+    }
+    else if (balanceType == auditorEncryptedBalance)
+    {
+        if (!auditor_)
+            return std::nullopt;
+        decryptor = *auditor_;
+    }
+
+    return decryptAmount(decryptor, *encryptedAmt);
+};
+
+json::Value
+MPTTester::mergeInboxJV(MPTMergeInbox const& arg) const
+{
+    json::Value jv;
+    if (arg.account)
+    {
+        jv[sfAccount] = arg.account->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Account not specified");
+    }
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else
+    {
+        if (!id_)
+            Throw<std::runtime_error>("MPT has not been created");
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+    jv[sfTransactionType] = jss::ConfidentialMPTMergeInbox;
+    return jv;
+}
+
+void
+MPTTester::mergeInbox(MPTMergeInbox const& arg)
+{
+    json::Value jv;
+    if (arg.account)
+    {
+        jv[sfAccount] = arg.account->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Account not specified");
+    }
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else
+    {
+        if (!id_)
+            Throw<std::runtime_error>("MPT has not been created");
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+
+    jv[sfTransactionType] = jss::ConfidentialMPTMergeInbox;
+    auto const holderPubAmt = getBalance(*arg.account);
+    auto const prevCOA = getIssuanceConfidentialBalance();
+    auto const prevOA = getIssuanceOutstandingBalance();
+    auto const prevInboxBalance = getDecryptedBalance(*arg.account, holderEncryptedInbox);
+    auto const prevSpendingBalance = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+    auto const prevIssuerBalance = getDecryptedBalance(*arg.account, issuerEncryptedBalance);
+    auto const prevIssuerEncrypted = getEncryptedBalance(*arg.account, issuerEncryptedBalance);
+    auto const prevAuditorEncrypted = getEncryptedBalance(*arg.account, auditorEncryptedBalance);
+    auto const prevVersion = getMPTokenVersion(*arg.account);
+
+    if (!prevInboxBalance || !prevSpendingBalance || !prevIssuerBalance)
+        Throw<std::runtime_error>("Failed to get pre-mergeInbox balances");
+
+    if (submit(arg, jv) == tesSUCCESS)
+    {
+        auto const postCOA = getIssuanceConfidentialBalance();
+        auto const postOA = getIssuanceOutstandingBalance();
+        auto const postInboxBalance = getDecryptedBalance(*arg.account, holderEncryptedInbox);
+        auto const postSpendingBalance = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+        auto const postIssuerBalance = getDecryptedBalance(*arg.account, issuerEncryptedBalance);
+        auto const postInboxEncrypted = getEncryptedBalance(*arg.account, holderEncryptedInbox);
+        auto const postIssuerEncrypted = getEncryptedBalance(*arg.account, issuerEncryptedBalance);
+        auto const postAuditorEncrypted =
+            getEncryptedBalance(*arg.account, auditorEncryptedBalance);
+        auto const postVersion = getMPTokenVersion(*arg.account);
+
+        if (!postInboxBalance || !postSpendingBalance || !postIssuerBalance ||
+            !prevIssuerEncrypted || !postInboxEncrypted || !postIssuerEncrypted)
+            Throw<std::runtime_error>("Failed to get post-mergeInbox balances");
+
+        env_.require(MptBalance(*this, *arg.account, holderPubAmt));
+        env_.require(RequireAny([&]() -> bool { return prevOA && postOA && *prevOA == *postOA; }));
+        env_.require(RequireAny([&]() -> bool { return prevCOA == postCOA; }));
+
+        env_.require(RequireAny([&]() -> bool {
+            return *postSpendingBalance == *prevInboxBalance + *prevSpendingBalance &&
+                *postInboxBalance == 0;
+        }));
+
+        env_.require(
+            RequireAny([&]() -> bool { return *prevIssuerBalance == *postIssuerBalance; }));
+
+        auto const holderPubKey = getPubKey(*arg.account);
+        if (!holderPubKey)
+            Throw<std::runtime_error>("Failed to get holder public key");
+
+        auto const expectedInbox = encryptCanonicalZeroAmount(
+            requireValue(holderPubKey, "holderPubKey"),
+            requireValue(arg.account, "account").id(),
+            issuanceID());
+        if (!expectedInbox)
+            Throw<std::runtime_error>("Failed to get canonical zero encryption");
+
+        env_.require(RequireAny([&]() -> bool { return *postInboxEncrypted == *expectedInbox; }));
+        env_.require(
+            RequireAny([&]() -> bool { return *postIssuerEncrypted == *prevIssuerEncrypted; }));
+        env_.require(RequireAny([&]() -> bool {
+            return postAuditorEncrypted.has_value() == prevAuditorEncrypted.has_value() &&
+                (!postAuditorEncrypted || *postAuditorEncrypted == *prevAuditorEncrypted);
+        }));
+        env_.require(RequireAny([&]() -> bool { return postVersion == prevVersion + 1; }));
+
+        env_.require(RequireAny([&]() -> bool {
+            return *postSpendingBalance + *postInboxBalance == *postIssuerBalance;
+        }));
+    }
+}
+
+std::optional<std::int64_t>
+MPTTester::getIssuanceOutstandingBalance() const
+{
+    if (!id_)
+        return std::nullopt;
+
+    auto const sle = env_.current()->read(keylet::mptokenIssuance(*id_));
+
+    if (!sle)
+        return std::nullopt;
+
+    return (*sle)[sfOutstandingAmount];
+}
+
+std::uint32_t
+MPTTester::getMPTokenVersion(Account const account) const
+{
+    if (!id_)
+        Throw<std::runtime_error>("Issuance ID does not exist");
+
+    auto const sle = env_.current()->read(keylet::mptoken(*id_, account));
+
+    // return 0 here instead of throwing an exception since tests for
+    // preclaim will check if the MPToken exists
+    if (!sle)
+        return 0;
+
+    return (*sle)[~sfConfidentialBalanceVersion].value_or(0);
+}
+
+void
+MPTTester::convertBack(MPTConvertBack const& arg)
+{
+    json::Value jv;
+    if (arg.account)
+    {
+        jv[sfAccount] = arg.account->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Account not specified");
+    }
+
+    jv[jss::TransactionType] = jss::ConfidentialMPTConvertBack;
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else
+    {
+        if (!id_)
+            Throw<std::runtime_error>("MPT has not been created");
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+
+    if (arg.amt)
+        jv[sfMPTAmount.jsonName] = std::to_string(*arg.amt);
+
+    Buffer holderCiphertext;
+    Buffer issuerCiphertext;
+    std::optional<Buffer> auditorCiphertext;
+    Buffer blindingFactor;
+
+    fillConversionCiphertexts(
+        arg, jv, holderCiphertext, issuerCiphertext, auditorCiphertext, blindingFactor);
+
+    jv[sfBlindingFactor] = strHex(blindingFactor);
+
+    auto const prevInboxBalance = getDecryptedBalance(*arg.account, holderEncryptedInbox);
+    auto const prevSpendingBalance = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+    auto const prevIssuerBalance = getDecryptedBalance(*arg.account, issuerEncryptedBalance);
+
+    if (!prevInboxBalance || !prevSpendingBalance || !prevIssuerBalance)
+        Throw<std::runtime_error>("Failed to get Pre-convertBack balance");
+
+    Buffer pedersenCommitment;
+    Buffer const pcBlindingFactor = generateBlindingFactor();
+    if (arg.pedersenCommitment)
+    {
+        pedersenCommitment = *arg.pedersenCommitment;
+    }
+    else
+    {
+        pedersenCommitment = getPedersenCommitment(*prevSpendingBalance, pcBlindingFactor);
+    }
+
+    jv[sfBalanceCommitment] = strHex(pedersenCommitment);
+
+    if (arg.proof)
+    {
+        jv[sfZKProof.jsonName] = strHex(*arg.proof);
+    }
+    else
+    {
+        auto const version = getMPTokenVersion(*arg.account);
+
+        // if the caller generated ciphertexts themselves, they should also
+        // generate the proof themselves from the blinding factor
+        auto const seq = arg.ticketSeq.value_or(env_.seq(*arg.account));
+        auto const contextHash = getConvertBackContextHash(
+            requireValue(arg.account, "account").id(), issuanceID(), seq, version);
+        auto const prevEncryptedSpendingBalance =
+            getEncryptedBalance(*arg.account, holderEncryptedSpending);
+
+        Buffer proof;
+        // generate a dummy proof if no encrypted amount field, so that other
+        // preflight/preclaim are checked
+        if (!prevEncryptedSpendingBalance)
+        {
+            proof = gMakeZeroBuffer(kEcConvertBackProofLength);
+        }
+        else
+        {
+            proof = getConvertBackProof(
+                *arg.account,
+                requireValue(arg.amt, "amt"),
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = *prevSpendingBalance,
+                    .encryptedAmt = *prevEncryptedSpendingBalance,
+                    .blindingFactor = pcBlindingFactor,
+                });
+        }
+        jv[sfZKProof] = strHex(proof);
+    }
+
+    auto const holderAmt = getBalance(*arg.account);
+    auto const prevConfidentialOutstanding = getIssuanceConfidentialBalance();
+
+    std::optional<uint64_t> prevAuditorBalance;
+    if (arg.auditorEncryptedAmt || auditor_)
+    {
+        prevAuditorBalance = getDecryptedBalance(*arg.account, auditorEncryptedBalance);
+        if (!prevAuditorBalance)
+            Throw<std::runtime_error>("Failed to get Pre-convertBack balance");
+    }
+
+    auto const prevOutstanding = getIssuanceOutstandingBalance();
+    auto const prevVersion = getMPTokenVersion(*arg.account);
+
+    if (submit(arg, jv) == tesSUCCESS)
+    {
+        auto const postConfidentialOutstanding = getIssuanceConfidentialBalance();
+        auto const postOutstanding = getIssuanceOutstandingBalance();
+        auto const postVersion = getMPTokenVersion(*arg.account);
+        env_.require(MptBalance(
+            *this, requireValue(arg.account, "account"), holderAmt + requireValue(arg.amt, "amt")));
+        env_.require(RequireAny([&]() -> bool {
+            return prevOutstanding && postOutstanding && *prevOutstanding == *postOutstanding;
+        }));
+        env_.require(RequireAny([&]() -> bool {
+            return prevConfidentialOutstanding - *arg.amt == postConfidentialOutstanding;
+        }));
+
+        auto const postInboxBalance = getDecryptedBalance(*arg.account, holderEncryptedInbox);
+        auto const postIssuerBalance = getDecryptedBalance(*arg.account, issuerEncryptedBalance);
+        auto const postSpendingBalance = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+
+        if (!postInboxBalance || !postIssuerBalance || !postSpendingBalance)
+            Throw<std::runtime_error>("Failed to get post-convertBack balance");
+
+        if (arg.auditorEncryptedAmt || auditor_)
+        {
+            auto const postAuditorBalance =
+                getDecryptedBalance(*arg.account, auditorEncryptedBalance);
+
+            if (!postAuditorBalance)
+                Throw<std::runtime_error>("Failed to get post-convertBack balance");
+
+            // auditor's encrypted balance is updated correctly
+            env_.require(RequireAny(
+                [&]() -> bool { return *prevAuditorBalance - *arg.amt == *postAuditorBalance; }));
+        }
+
+        // inbox balance should not change
+        env_.require(RequireAny([&]() -> bool { return *postInboxBalance == *prevInboxBalance; }));
+
+        // issuer's encrypted balance is updated correctly
+        env_.require(RequireAny(
+            [&]() -> bool { return *prevIssuerBalance - *arg.amt == *postIssuerBalance; }));
+
+        // holder's spending balance is updated correctly
+        env_.require(RequireAny(
+            [&]() -> bool { return *prevSpendingBalance - *arg.amt == *postSpendingBalance; }));
+
+        // holder's confidential balance version is updated correctly
+        env_.require(RequireAny([&]() -> bool { return postVersion == prevVersion + 1; }));
+
+        // sum of holder's inbox and spending balance should equal to issuer's
+        // encrypted balance
+        env_.require(RequireAny([&]() -> bool {
+            return *postInboxBalance + *postSpendingBalance == *postIssuerBalance;
+        }));
+    }
+}
+
+json::Value
+MPTTester::convertBackJV(MPTConvertBack const& arg, std::uint32_t seq)
+{
+    json::Value jv;
+    if (arg.account)
+    {
+        jv[sfAccount] = arg.account->human();
+    }
+    else
+    {
+        Throw<std::runtime_error>("Account not specified");
+    }
+
+    jv[jss::TransactionType] = jss::ConfidentialMPTConvertBack;
+    if (arg.id)
+    {
+        jv[sfMPTokenIssuanceID] = to_string(*arg.id);
+    }
+    else
+    {
+        if (!id_)
+            Throw<std::runtime_error>("MPT has not been created");
+        jv[sfMPTokenIssuanceID] = to_string(*id_);
+    }
+
+    if (arg.amt)
+        jv[sfMPTAmount.jsonName] = std::to_string(*arg.amt);
+
+    Buffer holderCiphertext;
+    Buffer issuerCiphertext;
+    std::optional<Buffer> auditorCiphertext;
+    Buffer blindingFactor;
+
+    fillConversionCiphertexts(
+        arg, jv, holderCiphertext, issuerCiphertext, auditorCiphertext, blindingFactor);
+
+    jv[sfBlindingFactor] = strHex(blindingFactor);
+
+    auto const prevSpendingBalance = getDecryptedBalance(*arg.account, holderEncryptedSpending);
+    if (!prevSpendingBalance)
+        Throw<std::runtime_error>("convertBackJV: failed to read spending balance from ledger");
+
+    Buffer pedersenCommitment;
+    Buffer const pcBlindingFactor = generateBlindingFactor();
+    if (arg.pedersenCommitment)
+    {
+        pedersenCommitment = *arg.pedersenCommitment;
+    }
+    else
+    {
+        pedersenCommitment = getPedersenCommitment(*prevSpendingBalance, pcBlindingFactor);
+    }
+
+    jv[sfBalanceCommitment] = strHex(pedersenCommitment);
+
+    if (arg.proof)
+    {
+        jv[sfZKProof.jsonName] = strHex(*arg.proof);
+    }
+    else
+    {
+        auto const version = getMPTokenVersion(*arg.account);
+        auto const prevEncSpending = getEncryptedBalance(*arg.account, holderEncryptedSpending);
+        auto const contextHash = getConvertBackContextHash(
+            requireValue(arg.account, "account").id(), issuanceID(), seq, version);
+
+        Buffer proof;
+        if (!prevEncSpending)
+        {
+            proof = gMakeZeroBuffer(kEcConvertBackProofLength);
+        }
+        else
+        {
+            proof = getConvertBackProof(
+                *arg.account,
+                requireValue(arg.amt, "amt"),
+                contextHash,
+                {
+                    .pedersenCommitment = pedersenCommitment,
+                    .amt = *prevSpendingBalance,
+                    .encryptedAmt = *prevEncSpending,
+                    .blindingFactor = pcBlindingFactor,
+                });
+        }
+
+        jv[sfZKProof] = strHex(proof);
+    }
+
+    return jv;
+}
+
 }  // namespace xrpl::test::jtx
diff --git a/src/test/jtx/impl/utility.cpp b/src/test/jtx/impl/utility.cpp
index 7da419c6e7..c298cee684 100644
--- a/src/test/jtx/impl/utility.cpp
+++ b/src/test/jtx/impl/utility.cpp
@@ -13,6 +13,7 @@
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STParsedJSON.h>
@@ -57,7 +58,22 @@ fillFee(json::Value& jv, ReadView const& view)
 {
     if (jv.isMember(jss::Fee))
         return;
-    jv[jss::Fee] = to_string(view.fees().base);
+
+    auto const base = view.fees().base;
+
+    // For confidential transactions, the fee is higher because confidential
+    // transaction processing is more expensive.
+    auto const txType = jv[jss::TransactionType].asString();
+    if (txType == jss::ConfidentialMPTConvert || txType == jss::ConfidentialMPTConvertBack ||
+        txType == jss::ConfidentialMPTSend || txType == jss::ConfidentialMPTMergeInbox ||
+        txType == jss::ConfidentialMPTClawback)
+    {
+        jv[jss::Fee] = to_string(base * (kConfidentialFeeMultiplier + 1));
+    }
+    else
+    {
+        jv[jss::Fee] = to_string(base);
+    }
 }
 
 void
diff --git a/src/test/jtx/mpt.h b/src/test/jtx/mpt.h
index c8a65d7541..d5fba82e08 100644
--- a/src/test/jtx/mpt.h
+++ b/src/test/jtx/mpt.h
@@ -2,12 +2,21 @@
 
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/delegate.h>
 #include <test/jtx/owners.h>
+#include <test/jtx/tag.h>
 #include <test/jtx/ter.h>
+#include <test/jtx/ticket.h>
 #include <test/jtx/txflags.h>
 
+#include <xrpl/protocol/ConfidentialTransfer.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
 
 namespace xrpl::test::jtx {
 
@@ -15,7 +24,28 @@ class MPTTester;
 
 auto const kMptDexFlags = tfMPTCanTrade | tfMPTCanTransfer;
 
-// Check flags settings on MPT create
+/**
+ * @brief Create a zero-initialized buffer for malformed cryptography test
+ * inputs.
+ *
+ * xrpl::Buffer(size) allocates uninitialized heap memory. Because CI runs unit
+ * tests sequentially in the same process, uninitialized memory can recycle
+ * valid secp256k1 keys or Pedersen commitments from earlier tests. Explicitly
+ * zeroing the buffer guarantees structural validation fails deterministically.
+ *
+ * @param size The number of zero bytes to allocate.
+ * @return A buffer containing size zero bytes.
+ */
+[[nodiscard]] inline Buffer
+gMakeZeroBuffer(std::size_t size)
+{
+    Buffer b(size);
+    if (size > 0)
+        std::memset(b.data(), 0, size);
+    return b;
+}
+
+/** @brief Test helper that checks MPT flag settings after creation. */
 class MptFlags
 {
 private:
@@ -36,7 +66,7 @@ public:
     operator()(Env& env) const;
 };
 
-// Check mptissuance or mptoken amount balances on payment
+/** @brief Test helper that checks MPT issuance or holder balances. */
 class MptBalance
 {
 private:
@@ -54,6 +84,7 @@ public:
     operator()(Env& env) const;
 };
 
+/** @brief Test helper that accepts any condition supplied by a callback. */
 class RequireAny
 {
 private:
@@ -70,6 +101,7 @@ public:
 
 using Holders = std::vector<Account>;
 
+/** @brief Arguments for building an MPTokenIssuanceCreate test transaction. */
 struct MPTCreate
 {
     static inline std::vector<Account> allHolders = {};
@@ -93,9 +125,13 @@ struct MPTCreate
     std::optional<TER> err = std::nullopt;
 };
 
+/** @brief Arguments for initializing funded MPT test accounts and issuance. */
 struct MPTInit
 {
+    // Default-initialized so designated-initializer call sites that omit
+    // `holders` don't trip GCC's -Werror=missing-field-initializers.
     Holders holders = {};  // NOLINT(readability-redundant-member-init)
+    std::optional<Account> auditor = std::nullopt;
     PrettyAmount const xrp = XRP(10'000);
     PrettyAmount const xrpHolders = XRP(10'000);
     bool fund = true;
@@ -105,11 +141,13 @@ struct MPTInit
 };
 static MPTInit const kMptInitNoFund{.fund = false};
 
+/** @brief Full constructor arguments for MPTTester initialization. */
 struct MPTInitDef
 {
     Env& env;
     Account issuer;
     Holders holders = {};  // NOLINT(readability-redundant-member-init)
+    std::optional<Account> auditor = std::nullopt;
     std::uint16_t transferFee = 0;
     std::optional<std::uint64_t> pay = std::nullopt;
     std::uint32_t flags = kMptDexFlags;
@@ -121,6 +159,7 @@ struct MPTInitDef
     std::optional<TER> err = std::nullopt;
 };
 
+/** @brief Arguments for building an MPTokenIssuanceDestroy test transaction. */
 struct MPTDestroy
 {
     std::optional<Account> issuer = std::nullopt;
@@ -131,6 +170,7 @@ struct MPTDestroy
     std::optional<TER> err = std::nullopt;
 };
 
+/** @brief Arguments for building an MPTokenAuthorize test transaction. */
 struct MPTAuthorize
 {
     std::optional<Account> account = std::nullopt;
@@ -142,6 +182,7 @@ struct MPTAuthorize
     std::optional<TER> err = std::nullopt;
 };
 
+/** @brief Arguments for building an MPTokenIssuanceSet test transaction. */
 struct MPTSet
 {
     std::optional<Account> account = std::nullopt;
@@ -155,18 +196,215 @@ struct MPTSet
     std::optional<std::string> metadata = std::nullopt;
     std::optional<Account> delegate = std::nullopt;
     std::optional<uint256> domainID = std::nullopt;
+    std::optional<Buffer> issuerPubKey = std::nullopt;
+    std::optional<Buffer> auditorPubKey = std::nullopt;
+    std::optional<std::uint32_t> ticketSeq = std::nullopt;
     std::optional<TER> err = std::nullopt;
 };
 
+/** @brief Arguments for building a ConfidentialMPTConvert test transaction. */
+struct MPTConvert
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    std::optional<std::uint64_t> amt = std::nullopt;
+    std::optional<std::string> proof = std::nullopt;
+    std::optional<bool> fillAuditorEncryptedAmt = true;
+    // indicates whether to autofill schnorr proof.
+    // default : auto generate proof if holderPubKey is present.
+    // true: force proof generation.
+    // false: force proof omission.
+    std::optional<bool> fillSchnorrProof = std::nullopt;
+    std::optional<Buffer> holderPubKey = std::nullopt;
+    std::optional<Buffer> holderEncryptedAmt = std::nullopt;
+    std::optional<Buffer> issuerEncryptedAmt = std::nullopt;
+    std::optional<Buffer> auditorEncryptedAmt = std::nullopt;
+
+    std::optional<Buffer> blindingFactor = std::nullopt;
+    std::optional<Account> delegate = std::nullopt;
+    std::optional<std::uint32_t> ticketSeq = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<XRPAmount> fee = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+/** @brief Arguments for building a ConfidentialMPTMergeInbox test transaction. */
+struct MPTMergeInbox
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    std::optional<Account> delegate = std::nullopt;
+    std::optional<std::uint32_t> ticketSeq = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<XRPAmount> fee = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+/** @brief Arguments for building a ConfidentialMPTSend test transaction. */
+struct MPTConfidentialSend
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<Account> dest = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    // amt is to generate encrypted amounts for testing purposes
+    std::optional<std::uint64_t> amt = std::nullopt;
+    std::optional<std::string> proof = std::nullopt;
+    std::optional<Buffer> senderEncryptedAmt = std::nullopt;
+    std::optional<Buffer> destEncryptedAmt = std::nullopt;
+    std::optional<Buffer> issuerEncryptedAmt = std::nullopt;
+    std::optional<Buffer> auditorEncryptedAmt = std::nullopt;
+    std::optional<bool> fillAuditorEncryptedAmt = true;
+    std::optional<std::vector<std::string>> credentials = std::nullopt;
+    // not an txn param, only used for autofilling
+    std::optional<Buffer> blindingFactor = std::nullopt;
+    std::optional<Buffer> amountCommitment = std::nullopt;
+    std::optional<Buffer> balanceCommitment = std::nullopt;
+    std::optional<Account> delegate = std::nullopt;
+    std::optional<std::uint32_t> destinationTag = std::nullopt;
+    std::optional<std::uint32_t> ticketSeq = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<XRPAmount> fee = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+/** @brief Arguments for building a ConfidentialMPTConvertBack test transaction. */
+struct MPTConvertBack
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    std::optional<std::uint64_t> amt = std::nullopt;
+    std::optional<Buffer> proof = std::nullopt;
+    std::optional<Buffer> holderEncryptedAmt = std::nullopt;
+    std::optional<Buffer> issuerEncryptedAmt = std::nullopt;
+    std::optional<Buffer> auditorEncryptedAmt = std::nullopt;
+    std::optional<bool> fillAuditorEncryptedAmt = true;
+    // not an txn param, only used for autofilling
+    std::optional<Buffer> blindingFactor = std::nullopt;
+    std::optional<Buffer> pedersenCommitment = std::nullopt;
+    std::optional<Account> delegate = std::nullopt;
+    std::optional<std::uint32_t> ticketSeq = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<XRPAmount> fee = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+/** @brief Arguments for building a ConfidentialMPTClawback test transaction. */
+struct MPTConfidentialClawback
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<Account> holder = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    std::optional<std::uint64_t> amt = std::nullopt;
+    std::optional<std::string> proof = std::nullopt;
+    std::optional<Account> delegate = std::nullopt;
+    std::optional<std::uint32_t> ticketSeq = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<XRPAmount> fee = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+/**
+ * @brief Stores the parameters that are exclusively used to generate a
+ * Pedersen linkage proof.
+ */
+struct PedersenProofParams
+{
+    /** @brief The Pedersen commitment used by the proof. */
+    Buffer const pedersenCommitment;
+
+    /** @brief Either the spending balance or the value being transferred. */
+    uint64_t const amt;
+
+    /** @brief The encrypted amount linked to the Pedersen commitment. */
+    Buffer const encryptedAmt;
+
+    /** @brief The blinding factor used to create the Pedersen commitment. */
+    Buffer const blindingFactor;
+};
+
+/**
+ * @brief When building multiple confidential sends from the same account inside a
+ * single batch transaction, pass this state to the transaction builder for
+ * each subsequent send so that its proof references the post previous-send
+ * encrypted balance rather than the stale pre-send ledger state.
+ *
+ * The fields mirror what the ledger will contain after the preceding send's
+ * doApply() completes:
+ *   encSpending = homomorphicSubtract(prevEncSpending, senderEncAmt)
+ *   version     = prevVersion + 1
+ */
+struct ConfidentialSendChainState
+{
+    /** @brief Decrypted spending balance after the previous send. */
+    std::uint64_t spending;
+
+    /** @brief Encrypted spending balance after the previous send. */
+    Buffer encSpending;
+
+    /** @brief sfConfidentialBalanceVersion after the previous send. */
+    std::uint32_t version;
+};
+
+/**
+ * @brief Use this when building a second (or later) confidential send from the same
+ * account in the same batch. Pass the state to the chain aware
+ * transaction builder so that the next proof is constructed against the
+ * correct post-send encrypted balance and version.
+ *
+ * @param currentSpending     Decrypted spending balance before the send.
+ * @param currentEncSpending  sfConfidentialBalanceSpending before the send.
+ * @param currentVersion      sfConfidentialBalanceVersion before the send.
+ * @param sendAmt             Plaintext amount being sent.
+ * @param senderEncAmt        sfSenderEncryptedAmount from the send transaction.
+ * @return The predicted chain state, or std::nullopt if homomorphic
+ *         subtraction fails.
+ */
+std::optional<ConfidentialSendChainState>
+computeNextSendChainState(
+    std::uint64_t currentSpending,
+    Slice const& currentEncSpending,
+    std::uint32_t currentVersion,
+    std::uint64_t sendAmt,
+    Slice const& senderEncAmt);
+
+/**
+ * @brief Test helper for creating, mutating, and asserting MPT and confidential
+ * MPT ledger state.
+ */
 class MPTTester
 {
     Env& env_;
     Account const issuer_;
     std::unordered_map<std::string, Account> const holders_;
+    std::optional<Account> const auditor_;
     std::optional<MPTID> id_;
     bool close_;
+    std::unordered_map<AccountID, Buffer> pubKeys_;
+    std::unordered_map<AccountID, Buffer> privKeys_;
 
 public:
+    enum class EncryptedBalanceType {
+        IssuerEncryptedBalance,
+        HolderEncryptedInbox,
+        HolderEncryptedSpending,
+        AuditorEncryptedBalance,
+    };
+
+    static constexpr auto issuerEncryptedBalance = EncryptedBalanceType::IssuerEncryptedBalance;
+    static constexpr auto holderEncryptedInbox = EncryptedBalanceType::HolderEncryptedInbox;
+    static constexpr auto holderEncryptedSpending = EncryptedBalanceType::HolderEncryptedSpending;
+    static constexpr auto auditorEncryptedBalance = EncryptedBalanceType::AuditorEncryptedBalance;
+
     MPTTester(Env& env, Account issuer, MPTInit const& constr = {});
     MPTTester(MPTInitDef const& constr);
     MPTTester(
@@ -204,6 +442,83 @@ public:
     static json::Value
     setJV(MPTSet const& set = {});
 
+    void
+    convert(MPTConvert const& arg = MPTConvert{});
+
+    /**
+     * @brief Build a confidential convert JV without submitting it.
+     *
+     * @param arg Transaction builder arguments.
+     * @param seq Inner transaction sequence used in the Schnorr proof context
+     *            hash.
+     * @return The transaction JSON object.
+     */
+    json::Value
+    convertJV(MPTConvert const& arg, std::uint32_t seq);
+
+    void
+    mergeInbox(MPTMergeInbox const& arg = MPTMergeInbox{});
+
+    [[nodiscard]] json::Value
+    mergeInboxJV(MPTMergeInbox const& arg = MPTMergeInbox{}) const;
+
+    void
+    send(MPTConfidentialSend const& arg = MPTConfidentialSend{});
+
+    /**
+     * @brief Build a confidential send JV.
+     *
+     * When chain is provided, the sender's proof parameters are taken from it
+     * instead of the ledger, enabling proof generation for a second or later
+     * send from the same account inside a single batch.
+     *
+     * @param arg Transaction builder arguments.
+     * @param seq Inner transaction sequence used in the proof context hash.
+     * @param chain Optional predicted sender state from a previous batched
+     *              send.
+     * @return The transaction JSON object.
+     */
+    json::Value
+    sendJV(
+        MPTConfidentialSend const& arg,
+        std::uint32_t seq,
+        std::optional<ConfidentialSendChainState> chain = std::nullopt);
+
+    /**
+     * @brief Compute the projected sender state after a confidential send in a
+     * batch.
+     *
+     * Each confidential send requires a ZK proof that the sender's spending
+     * balance covers the transfer. In a batch, the second and later sends from
+     * the same sender need proofs built against the updated spending balance.
+     *
+     * @param sender The sender whose post-send state is being predicted.
+     * @param sendAmt The plaintext amount sent by the transaction.
+     * @param jv The confidential send transaction JSON object.
+     * @return The predicted sender state after applying the send.
+     */
+    [[nodiscard]] ConfidentialSendChainState
+    chainAfterSend(Account const& sender, std::uint64_t sendAmt, json::Value const& jv) const;
+
+    void
+    convertBack(MPTConvertBack const& arg = MPTConvertBack{});
+
+    /**
+     * @brief Build a confidential convertBack JV without submitting it.
+     *
+     * Reads the current encrypted spending balance and version from the ledger,
+     * so call this before the batch is submitted.
+     *
+     * @param arg Transaction builder arguments.
+     * @param seq Inner transaction sequence used in the proof context hash.
+     * @return The transaction JSON object.
+     */
+    json::Value
+    convertBackJV(MPTConvertBack const& arg, std::uint32_t seq);
+
+    void
+    confidentialClaw(MPTConfidentialClawback const& arg = MPTConfidentialClawback{});
+
     [[nodiscard]] bool
     checkDomainID(std::optional<uint256> expected) const;
 
@@ -213,6 +528,9 @@ public:
     [[nodiscard]] bool
     checkMPTokenOutstandingAmount(std::int64_t expectedAmount) const;
 
+    [[nodiscard]] bool
+    checkIssuanceConfidentialBalance(std::int64_t expectedAmount) const;
+
     [[nodiscard]] bool
     checkFlags(uint32_t const expectedFlags, std::optional<Account> const& holder = std::nullopt)
         const;
@@ -265,6 +583,13 @@ public:
     [[nodiscard]] std::int64_t
     getBalance(Account const& account) const;
 
+    [[nodiscard]] std::int64_t
+    getIssuanceConfidentialBalance() const;
+
+    [[nodiscard]] std::optional<Buffer>
+    getEncryptedBalance(Account const& account, EncryptedBalanceType option = holderEncryptedInbox)
+        const;
+
     MPT
     operator[](std::string const& name) const;
 
@@ -273,6 +598,60 @@ public:
 
     operator Asset() const;
 
+    void
+    generateKeyPair(Account const& account);
+
+    [[nodiscard]] std::optional<Buffer>
+    getPubKey(Account const& account) const;
+
+    [[nodiscard]] std::optional<Buffer>
+    getPrivKey(Account const& account) const;
+
+    [[nodiscard]] Buffer
+    encryptAmount(Account const& account, uint64_t const amt, Buffer const& blindingFactor) const;
+
+    [[nodiscard]] std::optional<uint64_t>
+    decryptAmount(Account const& account, Buffer const& amt) const;
+
+    [[nodiscard]] std::optional<uint64_t>
+    getDecryptedBalance(Account const& account, EncryptedBalanceType balanceType) const;
+
+    [[nodiscard]] std::optional<std::int64_t>
+    getIssuanceOutstandingBalance() const;
+
+    [[nodiscard]] std::optional<Buffer>
+    getClawbackProof(
+        Account const& holder,
+        std::uint64_t amount,
+        Buffer const& privateKey,
+        uint256 const& txHash) const;
+
+    [[nodiscard]] std::optional<Buffer>
+    getSchnorrProof(Account const& account, uint256 const& ctxHash) const;
+
+    [[nodiscard]] std::optional<Buffer>
+    getConfidentialSendProof(
+        Account const& sender,
+        std::uint64_t const amount,
+        std::vector<ConfidentialRecipient> const& recipients,
+        Slice const& blindingFactor,
+        uint256 const& contextHash,
+        PedersenProofParams const& amountParams,
+        PedersenProofParams const& balanceParams) const;
+
+    [[nodiscard]] Buffer
+    getConvertBackProof(
+        Account const& holder,
+        std::uint64_t const amount,
+        uint256 const& contextHash,
+        PedersenProofParams const& pcParams) const;
+
+    [[nodiscard]] std::uint32_t
+    getMPTokenVersion(Account const account) const;
+
+    static Buffer
+    getPedersenCommitment(std::uint64_t const amount, Buffer const& pedersenBlindingFactor);
+
     friend BookSpec
     operator~(MPTTester const& mpt)
     {
@@ -288,9 +667,54 @@ private:
 
     template <typename A>
     TER
-    submit(A const& arg, json::Value const& jv)
+    submit(A const& arg, json::Value jv)
     {
-        env_(jv, Txflags(arg.flags.value_or(0)), Ter(arg.err.value_or(tesSUCCESS)));
+        auto const expectedFlags = Txflags(arg.flags.value_or(0));
+        auto const expectedTer = Ter(arg.err.value_or(tesSUCCESS));
+
+        if constexpr (requires { arg.fee; })
+        {
+            if (arg.fee)
+                jv[jss::Fee] = to_string(*arg.fee);
+        }
+
+        std::optional<std::uint32_t> ticketSeq;
+        if constexpr (requires { arg.ticketSeq; })
+            ticketSeq = arg.ticketSeq;
+
+        std::optional<Account> delegateAcct;
+        if constexpr (requires { arg.delegate; })
+            delegateAcct = arg.delegate;
+
+        std::optional<std::uint32_t> dstTag;
+        if constexpr (requires { arg.destinationTag; })
+            dstTag = arg.destinationTag;
+
+        if (ticketSeq && delegateAcct)
+        {
+            env_(
+                jv,
+                expectedFlags,
+                expectedTer,
+                ticket::Use(*ticketSeq),
+                delegate::As(*delegateAcct));
+        }
+        else if (ticketSeq)
+        {
+            env_(jv, expectedFlags, expectedTer, ticket::Use(*ticketSeq));
+        }
+        else if (delegateAcct)
+        {
+            env_(jv, expectedFlags, expectedTer, delegate::As(*delegateAcct));
+        }
+        else if (dstTag)
+        {
+            env_(jv, expectedFlags, expectedTer, Dtag(*dstTag));
+        }
+        else
+        {
+            env_(jv, expectedFlags, expectedTer);
+        }
         auto const err = env_.ter();
         if (close_)
             env_.close();
@@ -309,6 +733,16 @@ private:
 
     [[nodiscard]] std::uint32_t
     getFlags(std::optional<Account> const& holder) const;
+
+    template <typename T>
+    void
+    fillConversionCiphertexts(
+        T const& arg,
+        json::Value& jv,
+        Buffer& holderCiphertext,
+        Buffer& issuerCiphertext,
+        std::optional<Buffer>& auditorCiphertext,
+        Buffer& blindingFactor) const;
 };
 
 }  // namespace xrpl::test::jtx
diff --git a/src/tests/libxrpl/protocol_autogen/ledger_entries/MPTokenIssuanceTests.cpp b/src/tests/libxrpl/protocol_autogen/ledger_entries/MPTokenIssuanceTests.cpp
index 7479f0c63c..8dc5960ee0 100644
--- a/src/tests/libxrpl/protocol_autogen/ledger_entries/MPTokenIssuanceTests.cpp
+++ b/src/tests/libxrpl/protocol_autogen/ledger_entries/MPTokenIssuanceTests.cpp
@@ -34,6 +34,9 @@ TEST(MPTokenIssuanceTests, BuilderSettersRoundTrip)
     auto const domainIDValue = canonical_UINT256();
     auto const mutableFlagsValue = canonical_UINT32();
     auto const referenceHoldingValue = canonical_UINT256();
+    auto const issuerEncryptionKeyValue = canonical_VL();
+    auto const auditorEncryptionKeyValue = canonical_VL();
+    auto const confidentialOutstandingAmountValue = canonical_UINT64();
 
     MPTokenIssuanceBuilder builder{
         issuerValue,
@@ -52,6 +55,9 @@ TEST(MPTokenIssuanceTests, BuilderSettersRoundTrip)
     builder.setDomainID(domainIDValue);
     builder.setMutableFlags(mutableFlagsValue);
     builder.setReferenceHolding(referenceHoldingValue);
+    builder.setIssuerEncryptionKey(issuerEncryptionKeyValue);
+    builder.setAuditorEncryptionKey(auditorEncryptionKeyValue);
+    builder.setConfidentialOutstandingAmount(confidentialOutstandingAmountValue);
 
     builder.setLedgerIndex(index);
     builder.setFlags(0x1u);
@@ -162,6 +168,30 @@ TEST(MPTokenIssuanceTests, BuilderSettersRoundTrip)
         EXPECT_TRUE(entry.hasReferenceHolding());
     }
 
+    {
+        auto const& expected = issuerEncryptionKeyValue;
+        auto const actualOpt = entry.getIssuerEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfIssuerEncryptionKey");
+        EXPECT_TRUE(entry.hasIssuerEncryptionKey());
+    }
+
+    {
+        auto const& expected = auditorEncryptionKeyValue;
+        auto const actualOpt = entry.getAuditorEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptionKey");
+        EXPECT_TRUE(entry.hasAuditorEncryptionKey());
+    }
+
+    {
+        auto const& expected = confidentialOutstandingAmountValue;
+        auto const actualOpt = entry.getConfidentialOutstandingAmount();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfConfidentialOutstandingAmount");
+        EXPECT_TRUE(entry.hasConfidentialOutstandingAmount());
+    }
+
     EXPECT_TRUE(entry.hasLedgerIndex());
     auto const ledgerIndex = entry.getLedgerIndex();
     ASSERT_TRUE(ledgerIndex.has_value());
@@ -189,6 +219,9 @@ TEST(MPTokenIssuanceTests, BuilderFromSleRoundTrip)
     auto const domainIDValue = canonical_UINT256();
     auto const mutableFlagsValue = canonical_UINT32();
     auto const referenceHoldingValue = canonical_UINT256();
+    auto const issuerEncryptionKeyValue = canonical_VL();
+    auto const auditorEncryptionKeyValue = canonical_VL();
+    auto const confidentialOutstandingAmountValue = canonical_UINT64();
 
     auto sle = std::make_shared<SLE>(MPTokenIssuance::entryType, index);
 
@@ -206,6 +239,9 @@ TEST(MPTokenIssuanceTests, BuilderFromSleRoundTrip)
     sle->at(sfDomainID) = domainIDValue;
     sle->at(sfMutableFlags) = mutableFlagsValue;
     sle->at(sfReferenceHolding) = referenceHoldingValue;
+    sle->at(sfIssuerEncryptionKey) = issuerEncryptionKeyValue;
+    sle->at(sfAuditorEncryptionKey) = auditorEncryptionKeyValue;
+    sle->at(sfConfidentialOutstandingAmount) = confidentialOutstandingAmountValue;
 
     MPTokenIssuanceBuilder builderFromSle{sle};
     EXPECT_TRUE(builderFromSle.validate());
@@ -380,6 +416,45 @@ TEST(MPTokenIssuanceTests, BuilderFromSleRoundTrip)
         expectEqualField(expected, *fromBuilderOpt, "sfReferenceHolding");
     }
 
+    {
+        auto const& expected = issuerEncryptionKeyValue;
+
+        auto const fromSleOpt = entryFromSle.getIssuerEncryptionKey();
+        auto const fromBuilderOpt = entryFromBuilder.getIssuerEncryptionKey();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfIssuerEncryptionKey");
+        expectEqualField(expected, *fromBuilderOpt, "sfIssuerEncryptionKey");
+    }
+
+    {
+        auto const& expected = auditorEncryptionKeyValue;
+
+        auto const fromSleOpt = entryFromSle.getAuditorEncryptionKey();
+        auto const fromBuilderOpt = entryFromBuilder.getAuditorEncryptionKey();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfAuditorEncryptionKey");
+        expectEqualField(expected, *fromBuilderOpt, "sfAuditorEncryptionKey");
+    }
+
+    {
+        auto const& expected = confidentialOutstandingAmountValue;
+
+        auto const fromSleOpt = entryFromSle.getConfidentialOutstandingAmount();
+        auto const fromBuilderOpt = entryFromBuilder.getConfidentialOutstandingAmount();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfConfidentialOutstandingAmount");
+        expectEqualField(expected, *fromBuilderOpt, "sfConfidentialOutstandingAmount");
+    }
+
     EXPECT_EQ(entryFromSle.getKey(), index);
     EXPECT_EQ(entryFromBuilder.getKey(), index);
 }
@@ -460,5 +535,11 @@ TEST(MPTokenIssuanceTests, OptionalFieldsReturnNullopt)
     EXPECT_FALSE(entry.getMutableFlags().has_value());
     EXPECT_FALSE(entry.hasReferenceHolding());
     EXPECT_FALSE(entry.getReferenceHolding().has_value());
+    EXPECT_FALSE(entry.hasIssuerEncryptionKey());
+    EXPECT_FALSE(entry.getIssuerEncryptionKey().has_value());
+    EXPECT_FALSE(entry.hasAuditorEncryptionKey());
+    EXPECT_FALSE(entry.getAuditorEncryptionKey().has_value());
+    EXPECT_FALSE(entry.hasConfidentialOutstandingAmount());
+    EXPECT_FALSE(entry.getConfidentialOutstandingAmount().has_value());
 }
 }
diff --git a/src/tests/libxrpl/protocol_autogen/ledger_entries/MPTokenTests.cpp b/src/tests/libxrpl/protocol_autogen/ledger_entries/MPTokenTests.cpp
index c104e7b365..7db4b638a7 100644
--- a/src/tests/libxrpl/protocol_autogen/ledger_entries/MPTokenTests.cpp
+++ b/src/tests/libxrpl/protocol_autogen/ledger_entries/MPTokenTests.cpp
@@ -27,6 +27,12 @@ TEST(MPTokenTests, BuilderSettersRoundTrip)
     auto const ownerNodeValue = canonical_UINT64();
     auto const previousTxnIDValue = canonical_UINT256();
     auto const previousTxnLgrSeqValue = canonical_UINT32();
+    auto const confidentialBalanceInboxValue = canonical_VL();
+    auto const confidentialBalanceSpendingValue = canonical_VL();
+    auto const confidentialBalanceVersionValue = canonical_UINT32();
+    auto const issuerEncryptedBalanceValue = canonical_VL();
+    auto const auditorEncryptedBalanceValue = canonical_VL();
+    auto const holderEncryptionKeyValue = canonical_VL();
 
     MPTokenBuilder builder{
         accountValue,
@@ -38,6 +44,12 @@ TEST(MPTokenTests, BuilderSettersRoundTrip)
 
     builder.setMPTAmount(mPTAmountValue);
     builder.setLockedAmount(lockedAmountValue);
+    builder.setConfidentialBalanceInbox(confidentialBalanceInboxValue);
+    builder.setConfidentialBalanceSpending(confidentialBalanceSpendingValue);
+    builder.setConfidentialBalanceVersion(confidentialBalanceVersionValue);
+    builder.setIssuerEncryptedBalance(issuerEncryptedBalanceValue);
+    builder.setAuditorEncryptedBalance(auditorEncryptedBalanceValue);
+    builder.setHolderEncryptionKey(holderEncryptionKeyValue);
 
     builder.setLedgerIndex(index);
     builder.setFlags(0x1u);
@@ -94,6 +106,54 @@ TEST(MPTokenTests, BuilderSettersRoundTrip)
         EXPECT_TRUE(entry.hasLockedAmount());
     }
 
+    {
+        auto const& expected = confidentialBalanceInboxValue;
+        auto const actualOpt = entry.getConfidentialBalanceInbox();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfConfidentialBalanceInbox");
+        EXPECT_TRUE(entry.hasConfidentialBalanceInbox());
+    }
+
+    {
+        auto const& expected = confidentialBalanceSpendingValue;
+        auto const actualOpt = entry.getConfidentialBalanceSpending();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfConfidentialBalanceSpending");
+        EXPECT_TRUE(entry.hasConfidentialBalanceSpending());
+    }
+
+    {
+        auto const& expected = confidentialBalanceVersionValue;
+        auto const actualOpt = entry.getConfidentialBalanceVersion();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfConfidentialBalanceVersion");
+        EXPECT_TRUE(entry.hasConfidentialBalanceVersion());
+    }
+
+    {
+        auto const& expected = issuerEncryptedBalanceValue;
+        auto const actualOpt = entry.getIssuerEncryptedBalance();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfIssuerEncryptedBalance");
+        EXPECT_TRUE(entry.hasIssuerEncryptedBalance());
+    }
+
+    {
+        auto const& expected = auditorEncryptedBalanceValue;
+        auto const actualOpt = entry.getAuditorEncryptedBalance();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptedBalance");
+        EXPECT_TRUE(entry.hasAuditorEncryptedBalance());
+    }
+
+    {
+        auto const& expected = holderEncryptionKeyValue;
+        auto const actualOpt = entry.getHolderEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfHolderEncryptionKey");
+        EXPECT_TRUE(entry.hasHolderEncryptionKey());
+    }
+
     EXPECT_TRUE(entry.hasLedgerIndex());
     auto const ledgerIndex = entry.getLedgerIndex();
     ASSERT_TRUE(ledgerIndex.has_value());
@@ -114,6 +174,12 @@ TEST(MPTokenTests, BuilderFromSleRoundTrip)
     auto const ownerNodeValue = canonical_UINT64();
     auto const previousTxnIDValue = canonical_UINT256();
     auto const previousTxnLgrSeqValue = canonical_UINT32();
+    auto const confidentialBalanceInboxValue = canonical_VL();
+    auto const confidentialBalanceSpendingValue = canonical_VL();
+    auto const confidentialBalanceVersionValue = canonical_UINT32();
+    auto const issuerEncryptedBalanceValue = canonical_VL();
+    auto const auditorEncryptedBalanceValue = canonical_VL();
+    auto const holderEncryptionKeyValue = canonical_VL();
 
     auto sle = std::make_shared<SLE>(MPToken::entryType, index);
 
@@ -124,6 +190,12 @@ TEST(MPTokenTests, BuilderFromSleRoundTrip)
     sle->at(sfOwnerNode) = ownerNodeValue;
     sle->at(sfPreviousTxnID) = previousTxnIDValue;
     sle->at(sfPreviousTxnLgrSeq) = previousTxnLgrSeqValue;
+    sle->at(sfConfidentialBalanceInbox) = confidentialBalanceInboxValue;
+    sle->at(sfConfidentialBalanceSpending) = confidentialBalanceSpendingValue;
+    sle->at(sfConfidentialBalanceVersion) = confidentialBalanceVersionValue;
+    sle->at(sfIssuerEncryptedBalance) = issuerEncryptedBalanceValue;
+    sle->at(sfAuditorEncryptedBalance) = auditorEncryptedBalanceValue;
+    sle->at(sfHolderEncryptionKey) = holderEncryptionKeyValue;
 
     MPTokenBuilder builderFromSle{sle};
     EXPECT_TRUE(builderFromSle.validate());
@@ -210,6 +282,84 @@ TEST(MPTokenTests, BuilderFromSleRoundTrip)
         expectEqualField(expected, *fromBuilderOpt, "sfLockedAmount");
     }
 
+    {
+        auto const& expected = confidentialBalanceInboxValue;
+
+        auto const fromSleOpt = entryFromSle.getConfidentialBalanceInbox();
+        auto const fromBuilderOpt = entryFromBuilder.getConfidentialBalanceInbox();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfConfidentialBalanceInbox");
+        expectEqualField(expected, *fromBuilderOpt, "sfConfidentialBalanceInbox");
+    }
+
+    {
+        auto const& expected = confidentialBalanceSpendingValue;
+
+        auto const fromSleOpt = entryFromSle.getConfidentialBalanceSpending();
+        auto const fromBuilderOpt = entryFromBuilder.getConfidentialBalanceSpending();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfConfidentialBalanceSpending");
+        expectEqualField(expected, *fromBuilderOpt, "sfConfidentialBalanceSpending");
+    }
+
+    {
+        auto const& expected = confidentialBalanceVersionValue;
+
+        auto const fromSleOpt = entryFromSle.getConfidentialBalanceVersion();
+        auto const fromBuilderOpt = entryFromBuilder.getConfidentialBalanceVersion();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfConfidentialBalanceVersion");
+        expectEqualField(expected, *fromBuilderOpt, "sfConfidentialBalanceVersion");
+    }
+
+    {
+        auto const& expected = issuerEncryptedBalanceValue;
+
+        auto const fromSleOpt = entryFromSle.getIssuerEncryptedBalance();
+        auto const fromBuilderOpt = entryFromBuilder.getIssuerEncryptedBalance();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfIssuerEncryptedBalance");
+        expectEqualField(expected, *fromBuilderOpt, "sfIssuerEncryptedBalance");
+    }
+
+    {
+        auto const& expected = auditorEncryptedBalanceValue;
+
+        auto const fromSleOpt = entryFromSle.getAuditorEncryptedBalance();
+        auto const fromBuilderOpt = entryFromBuilder.getAuditorEncryptedBalance();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfAuditorEncryptedBalance");
+        expectEqualField(expected, *fromBuilderOpt, "sfAuditorEncryptedBalance");
+    }
+
+    {
+        auto const& expected = holderEncryptionKeyValue;
+
+        auto const fromSleOpt = entryFromSle.getHolderEncryptionKey();
+        auto const fromBuilderOpt = entryFromBuilder.getHolderEncryptionKey();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfHolderEncryptionKey");
+        expectEqualField(expected, *fromBuilderOpt, "sfHolderEncryptionKey");
+    }
+
     EXPECT_EQ(entryFromSle.getKey(), index);
     EXPECT_EQ(entryFromBuilder.getKey(), index);
 }
@@ -276,5 +426,17 @@ TEST(MPTokenTests, OptionalFieldsReturnNullopt)
     EXPECT_FALSE(entry.getMPTAmount().has_value());
     EXPECT_FALSE(entry.hasLockedAmount());
     EXPECT_FALSE(entry.getLockedAmount().has_value());
+    EXPECT_FALSE(entry.hasConfidentialBalanceInbox());
+    EXPECT_FALSE(entry.getConfidentialBalanceInbox().has_value());
+    EXPECT_FALSE(entry.hasConfidentialBalanceSpending());
+    EXPECT_FALSE(entry.getConfidentialBalanceSpending().has_value());
+    EXPECT_FALSE(entry.hasConfidentialBalanceVersion());
+    EXPECT_FALSE(entry.getConfidentialBalanceVersion().has_value());
+    EXPECT_FALSE(entry.hasIssuerEncryptedBalance());
+    EXPECT_FALSE(entry.getIssuerEncryptedBalance().has_value());
+    EXPECT_FALSE(entry.hasAuditorEncryptedBalance());
+    EXPECT_FALSE(entry.getAuditorEncryptedBalance().has_value());
+    EXPECT_FALSE(entry.hasHolderEncryptionKey());
+    EXPECT_FALSE(entry.getHolderEncryptionKey().has_value());
 }
 }
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTClawbackTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTClawbackTests.cpp
new file mode 100644
index 0000000000..611bc18465
--- /dev/null
+++ b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTClawbackTests.cpp
@@ -0,0 +1,194 @@
+// Auto-generated unit tests for transaction ConfidentialMPTClawback
+
+
+#include <gtest/gtest.h>
+
+#include <protocol_autogen/TestHelpers.h>
+
+#include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Seed.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h>
+#include <xrpl/protocol_autogen/transactions/AccountSet.h>
+
+#include <string>
+
+namespace xrpl::transactions {
+
+// 1 & 4) Set fields via builder setters, build, then read them back via
+// wrapper getters. After build(), validate() should succeed.
+TEST(TransactionsConfidentialMPTClawbackTests, BuilderSettersRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTClawback"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 1;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const holderValue = canonical_ACCOUNT();
+    auto const mPTAmountValue = canonical_UINT64();
+    auto const zKProofValue = canonical_VL();
+
+    ConfidentialMPTClawbackBuilder builder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        holderValue,
+        mPTAmountValue,
+        zKProofValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Set optional fields
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(tx.validate(reason)) << reason;
+
+    // Verify signing was applied
+    EXPECT_FALSE(tx.getSigningPubKey().empty());
+    EXPECT_TRUE(tx.hasTxnSignature());
+
+    // Verify common fields
+    EXPECT_EQ(tx.getAccount(), accountValue);
+    EXPECT_EQ(tx.getSequence(), sequenceValue);
+    EXPECT_EQ(tx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = tx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    {
+        auto const& expected = holderValue;
+        auto const actual = tx.getHolder();
+        expectEqualField(expected, actual, "sfHolder");
+    }
+
+    {
+        auto const& expected = mPTAmountValue;
+        auto const actual = tx.getMPTAmount();
+        expectEqualField(expected, actual, "sfMPTAmount");
+    }
+
+    {
+        auto const& expected = zKProofValue;
+        auto const actual = tx.getZKProof();
+        expectEqualField(expected, actual, "sfZKProof");
+    }
+
+    // Verify optional fields
+}
+
+// 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
+// and verify all fields match.
+TEST(TransactionsConfidentialMPTClawbackTests, BuilderFromStTxRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTClawbackFromTx"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 2;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const holderValue = canonical_ACCOUNT();
+    auto const mPTAmountValue = canonical_UINT64();
+    auto const zKProofValue = canonical_VL();
+
+    // Build an initial transaction
+    ConfidentialMPTClawbackBuilder initialBuilder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        holderValue,
+        mPTAmountValue,
+        zKProofValue,
+        sequenceValue,
+        feeValue
+    };
+
+
+    auto initialTx = initialBuilder.build(publicKey, secretKey);
+
+    // Create builder from existing STTx
+    ConfidentialMPTClawbackBuilder builderFromTx{initialTx.getSTTx()};
+
+    auto rebuiltTx = builderFromTx.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(rebuiltTx.validate(reason)) << reason;
+
+    // Verify common fields
+    EXPECT_EQ(rebuiltTx.getAccount(), accountValue);
+    EXPECT_EQ(rebuiltTx.getSequence(), sequenceValue);
+    EXPECT_EQ(rebuiltTx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = rebuiltTx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    {
+        auto const& expected = holderValue;
+        auto const actual = rebuiltTx.getHolder();
+        expectEqualField(expected, actual, "sfHolder");
+    }
+
+    {
+        auto const& expected = mPTAmountValue;
+        auto const actual = rebuiltTx.getMPTAmount();
+        expectEqualField(expected, actual, "sfMPTAmount");
+    }
+
+    {
+        auto const& expected = zKProofValue;
+        auto const actual = rebuiltTx.getZKProof();
+        expectEqualField(expected, actual, "sfZKProof");
+    }
+
+    // Verify optional fields
+}
+
+// 3) Verify wrapper throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTClawbackTests, WrapperThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongType"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTClawback{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 4) Verify builder throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTClawbackTests, BuilderThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongTypeBuilder"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTClawbackBuilder{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+
+}
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTConvertBackTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTConvertBackTests.cpp
new file mode 100644
index 0000000000..1a5fb3a046
--- /dev/null
+++ b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTConvertBackTests.cpp
@@ -0,0 +1,303 @@
+// Auto-generated unit tests for transaction ConfidentialMPTConvertBack
+
+
+#include <gtest/gtest.h>
+
+#include <protocol_autogen/TestHelpers.h>
+
+#include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Seed.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h>
+#include <xrpl/protocol_autogen/transactions/AccountSet.h>
+
+#include <string>
+
+namespace xrpl::transactions {
+
+// 1 & 4) Set fields via builder setters, build, then read them back via
+// wrapper getters. After build(), validate() should succeed.
+TEST(TransactionsConfidentialMPTConvertBackTests, BuilderSettersRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTConvertBack"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 1;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const mPTAmountValue = canonical_UINT64();
+    auto const holderEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const auditorEncryptedAmountValue = canonical_VL();
+    auto const blindingFactorValue = canonical_UINT256();
+    auto const zKProofValue = canonical_VL();
+    auto const balanceCommitmentValue = canonical_VL();
+
+    ConfidentialMPTConvertBackBuilder builder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        mPTAmountValue,
+        holderEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        blindingFactorValue,
+        zKProofValue,
+        balanceCommitmentValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Set optional fields
+    builder.setAuditorEncryptedAmount(auditorEncryptedAmountValue);
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(tx.validate(reason)) << reason;
+
+    // Verify signing was applied
+    EXPECT_FALSE(tx.getSigningPubKey().empty());
+    EXPECT_TRUE(tx.hasTxnSignature());
+
+    // Verify common fields
+    EXPECT_EQ(tx.getAccount(), accountValue);
+    EXPECT_EQ(tx.getSequence(), sequenceValue);
+    EXPECT_EQ(tx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = tx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    {
+        auto const& expected = mPTAmountValue;
+        auto const actual = tx.getMPTAmount();
+        expectEqualField(expected, actual, "sfMPTAmount");
+    }
+
+    {
+        auto const& expected = holderEncryptedAmountValue;
+        auto const actual = tx.getHolderEncryptedAmount();
+        expectEqualField(expected, actual, "sfHolderEncryptedAmount");
+    }
+
+    {
+        auto const& expected = issuerEncryptedAmountValue;
+        auto const actual = tx.getIssuerEncryptedAmount();
+        expectEqualField(expected, actual, "sfIssuerEncryptedAmount");
+    }
+
+    {
+        auto const& expected = blindingFactorValue;
+        auto const actual = tx.getBlindingFactor();
+        expectEqualField(expected, actual, "sfBlindingFactor");
+    }
+
+    {
+        auto const& expected = zKProofValue;
+        auto const actual = tx.getZKProof();
+        expectEqualField(expected, actual, "sfZKProof");
+    }
+
+    {
+        auto const& expected = balanceCommitmentValue;
+        auto const actual = tx.getBalanceCommitment();
+        expectEqualField(expected, actual, "sfBalanceCommitment");
+    }
+
+    // Verify optional fields
+    {
+        auto const& expected = auditorEncryptedAmountValue;
+        auto const actualOpt = tx.getAuditorEncryptedAmount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfAuditorEncryptedAmount should be present";
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptedAmount");
+        EXPECT_TRUE(tx.hasAuditorEncryptedAmount());
+    }
+
+}
+
+// 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
+// and verify all fields match.
+TEST(TransactionsConfidentialMPTConvertBackTests, BuilderFromStTxRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTConvertBackFromTx"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 2;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const mPTAmountValue = canonical_UINT64();
+    auto const holderEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const auditorEncryptedAmountValue = canonical_VL();
+    auto const blindingFactorValue = canonical_UINT256();
+    auto const zKProofValue = canonical_VL();
+    auto const balanceCommitmentValue = canonical_VL();
+
+    // Build an initial transaction
+    ConfidentialMPTConvertBackBuilder initialBuilder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        mPTAmountValue,
+        holderEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        blindingFactorValue,
+        zKProofValue,
+        balanceCommitmentValue,
+        sequenceValue,
+        feeValue
+    };
+
+    initialBuilder.setAuditorEncryptedAmount(auditorEncryptedAmountValue);
+
+    auto initialTx = initialBuilder.build(publicKey, secretKey);
+
+    // Create builder from existing STTx
+    ConfidentialMPTConvertBackBuilder builderFromTx{initialTx.getSTTx()};
+
+    auto rebuiltTx = builderFromTx.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(rebuiltTx.validate(reason)) << reason;
+
+    // Verify common fields
+    EXPECT_EQ(rebuiltTx.getAccount(), accountValue);
+    EXPECT_EQ(rebuiltTx.getSequence(), sequenceValue);
+    EXPECT_EQ(rebuiltTx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = rebuiltTx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    {
+        auto const& expected = mPTAmountValue;
+        auto const actual = rebuiltTx.getMPTAmount();
+        expectEqualField(expected, actual, "sfMPTAmount");
+    }
+
+    {
+        auto const& expected = holderEncryptedAmountValue;
+        auto const actual = rebuiltTx.getHolderEncryptedAmount();
+        expectEqualField(expected, actual, "sfHolderEncryptedAmount");
+    }
+
+    {
+        auto const& expected = issuerEncryptedAmountValue;
+        auto const actual = rebuiltTx.getIssuerEncryptedAmount();
+        expectEqualField(expected, actual, "sfIssuerEncryptedAmount");
+    }
+
+    {
+        auto const& expected = blindingFactorValue;
+        auto const actual = rebuiltTx.getBlindingFactor();
+        expectEqualField(expected, actual, "sfBlindingFactor");
+    }
+
+    {
+        auto const& expected = zKProofValue;
+        auto const actual = rebuiltTx.getZKProof();
+        expectEqualField(expected, actual, "sfZKProof");
+    }
+
+    {
+        auto const& expected = balanceCommitmentValue;
+        auto const actual = rebuiltTx.getBalanceCommitment();
+        expectEqualField(expected, actual, "sfBalanceCommitment");
+    }
+
+    // Verify optional fields
+    {
+        auto const& expected = auditorEncryptedAmountValue;
+        auto const actualOpt = rebuiltTx.getAuditorEncryptedAmount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfAuditorEncryptedAmount should be present";
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptedAmount");
+    }
+
+}
+
+// 3) Verify wrapper throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTConvertBackTests, WrapperThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongType"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTConvertBack{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 4) Verify builder throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTConvertBackTests, BuilderThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongTypeBuilder"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTConvertBackBuilder{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 5) Build with only required fields and verify optional fields return nullopt.
+TEST(TransactionsConfidentialMPTConvertBackTests, OptionalFieldsReturnNullopt)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTConvertBackNullopt"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 3;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific required field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const mPTAmountValue = canonical_UINT64();
+    auto const holderEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const blindingFactorValue = canonical_UINT256();
+    auto const zKProofValue = canonical_VL();
+    auto const balanceCommitmentValue = canonical_VL();
+
+    ConfidentialMPTConvertBackBuilder builder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        mPTAmountValue,
+        holderEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        blindingFactorValue,
+        zKProofValue,
+        balanceCommitmentValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Do NOT set optional fields
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    // Verify optional fields are not present
+    EXPECT_FALSE(tx.hasAuditorEncryptedAmount());
+    EXPECT_FALSE(tx.getAuditorEncryptedAmount().has_value());
+}
+
+}
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTConvertTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTConvertTests.cpp
new file mode 100644
index 0000000000..6110196353
--- /dev/null
+++ b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTConvertTests.cpp
@@ -0,0 +1,309 @@
+// Auto-generated unit tests for transaction ConfidentialMPTConvert
+
+
+#include <gtest/gtest.h>
+
+#include <protocol_autogen/TestHelpers.h>
+
+#include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Seed.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h>
+#include <xrpl/protocol_autogen/transactions/AccountSet.h>
+
+#include <string>
+
+namespace xrpl::transactions {
+
+// 1 & 4) Set fields via builder setters, build, then read them back via
+// wrapper getters. After build(), validate() should succeed.
+TEST(TransactionsConfidentialMPTConvertTests, BuilderSettersRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTConvert"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 1;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const mPTAmountValue = canonical_UINT64();
+    auto const holderEncryptionKeyValue = canonical_VL();
+    auto const holderEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const auditorEncryptedAmountValue = canonical_VL();
+    auto const blindingFactorValue = canonical_UINT256();
+    auto const zKProofValue = canonical_VL();
+
+    ConfidentialMPTConvertBuilder builder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        mPTAmountValue,
+        holderEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        blindingFactorValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Set optional fields
+    builder.setHolderEncryptionKey(holderEncryptionKeyValue);
+    builder.setAuditorEncryptedAmount(auditorEncryptedAmountValue);
+    builder.setZKProof(zKProofValue);
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(tx.validate(reason)) << reason;
+
+    // Verify signing was applied
+    EXPECT_FALSE(tx.getSigningPubKey().empty());
+    EXPECT_TRUE(tx.hasTxnSignature());
+
+    // Verify common fields
+    EXPECT_EQ(tx.getAccount(), accountValue);
+    EXPECT_EQ(tx.getSequence(), sequenceValue);
+    EXPECT_EQ(tx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = tx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    {
+        auto const& expected = mPTAmountValue;
+        auto const actual = tx.getMPTAmount();
+        expectEqualField(expected, actual, "sfMPTAmount");
+    }
+
+    {
+        auto const& expected = holderEncryptedAmountValue;
+        auto const actual = tx.getHolderEncryptedAmount();
+        expectEqualField(expected, actual, "sfHolderEncryptedAmount");
+    }
+
+    {
+        auto const& expected = issuerEncryptedAmountValue;
+        auto const actual = tx.getIssuerEncryptedAmount();
+        expectEqualField(expected, actual, "sfIssuerEncryptedAmount");
+    }
+
+    {
+        auto const& expected = blindingFactorValue;
+        auto const actual = tx.getBlindingFactor();
+        expectEqualField(expected, actual, "sfBlindingFactor");
+    }
+
+    // Verify optional fields
+    {
+        auto const& expected = holderEncryptionKeyValue;
+        auto const actualOpt = tx.getHolderEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfHolderEncryptionKey should be present";
+        expectEqualField(expected, *actualOpt, "sfHolderEncryptionKey");
+        EXPECT_TRUE(tx.hasHolderEncryptionKey());
+    }
+
+    {
+        auto const& expected = auditorEncryptedAmountValue;
+        auto const actualOpt = tx.getAuditorEncryptedAmount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfAuditorEncryptedAmount should be present";
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptedAmount");
+        EXPECT_TRUE(tx.hasAuditorEncryptedAmount());
+    }
+
+    {
+        auto const& expected = zKProofValue;
+        auto const actualOpt = tx.getZKProof();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfZKProof should be present";
+        expectEqualField(expected, *actualOpt, "sfZKProof");
+        EXPECT_TRUE(tx.hasZKProof());
+    }
+
+}
+
+// 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
+// and verify all fields match.
+TEST(TransactionsConfidentialMPTConvertTests, BuilderFromStTxRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTConvertFromTx"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 2;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const mPTAmountValue = canonical_UINT64();
+    auto const holderEncryptionKeyValue = canonical_VL();
+    auto const holderEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const auditorEncryptedAmountValue = canonical_VL();
+    auto const blindingFactorValue = canonical_UINT256();
+    auto const zKProofValue = canonical_VL();
+
+    // Build an initial transaction
+    ConfidentialMPTConvertBuilder initialBuilder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        mPTAmountValue,
+        holderEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        blindingFactorValue,
+        sequenceValue,
+        feeValue
+    };
+
+    initialBuilder.setHolderEncryptionKey(holderEncryptionKeyValue);
+    initialBuilder.setAuditorEncryptedAmount(auditorEncryptedAmountValue);
+    initialBuilder.setZKProof(zKProofValue);
+
+    auto initialTx = initialBuilder.build(publicKey, secretKey);
+
+    // Create builder from existing STTx
+    ConfidentialMPTConvertBuilder builderFromTx{initialTx.getSTTx()};
+
+    auto rebuiltTx = builderFromTx.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(rebuiltTx.validate(reason)) << reason;
+
+    // Verify common fields
+    EXPECT_EQ(rebuiltTx.getAccount(), accountValue);
+    EXPECT_EQ(rebuiltTx.getSequence(), sequenceValue);
+    EXPECT_EQ(rebuiltTx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = rebuiltTx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    {
+        auto const& expected = mPTAmountValue;
+        auto const actual = rebuiltTx.getMPTAmount();
+        expectEqualField(expected, actual, "sfMPTAmount");
+    }
+
+    {
+        auto const& expected = holderEncryptedAmountValue;
+        auto const actual = rebuiltTx.getHolderEncryptedAmount();
+        expectEqualField(expected, actual, "sfHolderEncryptedAmount");
+    }
+
+    {
+        auto const& expected = issuerEncryptedAmountValue;
+        auto const actual = rebuiltTx.getIssuerEncryptedAmount();
+        expectEqualField(expected, actual, "sfIssuerEncryptedAmount");
+    }
+
+    {
+        auto const& expected = blindingFactorValue;
+        auto const actual = rebuiltTx.getBlindingFactor();
+        expectEqualField(expected, actual, "sfBlindingFactor");
+    }
+
+    // Verify optional fields
+    {
+        auto const& expected = holderEncryptionKeyValue;
+        auto const actualOpt = rebuiltTx.getHolderEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfHolderEncryptionKey should be present";
+        expectEqualField(expected, *actualOpt, "sfHolderEncryptionKey");
+    }
+
+    {
+        auto const& expected = auditorEncryptedAmountValue;
+        auto const actualOpt = rebuiltTx.getAuditorEncryptedAmount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfAuditorEncryptedAmount should be present";
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptedAmount");
+    }
+
+    {
+        auto const& expected = zKProofValue;
+        auto const actualOpt = rebuiltTx.getZKProof();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfZKProof should be present";
+        expectEqualField(expected, *actualOpt, "sfZKProof");
+    }
+
+}
+
+// 3) Verify wrapper throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTConvertTests, WrapperThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongType"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTConvert{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 4) Verify builder throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTConvertTests, BuilderThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongTypeBuilder"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTConvertBuilder{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 5) Build with only required fields and verify optional fields return nullopt.
+TEST(TransactionsConfidentialMPTConvertTests, OptionalFieldsReturnNullopt)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTConvertNullopt"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 3;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific required field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const mPTAmountValue = canonical_UINT64();
+    auto const holderEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const blindingFactorValue = canonical_UINT256();
+
+    ConfidentialMPTConvertBuilder builder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        mPTAmountValue,
+        holderEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        blindingFactorValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Do NOT set optional fields
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    // Verify optional fields are not present
+    EXPECT_FALSE(tx.hasHolderEncryptionKey());
+    EXPECT_FALSE(tx.getHolderEncryptionKey().has_value());
+    EXPECT_FALSE(tx.hasAuditorEncryptedAmount());
+    EXPECT_FALSE(tx.getAuditorEncryptedAmount().has_value());
+    EXPECT_FALSE(tx.hasZKProof());
+    EXPECT_FALSE(tx.getZKProof().has_value());
+}
+
+}
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTMergeInboxTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTMergeInboxTests.cpp
new file mode 100644
index 0000000000..bfc3ec4f0d
--- /dev/null
+++ b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTMergeInboxTests.cpp
@@ -0,0 +1,146 @@
+// Auto-generated unit tests for transaction ConfidentialMPTMergeInbox
+
+
+#include <gtest/gtest.h>
+
+#include <protocol_autogen/TestHelpers.h>
+
+#include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Seed.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h>
+#include <xrpl/protocol_autogen/transactions/AccountSet.h>
+
+#include <string>
+
+namespace xrpl::transactions {
+
+// 1 & 4) Set fields via builder setters, build, then read them back via
+// wrapper getters. After build(), validate() should succeed.
+TEST(TransactionsConfidentialMPTMergeInboxTests, BuilderSettersRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTMergeInbox"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 1;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+
+    ConfidentialMPTMergeInboxBuilder builder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Set optional fields
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(tx.validate(reason)) << reason;
+
+    // Verify signing was applied
+    EXPECT_FALSE(tx.getSigningPubKey().empty());
+    EXPECT_TRUE(tx.hasTxnSignature());
+
+    // Verify common fields
+    EXPECT_EQ(tx.getAccount(), accountValue);
+    EXPECT_EQ(tx.getSequence(), sequenceValue);
+    EXPECT_EQ(tx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = tx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    // Verify optional fields
+}
+
+// 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
+// and verify all fields match.
+TEST(TransactionsConfidentialMPTMergeInboxTests, BuilderFromStTxRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTMergeInboxFromTx"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 2;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+
+    // Build an initial transaction
+    ConfidentialMPTMergeInboxBuilder initialBuilder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        sequenceValue,
+        feeValue
+    };
+
+
+    auto initialTx = initialBuilder.build(publicKey, secretKey);
+
+    // Create builder from existing STTx
+    ConfidentialMPTMergeInboxBuilder builderFromTx{initialTx.getSTTx()};
+
+    auto rebuiltTx = builderFromTx.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(rebuiltTx.validate(reason)) << reason;
+
+    // Verify common fields
+    EXPECT_EQ(rebuiltTx.getAccount(), accountValue);
+    EXPECT_EQ(rebuiltTx.getSequence(), sequenceValue);
+    EXPECT_EQ(rebuiltTx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = rebuiltTx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    // Verify optional fields
+}
+
+// 3) Verify wrapper throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTMergeInboxTests, WrapperThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongType"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTMergeInbox{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 4) Verify builder throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTMergeInboxTests, BuilderThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongTypeBuilder"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTMergeInboxBuilder{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+
+}
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTSendTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTSendTests.cpp
new file mode 100644
index 0000000000..ca7793dece
--- /dev/null
+++ b/src/tests/libxrpl/protocol_autogen/transactions/ConfidentialMPTSendTests.cpp
@@ -0,0 +1,363 @@
+// Auto-generated unit tests for transaction ConfidentialMPTSend
+
+
+#include <gtest/gtest.h>
+
+#include <protocol_autogen/TestHelpers.h>
+
+#include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Seed.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h>
+#include <xrpl/protocol_autogen/transactions/AccountSet.h>
+
+#include <string>
+
+namespace xrpl::transactions {
+
+// 1 & 4) Set fields via builder setters, build, then read them back via
+// wrapper getters. After build(), validate() should succeed.
+TEST(TransactionsConfidentialMPTSendTests, BuilderSettersRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTSend"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 1;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const destinationValue = canonical_ACCOUNT();
+    auto const destinationTagValue = canonical_UINT32();
+    auto const senderEncryptedAmountValue = canonical_VL();
+    auto const destinationEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const auditorEncryptedAmountValue = canonical_VL();
+    auto const zKProofValue = canonical_VL();
+    auto const amountCommitmentValue = canonical_VL();
+    auto const balanceCommitmentValue = canonical_VL();
+    auto const credentialIDsValue = canonical_VECTOR256();
+
+    ConfidentialMPTSendBuilder builder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        destinationValue,
+        senderEncryptedAmountValue,
+        destinationEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        zKProofValue,
+        amountCommitmentValue,
+        balanceCommitmentValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Set optional fields
+    builder.setDestinationTag(destinationTagValue);
+    builder.setAuditorEncryptedAmount(auditorEncryptedAmountValue);
+    builder.setCredentialIDs(credentialIDsValue);
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(tx.validate(reason)) << reason;
+
+    // Verify signing was applied
+    EXPECT_FALSE(tx.getSigningPubKey().empty());
+    EXPECT_TRUE(tx.hasTxnSignature());
+
+    // Verify common fields
+    EXPECT_EQ(tx.getAccount(), accountValue);
+    EXPECT_EQ(tx.getSequence(), sequenceValue);
+    EXPECT_EQ(tx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = tx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    {
+        auto const& expected = destinationValue;
+        auto const actual = tx.getDestination();
+        expectEqualField(expected, actual, "sfDestination");
+    }
+
+    {
+        auto const& expected = senderEncryptedAmountValue;
+        auto const actual = tx.getSenderEncryptedAmount();
+        expectEqualField(expected, actual, "sfSenderEncryptedAmount");
+    }
+
+    {
+        auto const& expected = destinationEncryptedAmountValue;
+        auto const actual = tx.getDestinationEncryptedAmount();
+        expectEqualField(expected, actual, "sfDestinationEncryptedAmount");
+    }
+
+    {
+        auto const& expected = issuerEncryptedAmountValue;
+        auto const actual = tx.getIssuerEncryptedAmount();
+        expectEqualField(expected, actual, "sfIssuerEncryptedAmount");
+    }
+
+    {
+        auto const& expected = zKProofValue;
+        auto const actual = tx.getZKProof();
+        expectEqualField(expected, actual, "sfZKProof");
+    }
+
+    {
+        auto const& expected = amountCommitmentValue;
+        auto const actual = tx.getAmountCommitment();
+        expectEqualField(expected, actual, "sfAmountCommitment");
+    }
+
+    {
+        auto const& expected = balanceCommitmentValue;
+        auto const actual = tx.getBalanceCommitment();
+        expectEqualField(expected, actual, "sfBalanceCommitment");
+    }
+
+    // Verify optional fields
+    {
+        auto const& expected = destinationTagValue;
+        auto const actualOpt = tx.getDestinationTag();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfDestinationTag should be present";
+        expectEqualField(expected, *actualOpt, "sfDestinationTag");
+        EXPECT_TRUE(tx.hasDestinationTag());
+    }
+
+    {
+        auto const& expected = auditorEncryptedAmountValue;
+        auto const actualOpt = tx.getAuditorEncryptedAmount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfAuditorEncryptedAmount should be present";
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptedAmount");
+        EXPECT_TRUE(tx.hasAuditorEncryptedAmount());
+    }
+
+    {
+        auto const& expected = credentialIDsValue;
+        auto const actualOpt = tx.getCredentialIDs();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfCredentialIDs should be present";
+        expectEqualField(expected, *actualOpt, "sfCredentialIDs");
+        EXPECT_TRUE(tx.hasCredentialIDs());
+    }
+
+}
+
+// 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
+// and verify all fields match.
+TEST(TransactionsConfidentialMPTSendTests, BuilderFromStTxRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTSendFromTx"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 2;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const destinationValue = canonical_ACCOUNT();
+    auto const destinationTagValue = canonical_UINT32();
+    auto const senderEncryptedAmountValue = canonical_VL();
+    auto const destinationEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const auditorEncryptedAmountValue = canonical_VL();
+    auto const zKProofValue = canonical_VL();
+    auto const amountCommitmentValue = canonical_VL();
+    auto const balanceCommitmentValue = canonical_VL();
+    auto const credentialIDsValue = canonical_VECTOR256();
+
+    // Build an initial transaction
+    ConfidentialMPTSendBuilder initialBuilder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        destinationValue,
+        senderEncryptedAmountValue,
+        destinationEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        zKProofValue,
+        amountCommitmentValue,
+        balanceCommitmentValue,
+        sequenceValue,
+        feeValue
+    };
+
+    initialBuilder.setDestinationTag(destinationTagValue);
+    initialBuilder.setAuditorEncryptedAmount(auditorEncryptedAmountValue);
+    initialBuilder.setCredentialIDs(credentialIDsValue);
+
+    auto initialTx = initialBuilder.build(publicKey, secretKey);
+
+    // Create builder from existing STTx
+    ConfidentialMPTSendBuilder builderFromTx{initialTx.getSTTx()};
+
+    auto rebuiltTx = builderFromTx.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(rebuiltTx.validate(reason)) << reason;
+
+    // Verify common fields
+    EXPECT_EQ(rebuiltTx.getAccount(), accountValue);
+    EXPECT_EQ(rebuiltTx.getSequence(), sequenceValue);
+    EXPECT_EQ(rebuiltTx.getFee(), feeValue);
+
+    // Verify required fields
+    {
+        auto const& expected = mPTokenIssuanceIDValue;
+        auto const actual = rebuiltTx.getMPTokenIssuanceID();
+        expectEqualField(expected, actual, "sfMPTokenIssuanceID");
+    }
+
+    {
+        auto const& expected = destinationValue;
+        auto const actual = rebuiltTx.getDestination();
+        expectEqualField(expected, actual, "sfDestination");
+    }
+
+    {
+        auto const& expected = senderEncryptedAmountValue;
+        auto const actual = rebuiltTx.getSenderEncryptedAmount();
+        expectEqualField(expected, actual, "sfSenderEncryptedAmount");
+    }
+
+    {
+        auto const& expected = destinationEncryptedAmountValue;
+        auto const actual = rebuiltTx.getDestinationEncryptedAmount();
+        expectEqualField(expected, actual, "sfDestinationEncryptedAmount");
+    }
+
+    {
+        auto const& expected = issuerEncryptedAmountValue;
+        auto const actual = rebuiltTx.getIssuerEncryptedAmount();
+        expectEqualField(expected, actual, "sfIssuerEncryptedAmount");
+    }
+
+    {
+        auto const& expected = zKProofValue;
+        auto const actual = rebuiltTx.getZKProof();
+        expectEqualField(expected, actual, "sfZKProof");
+    }
+
+    {
+        auto const& expected = amountCommitmentValue;
+        auto const actual = rebuiltTx.getAmountCommitment();
+        expectEqualField(expected, actual, "sfAmountCommitment");
+    }
+
+    {
+        auto const& expected = balanceCommitmentValue;
+        auto const actual = rebuiltTx.getBalanceCommitment();
+        expectEqualField(expected, actual, "sfBalanceCommitment");
+    }
+
+    // Verify optional fields
+    {
+        auto const& expected = destinationTagValue;
+        auto const actualOpt = rebuiltTx.getDestinationTag();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfDestinationTag should be present";
+        expectEqualField(expected, *actualOpt, "sfDestinationTag");
+    }
+
+    {
+        auto const& expected = auditorEncryptedAmountValue;
+        auto const actualOpt = rebuiltTx.getAuditorEncryptedAmount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfAuditorEncryptedAmount should be present";
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptedAmount");
+    }
+
+    {
+        auto const& expected = credentialIDsValue;
+        auto const actualOpt = rebuiltTx.getCredentialIDs();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfCredentialIDs should be present";
+        expectEqualField(expected, *actualOpt, "sfCredentialIDs");
+    }
+
+}
+
+// 3) Verify wrapper throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTSendTests, WrapperThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongType"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTSend{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 4) Verify builder throws when constructed from wrong transaction type.
+TEST(TransactionsConfidentialMPTSendTests, BuilderThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongTypeBuilder"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(ConfidentialMPTSendBuilder{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 5) Build with only required fields and verify optional fields return nullopt.
+TEST(TransactionsConfidentialMPTSendTests, OptionalFieldsReturnNullopt)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testConfidentialMPTSendNullopt"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 3;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific required field values
+    auto const mPTokenIssuanceIDValue = canonical_UINT192();
+    auto const destinationValue = canonical_ACCOUNT();
+    auto const senderEncryptedAmountValue = canonical_VL();
+    auto const destinationEncryptedAmountValue = canonical_VL();
+    auto const issuerEncryptedAmountValue = canonical_VL();
+    auto const zKProofValue = canonical_VL();
+    auto const amountCommitmentValue = canonical_VL();
+    auto const balanceCommitmentValue = canonical_VL();
+
+    ConfidentialMPTSendBuilder builder{
+        accountValue,
+        mPTokenIssuanceIDValue,
+        destinationValue,
+        senderEncryptedAmountValue,
+        destinationEncryptedAmountValue,
+        issuerEncryptedAmountValue,
+        zKProofValue,
+        amountCommitmentValue,
+        balanceCommitmentValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Do NOT set optional fields
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    // Verify optional fields are not present
+    EXPECT_FALSE(tx.hasDestinationTag());
+    EXPECT_FALSE(tx.getDestinationTag().has_value());
+    EXPECT_FALSE(tx.hasAuditorEncryptedAmount());
+    EXPECT_FALSE(tx.getAuditorEncryptedAmount().has_value());
+    EXPECT_FALSE(tx.hasCredentialIDs());
+    EXPECT_FALSE(tx.getCredentialIDs().has_value());
+}
+
+}
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/MPTokenIssuanceSetTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/MPTokenIssuanceSetTests.cpp
index 5c97ae8871..e7b34590b2 100644
--- a/src/tests/libxrpl/protocol_autogen/transactions/MPTokenIssuanceSetTests.cpp
+++ b/src/tests/libxrpl/protocol_autogen/transactions/MPTokenIssuanceSetTests.cpp
@@ -35,6 +35,8 @@ TEST(TransactionsMPTokenIssuanceSetTests, BuilderSettersRoundTrip)
     auto const mPTokenMetadataValue = canonical_VL();
     auto const transferFeeValue = canonical_UINT16();
     auto const mutableFlagsValue = canonical_UINT32();
+    auto const issuerEncryptionKeyValue = canonical_VL();
+    auto const auditorEncryptionKeyValue = canonical_VL();
 
     MPTokenIssuanceSetBuilder builder{
         accountValue,
@@ -49,6 +51,8 @@ TEST(TransactionsMPTokenIssuanceSetTests, BuilderSettersRoundTrip)
     builder.setMPTokenMetadata(mPTokenMetadataValue);
     builder.setTransferFee(transferFeeValue);
     builder.setMutableFlags(mutableFlagsValue);
+    builder.setIssuerEncryptionKey(issuerEncryptionKeyValue);
+    builder.setAuditorEncryptionKey(auditorEncryptionKeyValue);
 
     auto tx = builder.build(publicKey, secretKey);
 
@@ -112,6 +116,22 @@ TEST(TransactionsMPTokenIssuanceSetTests, BuilderSettersRoundTrip)
         EXPECT_TRUE(tx.hasMutableFlags());
     }
 
+    {
+        auto const& expected = issuerEncryptionKeyValue;
+        auto const actualOpt = tx.getIssuerEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfIssuerEncryptionKey should be present";
+        expectEqualField(expected, *actualOpt, "sfIssuerEncryptionKey");
+        EXPECT_TRUE(tx.hasIssuerEncryptionKey());
+    }
+
+    {
+        auto const& expected = auditorEncryptionKeyValue;
+        auto const actualOpt = tx.getAuditorEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfAuditorEncryptionKey should be present";
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptionKey");
+        EXPECT_TRUE(tx.hasAuditorEncryptionKey());
+    }
+
 }
 
 // 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
@@ -134,6 +154,8 @@ TEST(TransactionsMPTokenIssuanceSetTests, BuilderFromStTxRoundTrip)
     auto const mPTokenMetadataValue = canonical_VL();
     auto const transferFeeValue = canonical_UINT16();
     auto const mutableFlagsValue = canonical_UINT32();
+    auto const issuerEncryptionKeyValue = canonical_VL();
+    auto const auditorEncryptionKeyValue = canonical_VL();
 
     // Build an initial transaction
     MPTokenIssuanceSetBuilder initialBuilder{
@@ -148,6 +170,8 @@ TEST(TransactionsMPTokenIssuanceSetTests, BuilderFromStTxRoundTrip)
     initialBuilder.setMPTokenMetadata(mPTokenMetadataValue);
     initialBuilder.setTransferFee(transferFeeValue);
     initialBuilder.setMutableFlags(mutableFlagsValue);
+    initialBuilder.setIssuerEncryptionKey(issuerEncryptionKeyValue);
+    initialBuilder.setAuditorEncryptionKey(auditorEncryptionKeyValue);
 
     auto initialTx = initialBuilder.build(publicKey, secretKey);
 
@@ -207,6 +231,20 @@ TEST(TransactionsMPTokenIssuanceSetTests, BuilderFromStTxRoundTrip)
         expectEqualField(expected, *actualOpt, "sfMutableFlags");
     }
 
+    {
+        auto const& expected = issuerEncryptionKeyValue;
+        auto const actualOpt = rebuiltTx.getIssuerEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfIssuerEncryptionKey should be present";
+        expectEqualField(expected, *actualOpt, "sfIssuerEncryptionKey");
+    }
+
+    {
+        auto const& expected = auditorEncryptionKeyValue;
+        auto const actualOpt = rebuiltTx.getAuditorEncryptionKey();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfAuditorEncryptionKey should be present";
+        expectEqualField(expected, *actualOpt, "sfAuditorEncryptionKey");
+    }
+
 }
 
 // 3) Verify wrapper throws when constructed from wrong transaction type.
@@ -274,6 +312,10 @@ TEST(TransactionsMPTokenIssuanceSetTests, OptionalFieldsReturnNullopt)
     EXPECT_FALSE(tx.getTransferFee().has_value());
     EXPECT_FALSE(tx.hasMutableFlags());
     EXPECT_FALSE(tx.getMutableFlags().has_value());
+    EXPECT_FALSE(tx.hasIssuerEncryptionKey());
+    EXPECT_FALSE(tx.getIssuerEncryptionKey().has_value());
+    EXPECT_FALSE(tx.hasAuditorEncryptionKey());
+    EXPECT_FALSE(tx.getAuditorEncryptionKey().has_value());
 }
 
 }

From 74b55a59b2c643929cba2352eef01c25be5ed479 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 29 Jun 2026 14:20:17 +0100
Subject: [PATCH 022/100] chore: Enable most bugprone checks (#7643)

---
 .clang-tidy                                   | 18 -----
 include/xrpl/config/BasicConfig.h             |  3 +-
 include/xrpl/protocol/detail/token_errors.h   |  1 -
 src/libxrpl/conditions/Condition.cpp          |  9 ---
 src/libxrpl/conditions/Fulfillment.cpp        | 12 ---
 src/libxrpl/ledger/helpers/TokenHelpers.cpp   |  7 +-
 .../nodestore/backend/RocksDBFactory.cpp      |  8 +-
 .../tx/transactors/dex/AMMWithdraw.cpp        |  7 +-
 src/test/app/AccountSet_test.cpp              |  1 +
 src/test/app/LoanBroker_test.cpp              |  9 ++-
 src/test/app/MPToken_test.cpp                 | 15 +---
 src/test/app/NFTokenBurn_test.cpp             |  1 +
 src/test/app/Vault_test.cpp                   |  3 +
 src/test/app/XChain_test.cpp                  | 10 +--
 src/test/consensus/LedgerTrie_test.cpp        |  1 +
 src/test/csf/Sim.h                            |  1 +
 src/test/nodestore/TestBase.h                 |  2 -
 src/test/rpc/LedgerEntry_test.cpp             |  2 -
 src/test/unit_test/SuiteJournal.h             |  3 +-
 src/tests/libxrpl/tx/AccountSet.cpp           |  1 +
 src/xrpld/core/detail/Config.cpp              | 10 +--
 src/xrpld/rpc/detail/PathRequestManager.cpp   |  3 +-
 src/xrpld/rpc/detail/Pathfinder.cpp           | 77 +++++++------------
 23 files changed, 61 insertions(+), 143 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index ef55e8517c..e12c73cc56 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -1,29 +1,11 @@
 ---
 Checks: "-*,
   bugprone-*,
-  -bugprone-assignment-in-if-condition,
-  -bugprone-bitwise-pointer-cast,
-  -bugprone-branch-clone,
-  -bugprone-command-processor,
-  -bugprone-copy-constructor-mutates-argument,
-  -bugprone-default-operator-new-on-overaligned-type,
   -bugprone-easily-swappable-parameters,
-  -bugprone-exception-copy-constructor-throws,
   -bugprone-exception-escape,
-  -bugprone-float-loop-counter,
-  -bugprone-forwarding-reference-overload,
   -bugprone-implicit-widening-of-multiplication-result,
-  -bugprone-incorrect-enable-shared-from-this,
   -bugprone-narrowing-conversions,
-  -bugprone-nondeterministic-pointer-iteration-order,
-  -bugprone-not-null-terminated-result,
-  -bugprone-random-generator-seed,
-  -bugprone-raw-memory-call-on-non-trivial-type,
-  -bugprone-std-namespace-modification,
-  -bugprone-tagged-union-member-count,
   -bugprone-throwing-static-initialization,
-  -bugprone-unchecked-string-to-number-conversion,
-  -bugprone-unintended-char-ostream-output,
 
   cppcoreguidelines-*,
   -cppcoreguidelines-avoid-c-arrays,
diff --git a/include/xrpl/config/BasicConfig.h b/include/xrpl/config/BasicConfig.h
index 5a82f7d081..858bf8bf2e 100644
--- a/include/xrpl/config/BasicConfig.h
+++ b/include/xrpl/config/BasicConfig.h
@@ -298,7 +298,8 @@ set(T& target, std::string const& name, Section const& section)
     try
     {
         auto const val = section.get<T>(name);
-        if ((foundAndValid = val.has_value()))
+        foundAndValid = val.has_value();
+        if (foundAndValid)
             target = *val;
     }
     catch (boost::bad_lexical_cast const&)  // NOLINT(bugprone-empty-catch)
diff --git a/include/xrpl/protocol/detail/token_errors.h b/include/xrpl/protocol/detail/token_errors.h
index 9d5e98e646..97db9288f9 100644
--- a/include/xrpl/protocol/detail/token_errors.h
+++ b/include/xrpl/protocol/detail/token_errors.h
@@ -58,7 +58,6 @@ public:
             case TokenCodecErrc::InvalidEncodingChar:
                 return "invalid encoding char";
             case TokenCodecErrc::Unknown:
-                return "unknown";
             default:
                 return "unknown";
         }
diff --git a/src/libxrpl/conditions/Condition.cpp b/src/libxrpl/conditions/Condition.cpp
index cb950c9e24..3be7aa7757 100644
--- a/src/libxrpl/conditions/Condition.cpp
+++ b/src/libxrpl/conditions/Condition.cpp
@@ -190,17 +190,8 @@ Condition::deserialize(Slice s, std::error_code& ec)
             break;
 
         case 1:  // PrefixSha256
-            ec = Error::UnsupportedType;
-            return {};
-
         case 2:  // ThresholdSha256
-            ec = Error::UnsupportedType;
-            return {};
-
         case 3:  // RsaSha256
-            ec = Error::UnsupportedType;
-            return {};
-
         case 4:  // Ed25519Sha256
             ec = Error::UnsupportedType;
             return {};
diff --git a/src/libxrpl/conditions/Fulfillment.cpp b/src/libxrpl/conditions/Fulfillment.cpp
index eaad6b8cdb..23a2a5eb32 100644
--- a/src/libxrpl/conditions/Fulfillment.cpp
+++ b/src/libxrpl/conditions/Fulfillment.cpp
@@ -101,20 +101,8 @@ Fulfillment::deserialize(Slice s, std::error_code& ec)
             break;
 
         case safeCast<TagType>(Type::PrefixSha256):
-            ec = Error::UnsupportedType;
-            return {};
-            break;
-
         case safeCast<TagType>(Type::ThresholdSha256):
-            ec = Error::UnsupportedType;
-            return {};
-            break;
-
         case safeCast<TagType>(Type::RsaSha256):
-            ec = Error::UnsupportedType;
-            return {};
-            break;
-
         case safeCast<TagType>(Type::Ed25519Sha256):
             ec = Error::UnsupportedType;
             return {};
diff --git a/src/libxrpl/ledger/helpers/TokenHelpers.cpp b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
index 2ecde25754..7988e24a56 100644
--- a/src/libxrpl/ledger/helpers/TokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
@@ -411,11 +411,8 @@ accountHolds(
 
     auto const sleMpt = view.read(keylet::mptoken(mptIssue.getMptID(), account));
 
-    if (!sleMpt)
-    {
-        amount.clear(mptIssue);
-    }
-    else if (zeroIfFrozen == FreezeHandling::ZeroIfFrozen && isFrozen(view, account, mptIssue))
+    if (!sleMpt ||
+        (zeroIfFrozen == FreezeHandling::ZeroIfFrozen && isFrozen(view, account, mptIssue)))
     {
         amount.clear(mptIssue);
     }
diff --git a/src/libxrpl/nodestore/backend/RocksDBFactory.cpp b/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
index 565fbded5d..69a648f2f4 100644
--- a/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
+++ b/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
@@ -36,7 +36,6 @@
 #include <rocksdb/write_batch.h>
 
 #include <atomic>
-#include <bit>
 #include <cstddef>
 #include <functional>
 #include <memory>
@@ -286,7 +285,7 @@ public:
         Status status = Status::Ok;
 
         rocksdb::ReadOptions const options;
-        rocksdb::Slice const slice(std::bit_cast<char const*>(hash.data()), keyBytes);
+        rocksdb::Slice const slice(reinterpret_cast<char const*>(hash.data()), keyBytes);
 
         std::string string;
 
@@ -349,8 +348,9 @@ public:
             EncodedBlob const encoded(e);
 
             wb.Put(
-                rocksdb::Slice(std::bit_cast<char const*>(encoded.getKey()), keyBytes),
-                rocksdb::Slice(std::bit_cast<char const*>(encoded.getData()), encoded.getSize()));
+                rocksdb::Slice(reinterpret_cast<char const*>(encoded.getKey()), keyBytes),
+                rocksdb::Slice(
+                    reinterpret_cast<char const*>(encoded.getData()), encoded.getSize()));
         }
 
         rocksdb::WriteOptions const options;
diff --git a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
index f26164c5fe..14ed5a4646 100644
--- a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
@@ -90,12 +90,7 @@ AMMWithdraw::preflight(PreflightContext const& ctx)
         if (lpTokens || amount || amount2 || ePrice)
             return temMALFORMED;
     }
-    else if (ctx.tx.isFlag(tfOneAssetWithdrawAll))
-    {
-        if (!amount || lpTokens || amount2 || ePrice)
-            return temMALFORMED;
-    }
-    else if (ctx.tx.isFlag(tfSingleAsset))
+    else if (ctx.tx.isFlag(tfOneAssetWithdrawAll) || ctx.tx.isFlag(tfSingleAsset))
     {
         if (!amount || lpTokens || amount2 || ePrice)
             return temMALFORMED;
diff --git a/src/test/app/AccountSet_test.cpp b/src/test/app/AccountSet_test.cpp
index 6688e3693f..362113aec2 100644
--- a/src/test/app/AccountSet_test.cpp
+++ b/src/test/app/AccountSet_test.cpp
@@ -383,6 +383,7 @@ public:
         auto const usd = gw["USD"];
 
         // Test gateway with a variety of allowed transfer rates
+        // NOLINTNEXTLINE(bugprone-float-loop-counter)
         for (double transferRate = 1.0; transferRate <= 2.0; transferRate += 0.03125)
         {
             Env env(*this);
diff --git a/src/test/app/LoanBroker_test.cpp b/src/test/app/LoanBroker_test.cpp
index bdc950eeff..2a4de18a9c 100644
--- a/src/test/app/LoanBroker_test.cpp
+++ b/src/test/app/LoanBroker_test.cpp
@@ -283,7 +283,8 @@ class LoanBroker_test : public beast::unit_test::Suite
                 [&env, &vault, &pseudoAccount, &broker, &keylet, this](auto n) {
                     using namespace jtx;
 
-                    if (BEAST_EXPECT(broker = env.le(keylet)))
+                    broker = env.le(keylet);
+                    if (BEAST_EXPECT(broker))
                     {
                         auto const amount = vault.asset(n);
                         BEAST_EXPECT(broker->at(sfCoverAvailable) == amount.number());
@@ -473,7 +474,8 @@ class LoanBroker_test : public beast::unit_test::Suite
             env.close();
 
             // Check the results of modifications
-            if (BEAST_EXPECT(broker = env.le(keylet)) && checkChangedBroker)
+            broker = env.le(keylet);
+            if (BEAST_EXPECT(broker) && checkChangedBroker)
                 checkChangedBroker(broker);
 
             // Verify that fields get removed when set to default values
@@ -486,7 +488,8 @@ class LoanBroker_test : public beast::unit_test::Suite
             env.close();
 
             // Check the updated fields
-            if (BEAST_EXPECT(broker = env.le(keylet)))
+            broker = env.le(keylet);
+            if (BEAST_EXPECT(broker))
             {
                 BEAST_EXPECT(!broker->isFieldPresent(sfDebtMaximum));
                 BEAST_EXPECT(!broker->isFieldPresent(sfData));
diff --git a/src/test/app/MPToken_test.cpp b/src/test/app/MPToken_test.cpp
index 15e17b4536..bbf1c54ab1 100644
--- a/src/test/app/MPToken_test.cpp
+++ b/src/test/app/MPToken_test.cpp
@@ -111,20 +111,9 @@ class MPToken_test : public beast::unit_test::Suite
                  .metadata = "test",
                  .err = temMALFORMED});
 
-            if (!features[featureSingleAssetVault])
+            if (!features[featureSingleAssetVault] || !features[featurePermissionedDomains])
             {
-                // tries to set DomainID when SAV is disabled
-                mptAlice.create(
-                    {.maxAmt = 100,
-                     .assetScale = 0,
-                     .metadata = "test",
-                     .flags = tfMPTRequireAuth,
-                     .domainID = uint256(42),
-                     .err = temDISABLED});
-            }
-            else if (!features[featurePermissionedDomains])
-            {
-                // tries to set DomainID when PD is disabled
+                // tries to set DomainID when SAV or PD is disabled
                 mptAlice.create(
                     {.maxAmt = 100,
                      .assetScale = 0,
diff --git a/src/test/app/NFTokenBurn_test.cpp b/src/test/app/NFTokenBurn_test.cpp
index 00667dc5ac..140fe2de15 100644
--- a/src/test/app/NFTokenBurn_test.cpp
+++ b/src/test/app/NFTokenBurn_test.cpp
@@ -198,6 +198,7 @@ class NFTokenBurn_test : public beast::unit_test::Suite
         // Use a default initialized mersenne_twister because we want the
         // effect of random numbers, but we want the test to run the same
         // way each time.
+        // NOLINTNEXTLINE(bugprone-random-generator-seed): fixed seed for reproducible test
         std::mt19937 engine;
         std::uniform_int_distribution<std::size_t> feeDist(
             decltype(kMaxTransferFee){}, kMaxTransferFee);
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index dd28c7ec6e..9b29442197 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -7896,7 +7896,10 @@ class Vault_test : public beast::unit_test::Suite
 
                 // Depositor deep freeze → self-withdraw blocked
                 env(trust(issuer, asset(0), owner, tfSetFreeze | tfSetDeepFreeze));
+                // TODO: branches are identical - confirm the intended pre/post-fix330
+                // expectations and replace with the correct values (one branch may be wrong).
                 env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    // NOLINTNEXTLINE(bugprone-branch-clone)
                     Ter(fix330Enabled ? TER(tecFROZEN) : TER(tecFROZEN)));
                 env(trust(issuer, asset(0), owner, tfClearFreeze | tfClearDeepFreeze));
 
diff --git a/src/test/app/XChain_test.cpp b/src/test/app/XChain_test.cpp
index de80444f2e..36c1a08144 100644
--- a/src/test/app/XChain_test.cpp
+++ b/src/test/app/XChain_test.cpp
@@ -2164,14 +2164,7 @@ struct XChain_test : public beast::unit_test::Suite, public jtx::XChainBridgeObj
                     scAttester, jvb, mcAlice, amt, payees[i], true, claimID, dst, signers[i]);
 
                 TER const expectedTER = i < quorum ? tesSUCCESS : TER{tecXCHAIN_NO_CLAIM_ID};
-                if (i + 1 == quorum)
-                {
-                    scEnv.tx(att, Ter(expectedTER)).close();
-                }
-                else
-                {
-                    scEnv.tx(att, Ter(expectedTER)).close();
-                }
+                scEnv.tx(att, Ter(expectedTER)).close();
 
                 if (i + 1 < quorum)
                 {
@@ -4375,6 +4368,7 @@ public:
     {
         using namespace jtx;
         uint64_t time = 0;
+        // NOLINTNEXTLINE(bugprone-random-generator-seed): fixed seed for reproducible test
         std::mt19937 gen(27);  // Standard mersenne_twister_engine
         std::uniform_int_distribution<uint32_t> distrib(0, 9);
 
diff --git a/src/test/consensus/LedgerTrie_test.cpp b/src/test/consensus/LedgerTrie_test.cpp
index 2b638b1dfa..0ddf1bf82f 100644
--- a/src/test/consensus/LedgerTrie_test.cpp
+++ b/src/test/consensus/LedgerTrie_test.cpp
@@ -663,6 +663,7 @@ class LedgerTrie_test : public beast::unit_test::Suite
         std::uint32_t const iterations = 10000;
 
         // Use explicit seed to have same results for CI
+        // NOLINTNEXTLINE(bugprone-random-generator-seed): fixed seed for reproducible test
         std::mt19937 gen{42};
         std::uniform_int_distribution<> depthDist(0, depthConst - 1);
         std::uniform_int_distribution<> widthDist(0, width - 1);
diff --git a/src/test/csf/Sim.h b/src/test/csf/Sim.h
index 89e6b95fe6..b5b7f5f9c2 100644
--- a/src/test/csf/Sim.h
+++ b/src/test/csf/Sim.h
@@ -65,6 +65,7 @@ public:
         and no network connections.
 
     */
+    // NOLINTNEXTLINE(bugprone-random-generator-seed): fixed seed for reproducible test
     Sim() : sink{scheduler.clock()}, j{sink}, net{scheduler}
     {
     }
diff --git a/src/test/nodestore/TestBase.h b/src/test/nodestore/TestBase.h
index c35042bd4f..885c3bbeac 100644
--- a/src/test/nodestore/TestBase.h
+++ b/src/test/nodestore/TestBase.h
@@ -73,9 +73,7 @@ public:
                     case 2:
                         return NodeObjectType::TransactionNode;
                     case 3:
-                        return NodeObjectType::Unknown;
                     default:
-                        // will never happen, but make static analysis tool happy.
                         return NodeObjectType::Unknown;
                 }
             }();
diff --git a/src/test/rpc/LedgerEntry_test.cpp b/src/test/rpc/LedgerEntry_test.cpp
index 14908cf72a..59dbf618f0 100644
--- a/src/test/rpc/LedgerEntry_test.cpp
+++ b/src/test/rpc/LedgerEntry_test.cpp
@@ -133,7 +133,6 @@ getTypeName(FieldType typeID)
         case FieldType::TwoAccountArrayField:
             return "length-2 array of Accounts";
         case FieldType::UInt32Field:
-            return "number";
         case FieldType::UInt64Field:
             return "number";
         default:
@@ -308,7 +307,6 @@ class LedgerEntry_test : public beast::unit_test::Suite
             case FieldType::TwoAccountArrayField:
                 return kTwoAccountArray;
             case FieldType::UInt32Field:
-                return 1;
             case FieldType::UInt64Field:
                 return 1;
             default:
diff --git a/src/test/unit_test/SuiteJournal.h b/src/test/unit_test/SuiteJournal.h
index bd54683031..174e9ff2ff 100644
--- a/src/test/unit_test/SuiteJournal.h
+++ b/src/test/unit_test/SuiteJournal.h
@@ -60,9 +60,8 @@ SuiteJournalSink::writeAlways(beast::Severity level, std::string const& text)
                 return "WRN:";
             case Severity::Error:
                 return "ERR:";
-            default:
-                break;
             case Severity::Fatal:
+            default:
                 break;
         }
         return "FTL:";
diff --git a/src/tests/libxrpl/tx/AccountSet.cpp b/src/tests/libxrpl/tx/AccountSet.cpp
index 46b298dde8..87d00c58bf 100644
--- a/src/tests/libxrpl/tx/AccountSet.cpp
+++ b/src/tests/libxrpl/tx/AccountSet.cpp
@@ -685,6 +685,7 @@ TEST(AccountSet, Gateway)
     IOU const usd("USD", gw);
 
     // Test gateway with a variety of allowed transfer rates
+    // NOLINTNEXTLINE(bugprone-float-loop-counter)
     for (double transferRate = 1.0; transferRate <= 2.0; transferRate += 0.03125)
     {
         TxTest env;
diff --git a/src/xrpld/core/detail/Config.cpp b/src/xrpld/core/detail/Config.cpp
index 1b2449823e..523cde743a 100644
--- a/src/xrpld/core/detail/Config.cpp
+++ b/src/xrpld/core/detail/Config.cpp
@@ -1006,13 +1006,9 @@ Config::loadFromString(std::string const& fileContents)
 
             if (!validatorsFile.empty())
             {
-                if (!boost::filesystem::exists(validatorsFile))
-                {
-                    validatorsFile.clear();
-                }
-                else if (
-                    !boost::filesystem::is_regular_file(validatorsFile) &&
-                    !boost::filesystem::is_symlink(validatorsFile))
+                if (!boost::filesystem::exists(validatorsFile) ||
+                    (!boost::filesystem::is_regular_file(validatorsFile) &&
+                     !boost::filesystem::is_symlink(validatorsFile)))
                 {
                     validatorsFile.clear();
                 }
diff --git a/src/xrpld/rpc/detail/PathRequestManager.cpp b/src/xrpld/rpc/detail/PathRequestManager.cpp
index ba42a0122f..7013353cb1 100644
--- a/src/xrpld/rpc/detail/PathRequestManager.cpp
+++ b/src/xrpld/rpc/detail/PathRequestManager.cpp
@@ -125,7 +125,8 @@ PathRequestManager::updateAll(std::shared_ptr<ReadView const> const& inLedger)
                             json::Value update = request->doUpdate(cache, false, continueCallback);
                             request->updateComplete();
                             update[jss::type] = "path_find";
-                            if ((ipSub = getSubscriber(request)))
+                            ipSub = getSubscriber(request);
+                            if (ipSub)
                             {
                                 ipSub->send(update, false);
                                 remove = false;
diff --git a/src/xrpld/rpc/detail/Pathfinder.cpp b/src/xrpld/rpc/detail/Pathfinder.cpp
index d7566622e8..fc788dea7d 100644
--- a/src/xrpld/rpc/detail/Pathfinder.cpp
+++ b/src/xrpld/rpc/detail/Pathfinder.cpp
@@ -646,21 +646,17 @@ Pathfinder::getBestPaths(
         {
             usePath = true;
         }
-        else if (extraPathsIterator->quality < pathsIterator->quality)
+        else if (extraPathsIterator->quality != pathsIterator->quality)
         {
-            useExtraPath = true;
+            // Prefer the lower (better) quality value
+            useExtraPath = extraPathsIterator->quality < pathsIterator->quality;
+            usePath = !useExtraPath;
         }
-        else if (extraPathsIterator->quality > pathsIterator->quality)
+        else if (extraPathsIterator->liquidity != pathsIterator->liquidity)
         {
-            usePath = true;
-        }
-        else if (extraPathsIterator->liquidity > pathsIterator->liquidity)
-        {
-            useExtraPath = true;
-        }
-        else if (extraPathsIterator->liquidity < pathsIterator->liquidity)
-        {
-            usePath = true;
+            // Equal quality: prefer the higher liquidity
+            useExtraPath = extraPathsIterator->liquidity > pathsIterator->liquidity;
+            usePath = !useExtraPath;
         }
         else
         {
@@ -795,31 +791,22 @@ Pathfinder::getPathsOut(
                     for (auto const& rspEntry : *lines)
                     {
                         if (pathAsset.get<Currency>() != rspEntry.getLimit().get<Issue>().currency)
-                        {
-                        }
-                        else if (
-                            rspEntry.getBalance() <= beast::kZero &&
+                            continue;
+                        if (rspEntry.getBalance() <= beast::kZero &&
                             (!rspEntry.getLimitPeer() ||
                              -rspEntry.getBalance() >= rspEntry.getLimitPeer() ||
                              (bAuthRequired && !rspEntry.getAuth())))
-                        {
-                        }
-                        else if (isDstAsset && dstAccount == rspEntry.getAccountIDPeer())
+                            continue;
+                        if (isDstAsset && dstAccount == rspEntry.getAccountIDPeer())
                         {
                             count += 10000;  // count a path to the destination extra
+                            continue;
                         }
-                        else if (rspEntry.getNoRipplePeer())
-                        {
-                            // This probably isn't a useful path out
-                        }
-                        else if (rspEntry.getFreezePeer())
-                        {
-                            // Not a useful path out
-                        }
-                        else
-                        {
-                            ++count;
-                        }
+                        if (rspEntry.getNoRipplePeer())
+                            continue;  // This probably isn't a useful path out
+                        if (rspEntry.getFreezePeer())
+                            continue;  // Not a useful path out
+                        ++count;
                     }
                 }
             },
@@ -828,26 +815,17 @@ Pathfinder::getPathsOut(
                 {
                     for (auto const& mpt : *mpts)
                     {
-                        if (pathAsset.get<MPTID>() != mpt.getMptID())
-                        {
-                        }
-                        else if (mpt.isZeroBalance() || mpt.isMaxedOut())
-                        {
-                        }
-                        else if (bAuthRequired)
-                        {
-                        }
-                        else if (isDstAsset && dstAccount == getMPTIssuer(mpt))
+                        if (pathAsset.get<MPTID>() != mpt.getMptID() || mpt.isZeroBalance() ||
+                            mpt.isMaxedOut() || bAuthRequired)
+                            continue;
+                        if (isDstAsset && dstAccount == getMPTIssuer(mpt))
                         {
                             count += 10000;
+                            continue;
                         }
-                        else if (isIndividualFrozen(*ledger_, account, MPTIssue{mpt.getMptID()}))
-                        {
-                        }
-                        else
-                        {
-                            ++count;
-                        }
+                        if (isIndividualFrozen(*ledger_, account, MPTIssue{mpt.getMptID()}))
+                            continue;
+                        ++count;
                     }
                 }
             });
@@ -1117,8 +1095,9 @@ Pathfinder::addLink(
                             if (checkAsset())
                             {
                                 // Can't leave on this path
+                                continue;
                             }
-                            else if (bToDestination)
+                            if (bToDestination)
                             {
                                 // destination is always worth trying
                                 if (uEndPathAsset == dstAmount_.asset())

From 809a6290752e4bfb484c602bf07beb9d19d898fb Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 29 Jun 2026 14:21:14 +0100
Subject: [PATCH 023/100] chore: Add a script to nicely format clang-tidy
 output (#7650)

---
 .github/workflows/reusable-clang-tidy.yml |  10 +--
 bin/filter-clang-tidy.py                  | 102 ++++++++++++++++++++++
 2 files changed, 107 insertions(+), 5 deletions(-)
 create mode 100755 bin/filter-clang-tidy.py

diff --git a/.github/workflows/reusable-clang-tidy.yml b/.github/workflows/reusable-clang-tidy.yml
index e66909ffad..68ddea3ea2 100644
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -96,10 +96,10 @@ jobs:
           set -o pipefail
           run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"
 
-      - name: Print errors
+      - name: Print filtered clang-tidy errors
         if: ${{ steps.run_clang_tidy.outcome != 'success' }}
         run: |
-          sed '/error\||/!d' "${OUTPUT_FILE}"
+          bin/filter-clang-tidy.py "${OUTPUT_FILE}"
 
       - name: Upload clang-tidy output
         if: ${{ github.event.repository.visibility == 'public' && steps.run_clang_tidy.outcome != 'success' }}
@@ -143,12 +143,12 @@ jobs:
           \`\`\`
           EOF
 
-      - name: Append clang-tidy output to issue body (filter for errors and warnings)
+      - name: Append filtered clang-tidy output to issue body
         if: ${{ steps.run_clang_tidy.outcome != 'success' }}
         run: |
           if [ -f "${OUTPUT_FILE}" ]; then
-              # Extract lines containing 'error:', 'warning:', or 'note:'
-              grep -E '(error:|warning:|note:)' "${OUTPUT_FILE}" >"${FILTERED_OUTPUT_FILE}" || true
+              # Filter to the unique errors with their source context.
+              bin/filter-clang-tidy.py "${OUTPUT_FILE}" >"${FILTERED_OUTPUT_FILE}" || true
 
               # If filtered output is empty, use original (might be a different error format)
               if [ ! -s "${FILTERED_OUTPUT_FILE}" ]; then
diff --git a/bin/filter-clang-tidy.py b/bin/filter-clang-tidy.py
new file mode 100755
index 0000000000..204a4e36f3
--- /dev/null
+++ b/bin/filter-clang-tidy.py
@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+
+"""
+Reduce run-clang-tidy output to its unique errors.
+
+It does two things:
+
+  1. Filters the raw output down to diagnostics and their source-context lines
+     (the indented "  103 | ..." / "      | ^" lines clang-tidy prints),
+     matching the "path:line:col: error:" diagnostic shape.
+
+  2. Deduplicates. The same diagnostic in a header is reported once per
+     translation unit that includes it, so identical error blocks are collapsed
+     to their first occurrence.
+
+An "error block" is an "error:" line together with the indented context lines
+and any "note:" lines that follow it (up to the next "error:" line). Blocks are
+compared as a whole, so an error stays attached to its own context, and
+first-occurrence order is preserved.
+
+The deduplicated output goes to stdout; a summary of unique error counts per
+check is printed to stderr.
+
+Usage:
+  bin/filter-clang-tidy.py [INPUT_FILE]            # read from file, or
+  run-clang-tidy ... | bin/filter-clang-tidy.py    # read from stdin
+"""
+
+import re
+import sys
+from collections import Counter
+
+# A clang-tidy diagnostic line looks like "path:line:col: error: msg [check]".
+# Matching on that shape (rather than a loose "error" substring) avoids treating
+# progress lines whose paths contain "error" as diagnostics, e.g.
+#   [284/850][0.7s] /nix/.../clang-tidy ... src/.../error.cpp
+DIAG_RE = re.compile(r":\d+:\d+: (?:error|warning|note):")
+ERROR_RE = re.compile(r":\d+:\d+: error:")
+CHECK_RE = re.compile(r" error: .*\[([^\],]+)")
+
+
+def filter_and_dedup(lines: list[str]) -> list[str]:
+    """Keep diagnostics with their context, then drop duplicate error blocks."""
+    blocks: list[str] = []
+    seen: set[str] = set()
+    current: list[str] = []
+
+    def flush() -> None:
+        if not current:
+            return
+        block = "".join(current)
+        if block not in seen:
+            seen.add(block)
+            blocks.append(block)
+
+    for line in lines:
+        # Keep only diagnostics and their indented source-context lines; drop
+        # progress/status output and blank lines.
+        if not (DIAG_RE.search(line) or line[:1] in (" ", "\t")):
+            continue
+        # An "error:" line starts a new block; its context and any following
+        # "note:" lines (and their context) belong to it.
+        if ERROR_RE.search(line):
+            flush()
+            current = []
+        current.append(line)
+    flush()
+
+    return blocks
+
+
+def summarize(blocks: list[str]) -> Counter[str]:
+    """Count unique errors per check name (e.g. "bugprone-branch-clone")."""
+    counts: Counter[str] = Counter()
+    for block in blocks:
+        # The error line is the first line of the block.
+        match = CHECK_RE.search(block.splitlines()[0])
+        if match:
+            counts[match.group(1)] += 1
+    return counts
+
+
+def main() -> int:
+    if len(sys.argv) > 1 and sys.argv[1] != "-":
+        with open(sys.argv[1], encoding="utf-8") as f:
+            lines = f.readlines()
+    else:
+        lines = sys.stdin.readlines()
+
+    blocks = filter_and_dedup(lines)
+    # Blank line between blocks so distinct errors are easy to tell apart.
+    sys.stdout.write("\n".join(blocks))
+
+    print("\nUnique errors per check:", file=sys.stderr)
+    for check, count in summarize(blocks).most_common():
+        print(f"{count:>4} {check}", file=sys.stderr)
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

From 62bfc4ca5b8ef0dcfc4d5e44199b254fc278ef01 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 30 Jun 2026 11:43:21 +0100
Subject: [PATCH 024/100] build: Mark sec256k1 and mpt-crypto as transitive
 headers (#7658)

---
 conanfile.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/conanfile.py b/conanfile.py
index aec4f9eab0..db12dcb585 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -30,10 +30,8 @@ class Xrpl(ConanFile):
         "ed25519/2015.03",
         "grpc/1.81.1",
         "libarchive/3.8.7",
-        "mpt-crypto/0.4.0-rc2",
         "nudb/2.0.9",
         "openssl/3.6.3",
-        "secp256k1/0.7.1",
         "soci/4.0.3",
         "zlib/1.3.2",
     ]
@@ -133,13 +131,15 @@ class Xrpl(ConanFile):
     def requirements(self):
         self.requires("boost/1.91.0", force=True, transitive_headers=True)
         self.requires("date/3.0.4", transitive_headers=True)
-        self.requires("lz4/1.10.0", force=True)
-        self.requires("protobuf/6.33.5", force=True)
-        self.requires("sqlite3/3.53.0", force=True)
         if self.options.jemalloc:
             self.requires("jemalloc/5.3.1")
+        self.requires("lz4/1.10.0", force=True)
+        self.requires("mpt-crypto/0.4.0-rc2", transitive_headers=True)
+        self.requires("protobuf/6.33.5", force=True)
         if self.options.rocksdb:
             self.requires("rocksdb/10.5.1")
+        self.requires("secp256k1/0.7.1", transitive_headers=True)
+        self.requires("sqlite3/3.53.0", force=True)
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (

From 95d53b4d43236ef9143aadc69c98a5e3c9b3b309 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 30 Jun 2026 11:43:44 +0100
Subject: [PATCH 025/100] ci: Use macOS 26 Tahoe with apple-clang 21 (#7601)

---
 .github/scripts/strategy-matrix/macos.json       | 2 +-
 .github/workflows/publish-docs.yml               | 2 +-
 .github/workflows/reusable-build-test-config.yml | 2 +-
 .github/workflows/reusable-clang-tidy.yml        | 2 +-
 .github/workflows/upload-conan-deps.yml          | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/strategy-matrix/macos.json b/.github/scripts/strategy-matrix/macos.json
index 66d7a55a43..2d3cc75c7b 100644
--- a/.github/scripts/strategy-matrix/macos.json
+++ b/.github/scripts/strategy-matrix/macos.json
@@ -1,6 +1,6 @@
 {
   "platform": "macos/arm64",
-  "runner": ["self-hosted", "macOS", "ARM64", "mac-runner-m1"],
+  "runner": ["self-hosted", "macOS", "ARM64", "macos-26-apple-clang-21"],
   "configs": [
     {
       "build_type": "Release",
diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index cb7d4c5382..bfa8d2e79c 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c47daebb2f9db64ffbac71b47d68a661498d5ce8
+        uses: XRPLF/actions/prepare-runner@9355d190fd7d4de80fadfd161e6edddc9702cd9f
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/reusable-build-test-config.yml b/.github/workflows/reusable-build-test-config.yml
index a81d9aec67..0cb0219d72 100644
--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -113,7 +113,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c47daebb2f9db64ffbac71b47d68a661498d5ce8
+        uses: XRPLF/actions/prepare-runner@9355d190fd7d4de80fadfd161e6edddc9702cd9f
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
diff --git a/.github/workflows/reusable-clang-tidy.yml b/.github/workflows/reusable-clang-tidy.yml
index 68ddea3ea2..b04847e137 100644
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c47daebb2f9db64ffbac71b47d68a661498d5ce8
+        uses: XRPLF/actions/prepare-runner@9355d190fd7d4de80fadfd161e6edddc9702cd9f
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/upload-conan-deps.yml b/.github/workflows/upload-conan-deps.yml
index 92b72cf6a9..88b364c2b1 100644
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c47daebb2f9db64ffbac71b47d68a661498d5ce8
+        uses: XRPLF/actions/prepare-runner@9355d190fd7d4de80fadfd161e6edddc9702cd9f
         with:
           enable_ccache: false
 

From 8abbd1ba3a194a652a158fcb6f3a0e9a13e4c9c1 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 30 Jun 2026 12:03:19 +0100
Subject: [PATCH 026/100] chore: Use std::ranges where possible (#7634)

---
 src/libxrpl/tx/ApplyContext.cpp               |  3 ++-
 src/libxrpl/tx/invariants/InvariantCheck.cpp  |  7 +++---
 .../tx/transactors/bridge/XChainBridge.cpp    |  7 +++---
 src/test/app/AmendmentTable_test.cpp          |  2 +-
 src/test/app/Manifest_test.cpp                |  7 +++---
 src/test/app/OfferMPT_test.cpp                | 14 +++++------
 src/test/app/XChain_test.cpp                  |  5 ++--
 .../beast/aged_associative_container_test.cpp | 20 ++++------------
 .../beast/beast_io_latency_probe_test.cpp     |  9 +++-----
 .../consensus/RCLCensorshipDetector_test.cpp  |  4 ++--
 src/test/csf/random.h                         |  2 +-
 src/test/peerfinder/Livecache_test.cpp        | 14 +++++------
 src/xrpld/app/ledger/detail/InboundLedger.cpp |  5 ++--
 src/xrpld/consensus/LedgerTrie.h              |  6 ++---
 src/xrpld/consensus/Validations.h             | 23 +++++++++----------
 src/xrpld/peerfinder/detail/Handouts.h        |  6 ++---
 src/xrpld/peerfinder/detail/Logic.h           | 18 +++++++--------
 src/xrpld/rpc/detail/ServerHandler.cpp        |  5 ++--
 18 files changed, 64 insertions(+), 93 deletions(-)

diff --git a/src/libxrpl/tx/ApplyContext.cpp b/src/libxrpl/tx/ApplyContext.cpp
index 93b0d101af..5e5ab90441 100644
--- a/src/libxrpl/tx/ApplyContext.cpp
+++ b/src/libxrpl/tx/ApplyContext.cpp
@@ -14,6 +14,7 @@
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/invariants/InvariantCheck.h>
 
+#include <algorithm>
 #include <array>
 #include <cstddef>
 #include <exception>
@@ -114,7 +115,7 @@ ApplyContext::checkInvariantsHelper(
             tx, result, fee, *view_, journal)...}};  // NOLINT(bugprone-unchecked-optional-access)
 
         // call each check's finalizer to see that it passes
-        if (!std::all_of(finalizers.cbegin(), finalizers.cend(), [](auto const& b) { return b; }))
+        if (!std::ranges::all_of(finalizers, [](auto const& b) { return b; }))
         {
             JLOG(journal.fatal()) << "Transaction has failed one or more global invariants: "
                                   << to_string(tx.getJson(JsonOptions::Values::None));
diff --git a/src/libxrpl/tx/invariants/InvariantCheck.cpp b/src/libxrpl/tx/invariants/InvariantCheck.cpp
index 231705efaf..308342da74 100644
--- a/src/libxrpl/tx/invariants/InvariantCheck.cpp
+++ b/src/libxrpl/tx/invariants/InvariantCheck.cpp
@@ -876,10 +876,9 @@ ValidPseudoAccounts::visitEntry(bool isDelete, SLE::const_ref before, SLE::const
             {
                 std::vector<SField const*> const& fields = getPseudoAccountFields();
 
-                auto const numFields =
-                    std::count_if(fields.begin(), fields.end(), [&after](SField const* sf) -> bool {
-                        return after->isFieldPresent(*sf);
-                    });
+                auto const numFields = std::ranges::count_if(
+                    fields,
+                    [&after](SField const* sf) -> bool { return after->isFieldPresent(*sf); });
                 if (numFields != 1)
                 {
                     std::stringstream error;
diff --git a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
index 1e9e0bfc61..9092ae4140 100644
--- a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
+++ b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
@@ -38,6 +38,7 @@
 #include <xrpl/tx/paths/Flow.h>
 #include <xrpl/tx/paths/detail/Steps.h>
 
+#include <algorithm>
 #include <cstdint>
 #include <expected>
 #include <limits>
@@ -301,10 +302,8 @@ onNewAttestations(
         }
 
         auto const& claimSigningAccount = att->attestationSignerAccount;
-        if (auto i = std::find_if(
-                attestations.begin(),
-                attestations.end(),
-                [&](auto const& a) { return a.keyAccount == claimSigningAccount; });
+        if (auto i = std::ranges::find_if(
+                attestations, [&](auto const& a) { return a.keyAccount == claimSigningAccount; });
             i != attestations.end())
         {
             // existing attestation
diff --git a/src/test/app/AmendmentTable_test.cpp b/src/test/app/AmendmentTable_test.cpp
index 7c2087bd4a..d420990cbc 100644
--- a/src/test/app/AmendmentTable_test.cpp
+++ b/src/test/app/AmendmentTable_test.cpp
@@ -140,7 +140,7 @@ private:
     combineArg(std::vector<Arg>& dest, std::vector<Arg> const& src, Args const&... args)
     {
         assert(dest.capacity() >= dest.size() + src.size());
-        std::copy(src.begin(), src.end(), std::back_inserter(dest));
+        std::ranges::copy(src, std::back_inserter(dest));
         if constexpr (sizeof...(args) > 0)
             combineArg(dest, args...);
     }
diff --git a/src/test/app/Manifest_test.cpp b/src/test/app/Manifest_test.cpp
index 0cf1155cf5..50e8ab4a8d 100644
--- a/src/test/app/Manifest_test.cpp
+++ b/src/test/app/Manifest_test.cpp
@@ -290,10 +290,9 @@ public:
                 if (inManifests.size() == loadedManifests.size())
                 {
                     BEAST_EXPECT(
-                        std::equal(
-                            inManifests.begin(),
-                            inManifests.end(),
-                            loadedManifests.begin(),
+                        std::ranges::equal(
+                            inManifests,
+                            loadedManifests,
                             [](Manifest const* lhs, Manifest const* rhs) { return *lhs == *rhs; }));
                 }
                 else
diff --git a/src/test/app/OfferMPT_test.cpp b/src/test/app/OfferMPT_test.cpp
index ac50924ac2..9958515c5f 100644
--- a/src/test/app/OfferMPT_test.cpp
+++ b/src/test/app/OfferMPT_test.cpp
@@ -3728,10 +3728,9 @@ public:
                     auto actorOffers = offersOnAccount(env, actor.acct);
                     auto const offerCount = std::distance(
                         actorOffers.begin(),
-                        std::remove_if(
-                            actorOffers.begin(), actorOffers.end(), [](SLE::const_pointer& offer) {
-                                return (*offer)[sfTakerGets].signum() == 0;
-                            }));
+                        std::ranges::remove_if(actorOffers, [](SLE::const_pointer& offer) {
+                            return (*offer)[sfTakerGets].signum() == 0;
+                        }).begin());
                     BEAST_EXPECT(offerCount == actor.offers);
 
                     env.require(Balance(actor.acct, actor.xrp));
@@ -3898,10 +3897,9 @@ public:
                     auto actorOffers = offersOnAccount(env, actor.acct);
                     auto const offerCount = std::distance(
                         actorOffers.begin(),
-                        std::remove_if(
-                            actorOffers.begin(), actorOffers.end(), [](SLE::const_pointer& offer) {
-                                return (*offer)[sfTakerGets].signum() == 0;
-                            }));
+                        std::ranges::remove_if(actorOffers, [](SLE::const_pointer& offer) {
+                            return (*offer)[sfTakerGets].signum() == 0;
+                        }).begin());
                     BEAST_EXPECT(offerCount == actor.offers);
 
                     env.require(Balance(actor.acct, actor.xrp));
diff --git a/src/test/app/XChain_test.cpp b/src/test/app/XChain_test.cpp
index 36c1a08144..437c329e02 100644
--- a/src/test/app/XChain_test.cpp
+++ b/src/test/app/XChain_test.cpp
@@ -306,9 +306,8 @@ struct BalanceTransfer
     [[nodiscard]] bool
     payeesReceived(STAmount const& reward) const
     {
-        return std::all_of(rewardAccounts.begin(), rewardAccounts.end(), [&](balance const& b) {
-            return b.diff() == reward;
-        });
+        return std::ranges::all_of(
+            rewardAccounts, [&](balance const& b) { return b.diff() == reward; });
     }
 
     bool
diff --git a/src/test/beast/aged_associative_container_test.cpp b/src/test/beast/aged_associative_container_test.cpp
index 2ac5fc5a33..413194491a 100644
--- a/src/test/beast/aged_associative_container_test.cpp
+++ b/src/test/beast/aged_associative_container_test.cpp
@@ -1296,13 +1296,7 @@ AgedAssociativeContainerTestBase::testChronological()
 
     typename Traits::template Cont<> c(v.begin(), v.end(), clock);
 
-    BEAST_EXPECT(
-        std::equal(
-            c.chronological.cbegin(),
-            c.chronological.cend(),
-            v.begin(),
-            v.end(),
-            EqualValue<Traits>()));
+    BEAST_EXPECT(std::ranges::equal(c.chronological, v, EqualValue<Traits>()));
 
     // Test touch() with a non-const iterator.
     for (auto iter(v.crbegin()); iter != v.crend(); ++iter)
@@ -1336,13 +1330,7 @@ AgedAssociativeContainerTestBase::testChronological()
         c.touch(found);
     }
 
-    BEAST_EXPECT(
-        std::equal(
-            c.chronological.cbegin(),
-            c.chronological.cend(),
-            v.cbegin(),
-            v.cend(),
-            EqualValue<Traits>()));
+    BEAST_EXPECT(std::ranges::equal(c.chronological, v, EqualValue<Traits>()));
 
     {
         // Because touch (reverse_iterator pos) is not allowed, the following
@@ -1407,8 +1395,8 @@ AgedAssociativeContainerTestBase::reverseFillAgedContainer(Container& c, Values
     clk.set(0);
 
     Values rev(values);
-    std::sort(rev.begin(), rev.end());
-    std::reverse(rev.begin(), rev.end());
+    std::ranges::sort(rev);
+    std::ranges::reverse(rev);
     for (auto& v : rev)
     {
         // Add values in reverse order so they are reversed chronologically.
diff --git a/src/test/beast/beast_io_latency_probe_test.cpp b/src/test/beast/beast_io_latency_probe_test.cpp
index b7e4980f05..9a93968dab 100644
--- a/src/test/beast/beast_io_latency_probe_test.cpp
+++ b/src/test/beast/beast_io_latency_probe_test.cpp
@@ -8,6 +8,7 @@
 #include <boost/asio/spawn.hpp>
 #include <boost/system/detail/error_code.hpp>
 
+#include <algorithm>
 #include <chrono>
 #include <condition_variable>  // IWYU pragma: keep
 #include <cstddef>
@@ -94,18 +95,14 @@ class io_latency_probe_test : public beast::unit_test::Suite, public beast::test
         auto
         getMax()
         {
-            return std::chrono::duration_cast<D>(
-                       *std::max_element(elapsedTimes.begin(), elapsedTimes.end()))
-                .count();
+            return std::chrono::duration_cast<D>(*std::ranges::max_element(elapsedTimes)).count();
         }
 
         template <class D>
         auto
         getMin()
         {
-            return std::chrono::duration_cast<D>(
-                       *std::min_element(elapsedTimes.begin(), elapsedTimes.end()))
-                .count();
+            return std::chrono::duration_cast<D>(*std::ranges::min_element(elapsedTimes)).count();
         }
     };
 #endif
diff --git a/src/test/consensus/RCLCensorshipDetector_test.cpp b/src/test/consensus/RCLCensorshipDetector_test.cpp
index 32117e0089..722a34f937 100644
--- a/src/test/consensus/RCLCensorshipDetector_test.cpp
+++ b/src/test/consensus/RCLCensorshipDetector_test.cpp
@@ -31,12 +31,12 @@ class RCLCensorshipDetector_test : public beast::unit_test::Suite
         cdet.check(std::move(accepted), [&remove, &remain](auto id, auto seq) {
             // If the item is supposed to be removed from the censorship
             // detector internal tracker manually, do it now:
-            if (std::find(remove.begin(), remove.end(), id) != remove.end())
+            if (std::ranges::find(remove, id) != remove.end())
                 return true;
 
             // If the item is supposed to still remain in the censorship
             // detector internal tracker; remove it from the vector.
-            auto it = std::find(remain.begin(), remain.end(), id);
+            auto it = std::ranges::find(remain, id);
             if (it != remain.end())
                 remain.erase(it);
             return false;
diff --git a/src/test/csf/random.h b/src/test/csf/random.h
index 30f98e37fe..c506397d88 100644
--- a/src/test/csf/random.h
+++ b/src/test/csf/random.h
@@ -44,7 +44,7 @@ std::vector<typename RandomNumberDistribution::result_type>
 sample(std::size_t size, RandomNumberDistribution dist, Generator& g)
 {
     std::vector<typename RandomNumberDistribution::result_type> res(size);
-    std::generate(res.begin(), res.end(), [&dist, &g]() { return dist(g); });
+    std::ranges::generate(res, [&dist, &g]() { return dist(g); });
     return res;
 }
 
diff --git a/src/test/peerfinder/Livecache_test.cpp b/src/test/peerfinder/Livecache_test.cpp
index 9dae410b5b..4f2d6e97e1 100644
--- a/src/test/peerfinder/Livecache_test.cpp
+++ b/src/test/peerfinder/Livecache_test.cpp
@@ -167,10 +167,9 @@ public:
         for (auto i = std::make_pair(0, c.hops.begin()); i.second != c.hops.end();
              ++i.first, ++i.second)
         {
-            std::copy((*i.second).begin(), (*i.second).end(), std::back_inserter(before[i.first]));
-            std::copy(
-                (*i.second).begin(), (*i.second).end(), std::back_inserter(beforeSorted[i.first]));
-            std::sort(beforeSorted[i.first].begin(), beforeSorted[i.first].end(), cmpEp);
+            std::ranges::copy(*i.second, std::back_inserter(before[i.first]));
+            std::ranges::copy(*i.second, std::back_inserter(beforeSorted[i.first]));
+            std::ranges::sort(beforeSorted[i.first], cmpEp);
         }
 
         c.hops.shuffle();
@@ -180,10 +179,9 @@ public:
         for (auto i = std::make_pair(0, c.hops.begin()); i.second != c.hops.end();
              ++i.first, ++i.second)
         {
-            std::copy((*i.second).begin(), (*i.second).end(), std::back_inserter(after[i.first]));
-            std::copy(
-                (*i.second).begin(), (*i.second).end(), std::back_inserter(afterSorted[i.first]));
-            std::sort(afterSorted[i.first].begin(), afterSorted[i.first].end(), cmpEp);
+            std::ranges::copy(*i.second, std::back_inserter(after[i.first]));
+            std::ranges::copy(*i.second, std::back_inserter(afterSorted[i.first]));
+            std::ranges::sort(afterSorted[i.first], cmpEp);
         }
 
         // each hop bucket should contain the same items
diff --git a/src/xrpld/app/ledger/detail/InboundLedger.cpp b/src/xrpld/app/ledger/detail/InboundLedger.cpp
index e4df126ee8..4affffd1c1 100644
--- a/src/xrpld/app/ledger/detail/InboundLedger.cpp
+++ b/src/xrpld/app/ledger/detail/InboundLedger.cpp
@@ -127,9 +127,8 @@ std::size_t
 InboundLedger::getPeerCount() const
 {
     auto const& peerIds = peerSet_->getPeerIds();
-    return std::count_if(peerIds.begin(), peerIds.end(), [this](auto id) {
-        return (app_.getOverlay().findPeerByShortID(id) != nullptr);
-    });
+    return std::ranges::count_if(
+        peerIds, [this](auto id) { return (app_.getOverlay().findPeerByShortID(id) != nullptr); });
 }
 
 void
diff --git a/src/xrpld/consensus/LedgerTrie.h b/src/xrpld/consensus/LedgerTrie.h
index cd9662ff02..b11a69a641 100644
--- a/src/xrpld/consensus/LedgerTrie.h
+++ b/src/xrpld/consensus/LedgerTrie.h
@@ -204,10 +204,8 @@ struct Node
     void
     erase(Node const* child)
     {
-        auto it = std::find_if(
-            children.begin(), children.end(), [child](std::unique_ptr<Node> const& curr) {
-                return curr.get() == child;
-            });
+        auto it = std::ranges::find_if(
+            children, [child](std::unique_ptr<Node> const& curr) { return curr.get() == child; });
         XRPL_ASSERT(it != children.end(), "xrpl::Node::erase : valid input");
         std::swap(*it, children.back());
         children.pop_back();
diff --git a/src/xrpld/consensus/Validations.h b/src/xrpld/consensus/Validations.h
index f109ae620b..d4da8a2887 100644
--- a/src/xrpld/consensus/Validations.h
+++ b/src/xrpld/consensus/Validations.h
@@ -817,16 +817,15 @@ public:
         if (!preferred)
         {
             // fall back to majority over acquiring ledgers
-            auto it = std::max_element(
-                acquiring_.begin(), acquiring_.end(), [](auto const& a, auto const& b) {
-                    std::pair<Seq, ID> const& aKey = a.first;
-                    typename hash_set<NodeID>::size_type const& aSize = a.second.size();
-                    std::pair<Seq, ID> const& bKey = b.first;
-                    typename hash_set<NodeID>::size_type const& bSize = b.second.size();
-                    // order by number of trusted peers validating that ledger
-                    // break ties with ledger ID
-                    return std::tie(aSize, aKey.second) < std::tie(bSize, bKey.second);
-                });
+            auto it = std::ranges::max_element(acquiring_, [](auto const& a, auto const& b) {
+                std::pair<Seq, ID> const& aKey = a.first;
+                typename hash_set<NodeID>::size_type const& aSize = a.second.size();
+                std::pair<Seq, ID> const& bKey = b.first;
+                typename hash_set<NodeID>::size_type const& bSize = b.second.size();
+                // order by number of trusted peers validating that ledger
+                // break ties with ledger ID
+                return std::tie(aSize, aKey.second) < std::tie(bSize, bKey.second);
+            });
             if (it != acquiring_.end())
                 return it->first;
             return std::nullopt;
@@ -896,7 +895,7 @@ public:
             return (preferred->first >= minSeq) ? preferred->second : lcl.id();
 
         // Otherwise, rely on peer ledgers
-        auto it = std::max_element(peerCounts.begin(), peerCounts.end(), [](auto& a, auto& b) {
+        auto it = std::ranges::max_element(peerCounts, [](auto const& a, auto const& b) {
             // Prefer larger counts, then larger ids on ties
             // (max_element expects this to return true if a < b)
             return std::tie(a.second, a.first) < std::tie(b.second, b.first);
@@ -932,7 +931,7 @@ public:
         }
 
         // Count parent ledgers as fallback
-        return std::count_if(lastLedger_.begin(), lastLedger_.end(), [&ledgerID](auto const& it) {
+        return std::ranges::count_if(lastLedger_, [&ledgerID](auto const& it) {
             auto const& curr = it.second;
             return curr.seq() > Seq{0} && curr[curr.seq() - Seq{1}] == ledgerID;
         });
diff --git a/src/xrpld/peerfinder/detail/Handouts.h b/src/xrpld/peerfinder/detail/Handouts.h
index 19a367f8c1..7523197c40 100644
--- a/src/xrpld/peerfinder/detail/Handouts.h
+++ b/src/xrpld/peerfinder/detail/Handouts.h
@@ -143,7 +143,7 @@ RedirectHandouts::tryInsert(Endpoint const& ep)
         return false;
 
     // Make sure the address isn't already in our list
-    if (std::any_of(list_.begin(), list_.end(), [&ep](Endpoint const& other) {
+    if (std::ranges::any_of(list_, [&ep](Endpoint const& other) {
             // Ignore port for security reasons
             return other.address.address() == ep.address.address();
         }))
@@ -222,7 +222,7 @@ SlotHandouts::tryInsert(Endpoint const& ep)
         return false;
 
     // Make sure the address isn't already in our list
-    if (std::any_of(list_.begin(), list_.end(), [&ep](Endpoint const& other) {
+    if (std::ranges::any_of(list_, [&ep](Endpoint const& other) {
             // Ignore port for security reasons
             return other.address.address() == ep.address.address();
         }))
@@ -311,7 +311,7 @@ ConnectHandouts::tryInsert(beast::IP::Endpoint const& endpoint)
         return false;
 
     // Make sure the address isn't already in our list
-    if (std::any_of(list_.begin(), list_.end(), [&endpoint](beast::IP::Endpoint const& other) {
+    if (std::ranges::any_of(list_, [&endpoint](beast::IP::Endpoint const& other) {
             // Ignore port for security reasons
             return other.address() == endpoint.address();
         }))
diff --git a/src/xrpld/peerfinder/detail/Logic.h b/src/xrpld/peerfinder/detail/Logic.h
index 55cce506ba..b74643f7a5 100644
--- a/src/xrpld/peerfinder/detail/Logic.h
+++ b/src/xrpld/peerfinder/detail/Logic.h
@@ -573,19 +573,17 @@ public:
                 // build list of active slots
                 std::vector<SlotImp::ptr> activeSlots;
                 activeSlots.reserve(slots.size());
-                std::for_each(
-                    slots.cbegin(), slots.cend(), [&activeSlots](Slots::value_type const& value) {
-                        if (value.second->state() == Slot::State::Active)
-                            activeSlots.emplace_back(value.second);
-                    });
+                std::ranges::for_each(slots, [&activeSlots](Slots::value_type const& value) {
+                    if (value.second->state() == Slot::State::Active)
+                        activeSlots.emplace_back(value.second);
+                });
                 std::shuffle(activeSlots.begin(), activeSlots.end(), defaultPrng());
 
                 // build target vector
                 targets.reserve(activeSlots.size());
-                std::for_each(
-                    activeSlots.cbegin(), activeSlots.cend(), [&targets](SlotImp::ptr const& slot) {
-                        targets.emplace_back(slot);
-                    });
+                std::ranges::for_each(activeSlots, [&targets](SlotImp::ptr const& slot) {
+                    targets.emplace_back(slot);
+                });
             }
 
             /* VFALCO NOTE
@@ -987,7 +985,7 @@ public:
         {
             auto const& address(iter->first.address());
             if (iter->second.when() <= now && squelches.find(address) == squelches.end() &&
-                std::none_of(slots.cbegin(), slots.cend(), [address](Slots::value_type const& v) {
+                std::ranges::none_of(slots, [address](Slots::value_type const& v) {
                     return address == v.first.address();
                 }))
             {
diff --git a/src/xrpld/rpc/detail/ServerHandler.cpp b/src/xrpld/rpc/detail/ServerHandler.cpp
index 5177c85738..768cbf0dc0 100644
--- a/src/xrpld/rpc/detail/ServerHandler.cpp
+++ b/src/xrpld/rpc/detail/ServerHandler.cpp
@@ -1179,9 +1179,8 @@ parsePorts(Config const& config, std::ostream& log)
     }
     else
     {
-        auto const count = std::count_if(result.cbegin(), result.cend(), [](Port const& p) {
-            return p.protocol.contains("peer");
-        });
+        auto const count = std::ranges::count_if(
+            result, [](Port const& p) { return p.protocol.contains("peer"); });
 
         if (count > 1)
         {

From ecf7f805c90538e177470febb0a3a5b989c60620 Mon Sep 17 00:00:00 2001
From: Vito Tumas <5780819+Tapanito@users.noreply.github.com>
Date: Wed, 1 Jul 2026 01:51:41 +0200
Subject: [PATCH 027/100] feat: Introduce lending 1.1 amendment and add
 `MemoData` field to `VaultDelete` transaction (#6324)

---
 include/xrpl/protocol/detail/features.macro   |  1 +
 .../xrpl/protocol/detail/transactions.macro   |  1 +
 .../transactions/VaultDelete.h                | 37 ++++++++++
 .../tx/transactors/vault/VaultDelete.cpp      |  8 +++
 src/test/app/Vault_test.cpp                   | 70 +++++++++++++++++++
 .../transactions/VaultDeleteTests.cpp         | 49 +++++++++++++
 6 files changed, 166 insertions(+)

diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index a9b237be32..3c808d960b 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -14,6 +14,7 @@
 
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
+XRPL_FEATURE(LendingProtocolV1_1,         Supported::No, VoteBehavior::DefaultNo)
 XRPL_FEATURE(ConfidentialTransfer,        Supported::No, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_3_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_2_0,                Supported::Yes, VoteBehavior::DefaultNo)
diff --git a/include/xrpl/protocol/detail/transactions.macro b/include/xrpl/protocol/detail/transactions.macro
index 8a3b0ff2ce..b46fca92b6 100644
--- a/include/xrpl/protocol/detail/transactions.macro
+++ b/include/xrpl/protocol/detail/transactions.macro
@@ -889,6 +889,7 @@ TRANSACTION(ttVAULT_DELETE, 67, VaultDelete,
     MustDeleteAcct | DestroyMptIssuance | MustModifyVault,
     ({
     {sfVaultID, SoeRequired},
+    {sfMemoData, SoeOptional},
 }))
 
 /** This transaction trades assets for shares with a vault. */
diff --git a/include/xrpl/protocol_autogen/transactions/VaultDelete.h b/include/xrpl/protocol_autogen/transactions/VaultDelete.h
index 2b6e248c0a..b4c08ae229 100644
--- a/include/xrpl/protocol_autogen/transactions/VaultDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/VaultDelete.h
@@ -57,6 +57,32 @@ public:
     {
         return this->tx_->at(sfVaultID);
     }
+
+    /**
+     * @brief Get sfMemoData (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getMemoData() const
+    {
+        if (hasMemoData())
+        {
+            return this->tx_->at(sfMemoData);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfMemoData is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasMemoData() const
+    {
+        return this->tx_->isFieldPresent(sfMemoData);
+    }
 };
 
 /**
@@ -112,6 +138,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfMemoData (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    VaultDeleteBuilder&
+    setMemoData(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfMemoData] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the VaultDelete wrapper.
      * @param publicKey The public key for signing.
diff --git a/src/libxrpl/tx/transactors/vault/VaultDelete.cpp b/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
index 0550f08b17..fa38ae278b 100644
--- a/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
@@ -7,8 +7,10 @@
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STNumber.h>  // IWYU pragma: keep
@@ -28,6 +30,12 @@ VaultDelete::preflight(PreflightContext const& ctx)
         return temMALFORMED;
     }
 
+    if (ctx.tx.isFieldPresent(sfMemoData) && !ctx.rules.enabled(featureLendingProtocolV1_1))
+        return temDISABLED;
+
+    if (!validDataLength(ctx.tx[~sfMemoData], kMaxDataPayloadLength))
+        return temMALFORMED;
+
     return tesSUCCESS;
 }
 
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index 9b29442197..d9afd93b23 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -7511,6 +7511,74 @@ class Vault_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testVaultDeleteMemoData()
+    {
+        using namespace test::jtx;
+
+        Env env{*this};
+
+        Account const owner{"owner"};
+        env.fund(XRP(1'000'000), owner);
+        env.close();
+
+        Vault const vault{env};
+
+        auto const keylet = keylet::vault(owner.id(), 1);
+        auto delTx = vault.del({.owner = owner, .id = keylet.key});
+
+        // Test VaultDelete with featureLendingProtocolV1_1 disabled
+        // Transaction fails if the data field is provided
+        {
+            testcase("VaultDelete memo data featureLendingProtocolV1_1 disabled");
+            env.disableFeature(featureLendingProtocolV1_1);
+            delTx[sfMemoData] = strHex(std::string(kMaxDataPayloadLength, 'A'));
+            env(delTx, Ter(temDISABLED));
+            env.enableFeature(featureLendingProtocolV1_1);
+            env.close();
+        }
+
+        // Transaction fails if the data field is too large
+        {
+            testcase("VaultDelete memo data featureLendingProtocolV1_1 enabled data too large");
+            delTx[sfMemoData] = strHex(std::string(kMaxDataPayloadLength + 1, 'A'));
+            env(delTx, Ter(temMALFORMED));
+            env.close();
+        }
+
+        // Transaction fails if the data field is set, but is empty
+        {
+            testcase("VaultDelete memo data featureLendingProtocolV1_1 enabled data empty");
+            delTx[sfMemoData] = strHex(std::string(0, 'A'));
+            env(delTx, Ter(temMALFORMED));
+            env.close();
+        }
+
+        {
+            testcase("VaultDelete memo data featureLendingProtocolV1_1 enabled no vault");
+            auto const keylet = keylet::vault(owner.id(), env.seq(owner));
+
+            // Recreate the transaction as the vault keylet changed
+            auto delTx = vault.del({.owner = owner, .id = keylet.key});
+            delTx[sfMemoData] = strHex(std::string(kMaxDataPayloadLength, 'A'));
+            env(delTx, Ter(tecNO_ENTRY));
+            env.close();
+        }
+
+        {
+            testcase("VaultDelete memo data featureLendingProtocolV1_1 enabled data valid");
+            PrettyAsset const xrpAsset = xrpIssue();
+            auto const [tx, keylet] = vault.create({.owner = owner, .asset = xrpAsset});
+            env(tx, Ter(tesSUCCESS));
+            env.close();
+            // Recreate the transaction as the vault keylet changed
+            auto delTx = vault.del({.owner = owner, .id = keylet.key});
+            delTx[sfMemoData] = strHex(std::string(kMaxDataPayloadLength, 'A'));
+            env(delTx, Ter(tesSUCCESS));
+            env.close();
+        }
+    }
+
     void
     testVaultDepositFreeze()
     {
@@ -8082,6 +8150,7 @@ class Vault_test : public beast::unit_test::Suite
 
             runTests();
             env.disableFeature(fixCleanup3_3_0);
+
             runTests();
             env.enableFeature(fixCleanup3_3_0);
         }
@@ -8115,6 +8184,7 @@ public:
         testVaultClawbackAssets();
         testVaultEscrowedMPT();
         testAssetsMaximum();
+        testVaultDeleteMemoData();
         testBug6LimitBypassWithShares();
         testRemoveEmptyHoldingLockedAmount();
         testRemoveEmptyHoldingConfidentialBalances();
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/VaultDeleteTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/VaultDeleteTests.cpp
index 70747af1ed..8f0eb2e4cd 100644
--- a/src/tests/libxrpl/protocol_autogen/transactions/VaultDeleteTests.cpp
+++ b/src/tests/libxrpl/protocol_autogen/transactions/VaultDeleteTests.cpp
@@ -30,6 +30,7 @@ TEST(TransactionsVaultDeleteTests, BuilderSettersRoundTrip)
 
     // Transaction-specific field values
     auto const vaultIDValue = canonical_UINT256();
+    auto const memoDataValue = canonical_VL();
 
     VaultDeleteBuilder builder{
         accountValue,
@@ -39,6 +40,7 @@ TEST(TransactionsVaultDeleteTests, BuilderSettersRoundTrip)
     };
 
     // Set optional fields
+    builder.setMemoData(memoDataValue);
 
     auto tx = builder.build(publicKey, secretKey);
 
@@ -62,6 +64,14 @@ TEST(TransactionsVaultDeleteTests, BuilderSettersRoundTrip)
     }
 
     // Verify optional fields
+    {
+        auto const& expected = memoDataValue;
+        auto const actualOpt = tx.getMemoData();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfMemoData should be present";
+        expectEqualField(expected, *actualOpt, "sfMemoData");
+        EXPECT_TRUE(tx.hasMemoData());
+    }
+
 }
 
 // 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
@@ -79,6 +89,7 @@ TEST(TransactionsVaultDeleteTests, BuilderFromStTxRoundTrip)
 
     // Transaction-specific field values
     auto const vaultIDValue = canonical_UINT256();
+    auto const memoDataValue = canonical_VL();
 
     // Build an initial transaction
     VaultDeleteBuilder initialBuilder{
@@ -88,6 +99,7 @@ TEST(TransactionsVaultDeleteTests, BuilderFromStTxRoundTrip)
         feeValue
     };
 
+    initialBuilder.setMemoData(memoDataValue);
 
     auto initialTx = initialBuilder.build(publicKey, secretKey);
 
@@ -112,6 +124,13 @@ TEST(TransactionsVaultDeleteTests, BuilderFromStTxRoundTrip)
     }
 
     // Verify optional fields
+    {
+        auto const& expected = memoDataValue;
+        auto const actualOpt = rebuiltTx.getMemoData();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfMemoData should be present";
+        expectEqualField(expected, *actualOpt, "sfMemoData");
+    }
+
 }
 
 // 3) Verify wrapper throws when constructed from wrong transaction type.
@@ -142,5 +161,35 @@ TEST(TransactionsVaultDeleteTests, BuilderThrowsOnWrongTxType)
     EXPECT_THROW(VaultDeleteBuilder{wrongTx.getSTTx()}, std::runtime_error);
 }
 
+// 5) Build with only required fields and verify optional fields return nullopt.
+TEST(TransactionsVaultDeleteTests, OptionalFieldsReturnNullopt)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testVaultDeleteNullopt"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 3;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific required field values
+    auto const vaultIDValue = canonical_UINT256();
+
+    VaultDeleteBuilder builder{
+        accountValue,
+        vaultIDValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Do NOT set optional fields
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    // Verify optional fields are not present
+    EXPECT_FALSE(tx.hasMemoData());
+    EXPECT_FALSE(tx.getMemoData().has_value());
+}
 
 }

From 86d8b244d6e9b61952de736c010c789e12c6498e Mon Sep 17 00:00:00 2001
From: Denis Angell <dangell@transia.co>
Date: Wed, 1 Jul 2026 08:47:14 -0400
Subject: [PATCH 028/100] feat: Add Batch (XLS-56) V1_1 (#6446)

Co-authored-by: Mayukha Vadari <mvadari@ripple.com>
---
 include/xrpl/core/HashRouter.h                |    6 +-
 include/xrpl/ledger/OpenView.h                |    2 +-
 include/xrpl/protocol/Batch.h                 |   10 +-
 include/xrpl/protocol/Protocol.h              |    3 +
 include/xrpl/protocol/STObject.h              |    5 +
 include/xrpl/protocol/STTx.h                  |   53 +-
 include/xrpl/protocol/TER.h                   |    2 +
 include/xrpl/protocol/detail/features.macro   |    8 +-
 .../xrpl/protocol/detail/transactions.macro   |    2 +-
 .../protocol_autogen/transactions/Batch.h     |    2 +-
 include/xrpl/tx/ApplyContext.h                |    6 +-
 include/xrpl/tx/Transactor.h                  |   49 +-
 include/xrpl/tx/transactors/system/Batch.h    |    8 +-
 src/libxrpl/protocol/STObject.cpp             |   14 +
 src/libxrpl/protocol/STTx.cpp                 |  133 +-
 src/libxrpl/protocol/TER.cpp                  |    2 +
 src/libxrpl/tx/Transactor.cpp                 |  105 +-
 src/libxrpl/tx/apply.cpp                      |   34 +-
 .../tx/transactors/lending/LoanSet.cpp        |    2 +-
 .../tx/transactors/payment/Payment.cpp        |   32 +-
 src/libxrpl/tx/transactors/system/Batch.cpp   |  153 +-
 src/test/app/Batch_test.cpp                   | 1227 ++++++++++++++---
 .../app/ConfidentialTransferExtended_test.cpp |   35 +-
 src/test/app/LedgerReplay_test.cpp            |   45 +-
 src/test/app/TxQ_test.cpp                     |    3 +-
 src/test/jtx/TestHelpers.h                    |    4 +-
 src/test/jtx/batch.h                          |    5 +-
 src/test/jtx/impl/batch.cpp                   |   16 +-
 src/test/rpc/Feature_test.cpp                 |    2 +-
 src/test/rpc/Simulate_test.cpp                |   16 +-
 src/xrpld/app/ledger/detail/BuildLedger.cpp   |    9 +
 src/xrpld/app/misc/NetworkOPs.cpp             |    7 +-
 src/xrpld/app/misc/detail/TxQ.cpp             |    7 +
 src/xrpld/overlay/detail/PeerImp.cpp          |    4 +-
 .../rpc/handlers/transaction/Simulate.cpp     |    8 +
 35 files changed, 1536 insertions(+), 483 deletions(-)

diff --git a/include/xrpl/core/HashRouter.h b/include/xrpl/core/HashRouter.h
index d36b8aee6e..c8b34d8e93 100644
--- a/include/xrpl/core/HashRouter.h
+++ b/include/xrpl/core/HashRouter.h
@@ -19,12 +19,14 @@ enum class HashRouterFlags : std::uint16_t {
     HELD = 0x08,     // Held by LedgerMaster after potential processing failure
     TRUSTED = 0x10,  // Comes from a trusted source
 
-    // Private flags (used internally in apply.cpp)
-    // Do not attempt to read, set, or reuse.
+    // Private flags. Each group is owned by one file; do not read, set, or
+    // reuse a flag outside the file noted.
+    // Used in apply.cpp
     PRIVATE1 = 0x0100,
     PRIVATE2 = 0x0200,
     PRIVATE3 = 0x0400,
     PRIVATE4 = 0x0800,
+    // Used in EscrowFinish.cpp
     PRIVATE5 = 0x1000,
     PRIVATE6 = 0x2000
 };
diff --git a/include/xrpl/ledger/OpenView.h b/include/xrpl/ledger/OpenView.h
index 4ba2a7759b..d145473516 100644
--- a/include/xrpl/ledger/OpenView.h
+++ b/include/xrpl/ledger/OpenView.h
@@ -28,7 +28,7 @@ inline constexpr struct OpenLedgerT
 /** Batch view construction tag.
 
     Views constructed with this tag are part of a stack of views
-    used during batch transaction applied.
+    used during batch transaction application.
  */
 inline constexpr struct BatchViewT
 {
diff --git a/include/xrpl/protocol/Batch.h b/include/xrpl/protocol/Batch.h
index 2f2412b3ff..4e021442d6 100644
--- a/include/xrpl/protocol/Batch.h
+++ b/include/xrpl/protocol/Batch.h
@@ -1,5 +1,6 @@
 #pragma once
 
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/Serializer.h>
@@ -7,9 +8,16 @@
 namespace xrpl {
 
 inline void
-serializeBatch(Serializer& msg, std::uint32_t const& flags, std::vector<uint256> const& txids)
+serializeBatch(
+    Serializer& msg,
+    AccountID const& outerAccount,
+    std::uint32_t outerSeqValue,
+    std::uint32_t const& flags,
+    std::vector<uint256> const& txids)
 {
     msg.add32(HashPrefix::Batch);
+    msg.addBitString(outerAccount);
+    msg.add32(outerSeqValue);
     msg.add32(flags);
     msg.add32(std::uint32_t(txids.size()));
     for (auto const& txid : txids)
diff --git a/include/xrpl/protocol/Protocol.h b/include/xrpl/protocol/Protocol.h
index 7eac92e83c..ba6347dfa7 100644
--- a/include/xrpl/protocol/Protocol.h
+++ b/include/xrpl/protocol/Protocol.h
@@ -311,6 +311,9 @@ constexpr std::size_t kPermissionMaxSize = 10;
 /** The maximum number of transactions that can be in a batch. */
 constexpr std::size_t kMaxBatchTxCount = 8;
 
+/** The maximum number of batch signers. */
+constexpr std::size_t kMaxBatchSigners = kMaxBatchTxCount * 3;
+
 /** Length of a secp256k1 scalar in bytes. */
 constexpr std::size_t kEcScalarLength = kMPT_SCALAR_SIZE;
 
diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index e65cc79c78..044e48ce62 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -217,6 +217,11 @@ public:
     [[nodiscard]] AccountID
     getAccountID(SField const& field) const;
 
+    /** The account responsible for the fee and authorization: the delegate when
+        sfDelegate is present, otherwise the account. */
+    [[nodiscard]] AccountID
+    getFeePayer() const;
+
     [[nodiscard]] Blob
     getFieldVL(SField const& field) const;
     [[nodiscard]] STAmount const&
diff --git a/include/xrpl/protocol/STTx.h b/include/xrpl/protocol/STTx.h
index 659fede31d..e78fce27a1 100644
--- a/include/xrpl/protocol/STTx.h
+++ b/include/xrpl/protocol/STTx.h
@@ -12,6 +12,7 @@
 
 #include <expected>
 #include <functional>
+#include <optional>
 
 namespace xrpl {
 
@@ -51,51 +52,48 @@ public:
     STTx(TxType type, std::function<void(STObject&)> assembler);
 
     // STObject functions.
-    SerializedTypeID
+    [[nodiscard]] SerializedTypeID
     getSType() const override;
 
-    std::string
+    [[nodiscard]] std::string
     getFullText() const override;
 
     // Outer transaction functions / signature functions.
     static Blob
     getSignature(STObject const& sigObject);
 
-    Blob
+    [[nodiscard]] Blob
     getSignature() const
     {
         return getSignature(*this);
     }
 
-    uint256
+    [[nodiscard]] uint256
     getSigningHash() const;
 
-    TxType
+    [[nodiscard]] TxType
     getTxnType() const;
 
-    Blob
+    [[nodiscard]] Blob
     getSigningPubKey() const;
 
-    SeqProxy
+    [[nodiscard]] SeqProxy
     getSeqProxy() const;
 
     /** Returns the first non-zero value of (Sequence, TicketSequence). */
-    std::uint32_t
+    [[nodiscard]] std::uint32_t
     getSeqValue() const;
 
-    AccountID
-    getFeePayer() const;
-
-    boost::container::flat_set<AccountID>
+    [[nodiscard]] boost::container::flat_set<AccountID>
     getMentionedAccounts() const;
 
-    uint256
+    [[nodiscard]] uint256
     getTransactionID() const;
 
-    json::Value
+    [[nodiscard]] json::Value
     getJson(JsonOptions options) const override;
 
-    json::Value
+    [[nodiscard]] json::Value
     getJson(JsonOptions options, bool binary) const;
 
     void
@@ -108,27 +106,27 @@ public:
         @param rules The current ledger rules.
         @return `true` if valid signature. If invalid, the error message string.
     */
-    std::expected<void, std::string>
+    [[nodiscard]] std::expected<void, std::string>
     checkSign(Rules const& rules) const;
 
-    std::expected<void, std::string>
+    [[nodiscard]] std::expected<void, std::string>
     checkBatchSign(Rules const& rules) const;
 
     // SQL Functions with metadata.
     static std::string const&
     getMetaSQLInsertReplaceHeader();
 
-    std::string
+    [[nodiscard]] std::string
     getMetaSQL(std::uint32_t inLedger, std::string const& escapedMetaData) const;
 
-    std::string
+    [[nodiscard]] std::string
     getMetaSQL(
         Serializer rawTxn,
         std::uint32_t inLedger,
         TxnSql status,
         std::string const& escapedMetaData) const;
 
-    std::vector<uint256> const&
+    [[nodiscard]] std::vector<uint256> const&
     getBatchTransactionIDs() const;
 
 private:
@@ -138,28 +136,31 @@ private:
             Will be *this more often than not.
         @return `true` if valid signature. If invalid, the error message string.
     */
-    std::expected<void, std::string>
+    [[nodiscard]] std::expected<void, std::string>
     checkSign(Rules const& rules, STObject const& sigObject) const;
 
-    std::expected<void, std::string>
+    [[nodiscard]] std::expected<void, std::string>
     checkSingleSign(STObject const& sigObject) const;
 
-    std::expected<void, std::string>
+    [[nodiscard]] std::expected<void, std::string>
     checkMultiSign(Rules const& rules, STObject const& sigObject) const;
 
-    std::expected<void, std::string>
+    [[nodiscard]] std::expected<void, std::string>
     checkBatchSingleSign(STObject const& batchSigner) const;
 
-    std::expected<void, std::string>
+    [[nodiscard]] std::expected<void, std::string>
     checkBatchMultiSign(STObject const& batchSigner, Rules const& rules) const;
 
+    void
+    buildBatchTxnIds();
+
     STBase*
     copy(std::size_t n, void* buf) const override;
     STBase*
     move(std::size_t n, void* buf) override;
 
     friend class detail::STVar;
-    mutable std::vector<uint256> batchTxnIds_;
+    std::optional<std::vector<uint256>> batchTxnIds_;
 };
 
 bool
diff --git a/include/xrpl/protocol/TER.h b/include/xrpl/protocol/TER.h
index 84c344ea76..4ee084e714 100644
--- a/include/xrpl/protocol/TER.h
+++ b/include/xrpl/protocol/TER.h
@@ -175,6 +175,8 @@ enum TEFcodes : TERUnderlyingType {
     tefNO_TICKET,
     tefNFTOKEN_IS_NOT_TRANSFERABLE,
     tefINVALID_LEDGER_FIX_TYPE,
+    tefNO_DST_PARTIAL,
+    tefBAD_PATH_COUNT,
 };
 
 //------------------------------------------------------------------------------
diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index 3c808d960b..a1911761bb 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -14,13 +14,14 @@
 
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
-XRPL_FEATURE(LendingProtocolV1_1,         Supported::No, VoteBehavior::DefaultNo)
-XRPL_FEATURE(ConfidentialTransfer,        Supported::No, VoteBehavior::DefaultNo)
+
+XRPL_FEATURE(BatchV1_1,                   Supported::No,  VoteBehavior::DefaultNo)
+XRPL_FEATURE(LendingProtocolV1_1,         Supported::No,  VoteBehavior::DefaultNo)
+XRPL_FEATURE(ConfidentialTransfer,        Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_3_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_2_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(MPTokensV2,                  Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_1_3,                Supported::Yes, VoteBehavior::DefaultYes)
-XRPL_FIX    (BatchInnerSigs,              Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(LendingProtocol,             Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(PermissionDelegationV1_1,    Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (DirectoryLimit,              Supported::Yes, VoteBehavior::DefaultNo)
@@ -34,7 +35,6 @@ XRPL_FEATURE(TokenEscrow,                 Supported::Yes, VoteBehavior::DefaultN
 XRPL_FIX    (EnforceNFTokenTrustlineV2,   Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (AMMv1_3,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(PermissionedDEX,             Supported::Yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(Batch,                       Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(SingleAssetVault,            Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (PayChanCancelAfter,          Supported::Yes, VoteBehavior::DefaultNo)
 // Check flags in Credential transactions
diff --git a/include/xrpl/protocol/detail/transactions.macro b/include/xrpl/protocol/detail/transactions.macro
index b46fca92b6..b0c4f66bae 100644
--- a/include/xrpl/protocol/detail/transactions.macro
+++ b/include/xrpl/protocol/detail/transactions.macro
@@ -940,7 +940,7 @@ TRANSACTION(ttVAULT_CLAWBACK, 70, VaultClawback,
 #endif
 TRANSACTION(ttBATCH, 71, Batch,
     Delegation::NotDelegable,
-    featureBatch,
+    featureBatchV1_1,
     NoPriv,
     ({
     {sfRawTransactions, SoeRequired},
diff --git a/include/xrpl/protocol_autogen/transactions/Batch.h b/include/xrpl/protocol_autogen/transactions/Batch.h
index 55b99d0eef..00f553ada7 100644
--- a/include/xrpl/protocol_autogen/transactions/Batch.h
+++ b/include/xrpl/protocol_autogen/transactions/Batch.h
@@ -20,7 +20,7 @@ class BatchBuilder;
  *
  * Type: ttBATCH (71)
  * Delegable: Delegation::NotDelegable
- * Amendment: featureBatch
+ * Amendment: featureBatchV1_1
  * Privileges: NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
diff --git a/include/xrpl/tx/ApplyContext.h b/include/xrpl/tx/ApplyContext.h
index 8540037601..c98b3f82c5 100644
--- a/include/xrpl/tx/ApplyContext.h
+++ b/include/xrpl/tx/ApplyContext.h
@@ -24,6 +24,10 @@ public:
         ApplyFlags flags,
         beast::Journal journal = beast::Journal{beast::Journal::getNullSink()});
 
+    // Convenience constructor used only by tests that build an ApplyContext
+    // directly (e.g. invariant checks). Production always uses the parentBatchId
+    // constructor above; this one fixes parentBatchId to std::nullopt and so is
+    // never valid for a batch inner (hence the TapBatch assert).
     explicit ApplyContext(
         ServiceRegistry& registry,
         OpenView& base,
@@ -124,7 +128,7 @@ private:
     ApplyFlags flags_;
     std::optional<ApplyViewImpl> view_;
 
-    // The ID of the batch transaction we are executing under, if seated.
+    // The ID of the batch transaction we are executing under, if set.
     std::optional<uint256 const> parentBatchId_;
 };
 
diff --git a/include/xrpl/tx/Transactor.h b/include/xrpl/tx/Transactor.h
index 02fedfe970..2b50cfa6e7 100644
--- a/include/xrpl/tx/Transactor.h
+++ b/include/xrpl/tx/Transactor.h
@@ -180,9 +180,6 @@ public:
     static NotTEC
     checkSign(PreclaimContext const& ctx);
 
-    static NotTEC
-    checkBatchSign(PreclaimContext const& ctx);
-
     // Returns the fee in fee units, not scaled for load.
     static XRPAmount
     calculateBaseFee(ReadView const& view, STTx const& tx);
@@ -373,7 +370,12 @@ protected:
         std::optional<uint256 const> const& parentBatchId,
         AccountID const& idAccount,
         STObject const& sigObject,
-        beast::Journal const j);
+        beast::Journal const j,
+        // A batch may carry an inner from an account that an earlier inner
+        // creates, so the signer account need not exist yet; when it does not,
+        // only its own master key may authorize it. Normal transactions require
+        // the account to already exist.
+        bool permitUncreatedAccount = false);
 
     // Base class always returns true
     static bool
@@ -413,25 +415,8 @@ protected:
         std::optional<T> value,
         unit::ValueUnit<Unit, T> min = unit::ValueUnit<Unit, T>{});
 
-private:
-    static NotTEC
-    checkPermission(
-        ReadView const& view,
-        STTx const& tx,
-        std::unordered_set<GranularPermissionType>& heldGranularPermissions);
-
-    std::pair<TER, XRPAmount>
-    reset(XRPAmount fee);
-
-    TER
-    consumeSeqProxy(SLE::pointer const& sleAccount);
-
-    TER
-    payFee();
-
-    std::tuple<TER, XRPAmount, bool>
-    processPersistentChanges(TER result, XRPAmount fee);
-
+    // Signature-authorization helpers. protected so the Batch transactor can
+    // reuse them when validating each BatchSigner in Batch::checkBatchSign.
     static NotTEC
     checkSingleSign(
         ReadView const& view,
@@ -448,6 +433,24 @@ private:
         STObject const& sigObject,
         beast::Journal const j);
 
+private:
+    static NotTEC
+    checkPermission(
+        ReadView const& view,
+        STTx const& tx,
+        std::unordered_set<GranularPermissionType>& heldGranularPermissions);
+
+    std::pair<TER, XRPAmount>
+    reset(XRPAmount fee);
+
+    TER
+    consumeSeqProxy(SLE::pointer const& sleAccount);
+    TER
+    payFee();
+
+    std::tuple<TER, XRPAmount, bool>
+    processPersistentChanges(TER result, XRPAmount fee);
+
     void trapTransaction(uint256) const;
 
     /** Performs early sanity checks on the account and fee fields.
diff --git a/include/xrpl/tx/transactors/system/Batch.h b/include/xrpl/tx/transactors/system/Batch.h
index 43f0103319..927a5b27cd 100644
--- a/include/xrpl/tx/transactors/system/Batch.h
+++ b/include/xrpl/tx/transactors/system/Batch.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <xrpl/basics/Log.h>
-#include <xrpl/protocol/Indexes.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
@@ -61,6 +59,12 @@ public:
         ttLOAN_MANAGE,
         ttLOAN_PAY,
     });
+
+private:
+    // Skips signature verification for inner txns, so keep it private: it must
+    // only be reached through Batch::checkSign.
+    static NotTEC
+    checkBatchSign(PreclaimContext const& ctx);
 };
 
 }  // namespace xrpl
diff --git a/src/libxrpl/protocol/STObject.cpp b/src/libxrpl/protocol/STObject.cpp
index e16cbc871f..445da16828 100644
--- a/src/libxrpl/protocol/STObject.cpp
+++ b/src/libxrpl/protocol/STObject.cpp
@@ -635,6 +635,20 @@ STObject::getAccountID(SField const& field) const
     return getFieldByValue<STAccount>(field);
 }
 
+AccountID
+STObject::getFeePayer() const
+{
+    // If sfDelegate is present, the delegate account is the payer
+    // note: if a delegate is specified, its authorization to act on behalf of the account is
+    // enforced in `Transactor::invokeCheckPermission`
+    // cryptographic signature validity is checked separately (e.g., in `Transactor::checkSign`)
+    if (isFieldPresent(sfDelegate))
+        return getAccountID(sfDelegate);
+
+    // Default payer
+    return getAccountID(sfAccount);
+}
+
 Blob
 STObject::getFieldVL(SField const& field) const
 {
diff --git a/src/libxrpl/protocol/STTx.cpp b/src/libxrpl/protocol/STTx.cpp
index be3b1a082f..cd2da12316 100644
--- a/src/libxrpl/protocol/STTx.cpp
+++ b/src/libxrpl/protocol/STTx.cpp
@@ -1,7 +1,6 @@
 #include <xrpl/protocol/STTx.h>
 
 #include <xrpl/basics/Blob.h>
-#include <xrpl/basics/Log.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/StringUtilities.h>
 #include <xrpl/basics/base_uint.h>
@@ -72,6 +71,7 @@ STTx::STTx(STObject&& object) : STObject(std::move(object))
     txType_ = safeCast<TxType>(getFieldU16(sfTransactionType));
     applyTemplate(getTxFormat(txType_)->getSOTemplate());  //  may throw
     tid_ = getHash(HashPrefix::TransactionId);
+    buildBatchTxnIds();
 }
 
 STTx::STTx(SerialIter& sit) : STObject(sfTransaction)
@@ -88,6 +88,7 @@ STTx::STTx(SerialIter& sit) : STObject(sfTransaction)
 
     applyTemplate(getTxFormat(txType_)->getSOTemplate());  // May throw
     tid_ = getHash(HashPrefix::TransactionId);
+    buildBatchTxnIds();
 }
 
 STTx::STTx(TxType type, std::function<void(STObject&)> assembler) : STObject(sfTransaction)
@@ -105,6 +106,7 @@ STTx::STTx(TxType type, std::function<void(STObject&)> assembler) : STObject(sfT
         logicError("Transaction type was mutated during assembly");
 
     tid_ = getHash(HashPrefix::TransactionId);
+    buildBatchTxnIds();
 }
 
 STBase*
@@ -212,20 +214,6 @@ STTx::getSeqValue() const
     return getSeqProxy().value();
 }
 
-AccountID
-STTx::getFeePayer() const
-{
-    // If sfDelegate is present, the delegate account is the payer
-    // note: if a delegate is specified, its authorization to act on behalf of the account is
-    // enforced in `Transactor::invokeCheckPermission`
-    // cryptographic signature validity is checked separately (e.g., in `Transactor::checkSign`)
-    if (isFieldPresent(sfDelegate))
-        return getAccountID(sfDelegate);
-
-    // Default payer
-    return getAccountID(sfAccount);
-}
-
 void
 STTx::sign(
     PublicKey const& publicKey,
@@ -279,6 +267,17 @@ STTx::checkSign(Rules const& rules) const
         if (auto const ret = checkSign(rules, counterSig); !ret)
             return std::unexpected("Counterparty: " + ret.error());
     }
+
+    // Verify the batch signer signatures here too, so they are cached with the
+    // rest of signature checking (checkValidity / SF_SIGGOOD) and stay out of
+    // the transaction engine. Gated on a batch (batchTxnIds_ seated) that
+    // actually carries signers; a batch whose inners are all from the outer
+    // account has no sfBatchSigners and needs no signer crypto.
+    if (batchTxnIds_ && isFieldPresent(sfBatchSigners))
+    {
+        if (auto const ret = checkBatchSign(rules); !ret)
+            return ret;
+    }
     return {};
 }
 
@@ -287,12 +286,15 @@ STTx::checkBatchSign(Rules const& rules) const
 {
     try
     {
-        XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::checkBatchSign : not a batch transaction");
         if (getTxnType() != ttBATCH)
         {
-            JLOG(debugLog().fatal()) << "not a batch transaction";
+            // LCOV_EXCL_START
+            UNREACHABLE("STTx::checkBatchSign : not a batch transaction");
             return std::unexpected("Not a batch transaction.");
+            // LCOV_EXCL_STOP
         }
+        if (!isFieldPresent(sfBatchSigners))
+            return std::unexpected("Missing BatchSigners field.");  // LCOV_EXCL_LINE
         STArray const& signers{getFieldArray(sfBatchSigners)};
         for (auto const& signer : signers)
         {
@@ -307,9 +309,10 @@ STTx::checkBatchSign(Rules const& rules) const
     }
     catch (std::exception const& e)
     {
-        JLOG(debugLog().error()) << "Batch signature check failed: " << e.what();
+        // LCOV_EXCL_START
+        return std::unexpected(std::string("Internal batch signature check failure: ") + e.what());
+        // LCOV_EXCL_STOP
     }
-    return std::unexpected("Internal batch signature check failure.");
 }
 
 json::Value
@@ -429,8 +432,11 @@ STTx::checkSingleSign(STObject const& sigObject) const
 std::expected<void, std::string>
 STTx::checkBatchSingleSign(STObject const& batchSigner) const
 {
+    XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::checkBatchSingleSign : batch transaction");
     Serializer msg;
-    serializeBatch(msg, getFlags(), getBatchTransactionIDs());
+    serializeBatch(
+        msg, getAccountID(sfAccount), getSeqValue(), getFlags(), getBatchTransactionIDs());
+    finishMultiSigningData(batchSigner.getAccountID(sfAccount), msg);
     return singleSignHelper(batchSigner, msg.slice());
 }
 
@@ -504,7 +510,7 @@ multiSignHelper(
         {
             return std::unexpected(
                 std::string("Invalid signature on account ") + toBase58(accountID) +
-                errorWhat.value_or("") + ".");
+                (errorWhat ? ": " + *errorWhat : "") + ".");
         }
     }
     // All signatures verified.
@@ -514,14 +520,18 @@ multiSignHelper(
 std::expected<void, std::string>
 STTx::checkBatchMultiSign(STObject const& batchSigner, Rules const& rules) const
 {
+    XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::checkBatchMultiSign : batch transaction");
     // We can ease the computational load inside the loop a bit by
     // pre-constructing part of the data that we hash.  Fill a Serializer
     // with the stuff that stays constant from signature to signature.
+    auto const batchSignerAccount = batchSigner.getAccountID(sfAccount);
     Serializer dataStart;
-    serializeBatch(dataStart, getFlags(), getBatchTransactionIDs());
+    serializeBatch(
+        dataStart, getAccountID(sfAccount), getSeqValue(), getFlags(), getBatchTransactionIDs());
+    dataStart.addBitString(batchSignerAccount);
     return multiSignHelper(
         batchSigner,
-        std::nullopt,
+        batchSignerAccount,
         [&dataStart](AccountID const& accountID) -> Serializer {
             Serializer s = dataStart;
             finishMultiSigningData(accountID, s);
@@ -555,42 +565,38 @@ STTx::checkMultiSign(Rules const& rules, STObject const& sigObject) const
         rules);
 }
 
-/**
- * @brief Retrieves a batch of transaction IDs from the STTx.
- *
- * This function returns a vector of transaction IDs by extracting them from
- * the field array `sfRawTransactions` within the STTx. If the batch
- * transaction IDs have already been computed and cached in `batchTxnIds_`,
- * it returns the cached vector. Otherwise, it computes the transaction IDs,
- * caches them, and then returns the vector.
- *
- * @return A vector of `uint256` containing the batch transaction IDs.
- *
- * @note The function asserts that the `sfRawTransactions` field array is not
- * empty and that the size of the computed batch transaction IDs matches the
- * size of the `sfRawTransactions` field array.
- */
+void
+STTx::buildBatchTxnIds()
+{
+    // Precondition: the template must have been applied first, so the fields
+    // (including sfRawTransactions) are canonical before the inner txns are
+    // hashed. The constructors call this immediately after applying the
+    // template; isFree() being false confirms a template is set.
+    XRPL_ASSERT(!isFree(), "STTx::buildBatchTxnIds : template applied");
+    if (getTxnType() != ttBATCH || !isFieldPresent(sfRawTransactions))
+        return;
+
+    auto const& raw = getFieldArray(sfRawTransactions);
+
+    // Seated for any batch with raw transactions. The count is validated in
+    // preflight and at the relay boundary, so build every id here; this keeps
+    // the invariant batchTxnIds_->size() == rawTransactions.size().
+    auto& ids = batchTxnIds_.emplace();
+    ids.reserve(raw.size());
+    for (STObject const& rb : raw)
+        ids.push_back(rb.getHash(HashPrefix::TransactionId));
+}
+
 std::vector<uint256> const&
 STTx::getBatchTransactionIDs() const
 {
-    XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::getBatchTransactionIDs : not a batch transaction");
+    XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::getBatchTransactionIDs : batch transaction");
     XRPL_ASSERT(
-        !getFieldArray(sfRawTransactions).empty(),
-        "STTx::getBatchTransactionIDs : empty raw transactions");
-
-    // The list of inner ids is built once, then reused on subsequent calls.
-    // After the list is built, it must always have the same size as the array
-    // `sfRawTransactions`. The assert below verifies that.
-    if (batchTxnIds_.empty())
-    {
-        for (STObject const& rb : getFieldArray(sfRawTransactions))
-            batchTxnIds_.push_back(rb.getHash(HashPrefix::TransactionId));
-    }
-
+        batchTxnIds_.has_value(), "STTx::getBatchTransactionIDs : batch transaction IDs built");
     XRPL_ASSERT(
-        batchTxnIds_.size() == getFieldArray(sfRawTransactions).size(),
+        batchTxnIds_->size() == getFieldArray(sfRawTransactions).size(),
         "STTx::getBatchTransactionIDs : batch transaction IDs size mismatch");
-    return batchTxnIds_;
+    return *batchTxnIds_;
 }
 
 //------------------------------------------------------------------------------
@@ -727,13 +733,22 @@ invalidMPTAmountInTx(STObject const& tx)
 }
 
 static bool
-isRawTransactionOkay(STObject const& st, std::string& reason)
+isBatchRawTransactionOkay(STObject const& st, std::string& reason)
 {
     if (!st.isFieldPresent(sfRawTransactions))
         return true;
 
+    // sfRawTransactions only appears on a Batch. passesLocalChecks runs on
+    // unverified user and peer input, so reject (rather than assert) a non-batch
+    // transaction that carries it.
+    if (st.getFieldU16(sfTransactionType) != ttBATCH)
+    {
+        reason = "Only Batch transactions may contain raw transactions.";
+        return false;
+    }
+
     if (st.isFieldPresent(sfBatchSigners) &&
-        st.getFieldArray(sfBatchSigners).size() > kMaxBatchTxCount)
+        st.getFieldArray(sfBatchSigners).size() > kMaxBatchSigners)
     {
         reason = "Batch Signers array exceeds max entries.";
         return false;
@@ -757,6 +772,12 @@ isRawTransactionOkay(STObject const& st, std::string& reason)
             }
 
             raw.applyTemplate(getTxFormat(tt)->getSOTemplate());
+
+            // passesLocalChecks recurses back into isBatchRawTransactionOkay,
+            // but an inner can never be a batch (rejected above), so the
+            // recursion terminates at depth 1.
+            if (!passesLocalChecks(raw, reason))
+                return false;
         }
         catch (std::exception const& e)
         {
@@ -791,7 +812,7 @@ passesLocalChecks(STObject const& st, std::string& reason)
         return false;
     }
 
-    if (!isRawTransactionOkay(st, reason))
+    if (!isBatchRawTransactionOkay(st, reason))
         return false;
 
     return true;
diff --git a/src/libxrpl/protocol/TER.cpp b/src/libxrpl/protocol/TER.cpp
index e5c1d17b1a..a6f8192a2f 100644
--- a/src/libxrpl/protocol/TER.cpp
+++ b/src/libxrpl/protocol/TER.cpp
@@ -130,6 +130,8 @@ transResults()
         MAKE_ERROR(tefNO_TICKET,                   "Ticket is not in ledger."),
         MAKE_ERROR(tefNFTOKEN_IS_NOT_TRANSFERABLE, "The specified NFToken is not transferable."),
         MAKE_ERROR(tefINVALID_LEDGER_FIX_TYPE,     "The LedgerFixType field has an invalid value."),
+        MAKE_ERROR(tefNO_DST_PARTIAL,              "Partial payment to create account not allowed."),
+        MAKE_ERROR(tefBAD_PATH_COUNT,              "Malformed: Too many paths."),
 
         MAKE_ERROR(telLOCAL_ERROR,            "Local failure."),
         MAKE_ERROR(telBAD_DOMAIN,             "Domain too long."),
diff --git a/src/libxrpl/tx/Transactor.cpp b/src/libxrpl/tx/Transactor.cpp
index 9ab8779f03..0f6988543e 100644
--- a/src/libxrpl/tx/Transactor.cpp
+++ b/src/libxrpl/tx/Transactor.cpp
@@ -1,6 +1,5 @@
 #include <xrpl/tx/Transactor.h>
 
-#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
@@ -221,13 +220,15 @@ Transactor::preflight1(PreflightContext const& ctx, std::uint32_t flagMask)
     if (ctx.tx.getSeqProxy().isTicket() && ctx.tx.isFieldPresent(sfAccountTxnID))
         return temINVALID;
 
-    if (ctx.tx.isFlag(tfInnerBatchTxn) && !ctx.rules.enabled(featureBatch))
+    if (ctx.tx.isFlag(tfInnerBatchTxn) && !ctx.rules.enabled(featureBatchV1_1))
         return temINVALID_FLAG;
 
-    XRPL_ASSERT(
-        ctx.tx.isFlag(tfInnerBatchTxn) == ctx.parentBatchId.has_value() ||
-            !ctx.rules.enabled(featureBatch),
-        "Inner batch transaction must have a parent batch ID.");
+    // Reject if the inner batch flag and parentBatchId are inconsistent.
+    // A standalone tx with tfInnerBatchTxn but no parentBatchId is an
+    // attack attempt. A tx with parentBatchId but without tfInnerBatchTxn
+    // is a programming error.
+    if (ctx.tx.isFlag(tfInnerBatchTxn) != ctx.parentBatchId.has_value())
+        return temINVALID_INNER_BATCH;
 
     return tesSUCCESS;
 }
@@ -243,15 +244,19 @@ Transactor::preflight2(PreflightContext const& ctx)
         return *ret;
     }
 
-    // It should be impossible for the InnerBatchTxn flag to be set without
-    // featureBatch being enabled
-    XRPL_ASSERT_PARTS(
-        !ctx.tx.isFlag(tfInnerBatchTxn) || ctx.rules.enabled(featureBatch),
-        "xrpl::Transactor::preflight2",
-        "InnerBatch flag only set if feature enabled");
-    // Skip signature check on batch inner transactions
-    if (ctx.tx.isFlag(tfInnerBatchTxn) && ctx.rules.enabled(featureBatch))
+    // Skip the signature check on batch inner transactions. preflight1 already
+    // enforces both conditions; re-checking them as defense in depth guarantees
+    // we never return success (and so skip signature validation) for an inner
+    // transaction unless the amendment is enabled and it really sits inside a
+    // batch.
+    if (ctx.tx.isFlag(tfInnerBatchTxn))
+    {
+        if (!ctx.rules.enabled(featureBatchV1_1))
+            return temINVALID_FLAG;
+        if (!ctx.parentBatchId.has_value())
+            return temINVALID_INNER_BATCH;
         return tesSUCCESS;
+    }
     // Do not add any checks after this point that are relevant for
     // batch inner transactions. They will be skipped.
 
@@ -708,23 +713,26 @@ Transactor::checkSign(
     std::optional<uint256 const> const& parentBatchId,
     AccountID const& idAccount,
     STObject const& sigObject,
-    beast::Journal const j)
+    beast::Journal const j,
+    bool permitUncreatedAccount)
 {
     {
         auto const sle = view.read(keylet::account(idAccount));
 
-        if (view.rules().enabled(featureLendingProtocol) && isPseudoAccount(sle))
+        if ((view.rules().enabled(featureLendingProtocol) ||
+             view.rules().enabled(featureBatchV1_1) || view.rules().enabled(fixCleanup3_3_0)) &&
+            isPseudoAccount(sle))
         {
-            // Pseudo-accounts can't sign transactions. This check is gated on
-            // the Lending Protocol amendment because that's the project it was
-            // added under, and it doesn't justify another amendment
+            // Pseudo-accounts can't sign transactions. This check is gated on a
+            // few different amendments so that it takes effect as soon as any of
+            // them is activated.
             return tefBAD_AUTH;
         }
     }
 
     auto const pkSigner = sigObject.getFieldVL(sfSigningPubKey);
     // Ignore signature check on batch inner transactions
-    if (parentBatchId && view.rules().enabled(featureBatch))
+    if (parentBatchId && view.rules().enabled(featureBatchV1_1))
     {
         // Defensive Check: These values are also checked in Batch::preflight
         if (sigObject.isFieldPresent(sfTxnSignature) || !pkSigner.empty() ||
@@ -762,7 +770,16 @@ Transactor::checkSign(
     auto const idSigner = calcAccountID(PublicKey(makeSlice(pkSigner)));
     auto const sleAccount = view.read(keylet::account(idAccount));
     if (!sleAccount)
-        return terNO_ACCOUNT;
+    {
+        // An account that does not exist yet can only be authorized by its own
+        // master key, and only where an un-created signer is permitted (a batch
+        // whose earlier inner creates the account). Otherwise it cannot sign.
+        if (!permitUncreatedAccount)
+            return terNO_ACCOUNT;
+        if (idAccount != idSigner)
+            return tefBAD_AUTH;
+        return tesSUCCESS;
+    }
 
     return checkSingleSign(view, idSigner, idAccount, sleAccount, j);
 }
@@ -775,50 +792,6 @@ Transactor::checkSign(PreclaimContext const& ctx)
     return checkSign(ctx.view, ctx.flags, ctx.parentBatchId, idAccount, ctx.tx, ctx.j);
 }
 
-NotTEC
-Transactor::checkBatchSign(PreclaimContext const& ctx)
-{
-    NotTEC ret = tesSUCCESS;
-    STArray const& signers{ctx.tx.getFieldArray(sfBatchSigners)};
-    for (auto const& signer : signers)
-    {
-        auto const idAccount = signer.getAccountID(sfAccount);
-
-        Blob const& pkSigner = signer.getFieldVL(sfSigningPubKey);
-        if (pkSigner.empty())
-        {
-            if (ret = checkMultiSign(ctx.view, ctx.flags, idAccount, signer, ctx.j);
-                !isTesSuccess(ret))
-                return ret;
-        }
-        else
-        {
-            // LCOV_EXCL_START
-            if (!publicKeyType(makeSlice(pkSigner)))
-                return tefBAD_AUTH;
-            // LCOV_EXCL_STOP
-
-            auto const idSigner = calcAccountID(PublicKey(makeSlice(pkSigner)));
-            auto const sleAccount = ctx.view.read(keylet::account(idAccount));
-
-            // A batch can include transactions from an un-created account ONLY
-            // when the account master key is the signer
-            if (!sleAccount)
-            {
-                if (idAccount != idSigner)
-                    return tefBAD_AUTH;
-
-                return tesSUCCESS;
-            }
-
-            if (ret = checkSingleSign(ctx.view, idSigner, idAccount, sleAccount, ctx.j);
-                !isTesSuccess(ret))
-                return ret;
-        }
-    }
-    return ret;
-}
-
 NotTEC
 Transactor::checkSingleSign(
     ReadView const& view,
@@ -1114,7 +1087,7 @@ Transactor::reset(XRPAmount fee)
 
     // balance should have already been checked in checkFee / preFlight.
     XRPL_ASSERT(
-        balance != beast::kZero && (!view().open() || balance >= fee),
+        (fee == beast::kZero || balance != beast::kZero) && (!view().open() || balance >= fee),
         "xrpl::Transactor::reset : valid balance");
 
     // We retry/reject the transaction if the account balance is zero or
diff --git a/src/libxrpl/tx/apply.cpp b/src/libxrpl/tx/apply.cpp
index b70cb0d345..d85c4cfc40 100644
--- a/src/libxrpl/tx/apply.cpp
+++ b/src/libxrpl/tx/apply.cpp
@@ -8,7 +8,6 @@
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/OpenView.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STObject.h>
@@ -39,30 +38,14 @@ checkValidity(HashRouter& router, STTx const& tx, Rules const& rules)
     auto const id = tx.getTransactionID();
     auto const flags = router.getFlags(id);
 
-    // Ignore signature check on batch inner transactions
-    if (tx.isFlag(tfInnerBatchTxn) && rules.enabled(featureBatch))
+    // Batch inner transactions are never independently valid: they are applied
+    // within their batch, not through checkValidity. Reaching here means one was
+    // relayed or submitted on its own, so mark it bad regardless of the
+    // amendment (like PeerImp and NetworkOPs).
+    if (tx.isFlag(tfInnerBatchTxn))
     {
-        // Defensive Check: These values are also checked in Batch::preflight
-        if (tx.isFieldPresent(sfTxnSignature) || !tx.getSigningPubKey().empty() ||
-            tx.isFieldPresent(sfSigners))
-            return {Validity::SigBad, "Malformed: Invalid inner batch transaction."};
-
-        // This block should probably have never been included in the
-        // original `Batch` implementation. An inner transaction never
-        // has a valid signature.
-        bool const neverValid = rules.enabled(fixBatchInnerSigs);
-        if (!neverValid)
-        {
-            std::string reason;
-            if (!passesLocalChecks(tx, reason))
-            {
-                router.setFlags(id, kSfLocalbad);
-                return {Validity::SigGoodOnly, reason};
-            }
-
-            router.setFlags(id, kSfSiggood);
-            return {Validity::Valid, ""};
-        }
+        router.setFlags(id, kSfSigbad);
+        return {Validity::SigBad, "Batch inner transactions are never considered validly signed."};
     }
 
     if (any(flags & kSfSigbad))
@@ -183,6 +166,9 @@ applyBatchTransactions(
 
         // If the transaction should be applied push its changes to the
         // whole-batch view.
+        // NOTE: each inner tx is individually capped at kOversizeMetaDataCap;
+        // there is no aggregate cap here. Bounded by kMaxBatchTxCount * cap,
+        // which standalone txns can already produce in one ledger.
         if (ret.applied && (isTesSuccess(ret.ter) || isTecClaim(ret.ter)))
             perTxBatchView.apply(batchView);
 
diff --git a/src/libxrpl/tx/transactors/lending/LoanSet.cpp b/src/libxrpl/tx/transactors/lending/LoanSet.cpp
index 903707320b..1ac387d1b1 100644
--- a/src/libxrpl/tx/transactors/lending/LoanSet.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanSet.cpp
@@ -57,7 +57,7 @@ LoanSet::preflight(PreflightContext const& ctx)
     auto const& tx = ctx.tx;
 
     // Special case for Batch inner transactions
-    if (tx.isFlag(tfInnerBatchTxn) && ctx.rules.enabled(featureBatch) &&
+    if (tx.isFlag(tfInnerBatchTxn) && ctx.rules.enabled(featureBatchV1_1) &&
         !tx.isFieldPresent(sfCounterparty))
     {
         auto const parentBatchId = ctx.parentBatchId.value_or(uint256{0});
diff --git a/src/libxrpl/tx/transactors/payment/Payment.cpp b/src/libxrpl/tx/transactors/payment/Payment.cpp
index 7f1e4d8079..6e3883572a 100644
--- a/src/libxrpl/tx/transactors/payment/Payment.cpp
+++ b/src/libxrpl/tx/transactors/payment/Payment.cpp
@@ -363,16 +363,21 @@ Payment::preclaim(PreclaimContext const& ctx)
             // transaction would succeed.
             return tecNO_DST;
         }
-        if (ctx.view.open() && partialPaymentAllowed)
+        // A partial payment may not fund a new account.
+        if (partialPaymentAllowed)
         {
-            // You cannot fund an account with a partial payment.
-            // Make retry work smaller, by rejecting this.
-            JLOG(ctx.j.trace()) << "Delay transaction: Partial payment not "
-                                   "allowed to create account.";
-
-            // Another transaction could create the account and then this
-            // transaction would succeed.
-            return telNO_DST_PARTIAL;
+            // Open view: the soft tel (unchanged).
+            if (ctx.view.open())
+            {
+                // Make retry work smaller, by rejecting this.
+                JLOG(ctx.j.trace()) << "Delay transaction: Partial payment not "
+                                       "allowed to create account.";
+                return telNO_DST_PARTIAL;
+            }
+            // Inner batch txns are claimed on a closed view, where a tel is
+            // invalid, so use the tef.
+            if (ctx.parentBatchId && ctx.view.rules().enabled(featureBatchV1_1))
+                return tefNO_DST_PARTIAL;
         }
         if (dstAmount < STAmount(ctx.view.fees().reserve))
         {
@@ -400,7 +405,7 @@ Payment::preclaim(PreclaimContext const& ctx)
     }
 
     // Payment with at least one intermediate step and uses transitive balances.
-    if ((hasPaths || sendMax || !dstAmount.native()) && ctx.view.open())
+    if (hasPaths || sendMax || !dstAmount.native())
     {
         STPathSet const& paths = ctx.tx.getFieldPathSet(sfPaths);
 
@@ -408,7 +413,12 @@ Payment::preclaim(PreclaimContext const& ctx)
                 return path.size() > kMaxPathLength;
             }))
         {
-            return telBAD_PATH_COUNT;
+            // Open view: the soft tel (unchanged). Inner batch txns are claimed
+            // on a closed view, where a tel is invalid, so use the tef.
+            if (ctx.view.open())
+                return telBAD_PATH_COUNT;
+            if (ctx.parentBatchId && ctx.view.rules().enabled(featureBatchV1_1))
+                return tefBAD_PATH_COUNT;
         }
     }
 
diff --git a/src/libxrpl/tx/transactors/system/Batch.cpp b/src/libxrpl/tx/transactors/system/Batch.cpp
index 64a62ac273..16d27f98d9 100644
--- a/src/libxrpl/tx/transactors/system/Batch.cpp
+++ b/src/libxrpl/tx/transactors/system/Batch.cpp
@@ -3,6 +3,8 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
@@ -21,11 +23,13 @@
 
 #include <algorithm>
 #include <bit>
+#include <cstddef>
 #include <cstdint>
 #include <limits>
 #include <unordered_map>
 #include <unordered_set>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
@@ -107,13 +111,13 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
     }
 
     // Calculate the Signers/BatchSigners Fees
-    std::int32_t signerCount = 0;
+    std::uint32_t signerCount = 0;
     if (tx.isFieldPresent(sfBatchSigners))
     {
         auto const& signers = tx.getFieldArray(sfBatchSigners);
 
         // LCOV_EXCL_START
-        if (signers.size() > kMaxBatchTxCount)
+        if (signers.size() > kMaxBatchSigners)
         {
             JLOG(debugLog().error()) << "BatchTrace: Batch Signers array exceeds max entries.";
             return XRPAmount{kInitialXrp};
@@ -128,7 +132,16 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
             }
             else if (signer.isFieldPresent(sfSigners))
             {
-                signerCount += signer.getFieldArray(sfSigners).size();
+                auto const& nestedSigners = signer.getFieldArray(sfSigners);
+                // LCOV_EXCL_START
+                if (nestedSigners.size() > STTx::kMaxMultiSigners)
+                {
+                    JLOG(debugLog().error())
+                        << "BatchTrace: Nested Signers array exceeds max entries.";
+                    return kInitialXrp;
+                }
+                // LCOV_EXCL_STOP
+                signerCount += nestedSigners.size();
             }
         }
     }
@@ -149,7 +162,8 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
         JLOG(debugLog().error()) << "BatchTrace: XRPAmount overflow in signerFees calculation.";
         return XRPAmount{kInitialXrp};
     }
-    if (txnFees + signerFees > maxAmount - batchBase)
+    XRPAmount const innerFees = txnFees + signerFees;
+    if (innerFees > maxAmount - batchBase)
     {
         JLOG(debugLog().error()) << "BatchTrace: XRPAmount overflow in total fee calculation.";
         return XRPAmount{kInitialXrp};
@@ -157,7 +171,7 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
     // LCOV_EXCL_STOP
 
     // 10 drops per batch signature + sum of inner tx fees + batchBase
-    return signerFees + txnFees + batchBase;
+    return innerFees + batchBase;
 }
 
 std::uint32_t
@@ -227,6 +241,14 @@ Batch::preflight(PreflightContext const& ctx)
         return temARRAY_TOO_LARGE;
     }
 
+    if (ctx.tx.isFieldPresent(sfBatchSigners) &&
+        ctx.tx.getFieldArray(sfBatchSigners).size() > kMaxBatchSigners)
+    {
+        JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]:"
+                            << "signers array exceeds " << kMaxBatchSigners << " entries.";
+        return temARRAY_TOO_LARGE;
+    }
+
     // Validation Inner Batch Txns
     std::unordered_set<uint256> uniqueHashes;
     std::unordered_map<AccountID, std::unordered_set<std::uint32_t>> accountSeqTicket;
@@ -384,46 +406,48 @@ Batch::preflight(PreflightContext const& ctx)
 NotTEC
 Batch::preflightSigValidated(PreflightContext const& ctx)
 {
+    XRPL_ASSERT(
+        ctx.tx.getTxnType() == ttBATCH, "xrpl::Batch::preflightSigValidated : batch transaction");
     auto const parentBatchId = ctx.tx.getTransactionID();
     auto const outerAccount = ctx.tx.getAccountID(sfAccount);
     auto const& rawTxns = ctx.tx.getFieldArray(sfRawTransactions);
 
-    // Build the signers list
-    std::unordered_set<AccountID> requiredSigners;
+    // Accounts that must sign the batch: each inner authorizer and counterparty
+    // (excluding the outer account), sorted and de-duplicated to match against
+    // the ascending, unique batch signers.
+    std::vector<AccountID> requiredSigners;
+    requiredSigners.reserve(kMaxBatchSigners);
     for (STObject const& rb : rawTxns)
     {
-        auto const innerAccount = rb.getAccountID(sfAccount);
+        // A delegated inner is signed by the delegate, not the account holder,
+        // so the delegate is the required signer when present.
+        AccountID const authorizer = rb.getFeePayer();
 
-        // If the inner account is the same as the outer account, do not add the
-        // inner account to the required signers set.
-        if (innerAccount != outerAccount)
-            requiredSigners.insert(innerAccount);
+        // The outer account signs the batch itself, so it is never added to the
+        // required signers.
+        if (authorizer != outerAccount)
+            requiredSigners.push_back(authorizer);
         // Some transactions have a Counterparty, who must also sign the
         // transaction if they are not the outer account
-        if (auto const counterparty = rb.at(~sfCounterparty);
+        if (auto const counterparty = rb[~sfCounterparty];
             counterparty && counterparty != outerAccount)
-            requiredSigners.insert(*counterparty);
+            requiredSigners.push_back(*counterparty);
     }
+    std::ranges::sort(requiredSigners);
+    auto const dupes = std::ranges::unique(requiredSigners);
+    requiredSigners.erase(dupes.begin(), dupes.end());
+
+    std::size_t numReqSignersMatched = 0;
 
     // Validation Batch Signers
-    std::unordered_set<AccountID> batchSigners;
     if (ctx.tx.isFieldPresent(sfBatchSigners))
     {
         STArray const& signers = ctx.tx.getFieldArray(sfBatchSigners);
 
-        // Check that the batch signers array is not too large.
-        if (signers.size() > kMaxBatchTxCount)
-        {
-            JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]: "
-                                << "signers array exceeds 8 entries.";
-            return temARRAY_TOO_LARGE;
-        }
-
-        // Add batch signers to the set to ensure all signer accounts are
-        // unique. Meanwhile, remove signer accounts from the set of inner
-        // transaction accounts (`requiredSigners`). By the end of the loop,
-        // `requiredSigners` should be empty, indicating that all inner
-        // accounts are matched with signers.
+        // Batch signers must be strictly ascending and match the required
+        // signers exactly; since both are sorted, each must be the next
+        // required signer.
+        AccountID lastBatchSigner{beast::kZero};
         for (auto const& signer : signers)
         {
             AccountID const signerAccount = signer.getAccountID(sfAccount);
@@ -434,40 +458,66 @@ Batch::preflightSigValidated(PreflightContext const& ctx)
                 return temBAD_SIGNER;
             }
 
-            if (!batchSigners.insert(signerAccount).second)
+            if (lastBatchSigner == signerAccount)
             {
                 JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]: "
                                     << "duplicate signer found: " << signerAccount;
-                return temREDUNDANT;
-            }
-
-            // Check that the batch signer is in the required signers set.
-            // Remove it if it does, as it can be crossed off the list.
-            if (requiredSigners.erase(signerAccount) == 0)
-            {
-                JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]: "
-                                    << "no account signature for inner txn.";
                 return temBAD_SIGNER;
             }
-        }
 
-        // Check the batch signers signatures.
-        auto const sigResult = ctx.tx.checkBatchSign(ctx.rules);
+            if (lastBatchSigner > signerAccount)
+            {
+                JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]: "
+                                    << "unsorted signers array: " << signerAccount;
+                return temBAD_SIGNER;
+            }
+            lastBatchSigner = signerAccount;
 
-        if (!sigResult)
-        {
-            JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]: "
-                                << "invalid batch txn signature: " << sigResult.error();
-            return temBAD_SIGNATURE;
+            if (numReqSignersMatched >= requiredSigners.size() ||
+                requiredSigners[numReqSignersMatched] != signerAccount)
+            {
+                JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]: "
+                                    << "missing signer or extra signer provided: " << signerAccount;
+                return temBAD_SIGNER;
+            }
+            ++numReqSignersMatched;
         }
     }
 
-    if (!requiredSigners.empty())
+    // Every required signer must be matched. Also covers sfBatchSigners being
+    // absent while inner txns require signers (numReqSignersMatched stays 0).
+    if (numReqSignersMatched != requiredSigners.size())
     {
         JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]: "
                             << "invalid batch signers.";
         return temBAD_SIGNER;
     }
+
+    return tesSUCCESS;
+}
+
+NotTEC
+Batch::checkBatchSign(PreclaimContext const& ctx)
+{
+    STArray const& signers{ctx.tx.getFieldArray(sfBatchSigners)};
+    for (auto const& signer : signers)
+    {
+        // Reuse the standard signer-authorization rules so the batch and
+        // non-batch paths cannot drift. permitUncreatedAccount allows an inner
+        // from an account that an earlier inner creates, which must be
+        // authorized by its own master key.
+        auto const idAccount = signer.getAccountID(sfAccount);
+        if (auto const ret = Transactor::checkSign(
+                ctx.view,
+                ctx.flags,
+                ctx.parentBatchId,
+                idAccount,
+                signer,
+                ctx.j,
+                /*permitUncreatedAccount=*/true);
+            !isTesSuccess(ret))
+            return ret;
+    }
     return tesSUCCESS;
 }
 
@@ -479,7 +529,7 @@ Batch::preflightSigValidated(PreflightContext const& ctx)
  * corresponding error code.
  *
  * Next, it verifies the batch-specific signature requirements by calling
- * Transactor::checkBatchSign. If this check fails, it also returns the
+ * Batch::checkBatchSign. If this check fails, it also returns the
  * corresponding error code.
  *
  * If both checks succeed, the function returns tesSUCCESS.
@@ -494,8 +544,11 @@ Batch::checkSign(PreclaimContext const& ctx)
     if (auto ret = Transactor::checkSign(ctx); !isTesSuccess(ret))
         return ret;
 
-    if (auto ret = Transactor::checkBatchSign(ctx); !isTesSuccess(ret))
-        return ret;
+    if (ctx.tx.isFieldPresent(sfBatchSigners))
+    {
+        if (auto ret = checkBatchSign(ctx); !isTesSuccess(ret))
+            return ret;
+    }
 
     return tesSUCCESS;
 }
diff --git a/src/test/app/Batch_test.cpp b/src/test/app/Batch_test.cpp
index 6aaae62155..f9c156fe06 100644
--- a/src/test/app/Batch_test.cpp
+++ b/src/test/app/Batch_test.cpp
@@ -1,5 +1,6 @@
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/SignerUtils.h>
 #include <test/jtx/TestHelpers.h>
 #include <test/jtx/acctdelete.h>
 #include <test/jtx/amount.h>
@@ -47,12 +48,14 @@
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STParsedJSON.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/Sign.h>
 #include <xrpl/protocol/SystemParameters.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
@@ -61,15 +64,17 @@
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol/jss.h>
 #include <xrpl/server/NetworkOPs.h>
+#include <xrpl/tx/Transactor.h>
 #include <xrpl/tx/apply.h>
+#include <xrpl/tx/transactors/payment/Payment.h>
 #include <xrpl/tx/transactors/system/Batch.h>
 
 #include <algorithm>
+#include <cstddef>
 #include <cstdint>
 #include <map>
 #include <memory>
 #include <optional>
-#include <sstream>
 #include <string>
 #include <utility>
 #include <vector>
@@ -200,16 +205,13 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        bool const withInnerSigFix = features[fixBatchInnerSigs];
-
         for (bool const withBatch : {true, false})
         {
-            testcase << "enabled: Batch " << (withBatch ? "enabled" : "disabled")
-                     << ", Inner Sig Fix: " << (withInnerSigFix ? "enabled" : "disabled");
+            testcase << "enabled: Batch " << (withBatch ? "enabled" : "disabled");
 
-            auto const amend = withBatch ? features : features - featureBatch;
+            auto const amend = withBatch ? features : features - featureBatchV1_1;
 
-            test::jtx::Env env{*this, amend};
+            Env env{*this, amend};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -230,12 +232,10 @@ class Batch_test : public beast::unit_test::Suite
             }
 
             // tfInnerBatchTxn
-            // If the feature is disabled, the transaction fails with
-            // temINVALID_FLAG. If the feature is enabled, the transaction fails
-            // early in checkValidity()
+            // A standalone transaction carrying this flag is never valid, so it
+            // is rejected early in checkValidity() regardless of the amendment.
             {
-                auto const txResult = withBatch ? Ter(telENV_RPC_FAILED) : Ter(temINVALID_FLAG);
-                env(pay(alice, bob, XRP(1)), Txflags(tfInnerBatchTxn), txResult);
+                env(pay(alice, bob, XRP(1)), Txflags(tfInnerBatchTxn), Ter(telENV_RPC_FAILED));
                 env.close();
             }
 
@@ -254,7 +254,7 @@ class Batch_test : public beast::unit_test::Suite
         //----------------------------------------------------------------------
         // preflight
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -431,6 +431,41 @@ class Batch_test : public beast::unit_test::Suite
             env.close();
         }
 
+        // temINVALID_INNER_BATCH: tfInnerBatchTxn set but no parentBatchId.
+        {
+            auto jtx = env.jt(pay(alice, bob, XRP(1)), Txflags(tfInnerBatchTxn));
+            PreflightContext const pfCtx(
+                env.app(), *jtx.stx, env.current()->rules(), TapNone, env.journal);
+            auto const pf = Transactor::invokePreflight<Payment>(pfCtx);
+            BEAST_EXPECT(pf == temINVALID_INNER_BATCH);
+        }
+
+        // temINVALID_FLAG: tfInnerBatchTxn set but featureBatchV1_1 disabled.
+        {
+            Env disabledEnv{*this, features - featureBatchV1_1};
+            disabledEnv.fund(XRP(10000), alice, bob);
+            disabledEnv.close();
+            auto jtx = disabledEnv.jt(pay(alice, bob, XRP(1)), Txflags(tfInnerBatchTxn));
+            PreflightContext const pfCtx(
+                disabledEnv.app(),
+                *jtx.stx,
+                disabledEnv.current()->rules(),
+                TapNone,
+                disabledEnv.journal);
+            auto const pf = Transactor::invokePreflight<Payment>(pfCtx);
+            BEAST_EXPECT(pf == temINVALID_FLAG);
+        }
+
+        // temINVALID_INNER_BATCH: parentBatchId set but tfInnerBatchTxn not
+        // set.
+        {
+            auto jtx = env.jt(pay(alice, bob, XRP(1)));
+            PreflightContext const pfCtx(
+                env.app(), *jtx.stx, uint256{1}, env.current()->rules(), TapBatch, env.journal);
+            auto const pf = Transactor::invokePreflight<Payment>(pfCtx);
+            BEAST_EXPECT(pf == temINVALID_INNER_BATCH);
+        }
+
         // temBAD_FEE: Batch: inner txn must have a fee of 0.
         {
             auto const seq = env.seq(alice);
@@ -537,16 +572,16 @@ class Batch_test : public beast::unit_test::Suite
             env.close();
         }
 
-        // DEFENSIVE: temARRAY_TOO_LARGE: Batch: signers array exceeds 8
-        // entries.
+        // DEFENSIVE: temARRAY_TOO_LARGE: Batch: signers array exceeds
+        // kMaxBatchSigners entries.
         // ACTUAL: telENV_RPC_FAILED: isRawTransactionOkay()
         {
             auto const seq = env.seq(alice);
-            auto const batchFee = batch::calcBatchFee(env, 9, 2);
+            auto const batchFee = batch::calcBatchFee(env, kMaxBatchSigners + 1, 2);
             env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
                 batch::Inner(pay(alice, bob, XRP(10)), seq + 1),
                 batch::Inner(pay(alice, bob, XRP(5)), seq + 2),
-                batch::Sig(bob, carol, alice, bob, carol, alice, bob, carol, alice, alice),
+                batch::Sig(std::vector<Reg>(kMaxBatchSigners + 1, bob)),
                 Ter(telENV_RPC_FAILED));
             env.close();
         }
@@ -563,7 +598,7 @@ class Batch_test : public beast::unit_test::Suite
             env.close();
         }
 
-        // temREDUNDANT: Batch: duplicate signer found
+        // temBAD_SIGNER: Batch: duplicate signer (caught by ascending order check)
         {
             auto const seq = env.seq(alice);
             auto const batchFee = batch::calcBatchFee(env, 2, 2);
@@ -571,7 +606,7 @@ class Batch_test : public beast::unit_test::Suite
                 batch::Inner(pay(alice, bob, XRP(10)), seq + 1),
                 batch::Inner(pay(bob, alice, XRP(5)), env.seq(bob)),
                 batch::Sig(bob, bob),
-                Ter(temREDUNDANT));
+                Ter(temBAD_SIGNER));
             env.close();
         }
 
@@ -611,7 +646,13 @@ class Batch_test : public beast::unit_test::Suite
                 batch::Inner(pay(bob, alice, XRP(5)), bobSeq));
 
             Serializer msg;
-            serializeBatch(msg, tfAllOrNothing, jt.stx->getBatchTransactionIDs());
+            serializeBatch(
+                msg,
+                jt.stx->getAccountID(sfAccount),
+                jt.stx->getSeqValue(),
+                tfAllOrNothing,
+                jt.stx->getBatchTransactionIDs());
+            finishMultiSigningData(bob.id(), msg);
             auto const sig = xrpl::sign(bob.pk(), bob.sk(), msg.slice());
             jt.jv[sfBatchSigners.jsonName][0u][sfBatchSigner.jsonName][sfAccount.jsonName] =
                 bob.human();
@@ -620,7 +661,7 @@ class Batch_test : public beast::unit_test::Suite
             jt.jv[sfBatchSigners.jsonName][0u][sfBatchSigner.jsonName][sfTxnSignature.jsonName] =
                 strHex(Slice{sig.data(), sig.size()});
 
-            env(jt.jv, Ter(temBAD_SIGNATURE));
+            env(jt.jv, Ter(telENV_RPC_FAILED));
             env.close();
         }
 
@@ -649,7 +690,7 @@ class Batch_test : public beast::unit_test::Suite
         //----------------------------------------------------------------------
         // preclaim
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -890,7 +931,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -971,6 +1012,46 @@ class Batch_test : public beast::unit_test::Suite
             env(jt.jv, batch::Sig(bob), Ter(telENV_RPC_FAILED));
             env.close();
         }
+
+        // Inner OfferCreate with MPT TakerPays. Valid under featureMPTokensV2.
+        {
+            MPTIssue const issue(makeMptID(1, alice));
+            STAmount const mptAmt{issue, UINT64_C(100)};
+
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const seq = env.seq(alice);
+
+            json::Value tx1;
+            tx1[jss::TransactionType] = jss::OfferCreate;
+            tx1[jss::Account] = alice.human();
+            tx1[jss::TakerPays] = mptAmt.getJson(JsonOptions::Values::None);
+            tx1[jss::TakerGets] = XRP(10).value().getJson(JsonOptions::Values::None);
+
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(tx1, seq + 1),
+                batch::Inner(pay(alice, bob, XRP(1)), seq + 2),
+                Ter(tesSUCCESS));
+            env.close();
+        }
+
+        // Invalid: inner txn with invalid memo (non-URL-safe MemoType)
+        {
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const seq = env.seq(alice);
+
+            auto tx1 = pay(alice, bob, XRP(10));
+            auto& ma = tx1["Memos"];
+            auto& mi = ma[ma.size()];
+            auto& m = mi["Memo"];
+            m["MemoType"] = strHex(std::string("\x01\x02\x03", 3));
+            m["MemoData"] = strHex(std::string("test"));
+
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(tx1, seq + 1),
+                batch::Inner(pay(alice, bob, XRP(1)), seq + 2),
+                Ter(telENV_RPC_FAILED));
+            env.close();
+        }
     }
 
     void
@@ -981,7 +1062,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -1239,7 +1320,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // Bad Fee Without Signer
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -1261,7 +1342,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // Bad Fee With MultiSign
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -1288,7 +1369,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // Bad Fee With MultiSign + BatchSigners
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -1317,7 +1398,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // Bad Fee With MultiSign + BatchSigners.Signers
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -1349,7 +1430,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // Bad Fee With BatchSigners
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -1373,7 +1454,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // Bad Fee Dynamic Fee Calculation
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -1412,7 +1493,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // telENV_RPC_FAILED: Batch: txns array exceeds 8 entries.
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -1437,7 +1518,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // temARRAY_TOO_LARGE: Batch: txns array exceeds 8 entries.
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -1465,41 +1546,52 @@ class Batch_test : public beast::unit_test::Suite
             });
         }
 
-        // telENV_RPC_FAILED: Batch: signers array exceeds 8 entries.
+        // Regression: the relay-boundary local check (isBatchRawTransactionOkay)
+        // caps the signers array at kMaxBatchSigners, matching Batch::preflight -
+        // not kMaxBatchTxCount. A batch with more than kMaxBatchTxCount but at
+        // most kMaxBatchSigners signers must get past local checks and reach
+        // signer validation. Before the cap was aligned it was wrongly rejected
+        // at the boundary (telENV_RPC_FAILED) before preflight ran; now it
+        // reaches preflightSigValidated and fails there as extra signers
+        // (temBAD_SIGNER) rather than being dropped pre-engine.
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
             env.fund(XRP(10000), alice, bob);
             env.close();
 
+            // Over kMaxBatchTxCount (8) but within kMaxBatchSigners (24).
+            std::size_t const signerCount = kMaxBatchTxCount + 1;
+
             auto const aliceSeq = env.seq(alice);
-            auto const batchFee = batch::calcBatchFee(env, 9, 2);
+            auto const batchFee = batch::calcBatchFee(env, signerCount, 2);
             env(batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
                 batch::Inner(pay(alice, bob, XRP(10)), aliceSeq + 1),
                 batch::Inner(pay(alice, bob, XRP(5)), aliceSeq + 2),
-                batch::Sig(bob, bob, bob, bob, bob, bob, bob, bob, bob, bob),
-                Ter(telENV_RPC_FAILED));
+                batch::Sig(std::vector<Reg>(signerCount, bob)),
+                Ter(temBAD_SIGNER));
             env.close();
         }
 
-        // temARRAY_TOO_LARGE: Batch: signers array exceeds 8 entries.
+        // temARRAY_TOO_LARGE: Batch preflight: signers array exceeds
+        // kMaxBatchSigners entries.
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
             env.fund(XRP(10000), alice, bob);
             env.close();
 
-            auto const batchFee = batch::calcBatchFee(env, 0, 9);
+            auto const batchFee = batch::calcBatchFee(env, kMaxBatchSigners + 1, 2);
             auto const aliceSeq = env.seq(alice);
             auto jt = env.jtnofill(
                 batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
                 batch::Inner(pay(alice, bob, XRP(10)), aliceSeq + 1),
                 batch::Inner(pay(alice, bob, XRP(5)), aliceSeq + 2),
-                batch::Sig(bob, bob, bob, bob, bob, bob, bob, bob, bob, bob));
+                batch::Sig(std::vector<Reg>(kMaxBatchSigners + 1, bob)));
 
             env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal j) {
                 auto const result = xrpl::apply(env.app(), view, *jt.stx, TapNone, j);
@@ -1517,7 +1609,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -1677,7 +1769,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -1966,7 +2058,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -2267,7 +2359,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -2538,22 +2630,16 @@ class Batch_test : public beast::unit_test::Suite
     void
     doTestInnerSubmitRPC(FeatureBitset features, bool withBatch)
     {
-        bool const withInnerSigFix = features[fixBatchInnerSigs];
+        std::string const testName =
+            std::string("inner submit rpc: batch ") + (withBatch ? "enabled" : "disabled") + ": ";
 
-        std::string const testName = [&]() {
-            std::stringstream ss;
-            ss << "inner submit rpc: batch " << (withBatch ? "enabled" : "disabled")
-               << ", inner sig fix: " << (withInnerSigFix ? "enabled" : "disabled") << ": ";
-            return ss.str();
-        }();
-
-        auto const amend = withBatch ? features : features - featureBatch;
+        auto const amend = withBatch ? features : features - featureBatchV1_1;
 
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, amend};
-        if (!BEAST_EXPECT(amend[featureBatch] == withBatch))
+        Env env{*this, amend};
+        if (!BEAST_EXPECT(amend[featureBatchV1_1] == withBatch))
             return;
 
         auto const alice = Account("alice");
@@ -2562,37 +2648,20 @@ class Batch_test : public beast::unit_test::Suite
         env.fund(XRP(10000), alice, bob);
         env.close();
 
-        auto submitAndValidate = [&](std::string caseName,
-                                     Slice const& slice,
-                                     int line,
-                                     std::optional<std::string> expectedEnabled = std::nullopt,
-                                     std::optional<std::string> expectedDisabled = std::nullopt,
-                                     bool expectInvalidFlag = false) {
-            testcase << testName << caseName
-                     << (expectInvalidFlag ? " - Expected to reach tx engine!" : "");
+        // Any transaction carrying tfInnerBatchTxn is rejected in checkValidity()
+        // before it reaches the tx engine, regardless of its signing fields or
+        // whether the amendment is enabled.
+        auto submitAndValidate = [&](std::string caseName, Slice const& slice, int line) {
+            testcase << testName << caseName;
             auto const jrr = env.rpc("submit", strHex(slice))[jss::result];
-            auto const expected = withBatch
-                ? expectedEnabled.value_or(
-                      "fails local checks: Malformed: Invalid inner batch "
-                      "transaction.")
-                : expectedDisabled.value_or("fails local checks: Empty SigningPubKey.");
-            if (expectInvalidFlag)
-            {
-                expect(
-                    jrr[jss::status] == "success" && jrr[jss::engine_result] == "temINVALID_FLAG",
-                    pretty(jrr),
-                    __FILE__,
-                    line);
-            }
-            else
-            {
-                expect(
-                    jrr[jss::status] == "error" && jrr[jss::error] == "invalidTransaction" &&
-                        jrr[jss::error_exception] == expected,
-                    pretty(jrr),
-                    __FILE__,
-                    line);
-            }
+            expect(
+                jrr[jss::status] == "error" && jrr[jss::error] == "invalidTransaction" &&
+                    jrr[jss::error_exception] ==
+                        "fails local checks: Batch inner transactions are never "
+                        "considered validly signed.",
+                pretty(jrr),
+                __FILE__,
+                line);
             env.close();
         };
 
@@ -2621,12 +2690,7 @@ class Batch_test : public beast::unit_test::Suite
             STParsedJSONObject parsed("test", txn.getTxn());
             Serializer s;
             parsed.object->add(s);  // NOLINT(bugprone-unchecked-optional-access)
-            submitAndValidate(
-                "SigningPubKey set",
-                s.slice(),
-                __LINE__,
-                std::nullopt,
-                "fails local checks: Invalid signature.");
+            submitAndValidate("SigningPubKey set", s.slice(), __LINE__);
         }
 
         // Invalid RPC Submission: Signers
@@ -2640,12 +2704,7 @@ class Batch_test : public beast::unit_test::Suite
             STParsedJSONObject parsed("test", txn.getTxn());
             Serializer s;
             parsed.object->add(s);  // NOLINT(bugprone-unchecked-optional-access)
-            submitAndValidate(
-                "Signers set",
-                s.slice(),
-                __LINE__,
-                std::nullopt,
-                "fails local checks: Invalid Signers array size.");
+            submitAndValidate("Signers set", s.slice(), __LINE__);
         }
 
         {
@@ -2656,8 +2715,7 @@ class Batch_test : public beast::unit_test::Suite
             STParsedJSONObject parsed("test", jt.jv);
             Serializer s;
             parsed.object->add(s);  // NOLINT(bugprone-unchecked-optional-access)
-            submitAndValidate(
-                "Fully signed", s.slice(), __LINE__, std::nullopt, std::nullopt, !withBatch);
+            submitAndValidate("Fully signed", s.slice(), __LINE__);
         }
 
         // Invalid RPC Submission: tfInnerBatchTxn
@@ -2670,13 +2728,7 @@ class Batch_test : public beast::unit_test::Suite
             STParsedJSONObject parsed("test", txn.getTxn());
             Serializer s;
             parsed.object->add(s);  // NOLINT(bugprone-unchecked-optional-access)
-            submitAndValidate(
-                "No signing fields set",
-                s.slice(),
-                __LINE__,
-                "fails local checks: Empty SigningPubKey.",
-                "fails local checks: Empty SigningPubKey.",
-                withBatch && !withInnerSigFix);
+            submitAndValidate("No signing fields set", s.slice(), __LINE__);
         }
 
         // Invalid RPC Submission: tfInnerBatchTxn pseudo-transaction
@@ -2687,7 +2739,7 @@ class Batch_test : public beast::unit_test::Suite
         {
             STTx const amendTx(ttAMENDMENT, [seq = env.closed()->header().seq + 1](auto& obj) {
                 obj.setAccountID(sfAccount, AccountID());
-                obj.setFieldH256(sfAmendment, fixBatchInnerSigs);
+                obj.setFieldH256(sfAmendment, featureBatchV1_1);
                 obj.setFieldU32(sfLedgerSequence, seq);
                 obj.setFieldU32(sfFlags, tfInnerBatchTxn);
             });
@@ -2695,13 +2747,7 @@ class Batch_test : public beast::unit_test::Suite
             STParsedJSONObject parsed("test", txn.getTxn());
             Serializer s;
             parsed.object->add(s);  // NOLINT(bugprone-unchecked-optional-access)
-            submitAndValidate(
-                "Pseudo-transaction",
-                s.slice(),
-                __LINE__,
-                withInnerSigFix ? "fails local checks: Empty SigningPubKey."
-                                : "fails local checks: Cannot submit pseudo transactions.",
-                "fails local checks: Empty SigningPubKey.");
+            submitAndValidate("Pseudo-transaction", s.slice(), __LINE__);
         }
     }
 
@@ -2722,7 +2768,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -2771,6 +2817,93 @@ class Batch_test : public beast::unit_test::Suite
         // Alice pays XRP & Fee; Bob receives XRP
         BEAST_EXPECT(env.balance(alice) == preAlice - XRP(1000) - batchFee);
         BEAST_EXPECT(env.balance(bob) == XRP(1000));
+
+        // An inner partial payment must never fund a new account. With
+        // featureBatchV1_1 the partial-payment-to-create check runs on the
+        // batch's closed view and rejects it (tefNO_DST_PARTIAL). A USD->XRP path is
+        // set up so that, absent the check, the partial payment would deliver
+        // XRP and create carol; the check must block exactly that. A
+        // cross-currency shape (IOU SendMax, XRP Amount) also lets the inner
+        // pass preflight and reach the preclaim check.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const gw = Account("gw");
+            auto const carol = Account("carol");  // never funded
+            auto const usd = gw["USD"];
+            env.fund(XRP(10000), alice, gw);
+            env.close();
+            env.memoize(carol);
+
+            env(trust(alice, usd(100000)));
+            env(pay(gw, alice, usd(10000)));
+            env(offer(gw, usd(2000), XRP(2000)));  // USD -> XRP liquidity
+            env.close();
+
+            auto const seq = env.seq(alice);
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+
+            auto pp = pay(alice, carol, XRP(1000));
+            pp[jss::SendMax] = usd(2000).value().getJson(JsonOptions::Values::None);
+            pp[jss::Flags] = tfPartialPayment;
+
+            env(batch::outer(alice, seq, batchFee, tfIndependent),
+                batch::Inner(pp, seq + 1),
+                batch::Inner(noop(alice), seq + 2),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // carol was not created despite the available path.
+            BEAST_EXPECT(!env.le(carol));
+        }
+    }
+
+    void
+    testCheckAllSignatures(FeatureBitset features)
+    {
+        testcase("check all signatures");
+
+        using namespace test::jtx;
+        using namespace std::literals;
+
+        // Verifies that checkBatchSign validates all signers even when an
+        // unfunded account (signed with its master key) appears first in the
+        // sorted signer list. A funded account with an invalid signature must
+        // still be rejected with tefBAD_AUTH.
+
+        Env env{*this, features};
+
+        auto const alice = Account("alice");
+        // "aaa" sorts before other accounts alphabetically, ensuring the
+        // unfunded account is checked first in the sorted signer list
+        auto const unfunded = Account("aaa");
+        auto const carol = Account("carol");
+        env.fund(XRP(10000), alice, carol);
+        env.close();
+
+        // Verify sort order: unfunded.id() < carol.id()
+        BEAST_EXPECT(unfunded.id() < carol.id());
+
+        auto const seq = env.seq(alice);
+        auto const ledSeq = env.current()->seq();
+        auto const batchFee = batch::calcBatchFee(env, 2, 3);
+
+        // The batch includes:
+        // 1. alice pays unfunded (to create unfunded's account)
+        // 2. unfunded does a noop (signed by unfunded's master key - valid)
+        // 3. carol pays alice (signed by alice's key - INVALID since alice is
+        //    not carol's regular key)
+        //
+        // checkBatchSign must validate all signers regardless of order.
+        // This must fail with tefBAD_AUTH.
+        env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+            batch::Inner(pay(alice, unfunded, XRP(100)), seq + 1),
+            batch::Inner(noop(unfunded), ledSeq),
+            batch::Inner(pay(carol, alice, XRP(1000)), env.seq(carol)),
+            batch::Sig(unfunded, Reg{carol, alice}),
+            Ter(tefBAD_AUTH));
+        env.close();
     }
 
     void
@@ -2781,7 +2914,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -2845,7 +2978,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // tfIndependent: account delete success
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -2897,7 +3030,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // tfIndependent: account delete fails
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -2957,7 +3090,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // tfAllOrNothing: account delete fails
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -3009,7 +3142,7 @@ class Batch_test : public beast::unit_test::Suite
 
         using namespace test::jtx;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         Account const issuer{"issuer"};
         // For simplicity, lender will be the sole actor for the vault &
@@ -3186,7 +3319,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -3322,7 +3455,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -3396,7 +3529,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -3470,7 +3603,7 @@ class Batch_test : public beast::unit_test::Suite
             using namespace test::jtx;
             using namespace std::literals;
 
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -3531,7 +3664,7 @@ class Batch_test : public beast::unit_test::Suite
             using namespace test::jtx;
             using namespace std::literals;
 
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -3591,7 +3724,7 @@ class Batch_test : public beast::unit_test::Suite
             using namespace test::jtx;
             using namespace std::literals;
 
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -3666,7 +3799,7 @@ class Batch_test : public beast::unit_test::Suite
             // overwritten by the payment in the batch transaction. Because the
             // terPRE_SEQ is outside of the batch this noop transaction will ge
             // reapplied in the following ledger
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob, carol);
             env.close();
 
@@ -3729,7 +3862,7 @@ class Batch_test : public beast::unit_test::Suite
             // IMPORTANT: The batch txn is applied first, then the noop txn.
             // Because of this ordering, the noop txn is not applied and is
             // overwritten by the payment in the batch transaction.
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob);
             env.close();
 
@@ -3783,7 +3916,7 @@ class Batch_test : public beast::unit_test::Suite
             // IMPORTANT: The batch txn is applied first, then the noop txn.
             // Because of this ordering, the noop txn is not applied and is
             // overwritten by the payment in the batch transaction.
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob);
             env.close();
 
@@ -3831,7 +3964,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // Outer Batch terPRE_SEQ
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob, carol);
             env.close();
 
@@ -3905,7 +4038,7 @@ class Batch_test : public beast::unit_test::Suite
             // IMPORTANT: The batch txn is applied first, then the noop txn.
             // Because of this ordering, the noop txn is not applied and is
             // overwritten by the payment in the batch transaction.
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob);
             env.close();
 
@@ -3964,7 +4097,7 @@ class Batch_test : public beast::unit_test::Suite
             // IMPORTANT: The batch txn is applied first, then the noop txn.
             // Because of this ordering, the noop txn is not applied and is
             // overwritten by the payment in the batch transaction.
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob);
             env.close();
 
@@ -4037,7 +4170,7 @@ class Batch_test : public beast::unit_test::Suite
             // batch will run in the close ledger process. The batch will be
             // allied and then retry this transaction in the current ledger.
 
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob);
             env.close();
 
@@ -4100,7 +4233,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // Create Object Before Batch Txn
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob);
             env.close();
 
@@ -4163,7 +4296,7 @@ class Batch_test : public beast::unit_test::Suite
             // batch will run in the close ledger process. The batch will be
             // applied and then retry this transaction in the current ledger.
 
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             env.fund(XRP(10000), alice, bob);
             env.close();
 
@@ -4226,7 +4359,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
 
         auto const alice = Account("alice");
         auto const bob = Account("bob");
@@ -4265,7 +4398,7 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        test::jtx::Env env{*this, features};
+        Env env{*this, features};
         XRPAmount const baseFee = env.current()->fees().base;
 
         auto const alice = Account("alice");
@@ -4359,9 +4492,12 @@ class Batch_test : public beast::unit_test::Suite
         using namespace test::jtx;
         using namespace std::literals;
 
-        // only outer batch transactions are counter towards the queue size
+        // A Batch is never queued. Under open-ledger congestion a Batch that
+        // pays only its base fee cannot apply directly and, unlike an ordinary
+        // transaction, is rejected outright rather than held in the queue. A
+        // Batch that pays the escalated open-ledger fee applies directly.
         {
-            test::jtx::Env env{
+            Env env{
                 *this,
                 makeSmallQueueConfig({{Keys::kMinimumTxnInLedgerStandalone, "2"}}),
                 features,
@@ -4378,7 +4514,7 @@ class Batch_test : public beast::unit_test::Suite
             env.fund(XRP(10000), noripple(carol));
             env.close(env.now() + 5s, 10000ms);
 
-            // Fill the ledger
+            // Fill the open ledger so escalation is active.
             env(noop(alice));
             env(noop(alice));
             env(noop(alice));
@@ -4391,33 +4527,28 @@ class Batch_test : public beast::unit_test::Suite
             auto const bobSeq = env.seq(bob);
             auto const batchFee = batch::calcBatchFee(env, 1, 2);
 
-            // Queue Batch
-            {
-                env(batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
-                    batch::Inner(pay(alice, bob, XRP(10)), aliceSeq + 1),
-                    batch::Inner(pay(bob, alice, XRP(5)), bobSeq),
-                    batch::Sig(bob),
-                    Ter(terQUEUED));
-            }
+            // Paying only the base fee, the Batch cannot enter the congested
+            // open ledger and is rejected rather than queued.
+            env(batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
+                batch::Inner(pay(alice, bob, XRP(10)), aliceSeq + 1),
+                batch::Inner(pay(bob, alice, XRP(5)), bobSeq),
+                batch::Sig(bob),
+                Ter(telCAN_NOT_QUEUE));
 
-            checkMetrics(*this, env, 2, std::nullopt, 3, 2);
+            // The Batch was not queued; only carol's transaction is queued.
+            checkMetrics(*this, env, 1, std::nullopt, 3, 2);
 
-            // Replace Queued Batch
-            {
-                env(batch::outer(alice, aliceSeq, openLedgerFee(env, batchFee), tfAllOrNothing),
-                    batch::Inner(pay(alice, bob, XRP(10)), aliceSeq + 1),
-                    batch::Inner(pay(bob, alice, XRP(5)), bobSeq),
-                    batch::Sig(bob),
-                    Ter(tesSUCCESS));
-                env.close();
-            }
-
-            checkMetrics(*this, env, 0, 12, 1, 6);
+            // Paying the escalated open-ledger fee, the Batch applies directly.
+            env(batch::outer(alice, aliceSeq, openLedgerFee(env, batchFee), tfAllOrNothing),
+                batch::Inner(pay(alice, bob, XRP(10)), aliceSeq + 1),
+                batch::Inner(pay(bob, alice, XRP(5)), bobSeq),
+                batch::Sig(bob),
+                Ter(tesSUCCESS));
         }
 
         // inner batch transactions are counter towards the ledger tx count
         {
-            test::jtx::Env env{
+            Env env{
                 *this,
                 makeSmallQueueConfig({{Keys::kMinimumTxnInLedgerStandalone, "2"}}),
                 features,
@@ -4457,6 +4588,50 @@ class Batch_test : public beast::unit_test::Suite
             env(noop(carol), Ter(terQUEUED));
             checkMetrics(*this, env, 1, std::nullopt, 3, 2);
         }
+
+        // A Batch is never queued, so it also cannot sit behind the account's
+        // already-queued transactions: with a sequence gap it cannot apply
+        // directly and is rejected rather than queued.
+        {
+            Env env{
+                *this,
+                makeSmallQueueConfig({{Keys::kMinimumTxnInLedgerStandalone, "2"}}),
+                features,
+                nullptr,
+                beast::Severity::Error};
+
+            auto alice = Account("alice");
+            auto bob = Account("bob");
+
+            env.fund(XRP(10000), noripple(alice, bob));
+            env.close(env.now() + 5s, 10000ms);
+
+            // Fill the open ledger so subsequent transactions queue.
+            env(noop(alice));
+            env(noop(alice));
+            env(noop(alice));
+            checkMetrics(*this, env, 0, std::nullopt, 3, 2);
+
+            auto const aliceSeq = env.seq(alice);
+
+            // Queue two normal transactions for alice.
+            env(noop(alice), Seq(aliceSeq + 0), Ter(terQUEUED));
+            env(noop(alice), Seq(aliceSeq + 1), Ter(terQUEUED));
+            checkMetrics(*this, env, 2, std::nullopt, 3, 2);
+
+            // The Batch's sequence sits behind the queued transactions, so it
+            // cannot apply directly and is rejected rather than queued.
+            auto const bobSeq = env.seq(bob);
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            env(batch::outer(alice, aliceSeq + 2, batchFee, tfAllOrNothing),
+                batch::Inner(pay(alice, bob, XRP(10)), aliceSeq + 3),
+                batch::Inner(pay(bob, alice, XRP(5)), bobSeq),
+                batch::Sig(bob),
+                Ter(telCAN_NOT_QUEUE));
+
+            // The two queued transactions are untouched.
+            checkMetrics(*this, env, 2, std::nullopt, 3, 2);
+        }
     }
 
     void
@@ -4508,6 +4683,376 @@ class Batch_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testBatchDelegateConsent(FeatureBitset features)
+    {
+        testcase("batch delegate consent");
+
+        using namespace test::jtx;
+        using namespace std::literals;
+
+        // Delegate consent bypass.
+        //
+        // Alice delegates Payment to Bob. A Batch carries an inner Payment with
+        // Delegate=Bob, but Bob never signs the batch (and, because the inner
+        // Account == the outer Account, no BatchSigners are required at all).
+        // Batch waives the per-inner signature check, and preflightSigValidated
+        // derives required signers from sfAccount only -- it ignores sfDelegate
+        // -- so Bob's delegated authority is exercised without Bob's consent.
+        //
+        // SECURE EXPECTATION: the delegate (Bob) must authorize the inner txn,
+        // so the batch must be rejected (temBAD_SIGNER) when Bob does not sign.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const mallory = Account("mallory");
+            env.fund(XRP(10000), alice, bob, mallory);
+            env.close();
+
+            env(delegate::set(alice, bob, {"Payment"}));
+            env.close();
+
+            auto const preMallory = env.balance(mallory);
+
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const seq = env.seq(alice);
+
+            auto inner = batch::Inner(pay(alice, mallory, XRP(1000)), seq + 1);
+            inner[jss::Delegate] = bob.human();
+
+            // Bob is NOT among the batch signers; he never consents.
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                inner,
+                batch::Inner(pay(alice, mallory, XRP(1)), seq + 2),
+                Ter(temBAD_SIGNER));
+            env.close();
+
+            // No funds should have moved to Mallory.
+            BEAST_EXPECT(env.balance(mallory) == preMallory);
+        }
+
+        // Self-grant attribution forgery.
+        //
+        // With no pre-existing delegation, Alice places DelegateSet(authorize
+        // Bob) and a Delegate=Bob action in the SAME batch. The second inner
+        // reads the delegation created by the first from the batch's running
+        // view, and Bob never signs -- manufacturing on-chain attribution of
+        // the action to Bob without his consent.
+        //
+        // SECURE EXPECTATION: rejected (temBAD_SIGNER) -- Bob must consent, and
+        // a grant cannot be created and exercised within the same atomic batch.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const mallory = Account("mallory");
+            env.fund(XRP(10000), alice, bob, mallory);
+            env.close();
+
+            auto const preMallory = env.balance(mallory);
+
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const seq = env.seq(alice);
+
+            auto inner = batch::Inner(pay(alice, mallory, XRP(1000)), seq + 2);
+            inner[jss::Delegate] = bob.human();
+
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(delegate::set(alice, bob, {"Payment"}), seq + 1),
+                inner,
+                Ter(temBAD_SIGNER));
+            env.close();
+
+            BEAST_EXPECT(env.balance(mallory) == preMallory);
+        }
+
+        // Legitimate counterpart: the same atomic grant-and-use is allowed when
+        // the delegate co-signs the batch -- consent is present, so it succeeds.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const mallory = Account("mallory");
+            env.fund(XRP(10000), alice, bob, mallory);
+            env.close();
+
+            auto const preMallory = env.balance(mallory);
+
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            auto const seq = env.seq(alice);
+
+            auto inner = batch::Inner(pay(alice, mallory, XRP(1000)), seq + 2);
+            inner[jss::Delegate] = bob.human();
+
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(delegate::set(alice, bob, {"Payment"}), seq + 1),
+                inner,
+                batch::Sig(bob),
+                Ter(tesSUCCESS));
+            env.close();
+
+            BEAST_EXPECT(env.balance(mallory) == preMallory + XRP(1000));
+        }
+
+        // Multi-account: a delegated inner from a non-outer account also
+        // requires the delegate's signature (not the account holder's).
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const carol = Account("carol");
+            env.fund(XRP(10000), alice, bob, carol);
+            env.close();
+
+            env(delegate::set(bob, carol, {"Payment"}));
+            env.close();
+
+            auto const preAlice = env.balance(alice);
+
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            auto const aliceSeq = env.seq(alice);
+            auto const bobSeq = env.seq(bob);
+
+            auto inner = batch::Inner(pay(bob, alice, XRP(1)), bobSeq);
+            inner[jss::Delegate] = carol.human();
+
+            // Carol (the delegate) does not sign.
+            env(batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
+                inner,
+                batch::Inner(pay(alice, bob, XRP(2)), aliceSeq + 1),
+                Ter(temBAD_SIGNER));
+            env.close();
+
+            BEAST_EXPECT(env.balance(alice) == preAlice);
+        }
+
+        // Wrong signer: a batch signature from someone other than the named
+        // delegate does not satisfy the requirement.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const carol = Account("carol");
+            auto const mallory = Account("mallory");
+            env.fund(XRP(10000), alice, bob, carol, mallory);
+            env.close();
+
+            env(delegate::set(alice, bob, {"Payment"}));
+            env.close();
+
+            auto const preMallory = env.balance(mallory);
+
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            auto const seq = env.seq(alice);
+
+            auto inner = batch::Inner(pay(alice, mallory, XRP(1000)), seq + 1);
+            inner[jss::Delegate] = bob.human();
+
+            // Carol signs instead of the named delegate Bob.
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                inner,
+                batch::Inner(pay(alice, mallory, XRP(1)), seq + 2),
+                batch::Sig(carol),
+                Ter(temBAD_SIGNER));
+            env.close();
+
+            BEAST_EXPECT(env.balance(mallory) == preMallory);
+        }
+
+        // Delegate is the outer account: the outer signature already provides
+        // the delegate's consent, so no BatchSigners are required.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            env.fund(XRP(10000), alice, bob);
+            env.close();
+
+            // Bob delegates Payment to Alice, who is also the batch submitter.
+            env(delegate::set(bob, alice, {"Payment"}));
+            env.close();
+
+            auto const preBob = env.balance(bob);
+
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const aliceSeq = env.seq(alice);
+            auto const bobSeq = env.seq(bob);
+
+            auto inner = batch::Inner(pay(bob, alice, XRP(1)), bobSeq);
+            inner[jss::Delegate] = alice.human();
+
+            env(batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
+                inner,
+                batch::Inner(pay(alice, bob, XRP(2)), aliceSeq + 1),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Net: Bob sends 1 to Alice, receives 2 from Alice.
+            BEAST_EXPECT(env.balance(bob) == preBob + XRP(1));
+        }
+
+        // Principal signs instead of the delegate. Bob delegates Payment to
+        // Carol and an inner pays from Bob with Delegate=Carol, so Carol -- not
+        // Bob -- is the required batch signer. Bob's own signature (the account
+        // holder) does not satisfy the delegate-consent requirement.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const carol = Account("carol");
+            env.fund(XRP(10000), alice, bob, carol);
+            env.close();
+
+            env(delegate::set(bob, carol, {"Payment"}));
+            env.close();
+
+            auto const preAlice = env.balance(alice);
+
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            auto const aliceSeq = env.seq(alice);
+            auto const bobSeq = env.seq(bob);
+
+            auto inner = batch::Inner(pay(bob, alice, XRP(1)), bobSeq);
+            inner[jss::Delegate] = carol.human();
+
+            // Bob (the principal) signs in place of Carol (the delegate).
+            env(batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
+                inner,
+                batch::Inner(pay(alice, bob, XRP(2)), aliceSeq + 1),
+                batch::Sig(bob),
+                Ter(temBAD_SIGNER));
+            env.close();
+
+            BEAST_EXPECT(env.balance(alice) == preAlice);
+        }
+
+        // Control for the revocation case below: identical setup, but inner 1
+        // is a benign payment instead of a revocation. With Alice's delegation
+        // intact, the delegated inner 2 succeeds -- proving the failure in the
+        // revocation case is caused by the revocation, not the setup.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const mallory = Account("mallory");
+            env.fund(XRP(10000), alice, bob, mallory);
+            env.close();
+
+            env(delegate::set(bob, alice, {"Payment"}));
+            env.close();
+
+            auto const preMallory = env.balance(mallory);
+
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            auto const seq = env.seq(bob);
+
+            auto inner2 = batch::Inner(pay(bob, mallory, XRP(1000)), seq + 2);
+            inner2[jss::Delegate] = alice.human();
+
+            // Inner 1 is Bob's own payment (no revocation); Alice co-signs for
+            // the delegated inner 2.
+            auto const [txIDs, batchID] = submitBatch(
+                env,
+                tesSUCCESS,
+                batch::outer(bob, seq, batchFee, tfIndependent),
+                batch::Inner(pay(bob, alice, XRP(1)), seq + 1),
+                inner2,
+                batch::Sig(alice));
+            env.close();
+
+            std::vector<TestLedgerData> const testCases = {
+                {.index = 0,
+                 .txType = "Batch",
+                 .result = "tesSUCCESS",
+                 .txHash = batchID,
+                 .batchID = std::nullopt},
+                {.index = 1,
+                 .txType = "Payment",
+                 .result = "tesSUCCESS",
+                 .txHash = txIDs[0],
+                 .batchID = batchID},
+                {.index = 2,
+                 .txType = "Payment",
+                 .result = "tesSUCCESS",
+                 .txHash = txIDs[1],
+                 .batchID = batchID},
+            };
+            validateClosedLedger(env, testCases);
+
+            // The delegated payment applied: Mallory received the funds.
+            BEAST_EXPECT(env.balance(mallory) == preMallory + XRP(1000));
+        }
+
+        // Revocation within the same batch. Bob grants Alice Payment permission
+        // beforehand; an earlier inner revokes it before a later delegated
+        // inner tries to use it. Alice must still co-sign (delegate consent is
+        // derived from the static tx), but the revoked permission makes the
+        // delegated inner fail at apply time -- a grant cannot be used after it
+        // is removed earlier in the same batch.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const mallory = Account("mallory");
+            env.fund(XRP(10000), alice, bob, mallory);
+            env.close();
+
+            env(delegate::set(bob, alice, {"Payment"}));
+            env.close();
+
+            auto const preMallory = env.balance(mallory);
+
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            auto const seq = env.seq(bob);
+
+            // Inner 2: Alice acts as Bob's delegate, so Alice is the required
+            // batch signer.
+            auto inner2 = batch::Inner(pay(bob, mallory, XRP(1000)), seq + 2);
+            inner2[jss::Delegate] = alice.human();
+
+            // tfIndependent: inner 1 (the revocation) applies; inner 2 then
+            // fails for lack of permission without reverting inner 1. An empty
+            // permission list deletes the Delegate object.
+            auto const [txIDs, batchID] = submitBatch(
+                env,
+                tesSUCCESS,
+                batch::outer(bob, seq, batchFee, tfIndependent),
+                batch::Inner(delegate::set(bob, alice, {}), seq + 1),
+                inner2,
+                batch::Sig(alice));
+            env.close();
+
+            std::vector<TestLedgerData> const testCases = {
+                {.index = 0,
+                 .txType = "Batch",
+                 .result = "tesSUCCESS",
+                 .txHash = batchID,
+                 .batchID = std::nullopt},
+                {.index = 1,
+                 .txType = "DelegateSet",
+                 .result = "tesSUCCESS",
+                 .txHash = txIDs[0],
+                 .batchID = batchID},
+                // inner 2 fails: Alice's permission was revoked in inner 1.
+            };
+            validateClosedLedger(env, testCases);
+
+            // The delegated payment never applied.
+            BEAST_EXPECT(env.balance(mallory) == preMallory);
+            BEAST_EXPECT(env.rpc("tx", txIDs[1])[jss::result][jss::error] == "txnNotFound");
+        }
+    }
+
     void
     testBatchDelegate(FeatureBitset features)
     {
@@ -4518,7 +5063,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // delegated non atomic inner
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -4533,17 +5078,20 @@ class Batch_test : public beast::unit_test::Suite
             auto const preAlice = env.balance(alice);
             auto const preBob = env.balance(bob);
 
-            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
             auto const seq = env.seq(alice);
 
             auto tx = batch::Inner(pay(alice, bob, XRP(1)), seq + 1);
             tx[jss::Delegate] = bob.human();
+            // The delegate (Bob) authorizes the delegated inner, so Bob must
+            // provide the batch signature.
             auto const [txIDs, batchID] = submitBatch(
                 env,
                 tesSUCCESS,
                 batch::outer(alice, seq, batchFee, tfAllOrNothing),
                 tx,
-                batch::Inner(pay(alice, bob, XRP(2)), seq + 2));
+                batch::Inner(pay(alice, bob, XRP(2)), seq + 2),
+                batch::Sig(bob));
             env.close();
 
             std::vector<TestLedgerData> const testCases = {
@@ -4575,7 +5123,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // delegated atomic inner
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -4598,13 +5146,15 @@ class Batch_test : public beast::unit_test::Suite
 
             auto tx = batch::Inner(pay(bob, alice, XRP(1)), bobSeq);
             tx[jss::Delegate] = carol.human();
+            // Carol is the delegate authorizing the inner txn on Bob's behalf,
+            // so Carol -- not Bob -- must provide the batch signature.
             auto const [txIDs, batchID] = submitBatch(
                 env,
                 tesSUCCESS,
                 batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
                 tx,
                 batch::Inner(pay(alice, bob, XRP(2)), aliceSeq + 1),
-                batch::Sig(bob));
+                batch::Sig(carol));
             env.close();
 
             std::vector<TestLedgerData> const testCases = {
@@ -4639,7 +5189,7 @@ class Batch_test : public beast::unit_test::Suite
         // this also makes sure tfInnerBatchTxn won't block delegated AccountSet
         // with granular permission
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
 
             auto const alice = Account("alice");
             auto const bob = Account("bob");
@@ -4654,19 +5204,22 @@ class Batch_test : public beast::unit_test::Suite
             auto const preAlice = env.balance(alice);
             auto const preBob = env.balance(bob);
 
-            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
             auto const seq = env.seq(alice);
 
             auto tx = batch::Inner(noop(alice), seq + 1);
             std::string const domain = "example.com";
             tx[sfDomain.jsonName] = strHex(domain);
             tx[jss::Delegate] = bob.human();
+            // Bob is the delegate authorizing the inner AccountSet, so Bob must
+            // provide the batch signature.
             auto const [txIDs, batchID] = submitBatch(
                 env,
                 tesSUCCESS,
                 batch::outer(alice, seq, batchFee, tfAllOrNothing),
                 tx,
-                batch::Inner(pay(alice, bob, XRP(2)), seq + 2));
+                batch::Inner(pay(alice, bob, XRP(2)), seq + 2),
+                batch::Sig(bob));
             env.close();
 
             std::vector<TestLedgerData> const testCases = {
@@ -4700,7 +5253,7 @@ class Batch_test : public beast::unit_test::Suite
         // this also makes sure tfInnerBatchTxn won't block delegated
         // MPTokenIssuanceSet with granular permission
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             Account const alice{"alice"};
             Account const bob{"bob"};
             env.fund(XRP(100000), alice, bob);
@@ -4717,7 +5270,7 @@ class Batch_test : public beast::unit_test::Suite
             env.close();
 
             auto const seq = env.seq(alice);
-            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
 
             json::Value jv1;
             jv1[sfTransactionType] = jss::MPTokenIssuanceSet;
@@ -4735,12 +5288,15 @@ class Batch_test : public beast::unit_test::Suite
             jv2[sfMPTokenIssuanceID] = to_string(mptID);
             jv2[sfFlags] = tfMPTUnlock;
 
+            // Both inners are delegated to Bob, so Bob must provide the batch
+            // signature (one signer covers both).
             auto const [txIDs, batchID] = submitBatch(
                 env,
                 tesSUCCESS,
                 batch::outer(alice, seq, batchFee, tfAllOrNothing),
                 batch::Inner(jv1, seq + 1),
-                batch::Inner(jv2, seq + 2));
+                batch::Inner(jv2, seq + 2),
+                batch::Sig(bob));
             env.close();
 
             std::vector<TestLedgerData> const testCases = {
@@ -4767,7 +5323,7 @@ class Batch_test : public beast::unit_test::Suite
         // this also makes sure tfInnerBatchTxn won't block delegated TrustSet
         // with granular permission
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             Account const gw{"gw"};
             Account const alice{"alice"};
             Account const bob{"bob"};
@@ -4781,19 +5337,22 @@ class Batch_test : public beast::unit_test::Suite
             env.close();
 
             auto const seq = env.seq(gw);
-            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
 
             auto jv1 = trust(gw, gw["USD"](0), alice, tfSetfAuth);
             jv1[sfDelegate] = bob.human();
             auto jv2 = trust(gw, gw["USD"](0), alice, tfSetFreeze);
             jv2[sfDelegate] = bob.human();
 
+            // Both inners are delegated to Bob, so Bob must provide the batch
+            // signature.
             auto const [txIDs, batchID] = submitBatch(
                 env,
                 tesSUCCESS,
                 batch::outer(gw, seq, batchFee, tfAllOrNothing),
                 batch::Inner(jv1, seq + 1),
-                batch::Inner(jv2, seq + 2));
+                batch::Inner(jv2, seq + 2),
+                batch::Sig(bob));
             env.close();
 
             std::vector<TestLedgerData> const testCases = {
@@ -4818,7 +5377,7 @@ class Batch_test : public beast::unit_test::Suite
 
         // inner transaction not authorized by the delegating account.
         {
-            test::jtx::Env env{*this, features};
+            Env env{*this, features};
             Account const gw{"gw"};
             Account const alice{"alice"};
             Account const bob{"bob"};
@@ -4832,20 +5391,23 @@ class Batch_test : public beast::unit_test::Suite
             env.close();
 
             auto const seq = env.seq(gw);
-            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
 
             auto jv1 = trust(gw, gw["USD"](0), alice, tfSetFreeze);
             jv1[sfDelegate] = bob.human();
             auto jv2 = trust(gw, gw["USD"](0), alice, tfClearFreeze);
             jv2[sfDelegate] = bob.human();
 
+            // Both inners are delegated to Bob, so Bob must provide the batch
+            // signature; jv2 still fails preclaim for lack of permission.
             auto const [txIDs, batchID] = submitBatch(
                 env,
                 tesSUCCESS,
                 batch::outer(gw, seq, batchFee, tfIndependent),
                 batch::Inner(jv1, seq + 1),
                 // terNO_DELEGATE_PERMISSION: not authorized to clear freeze
-                batch::Inner(jv2, seq + 2));
+                batch::Inner(jv2, seq + 2),
+                batch::Sig(bob));
             env.close();
 
             std::vector<TestLedgerData> const testCases = {
@@ -5004,7 +5566,7 @@ class Batch_test : public beast::unit_test::Suite
                 batch::outer(alice, seq, batchFee, tfAllOrNothing),
                 batch::Inner(pay(alice, bob, XRP(10)), seq + 1),
                 batch::Inner(pay(alice, bob, XRP(5)), seq + 2),
-                batch::Sig(bob, carol, alice, bob, carol, alice, bob, carol, alice, alice));
+                batch::Sig(std::vector<Reg>(kMaxBatchSigners + 1, bob)));
             XRPAmount const txBaseFee = getBaseFee(jtx);
             BEAST_EXPECT(txBaseFee == XRPAmount(kInitialXrp));
         }
@@ -5022,6 +5584,304 @@ class Batch_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testStandaloneInnerBatchFlag(FeatureBitset features)
+    {
+        testcase("standalone tx with tfInnerBatchTxn rejected");
+
+        using namespace test::jtx;
+        using namespace std::literals;
+
+        // A standalone Payment with tfInnerBatchTxn must be rejected.
+        // Without proper guards this would bypass signature verification
+        // in preflight2.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            env.fund(XRP(10000), alice, bob);
+            env.close();
+
+            // Submit a normal Payment with tfInnerBatchTxn flag.
+            // preflight1 must reject with temINVALID_INNER_BATCH because
+            // the flag is set but no parentBatchId exists.
+            env(pay(alice, bob, XRP(1)), Txflags(tfInnerBatchTxn), Ter(telENV_RPC_FAILED));
+            env.close();
+
+            // Verify via direct apply path (bypassing RPC layer)
+            env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal j) {
+                // Construct a Payment STTx with tfInnerBatchTxn,
+                // empty signing pub key, and no signature — mimicking
+                // what an attacker would send to skip sig verification.
+                STTx const stx = STTx(ttPAYMENT, [&](auto& obj) {
+                    obj.setAccountID(sfAccount, alice.id());
+                    obj.setAccountID(sfDestination, bob.id());
+                    obj.setFieldAmount(sfAmount, XRP(1));
+                    obj.setFieldAmount(sfFee, XRP(0));
+                    obj.setFieldU32(sfSequence, env.seq(alice));
+                    obj.setFieldU32(sfFlags, tfInnerBatchTxn);
+                });
+
+                auto const result = xrpl::apply(env.app(), view, stx, TapNone, j);
+                // Must NOT be applied — signature was never checked
+                BEAST_EXPECT(!result.applied);
+                return false;
+            });
+        }
+    }
+
+    void
+    testOuterBinding(FeatureBitset features)
+    {
+        testcase("outer binding");
+
+        using namespace test::jtx;
+
+        // Signatures captured from one outer account cannot be replayed
+        // under a different outer account.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const carol = Account("carol");
+            auto const eve = Account("eve");
+            env.fund(XRP(10000), alice, bob, carol, eve);
+            env.close();
+
+            auto const preCarol = env.balance(carol);
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+
+            auto const aliceSeq = env.seq(alice);
+            auto const batchFee1 = batch::calcBatchFee(env, 2, 2);
+            auto jt1 = env.jt(
+                batch::outer(alice, aliceSeq, batchFee1, tfOnlyOne),
+                batch::Inner(pay(bob, alice, XRP(100)), bobSeq),
+                batch::Inner(pay(carol, alice, XRP(50)), carolSeq),
+                batch::Sig(bob, carol));
+
+            auto const capturedSigners = jt1.jv[sfBatchSigners.jsonName];
+
+            env(jt1, Ter(tesSUCCESS));
+            env.close();
+            BEAST_EXPECT(env.seq(bob) == bobSeq + 1);
+            BEAST_EXPECT(env.seq(carol) == carolSeq);
+
+            auto const batchFee2 = batch::calcBatchFee(env, 2, 2);
+            auto jt2 = env.jtnofill(
+                batch::outer(eve, env.seq(eve), batchFee2, tfOnlyOne),
+                batch::Inner(pay(bob, alice, XRP(100)), bobSeq),
+                batch::Inner(pay(carol, alice, XRP(50)), carolSeq));
+
+            jt2.jv[sfBatchSigners.jsonName] = capturedSigners;
+            env(jt2.jv, Ter(telENV_RPC_FAILED));
+            env.close();
+
+            BEAST_EXPECT(env.seq(carol) == carolSeq);
+            BEAST_EXPECT(env.balance(carol) == preCarol);
+        }
+
+        // Signatures are bound to the outer sequence; replaying them
+        // at a higher sequence must fail.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const carol = Account("carol");
+            env.fund(XRP(10000), alice, bob, carol);
+            env.close();
+
+            auto const preCarol = env.balance(carol);
+            auto const bobSeq = env.seq(bob);
+            auto const carolSeq = env.seq(carol);
+
+            auto const aliceSeq1 = env.seq(alice);
+            auto const batchFee1 = batch::calcBatchFee(env, 2, 2);
+            auto jt1 = env.jt(
+                batch::outer(alice, aliceSeq1, batchFee1, tfOnlyOne),
+                batch::Inner(pay(bob, alice, XRP(500)), bobSeq),
+                batch::Inner(pay(carol, alice, XRP(500)), carolSeq),
+                batch::Sig(bob, carol));
+
+            auto const capturedSigners = jt1.jv[sfBatchSigners.jsonName];
+
+            env(jt1, Ter(tesSUCCESS));
+            env.close();
+            BEAST_EXPECT(env.seq(bob) == bobSeq + 1);
+            BEAST_EXPECT(env.seq(carol) == carolSeq);
+
+            auto const batchFee2 = batch::calcBatchFee(env, 2, 2);
+            auto jt2 = env.jtnofill(
+                batch::outer(alice, env.seq(alice), batchFee2, tfOnlyOne),
+                batch::Inner(pay(bob, alice, XRP(500)), bobSeq),
+                batch::Inner(pay(carol, alice, XRP(500)), carolSeq));
+
+            jt2.jv[sfBatchSigners.jsonName] = capturedSigners;
+            env(jt2.jv, Ter(telENV_RPC_FAILED));
+            env.close();
+
+            BEAST_EXPECT(env.balance(carol) == preCarol);
+            BEAST_EXPECT(env.seq(carol) == carolSeq);
+        }
+
+        // Multi-signed batch signer entries are bound to their account;
+        // reusing inner signatures under a different batch signer must fail.
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const carol = Account("carol");
+            auto const dave = Account("dave");
+            auto const elsa = Account("elsa");
+            env.fund(XRP(10000), alice, bob, carol, dave, elsa);
+            env.close();
+
+            env(signers(bob, 2, {{dave, 1}, {elsa, 1}}));
+            env.close();
+            env(signers(carol, 2, {{dave, 1}, {elsa, 1}}));
+            env.close();
+
+            auto const seq = env.seq(alice);
+            auto const batchFee = batch::calcBatchFee(env, 3, 2);
+            auto jt1 = env.jt(
+                batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(pay(alice, bob, XRP(10)), seq + 1),
+                batch::Inner(pay(bob, alice, XRP(5)), env.seq(bob)),
+                batch::Msig(bob, {dave, elsa}),
+                Ter(tesSUCCESS));
+
+            auto const bobSignerEntry = jt1.jv[sfBatchSigners.jsonName][0u];
+
+            env(jt1, Ter(tesSUCCESS));
+            env.close();
+
+            auto const seq2 = env.seq(alice);
+            auto const batchFee2 = batch::calcBatchFee(env, 3, 2);
+            auto jt2 = env.jtnofill(
+                batch::outer(alice, seq2, batchFee2, tfAllOrNothing),
+                batch::Inner(pay(alice, carol, XRP(10)), seq2 + 1),
+                batch::Inner(pay(carol, alice, XRP(5)), env.seq(carol)));
+
+            json::Value carolSigner;
+            carolSigner[sfBatchSigner.jsonName][jss::Account] = carol.human();
+            carolSigner[sfBatchSigner.jsonName][jss::SigningPubKey] = "";
+            carolSigner[sfBatchSigner.jsonName][sfSigners.jsonName] =
+                bobSignerEntry[sfBatchSigner.jsonName][sfSigners.jsonName];
+
+            jt2.jv[sfBatchSigners.jsonName][0u] = carolSigner;
+            env(jt2.jv, Ter(telENV_RPC_FAILED));
+            env.close();
+        }
+    }
+
+    void
+    testUnsortedBatchSigners(FeatureBitset features)
+    {
+        testcase("unsorted batch signers");
+
+        using namespace test::jtx;
+
+        Env env{*this, features};
+
+        auto const alice = Account("alice");
+        auto const bob = Account("bob");
+        auto const carol = Account("carol");
+        env.fund(XRP(10000), alice, bob, carol);
+        env.close();
+
+        auto const seq = env.seq(alice);
+        auto const bobSeq = env.seq(bob);
+        auto const carolSeq = env.seq(carol);
+        auto const batchFee = batch::calcBatchFee(env, 2, 2);
+
+        auto jt = env.jt(
+            batch::outer(alice, seq, batchFee, tfAllOrNothing),
+            batch::Inner(pay(bob, alice, XRP(10)), bobSeq),
+            batch::Inner(pay(carol, alice, XRP(5)), carolSeq),
+            batch::Sig(bob, carol));
+
+        auto const s0 = jt.jv[sfBatchSigners.jsonName][0u];
+        auto const s1 = jt.jv[sfBatchSigners.jsonName][1u];
+        jt.jv[sfBatchSigners.jsonName][0u] = s1;
+        jt.jv[sfBatchSigners.jsonName][1u] = s0;
+
+        env(jt.jv, Ter(temBAD_SIGNER));
+        env.close();
+    }
+
+    void
+    testBatchSigCache(FeatureBitset features)
+    {
+        testcase("batch signature caching");
+
+        using namespace test::jtx;
+
+        // Mirrors apply.cpp's file-local kSfSiggood (the standard signature-good
+        // cache); batch signer sigs are now verified and cached alongside the
+        // outer signature in checkSign/checkValidity.
+        constexpr HashRouterFlags kSfSiggood = HashRouterFlags::PRIVATE2;
+
+        // Valid batch: alice (outer) + an inner from bob, who co-signs.
+        auto buildValidBatch = [](Env& env) {
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const seq = env.seq(alice);
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            return env.jt(
+                batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(pay(alice, bob, XRP(1)), seq + 1),
+                batch::Inner(pay(bob, alice, XRP(2)), env.seq(bob)),
+                batch::Sig(bob));
+        };
+
+        // WRITE: a valid batch records "good" on its tx id.
+        {
+            Env env{*this, features};
+            env.fund(XRP(10000), Account("alice"), Account("bob"));
+            env.close();
+
+            auto jt = buildValidBatch(env);
+            auto const txid = jt.stx->getTransactionID();
+
+            BEAST_EXPECT(!any(env.app().getHashRouter().getFlags(txid) & kSfSiggood));
+            env(jt, Ter(tesSUCCESS));
+            BEAST_EXPECT(any(env.app().getHashRouter().getFlags(txid) & kSfSiggood));
+            env.close();
+        }
+
+        // READ: corrupt only a signer's signature (outer sig + signer key
+        // untouched), so just the crypto would fail. Caught when uncached...
+        {
+            Env env{*this, features};
+            env.fund(XRP(10000), Account("alice"), Account("bob"));
+            env.close();
+
+            auto jt = buildValidBatch(env);
+            jt.jv[sfBatchSigners.jsonName][0u][sfBatchSigner.jsonName][sfTxnSignature.jsonName] =
+                "00";
+            env(jt.jv, Ter(telENV_RPC_FAILED));
+            env.close();
+        }
+        {
+            // ...but a planted "good" skips the crypto, so it applies.
+            Env env{*this, features};
+            env.fund(XRP(10000), Account("alice"), Account("bob"));
+            env.close();
+
+            auto jt = buildValidBatch(env);
+            jt.jv[sfBatchSigners.jsonName][0u][sfBatchSigner.jsonName][sfTxnSignature.jsonName] =
+                "00";
+            auto const txid = STTx{parse(jt.jv)}.getTransactionID();
+            env.app().getHashRouter().setFlags(txid, kSfSiggood);
+            env(jt.jv, Ter(tesSUCCESS));
+            env.close();
+        }
+    }
+
     void
     testWithFeats(FeatureBitset features)
     {
@@ -5038,6 +5898,7 @@ class Batch_test : public beast::unit_test::Suite
         testIndependent(features);
         testInnerSubmitRPC(features);
         testAccountActivation(features);
+        testCheckAllSignatures(features);
         testAccountSet(features);
         testAccountDelete(features);
         testLoan(features);
@@ -5053,8 +5914,13 @@ class Batch_test : public beast::unit_test::Suite
         testBatchTxQueue(features);
         testBatchNetworkOps(features);
         testBatchDelegate(features);
+        testBatchDelegateConsent(features);
         testValidateRPCResponse(features);
         testBatchCalculateBaseFee(features);
+        testStandaloneInnerBatchFlag(features);
+        testOuterBinding(features);
+        testUnsortedBatchSigners(features);
+        testBatchSigCache(features);
     }
 
 public:
@@ -5064,7 +5930,6 @@ public:
         using namespace test::jtx;
 
         auto const sa = testableAmendments();
-        testWithFeats(sa - fixBatchInnerSigs);
         testWithFeats(sa);
     }
 };
diff --git a/src/test/app/ConfidentialTransferExtended_test.cpp b/src/test/app/ConfidentialTransferExtended_test.cpp
index 0aee7516c9..953325a6e9 100644
--- a/src/test/app/ConfidentialTransferExtended_test.cpp
+++ b/src/test/app/ConfidentialTransferExtended_test.cpp
@@ -1945,7 +1945,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             env.close();
 
             auto const bobSeq = env.seq(bob);
-            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
 
             // jv1: proof against spending balance 100
             auto jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 60}, bobSeq + 1);
@@ -1957,6 +1957,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
                 batch::Inner(jv1, bobSeq + 1),
                 batch::Inner(jv2, bobSeq + 2),
+                batch::Sig(dave),
                 Ter(tesSUCCESS));
             env.close();
 
@@ -1981,7 +1982,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             env.close();
 
             auto const bobSeq = env.seq(bob);
-            auto const batchFee = batch::calcConfidentialBatchFee(env, 0, 2);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
 
             // jv1: proof against spending balance 100.
             auto jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 40}, bobSeq + 1);
@@ -1994,6 +1995,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
                 batch::Inner(jv1, bobSeq + 1),
                 batch::Inner(jv2, bobSeq + 2),
+                batch::Sig(dave),
                 Ter(tesSUCCESS));
             env.close();
 
@@ -2029,7 +2031,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
 
             auto const bobSeq = env.seq(bob);
             auto const carolSeq = env.seq(carol);
-            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 2, 2);
 
             // jv1: direct send from carol (valid proof).
             auto const jv1 = mpt.sendJV({.account = carol, .dest = dave, .amt = 30}, carolSeq);
@@ -2040,7 +2042,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             env(batch::outer(bob, bobSeq, batchFee, tfAllOrNothing),
                 batch::Inner(jv1, carolSeq),
                 batch::Inner(jv2, bobSeq + 1),
-                batch::Sig(carol),
+                batch::Sig(carol, dave),
                 Ter(tesSUCCESS));
             env.close();
 
@@ -2066,7 +2068,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             // Bob does not grant dave any permissions.
             auto const bobSeq = env.seq(bob);
             auto const carolSeq = env.seq(carol);
-            auto const batchFee = batch::calcConfidentialBatchFee(env, 1, 2);
+            auto const batchFee = batch::calcConfidentialBatchFee(env, 2, 2);
 
             auto jv1 = mpt.sendJV({.account = bob, .dest = carol, .amt = 50}, bobSeq + 1);
             jv1[jss::Delegate] = dave.human();
@@ -2075,7 +2077,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             env(batch::outer(bob, bobSeq, batchFee, tfIndependent),
                 batch::Inner(jv1, bobSeq + 1),
                 batch::Inner(jv2, carolSeq),
-                batch::Sig(carol),
+                batch::Sig(carol, dave),
                 Ter(tesSUCCESS));
             env.close();
 
@@ -2093,8 +2095,9 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
         testcase("Test batch delegated send with delegate as outer account");
         using namespace test::jtx;
 
-        // Dave has delegation permission, but the inner Account is bob.
-        // Without bob's BatchSigner, the batch is rejected.
+        // Dave holds bob's ConfidentialMPTSend delegation and is the outer batch
+        // signer, so dave's outer signature consents to the delegated inner.
+        // The batch applies.
         {
             Env env{*this, features};
             Account const alice("alice");
@@ -2119,11 +2122,11 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             env(batch::outer(dave, daveSeq, batchFee, tfAllOrNothing),
                 batch::Inner(jv1, bobSeq),
                 batch::Inner(jv2, daveSeq + 1),
-                Ter(temBAD_SIGNER));
+                Ter(tesSUCCESS));
             env.close();
 
-            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 100);
-            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 0);
+            BEAST_EXPECT(mpt.getDecryptedBalance(bob, MPTTester::holderEncryptedSpending) == 60);
+            BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 40);
         }
 
         // Dave submits a mixed batch: bob signs inner tx1, and
@@ -2163,8 +2166,10 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             BEAST_EXPECT(mpt.getDecryptedBalance(carol, MPTTester::holderEncryptedInbox) == 70);
         }
 
-        // Verify the delegator Bob's BatchSigner does not bypass the missing delegation permission.
-        // The delegated inner send fails.
+        // The delegated inner's required signer is the delegate (dave), not bob.
+        // Bob signs but is not a required signer, so the batch is rejected as an
+        // extra signer. The delegator's signature cannot stand in for the
+        // delegate's.
         {
             Env env{*this, features};
             Account const alice("alice");
@@ -2189,7 +2194,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
                 batch::Inner(jv1, bobSeq),
                 batch::Inner(jv2, carolSeq),
                 batch::Sig(bob, carol),
-                Ter(tesSUCCESS));
+                Ter(temBAD_SIGNER));
             env.close();
 
             // jv1 fails before jv2 is attempted.
@@ -2257,7 +2262,7 @@ class ConfidentialTransferExtended_test : public ConfidentialTransferTestBase
             batch::Inner(jv4, frankSeq),
             batch::Inner(jv5, frankSeq + 1),
             batch::Inner(jv6, bobSeq + 2),
-            batch::Sig(bob, carol, frank),
+            batch::Sig(erin, frank),
             Ter(tesSUCCESS));
         env.close();
 
diff --git a/src/test/app/LedgerReplay_test.cpp b/src/test/app/LedgerReplay_test.cpp
index 2422db05de..ed99817f34 100644
--- a/src/test/app/LedgerReplay_test.cpp
+++ b/src/test/app/LedgerReplay_test.cpp
@@ -1,12 +1,14 @@
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
 #include <test/jtx/amount.h>
+#include <test/jtx/batch.h>
 #include <test/jtx/envconfig.h>
 #include <test/jtx/fee.h>
 #include <test/jtx/pay.h>
 #include <test/jtx/seq.h>
 #include <test/jtx/sig.h>
 #include <test/jtx/tags.h>
+#include <test/jtx/ter.h>
 
 #include <xrpld/app/ledger/BuildLedger.h>
 #include <xrpld/app/ledger/InboundLedger.h>
@@ -36,6 +38,8 @@
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
 #include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
 #include <xrpl/resource/Charge.h>
 #include <xrpl/server/Handoff.h>
 #include <xrpl/shamap/SHAMapItem.h>
@@ -68,7 +72,7 @@ namespace xrpl::test {
 struct LedgerReplay_test : public beast::unit_test::Suite
 {
     void
-    run() override
+    testReplayLedger()
     {
         testcase("Replay ledger");
 
@@ -91,6 +95,45 @@ struct LedgerReplay_test : public beast::unit_test::Suite
 
         BEAST_EXPECT(replayed->header().hash == lastClosed->header().hash);
     }
+
+    void
+    testReplayBatchLedger()
+    {
+        testcase("Replay ledger with batch transactions");
+
+        using namespace jtx;
+
+        Env env(*this, testableAmendments());
+
+        auto const alice = Account("alice");
+        auto const bob = Account("bob");
+        env.fund(XRP(100000), alice, bob);
+        env.close();
+
+        auto const seq = env.seq(alice);
+        auto const batchFee = batch::calcBatchFee(env, 0, 2);
+        env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+            batch::Inner(pay(alice, bob, XRP(1)), seq + 1),
+            batch::Inner(pay(alice, bob, XRP(2)), seq + 2),
+            Ter(tesSUCCESS));
+        env.close();
+
+        LedgerMaster& ledgerMaster = env.app().getLedgerMaster();
+        auto const lastClosed = ledgerMaster.getClosedLedger();
+        auto const lastClosedParent = ledgerMaster.getLedgerByHash(lastClosed->header().parentHash);
+
+        auto const replayed = buildLedger(
+            LedgerReplay(lastClosedParent, lastClosed), TapNone, env.app(), env.journal);
+
+        BEAST_EXPECT(replayed->header().hash == lastClosed->header().hash);
+    }
+
+    void
+    run() override
+    {
+        testReplayLedger();
+        testReplayBatchLedger();
+    }
 };
 
 enum class InboundLedgersBehavior {
diff --git a/src/test/app/TxQ_test.cpp b/src/test/app/TxQ_test.cpp
index 2d10eb4beb..91eb26da7e 100644
--- a/src/test/app/TxQ_test.cpp
+++ b/src/test/app/TxQ_test.cpp
@@ -61,8 +61,7 @@ namespace xrpl::test {
 
 class TxQPosNegFlows_test : public beast::unit_test::Suite
 {
-    // Same as corresponding values from TxQ.h
-    static constexpr FeeLevel64 kBaseFeeLevel{256};
+    static constexpr FeeLevel64 kBaseFeeLevel{TxQ::kBaseLevel};
     static constexpr FeeLevel64 kMinEscalationFeeLevel = kBaseFeeLevel * 500;
 
     static void
diff --git a/src/test/jtx/TestHelpers.h b/src/test/jtx/TestHelpers.h
index 0e35e6b9ec..34532b17f7 100644
--- a/src/test/jtx/TestHelpers.h
+++ b/src/test/jtx/TestHelpers.h
@@ -731,8 +731,8 @@ create(jtx::Account const& account, jtx::Account const& dest, STAmount const& se
 
 }  // namespace check
 
-static constexpr FeeLevel64 kBaseFeeLevel{TxQ::kBaseLevel};
-static constexpr FeeLevel64 kMinEscalationFeeLevel = kBaseFeeLevel * 500;
+inline constexpr FeeLevel64 kBaseFeeLevel{TxQ::kBaseLevel};
+inline constexpr FeeLevel64 kMinEscalationFeeLevel = kBaseFeeLevel * 500;
 
 inline uint256
 getCheckIndex(AccountID const& account, std::uint32_t uSequence)
diff --git a/src/test/jtx/batch.h b/src/test/jtx/batch.h
index 0e78d409fa..4d564f150a 100644
--- a/src/test/jtx/batch.h
+++ b/src/test/jtx/batch.h
@@ -58,7 +58,6 @@ class Inner
 {
 private:
     json::Value txn_;
-    std::uint32_t seq_;
     std::optional<std::uint32_t> ticket_;
 
 public:
@@ -66,10 +65,10 @@ public:
         json::Value txn,
         std::uint32_t const& sequence,
         std::optional<std::uint32_t> const& ticket = std::nullopt)
-        : txn_(std::move(txn)), seq_(sequence), ticket_(ticket)
+        : txn_(std::move(txn)), ticket_(ticket)
     {
         txn_[jss::SigningPubKey] = "";
-        txn_[jss::Sequence] = seq_;
+        txn_[jss::Sequence] = sequence;
         txn_[jss::Fee] = "0";
         txn_[jss::Flags] = txn_[jss::Flags].asUInt() | tfInnerBatchTxn;
 
diff --git a/src/test/jtx/impl/batch.cpp b/src/test/jtx/impl/batch.cpp
index 66ca0c7d54..b1061f65a3 100644
--- a/src/test/jtx/impl/batch.cpp
+++ b/src/test/jtx/impl/batch.cpp
@@ -99,7 +99,13 @@ Sig::operator()(Env& env, JTx& jt) const
         jo[jss::SigningPubKey] = strHex(e.sig.pk().slice());
 
         Serializer msg;
-        serializeBatch(msg, stx.getFlags(), stx.getBatchTransactionIDs());
+        serializeBatch(
+            msg,
+            stx.getAccountID(sfAccount),
+            stx.getSeqValue(),
+            stx.getFlags(),
+            stx.getBatchTransactionIDs());
+        finishMultiSigningData(e.acct.id(), msg);
         // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
         auto const sig = xrpl::sign(*publicKeyType(e.sig.pk().slice()), e.sig.sk(), msg.slice());
         jo[sfTxnSignature.getJsonName()] = strHex(Slice{sig.data(), sig.size()});
@@ -137,7 +143,13 @@ Msig::operator()(Env& env, JTx& jt) const
         iso[jss::SigningPubKey] = strHex(e.sig.pk().slice());
 
         Serializer msg;
-        serializeBatch(msg, stx.getFlags(), stx.getBatchTransactionIDs());
+        serializeBatch(
+            msg,
+            stx.getAccountID(sfAccount),
+            stx.getSeqValue(),
+            stx.getFlags(),
+            stx.getBatchTransactionIDs());
+        msg.addBitString(master.id());
         finishMultiSigningData(e.acct.id(), msg);
         // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
         auto const sig = xrpl::sign(*publicKeyType(e.sig.pk().slice()), e.sig.sk(), msg.slice());
diff --git a/src/test/rpc/Feature_test.cpp b/src/test/rpc/Feature_test.cpp
index 8cda5965cb..a36e51cb6f 100644
--- a/src/test/rpc/Feature_test.cpp
+++ b/src/test/rpc/Feature_test.cpp
@@ -134,7 +134,7 @@ class Feature_test : public beast::unit_test::Suite
         // or removed, swap out for any other feature.
         BEAST_EXPECT(
             featureToName(fixRemoveNFTokenAutoTrustLine) == "fixRemoveNFTokenAutoTrustLine");
-        BEAST_EXPECT(featureToName(featureBatch) == "Batch");
+        BEAST_EXPECT(featureToName(featureBatchV1_1) == "BatchV1_1");
         BEAST_EXPECT(featureToName(featureDID) == "DID");
         BEAST_EXPECT(featureToName(fixIncludeKeyletFields) == "fixIncludeKeyletFields");
         BEAST_EXPECT(featureToName(featureTokenEscrow) == "TokenEscrow");
diff --git a/src/test/rpc/Simulate_test.cpp b/src/test/rpc/Simulate_test.cpp
index 5ea79c3996..0d00360a58 100644
--- a/src/test/rpc/Simulate_test.cpp
+++ b/src/test/rpc/Simulate_test.cpp
@@ -420,6 +420,20 @@ class Simulate_test : public beast::unit_test::Suite
             BEAST_EXPECT(
                 resp[jss::result][jss::error_message] == "Transaction should not be signed.");
         }
+        {
+            // tfInnerBatchTxn flag on top-level transaction
+            json::Value params;
+            json::Value txJson{json::ValueType::Object};
+            txJson[jss::TransactionType] = jss::AccountSet;
+            txJson[jss::Account] = env.master.human();
+            txJson[jss::Flags] = tfInnerBatchTxn;
+            params[jss::tx_json] = txJson;
+
+            auto const resp = env.rpc("json", "simulate", to_string(params));
+            BEAST_EXPECT(
+                resp[jss::result][jss::error_message] ==
+                "tfInnerBatchTxn flag is not allowed on top-level transactions.");
+        }
     }
 
     void
@@ -476,7 +490,7 @@ class Simulate_test : public beast::unit_test::Suite
         auto jt = env.jtnofill(
             batch::outer(alice, env.seq(alice), batchFee, tfAllOrNothing),
             batch::Inner(pay(alice, bob, XRP(10)), seq + 1),
-            batch::Inner(pay(alice, bob, XRP(10)), seq + 1));
+            batch::Inner(pay(alice, bob, XRP(10)), seq + 2));
 
         jt.jv.removeMember(jss::TxnSignature);
         json::Value params;
diff --git a/src/xrpld/app/ledger/detail/BuildLedger.cpp b/src/xrpld/app/ledger/detail/BuildLedger.cpp
index 2eb64ecaf9..038a7be4b7 100644
--- a/src/xrpld/app/ledger/detail/BuildLedger.cpp
+++ b/src/xrpld/app/ledger/detail/BuildLedger.cpp
@@ -17,6 +17,7 @@
 #include <xrpl/protocol/LedgerHeader.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SystemParameters.h>
+#include <xrpl/protocol/TxFlags.h>
 #include <xrpl/tx/apply.h>
 
 #include <cstddef>
@@ -233,7 +234,15 @@ buildLedger(
         j,
         [&](OpenView& accum, std::shared_ptr<Ledger> const& built) {
             for (auto& tx : replayData.orderedTxns())
+            {
+                // Inner batch transactions are applied as part of their outer
+                // Batch transaction, never on their own. Skip them here so they
+                // are not re-applied a second time outside of the batch during
+                // replay.
+                if (tx.second->isFlag(tfInnerBatchTxn))
+                    continue;
                 applyTransaction(app, accum, *tx.second, false, applyFlags, j);
+            }
         });
 }
 
diff --git a/src/xrpld/app/misc/NetworkOPs.cpp b/src/xrpld/app/misc/NetworkOPs.cpp
index 1802441a66..82445f3625 100644
--- a/src/xrpld/app/misc/NetworkOPs.cpp
+++ b/src/xrpld/app/misc/NetworkOPs.cpp
@@ -1253,8 +1253,9 @@ NetworkOPsImp::submitTransaction(std::shared_ptr<STTx const> const& iTrans)
         return;
     }
 
-    // Enforce Network bar for batch txn
-    if (iTrans->isFlag(tfInnerBatchTxn) && ledgerMaster_.getValidatedRules().enabled(featureBatch))
+    // Reject any transaction with the tfInnerBatchTxn flag at the network
+    // boundary, regardless of amendment state.
+    if (iTrans->isFlag(tfInnerBatchTxn))
     {
         JLOG(journal_.error()) << "Submitted transaction invalid: tfInnerBatchTxn flag present.";
         return;
@@ -1320,7 +1321,7 @@ NetworkOPsImp::preProcessTransaction(std::shared_ptr<Transaction>& transaction)
     // under no circumstances will we ever accept an inner txn within a batch
     // txn from the network.
     auto const sttx = *transaction->getSTransaction();
-    if (sttx.isFlag(tfInnerBatchTxn) && view->rules().enabled(featureBatch))
+    if (sttx.isFlag(tfInnerBatchTxn))
     {
         transaction->setStatus(TransStatus::INVALID);
         transaction->setResult(temINVALID_FLAG);
diff --git a/src/xrpld/app/misc/detail/TxQ.cpp b/src/xrpld/app/misc/detail/TxQ.cpp
index ec5ac569d6..7e57302d23 100644
--- a/src/xrpld/app/misc/detail/TxQ.cpp
+++ b/src/xrpld/app/misc/detail/TxQ.cpp
@@ -25,6 +25,7 @@
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/SeqProxy.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
 #include <xrpl/protocol/Units.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol/jss.h>
@@ -390,6 +391,12 @@ TxQ::canBeHeld(
     std::optional<TxQAccount::TxMap::iterator> const& replacementIter,
     std::scoped_lock<std::mutex> const& lock)
 {
+    // A Batch is never queued: its inner transactions can change the sequence
+    // numbers of multiple accounts, which the TxQ's per-account model cannot
+    // forecast. It must apply straight to the open ledger or not at all.
+    if (tx.getTxnType() == ttBATCH)
+        return telCAN_NOT_QUEUE;
+
     // PreviousTxnID is deprecated and should never be used.
     // AccountTxnID is not supported by the transaction
     // queue yet, but should be added in the future.
diff --git a/src/xrpld/overlay/detail/PeerImp.cpp b/src/xrpld/overlay/detail/PeerImp.cpp
index e1d7d23215..5ac61cfd91 100644
--- a/src/xrpld/overlay/detail/PeerImp.cpp
+++ b/src/xrpld/overlay/detail/PeerImp.cpp
@@ -1309,7 +1309,7 @@ PeerImp::handleTransaction(
         // Charge strongly for attempting to relay a txn with tfInnerBatchTxn
         // LCOV_EXCL_START
         /*
-           There is no need to check whether the featureBatch amendment is
+           There is no need to check whether the featureBatchV1_1 amendment is
            enabled.
 
            * If the `tfInnerBatchTxn` flag is set, and the amendment is
@@ -2873,7 +2873,7 @@ PeerImp::checkTransaction(
         // charge strongly for relaying batch txns
         // LCOV_EXCL_START
         /*
-           There is no need to check whether the featureBatch amendment is
+           There is no need to check whether the featureBatchV1_1 amendment is
            enabled.
 
            * If the `tfInnerBatchTxn` flag is set, and the amendment is
diff --git a/src/xrpld/rpc/handlers/transaction/Simulate.cpp b/src/xrpld/rpc/handlers/transaction/Simulate.cpp
index 7ee28c4886..2a6c2280e3 100644
--- a/src/xrpld/rpc/handlers/transaction/Simulate.cpp
+++ b/src/xrpld/rpc/handlers/transaction/Simulate.cpp
@@ -26,6 +26,7 @@
 #include <xrpl/protocol/STParsedJSON.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/TxFormats.h>
 #include <xrpl/protocol/jss.h>
 #include <xrpl/resource/Fees.h>
@@ -355,6 +356,13 @@ doSimulate(RPC::JsonContext& context)
         return RPC::makeError(RpcNotImpl);
     }
 
+    // Reject transactions with the tfInnerBatchTxn flag.
+    if (stTx->isFlag(tfInnerBatchTxn))
+    {
+        return RPC::makeError(
+            RpcInvalidParams, "tfInnerBatchTxn flag is not allowed on top-level transactions.");
+    }
+
     std::string reason;
     auto transaction = std::make_shared<Transaction>(stTx, reason, context.app);
     // Actually run the transaction through the transaction processor

From ea13be81b7037ce0a03c706e5b916b0beb581496 Mon Sep 17 00:00:00 2001
From: Vito Tumas <5780819+Tapanito@users.noreply.github.com>
Date: Wed, 1 Jul 2026 15:21:23 +0200
Subject: [PATCH 029/100] feat: Add an invariant to ensure object deletion also
 deletes its pseudo-account (#7445)

Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>
---
 include/xrpl/tx/invariants/InvariantCheck.h  |  26 +++-
 src/libxrpl/tx/invariants/InvariantCheck.cpp |  95 +++++++++++--
 src/test/app/Invariants_test.cpp             | 142 +++++++++++++++++--
 3 files changed, 242 insertions(+), 21 deletions(-)

diff --git a/include/xrpl/tx/invariants/InvariantCheck.h b/include/xrpl/tx/invariants/InvariantCheck.h
index 8931d189fd..ba91cba064 100644
--- a/include/xrpl/tx/invariants/InvariantCheck.h
+++ b/include/xrpl/tx/invariants/InvariantCheck.h
@@ -375,16 +375,35 @@ public:
  */
 class ValidAmounts
 {
-    std::vector<std::shared_ptr<SLE const>> afterEntries_;
+    std::vector<SLE::const_pointer> afterEntries_;
 
 public:
     void
-    visitEntry(bool, std::shared_ptr<SLE const> const&, std::shared_ptr<SLE const> const&);
+    visitEntry(bool, SLE::const_ref, SLE::const_ref);
 
     [[nodiscard]] bool
     finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&) const;
 };
 
+/*
+ * Verify that when an object with an associated pseudo-account is deleted,
+ * its pseudo-account is also deleted.
+ *
+ * The reverse (pseudo-account deleted → object deleted) is enforced by
+ * AccountRootsDeletedClean via getPseudoAccountFields().
+ */
+class ObjectHasPseudoAccount
+{
+public:
+    void
+    visitEntry(bool, SLE::const_ref, SLE::const_ref);
+
+    [[nodiscard]] bool
+    finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&) const;
+
+private:
+    std::vector<SLE::const_pointer> deletedObjSles_;
+};
 // additional invariant checks can be declared above and then added to this
 // tuple
 using InvariantChecks = std::tuple<
@@ -416,7 +435,8 @@ using InvariantChecks = std::tuple<
     ValidConfidentialMPToken,
     ValidMPTPayment,
     ValidAmounts,
-    ValidMPTTransfer>;
+    ValidMPTTransfer,
+    ObjectHasPseudoAccount>;
 
 /**
  * @brief get a tuple of all invariant checks
diff --git a/src/libxrpl/tx/invariants/InvariantCheck.cpp b/src/libxrpl/tx/invariants/InvariantCheck.cpp
index 308342da74..32df44a96b 100644
--- a/src/libxrpl/tx/invariants/InvariantCheck.cpp
+++ b/src/libxrpl/tx/invariants/InvariantCheck.cpp
@@ -35,6 +35,7 @@
 #include <memory>
 #include <optional>
 #include <sstream>
+#include <string>
 #include <vector>
 
 namespace xrpl {
@@ -63,6 +64,23 @@ hasPrivilege(STTx const& tx, Privilege priv)
 #undef TRANSACTION
 #pragma pop_macro("TRANSACTION")
 
+// Returns the human-readable name of a ledger entry's type, falling back to
+// the numeric type if the format is somehow unknown.
+static std::string
+ledgerEntryTypeName(SLE const& sle)
+{
+    auto const item = LedgerFormats::getInstance().findByType(sle.getType());
+
+    if (item == nullptr)
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::ledgerEntryTypeName : ledger entry has no known ledger format");
+        return std::to_string(sle.getType());
+        // LCOV_EXCL_STOP
+    }
+    return item->getName();
+}
+
 void
 TransactionFeeCheck::visitEntry(bool, SLE::const_ref, SLE::const_ref)
 {
@@ -457,16 +475,8 @@ AccountRootsDeletedClean::finalize(
         if (auto const sle = view.read(keylet))
         {
             // Finding the object is bad
-            auto const typeName = [&sle]() {
-                auto item = LedgerFormats::getInstance().findByType(sle->getType());
-
-                if (item != nullptr)
-                    return item->getName();
-                return std::to_string(sle->getType());
-            }();
-
-            JLOG(j.fatal()) << "Invariant failed: account deletion left behind a " << typeName
-                            << " object";
+            JLOG(j.fatal()) << "Invariant failed: account deletion left behind a "
+                            << ledgerEntryTypeName(*sle) << " object";
             // The comment above starting with "assert(enforce)" explains this
             // assert.
             XRPL_ASSERT(
@@ -1070,4 +1080,69 @@ ValidAmounts::finalize(
     return true;
 }
 
+void
+ObjectHasPseudoAccount::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after)
+{
+    if (!isDelete)
+        return;
+
+    // Before should never be null when isDelete = true
+    if (!before)
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE(
+            "xrpl::ObjectHasPseudoAccount::visitEntry : deleted ledger entry missing before state");
+        return;
+        // LCOV_EXCL_STOP
+    }
+
+    switch (before->getType())
+    {
+        case ltAMM:
+        case ltVAULT:
+        case ltLOAN_BROKER:
+            deletedObjSles_.push_back(before);
+            break;
+        default:
+            return;
+    }
+}
+
+[[nodiscard]] bool
+ObjectHasPseudoAccount::finalize(
+    STTx const&,
+    TER const,
+    XRPAmount const,
+    ReadView const& view,
+    beast::Journal const& j) const
+{
+    if (!view.rules().enabled(fixCleanup3_3_0))
+        return true;
+
+    if (deletedObjSles_.empty())
+        return true;
+
+    bool failed = false;
+    for (auto const& sle : deletedObjSles_)
+    {
+        if (!sle->isFieldPresent(sfAccount))
+        {
+            JLOG(j.fatal()) << "Invariant failed: deleted " << ledgerEntryTypeName(*sle)
+                            << " is missing pseudo-account field";
+            failed = true;
+            continue;
+        }
+
+        // The pseudo-account must NOT exist on the ledger after the object is deleted.
+        if (view.exists(keylet::account(sle->getAccountID(sfAccount))))
+        {
+            JLOG(j.fatal()) << "Invariant failed: deleted " << ledgerEntryTypeName(*sle)
+                            << " without deleting its pseudo-account";
+            failed = true;
+        }
+    }
+
+    return !failed;
+}
+
 }  // namespace xrpl
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 9fde52ecb2..079ff9df88 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -2829,7 +2829,8 @@ class Invariants_test : public beast::unit_test::Suite
             });
 
         doInvariantCheck(
-            {"vault updated by a wrong transaction type"},
+            {"vault updated by a wrong transaction type",
+             "deleted Vault without deleting its pseudo-account"},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 auto const keylet = keylet::vault(a1.id(), ac.view().seq());
                 auto sleVault = ac.view().peek(keylet);
@@ -2840,7 +2841,7 @@ class Invariants_test : public beast::unit_test::Suite
             },
             XRPAmount{},
             STTx{ttPAYMENT, [](STObject&) {}},
-            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
             [&](Account const& a1, Account const& a2, Env& env) {
                 Vault const vault{env};
                 auto [tx, _] = vault.create({.owner = a1, .asset = xrpIssue()});
@@ -2877,6 +2878,7 @@ class Invariants_test : public beast::unit_test::Suite
                 auto const vaultPage = ac.view().dirInsert(
                     keylet::ownerDir(a1.id()), sleVault->key(), describeOwnerDir(a1.id()));
                 sleVault->setFieldU64(sfOwnerNode, *vaultPage);
+                sleVault->setAccountID(sfAccount, a1.id());
                 ac.view().insert(sleVault);
                 return true;
             },
@@ -2885,7 +2887,8 @@ class Invariants_test : public beast::unit_test::Suite
             {tecINVARIANT_FAILED, tecINVARIANT_FAILED});
 
         doInvariantCheck(
-            {"vault deleted by a wrong transaction type"},
+            {"vault deleted by a wrong transaction type",
+             "deleted Vault without deleting its pseudo-account"},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 auto const keylet = keylet::vault(a1.id(), ac.view().seq());
                 auto sleVault = ac.view().peek(keylet);
@@ -2896,7 +2899,7 @@ class Invariants_test : public beast::unit_test::Suite
             },
             XRPAmount{},
             STTx{ttVAULT_SET, [](STObject&) {}},
-            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
             [&](Account const& a1, Account const& a2, Env& env) {
                 Vault const vault{env};
                 auto [tx, _] = vault.create({.owner = a1, .asset = xrpIssue()});
@@ -2905,7 +2908,8 @@ class Invariants_test : public beast::unit_test::Suite
             });
 
         doInvariantCheck(
-            {"vault operation updated more than single vault"},
+            {"vault operation updated more than single vault",
+             "deleted Vault without deleting its pseudo-account"},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 {
                     auto const keylet = keylet::vault(a1.id(), ac.view().seq());
@@ -2925,7 +2929,7 @@ class Invariants_test : public beast::unit_test::Suite
             },
             XRPAmount{},
             STTx{ttVAULT_DELETE, [](STObject&) {}},
-            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
             [&](Account const& a1, Account const& a2, Env& env) {
                 Vault const vault{env};
                 {
@@ -2949,6 +2953,7 @@ class Invariants_test : public beast::unit_test::Suite
                     auto const vaultPage = ac.view().dirInsert(
                         keylet::ownerDir(a.id()), sleVault->key(), describeOwnerDir(a.id()));
                     sleVault->setFieldU64(sfOwnerNode, *vaultPage);
+                    sleVault->setAccountID(sfAccount, a.id());
                     ac.view().insert(sleVault);
                 };
                 insertVault(a1);
@@ -2960,7 +2965,8 @@ class Invariants_test : public beast::unit_test::Suite
             {tecINVARIANT_FAILED, tecINVARIANT_FAILED});
 
         doInvariantCheck(
-            {"deleted vault must also delete shares"},
+            {"deleted vault must also delete shares",
+             "deleted Vault without deleting its pseudo-account"},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 auto const keylet = keylet::vault(a1.id(), ac.view().seq());
                 auto sleVault = ac.view().peek(keylet);
@@ -2971,7 +2977,7 @@ class Invariants_test : public beast::unit_test::Suite
             },
             XRPAmount{},
             STTx{ttVAULT_DELETE, [](STObject&) {}},
-            {tecINVARIANT_FAILED, tecINVARIANT_FAILED},
+            {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
             [&](Account const& a1, Account const& a2, Env& env) {
                 Vault const vault{env};
                 auto [tx, _] = vault.create({.owner = a1, .asset = xrpIssue()});
@@ -5176,6 +5182,125 @@ class Invariants_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testObjectHasPseudoAccount()
+    {
+        testcase << "object has pseudo-account";
+        using namespace jtx;
+
+        auto const amendments = defaultAmendments() | fixCleanup3_3_0;
+
+        // Vault: object deleted without its pseudo-account
+        {
+            Keylet vaultKeylet = keylet::amendments();
+            doInvariantCheck(
+                Env{*this, amendments},
+                {{"deleted Vault without deleting its pseudo-account"}},
+                [&vaultKeylet](Account const&, Account const&, ApplyContext& ac) {
+                    auto sle = ac.view().peek(vaultKeylet);
+                    if (!sle)
+                        return false;
+                    ac.view().erase(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{ttVAULT_DELETE, [](STObject&) {}},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                [&vaultKeylet](Account const& a1, Account const&, Env& env) {
+                    Vault const vault{env};
+                    auto [tx, keylet] = vault.create({.owner = a1, .asset = xrpIssue()});
+                    env(tx);
+                    vaultKeylet = keylet;
+                    return true;
+                });
+        }
+
+        // AMM: object deleted without its pseudo-account
+        {
+            uint256 ammID{};
+            Account const gw{"gw"};
+            doInvariantCheck(
+                Env{*this, amendments},
+                {{"deleted AMM without deleting its pseudo-account"}},
+                [&ammID](Account const&, Account const&, ApplyContext& ac) {
+                    auto sle = ac.view().peek(keylet::amm(ammID));
+                    if (!sle)
+                        return false;
+                    ac.view().erase(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{ttAMM_DELETE, [](STObject&) {}},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                [&ammID, &gw](Account const&, Account const&, Env& env) {
+                    env.fund(XRP(1'000), gw);
+                    AMM const amm(env, gw, XRP(100), gw["USD"](100));
+                    ammID = amm.ammID();
+                    return true;
+                });
+        }
+
+        // LoanBroker: object deleted without its pseudo-account
+        {
+            Keylet loanBrokerKeylet = keylet::amendments();
+            doInvariantCheck(
+                Env{*this, amendments},
+                {{"deleted LoanBroker without deleting its pseudo-account"}},
+                [&loanBrokerKeylet](Account const&, Account const&, ApplyContext& ac) {
+                    auto sle = ac.view().peek(loanBrokerKeylet);
+                    if (!sle)
+                        return false;
+                    ac.view().erase(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{ttLOAN_BROKER_DELETE, [](STObject&) {}},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                [&loanBrokerKeylet, this](Account const& a1, Account const&, Env& env) {
+                    PrettyAsset const xrpAsset{xrpIssue(), 1'000'000};
+                    loanBrokerKeylet = this->createLoanBroker(a1, env, xrpAsset);
+                    return BEAST_EXPECT(env.le(loanBrokerKeylet));
+                });
+        }
+
+        // Deleted object missing sfAccount field (defensive check).
+        // Manually construct the view to place a vault SLE without
+        // sfAccount into the base ledger, then erase it.
+        {
+            Env env{*this, amendments};
+            Account const a1{"A1"};
+            Account const a2{"A2"};
+            env.fund(XRP(1000), a1, a2);
+            env.close();
+
+            OpenView ov{*env.current()};
+
+            auto const vaultKeylet = keylet::vault(a1.id(), ov.seq());
+            auto sleVault = std::make_shared<SLE>(vaultKeylet);
+            sleVault->makeFieldAbsent(sfAccount);
+            ov.rawInsert(sleVault);
+
+            STTx const tx{ttVAULT_DELETE, [](STObject&) {}};
+            test::StreamSink sink{beast::Severity::Warning};
+            beast::Journal const jlog{sink};
+            ApplyContext ac{
+                env.app(), ov, tx, tesSUCCESS, env.current()->fees().base, TapNone, jlog};
+            CurrentTransactionRulesGuard const rulesGuard(ov.rules());
+
+            auto sle = ac.view().peek(vaultKeylet);
+            if (!BEAST_EXPECT(sle))
+                return;
+            ac.view().erase(sle);
+
+            auto transactor = makeTransactor(ac);
+            if (!BEAST_EXPECT(transactor))
+                return;
+            TER const result = transactor->checkInvariants(tesSUCCESS, XRPAmount{});
+            BEAST_EXPECT(result == tecINVARIANT_FAILED);
+            BEAST_EXPECT(sink.messages().str().contains("is missing pseudo-account field"));
+        }
+    }
+
     void
     testConfidentialMPTTransfer()
     {
@@ -5458,6 +5583,7 @@ public:
         testInvariantOverwrite(defaultAmendments() - fixCleanup3_1_3);
         testVaultComputeCoarsestScale();
         testAMM();
+        testObjectHasPseudoAccount();
     }
 };
 

From 6aed3bb71d2820f081ce2a22666e456420a814b2 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 1 Jul 2026 14:28:14 +0100
Subject: [PATCH 030/100] chore: Update pre-commit hooks && actions (#7686)

---
 .github/workflows/pre-commit.yml                 | 2 +-
 .github/workflows/publish-docs.yml               | 2 +-
 .github/workflows/reusable-build-test-config.yml | 2 +-
 .github/workflows/reusable-clang-tidy.yml        | 2 +-
 .github/workflows/upload-conan-deps.yml          | 2 +-
 .pre-commit-config.yaml                          | 6 +++---
 docs/0001-negative-unl/README.md                 | 2 +-
 7 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 0363534af5..1acd28208e 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@e06d4138c9ec8dceeb7c818645faa38087ea9e3d
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@1bde119a1ab71305ba5d3716e7a82cea1c7bdede
     with:
       runs_on: ubuntu-latest
       container: '{ "image": "ghcr.io/xrplf/ci/tools-rippled-pre-commit:sha-41ec7c1" }'
diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index bfa8d2e79c..1ac8d61655 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@9355d190fd7d4de80fadfd161e6edddc9702cd9f
+        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/reusable-build-test-config.yml b/.github/workflows/reusable-build-test-config.yml
index 0cb0219d72..e7a88a0e66 100644
--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -113,7 +113,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@9355d190fd7d4de80fadfd161e6edddc9702cd9f
+        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
diff --git a/.github/workflows/reusable-clang-tidy.yml b/.github/workflows/reusable-clang-tidy.yml
index b04847e137..5528f3452e 100644
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@9355d190fd7d4de80fadfd161e6edddc9702cd9f
+        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/upload-conan-deps.yml b/.github/workflows/upload-conan-deps.yml
index 88b364c2b1..22ad36d98f 100644
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@9355d190fd7d4de80fadfd161e6edddc9702cd9f
+        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
         with:
           enable_ccache: false
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4cbf4c1dd0..7bac4d1140 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -51,12 +51,12 @@ repos:
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
-    rev: faadd6a9d852369ca94f4d15b2404c967ba8cb01 # frozen: 0.27.6
+    rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
     hooks:
       - id: gersemi
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 515f543f5718ebfd6ce22e16708bb32c68ff96e1 # frozen: v3.8.3
+    rev: 39e2973981e6d2f9b6c543b0086a2d2393abdc89 # frozen: v3.9.4
     hooks:
       - id: prettier
         args: [--end-of-line=auto]
@@ -86,7 +86,7 @@ repos:
         files: \.md$
 
   - repo: https://github.com/streetsidesoftware/cspell-cli
-    rev: 4643f154907327ee0a2c7038f0296e0dd77d9776 # frozen: v10.0.0
+    rev: ea11f9efc0bec520073405bc30552da887ba71bc # frozen: v10.0.1
     hooks:
       - id: cspell # Spell check changed files
         exclude: |
diff --git a/docs/0001-negative-unl/README.md b/docs/0001-negative-unl/README.md
index dd5f9af2ae..0bc65cd860 100644
--- a/docs/0001-negative-unl/README.md
+++ b/docs/0001-negative-unl/README.md
@@ -288,7 +288,7 @@ components with non-trivial changes are colored green.
     validated.
 
 ![Sequence diagram](./negativeUNL_highLevel_sequence.png?raw=true "Negative UNL
- Changes")
+Changes")
 
 ## Roads Not Taken
 

From 6d0b758a12eeb24b3c980d4673be3673040fdc63 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 1 Jul 2026 14:28:41 +0100
Subject: [PATCH 031/100] build: Don't reuse binaries between different C++
 versions (#7681)

---
 conan/profiles/default    | 12 +++++++-----
 conan/profiles/sanitizers | 10 +++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/conan/profiles/default b/conan/profiles/default
index e0a88ebca1..ae6e23c3c3 100644
--- a/conan/profiles/default
+++ b/conan/profiles/default
@@ -10,16 +10,18 @@
 os={{ os }}
 arch={{ arch }}
 build_type=Debug
-compiler={{compiler}}
+compiler={{ compiler }}
 compiler.version={{ compiler_version }}
 compiler.cppstd=23
 {% if os == "Windows" %}
 compiler.runtime=static
 {% else %}
-compiler.libcxx={{detect_api.detect_libcxx(compiler, version, compiler_exe)}}
+compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}
 
 [conf]
-{% if compiler == "gcc" and compiler_version < 13 %}
-tools.build:cxxflags+=['-Wno-restrict']
-{% endif %}
+{# By default, Conan tries to reuse binaries built with different cppstd versions. #}
+{# We want to avoid that to improve reproduceability, so we add the cppstd version to the package ID. #}
+{# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
+user.package:cppstd_version=23
+tools.info.package_id:confs+=["user.package:cppstd_version"]
diff --git a/conan/profiles/sanitizers b/conan/profiles/sanitizers
index 083807ea9e..09e6aef02b 100644
--- a/conan/profiles/sanitizers
+++ b/conan/profiles/sanitizers
@@ -87,15 +87,15 @@ include(default)
 {% endif %}
 
 [conf]
-tools.build:defines+={{defines}}
-tools.build:cxxflags+={{sanitizer_compiler_flags}}
-tools.build:sharedlinkflags+={{sanitizer_linker_flags}}
-tools.build:exelinkflags+={{sanitizer_linker_flags}}
+tools.build:defines+={{ defines }}
+tools.build:cxxflags+={{ sanitizer_compiler_flags }}
+tools.build:sharedlinkflags+={{ sanitizer_linker_flags }}
+tools.build:exelinkflags+={{ sanitizer_linker_flags }}
 
 tools.info.package_id:confs+=["tools.build:cxxflags", "tools.build:exelinkflags", "tools.build:sharedlinkflags", "tools.build:defines"]
 
 # &: means "apply only to the consumer/root package"
-&:tools.cmake.cmaketoolchain:extra_variables={"SANITIZERS": "{{sanitizers}}", "SANITIZERS_COMPILER_FLAGS": "{{sanitizer_compiler_flags | join(' ')}}", "SANITIZERS_LINKER_FLAGS": "{{sanitizer_linker_flags | join(' ')}}"}
+&:tools.cmake.cmaketoolchain:extra_variables={"SANITIZERS": "{{ sanitizers }}", "SANITIZERS_COMPILER_FLAGS": "{{ sanitizer_compiler_flags | join(' ') }}", "SANITIZERS_LINKER_FLAGS": "{{ sanitizer_linker_flags | join(' ') }}"}
 
 [options]
 {% if enable_asan %}

From ba739c94ce184933e728295527131242317acb9b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 09:29:06 -0400
Subject: [PATCH 032/100] ci: [DEPENDABOT] bump actions/setup-python from 6.2.0
 to 6.3.0 (#7657)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/reusable-package.yml         | 2 +-
 .github/workflows/reusable-strategy-matrix.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reusable-package.yml b/.github/workflows/reusable-package.yml
index 249e807592..6feecbfb75 100644
--- a/.github/workflows/reusable-package.yml
+++ b/.github/workflows/reusable-package.yml
@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/reusable-strategy-matrix.yml b/.github/workflows/reusable-strategy-matrix.yml
index c1a1c1a78b..690aa3d423 100644
--- a/.github/workflows/reusable-strategy-matrix.yml
+++ b/.github/workflows/reusable-strategy-matrix.yml
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
 

From d1ff948244cb8b3027a74851466e8816f7940a90 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 1 Jul 2026 14:30:03 +0100
Subject: [PATCH 033/100] test: Add tests for TMProofPathResponse and
 TMReplayDeltaResponse invalid hash/key sizes (#7593)

---
 src/test/app/LedgerReplay_test.cpp | 62 ++++++++++++++++++++++++++++++
 src/test/basics/base_uint_test.cpp | 18 +++++++++
 2 files changed, 80 insertions(+)

diff --git a/src/test/app/LedgerReplay_test.cpp b/src/test/app/LedgerReplay_test.cpp
index ed99817f34..da98c03380 100644
--- a/src/test/app/LedgerReplay_test.cpp
+++ b/src/test/app/LedgerReplay_test.cpp
@@ -982,6 +982,46 @@ struct LedgerReplayer_test : public beast::unit_test::Suite
             BEAST_EXPECT(!reply->has_error());
             BEAST_EXPECT(server.msgHandler.processProofPathResponse(reply));
 
+            {
+                // bad reply: invalid hash/key sizes
+                {
+                    // reply with undersized ledgerhash (31 bytes)
+                    auto bad = std::make_shared<protocol::TMProofPathResponse>(*reply);
+                    bad->set_ledgerhash(std::string(31, '\x01'));
+                    BEAST_EXPECT(!server.msgHandler.processProofPathResponse(bad));
+                }
+                {
+                    // reply with oversized ledgerhash (33 bytes)
+                    auto bad = std::make_shared<protocol::TMProofPathResponse>(*reply);
+                    bad->set_ledgerhash(std::string(33, '\x01'));
+                    BEAST_EXPECT(!server.msgHandler.processProofPathResponse(bad));
+                }
+                {
+                    // reply with empty ledgerhash
+                    auto bad = std::make_shared<protocol::TMProofPathResponse>(*reply);
+                    bad->set_ledgerhash(std::string());
+                    BEAST_EXPECT(!server.msgHandler.processProofPathResponse(bad));
+                }
+                {
+                    // reply with undersized key (31 bytes)
+                    auto bad = std::make_shared<protocol::TMProofPathResponse>(*reply);
+                    bad->set_key(std::string(31, '\x01'));
+                    BEAST_EXPECT(!server.msgHandler.processProofPathResponse(bad));
+                }
+                {
+                    // reply with oversized key (33 bytes)
+                    auto bad = std::make_shared<protocol::TMProofPathResponse>(*reply);
+                    bad->set_key(std::string(33, '\x01'));
+                    BEAST_EXPECT(!server.msgHandler.processProofPathResponse(bad));
+                }
+                {
+                    // reply with empty key
+                    auto bad = std::make_shared<protocol::TMProofPathResponse>(*reply);
+                    bad->set_key(std::string());
+                    BEAST_EXPECT(!server.msgHandler.processProofPathResponse(bad));
+                }
+            }
+
             {
                 // bad reply
                 // bad header
@@ -1031,6 +1071,28 @@ struct LedgerReplayer_test : public beast::unit_test::Suite
             BEAST_EXPECT(!reply->has_error());
             BEAST_EXPECT(server.msgHandler.processReplayDeltaResponse(reply));
 
+            {
+                // bad reply: invalid hash sizes
+                {
+                    // reply with undersized ledgerhash (31 bytes)
+                    auto bad = std::make_shared<protocol::TMReplayDeltaResponse>(*reply);
+                    bad->set_ledgerhash(std::string(31, '\x01'));
+                    BEAST_EXPECT(!server.msgHandler.processReplayDeltaResponse(bad));
+                }
+                {
+                    // reply with oversized ledgerhash (33 bytes)
+                    auto bad = std::make_shared<protocol::TMReplayDeltaResponse>(*reply);
+                    bad->set_ledgerhash(std::string(33, '\x01'));
+                    BEAST_EXPECT(!server.msgHandler.processReplayDeltaResponse(bad));
+                }
+                {
+                    // reply with empty ledgerhash
+                    auto bad = std::make_shared<protocol::TMReplayDeltaResponse>(*reply);
+                    bad->set_ledgerhash(std::string());
+                    BEAST_EXPECT(!server.msgHandler.processReplayDeltaResponse(bad));
+                }
+            }
+
             {
                 // bad reply
                 // bad header
diff --git a/src/test/basics/base_uint_test.cpp b/src/test/basics/base_uint_test.cpp
index 5816b4eb59..c6572a0028 100644
--- a/src/test/basics/base_uint_test.cpp
+++ b/src/test/basics/base_uint_test.cpp
@@ -117,11 +117,29 @@ struct base_uint_test : beast::unit_test::Suite
         }
     }
 
+    void
+    testFromRawSizeMismatch()
+    {
+        testcase("base_uint: fromRaw size mismatch");
+
+        // Container larger than the base_uint (16 bytes vs 12 bytes for test96).
+        // Only the first 12 bytes are copied; the extra bytes are ignored.
+        {
+            Blob const tooBig{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
+            test96 const result = test96::fromRaw(tooBig);
+            BEAST_EXPECT(to_string(result) == "0102030405060708090A0B0C");
+        }
+    }
+
     void
     run() override
     {
         testcase("base_uint: general purpose tests");
 
+#ifdef NDEBUG
+        testFromRawSizeMismatch();
+#endif
+
         static_assert(!std::is_constructible_v<test96, std::complex<double>>);
         static_assert(!std::is_assignable_v<test96&, std::complex<double>>);
 

From 0d149ba5b621d7ae6210c8ed005c3109a4782413 Mon Sep 17 00:00:00 2001
From: Vito Tumas <5780819+Tapanito@users.noreply.github.com>
Date: Wed, 1 Jul 2026 17:04:38 +0200
Subject: [PATCH 034/100] fix: Disable AMM creation with Vault shares (#7666)

---
 include/xrpl/ledger/helpers/MPTokenHelpers.h |   9 +
 include/xrpl/ledger/helpers/TokenHelpers.h   |  32 +-
 src/libxrpl/ledger/helpers/TokenHelpers.cpp  |  61 +-
 src/libxrpl/tx/invariants/MPTInvariant.cpp   |  25 +-
 src/libxrpl/tx/transactors/dex/AMMCreate.cpp |  17 +
 src/test/app/AMMMPT_test.cpp                 | 176 +-----
 src/test/app/Invariants_test.cpp             | 217 ++-----
 src/test/app/Vault_test.cpp                  | 619 ++++++++++---------
 8 files changed, 495 insertions(+), 661 deletions(-)

diff --git a/include/xrpl/ledger/helpers/MPTokenHelpers.h b/include/xrpl/ledger/helpers/MPTokenHelpers.h
index c709badab8..b7f87337cf 100644
--- a/include/xrpl/ledger/helpers/MPTokenHelpers.h
+++ b/include/xrpl/ledger/helpers/MPTokenHelpers.h
@@ -23,6 +23,15 @@ namespace xrpl {
 [[nodiscard]] bool
 isGlobalFrozen(ReadView const& view, MPTIssue const& mptIssue);
 
+/** Returns true if @p account's MPToken for @p mptIssue carries the
+ *  individual-lock flag (lsfMPTLocked).
+ *
+ *  @warning This checks only the raw per-holder lock bit.  It does **not**
+ *  perform the transitive vault pseudo-account check: if @p mptIssue is a
+ *  vault share whose underlying asset is frozen, this function returns false.
+ *  Call @ref isFrozen instead when determining whether an account may send or
+ *  receive tokens — it combines isIndividualFrozen, isGlobalFrozen, and
+ *  isVaultPseudoAccountFrozen into a single complete check. */
 [[nodiscard]] bool
 isIndividualFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue);
 
diff --git a/include/xrpl/ledger/helpers/TokenHelpers.h b/include/xrpl/ledger/helpers/TokenHelpers.h
index 0c9871cd76..c8a67f776a 100644
--- a/include/xrpl/ledger/helpers/TokenHelpers.h
+++ b/include/xrpl/ledger/helpers/TokenHelpers.h
@@ -144,19 +144,18 @@ checkDeepFrozen(ReadView const& view, AccountID const& account, Asset const& ass
  *
  * Otherwise checks, in order:
  *   1. If the asset is globally frozen the remaining checks are redundant.
- *   2. For MPT shares: The pseudo-account's vault share must not be transitively frozen via its
- * underlying asset.
- *   3. The pseudo-account's trustline / MPToken must not be frozen for sending.
- *   4. Skipped when submitter == dst (self-withdrawal); a regular freeze should not prevent
- * recovering one's own funds.
- *   5. The destination must not be deep-frozen (cannot receive under any circumstance).
+ *   2. The pseudo-account's trustline / MPToken must not be individually frozen for sending.
+ *   3. The submitter's trustline / MPToken must not be individually frozen. Skipped when
+ * submitter == dst (self-withdrawal) so a regular freeze does not prevent recovering one's own
+ * funds. (Enforced as defensive code; no current caller exercises a frozen submitter ≠ dst.)
+ *   4. The destination must not be deep-frozen.
  *
- * For IOUs a regular individual freeze on the withdrawer does NOT block self-withdrawal; only deep
- * freeze does.  For MPTs "locked" is equivalent to deep-frozen, so locked MPT holders are always
+ * For IOUs a regular individual freeze on the submitter does NOT block self-withdrawal; only deep
+ * freeze does. For MPTs "locked" is equivalent to deep-frozen, so locked MPT holders are always
  * blocked.
  *
  * @param view          Ledger view to read freeze state from.
- * @param srcAcct       Pseudo-account the funds are withdrawn from (sender).
+ * @param pseudoAcct       Pseudo-account the funds are withdrawn from (sender).
  * @param submitterAcct Account that submitted the withdrawal transaction.
  * @param dstAcct       Account receiving the withdrawn funds.
  * @param asset         Asset being withdrawn.
@@ -166,7 +165,7 @@ checkDeepFrozen(ReadView const& view, AccountID const& account, Asset const& ass
 [[nodiscard]] TER
 checkWithdrawFreeze(
     ReadView const& view,
-    AccountID const& srcAcct,
+    AccountID const& pseudoAcct,
     AccountID const& submitterAcct,
     AccountID const& dstAcct,
     Asset const& asset);
@@ -175,20 +174,17 @@ checkWithdrawFreeze(
  * Checks freeze compliance for depositing an asset into a pseudo-account (e.g. Vault, AMM,
  * LoanBroker).
  *
- *
  * Checks, in order:
  *   1. If the asset is globally frozen the remaining checks are redundant.
- *   2. For MPT shares: the pseudo-account's vault share must not be transitively frozen via its
- * underlying asset (returns tecLOCKED).
- *   3. The depositor must not be individually frozen. Skipped when srcAcct is the asset issuer,
- * since the issuer can always send its own asset.
- *   4. The pseudo-account must not be individually frozen for the asset.  Unlike regular accounts,
+ *   2. The depositor must not be individually frozen for the asset. Skipped when srcAcct is the
+ * asset issuer, since the issuer can always send its own asset.
+ *   3. The pseudo-account must not be individually frozen for the asset.  Unlike regular accounts,
  * pseudo-accounts cannot receive deposits under a regular freeze because the deposited funds
  * could not later be withdrawn.
  *
  * @param view    Ledger view to read freeze state from.
  * @param srcAcct Depositor sending the funds.
- * @param dstAcct Pseudo-account receiving the deposit.
+ * @param pseudoAcct Pseudo-account receiving the deposit.
  * @param asset   Asset being deposited.
  * @return tesSUCCESS if the deposit is permitted, otherwise a freeze result
  *         (tecFROZEN for IOUs, tecLOCKED for MPTs).
@@ -197,7 +193,7 @@ checkWithdrawFreeze(
 checkDepositFreeze(
     ReadView const& view,
     AccountID const& srcAcct,
-    AccountID const& dstAcct,
+    AccountID const& pseudoAcct,
     Asset const& asset);
 
 //------------------------------------------------------------------------------
diff --git a/src/libxrpl/ledger/helpers/TokenHelpers.cpp b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
index 7988e24a56..0ab97a4b60 100644
--- a/src/libxrpl/ledger/helpers/TokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
@@ -160,19 +160,24 @@ checkDeepFrozen(ReadView const& view, AccountID const& account, Asset const& ass
 [[nodiscard]] TER
 checkWithdrawFreeze(
     ReadView const& view,
-    AccountID const& srcAcct,
+    AccountID const& pseudoAcct,
     AccountID const& submitterAcct,
     AccountID const& dstAcct,
     Asset const& asset)
 {
     XRPL_ASSERT(
-        isPseudoAccount(view, srcAcct), "xrpl::checkWithdrawFreeze : source is a pseudo-account");
+        isPseudoAccount(view, pseudoAcct),
+        "xrpl::checkWithdrawFreeze : source is a pseudo-account");
     XRPL_ASSERT(
         !isPseudoAccount(view, submitterAcct),
         "xrpl::checkWithdrawFreeze : submitter is not a pseudo-account");
     XRPL_ASSERT(
         !isPseudoAccount(view, dstAcct),
         "xrpl::checkWithdrawFreeze : destination is not a pseudo-account");
+    // The asset being withdrawn must not be issued by a pseudo-account
+    XRPL_ASSERT(
+        !isPseudoAccount(view, asset.getIssuer()),
+        "xrpl::checkWithdrawFreeze : asset issuer cannot be a pseudo-account");
 
     // Funds can always be sent to the issuer
     if (dstAcct == asset.getIssuer())
@@ -182,16 +187,9 @@ checkWithdrawFreeze(
     if (auto const ret = checkGlobalFrozen(view, asset); !isTesSuccess(ret))
         return ret;
 
-    // Special case for shares - check if the shares (and the transitive asset) is not frozen
-    if (asset.holds<MPTIssue>() &&
-        isVaultPseudoAccountFrozen(view, srcAcct, asset.get<MPTIssue>(), 0))
-    {
-        return tecLOCKED;
-    }
-
     // The transfer is from Submitter to Destination via Source (pseudo-account)
     // Both Source and Submitter must not be frozen to allow sending funds
-    if (auto const ret = checkIndividualFrozen(view, srcAcct, asset); !isTesSuccess(ret))
+    if (auto const ret = checkIndividualFrozen(view, pseudoAcct, asset); !isTesSuccess(ret))
         return ret;
 
     // Check submitter's individual freeze only when Submitter != Destination (a regular freeze
@@ -203,33 +201,42 @@ checkWithdrawFreeze(
     }
 
     // The destination account must not be deep frozen to receive the funds
-    return checkDeepFrozen(view, dstAcct, asset);
+    if (auto const ret = checkDeepFrozen(view, dstAcct, asset); !isTesSuccess(ret))
+        return ret;
+
+    if (asset.holds<MPTIssue>() &&
+        isVaultPseudoAccountFrozen(view, pseudoAcct, asset.get<MPTIssue>(), 0))
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::checkWithdrawFreeze : pseudo-account backed object holds shares");
+        return tecINTERNAL;
+        // LCOV_EXCL_STOP
+    }
+
+    return tesSUCCESS;
 }
 
 [[nodiscard]] TER
 checkDepositFreeze(
     ReadView const& view,
     AccountID const& srcAcct,
-    AccountID const& dstAcct,
+    AccountID const& pseudoAcct,
     Asset const& asset)
 {
     XRPL_ASSERT(
-        isPseudoAccount(view, dstAcct),
+        isPseudoAccount(view, pseudoAcct),
         "xrpl::checkDepositFreeze : destination is a pseudo-account");
     XRPL_ASSERT(
         !isPseudoAccount(view, srcAcct),
         "xrpl::checkDepositFreeze : source is not a pseudo-account");
+    // The asset being deposited must not be issued by a pseudo-account
+    XRPL_ASSERT(
+        !isPseudoAccount(view, asset.getIssuer()),
+        "xrpl::checkDepositFreeze : asset issuer cannot be a pseudo-account");
 
     if (auto const ret = checkGlobalFrozen(view, asset); !isTesSuccess(ret))
         return ret;
 
-    // Special case for shares - check if the shares and the transitive asset is not frozen
-    if (asset.holds<MPTIssue>() &&
-        isVaultPseudoAccountFrozen(view, dstAcct, asset.get<MPTIssue>(), 0))
-    {
-        return tecLOCKED;
-    }
-
     if (srcAcct != asset.getIssuer())
     {
         if (auto const ret = checkIndividualFrozen(view, srcAcct, asset); !isTesSuccess(ret))
@@ -238,7 +245,19 @@ checkDepositFreeze(
 
     // Unlike regular accounts, pseudo-accounts cannot receive deposits under a regular freeze
     // because those funds cannot be later withdrawn
-    return checkIndividualFrozen(view, dstAcct, asset);
+    if (auto const ret = checkIndividualFrozen(view, pseudoAcct, asset); !isTesSuccess(ret))
+        return ret;
+
+    if (asset.holds<MPTIssue>() &&
+        isVaultPseudoAccountFrozen(view, pseudoAcct, asset.get<MPTIssue>(), 0))
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::checkDepositFreeze : pseudo-account backed object holds shares");
+        return tecINTERNAL;
+        // LCOV_EXCL_STOP
+    }
+
+    return tesSUCCESS;
 }
 
 //------------------------------------------------------------------------------
diff --git a/src/libxrpl/tx/invariants/MPTInvariant.cpp b/src/libxrpl/tx/invariants/MPTInvariant.cpp
index 26bee4effb..d8f7fcc27d 100644
--- a/src/libxrpl/tx/invariants/MPTInvariant.cpp
+++ b/src/libxrpl/tx/invariants/MPTInvariant.cpp
@@ -6,7 +6,6 @@
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
@@ -837,8 +836,6 @@ ValidMPTTransfer::finalize(
     ReadView const& view,
     beast::Journal const& j)
 {
-    auto const fix330Enabled = view.rules().enabled(fixCleanup3_3_0);
-
     if (hasPrivilege(tx, OverrideFreeze))
         return true;
 
@@ -901,27 +898,9 @@ ValidMPTTransfer::finalize(
 
                 // Check once: if any involved account is frozen, the whole issuance transfer is
                 // considered frozen. Only need to check for frozen if there is a transfer of funds.
-                //
-                // Post-fix330: full isFrozen() applies — vault-share transitive freeze is part of
-                // the freeze semantics for all changed holders.
-                //
-                // Pre-fix330: legacy AMM withdraw only checked individual freeze on the
-                // destination, not the transitive vault freeze.  All other paths (and the AMM
-                // account itself as sender) did apply the full check.
-                MPTIssue const issue{mptID};
-                auto const legacyAccountFrozen = [&] {
-                    if (isGlobalFrozen(view, issue) || isIndividualFrozen(view, account, issue))
-                        return true;
-                    bool const isReceiver =
-                        !value.amtBefore.has_value() || *value.amtAfter > *value.amtBefore;
-                    if (txnType == ttAMM_WITHDRAW && isReceiver)
-                        return false;
-                    return isVaultPseudoAccountFrozen(view, account, issue, 0);
-                };
-                bool const accountFrozen =
-                    fix330Enabled ? isFrozen(view, account, issue) : legacyAccountFrozen();
                 if (!invalidTransfer &&
-                    (accountFrozen || !isAuthorized(view, mptID, account, reqAuth)))
+                    (isFrozen(view, account, MPTIssue{mptID}) ||
+                     !isAuthorized(view, mptID, account, reqAuth)))
                 {
                     invalidTransfer = true;
                 }
diff --git a/src/libxrpl/tx/transactors/dex/AMMCreate.cpp b/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
index ef271ba362..66d059c54d 100644
--- a/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
@@ -193,6 +193,23 @@ AMMCreate::preclaim(PreclaimContext const& ctx)
                 pseudoAccountAddress(ctx.view, keylet::amm(amount.asset(), amount2.asset()).key);
             accountId == beast::kZero)
             return terADDRESS_COLLISION;
+
+        auto const isMPTIssuerPseudo = [&](Asset const& asset) {
+            if (asset.native())
+                return false;
+
+            if (asset.holds<Issue>())
+                return false;
+
+            return isPseudoAccount(ctx.view, asset.getIssuer());
+        };
+
+        if (isMPTIssuerPseudo(amount.asset()) || isMPTIssuerPseudo(amount2.asset()))
+        {
+            JLOG(ctx.j.debug()) << "AMM Instance: can't create with vault shares " << amount << " "
+                                << amount2;
+            return tecWRONG_ASSET;
+        }
     }
 
     if (auto const ter = canMPTTradeAndTransfer(ctx.view, amount.asset(), accountID, accountID);
diff --git a/src/test/app/AMMMPT_test.cpp b/src/test/app/AMMMPT_test.cpp
index 9ff6c65c17..c68270591a 100644
--- a/src/test/app/AMMMPT_test.cpp
+++ b/src/test/app/AMMMPT_test.cpp
@@ -6892,168 +6892,38 @@ private:
     void
     testAMMWithVaultShares()
     {
-        testcase("AMM with vault shares — underlying freeze blocks share withdrawal");
+        testcase("AMM with vault shares not allowed");
         using namespace jtx;
+
         // AMMTestBase::testableAmendments() strips featureSingleAssetVault,
         // but vault shares require it. Use the global jtx set directly.
-        FeatureBitset const all{jtx::testableAmendments()};
+        Env env{*this, envconfig(), jtx::testableAmendments(), nullptr, beast::Severity::Disabled};
 
-        // When alice's underlying asset is individually frozen:
-        //
-        // Deposit (post-fixCleanup3_3_0): checkDepositFreeze checks the AMM
-        //   pseudo-account's underlying, not alice's — deposit is allowed.
-        //   Pre-fix: featureAMMClawback calls isFrozen(alice, share) which
-        //   descends via isVaultPseudoAccountFrozen(alice,...) and finds the
-        //   frozen underlying — deposit is blocked.
-        //
-        // Withdrawal (post-fixCleanup3_3_0): checkWithdrawFreeze ends with
-        //   checkDeepFrozen(alice, share) which calls isFrozen(alice, share)
-        //   and finds the frozen underlying — withdrawal is blocked.
-        //   Pre-fix: the old path only checks the AMM account's MPToken lock,
-        //   which is unset — withdrawal succeeds.
+        env.fund(XRP(100'000), gw_, alice_);
+        env(fset(gw_, asfDefaultRipple));
+        env.close();
 
-        auto runIOU = [&](FeatureBitset const& features) {
-            bool const fix330 = features[fixCleanup3_3_0];
-            Env env{*this, envconfig(), features, nullptr, beast::Severity::Disabled};
+        PrettyAsset const iou = gw_["IOU"];
+        env.trust(iou(1'000'000), alice_);
+        env(pay(gw_, alice_, iou(10'000)));
+        env.close();
 
-            env.fund(XRP(100'000), gw_, alice_);
-            env(fset(gw_, asfDefaultRipple));
-            env.close();
+        Vault const vault{env};
+        auto [createTx, vaultKeylet] = vault.create({.owner = alice_, .asset = iou});
+        env(createTx);
+        env.close();
 
-            PrettyAsset const iou = gw_["IOU"];
-            env.trust(iou(1'000'000), alice_);
-            env(pay(gw_, alice_, iou(10'000)));
-            env.close();
+        env(vault.deposit({.depositor = alice_, .id = vaultKeylet.key, .amount = iou(200)}));
+        env.close();
 
-            Vault const vault{env};
-            auto [createTx, vaultKeylet] = vault.create({.owner = alice_, .asset = iou});
-            env(createTx);
-            env.close();
+        auto const vaultSle = env.le(vaultKeylet);
+        if (!BEAST_EXPECT(vaultSle))
+            return;
 
-            // 200 IOU → 200,000,000 vault shares (IOU vault scale = 6)
-            env(vault.deposit({.depositor = alice_, .id = vaultKeylet.key, .amount = iou(200)}));
-            env.close();
-
-            auto const shareMPTID = env.le(vaultKeylet)->at(sfShareMPTID);
-            // Use half the shares for the AMM; alice keeps the other half.
-            STAmount const shareAmt{MPTIssue{shareMPTID}, 100'000'000};
-            // Pool: XRP(100) = 1e8 drops, shares = 1e8 → LP ≈ 1e8
-            AMM amm{env, alice_, XRP(100), shareAmt};
-            env.close();
-
-            // Freeze alice's IOU trustline (individual freeze on underlying).
-            env(trust(gw_, iou(0), alice_, tfSetFreeze));
-            env.close();
-
-            // post-fix330: checkDepositFreeze checks AMM pseudo's underlying
-            //              (not alice's) → deposit is allowed
-            // pre-fix330:  featureAMMClawback path calls isFrozen(alice, share)
-            //              which descends to alice's frozen IOU → tecLOCKED
-            amm.deposit(
-                {.account = alice_,
-                 .asset1In = XRP(1),
-                 .err = Ter(fix330 ? TER(tesSUCCESS) : TER(tecLOCKED))});
-
-            // post-fix330: checkWithdrawFreeze → checkDeepFrozen(alice, share)
-            //              descends to alice's frozen IOU → tecLOCKED
-            // pre-fix330:  the AMM pseudo-account is not authorized for the
-            //              share's underlying (requireAuth recurses share→IOU
-            //              and the AMM holds no IOU trustline), so
-            //              accountHolds(ZeroIfUnauthorized) reports the pool's
-            //              share balance as 0 and the withdrawal math fails →
-            //              tecAMM_FAILED.  Vault shares deposited into an AMM are
-            //              only withdrawable once fixCleanup3_3_0 exempts the
-            //              pseudo-account from the recursive auth check.
-            amm.withdraw(
-                {.account = alice_,
-                 .tokens = 1'000,
-                 .err = Ter(fix330 ? TER(tecLOCKED) : TER(tecAMM_FAILED))});
-
-            env(trust(gw_, iou(0), alice_, tfClearFreeze));
-            env.close();
-
-            // Lifting the freeze lets the deposit through in both cases.  The
-            // withdrawal only succeeds post-fix330; pre-fix330 the share balance
-            // remains inaccessible to the unauthorized pseudo-account, so the
-            // shares stay stuck → tecAMM_FAILED.
-            amm.deposit({.account = alice_, .asset1In = XRP(1)});
-            amm.withdraw(
-                {.account = alice_,
-                 .tokens = 1'000,
-                 .err = Ter(fix330 ? TER(tesSUCCESS) : TER(tecAMM_FAILED))});
-        };
-
-        runIOU(all);
-        runIOU(all - fixCleanup3_3_0);
-
-        auto runMPT = [&](FeatureBitset const& features) {
-            bool const fix330 = features[fixCleanup3_3_0];
-            // Expected freeze failures fire invariant checks that log at Error;
-            // silence them so the test output stays clean.
-            Env env{*this, envconfig(), features, nullptr, beast::Severity::Disabled};
-
-            env.fund(XRP(100'000), gw_, alice_);
-            env.close();
-
-            MPTTester mptt{env, gw_, kMptInitNoFund};
-            mptt.create({.flags = kMptDexFlags | tfMPTCanLock});
-            PrettyAsset const mpt = mptt.issuanceID();
-            mptt.authorize({.account = alice_});
-            env(pay(gw_, alice_, mpt(30'000)));
-            env.close();
-
-            Vault const vault{env};
-            auto [createTx, vaultKeylet] = vault.create({.owner = alice_, .asset = mpt});
-            env(createTx);
-            env.close();
-
-            // 20000 MPT → 20000 vault shares (MPT vault scale = 0)
-            env(vault.deposit({.depositor = alice_, .id = vaultKeylet.key, .amount = mpt(20'000)}));
-            env.close();
-
-            auto const shareMPTID = env.le(vaultKeylet)->at(sfShareMPTID);
-            // Use half the shares for the AMM; alice keeps the other half.
-            // Pool: XRP(100) = 1e8 drops, shares = 10000 → LP ≈ 1e6
-            STAmount const shareAmt{MPTIssue{shareMPTID}, 10'000};
-            AMM amm{env, alice_, XRP(100), shareAmt};
-            env.close();
-
-            // Lock alice's underlying MPT (individual lock).
-            mptt.set({.holder = alice_, .flags = tfMPTLock});
-
-            // Same pre/post-fix330 semantics as the IOU case above.
-            amm.deposit(
-                {.account = alice_,
-                 .asset1In = XRP(1),
-                 .err = Ter(fix330 ? TER(tesSUCCESS) : TER(tecLOCKED))});
-
-            // {.tokens = 1'000} → frac = 1000/1e6 = 0.001
-            // XRP out = 1e8 * 0.001 = 1e5 drops, shares out = 10000 * 0.001 = 10
-            // post-fix330: checkWithdrawFreeze sees alice's locked underlying
-            //              MPT via the share → tecLOCKED.
-            // pre-fix330:  the AMM pseudo-account is unauthorized for the
-            //              share's underlying MPT (it holds no underlying
-            //              MPToken), so accountHolds(ZeroIfUnauthorized) zeros
-            //              the pool's share balance and the math fails →
-            //              tecAMM_FAILED.
-            amm.withdraw(
-                {.account = alice_,
-                 .tokens = 1'000,
-                 .err = Ter(fix330 ? TER(tecLOCKED) : TER(tecAMM_FAILED))});
-
-            mptt.set({.holder = alice_, .flags = tfMPTUnlock});
-
-            // Unlocking lets the deposit through; the withdrawal only succeeds
-            // post-fix330 (pre-fix330 the shares remain stuck → tecAMM_FAILED).
-            amm.deposit({.account = alice_, .asset1In = XRP(1)});
-            amm.withdraw(
-                {.account = alice_,
-                 .tokens = 1'000,
-                 .err = Ter(fix330 ? TER(tesSUCCESS) : TER(tecAMM_FAILED))});
-        };
-
-        runMPT(all);
-        runMPT(all - fixCleanup3_3_0);
+        auto const shareMPTID = vaultSle->at(sfShareMPTID);
+        STAmount const shareAmt{MPTIssue{shareMPTID}, 100'000'000};
+        AMM const amm{env, alice_, XRP(100), shareAmt, Ter(tecWRONG_ASSET)};
+        env.close();
     }
 
     void
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 079ff9df88..79fdbb54ed 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -4,7 +4,6 @@
 #include <test/jtx/TestHelpers.h>
 #include <test/jtx/amount.h>
 #include <test/jtx/fee.h>
-#include <test/jtx/flags.h>
 #include <test/jtx/mpt.h>
 #include <test/jtx/pay.h>
 #include <test/jtx/permissioned_domains.h>
@@ -65,6 +64,7 @@
 #include <memory>
 #include <optional>
 #include <string>
+#include <tuple>
 #include <utility>
 #include <vector>
 
@@ -4606,15 +4606,17 @@ class Invariants_test : public beast::unit_test::Suite
             }
         }
 
-        // Vault-share transfer: ValidMPTTransfer gates isVaultPseudoAccountFrozen
-        // on fixCleanup3_3_0.  Pre-amendment, vault-share transfers are allowed
-        // even when the underlying asset is individually frozen for the sender;
-        // post-amendment they are blocked.
+        // Vault-share freeze invariant: isVaultPseudoAccountFrozen descends
+        // through sfReferenceHolding to test the vault's underlying asset for
+        // each changed holder.
         {
             Account const gw{"gw"};
             MPTID shareID{};
 
-            auto const preclose = [&](Account const& a1, Account const& a2, Env& env) -> bool {
+            // Vault setup: a1 and a2 both deposit IOU and hold vault shares.
+            auto const setupVault = [&](Account const& a1,
+                                        Account const& a2,
+                                        Env& env) -> std::tuple<MPTID, AccountID> {
                 env.fund(XRP(1'000), gw);
                 env.trust(gw["IOU"](10'000), a1);
                 env.trust(gw["IOU"](10'000), a2);
@@ -4623,25 +4625,17 @@ class Invariants_test : public beast::unit_test::Suite
                 env(pay(gw, a2, gw["IOU"](500)));
                 env.close();
 
-                PrettyAsset const iou = gw["IOU"];
                 Vault const vault{env};
-                auto [createTx, vaultKeylet] = vault.create({.owner = a1, .asset = iou});
+                auto [createTx, vaultKeylet] = vault.create({.owner = a1, .asset = gw["IOU"]});
                 env(createTx);
                 env.close();
-                // Both a1 and a2 deposit IOU, each receiving vault shares.
-                env(vault.deposit({.depositor = a1, .id = vaultKeylet.key, .amount = iou(100)}));
-                env(vault.deposit({.depositor = a2, .id = vaultKeylet.key, .amount = iou(100)}));
+                env(vault.deposit(
+                    {.depositor = a1, .id = vaultKeylet.key, .amount = gw["IOU"](100)}));
+                env(vault.deposit(
+                    {.depositor = a2, .id = vaultKeylet.key, .amount = gw["IOU"](100)}));
                 env.close();
 
-                shareID = env.le(vaultKeylet)->at(sfShareMPTID);
-
-                // Freeze a2's IOU trustline from the issuer side.
-                // a2 is the receiver in the simulated AMM withdraw; the
-                // distinction under test is that pre-fix330 the invariant
-                // does not apply the transitive vault freeze to receivers.
-                env(trust(gw, gw["IOU"](0), a2, tfSetFreeze));
-                env.close();
-                return true;
+                return {env.le(vaultKeylet)->at(sfShareMPTID), env.le(vaultKeylet)->at(sfAccount)};
             };
 
             // Simulate a vault-share transfer: a1 sends 10 shares to a2.
@@ -4658,156 +4652,45 @@ class Invariants_test : public beast::unit_test::Suite
                 return true;
             };
 
-            // post-fixCleanup3_3_0: full isFrozen() applies to all holders;
-            // isVaultPseudoAccountFrozen finds a2's underlying IOU frozen →
-            // invalidTransfer → invariant fires.
-            doInvariantCheck(
-                Env{*this, defaultAmendments()},
-                {{"invalid MPToken transfer between holders"}},
-                precheck,
-                XRPAmount{},
-                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
-                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
-                preclose);
+            // Case: vault pseudo-account's IOU trustline is frozen.
+            {
+                auto const preclose = [&](Account const& a1, Account const& a2, Env& env) -> bool {
+                    auto [sid, vid] = setupVault(a1, a2, env);
+                    shareID = sid;
+                    env(trust(gw, gw["IOU"](0), Account{"vaultPseudo", vid}, tfSetFreeze));
+                    env.close();
+                    return true;
+                };
 
-            // pre-fixCleanup3_3_0: legacy AMM withdraw only checked
-            // checkIndividualFrozen on the destination, not the transitive
-            // vault freeze; a2 as receiver is exempt → invariant passes.
-            doInvariantCheck(
-                Env{*this, defaultAmendments() - fixCleanup3_3_0},
-                {},
-                precheck,
-                XRPAmount{},
-                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
-                {tesSUCCESS, tesSUCCESS},
-                preclose);
-        }
+                doInvariantCheck(
+                    Env{*this, defaultAmendments()},
+                    {{"invalid MPToken transfer between holders"}},
+                    precheck,
+                    XRPAmount{},
+                    STTx{ttPAYMENT, [](STObject&) {}},
+                    {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                    preclose);
+            }
 
-        // Side-specific vault-share AMM_WITHDRAW invariant tests.
-        // Both cases use a real vault (IOU underlying) and a real AMM whose
-        // pool includes vault shares.  precheck simulates an AMM_WITHDRAW by
-        // transferring 10 vault shares from the AMM pseudo-account to a2.
-        {
-            MPTID shareID{};
-            AccountID ammAcctID{};
-            AccountID vaultPseudoID{};
-            Account const gw{"gw"};
+            // Case: receiver's (a2's) IOU trustline is frozen.
+            {
+                auto const preclose = [&](Account const& a1, Account const& a2, Env& env) -> bool {
+                    auto [sid, vid] = setupVault(a1, a2, env);
+                    shareID = sid;
+                    env(trust(gw, gw["IOU"](0), a2, tfSetFreeze));
+                    env.close();
+                    return true;
+                };
 
-            // Simulate AMM_WITHDRAW: AMM pseudo-account sends 10 vault shares
-            // to a2.  The AMM pseudo is the sender (decreasing balance);
-            // a2 is the receiver (increasing balance).
-            auto const precheck2 =
-                [&](Account const& /*a1*/, Account const& a2, ApplyContext& ac) -> bool {
-                auto sleAMM = ac.view().peek(keylet::mptoken(shareID, ammAcctID));
-                auto sle2 = ac.view().peek(keylet::mptoken(shareID, a2.id()));
-                if (!sleAMM || !sle2)
-                    return false;
-                (*sleAMM)[sfMPTAmount] -= 10;
-                (*sle2)[sfMPTAmount] += 10;
-                ac.view().update(sleAMM);
-                ac.view().update(sle2);
-                return true;
-            };
-
-            // Shared vault + AMM setup: a1 deposits 500 IOU into a vault and
-            // creates an AMM with XRP + 100 vault shares, giving the AMM
-            // pseudo-account a vault-share MPToken balance.
-            auto const setupVaultAMM = [&](Account const& a1, Account const& a2, Env& env) -> bool {
-                env.fund(XRP(1'000), gw);
-                env(fset(gw, asfDefaultRipple));
-                env.close();
-
-                env.trust(gw["IOU"](10'000), a1);
-                env.trust(gw["IOU"](10'000), a2);
-                env.close();
-                env(pay(gw, a1, gw["IOU"](1'000)));
-                env(pay(gw, a2, gw["IOU"](500)));
-                env.close();
-
-                Vault const vault{env};
-                auto [createTx, vaultKeylet] = vault.create({.owner = a1, .asset = gw["IOU"]});
-                env(createTx);
-                env.close();
-
-                env(vault.deposit(
-                    {.depositor = a1, .id = vaultKeylet.key, .amount = gw["IOU"](500)}));
-                env(vault.deposit(
-                    {.depositor = a2, .id = vaultKeylet.key, .amount = gw["IOU"](200)}));
-                env.close();
-
-                shareID = env.le(vaultKeylet)->at(sfShareMPTID);
-                vaultPseudoID = env.le(vaultKeylet)->at(sfAccount);
-
-                // a1 creates AMM with XRP + 100 vault shares; the AMM
-                // pseudo-account receives an MPToken record for shareID.
-                AMM const amm(env, a1, XRP(100), STAmount{MPTIssue{shareID}, 100});
-                ammAcctID = amm.ammAccount();
-                return true;
-            };
-
-            // Case 1: freeze the vault pseudo-account's IOU trustline.
-            // isVaultPseudoAccountFrozen(ammAcct) calls isAnyFrozen({vaultPseudo,
-            // ammAcct}, IOU); since vaultPseudo is frozen it returns true.  The
-            // AMM sender has a decreasing balance (not a receiver) so it is
-            // never exempt from the check — invariant fires both pre- and
-            // post-fixCleanup3_3_0.
-            auto const preclose3 = [&](Account const& a1, Account const& a2, Env& env) -> bool {
-                if (!setupVaultAMM(a1, a2, env))
-                    return false;
-                env(trust(gw, gw["IOU"](0), Account{"vaultPseudo", vaultPseudoID}, tfSetFreeze));
-                env.close();
-                return true;
-            };
-
-            doInvariantCheck(
-                Env{*this, defaultAmendments()},
-                {{"invalid MPToken transfer between holders"}},
-                precheck2,
-                XRPAmount{},
-                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
-                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
-                preclose3);
-
-            doInvariantCheck(
-                Env{*this, defaultAmendments() - fixCleanup3_3_0},
-                {{"invalid MPToken transfer between holders"}},
-                precheck2,
-                XRPAmount{},
-                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
-                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
-                preclose3);
-
-            // Case 2: freeze a2's (receiver's) IOU trustline.
-            // isVaultPseudoAccountFrozen(a2) → isAnyFrozen({vaultPseudo, a2},
-            // IOU) → true.  The AMM sender's check passes (vaultPseudo and
-            // ammAcct are not frozen).  Pre-fix330: receiver is exempt from
-            // isVaultPseudoAccountFrozen in ttAMM_WITHDRAW → passes.
-            // Post-fix330: full isFrozen() applied to a2 → fires.
-            auto const preclose4 = [&](Account const& a1, Account const& a2, Env& env) -> bool {
-                if (!setupVaultAMM(a1, a2, env))
-                    return false;
-                env(trust(gw, gw["IOU"](0), a2, tfSetFreeze));
-                env.close();
-                return true;
-            };
-
-            doInvariantCheck(
-                Env{*this, defaultAmendments()},
-                {{"invalid MPToken transfer between holders"}},
-                precheck2,
-                XRPAmount{},
-                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
-                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
-                preclose4);
-
-            doInvariantCheck(
-                Env{*this, defaultAmendments() - fixCleanup3_3_0},
-                {},
-                precheck2,
-                XRPAmount{},
-                STTx{ttAMM_WITHDRAW, [](STObject&) {}},
-                {tesSUCCESS, tesSUCCESS},
-                preclose4);
+                doInvariantCheck(
+                    Env{*this, defaultAmendments()},
+                    {{"invalid MPToken transfer between holders"}},
+                    precheck,
+                    XRPAmount{},
+                    STTx{ttPAYMENT, [](STObject&) {}},
+                    {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                    preclose);
+            }
         }
     }
 
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index d9afd93b23..f6574872f9 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -1634,8 +1634,6 @@ class Vault_test : public beast::unit_test::Suite
             env(tx, Ter(tecNO_ENTRY));
         });
 
-        // Freeze/lock tests are in testVaultDepositFreeze/testVaultWithdrawFreeze
-
         testCase([this](
                      Env& env,
                      Account const& issuer,
@@ -2238,11 +2236,6 @@ class Vault_test : public beast::unit_test::Suite
             env(offer(alice, XRP(1), shares(1)), Ter{tecNO_PERMISSION});
             env.close();
 
-            // The inherited CanTrade restriction also blocks AMM creation.
-            AMM const ammUnderlyingFail(
-                env, alice, XRP(1'000), asset(1'000), Ter{tecNO_PERMISSION});
-            AMM const ammShares(env, alice, XRP(1'000), shares(100), Ter{tecNO_PERMISSION});
-
             // Deposit still works before enabling CanTrade.
             env(vault.deposit({.depositor = alice, .id = keylet.key, .amount = asset(100)}));
             env.close();
@@ -7580,185 +7573,212 @@ class Vault_test : public beast::unit_test::Suite
     }
 
     void
-    testVaultDepositFreeze()
+    testVaultDepositFreezeIOU()
     {
         using namespace test::jtx;
+        testcase("VaultDeposit IOU freeze checks");
 
         Account const issuer{"issuer"};
         Account const owner{"owner"};
+        Env env{*this};
+        Vault vault{env};
 
-        // === IOU ===
-        {
-            testcase("VaultDeposit IOU freeze checks");
-            Env env{*this};
-            Vault vault{env};
+        env.fund(XRP(100'000), issuer, owner);
+        env(fset(issuer, asfAllowTrustLineClawback));
+        env.close();
+        PrettyAsset const asset = issuer["IOU"];
+        env.trust(asset(1'000'000), owner);
+        env(pay(issuer, owner, asset(100'000)));
+        env.close();
 
-            env.fund(XRP(100'000), issuer, owner);
-            env(fset(issuer, asfAllowTrustLineClawback));
-            env.close();
-            PrettyAsset const asset = issuer["IOU"];
-            env.trust(asset(1'000'000), owner);
-            env(pay(issuer, owner, asset(100'000)));
-            env.close();
+        auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
+        env(tx);
+        env.close();
+        auto const vaultAcct = Account("vault", env.le(keylet)->at(sfAccount));
 
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-            auto const vaultAcct = Account("vault", env.le(keylet)->at(sfAccount));
+        // Initial deposit so the vault pseudo-account has a trustline
+        env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
+        env.close();
 
-            // Initial deposit so the vault pseudo-account has a trustline
-            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
-            env.close();
+        auto runTests = [&]() {
+            auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
 
-            auto runTests = [&]() {
-                auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
-
-                // Global freeze
+            // Global freeze
+            {
+                testcase("VaultDeposit IOU global freeze");
                 env(fset(issuer, asfGlobalFreeze));
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
                     Ter(tecFROZEN));
                 env(fclear(issuer, asfGlobalFreeze));
+            }
 
-                // Depositor regular freeze
+            // Depositor freeze
+            {
+                testcase("VaultDeposit IOU depositor freeze");
                 env(trust(issuer, asset(0), owner, tfSetFreeze));
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
                     Ter(tecFROZEN));
                 env(trust(issuer, asset(0), owner, tfClearFreeze));
+            }
 
-                // Depositor deep freeze
+            // Depositor deep freeze
+            {
+                testcase("VaultDeposit IOU depositor deep freeze");
                 env(trust(issuer, asset(0), owner, tfSetFreeze | tfSetDeepFreeze));
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
                     Ter(tecFROZEN));
                 env(trust(issuer, asset(0), owner, tfClearFreeze | tfClearDeepFreeze));
+            }
 
-                // Vault-account regular freeze
-                // Post-fix: checkDepositFreeze catches it → tecFROZEN
-                // Pre-fix: not checked directly, but the transitive share
-                //          check triggers → tecLOCKED
-                {
-                    auto trustSet = [&]() {
-                        json::Value jv;
-                        jv[jss::Account] = issuer.human();
-                        {
-                            auto& ja = jv[jss::LimitAmount] =
-                                asset(0).value().getJson(JsonOptions::Values::None);
-                            ja[jss::issuer] = toBase58(vaultAcct.id());
-                        }
-                        jv[jss::TransactionType] = jss::TrustSet;
-                        return jv;
-                    }();
+            // Vault-account freeze
+            // Post-fix: checkDepositFreeze catches it → tecFROZEN
+            // Pre-fix: not checked directly, but the transitive share
+            //          check triggers → tecLOCKED
+            {
+                testcase("VaultDeposit IOU pseudo-account freeze");
+                auto trustSet = [&]() {
+                    json::Value jv;
+                    jv[jss::Account] = issuer.human();
+                    {
+                        auto& ja = jv[jss::LimitAmount] =
+                            asset(0).value().getJson(JsonOptions::Values::None);
+                        ja[jss::issuer] = toBase58(vaultAcct.id());
+                    }
+                    jv[jss::TransactionType] = jss::TrustSet;
+                    return jv;
+                }();
 
-                    trustSet[jss::Flags] = tfSetFreeze;
-                    env(trustSet);
-                    env.close();
+                trustSet[jss::Flags] = tfSetFreeze;
+                env(trustSet);
+                env.close();
 
-                    TER const expected = fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED);
-                    env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
-                        Ter(expected));
+                TER const expected = fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED);
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(expected));
 
-                    trustSet[jss::Flags] = tfClearFreeze;
-                    env(trustSet);
-                    env.close();
-                }
+                trustSet[jss::Flags] = tfClearFreeze;
+                env(trustSet);
+                env.close();
+            }
 
-                // Vault-account deep freeze
-                {
-                    auto trustSet = [&]() {
-                        json::Value jv;
-                        jv[jss::Account] = issuer.human();
-                        {
-                            auto& ja = jv[jss::LimitAmount] =
-                                asset(0).value().getJson(JsonOptions::Values::None);
-                            ja[jss::issuer] = toBase58(vaultAcct.id());
-                        }
-                        jv[jss::TransactionType] = jss::TrustSet;
-                        return jv;
-                    }();
+            // Vault-account deep freeze
+            {
+                testcase("VaultDeposit IOU pseudo-account deep freeze");
+                auto trustSet = [&]() {
+                    json::Value jv;
+                    jv[jss::Account] = issuer.human();
+                    {
+                        auto& ja = jv[jss::LimitAmount] =
+                            asset(0).value().getJson(JsonOptions::Values::None);
+                        ja[jss::issuer] = toBase58(vaultAcct.id());
+                    }
+                    jv[jss::TransactionType] = jss::TrustSet;
+                    return jv;
+                }();
 
-                    trustSet[jss::Flags] = tfSetFreeze | tfSetDeepFreeze;
-                    env(trustSet);
-                    env.close();
+                trustSet[jss::Flags] = tfSetFreeze | tfSetDeepFreeze;
+                env(trustSet);
+                env.close();
 
-                    env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
-                        Ter(fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED)));
+                env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED)));
 
-                    trustSet[jss::Flags] = tfClearFreeze | tfClearDeepFreeze;
-                    env(trustSet);
-                    env.close();
-                }
+                trustSet[jss::Flags] = tfClearFreeze | tfClearDeepFreeze;
+                env(trustSet);
+                env.close();
+            }
 
-                // Clawback works while frozen
+            // Clawback works while frozen
+            {
+                testcase("VaultDeposit IOU freeze clawback unaffected");
                 env(fset(issuer, asfGlobalFreeze));
                 env(vault.clawback(
                     {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = asset(1)}));
                 env(fclear(issuer, asfGlobalFreeze));
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
                 env.close();
-            };
+            }
+        };
 
-            runTests();
-            env.disableFeature(fixCleanup3_3_0);
-            runTests();
-            env.enableFeature(fixCleanup3_3_0);
-        }
+        runTests();
+        env.disableFeature(fixCleanup3_3_0);
+        runTests();
+        env.enableFeature(fixCleanup3_3_0);
+    }
 
-        // === MPT ===
-        {
-            testcase("VaultDeposit MPT lock checks");
-            Env env{*this};
-            Vault vault{env};
+    void
+    testVaultDepositFreezeMPT()
+    {
+        using namespace test::jtx;
+        testcase("VaultDeposit MPT lock checks");
 
-            env.fund(XRP(100'000), issuer, owner);
-            env.close();
+        Account const issuer{"issuer"};
+        Account const owner{"owner"};
+        Env env{*this};
+        Vault vault{env};
 
-            MPTTester mptt{env, issuer, kMptInitNoFund};
-            mptt.create(
-                {.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth});
-            PrettyAsset const mpt{mptt.issuanceID()};
+        env.fund(XRP(100'000), issuer, owner);
+        env.close();
 
-            mptt.authorize({.account = owner});
-            mptt.authorize({.account = issuer, .holder = owner});
-            env.close();
-            env(pay(issuer, owner, mpt(100'000)));
-            env.close();
+        MPTTester mptt{env, issuer, kMptInitNoFund};
+        mptt.create(
+            {.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth});
+        PrettyAsset const mpt{mptt.issuanceID()};
 
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = mpt});
-            env(tx);
-            env.close();
-            auto const vaultAcctID = env.le(keylet)->at(sfAccount);
-            Account const vaultAcct("vault", vaultAcctID);
+        mptt.authorize({.account = owner});
+        mptt.authorize({.account = issuer, .holder = owner});
+        env.close();
+        env(pay(issuer, owner, mpt(100'000)));
+        env.close();
 
-            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(100)}));
-            env.close();
+        auto [tx, keylet] = vault.create({.owner = owner, .asset = mpt});
+        env(tx);
+        env.close();
+        auto const vaultAcctID = env.le(keylet)->at(sfAccount);
+        Account const vaultAcct("vault", vaultAcctID);
 
-            // For MPT isDeepFrozen == isFrozen, so all locks block in
-            // both pre- and post-fix.
-            auto runTests = [&]() {
-                // Global lock
+        env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(100)}));
+        env.close();
+
+        // For MPT isDeepFrozen == isFrozen, so all locks block in
+        // both pre- and post-fix.
+        auto runTests = [&]() {
+            // Global lock
+            {
+                testcase("VaultDeposit MPT global lock");
                 mptt.set({.flags = tfMPTLock});
                 env.close();
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
                     Ter(tecLOCKED));
                 mptt.set({.flags = tfMPTUnlock});
                 env.close();
+            }
 
-                // Depositor individual lock
+            // Depositor individual lock
+            {
+                testcase("VaultDeposit MPT depositor lock");
                 mptt.set({.holder = owner, .flags = tfMPTLock});
                 env.close();
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
                     Ter(tecLOCKED));
                 mptt.set({.holder = owner, .flags = tfMPTUnlock});
                 env.close();
+            }
 
-                // Vault pseudo-account individual lock
+            // Vault pseudo-account individual lock
+            {
+                testcase("VaultDeposit MPT pseudo-account lock");
                 mptt.set({.holder = vaultAcct, .flags = tfMPTLock});
                 env.close();
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
                     Ter(tecLOCKED));
                 mptt.set({.holder = vaultAcct, .flags = tfMPTUnlock});
                 env.close();
+            }
 
-                // Clawback works while locked
+            // Clawback works while locked
+            {
+                testcase("VaultDeposit MPT lock clawback unaffected");
                 mptt.set({.flags = tfMPTLock});
                 env.close();
                 env(vault.clawback(
@@ -7767,16 +7787,16 @@ class Vault_test : public beast::unit_test::Suite
                 env.close();
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
                 env.close();
-            };
+            }
+        };
 
-            runTests();
-            env.disableFeature(fixCleanup3_3_0);
-            runTests();
-            env.enableFeature(fixCleanup3_3_0);
-        }
+        runTests();
+        env.disableFeature(fixCleanup3_3_0);
+        runTests();
+        env.enableFeature(fixCleanup3_3_0);
     }
 
-    // Focused demonstration: a depositor under a regular individual IOU freeze
+    // Focused demonstration: a depositor under an individual IOU freeze
     // can still withdraw to themselves (self-withdrawal), but is blocked from
     // withdrawing to a third party.
     //
@@ -7818,7 +7838,7 @@ class Vault_test : public beast::unit_test::Suite
         auto runTests = [&]() {
             auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
 
-            // Set a regular individual freeze on the owner's IOU trustline.
+            // Set an individual freeze on the owner's IOU trustline.
             env(trust(issuer, asset(0), owner, tfSetFreeze));
             env.close();
 
@@ -7850,110 +7870,111 @@ class Vault_test : public beast::unit_test::Suite
     }
 
     void
-    testVaultWithdrawFreeze()
+    testVaultWithdrawFreezeIOU()
     {
         using namespace test::jtx;
+        testcase("VaultWithdraw IOU freeze checks");
 
         Account const issuer{"issuer"};
         Account const owner{"owner"};
+        Env env{*this};
+        Vault const vault{env};
 
-        // === IOU ===
-        {
-            testcase("VaultWithdraw IOU freeze checks");
-            Env env{*this};
-            Vault vault{env};
+        env.fund(XRP(100'000), issuer, owner);
+        env(fset(issuer, asfAllowTrustLineClawback));
+        env.close();
+        PrettyAsset const asset = issuer["IOU"];
+        env.trust(asset(1'000'000), owner);
+        env(pay(issuer, owner, asset(100'000)));
+        env.close();
 
-            env.fund(XRP(100'000), issuer, owner);
-            env(fset(issuer, asfAllowTrustLineClawback));
-            env.close();
-            PrettyAsset const asset = issuer["IOU"];
-            env.trust(asset(1'000'000), owner);
-            env(pay(issuer, owner, asset(100'000)));
-            env.close();
+        auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
+        env(tx);
+        env.close();
+        auto const vaultAcct = Account("vault", env.le(keylet)->at(sfAccount));
 
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = asset});
-            env(tx);
-            env.close();
-            auto const vaultAcct = Account("vault", env.le(keylet)->at(sfAccount));
+        env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
+        env.close();
 
-            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(100)}));
-            env.close();
+        Account const charlie{"charlie"};
+        env.fund(XRP(10'000), charlie);
+        env.trust(asset(1'000'000), charlie);
+        env.close();
 
-            Account const charlie{"charlie"};
-            env.fund(XRP(10'000), charlie);
-            env.trust(asset(1'000'000), charlie);
-            env.close();
-
-            auto runTests = [&]() {
-                auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
-                // Post-fix: submitter freeze blocks withdraw to 3rd party
-                // Pre-fix: submitter's IOU freeze not checked, but
-                //          checkFrozen(depositor, share) may trigger tecLOCKED
-                TER const submitterTo3rd = fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED);
-
-                // Global freeze → self-withdraw
+        auto runTests = [&]() {
+            auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+            // Global freeze → self-withdraw
+            {
+                testcase("VaultWithdraw IOU global freeze");
                 env(fset(issuer, asfGlobalFreeze));
                 env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
                     Ter(tecFROZEN));
                 // Global freeze → withdraw to 3rd party
-                {
-                    auto withdrawToCharlie =
-                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
-                    withdrawToCharlie[sfDestination] = charlie.human();
-                    env(withdrawToCharlie, Ter(tecFROZEN));
-                }
+
+                auto withdrawToCharlie =
+                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                withdrawToCharlie[sfDestination] = charlie.human();
+                env(withdrawToCharlie, Ter(tecFROZEN));
+
                 env(fclear(issuer, asfGlobalFreeze));
+            }
 
-                // Vault-account regular freeze
-                {
-                    auto trustSet = [&]() {
-                        json::Value jv;
-                        jv[jss::Account] = issuer.human();
-                        {
-                            auto& ja = jv[jss::LimitAmount] =
-                                asset(0).value().getJson(JsonOptions::Values::None);
-                            ja[jss::issuer] = toBase58(vaultAcct.id());
-                        }
-                        jv[jss::TransactionType] = jss::TrustSet;
-                        return jv;
-                    }();
-
-                    trustSet[jss::Flags] = tfSetFreeze;
-                    env(trustSet);
-                    env.close();
-
-                    TER const vaultAcctFreeze = fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED);
-
-                    // Self-withdraw
-                    env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
-                        Ter(vaultAcctFreeze));
-                    // Withdraw to 3rd party
+            // Vault-account freeze
+            {
+                testcase("VaultWithdraw IOU pseudo-account freeze");
+                auto trustSet = [&]() {
+                    json::Value jv;
+                    jv[jss::Account] = issuer.human();
                     {
-                        auto withdrawToCharlie = vault.withdraw(
-                            {.depositor = owner, .id = keylet.key, .amount = asset(1)});
-                        withdrawToCharlie[sfDestination] = charlie.human();
-                        env(withdrawToCharlie, Ter(vaultAcctFreeze));
+                        auto& ja = jv[jss::LimitAmount] =
+                            asset(0).value().getJson(JsonOptions::Values::None);
+                        ja[jss::issuer] = toBase58(vaultAcct.id());
                     }
+                    jv[jss::TransactionType] = jss::TrustSet;
+                    return jv;
+                }();
 
-                    trustSet[jss::Flags] = tfClearFreeze;
-                    env(trustSet);
-                    env.close();
-                }
+                trustSet[jss::Flags] = tfSetFreeze;
+                env(trustSet);
+                env.close();
 
-                // Depositor regular freeze → self-withdraw
+                TER const terExpected = fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED);
+
+                // Self-withdraw
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(terExpected));
+                // Withdraw to 3rd party
+
+                auto withdrawToCharlie =
+                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                withdrawToCharlie[sfDestination] = charlie.human();
+                env(withdrawToCharlie, Ter(terExpected));
+
+                trustSet[jss::Flags] = tfClearFreeze;
+                env(trustSet);
+                env.close();
+            }
+
+            // Depositor freeze, self-withdraw
+            {
+                testcase("VaultWithdraw IOU self-withdraw freeze check");
                 env(trust(issuer, asset(0), owner, tfSetFreeze));
+
                 // Post-fix: self-withdraw allowed (submitter==dst skip)
                 // Pre-fix: isFrozen(depositor, iou) catches it
                 env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
                     Ter(fix330Enabled ? TER(tesSUCCESS) : TER(tecFROZEN)));
 
-                // Depositor regular freeze → withdraw to 3rd party
-                {
-                    auto withdrawTo3rd =
-                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
-                    withdrawTo3rd[sfDestination] = charlie.human();
-                    env(withdrawTo3rd, Ter(submitterTo3rd));
-                }
+                // Depositor freeze withdraw to 3rd party
+                auto withdrawTo3rd =
+                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                withdrawTo3rd[sfDestination] = charlie.human();
+
+                // Post-fix: submitter freeze blocks withdraw to 3rd party
+                // Pre-fix: submitter's IOU freeze not checked, but checkFrozen(depositor,
+                // share) triggers tecLOCKED
+                env(withdrawTo3rd, Ter(fix330Enabled ? TER(tecFROZEN) : TER(tecLOCKED)));
+
                 env(trust(issuer, asset(0), owner, tfClearFreeze));
                 // Replenish what was withdrawn
                 if (fix330Enabled)
@@ -7961,104 +7982,131 @@ class Vault_test : public beast::unit_test::Suite
                     env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
                 }
                 env.close();
+            }
 
-                // Depositor deep freeze → self-withdraw blocked
+            // Depositor deep freeze → self-withdraw blocked
+            {
+                testcase("VaultWithdraw IOU depositor deep freeze");
                 env(trust(issuer, asset(0), owner, tfSetFreeze | tfSetDeepFreeze));
-                // TODO: branches are identical - confirm the intended pre/post-fix330
-                // expectations and replace with the correct values (one branch may be wrong).
-                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
-                    // NOLINTNEXTLINE(bugprone-branch-clone)
-                    Ter(fix330Enabled ? TER(tecFROZEN) : TER(tecFROZEN)));
-                env(trust(issuer, asset(0), owner, tfClearFreeze | tfClearDeepFreeze));
 
-                // Destination regular freeze → withdraw to 3rd party
+                env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}),
+                    Ter(tecFROZEN));
+
+                env(trust(issuer, asset(0), owner, tfClearFreeze | tfClearDeepFreeze));
+            }
+
+            // Destination freeze → withdraw to 3rd party
+            {
+                testcase("VaultWithdraw IOU freeze withdraw to 3rd party");
+
                 env(trust(issuer, asset(0), charlie, tfSetFreeze));
+
                 // Self-withdraw unaffected by charlie's freeze
                 env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
-                {
-                    auto withdrawToCharlie =
-                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
-                    withdrawToCharlie[sfDestination] = charlie.human();
-                    // Post-fix: regular freeze on dst allowed
-                    // Pre-fix: checkFrozen(dst, iou) catches it
-                    env(withdrawToCharlie, Ter(fix330Enabled ? TER(tesSUCCESS) : TER(tecFROZEN)));
-                }
+
+                auto withdrawToCharlie =
+                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                withdrawToCharlie[sfDestination] = charlie.human();
+
+                // Post-fix: freeze on dst allowed
+                // Pre-fix: checkFrozen(dst, iou) catches it
+                env(withdrawToCharlie, Ter(fix330Enabled ? TER(tesSUCCESS) : TER(tecFROZEN)));
+
                 env(trust(issuer, asset(0), charlie, tfClearFreeze));
+
                 // Replenish: 1 for self-withdraw + 1 if charlie withdraw succeeded
                 env(vault.deposit(
                     {.depositor = owner,
                      .id = keylet.key,
                      .amount = asset(fix330Enabled ? 2 : 1)}));
                 env.close();
+            }
+
+            // Destination deep freeze → withdraw to 3rd party blocked
+            {
+                testcase("VaultWithdraw IOU deep freeze withdraw to 3rd party");
 
-                // Destination deep freeze → withdraw to 3rd party blocked
                 env(trust(issuer, asset(0), charlie, tfSetFreeze | tfSetDeepFreeze));
-                {
-                    auto withdrawToCharlie =
-                        vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
-                    withdrawToCharlie[sfDestination] = charlie.human();
-                    env(withdrawToCharlie, Ter(tecFROZEN));
-                }
+
+                auto withdrawToCharlie =
+                    vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)});
+                withdrawToCharlie[sfDestination] = charlie.human();
+                env(withdrawToCharlie, Ter(tecFROZEN));
+
                 // Destination deep freeze → self-withdraw unaffected
                 env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
+
                 env(trust(issuer, asset(0), charlie, tfClearFreeze | tfClearDeepFreeze));
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
                 env.close();
+            }
 
-                // Clawback works while frozen
+            // Clawback works while frozen
+            {
+                testcase("VaultWithdraw IOU freeze clawback unaffected");
                 env(fset(issuer, asfGlobalFreeze));
+
                 env(vault.clawback(
                     {.issuer = issuer, .id = keylet.key, .holder = owner, .amount = asset(1)}));
+
                 env(fclear(issuer, asfGlobalFreeze));
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = asset(1)}));
                 env.close();
-            };
+            }
+        };
 
-            runTests();
-            env.disableFeature(fixCleanup3_3_0);
-            runTests();
-            env.enableFeature(fixCleanup3_3_0);
-        }
+        runTests();
+        env.disableFeature(fixCleanup3_3_0);
+        runTests();
+        env.enableFeature(fixCleanup3_3_0);
+    }
 
-        // === MPT ===
-        {
-            testcase("VaultWithdraw MPT lock checks");
-            Env env{*this};
-            Vault vault{env};
+    void
+    testVaultWithdrawFreezeMPT()
+    {
+        using namespace test::jtx;
+        testcase("VaultWithdraw MPT lock checks");
 
-            env.fund(XRP(100'000), issuer, owner);
-            env.close();
+        Account const issuer{"issuer"};
+        Account const owner{"owner"};
+        Env env{*this};
+        Vault vault{env};
 
-            MPTTester mptt{env, issuer, kMptInitNoFund};
-            mptt.create(
-                {.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth});
-            PrettyAsset const mpt{mptt.issuanceID()};
+        env.fund(XRP(100'000), issuer, owner);
+        env.close();
 
-            mptt.authorize({.account = owner});
-            mptt.authorize({.account = issuer, .holder = owner});
-            env.close();
-            env(pay(issuer, owner, mpt(100'000)));
-            env.close();
+        MPTTester mptt{env, issuer, kMptInitNoFund};
+        mptt.create(
+            {.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock | tfMPTRequireAuth});
+        PrettyAsset const mpt{mptt.issuanceID()};
 
-            auto [tx, keylet] = vault.create({.owner = owner, .asset = mpt});
-            env(tx);
-            env.close();
-            Account const vaultAcct("vault", env.le(keylet)->at(sfAccount));
+        mptt.authorize({.account = owner});
+        mptt.authorize({.account = issuer, .holder = owner});
+        env.close();
+        env(pay(issuer, owner, mpt(100'000)));
+        env.close();
 
-            env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(100)}));
-            env.close();
+        auto [tx, keylet] = vault.create({.owner = owner, .asset = mpt});
+        env(tx);
+        env.close();
+        Account const vaultAcct("vault", env.le(keylet)->at(sfAccount));
 
-            Account const charlie{"charlie"};
-            env.fund(XRP(10'000), charlie);
-            env.close();
-            mptt.authorize({.account = charlie});
-            mptt.authorize({.account = issuer, .holder = charlie});
-            env.close();
+        env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(100)}));
+        env.close();
 
-            auto runTests = [&]() {
-                auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+        Account const charlie{"charlie"};
+        env.fund(XRP(10'000), charlie);
+        env.close();
+        mptt.authorize({.account = charlie});
+        mptt.authorize({.account = issuer, .holder = charlie});
+        env.close();
 
-                // Global lock
+        auto runTests = [&]() {
+            auto const fix330Enabled = env.current()->rules().enabled(fixCleanup3_3_0);
+
+            // Global lock
+            {
+                testcase("VaultWithdraw MPT global lock");
                 mptt.set({.flags = tfMPTLock});
                 env.close();
                 env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
@@ -8081,17 +8129,23 @@ class Vault_test : public beast::unit_test::Suite
                     env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
                 }
                 env.close();
+            }
 
-                // Vault pseudo-account individual lock
+            // Vault pseudo-account individual lock
+            {
+                testcase("VaultWithdraw MPT pseudo-account lock");
                 mptt.set({.holder = vaultAcct, .flags = tfMPTLock});
                 env.close();
                 env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
                     Ter(tecLOCKED));
                 mptt.set({.holder = vaultAcct, .flags = tfMPTUnlock});
                 env.close();
+            }
 
-                // Depositor individual lock → self-withdraw blocked
-                // (isDeepFrozen == isFrozen for MPT)
+            // Depositor individual lock → self-withdraw blocked
+            // (isDeepFrozen == isFrozen for MPT)
+            {
+                testcase("VaultWithdraw MPT depositor lock");
                 mptt.set({.holder = owner, .flags = tfMPTLock});
                 env.close();
                 env(vault.withdraw({.depositor = owner, .id = keylet.key, .amount = mpt(1)}),
@@ -8120,8 +8174,11 @@ class Vault_test : public beast::unit_test::Suite
                     env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
                 }
                 env.close();
+            }
 
-                // 3rd party destination lock → withdraw to 3rd party blocked
+            // 3rd party destination lock → withdraw to 3rd party blocked
+            {
+                testcase("VaultWithdraw MPT 3rd party destination lock");
                 mptt.set({.holder = charlie, .flags = tfMPTLock});
                 env.close();
                 {
@@ -8136,8 +8193,11 @@ class Vault_test : public beast::unit_test::Suite
                 env.close();
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
                 env.close();
+            }
 
-                // Clawback works while locked
+            // Clawback works while locked
+            {
+                testcase("VaultWithdraw MPT lock clawback unaffected");
                 mptt.set({.flags = tfMPTLock});
                 env.close();
                 env(vault.clawback(
@@ -8146,14 +8206,13 @@ class Vault_test : public beast::unit_test::Suite
                 env.close();
                 env(vault.deposit({.depositor = owner, .id = keylet.key, .amount = mpt(1)}));
                 env.close();
-            };
+            }
+        };
 
-            runTests();
-            env.disableFeature(fixCleanup3_3_0);
-
-            runTests();
-            env.enableFeature(fixCleanup3_3_0);
-        }
+        runTests();
+        env.disableFeature(fixCleanup3_3_0);
+        runTests();
+        env.enableFeature(fixCleanup3_3_0);
     }
 
 public:
@@ -8198,8 +8257,10 @@ public:
         testWithdrawSoleShareholderPartialFixedSharesUsesFullPrice();
         testWithdrawSoleShareholderLoanRepaymentExit();
 
-        testVaultDepositFreeze();
-        testVaultWithdrawFreeze();
+        testVaultDepositFreezeIOU();
+        testVaultDepositFreezeMPT();
+        testVaultWithdrawFreezeIOU();
+        testVaultWithdrawFreezeMPT();
         testVaultSelfWithdrawWhileFrozen();
 
         testReferenceHolding();

From c53aafa6bfeb8591532c770cfcc59abf5f156a2f Mon Sep 17 00:00:00 2001
From: Timothy Banks <tbanks@ripple.com>
Date: Wed, 1 Jul 2026 11:36:28 -0400
Subject: [PATCH 035/100] refactor: Retire InnerObjTemplate fix (#7368)

---
 include/xrpl/protocol/detail/features.macro  |  2 +-
 src/libxrpl/ledger/helpers/AMMHelpers.cpp    |  6 ++---
 src/libxrpl/protocol/STObject.cpp            |  6 ++---
 src/libxrpl/tx/transactors/dex/AMMBid.cpp    | 17 ++++----------
 src/libxrpl/tx/transactors/dex/AMMVote.cpp   |  4 +---
 src/test/app/AMM_test.cpp                    | 24 +-------------------
 src/test/jtx/impl/AMM.cpp                    | 10 ++------
 src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp |  4 +---
 8 files changed, 15 insertions(+), 58 deletions(-)

diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index a1911761bb..7e64a49b0c 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -58,7 +58,6 @@ XRPL_FIX    (XChainRewardRounding,       Supported::Yes, VoteBehavior::DefaultNo
 XRPL_FIX    (EmptyDID,                   Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(PriceOracle,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (AMMOverflowOffer,           Supported::Yes, VoteBehavior::DefaultYes)
-XRPL_FIX    (InnerObjTemplate,           Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (FillOrKill,                 Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(DID,                        Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (DisallowIncomingV1,         Supported::Yes, VoteBehavior::DefaultNo)
@@ -101,6 +100,7 @@ XRPL_RETIRE_FIX(1623)
 XRPL_RETIRE_FIX(1781)
 XRPL_RETIRE_FIX(AmendmentMajorityCalc)
 XRPL_RETIRE_FIX(CheckThreading)
+XRPL_RETIRE_FIX(InnerObjTemplate)
 XRPL_RETIRE_FIX(MasterKeyAsRegularKey)
 XRPL_RETIRE_FIX(NonFungibleTokensV1_2)
 XRPL_RETIRE_FIX(NFTokenRemint)
diff --git a/src/libxrpl/ledger/helpers/AMMHelpers.cpp b/src/libxrpl/ledger/helpers/AMMHelpers.cpp
index 7cd27a1f34..df6d335085 100644
--- a/src/libxrpl/ledger/helpers/AMMHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/AMMHelpers.cpp
@@ -602,9 +602,7 @@ std::uint16_t
 getTradingFee(ReadView const& view, SLE const& ammSle, AccountID const& account)
 {
     using namespace std::chrono;
-    XRPL_ASSERT(
-        !view.rules().enabled(fixInnerObjTemplate) || ammSle.isFieldPresent(sfAuctionSlot),
-        "xrpl::getTradingFee : auction present");
+    XRPL_ASSERT(ammSle.isFieldPresent(sfAuctionSlot), "xrpl::getTradingFee : auction present");
     if (ammSle.isFieldPresent(sfAuctionSlot))
     {
         auto const& auctionSlot = safeDowncast<STObject const&>(ammSle.peekAtField(sfAuctionSlot));
@@ -822,7 +820,7 @@ initializeFeeAuctionVote(
     // AMM creator gets the auction slot for free.
     // AuctionSlot is created on AMMCreate and updated on AMMDeposit
     // when AMM is in an empty state
-    if (rules.enabled(fixInnerObjTemplate) && !ammSle->isFieldPresent(sfAuctionSlot))
+    if (!ammSle->isFieldPresent(sfAuctionSlot))
     {
         STObject auctionSlot = STObject::makeInnerObject(sfAuctionSlot);
         ammSle->set(std::move(auctionSlot));
diff --git a/src/libxrpl/protocol/STObject.cpp b/src/libxrpl/protocol/STObject.cpp
index 445da16828..c493ba65af 100644
--- a/src/libxrpl/protocol/STObject.cpp
+++ b/src/libxrpl/protocol/STObject.cpp
@@ -78,12 +78,10 @@ STObject::makeInnerObject(SField const& name)
     // The if is complicated because inner object templates were added in
     // two phases:
     //  1. If there are no available Rules, then always apply the template.
-    //  2. fixInnerObjTemplate added templates to two AMM inner objects.
-    //  3. fixInnerObjTemplate2 added templates to all remaining inner objects.
+    //  2. fixInnerObjTemplate2 added templates to all remaining inner objects.
     std::optional<Rules> const& rules = getCurrentTransactionRules();
     bool const isAMMObj = name == sfAuctionSlot || name == sfVoteEntry;
-    if (!rules || (rules->enabled(fixInnerObjTemplate) && isAMMObj) ||
-        (rules->enabled(fixInnerObjTemplate2) && !isAMMObj))
+    if (!rules || isAMMObj || rules->enabled(fixInnerObjTemplate2))
     {
         if (SOTemplate const* elements =
                 InnerObjectFormats::getInstance().findSOTemplateBySField(name))
diff --git a/src/libxrpl/tx/transactors/dex/AMMBid.cpp b/src/libxrpl/tx/transactors/dex/AMMBid.cpp
index 83432fa0d0..3454559e82 100644
--- a/src/libxrpl/tx/transactors/dex/AMMBid.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMBid.cpp
@@ -184,18 +184,11 @@ applyBid(ApplyContext& ctx, Sandbox& sb, AccountID const& account, beast::Journa
         return {tecINTERNAL, false};
     STAmount const lptAMMBalance = (*ammSle)[sfLPTokenBalance];
     auto const lpTokens = ammLPHolds(sb, *ammSle, account, ctx.journal);
-    auto const& rules = ctx.view().rules();
-    if (!rules.enabled(fixInnerObjTemplate))
-    {
-        if (!ammSle->isFieldPresent(sfAuctionSlot))
-            ammSle->makeFieldPresent(sfAuctionSlot);
-    }
-    else
-    {
-        XRPL_ASSERT(ammSle->isFieldPresent(sfAuctionSlot), "xrpl::applyBid : has auction slot");
-        if (!ammSle->isFieldPresent(sfAuctionSlot))
-            return {tecINTERNAL, false};
-    }
+
+    XRPL_ASSERT(ammSle->isFieldPresent(sfAuctionSlot), "xrpl::applyBid : has auction slot");
+    if (!ammSle->isFieldPresent(sfAuctionSlot))
+        return {tecINTERNAL, false};
+
     auto& auctionSlot = ammSle->peekFieldObject(sfAuctionSlot);
     auto const current =
         duration_cast<seconds>(ctx.view().header().parentCloseTime.time_since_epoch()).count();
diff --git a/src/libxrpl/tx/transactors/dex/AMMVote.cpp b/src/libxrpl/tx/transactors/dex/AMMVote.cpp
index 23604d46cc..0f2b721ac4 100644
--- a/src/libxrpl/tx/transactors/dex/AMMVote.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMVote.cpp
@@ -195,9 +195,7 @@ applyVote(ApplyContext& ctx, Sandbox& sb, AccountID const& accountID, beast::Jou
         }
     }
 
-    XRPL_ASSERT(
-        !ctx.view().rules().enabled(fixInnerObjTemplate) || ammSle->isFieldPresent(sfAuctionSlot),
-        "xrpl::applyVote : has auction slot");
+    XRPL_ASSERT(ammSle->isFieldPresent(sfAuctionSlot), "xrpl::applyVote : has auction slot");
 
     // Update the vote entries and the trading/discounted fee.
     ammSle->setFieldArray(sfVoteSlots, updatedVoteSlots);
diff --git a/src/test/app/AMM_test.cpp b/src/test/app/AMM_test.cpp
index 3672c4a68a..d4b6ba5429 100644
--- a/src/test/app/AMM_test.cpp
+++ b/src/test/app/AMM_test.cpp
@@ -5747,38 +5747,16 @@ private:
         };
 
         // ledger is closed after each transaction, vote/withdraw don't fail
-        // regardless whether the amendment is enabled or not
         test(all, tesSUCCESS, tesSUCCESS, tesSUCCESS, tesSUCCESS, 0, true);
-        test(all - fixInnerObjTemplate, tesSUCCESS, tesSUCCESS, tesSUCCESS, tesSUCCESS, 0, true);
         // ledger is not closed after each transaction
-        // vote/withdraw don't fail if the amendment is enabled
         test(all, tesSUCCESS, tesSUCCESS, tesSUCCESS, tesSUCCESS, 0, false);
-        // vote/withdraw fail if the amendment is not enabled
-        // second vote/withdraw still fail: second vote fails because
-        // the initial trading fee is 0, consequently second withdraw fails
-        // because the second vote fails
-        test(
-            all - fixInnerObjTemplate,
-            tefEXCEPTION,
-            tefEXCEPTION,
-            tefEXCEPTION,
-            tefEXCEPTION,
-            0,
-            false);
         // if non-zero trading/discounted fee then vote/withdraw
-        // don't fail whether the ledger is closed or not and
-        // the amendment is enabled or not
+        // don't fail whether the ledger is closed or not
         test(all, tesSUCCESS, tesSUCCESS, tesSUCCESS, tesSUCCESS, 10, true);
-        test(all - fixInnerObjTemplate, tesSUCCESS, tesSUCCESS, tesSUCCESS, tesSUCCESS, 10, true);
         test(all, tesSUCCESS, tesSUCCESS, tesSUCCESS, tesSUCCESS, 10, false);
-        test(all - fixInnerObjTemplate, tesSUCCESS, tesSUCCESS, tesSUCCESS, tesSUCCESS, 10, false);
         // non-zero trading fee but discounted fee is 0, vote doesn't fail
         // but withdraw fails
         test(all, tesSUCCESS, tesSUCCESS, tesSUCCESS, tesSUCCESS, 9, false);
-        // second vote sets the trading fee to non-zero, consequently
-        // second withdraw doesn't fail even if the amendment is not
-        // enabled and the ledger is not closed
-        test(all - fixInnerObjTemplate, tesSUCCESS, tefEXCEPTION, tesSUCCESS, tesSUCCESS, 9, false);
     }
 
     void
diff --git a/src/test/jtx/impl/AMM.cpp b/src/test/jtx/impl/AMM.cpp
index 2184f7e1b0..5c815d4226 100644
--- a/src/test/jtx/impl/AMM.cpp
+++ b/src/test/jtx/impl/AMM.cpp
@@ -738,8 +738,7 @@ AMM::bid(BidArg const& arg)
 {
     if (auto const amm = env_.current()->read(keylet::amm(asset1_.asset(), asset2_.asset())))
     {
-        if (env_.current()->rules().enabled(fixInnerObjTemplate) &&
-            !amm->isFieldPresent(sfAuctionSlot))
+        if (!amm->isFieldPresent(sfAuctionSlot))
             Throw<std::runtime_error>("AMM::Bid");
         if (amm->isFieldPresent(sfAuctionSlot))
         {
@@ -867,8 +866,7 @@ AMM::expectAuctionSlot(auto&& cb) const
 {
     if (auto const amm = env_.current()->read(keylet::amm(asset1_.asset(), asset2_.asset())))
     {
-        if (env_.current()->rules().enabled(fixInnerObjTemplate) &&
-            !amm->isFieldPresent(sfAuctionSlot))
+        if (!amm->isFieldPresent(sfAuctionSlot))
             Throw<std::runtime_error>("AMM::expectAuctionSlot");
         if (amm->isFieldPresent(sfAuctionSlot))
         {
@@ -876,10 +874,6 @@ AMM::expectAuctionSlot(auto&& cb) const
                 safeDowncast<STObject const&>(amm->peekAtField(sfAuctionSlot));
             if (auctionSlot.isFieldPresent(sfAccount))
             {
-                // This could fail in pre-fixInnerObjTemplate tests
-                // if the submitted transactions recreate one of
-                // the failure scenarios. Access as optional
-                // to avoid the failure.
                 auto const slotFee = auctionSlot[~sfDiscountedFee].value_or(0);
                 auto const slotInterval = ammAuctionTimeSlot(
                     env_.app().getTimeKeeper().now().time_since_epoch().count(), auctionSlot);
diff --git a/src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp b/src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp
index 043fdd2d7b..7f54f81423 100644
--- a/src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp
+++ b/src/xrpld/rpc/handlers/orderbook/AMMInfo.cpp
@@ -214,9 +214,7 @@ doAMMInfo(RPC::JsonContext& context)
     }
     if (voteSlots.size() > 0)
         ammResult[jss::vote_slots] = std::move(voteSlots);
-    XRPL_ASSERT(
-        !ledger->rules().enabled(fixInnerObjTemplate) || amm->isFieldPresent(sfAuctionSlot),
-        "xrpl::doAMMInfo : auction slot is set");
+    XRPL_ASSERT(amm->isFieldPresent(sfAuctionSlot), "xrpl::doAMMInfo : auction slot is present");
     if (amm->isFieldPresent(sfAuctionSlot))
     {
         auto const& auctionSlot = safeDowncast<STObject const&>(amm->peekAtField(sfAuctionSlot));

From 8e378c4f4727a188ca0300b76142f2f867ba1e30 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Thu, 2 Jul 2026 00:14:17 +0100
Subject: [PATCH 036/100] build: Add verify-headers target to cleanup headers
 (#7670)

---
 .clang-tidy                                   |   2 +-
 .gersemi/definitions.cmake                    |   6 +
 .../scripts/levelization/results/loops.txt    |   6 -
 .../scripts/levelization/results/ordering.txt |  11 +-
 .github/workflows/reusable-clang-tidy.yml     |   3 +-
 .pre-commit-config.yaml                       |   6 +-
 BUILD.md                                      |  38 +++-
 bin/pre-commit/clang_tidy_check.py            | 171 ++----------------
 cmake/XrplCore.cmake                          |   9 +
 cmake/XrplSettings.cmake                      |  17 ++
 cmake/add_module.cmake                        |  17 ++
 cmake/verify_headers.cmake                    |  84 +++++++++
 include/xrpl/basics/Buffer.h                  |   1 +
 include/xrpl/basics/CompressionAlgorithms.h   |   1 +
 include/xrpl/basics/DecayingSample.h          |   1 +
 include/xrpl/basics/FileUtilities.h           |   2 +
 include/xrpl/basics/IntrusivePointer.h        |   1 +
 include/xrpl/basics/IntrusiveRefCounts.h      |   1 +
 include/xrpl/basics/Log.h                     |   3 +-
 include/xrpl/basics/Number.h                  |   4 +
 include/xrpl/basics/RangeSet.h                |   1 +
 include/xrpl/basics/Resolver.h                |   1 +
 include/xrpl/basics/ResolverAsio.h            |   2 +
 include/xrpl/basics/SHAMapHash.h              |   2 +
 include/xrpl/basics/SharedWeakCachePointer.h  |   2 +
 include/xrpl/basics/SlabAllocator.h           |   1 +
 include/xrpl/basics/StringUtilities.h         |   3 +-
 include/xrpl/basics/TaggedCache.h             |  15 +-
 include/xrpl/basics/TaggedCache.ipp           |   1 +
 include/xrpl/basics/UnorderedContainers.h     |   4 +-
 include/xrpl/basics/base64.h                  |   1 +
 include/xrpl/basics/base_uint.h               |  10 +
 include/xrpl/basics/chrono.h                  |   1 +
 include/xrpl/basics/hardened_hash.h           |   1 -
 include/xrpl/basics/join.h                    |   2 +
 include/xrpl/basics/make_SSLContext.h         |   1 +
 .../xrpl/basics/partitioned_unordered_map.h   |   3 +
 include/xrpl/basics/random.h                  |   1 -
 include/xrpl/basics/safe_cast.h               |   2 -
 include/xrpl/basics/strHex.h                  |   3 +
 include/xrpl/basics/tagged_integer.h          |   1 +
 include/xrpl/beast/asio/io_latency_probe.h    |   1 +
 .../beast/container/aged_container_utility.h  |   1 +
 include/xrpl/beast/container/aged_map.h       |   1 +
 include/xrpl/beast/container/aged_multimap.h  |   1 +
 .../xrpl/beast/container/aged_unordered_map.h |   1 +
 .../beast/container/aged_unordered_multimap.h |   1 +
 .../container/detail/aged_ordered_container.h |  27 +--
 .../detail/aged_unordered_container.h         |   6 +
 include/xrpl/beast/core/CurrentThreadName.h   |   1 +
 include/xrpl/beast/core/LexicalCast.h         |   5 +-
 include/xrpl/beast/core/List.h                |   2 +
 include/xrpl/beast/core/LockFreeStack.h       |   3 +-
 include/xrpl/beast/hash/hash_append.h         |   2 +-
 include/xrpl/beast/insight/Collector.h        |   2 +
 include/xrpl/beast/insight/Insight.h          |  15 --
 include/xrpl/beast/insight/NullCollector.h    |   2 +
 include/xrpl/beast/insight/StatsDCollector.h  |   3 +
 include/xrpl/beast/net/IPAddress.h            |   1 +
 include/xrpl/beast/net/IPAddressV4.h          |   2 -
 include/xrpl/beast/net/IPAddressV6.h          |   2 -
 include/xrpl/beast/net/IPEndpoint.h           |   5 +
 include/xrpl/beast/rfc2616.h                  |   1 +
 include/xrpl/beast/test/yield_to.h            |   2 +
 include/xrpl/beast/unit_test.h                |   9 -
 include/xrpl/beast/unit_test/match.h          |   1 +
 include/xrpl/beast/unit_test/recorder.h       |   4 +
 include/xrpl/beast/unit_test/reporter.h       |   5 +-
 include/xrpl/beast/unit_test/results.h        |   1 +
 include/xrpl/beast/unit_test/suite.h          |   4 +-
 include/xrpl/beast/unit_test/suite_info.h     |   2 +-
 include/xrpl/beast/unit_test/suite_list.h     |   1 +
 include/xrpl/beast/unit_test/thread.h         |   2 +
 include/xrpl/beast/utility/Journal.h          |   3 +
 include/xrpl/beast/utility/PropertyStream.h   |   2 +
 include/xrpl/beast/utility/WrappedSink.h      |   1 +
 include/xrpl/beast/utility/rngfill.h          |   2 -
 include/xrpl/conditions/Condition.h           |   4 +
 include/xrpl/conditions/Fulfillment.h         |   5 +
 .../xrpl/conditions/detail/PreimageSha256.h   |   4 +
 include/xrpl/conditions/detail/utils.h        |   3 +
 include/xrpl/config/BasicConfig.h             |   4 +
 include/xrpl/core/ClosureCounter.h            |   3 +
 include/xrpl/core/HashRouter.h                |   6 +
 include/xrpl/core/Job.h                       |   5 +
 include/xrpl/core/JobQueue.h                  |  22 ++-
 include/xrpl/core/JobTypeData.h               |   3 +
 include/xrpl/core/JobTypeInfo.h               |   4 +
 include/xrpl/core/JobTypes.h                  |   4 +
 include/xrpl/core/LoadMonitor.h               |   1 +
 include/xrpl/core/PeerReservationTable.h      |   1 +
 include/xrpl/core/PerfLog.h                   |   3 +-
 include/xrpl/core/ServiceRegistry.h           |   6 +
 include/xrpl/core/StartUpType.h               |   2 +-
 include/xrpl/core/detail/semaphore.h          |   1 +
 include/xrpl/crypto/RFC1751.h                 |   1 +
 include/xrpl/crypto/csprng.h                  |   3 +
 include/xrpl/json/JsonPropertyStream.h        |   3 +
 include/xrpl/json/Writer.h                    |   4 +-
 include/xrpl/json/detail/json_assert.h        |   3 -
 include/xrpl/json/json_reader.h               |   3 +
 include/xrpl/json/json_writer.h               |   3 +
 include/xrpl/ledger/AcceptedLedgerTx.h        |  10 +
 include/xrpl/ledger/AmendmentTable.h          |  23 +++
 include/xrpl/ledger/ApplyView.h               |  15 +-
 include/xrpl/ledger/ApplyViewImpl.h           |  11 ++
 include/xrpl/ledger/BookDirs.h                |   7 +
 include/xrpl/ledger/CachedView.h              |   9 +
 include/xrpl/ledger/CanonicalTXSet.h          |   6 +
 include/xrpl/ledger/Dir.h                     |  10 +-
 include/xrpl/ledger/Ledger.h                  |  22 ++-
 include/xrpl/ledger/LedgerTiming.h            |   5 +-
 include/xrpl/ledger/OpenView.h                |  13 +-
 include/xrpl/ledger/PaymentSandbox.h          |  10 +-
 include/xrpl/ledger/RawView.h                 |   3 +
 include/xrpl/ledger/ReadView.h                |  11 +-
 include/xrpl/ledger/Sandbox.h                 |   2 +
 include/xrpl/ledger/View.h                    |   9 +
 include/xrpl/ledger/detail/ApplyStateTable.h  |  13 ++
 include/xrpl/ledger/detail/ApplyViewBase.h    |  10 +
 include/xrpl/ledger/detail/RawStateTable.h    |   8 +
 include/xrpl/ledger/detail/ReadViewFwdRange.h |   2 +
 include/xrpl/ledger/helpers/AMMHelpers.h      |  16 +-
 .../xrpl/ledger/helpers/AccountRootHelpers.h  |   5 +
 .../xrpl/ledger/helpers/CredentialHelpers.h   |   9 +-
 include/xrpl/ledger/helpers/DelegateHelpers.h |   3 +
 .../xrpl/ledger/helpers/DirectoryHelpers.h    |   6 +-
 include/xrpl/ledger/helpers/EscrowHelpers.h   |  17 +-
 include/xrpl/ledger/helpers/LendingHelpers.h  |  21 ++-
 include/xrpl/ledger/helpers/MPTokenHelpers.h  |   6 +
 include/xrpl/ledger/helpers/NFTokenHelpers.h  |  16 +-
 .../ledger/helpers/PaymentChannelHelpers.h    |   5 +-
 .../ledger/helpers/PermissionedDEXHelpers.h   |   6 +-
 .../xrpl/ledger/helpers/RippleStateHelpers.h  |   7 +
 include/xrpl/ledger/helpers/TokenHelpers.h    |   7 +
 include/xrpl/net/AutoSocket.h                 |   8 +
 include/xrpl/net/HTTPClient.h                 |   1 +
 include/xrpl/net/HTTPClientSSLContext.h       |   8 +
 include/xrpl/net/RegisterSSLCerts.h           |   2 +-
 include/xrpl/nodestore/Backend.h              |   9 +
 include/xrpl/nodestore/Database.h             |  18 +-
 include/xrpl/nodestore/DatabaseRotating.h     |   7 +
 include/xrpl/nodestore/DummyScheduler.h       |   1 +
 include/xrpl/nodestore/Factory.h              |   6 +-
 include/xrpl/nodestore/Manager.h              |   9 +-
 include/xrpl/nodestore/NodeObject.h           |   4 +
 include/xrpl/nodestore/Types.h                |   1 +
 include/xrpl/nodestore/detail/BatchWriter.h   |   2 +
 .../xrpl/nodestore/detail/DatabaseNodeImp.h   |  16 ++
 .../nodestore/detail/DatabaseRotatingImp.h    |  11 ++
 include/xrpl/nodestore/detail/DecodedBlob.h   |   2 +
 include/xrpl/nodestore/detail/EncodedBlob.h   |   3 +
 include/xrpl/nodestore/detail/ManagerImp.h    |  11 ++
 include/xrpl/nodestore/detail/codec.h         |   4 +
 include/xrpl/nodestore/detail/varint.h        |   1 +
 include/xrpl/proto/org/xrpl/rpc/v1/README.md  |   6 +-
 include/xrpl/protocol/AMMCore.h               |   5 +
 include/xrpl/protocol/AccountID.h             |   6 +-
 include/xrpl/protocol/AmountConversions.h     |  10 +
 include/xrpl/protocol/ApiVersion.h            |   1 +
 include/xrpl/protocol/Asset.h                 |  11 +-
 include/xrpl/protocol/Batch.h                 |   5 +-
 include/xrpl/protocol/Book.h                  |  11 ++
 include/xrpl/protocol/BuildInfo.h             |   1 +
 include/xrpl/protocol/ConfidentialTransfer.h  |  15 +-
 include/xrpl/protocol/ErrorCodes.h            |   3 +-
 include/xrpl/protocol/Feature.h               |   2 +
 include/xrpl/protocol/Fees.h                  |   3 +
 include/xrpl/protocol/IOUAmount.h             |   1 +
 include/xrpl/protocol/Indexes.h               |  11 +-
 include/xrpl/protocol/InnerObjectFormats.h    |   2 +
 include/xrpl/protocol/Issue.h                 |   6 +-
 include/xrpl/protocol/KnownFormats.h          |   4 +
 include/xrpl/protocol/LedgerFormats.h         |   3 +
 include/xrpl/protocol/LedgerHeader.h          |   3 +
 include/xrpl/protocol/MPTAmount.h             |   4 +-
 include/xrpl/protocol/MPTIssue.h              |  10 +
 include/xrpl/protocol/PathAsset.h             |   7 +
 include/xrpl/protocol/Permissions.h           |   5 +-
 include/xrpl/protocol/Protocol.h              |   2 +
 include/xrpl/protocol/PublicKey.h             |  10 +
 include/xrpl/protocol/Quality.h               |   6 +-
 include/xrpl/protocol/QualityFunction.h       |   6 +
 include/xrpl/protocol/Rate.h                  |   2 +-
 include/xrpl/protocol/Rules.h                 |   3 +
 include/xrpl/protocol/SField.h                |   3 +-
 include/xrpl/protocol/SOTemplate.h            |   2 +
 include/xrpl/protocol/STAccount.h             |   4 +
 include/xrpl/protocol/STAmount.h              |  16 +-
 include/xrpl/protocol/STArray.h               |  11 ++
 include/xrpl/protocol/STBase.h                |   3 +
 include/xrpl/protocol/STBitString.h           |   7 +
 include/xrpl/protocol/STBlob.h                |   6 +-
 include/xrpl/protocol/STCurrency.h            |   6 +-
 include/xrpl/protocol/STExchange.h            |   3 +-
 include/xrpl/protocol/STInteger.h             |   8 +
 include/xrpl/protocol/STIssue.h               |   9 +
 include/xrpl/protocol/STLedgerEntry.h         |  14 +-
 include/xrpl/protocol/STNumber.h              |   7 +
 include/xrpl/protocol/STObject.h              |  14 +-
 include/xrpl/protocol/STParsedJSON.h          |   5 +-
 include/xrpl/protocol/STPathSet.h             |   5 +-
 include/xrpl/protocol/STTakesAsset.h          |   2 +
 include/xrpl/protocol/STTx.h                  |  14 +-
 include/xrpl/protocol/STValidation.h          |  43 +++--
 include/xrpl/protocol/STVector256.h           |  10 +-
 include/xrpl/protocol/STXChainBridge.h        |  10 +
 include/xrpl/protocol/SecretKey.h             |   4 +
 include/xrpl/protocol/Seed.h                  |   3 +
 include/xrpl/protocol/Serializer.h            |   3 +-
 include/xrpl/protocol/Sign.h                  |   4 +
 include/xrpl/protocol/SystemParameters.h      |   3 +
 include/xrpl/protocol/TER.h                   |   2 +
 include/xrpl/protocol/TxFormats.h             |   2 +
 include/xrpl/protocol/TxMeta.h                |  11 +-
 include/xrpl/protocol/UintTypes.h             |   6 +-
 include/xrpl/protocol/Units.h                 |   4 +
 include/xrpl/protocol/XChainAttestations.h    |   8 +-
 include/xrpl/protocol/XRPAmount.h             |   5 +
 include/xrpl/protocol/detail/STVar.h          |   1 +
 include/xrpl/protocol/detail/b58_utils.h      |   4 +-
 include/xrpl/protocol/detail/token_errors.h   |   2 +
 include/xrpl/protocol/digest.h                |   3 +
 include/xrpl/protocol/json_get_or_throw.h     |   4 +
 include/xrpl/protocol/messages.h              |   2 -
 include/xrpl/protocol/serialize.h             |   3 +
 include/xrpl/protocol/st.h                    |  18 --
 include/xrpl/protocol/tokens.h                |   3 +-
 include/xrpl/rdb/DatabaseCon.h                |  12 +-
 include/xrpl/rdb/RelationalDatabase.h         |  18 +-
 include/xrpl/rdb/SociDB.h                     |   5 +-
 include/xrpl/resource/Charge.h                |   2 +
 include/xrpl/resource/Consumer.h              |   5 +-
 include/xrpl/resource/ResourceManager.h       |   4 +
 include/xrpl/resource/Types.h                 |  10 -
 include/xrpl/resource/detail/Entry.h          |   7 +-
 include/xrpl/resource/detail/Import.h         |   2 +
 include/xrpl/resource/detail/Key.h            |   3 +-
 include/xrpl/resource/detail/Logic.h          |  11 +-
 include/xrpl/server/InfoSub.h                 |   9 +
 include/xrpl/server/LoadFeeTrack.h            |   1 +
 include/xrpl/server/Manifest.h                |   8 +
 include/xrpl/server/NetworkOPs.h              |  15 +-
 include/xrpl/server/Port.h                    |   3 +-
 include/xrpl/server/Server.h                  |   4 +-
 include/xrpl/server/Session.h                 |   6 +-
 include/xrpl/server/SimpleWriter.h            |   5 +-
 include/xrpl/server/State.h                   |   4 +-
 include/xrpl/server/Vacuum.h                  |   1 +
 include/xrpl/server/WSSession.h               |   3 +-
 include/xrpl/server/Wallet.h                  |  12 ++
 include/xrpl/server/Writer.h                  |   1 +
 include/xrpl/server/detail/BaseHTTPPeer.h     |  11 +-
 include/xrpl/server/detail/BasePeer.h         |   3 +-
 include/xrpl/server/detail/BaseWSPeer.h       |   8 +
 include/xrpl/server/detail/Door.h             |   5 +
 include/xrpl/server/detail/JSONRPCUtil.h      |   3 +-
 include/xrpl/server/detail/LowestLayer.h      |   9 -
 include/xrpl/server/detail/PlainHTTPPeer.h    |   5 +
 include/xrpl/server/detail/PlainWSPeer.h      |   4 +
 include/xrpl/server/detail/SSLHTTPPeer.h      |   6 +
 include/xrpl/server/detail/SSLWSPeer.h        |   7 +-
 include/xrpl/server/detail/ServerImpl.h       |  11 +-
 include/xrpl/server/detail/Spawn.h            |   1 +
 include/xrpl/server/detail/io_list.h          |   1 +
 include/xrpl/shamap/Family.h                  |   2 +
 include/xrpl/shamap/FullBelowCache.h          |   4 +
 include/xrpl/shamap/SHAMap.h                  |  19 +-
 .../xrpl/shamap/SHAMapAccountStateLeafNode.h  |   7 +
 include/xrpl/shamap/SHAMapInnerNode.h         |   6 +-
 include/xrpl/shamap/SHAMapItem.h              |   8 +
 include/xrpl/shamap/SHAMapLeafNode.h          |   3 +
 include/xrpl/shamap/SHAMapMissingNode.h       |   4 +-
 include/xrpl/shamap/SHAMapNodeID.h            |   2 +
 include/xrpl/shamap/SHAMapSyncFilter.h        |   3 +
 include/xrpl/shamap/SHAMapTreeNode.h          |   2 +-
 include/xrpl/shamap/SHAMapTxLeafNode.h        |   7 +
 .../xrpl/shamap/SHAMapTxPlusMetaLeafNode.h    |   7 +
 include/xrpl/shamap/TreeNodeCache.h           |   1 +
 include/xrpl/shamap/detail/TaggedPointer.h    |   7 +-
 include/xrpl/tx/ApplyContext.h                |  11 ++
 include/xrpl/tx/SignerEntries.h               |   8 +-
 include/xrpl/tx/Transactor.h                  |  16 ++
 include/xrpl/tx/apply.h                       |   6 +-
 include/xrpl/tx/applySteps.h                  |  14 +-
 include/xrpl/tx/invariants/AMMInvariant.h     |   3 +
 .../xrpl/tx/invariants/DirectoryInvariant.h   |   2 +
 include/xrpl/tx/invariants/FreezeInvariant.h  |   3 +
 include/xrpl/tx/invariants/InvariantCheck.h   |   7 +-
 .../tx/invariants/InvariantCheckPrivilege.h   |   1 +
 .../xrpl/tx/invariants/LoanBrokerInvariant.h  |   2 +
 include/xrpl/tx/invariants/LoanInvariant.h    |   3 +
 include/xrpl/tx/invariants/MPTInvariant.h     |   8 +
 include/xrpl/tx/invariants/NFTInvariant.h     |   3 +-
 .../tx/invariants/PermissionedDEXInvariant.h  |   3 +
 .../invariants/PermissionedDomainInvariant.h  |   3 +
 include/xrpl/tx/invariants/VaultInvariant.h   |   5 +
 include/xrpl/tx/paths/AMMLiquidity.h          |  10 +-
 include/xrpl/tx/paths/AMMOffer.h              |   8 +-
 include/xrpl/tx/paths/BookTip.h               |   7 +-
 include/xrpl/tx/paths/Flow.h                  |   7 +
 include/xrpl/tx/paths/Offer.h                 |  12 +-
 include/xrpl/tx/paths/OfferStream.h           |   7 +-
 include/xrpl/tx/paths/RippleCalc.h            |   5 +
 include/xrpl/tx/paths/detail/EitherAmount.h   |   7 +-
 include/xrpl/tx/paths/detail/FlowDebugInfo.h  |  12 +-
 include/xrpl/tx/paths/detail/StepChecks.h     |   6 +
 include/xrpl/tx/paths/detail/Steps.h          |  16 +-
 include/xrpl/tx/paths/detail/StrandFlow.h     |  21 ++-
 .../tx/transactors/account/AccountDelete.h    |   7 +
 .../xrpl/tx/transactors/account/AccountSet.h  |  10 +-
 .../tx/transactors/account/SetRegularKey.h    |   7 +
 .../tx/transactors/account/SignerListSet.h    |   9 +
 .../xrpl/tx/transactors/bridge/XChainBridge.h |  11 +-
 .../xrpl/tx/transactors/check/CheckCancel.h   |   7 +
 include/xrpl/tx/transactors/check/CheckCash.h |   7 +
 .../xrpl/tx/transactors/check/CheckCreate.h   |   7 +
 .../credentials/CredentialAccept.h            |   9 +
 .../credentials/CredentialCreate.h            |   9 +
 .../credentials/CredentialDelete.h            |   9 +
 .../tx/transactors/delegate/DelegateSet.h     |   8 +
 include/xrpl/tx/transactors/dex/AMMBid.h      |   7 +
 include/xrpl/tx/transactors/dex/AMMClawback.h |  13 ++
 include/xrpl/tx/transactors/dex/AMMCreate.h   |   7 +
 include/xrpl/tx/transactors/dex/AMMDelete.h   |   7 +
 include/xrpl/tx/transactors/dex/AMMDeposit.h  |  14 ++
 include/xrpl/tx/transactors/dex/AMMVote.h     |   7 +
 include/xrpl/tx/transactors/dex/AMMWithdraw.h |  18 +-
 include/xrpl/tx/transactors/dex/OfferCancel.h |   8 +-
 include/xrpl/tx/transactors/dex/OfferCreate.h |  20 ++
 include/xrpl/tx/transactors/did/DIDDelete.h   |  10 +
 include/xrpl/tx/transactors/did/DIDSet.h      |   7 +
 .../xrpl/tx/transactors/escrow/EscrowCancel.h |   7 +
 .../xrpl/tx/transactors/escrow/EscrowCreate.h |   7 +
 .../xrpl/tx/transactors/escrow/EscrowFinish.h |   7 +
 .../lending/LoanBrokerCoverClawback.h         |   7 +
 .../lending/LoanBrokerCoverDeposit.h          |   7 +
 .../lending/LoanBrokerCoverWithdraw.h         |   7 +
 .../tx/transactors/lending/LoanBrokerDelete.h |   7 +
 .../tx/transactors/lending/LoanBrokerSet.h    |  10 +
 .../xrpl/tx/transactors/lending/LoanDelete.h  |   7 +
 .../xrpl/tx/transactors/lending/LoanManage.h  |  11 ++
 include/xrpl/tx/transactors/lending/LoanPay.h |   9 +
 include/xrpl/tx/transactors/lending/LoanSet.h |  13 +-
 .../tx/transactors/nft/NFTokenAcceptOffer.h   |  10 +
 include/xrpl/tx/transactors/nft/NFTokenBurn.h |   7 +
 .../tx/transactors/nft/NFTokenCancelOffer.h   |   7 +
 .../tx/transactors/nft/NFTokenCreateOffer.h   |   9 +
 include/xrpl/tx/transactors/nft/NFTokenMint.h |  12 +-
 .../xrpl/tx/transactors/nft/NFTokenModify.h   |   7 +
 .../xrpl/tx/transactors/oracle/OracleDelete.h |   9 +
 .../xrpl/tx/transactors/oracle/OracleSet.h    |   7 +
 .../tx/transactors/payment/DepositPreauth.h   |   9 +
 include/xrpl/tx/transactors/payment/Payment.h |  12 ++
 .../payment_channel/PaymentChannelClaim.h     |   9 +
 .../payment_channel/PaymentChannelCreate.h    |   7 +
 .../payment_channel/PaymentChannelFund.h      |   7 +
 .../PermissionedDomainDelete.h                |   7 +
 .../PermissionedDomainSet.h                   |   7 +
 include/xrpl/tx/transactors/system/Batch.h    |  11 ++
 include/xrpl/tx/transactors/system/Change.h   |   7 +
 .../tx/transactors/system/LedgerStateFix.h    |   9 +
 .../xrpl/tx/transactors/system/TicketCreate.h |   9 +
 include/xrpl/tx/transactors/token/Clawback.h  |   7 +
 .../token/ConfidentialMPTClawback.h           |   9 +
 .../token/ConfidentialMPTConvert.h            |   9 +
 .../token/ConfidentialMPTConvertBack.h        |   9 +
 .../token/ConfidentialMPTMergeInbox.h         |   9 +
 .../transactors/token/ConfidentialMPTSend.h   |   9 +
 .../tx/transactors/token/MPTokenAuthorize.h   |  12 ++
 .../transactors/token/MPTokenIssuanceCreate.h |  13 ++
 .../token/MPTokenIssuanceDestroy.h            |   7 +
 .../tx/transactors/token/MPTokenIssuanceSet.h |   9 +
 include/xrpl/tx/transactors/token/TrustSet.h  |  12 +-
 .../xrpl/tx/transactors/vault/VaultClawback.h |  10 +
 .../xrpl/tx/transactors/vault/VaultCreate.h   |   9 +
 .../xrpl/tx/transactors/vault/VaultDelete.h   |   7 +
 .../xrpl/tx/transactors/vault/VaultDeposit.h  |   7 +
 include/xrpl/tx/transactors/vault/VaultSet.h  |   7 +
 .../xrpl/tx/transactors/vault/VaultWithdraw.h |   7 +
 src/libxrpl/core/detail/JobQueue.cpp          |   1 +
 src/libxrpl/json/json_value.cpp               |   2 +
 src/libxrpl/net/RegisterSSLCerts.cpp          |   2 +
 src/libxrpl/protocol/AMMCore.cpp              |   1 +
 src/libxrpl/protocol/ConfidentialTransfer.cpp |   1 +
 src/libxrpl/protocol/Permissions.cpp          |   1 +
 src/libxrpl/protocol/STNumber.cpp             |   2 +-
 src/libxrpl/server/State.cpp                  |   1 +
 src/libxrpl/server/Wallet.cpp                 |   2 +
 .../PermissionedDomainInvariant.cpp           |   1 +
 .../tx/transactors/dex/OfferCreate.cpp        |   1 +
 .../tx/transactors/nft/NFTokenCreateOffer.cpp |   1 +
 src/libxrpl/tx/transactors/system/Batch.cpp   |   1 +
 src/test/app/FlowMPT_test.cpp                 |   1 +
 src/test/app/LedgerReplay_test.cpp            |   1 +
 src/test/app/MultiSign_test.cpp               |   1 +
 src/test/app/OfferMPT_test.cpp                |   2 +
 src/test/app/PayStrand_test.cpp               |   1 +
 src/test/app/SHAMapStore_test.cpp             |   1 +
 src/test/basics/hardened_hash_test.cpp        |   1 +
 src/test/beast/IPEndpointCommon.h             |   4 +
 .../beast/aged_associative_container_test.cpp |  20 +-
 src/test/core/SociDB_test.cpp                 |   1 +
 src/test/csf.h                                |  19 --
 src/test/csf/BasicNetwork.h                   |   2 +
 src/test/csf/CollectorRef.h                   |   7 +
 src/test/csf/Digraph.h                        |   5 +-
 src/test/csf/Histogram.h                      |   4 +-
 src/test/csf/Peer.h                           |  20 +-
 src/test/csf/PeerGroup.h                      |   9 +
 src/test/csf/Scheduler.h                      |   1 +
 src/test/csf/Sim.h                            |   8 +-
 src/test/csf/TrustGraph.h                     |   6 +-
 src/test/csf/Tx.h                             |   1 +
 src/test/csf/Validation.h                     |   4 +-
 src/test/csf/collectors.h                     |  10 +
 src/test/csf/events.h                         |   5 +-
 src/test/csf/ledgers.h                        |   8 +-
 src/test/csf/random.h                         |   3 +
 src/test/csf/submitters.h                     |   3 +-
 src/test/csf/timers.h                         |   1 +
 src/test/json/TestOutputSuite.h               |   9 +-
 src/test/jtx.h                                |  60 ------
 src/test/jtx/AMM.h                            |  23 ++-
 src/test/jtx/AMMTest.h                        |  12 ++
 src/test/jtx/AbstractClient.h                 |   2 +
 src/test/jtx/Account.h                        |   4 +-
 src/test/jtx/CaptureLogs.h                    |   6 +
 src/test/jtx/CheckMessageLogs.h               |   5 +
 src/test/jtx/ConfidentialTransfer.h           |  22 ---
 src/test/jtx/Env.h                            |  27 ++-
 src/test/jtx/Env_ss.h                         |   6 +
 src/test/jtx/JTx.h                            |   3 +
 src/test/jtx/Oracle.h                         |  21 ++-
 src/test/jtx/PathSet.h                        |  16 +-
 src/test/jtx/TestHelpers.h                    |  33 +++-
 src/test/jtx/TestSuite.h                      |   4 +-
 src/test/jtx/TrustedPublisherServer.h         |  19 ++
 src/test/jtx/WSClient.h                       |   5 +
 src/test/jtx/account_txn_id.h                 |   3 +
 src/test/jtx/acctdelete.h                     |   4 +-
 src/test/jtx/amount.h                         |  14 +-
 src/test/jtx/balance.h                        |   4 +
 src/test/jtx/batch.h                          |  10 +-
 src/test/jtx/check.h                          |   6 +-
 src/test/jtx/credentials.h                    |  13 +-
 src/test/jtx/delegate.h                       |   6 +
 src/test/jtx/delivermin.h                     |   1 +
 src/test/jtx/deposit.h                        |   9 +-
 src/test/jtx/did.h                            |   8 +-
 src/test/jtx/directory.h                      |   6 +-
 src/test/jtx/domain.h                         |   3 +
 src/test/jtx/envconfig.h                      |   5 +
 src/test/jtx/escrow.h                         |  11 +-
 src/test/jtx/fee.h                            |   3 +
 src/test/jtx/flags.h                          |   4 +
 src/test/jtx/impl/Oracle.cpp                  |   1 +
 src/test/jtx/invoice_id.h                     |   3 +
 src/test/jtx/jtx_json.h                       |   3 +
 src/test/jtx/last_ledger_sequence.h           |   3 +
 src/test/jtx/ledgerStateFix.h                 |   4 +-
 src/test/jtx/memo.h                           |   2 +
 src/test/jtx/mpt.h                            |  20 ++
 src/test/jtx/multisign.h                      |  10 +-
 src/test/jtx/noop.h                           |   3 +
 src/test/jtx/offer.h                          |   2 +
 src/test/jtx/owners.h                         |   3 +-
 src/test/jtx/paths.h                          |   7 +-
 src/test/jtx/pay.h                            |   1 +
 src/test/jtx/permissioned_dex.h               |   5 +
 src/test/jtx/permissioned_domains.h           |  12 ++
 src/test/jtx/prop.h                           |   2 +
 src/test/jtx/quality.h                        |   3 +
 src/test/jtx/require.h                        |   1 +
 src/test/jtx/rpc.h                            |   7 +-
 src/test/jtx/sendmax.h                        |   1 +
 src/test/jtx/seq.h                            |   2 +
 src/test/jtx/sig.h                            |   5 +
 src/test/jtx/tag.h                            |   3 +
 src/test/jtx/ter.h                            |   4 +
 src/test/jtx/ticket.h                         |   4 +
 src/test/jtx/token.h                          |   8 +-
 src/test/jtx/trust.h                          |   3 +
 src/test/jtx/txflags.h                        |   3 +
 src/test/jtx/utility.h                        |   4 +-
 src/test/jtx/vault.h                          |   2 +-
 src/test/jtx/xchain_bridge.h                  |   9 +-
 src/test/nodestore/TestBase.h                 |  11 +-
 src/test/protocol/STObject_test.cpp           |   1 +
 src/test/protocol/STParsedJSON_test.cpp       |   1 +
 src/test/rpc/GRPCTestClientBase.h             |  32 ----
 src/test/shamap/common.h                      |  13 ++
 src/test/unit_test/FileDirGuard.h             |   8 +-
 src/test/unit_test/SuiteJournal.h             |   7 +-
 src/test/unit_test/multi_runner.h             |   9 +-
 src/tests/libxrpl/CMakeLists.txt              |   7 +
 src/tests/libxrpl/helpers/IOU.h               |   2 +-
 src/tests/libxrpl/helpers/TestFamily.h        |   9 +
 .../libxrpl/helpers/TestServiceRegistry.h     |   5 +
 src/tests/libxrpl/helpers/TestSink.h          |   2 +
 src/tests/libxrpl/helpers/TxTest.h            |  10 +-
 .../libxrpl/protocol_autogen/TestHelpers.h    |   1 +
 .../app/consensus/RCLCensorshipDetector.h     |   2 +-
 src/xrpld/app/consensus/RCLConsensus.h        |  20 +-
 src/xrpld/app/consensus/RCLCxLedger.h         |   8 +-
 src/xrpld/app/consensus/RCLCxPeerPos.h        |   3 +
 src/xrpld/app/consensus/RCLCxTx.h             |   8 +
 src/xrpld/app/consensus/RCLValidations.h      |  11 ++
 src/xrpld/app/ledger/AcceptedLedger.h         |   5 +
 src/xrpld/app/ledger/AccountStateSF.h         |   6 +
 src/xrpld/app/ledger/BuildLedger.h            |   4 +
 src/xrpld/app/ledger/ConsensusTransSetSF.cpp  |   1 +
 src/xrpld/app/ledger/ConsensusTransSetSF.h    |   7 +
 src/xrpld/app/ledger/InboundLedger.h          |  17 ++
 src/xrpld/app/ledger/InboundLedgers.h         |  14 ++
 src/xrpld/app/ledger/InboundTransactions.h    |   7 +
 src/xrpld/app/ledger/LedgerCleaner.h          |   2 +
 src/xrpld/app/ledger/LedgerHistory.h          |   7 +
 src/xrpld/app/ledger/LedgerHolder.h           |   3 +
 src/xrpld/app/ledger/LedgerMaster.h           |  21 ++-
 src/xrpld/app/ledger/LedgerPersistence.h      |   4 +
 src/xrpld/app/ledger/LedgerReplayTask.h       |   5 +
 src/xrpld/app/ledger/LedgerReplayer.h         |  11 +-
 src/xrpld/app/ledger/LedgerToJson.h           |   8 +-
 src/xrpld/app/ledger/LocalTxs.h               |   3 +
 src/xrpld/app/ledger/OpenLedger.h             |  10 +-
 src/xrpld/app/ledger/OrderBookDBImpl.h        |  11 ++
 src/xrpld/app/ledger/TransactionMaster.h      |   9 +
 src/xrpld/app/ledger/TransactionStateSF.h     |   6 +
 .../app/ledger/detail/LedgerDeltaAcquire.cpp  |   2 +
 .../app/ledger/detail/LedgerDeltaAcquire.h    |  10 +
 src/xrpld/app/ledger/detail/LedgerMaster.cpp  |   1 +
 .../ledger/detail/LedgerReplayMsgHandler.h    |   5 +-
 .../app/ledger/detail/LedgerReplayTask.cpp    |   1 +
 .../app/ledger/detail/SkipListAcquire.cpp     |   2 +
 src/xrpld/app/ledger/detail/SkipListAcquire.h |  12 +-
 src/xrpld/app/ledger/detail/TimeoutCounter.h  |   6 +
 .../app/ledger/detail/TransactionAcquire.h    |  11 ++
 src/xrpld/app/main/Application.cpp            |   1 +
 src/xrpld/app/main/Application.h              |  12 +-
 src/xrpld/app/main/BasicApp.h                 |   1 +
 src/xrpld/app/main/CollectorManager.h         |   7 +-
 src/xrpld/app/main/GRPCServer.cpp             |   1 +
 src/xrpld/app/main/GRPCServer.h               |  15 +-
 src/xrpld/app/main/LoadManager.h              |   2 +-
 src/xrpld/app/main/NodeIdentity.h             |   2 +
 src/xrpld/app/main/NodeStoreScheduler.h       |   1 +
 src/xrpld/app/main/Tuning.h                   |   1 +
 src/xrpld/app/misc/AmendmentTableImpl.h       |   6 +-
 src/xrpld/app/misc/FeeVote.h                  |   6 +
 src/xrpld/app/misc/FeeVoteImpl.cpp            |   1 +
 src/xrpld/app/misc/NegativeUNLVote.h          |   7 +
 src/xrpld/app/misc/SHAMapStore.h              |   7 +-
 src/xrpld/app/misc/SHAMapStoreImp.cpp         |   1 +
 src/xrpld/app/misc/SHAMapStoreImp.h           |  16 ++
 src/xrpld/app/misc/Transaction.h              |   9 +
 src/xrpld/app/misc/TxQ.h                      |  18 ++
 src/xrpld/app/misc/ValidatorKeys.h            |   2 +
 src/xrpld/app/misc/ValidatorList.h            |  17 +-
 src/xrpld/app/misc/ValidatorSite.h            |   9 +-
 src/xrpld/app/misc/detail/AccountTxPaging.h   |   3 +
 src/xrpld/app/misc/detail/ValidatorSite.cpp   |   1 -
 src/xrpld/app/misc/detail/WorkBase.h          |   4 +-
 src/xrpld/app/misc/detail/WorkFile.h          |   3 +
 src/xrpld/app/misc/detail/WorkPlain.h         |   3 +
 src/xrpld/app/misc/detail/WorkSSL.h           |   5 +-
 src/xrpld/app/misc/make_NetworkOPs.h          |   3 +-
 src/xrpld/app/rdb/PeerFinder.h                |   7 +-
 src/xrpld/app/rdb/backend/SQLiteDatabase.h    |  12 ++
 src/xrpld/app/rdb/backend/detail/Node.cpp     |   2 +
 src/xrpld/app/rdb/backend/detail/Node.h       |  24 +++
 src/xrpld/app/rdb/detail/PeerFinder.cpp       |   1 +
 src/xrpld/consensus/Consensus.h               |  11 +-
 src/xrpld/consensus/ConsensusParms.h          |   2 +-
 src/xrpld/consensus/ConsensusProposal.h       |   1 +
 src/xrpld/consensus/ConsensusTypes.h          |   4 +
 src/xrpld/consensus/DisputedTx.h              |   5 +
 src/xrpld/consensus/LedgerTrie.h              |   4 +
 src/xrpld/consensus/Validations.h             |  11 +-
 src/xrpld/core/Config.h                       |   4 +
 src/xrpld/core/TimeKeeper.h                   |   1 +
 src/xrpld/overlay/Cluster.h                   |   5 +
 src/xrpld/overlay/Compression.h               |   4 +
 src/xrpld/overlay/Message.h                   |  11 +-
 src/xrpld/overlay/Overlay.h                   |  11 ++
 src/xrpld/overlay/Peer.h                      |   6 +
 src/xrpld/overlay/PeerSet.h                   |   9 +
 src/xrpld/overlay/ReduceRelayCommon.h         |   2 +
 src/xrpld/overlay/Slot.h                      |  18 +-
 src/xrpld/overlay/Squelch.h                   |   1 +
 src/xrpld/overlay/detail/ConnectAttempt.h     |  12 ++
 src/xrpld/overlay/detail/Handshake.h          |   6 +-
 src/xrpld/overlay/detail/OverlayImpl.h        |  22 ++-
 src/xrpld/overlay/detail/PeerImp.h            |  31 ++++
 src/xrpld/overlay/detail/ProtocolMessage.h    |   9 +-
 src/xrpld/overlay/detail/TrafficCount.h       |   8 +-
 src/xrpld/overlay/detail/TxMetrics.h          |   4 +-
 src/xrpld/overlay/detail/ZeroCopyStream.h     |  11 +-
 src/xrpld/overlay/make_Overlay.h              |   7 +
 src/xrpld/overlay/predicates.h                |   1 +
 src/xrpld/peerfinder/PeerfinderManager.h      |   9 +
 src/xrpld/peerfinder/Slot.h                   |   2 +
 src/xrpld/peerfinder/detail/Bootcache.h       |   1 +
 src/xrpld/peerfinder/detail/Checker.h         |   2 +
 src/xrpld/peerfinder/detail/Counts.h          |   7 +-
 src/xrpld/peerfinder/detail/Fixed.h           |   5 +
 src/xrpld/peerfinder/detail/Handouts.h        |   5 +
 src/xrpld/peerfinder/detail/Livecache.h       |  14 ++
 src/xrpld/peerfinder/detail/Logic.h           |  16 ++
 src/xrpld/peerfinder/detail/SlotImp.h         |   5 +
 src/xrpld/peerfinder/detail/Source.h          |   4 +
 src/xrpld/peerfinder/detail/SourceStrings.h   |   2 +
 src/xrpld/peerfinder/detail/Store.h           |   6 +
 src/xrpld/peerfinder/detail/StoreSqdb.h       |   9 +
 src/xrpld/peerfinder/detail/Tuning.h          |   3 +
 src/xrpld/peerfinder/detail/iosformat.h       |   3 +
 src/xrpld/peerfinder/make_Manager.h           |   4 +
 src/xrpld/perflog/detail/PerfLogImp.cpp       |   3 +
 src/xrpld/perflog/detail/PerfLogImp.h         |   8 +-
 src/xrpld/rpc/BookChanges.h                   |  12 ++
 src/xrpld/rpc/CTID.h                          |   7 +-
 src/xrpld/rpc/Context.h                       |   6 +
 src/xrpld/rpc/DeliveredAmount.h               |   2 +-
 src/xrpld/rpc/GRPCHandlers.h                  |   8 +-
 src/xrpld/rpc/MPTokenIssuanceID.h             |   2 +-
 src/xrpld/rpc/Output.h                        |   9 +-
 src/xrpld/rpc/RPCCall.h                       |   5 +-
 src/xrpld/rpc/RPCHandler.h                    |   5 +
 src/xrpld/rpc/RPCSub.h                        |   3 +
 src/xrpld/rpc/Role.h                          |   4 +-
 src/xrpld/rpc/ServerHandler.h                 |  17 +-
 src/xrpld/rpc/Status.h                        |   7 +
 src/xrpld/rpc/detail/AccountAssets.h          |   6 +-
 src/xrpld/rpc/detail/AssetCache.h             |   6 +-
 src/xrpld/rpc/detail/Handler.h                |  10 +-
 src/xrpld/rpc/detail/MPT.h                    |   2 +-
 src/xrpld/rpc/detail/PathRequest.h            |  16 +-
 src/xrpld/rpc/detail/PathRequestManager.h     |  10 +
 src/xrpld/rpc/detail/Pathfinder.h             |  16 +-
 src/xrpld/rpc/detail/PathfinderUtils.h        |   4 +
 src/xrpld/rpc/detail/RPCHandler.cpp           |   1 +
 src/xrpld/rpc/detail/RPCHelpers.h             |  15 +-
 src/xrpld/rpc/detail/RPCLedgerHelpers.cpp     |   4 +
 src/xrpld/rpc/detail/RPCLedgerHelpers.h       |   9 +-
 src/xrpld/rpc/detail/TransactionSign.h        |   5 +
 src/xrpld/rpc/detail/TrustLine.h              |   7 +-
 src/xrpld/rpc/detail/Tuning.h                 |   2 +
 src/xrpld/rpc/detail/WSInfoSub.h              |   3 +
 src/xrpld/rpc/handlers/Handlers.h             |   2 +
 .../rpc/handlers/account/AccountNFTs.cpp      |   1 +
 .../admin/peer/PeerReservationsDel.cpp        |   1 +
 .../admin/peer/PeerReservationsList.cpp       |   1 +
 .../rpc/handlers/admin/status/GetCounts.h     |   2 +
 src/xrpld/rpc/handlers/ledger/Ledger.h        |   8 +-
 .../rpc/handlers/ledger/LedgerEntryHelpers.h  |  17 +-
 .../rpc/handlers/orderbook/BookChanges.cpp    |   1 +
 .../handlers/orderbook/GetAggregatePrice.cpp  |   1 +
 .../rpc/handlers/orderbook/NFTOffersHelpers.h |  12 +-
 src/xrpld/rpc/handlers/server_info/Version.h  |   7 +
 src/xrpld/rpc/json_body.h                     |   5 +
 src/xrpld/shamap/NodeFamily.cpp               |   1 +
 src/xrpld/shamap/NodeFamily.h                 |   9 +
 662 files changed, 3870 insertions(+), 743 deletions(-)
 create mode 100644 cmake/verify_headers.cmake
 delete mode 100644 include/xrpl/beast/insight/Insight.h
 delete mode 100644 include/xrpl/protocol/st.h
 delete mode 100644 include/xrpl/resource/Types.h
 delete mode 100644 src/test/csf.h
 delete mode 100644 src/test/jtx.h
 delete mode 100644 src/test/rpc/GRPCTestClientBase.h

diff --git a/.clang-tidy b/.clang-tidy
index e12c73cc56..84849db7a0 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -147,7 +147,7 @@ CheckOptions:
   bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
   bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc
 
-  misc-include-cleaner.IgnoreHeaders: ".*/(detail|impl)/.*;.*fwd\\.h(pp)?;time.h;stdlib.h;sqlite3.h;netinet/in\\.h;sys/resource\\.h;sys/sysinfo\\.h;linux/sysinfo\\.h;__chrono/.*;bits/.*;_abort\\.h;boost/uuid/uuid_hash.hpp;boost/beast/core/flat_buffer\\.hpp;boost/beast/http/field\\.hpp;boost/beast/http/dynamic_body\\.hpp;boost/beast/http/message\\.hpp;boost/beast/http/read\\.hpp;boost/beast/http/write\\.hpp;openssl/obj_mac\\.h"
+  misc-include-cleaner.IgnoreHeaders: ".*/(detail|impl)/.*;.*fwd\\.h(pp)?;time.h;stdlib.h;sqlite3.h;netinet/in\\.h;sys/resource\\.h;sys/sysinfo\\.h;linux/sysinfo\\.h;__chrono/.*;bits/.*;_abort\\.h;boost/.*;openssl/obj_mac\\.h"
 
   readability-braces-around-statements.ShortStatementLines: 2
   readability-identifier-naming.MacroDefinitionCase: UPPER_CASE
diff --git a/.gersemi/definitions.cmake b/.gersemi/definitions.cmake
index 58bc74c70a..aa63076c8b 100644
--- a/.gersemi/definitions.cmake
+++ b/.gersemi/definitions.cmake
@@ -48,6 +48,12 @@ endfunction()
 function(add_module parent name)
 endfunction()
 
+function(verify_target_headers target headers_dir)
+endfunction()
+
+function(_verify_add_headers target dir)
+endfunction()
+
 function(setup_protocol_autogen)
 endfunction()
 
diff --git a/.github/scripts/levelization/results/loops.txt b/.github/scripts/levelization/results/loops.txt
index fb449441e3..cf70468e32 100644
--- a/.github/scripts/levelization/results/loops.txt
+++ b/.github/scripts/levelization/results/loops.txt
@@ -1,9 +1,3 @@
-Loop: test.jtx test.toplevel
-  test.toplevel > test.jtx
-
-Loop: test.jtx test.unit_test
-  test.unit_test ~= test.jtx
-
 Loop: xrpld.app xrpld.overlay
   xrpld.app > xrpld.overlay
 
diff --git a/.github/scripts/levelization/results/ordering.txt b/.github/scripts/levelization/results/ordering.txt
index 7b31042158..5cc49dd2f5 100644
--- a/.github/scripts/levelization/results/ordering.txt
+++ b/.github/scripts/levelization/results/ordering.txt
@@ -105,9 +105,9 @@ test.csf > xrpl.basics
 test.csf > xrpld.consensus
 test.csf > xrpl.json
 test.csf > xrpl.ledger
-test.csf > xrpl.protocol
 test.json > test.jtx
 test.json > xrpl.json
+test.jtx > test.unit_test
 test.jtx > xrpl.basics
 test.jtx > xrpl.config
 test.jtx > xrpl.core
@@ -194,8 +194,6 @@ test.shamap > xrpl.config
 test.shamap > xrpl.nodestore
 test.shamap > xrpl.protocol
 test.shamap > xrpl.shamap
-test.toplevel > test.csf
-test.toplevel > xrpl.json
 test.unit_test > xrpl.basics
 test.unit_test > xrpl.protocol
 tests.libxrpl > xrpl.basics
@@ -218,11 +216,14 @@ xrpl.core > xrpl.json
 xrpl.core > xrpl.protocol
 xrpl.json > xrpl.basics
 xrpl.ledger > xrpl.basics
+xrpl.ledger > xrpl.json
+xrpl.ledger > xrpl.nodestore
 xrpl.ledger > xrpl.protocol
 xrpl.ledger > xrpl.shamap
 xrpl.net > xrpl.basics
 xrpl.nodestore > xrpl.basics
 xrpl.nodestore > xrpl.config
+xrpl.nodestore > xrpl.json
 xrpl.nodestore > xrpl.protocol
 xrpl.protocol > xrpl.basics
 xrpl.protocol > xrpl.json
@@ -240,7 +241,6 @@ xrpl.server > xrpl.json
 xrpl.server > xrpl.protocol
 xrpl.server > xrpl.rdb
 xrpl.server > xrpl.resource
-xrpl.server > xrpl.shamap
 xrpl.shamap > xrpl.basics
 xrpl.shamap > xrpl.nodestore
 xrpl.shamap > xrpl.protocol
@@ -295,8 +295,10 @@ xrpld.peerfinder > xrpl.rdb
 xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config
 xrpld.perflog > xrpl.core
+xrpld.perflog > xrpld.app
 xrpld.perflog > xrpld.rpc
 xrpld.perflog > xrpl.json
+xrpld.perflog > xrpl.nodestore
 xrpld.perflog > xrpl.protocol
 xrpld.rpc > xrpl.basics
 xrpld.rpc > xrpl.config
@@ -314,5 +316,6 @@ xrpld.rpc > xrpl.shamap
 xrpld.rpc > xrpl.tx
 xrpld.shamap > xrpl.basics
 xrpld.shamap > xrpld.core
+xrpld.shamap > xrpl.nodestore
 xrpld.shamap > xrpl.protocol
 xrpld.shamap > xrpl.shamap
diff --git a/.github/workflows/reusable-clang-tidy.yml b/.github/workflows/reusable-clang-tidy.yml
index 5528f3452e..a6bbe669ce 100644
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -79,6 +79,7 @@ jobs:
               -Dtests=ON \
               -Dwerr=ON \
               -Dxrpld=ON \
+              -Dverify_headers=ON \
               ..
 
       # clang-tidy needs headers generated from proto files
@@ -91,7 +92,7 @@ jobs:
         id: run_clang_tidy
         continue-on-error: true
         env:
-          TARGETS: ${{ needs.determine-files.outputs.need_full_run != 'true' && needs.determine-files.outputs.cpp_changed_files || 'src tests' }}
+          TARGETS: ${{ needs.determine-files.outputs.need_full_run != 'true' && needs.determine-files.outputs.cpp_changed_files || 'include src tests' }}
         run: |
           set -o pipefail
           run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 7bac4d1140..2e4521870d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -28,8 +28,10 @@ repos:
         entry: ./bin/pre-commit/clang_tidy_check.py
         language: python
         types_or: [c++, c]
-        exclude: ^include/xrpl/protocol_autogen
-        pass_filenames: false # script determines the staged files itself
+        # .ipp fragments are included by their owning header rather than compiled
+        # as standalone translation units, so they have no compile_commands.json
+        # entry to lint (verify_headers checks them transitively).
+        exclude: '^include/xrpl/protocol_autogen|\.ipp$'
       - id: fix-include-style
         name: fix include style
         entry: ./bin/pre-commit/fix_include_style.py
diff --git a/BUILD.md b/BUILD.md
index 847cd7bc1a..6ccdde12d5 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -317,21 +317,41 @@ See [Sanitizers docs](./docs/build/sanitizers.md) for more details.
 
 ## Options
 
-| Option     | Default Value | Description                                                    |
-| ---------- | ------------- | -------------------------------------------------------------- |
-| `assert`   | OFF           | Force enabling assertions.                                     |
-| `coverage` | OFF           | Prepare the coverage report.                                   |
-| `tests`    | OFF           | Build tests.                                                   |
-| `unity`    | OFF           | Configure a unity build.                                       |
-| `xrpld`    | OFF           | Build the xrpld application, and not just the libxrpl library. |
-| `werr`     | OFF           | Treat compilation warnings as errors                           |
-| `wextra`   | OFF           | Enable additional compilation warnings                         |
+| Option           | Default Value | Description                                                                   |
+| ---------------- | ------------- | ----------------------------------------------------------------------------- |
+| `assert`         | OFF           | Force enabling assertions.                                                    |
+| `coverage`       | OFF           | Prepare the coverage report.                                                  |
+| `tests`          | OFF           | Build tests.                                                                  |
+| `unity`          | OFF           | Configure a unity build.                                                      |
+| `verify_headers` | ON            | Make the `verify-headers` target available to compile each header on its own. |
+| `xrpld`          | OFF           | Build the xrpld application, and not just the libxrpl library.                |
+| `werr`           | OFF           | Treat compilation warnings as errors                                          |
+| `wextra`         | OFF           | Enable additional compilation warnings                                        |
 
 [Unity builds][unity-build] may be faster for the first build (at the cost of much more
 memory) since they concatenate sources into fewer translation units. Non-unity
 builds may be faster for incremental builds, and can be helpful for detecting
 `#include` omissions.
 
+### Verifying headers
+
+The regular build only compiles `.cpp` files, so a header is only ever checked
+through whatever translation unit happens to include it. A header that forgets
+an `#include` is not caught as long as every `.cpp` that uses it includes its
+missing dependency first. The `verify_headers` option (ON by default) adds a
+`verify-headers` target that compiles every header on its own, which fails if a
+header is not self-contained:
+
+```bash
+cmake --build . --target verify-headers
+```
+
+The per-header objects are excluded from the `all` target, so a normal build
+never compiles them; they are built only through `verify-headers`. The generated
+translation units do appear in `compile_commands.json`, so clang-tidy (and
+clangd and IDEs) can lint each header on its own. Pass `-Dverify_headers=OFF` to
+omit them entirely.
+
 ## Troubleshooting
 
 ### Conan
diff --git a/bin/pre-commit/clang_tidy_check.py b/bin/pre-commit/clang_tidy_check.py
index f134660671..d074c56acf 100755
--- a/bin/pre-commit/clang_tidy_check.py
+++ b/bin/pre-commit/clang_tidy_check.py
@@ -1,21 +1,22 @@
 #!/usr/bin/env python3
-"""Pre-commit hook that runs clang-tidy on changed files using run-clang-tidy."""
+"""Pre-commit hook that runs clang-tidy on changed files using run-clang-tidy.
+
+The set of files is chosen by pre-commit (see .pre-commit-config.yaml), which
+filters to C/C++ sources and excludes `.ipp` fragments. Headers are linted
+directly: the `verify_headers` build option (ON by default) compiles every
+`.h`/`.hpp` on its own, so each header is the main file of its own
+compile_commands.json entry and run-clang-tidy can analyse it just like a
+`.cpp`.
+"""
 
 from __future__ import annotations
 
-import json
 import os
-import re
 import shutil
 import subprocess
 import sys
-from collections import defaultdict
 from pathlib import Path
 
-HEADER_EXTENSIONS = {".h", ".hpp", ".ipp"}
-SOURCE_EXTENSIONS = {".cpp"}
-INCLUDE_RE = re.compile(r"^\s*#\s*include\s*[<\"]([^>\"]+)[>\"]")
-
 
 def find_run_clang_tidy() -> str | None:
     for candidate in ("run-clang-tidy-21", "run-clang-tidy"):
@@ -32,150 +33,11 @@ def find_build_dir(repo_root: Path) -> Path | None:
     return None
 
 
-def build_include_graph(build_dir: Path, repo_root: Path) -> tuple[dict, set]:
-    """
-    Scan all files reachable from compile_commands.json and build an inverted include graph.
-
-    Returns:
-        inverted: header_path -> set of files that include it
-        source_files: set of all TU paths from compile_commands.json
-    """
-    with open(build_dir / "compile_commands.json") as f:
-        db = json.load(f)
-
-    source_files = {Path(e["file"]).resolve() for e in db}
-    include_roots = [repo_root / "include", repo_root / "src"]
-    inverted: dict[Path, set[Path]] = defaultdict(set)
-
-    to_scan: set[Path] = set(source_files)
-    scanned: set[Path] = set()
-
-    while to_scan:
-        file = to_scan.pop()
-        if file in scanned or not file.exists():
-            continue
-        scanned.add(file)
-
-        content = file.read_text()
-
-        for line in content.splitlines():
-            m = INCLUDE_RE.match(line)
-            if not m:
-                continue
-            for root in include_roots:
-                candidate = (root / m.group(1)).resolve()
-                if candidate.exists():
-                    inverted[candidate].add(file)
-                    if candidate not in scanned:
-                        to_scan.add(candidate)
-                    break
-
-    return inverted, source_files
-
-
-def find_tus_for_headers(
-    headers: list[Path],
-    inverted: dict[Path, set[Path]],
-    source_files: set[Path],
-) -> set[Path]:
-    """
-    For each header, pick one TU that transitively includes it.
-    Prefers a TU whose stem matches the header's stem, otherwise picks the first found.
-    """
-    result: set[Path] = set()
-
-    for header in headers:
-        preferred: Path | None = None
-        visited: set[Path] = {header}
-        stack: list[Path] = [header]
-
-        while stack:
-            h = stack.pop()
-            for inc in inverted.get(h, ()):
-                if inc in source_files:
-                    if inc.stem == header.stem:
-                        preferred = inc
-                        break
-                    if preferred is None:
-                        preferred = inc
-                if inc not in visited:
-                    visited.add(inc)
-                    stack.append(inc)
-            if preferred is not None and preferred.stem == header.stem:
-                break
-
-        if preferred is not None:
-            result.add(preferred)
-
-    return result
-
-
-def resolve_files(
-    input_files: list[str], build_dir: Path, repo_root: Path
-) -> list[str]:
-    """
-    Split input into source files and headers. Source files are passed through;
-    headers are resolved to the TUs that transitively include them.
-    """
-    sources: list[Path] = []
-    headers: list[Path] = []
-
-    for f in input_files:
-        p = Path(f).resolve()
-        if p.suffix in SOURCE_EXTENSIONS:
-            sources.append(p)
-        elif p.suffix in HEADER_EXTENSIONS:
-            headers.append(p)
-
-    if not headers:
-        return [str(p) for p in sources]
-
-    print(
-        f"Resolving {len(headers)} header(s) to compilation units...", file=sys.stderr
-    )
-    inverted, source_files = build_include_graph(build_dir, repo_root)
-    tus = find_tus_for_headers(headers, inverted, source_files)
-
-    if not tus:
-        print(
-            "Warning: no compilation units found that include the modified headers; "
-            "skipping clang-tidy for headers.",
-            file=sys.stderr,
-        )
-
-    return sorted({str(p) for p in (*sources, *tus)})
-
-
-def staged_files(repo_root: Path) -> list[str]:
-    result = subprocess.run(
-        ["git", "diff", "--staged", "--name-only", "--diff-filter=d"],
-        capture_output=True,
-        text=True,
-        cwd=repo_root,
-    )
-    if result.returncode != 0:
-        print(
-            "clang-tidy check failed: 'git diff --staged' command failed.",
-            file=sys.stderr,
-        )
-        if result.stderr:
-            print(result.stderr, file=sys.stderr)
-        sys.exit(result.returncode or 1)
-    return [str(repo_root / p) for p in result.stdout.splitlines() if p]
-
-
 def main():
     if not os.environ.get("TIDY"):
         return 0
 
-    repo_root = Path(
-        subprocess.check_output(
-            ["git", "rev-parse", "--show-toplevel"],
-            cwd=Path(__file__).parent,
-            text=True,
-        ).strip()
-    )
-    files = staged_files(repo_root)
+    files = sys.argv[1:]
     if not files:
         return 0
 
@@ -188,6 +50,13 @@ def main():
         )
         return 1
 
+    repo_root = Path(
+        subprocess.check_output(
+            ["git", "rev-parse", "--show-toplevel"],
+            cwd=Path(__file__).parent,
+            text=True,
+        ).strip()
+    )
     build_dir = find_build_dir(repo_root)
     if not build_dir:
         print(
@@ -197,13 +66,9 @@ def main():
         )
         return 1
 
-    tidy_files = resolve_files(files, build_dir, repo_root)
-    if not tidy_files:
-        return 0
-
     result = subprocess.run(
         [run_clang_tidy, "-quiet", "-p", str(build_dir), "-fix", "-allow-no-checks"]
-        + tidy_files
+        + files
     )
     return result.returncode
 
diff --git a/cmake/XrplCore.cmake b/cmake/XrplCore.cmake
index 4d4a800d9a..3e49267715 100644
--- a/cmake/XrplCore.cmake
+++ b/cmake/XrplCore.cmake
@@ -293,4 +293,13 @@ if(xrpld)
             PRIVATE ${CMAKE_SOURCE_DIR}/external/antithesis-sdk
         )
     endif()
+
+    # The xrpld headers are not built with add_module, so verify them against
+    # the executable's own compile environment.
+    if(verify_headers)
+        verify_target_headers(xrpld "${CMAKE_CURRENT_SOURCE_DIR}/src/xrpld")
+        if(tests)
+            verify_target_headers(xrpld "${CMAKE_CURRENT_SOURCE_DIR}/src/test")
+        endif()
+    endif()
 endif()
diff --git a/cmake/XrplSettings.cmake b/cmake/XrplSettings.cmake
index 44a727a994..757a596096 100644
--- a/cmake/XrplSettings.cmake
+++ b/cmake/XrplSettings.cmake
@@ -30,6 +30,23 @@ if(tests)
     endif()
 endif()
 
+# Enabled by default so every header is compiled on its own as the main file of
+# its own compile_commands.json entry - this is what lets clang-tidy (and clangd
+# and IDEs) analyse a header's own includes directly. The per-header objects are
+# EXCLUDE_FROM_ALL (see cmake/verify_headers.cmake) and the aggregate target
+# below is not part of `all`, so a normal `cmake --build` never compiles them.
+option(
+    verify_headers
+    "Compile every header on its own to verify it is self-contained."
+    ON
+)
+if(verify_headers)
+    # Aggregate target that builds every per-module header-verification library
+    # created by add_module (see cmake/verify_headers.cmake). Build it with:
+    #   cmake --build . --target verify-headers
+    add_custom_target(verify-headers)
+endif()
+
 option(unity "Creates a build using UNITY support in cmake." OFF)
 if(unity)
     if(NOT is_ci)
diff --git a/cmake/add_module.cmake b/cmake/add_module.cmake
index 316d6c627b..b72d1077bb 100644
--- a/cmake/add_module.cmake
+++ b/cmake/add_module.cmake
@@ -1,4 +1,5 @@
 include(isolate_headers)
+include(verify_headers)
 
 # Create an OBJECT library target named
 #
@@ -37,4 +38,20 @@ function(add_module parent name)
         "${CMAKE_CURRENT_SOURCE_DIR}/src/lib${parent}/${name}"
         PRIVATE
     )
+    # protocol_autogen contains generated headers that are deliberately exempt
+    # from clang-tidy (see ExcludeHeaderFilterRegex in .clang-tidy), so we do not
+    # verify them either.
+    if(
+        verify_headers
+        AND NOT "${parent}/${name}" STREQUAL "xrpl/protocol_autogen"
+    )
+        verify_target_headers(
+            ${target}
+            "${CMAKE_CURRENT_SOURCE_DIR}/include/${parent}/${name}"
+        )
+        verify_target_headers(
+            ${target}
+            "${CMAKE_CURRENT_SOURCE_DIR}/src/lib${parent}/${name}"
+        )
+    endif()
 endfunction()
diff --git a/cmake/verify_headers.cmake b/cmake/verify_headers.cmake
new file mode 100644
index 0000000000..2c36869441
--- /dev/null
+++ b/cmake/verify_headers.cmake
@@ -0,0 +1,84 @@
+# Our normal build only ever compiles `.cpp` files, so a header is only ever
+# checked through whatever translation unit happens to include it. A header that
+# is missing an `#include` is never caught as long as every `.cpp` that uses it
+# includes its missing dependency first. To check a header on its own we compile
+# it directly as a translation unit.
+#
+# Compiling the header itself - rather than a `.cpp` wrapper that includes it -
+# gives two checks at once:
+#   * the compiler fails if the header is not self-contained, i.e. it uses a
+#     declaration that is not available (directly or transitively); and
+#   * the header is the *main file* of its `compile_commands.json` entry, so
+#     clang-tidy's misc-include-cleaner analyses (and can --fix) the header's own
+#     includes - flagging a dependency that is only available transitively, which
+#     a plain compile cannot catch. A wrapper would be the main file instead, and
+#     include-cleaner never looks inside the headers a main file includes.
+#
+# The objects are never linked anywhere; we build them only for these checks.
+
+# Verify that the headers under headers_dir compile on their own, using the
+# compile environment of an existing target so each header is compiled exactly as
+# that target compiles it. This works for both add_module libraries and the xrpld
+# and test binaries: a library's isolated public and private include directories
+# and a binary's `-I src` both live in its INCLUDE_DIRECTORIES, and the modules or
+# libraries it links live in its LINK_LIBRARIES. We copy those usage requirements
+# through generator expressions (rather than linking ${target}, which is
+# impossible for an executable), evaluated at generation time so they capture
+# requirements the caller adds after this runs. The verify library is created
+# once; call this repeatedly to add more header directories.
+#
+# verify_target_headers(target headers_dir)
+function(verify_target_headers target headers_dir)
+    set(verify ${target}.verify)
+    if(NOT TARGET ${verify})
+        add_library(${verify} OBJECT EXCLUDE_FROM_ALL)
+        # A unity build would concatenate the headers into a single translation
+        # unit, where a header missing an include could be satisfied by one that
+        # precedes it in the blob - exactly the bug we want to catch.
+        set_target_properties(${verify} PROPERTIES UNITY_BUILD OFF)
+        target_include_directories(
+            ${verify}
+            PRIVATE $<TARGET_PROPERTY:${target},INCLUDE_DIRECTORIES>
+        )
+        target_compile_definitions(
+            ${verify}
+            PRIVATE $<TARGET_PROPERTY:${target},COMPILE_DEFINITIONS>
+        )
+        target_compile_options(
+            ${verify}
+            PRIVATE $<TARGET_PROPERTY:${target},COMPILE_OPTIONS>
+        )
+        target_link_libraries(
+            ${verify}
+            PRIVATE $<TARGET_PROPERTY:${target},LINK_LIBRARIES>
+        )
+        add_dependencies(verify-headers ${verify})
+    endif()
+    _verify_add_headers(${verify} "${headers_dir}")
+endfunction()
+
+# Add every .h/.hpp under dir to target as a directly-compiled C++ translation
+# unit. .ipp files are inline-implementation fragments included by their owning
+# header (often after a class declaration), so they are not self-contained on
+# their own and are verified transitively when that header is verified.
+function(_verify_add_headers target dir)
+    file(GLOB_RECURSE headers CONFIGURE_DEPENDS "${dir}/*.h" "${dir}/*.hpp")
+    if(NOT headers)
+        return()
+    endif()
+    # `-xc++` forces the header to be compiled as a C++ translation unit; a lone
+    # `.h` is otherwise treated as a header to precompile. `#pragma once` is
+    # harmless (and warns) when the header is the main file, so silence it.
+    # Compiled on its own, a header legitimately defines constants and static or
+    # template functions that nothing in this single translation unit uses (they
+    # exist for the files that include it), so the resulting unused-entity
+    # warnings are expected and must not fail the build under -Werror.
+    set_source_files_properties(
+        ${headers}
+        PROPERTIES
+            LANGUAGE CXX
+            COMPILE_OPTIONS
+                "-xc++;-Wno-pragma-once-outside-header;-Wno-unused-const-variable;-Wno-unused-function"
+    )
+    target_sources(${target} PRIVATE ${headers})
+endfunction()
diff --git a/include/xrpl/basics/Buffer.h b/include/xrpl/basics/Buffer.h
index 59968a4fa4..c0ae8ef56e 100644
--- a/include/xrpl/basics/Buffer.h
+++ b/include/xrpl/basics/Buffer.h
@@ -6,6 +6,7 @@
 #include <cstdint>
 #include <cstring>
 #include <memory>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/CompressionAlgorithms.h b/include/xrpl/basics/CompressionAlgorithms.h
index e24c490337..a5ec8645b6 100644
--- a/include/xrpl/basics/CompressionAlgorithms.h
+++ b/include/xrpl/basics/CompressionAlgorithms.h
@@ -5,6 +5,7 @@
 #include <lz4.h>
 
 #include <algorithm>
+#include <cstddef>
 #include <cstdint>
 #include <stdexcept>
 #include <vector>
diff --git a/include/xrpl/basics/DecayingSample.h b/include/xrpl/basics/DecayingSample.h
index 910c8f9e14..86a8baa62e 100644
--- a/include/xrpl/basics/DecayingSample.h
+++ b/include/xrpl/basics/DecayingSample.h
@@ -2,6 +2,7 @@
 
 #include <chrono>
 #include <cmath>
+#include <cstddef>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/FileUtilities.h b/include/xrpl/basics/FileUtilities.h
index 8cf7e4893f..c7a427b8a9 100644
--- a/include/xrpl/basics/FileUtilities.h
+++ b/include/xrpl/basics/FileUtilities.h
@@ -3,7 +3,9 @@
 #include <boost/filesystem.hpp>
 #include <boost/system/error_code.hpp>
 
+#include <cstddef>
 #include <optional>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/IntrusivePointer.h b/include/xrpl/basics/IntrusivePointer.h
index d66c340d3f..c23d6afb85 100644
--- a/include/xrpl/basics/IntrusivePointer.h
+++ b/include/xrpl/basics/IntrusivePointer.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <concepts>
+#include <cstddef>
 #include <cstdint>
 #include <type_traits>
 #include <utility>
diff --git a/include/xrpl/basics/IntrusiveRefCounts.h b/include/xrpl/basics/IntrusiveRefCounts.h
index 0b00f1d5b1..5eb1422541 100644
--- a/include/xrpl/basics/IntrusiveRefCounts.h
+++ b/include/xrpl/basics/IntrusiveRefCounts.h
@@ -3,6 +3,7 @@
 #include <xrpl/beast/utility/instrumentation.h>
 
 #include <atomic>
+#include <cstddef>
 #include <cstdint>
 
 namespace xrpl {
diff --git a/include/xrpl/basics/Log.h b/include/xrpl/basics/Log.h
index 0699cdd3d9..4e3437fe71 100644
--- a/include/xrpl/basics/Log.h
+++ b/include/xrpl/basics/Log.h
@@ -1,6 +1,5 @@
 #pragma once
 
-#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/beast/utility/Journal.h>
 
 #include <boost/beast/core/string.hpp>
@@ -11,7 +10,9 @@
 #include <memory>
 #include <mutex>
 #include <optional>
+#include <string>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/Number.h b/include/xrpl/basics/Number.h
index cee0c45355..073da12f89 100644
--- a/include/xrpl/basics/Number.h
+++ b/include/xrpl/basics/Number.h
@@ -2,7 +2,9 @@
 
 #include <xrpl/beast/utility/instrumentation.h>
 
+#include <algorithm>
 #include <array>
+#include <cstddef>
 #include <cstdint>
 #include <functional>
 #include <limits>
@@ -11,7 +13,9 @@
 #include <set>
 #include <stdexcept>
 #include <string>
+#include <type_traits>
 #include <unordered_map>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/RangeSet.h b/include/xrpl/basics/RangeSet.h
index e1cee8b6c4..2ed543b376 100644
--- a/include/xrpl/basics/RangeSet.h
+++ b/include/xrpl/basics/RangeSet.h
@@ -6,6 +6,7 @@
 #include <boost/icl/closed_interval.hpp>
 #include <boost/icl/interval_set.hpp>
 
+#include <functional>
 #include <optional>
 #include <string>
 #include <vector>
diff --git a/include/xrpl/basics/Resolver.h b/include/xrpl/basics/Resolver.h
index 3b6a950247..d48958b76d 100644
--- a/include/xrpl/basics/Resolver.h
+++ b/include/xrpl/basics/Resolver.h
@@ -3,6 +3,7 @@
 #include <xrpl/beast/net/IPEndpoint.h>
 
 #include <functional>
+#include <string>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/basics/ResolverAsio.h b/include/xrpl/basics/ResolverAsio.h
index 2764777327..0b78b9747c 100644
--- a/include/xrpl/basics/ResolverAsio.h
+++ b/include/xrpl/basics/ResolverAsio.h
@@ -5,6 +5,8 @@
 
 #include <boost/asio/io_context.hpp>
 
+#include <memory>
+
 namespace xrpl {
 
 class ResolverAsio : public Resolver
diff --git a/include/xrpl/basics/SHAMapHash.h b/include/xrpl/basics/SHAMapHash.h
index 76d9d4fa3d..3c3d525022 100644
--- a/include/xrpl/basics/SHAMapHash.h
+++ b/include/xrpl/basics/SHAMapHash.h
@@ -3,7 +3,9 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/partitioned_unordered_map.h>
 
+#include <cstddef>
 #include <ostream>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/SharedWeakCachePointer.h b/include/xrpl/basics/SharedWeakCachePointer.h
index c2c3239eea..a143647a1e 100644
--- a/include/xrpl/basics/SharedWeakCachePointer.h
+++ b/include/xrpl/basics/SharedWeakCachePointer.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include <concepts>
+#include <cstddef>
 #include <memory>
 #include <variant>
 
diff --git a/include/xrpl/basics/SlabAllocator.h b/include/xrpl/basics/SlabAllocator.h
index 0172b1ade2..8e741991f6 100644
--- a/include/xrpl/basics/SlabAllocator.h
+++ b/include/xrpl/basics/SlabAllocator.h
@@ -15,6 +15,7 @@
 #include <cstdint>
 #include <cstring>
 #include <mutex>
+#include <stdexcept>
 #include <vector>
 
 #if BOOST_OS_LINUX
diff --git a/include/xrpl/basics/StringUtilities.h b/include/xrpl/basics/StringUtilities.h
index 1d3434b7ed..97df43d68f 100644
--- a/include/xrpl/basics/StringUtilities.h
+++ b/include/xrpl/basics/StringUtilities.h
@@ -1,18 +1,19 @@
 #pragma once
 
 #include <xrpl/basics/Blob.h>
-#include <xrpl/basics/strHex.h>
 
 #include <boost/format.hpp>
 #include <boost/utility/string_view.hpp>
 
 #include <array>
 #include <concepts>
+#include <cstddef>
 #include <cstdint>
 #include <optional>
 #include <string>
 #include <string_view>
 #include <type_traits>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/TaggedCache.h b/include/xrpl/basics/TaggedCache.h
index 973fcd828a..71ebfc57a4 100644
--- a/include/xrpl/basics/TaggedCache.h
+++ b/include/xrpl/basics/TaggedCache.h
@@ -1,17 +1,24 @@
 #pragma once
 
-#include <xrpl/basics/IntrusivePointer.h>
-#include <xrpl/basics/Log.h>
-#include <xrpl/basics/SharedWeakCachePointer.ipp>
+#include <xrpl/basics/SharedWeakCachePointer.h>
+#include <xrpl/basics/SharedWeakCachePointer.ipp>  // IWYU pragma: keep
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/hardened_hash.h>
 #include <xrpl/beast/clock/abstract_clock.h>
-#include <xrpl/beast/insight/Insight.h>
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/insight/Gauge.h>
+#include <xrpl/beast/insight/Hook.h>
+#include <xrpl/beast/insight/NullCollector.h>
+#include <xrpl/beast/utility/Journal.h>
 
 #include <atomic>
+#include <chrono>
 #include <cstddef>
+#include <cstdint>
 #include <functional>
+#include <memory>
 #include <mutex>
+#include <string>
 #include <thread>
 #include <type_traits>
 #include <vector>
diff --git a/include/xrpl/basics/TaggedCache.ipp b/include/xrpl/basics/TaggedCache.ipp
index 7e812ce4c7..ffcd533216 100644
--- a/include/xrpl/basics/TaggedCache.ipp
+++ b/include/xrpl/basics/TaggedCache.ipp
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <xrpl/basics/IntrusivePointer.ipp>
+#include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
 
 namespace xrpl {
diff --git a/include/xrpl/basics/UnorderedContainers.h b/include/xrpl/basics/UnorderedContainers.h
index 5a417d5045..e0700c4055 100644
--- a/include/xrpl/basics/UnorderedContainers.h
+++ b/include/xrpl/basics/UnorderedContainers.h
@@ -2,12 +2,14 @@
 
 #include <xrpl/basics/hardened_hash.h>
 #include <xrpl/basics/partitioned_unordered_map.h>
-#include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/hash/xxhasher.h>
 
+#include <functional>
+#include <memory>
 #include <unordered_map>
 #include <unordered_set>
+#include <utility>
 
 /**
  * Use hash_* containers for keys that do not need a cryptographically secure
diff --git a/include/xrpl/basics/base64.h b/include/xrpl/basics/base64.h
index 660958ce14..24fd660e65 100644
--- a/include/xrpl/basics/base64.h
+++ b/include/xrpl/basics/base64.h
@@ -34,6 +34,7 @@
 
 #pragma once
 
+#include <cstddef>
 #include <cstdint>
 #include <string>
 #include <string_view>
diff --git a/include/xrpl/basics/base_uint.h b/include/xrpl/basics/base_uint.h
index 93520ff699..e6ca1993f9 100644
--- a/include/xrpl/basics/base_uint.h
+++ b/include/xrpl/basics/base_uint.h
@@ -10,6 +10,7 @@
 #include <xrpl/basics/hardened_hash.h>
 #include <xrpl/basics/partitioned_unordered_map.h>
 #include <xrpl/basics/strHex.h>
+#include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
@@ -18,8 +19,17 @@
 
 #include <algorithm>
 #include <array>
+#include <compare>
+#include <cstddef>
+#include <cstdint>
 #include <cstring>
 #include <expected>
+#include <iterator>
+#include <optional>
+#include <ostream>
+#include <stdexcept>
+#include <string>
+#include <string_view>
 #include <type_traits>
 
 namespace xrpl {
diff --git a/include/xrpl/basics/chrono.h b/include/xrpl/basics/chrono.h
index 5d6de06248..61246fc699 100644
--- a/include/xrpl/basics/chrono.h
+++ b/include/xrpl/basics/chrono.h
@@ -10,6 +10,7 @@
 #include <cstdint>
 #include <ratio>
 #include <string>
+#include <type_traits>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/hardened_hash.h b/include/xrpl/basics/hardened_hash.h
index b8ea1e0f3f..5a855736b3 100644
--- a/include/xrpl/basics/hardened_hash.h
+++ b/include/xrpl/basics/hardened_hash.h
@@ -1,6 +1,5 @@
 #pragma once
 
-#include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/hash/xxhasher.h>
 
 #include <cstdint>
diff --git a/include/xrpl/basics/join.h b/include/xrpl/basics/join.h
index c214212473..492e4f3122 100644
--- a/include/xrpl/basics/join.h
+++ b/include/xrpl/basics/join.h
@@ -1,7 +1,9 @@
 #pragma once
 
+#include <cstddef>
 #include <string>
 #include <string_view>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/basics/make_SSLContext.h b/include/xrpl/basics/make_SSLContext.h
index 46f6a15e84..45ac637c36 100644
--- a/include/xrpl/basics/make_SSLContext.h
+++ b/include/xrpl/basics/make_SSLContext.h
@@ -2,6 +2,7 @@
 
 #include <boost/asio/ssl/context.hpp>
 
+#include <memory>
 #include <string>
 
 namespace xrpl {
diff --git a/include/xrpl/basics/partitioned_unordered_map.h b/include/xrpl/basics/partitioned_unordered_map.h
index c51cedf2dd..c2750a5769 100644
--- a/include/xrpl/basics/partitioned_unordered_map.h
+++ b/include/xrpl/basics/partitioned_unordered_map.h
@@ -3,7 +3,10 @@
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
+#include <cstddef>
 #include <functional>
+#include <iterator>
+#include <memory>
 #include <optional>
 #include <string>
 #include <thread>
diff --git a/include/xrpl/basics/random.h b/include/xrpl/basics/random.h
index 0b298e12d9..cceaa6f029 100644
--- a/include/xrpl/basics/random.h
+++ b/include/xrpl/basics/random.h
@@ -3,7 +3,6 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/beast/xor_shift_engine.h>
 
-#include <cstddef>
 #include <cstdint>
 #include <limits>
 #include <mutex>
diff --git a/include/xrpl/basics/safe_cast.h b/include/xrpl/basics/safe_cast.h
index f71edc47ad..714146e089 100644
--- a/include/xrpl/basics/safe_cast.h
+++ b/include/xrpl/basics/safe_cast.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <xrpl/beast/utility/instrumentation.h>
-
 #include <type_traits>
 
 namespace xrpl {
diff --git a/include/xrpl/basics/strHex.h b/include/xrpl/basics/strHex.h
index 9cae234f06..1366515bd3 100644
--- a/include/xrpl/basics/strHex.h
+++ b/include/xrpl/basics/strHex.h
@@ -3,6 +3,9 @@
 #include <boost/algorithm/hex.hpp>
 #include <boost/endian/conversion.hpp>
 
+#include <iterator>
+#include <string>
+
 namespace xrpl {
 
 template <class FwdIt>
diff --git a/include/xrpl/basics/tagged_integer.h b/include/xrpl/basics/tagged_integer.h
index ddcde479f3..8fbd2a274b 100644
--- a/include/xrpl/basics/tagged_integer.h
+++ b/include/xrpl/basics/tagged_integer.h
@@ -7,6 +7,7 @@
 #include <boost/operators.hpp>
 
 #include <iostream>
+#include <string>
 #include <type_traits>
 
 namespace xrpl {
diff --git a/include/xrpl/beast/asio/io_latency_probe.h b/include/xrpl/beast/asio/io_latency_probe.h
index 5e1b098dcb..f67ff4a692 100644
--- a/include/xrpl/beast/asio/io_latency_probe.h
+++ b/include/xrpl/beast/asio/io_latency_probe.h
@@ -8,6 +8,7 @@
 
 #include <chrono>
 #include <condition_variable>
+#include <cstddef>
 #include <mutex>
 #include <stdexcept>
 
diff --git a/include/xrpl/beast/container/aged_container_utility.h b/include/xrpl/beast/container/aged_container_utility.h
index 879672e9cf..7cda863fab 100644
--- a/include/xrpl/beast/container/aged_container_utility.h
+++ b/include/xrpl/beast/container/aged_container_utility.h
@@ -3,6 +3,7 @@
 #include <xrpl/beast/container/aged_container.h>
 
 #include <chrono>
+#include <cstddef>
 #include <type_traits>
 
 namespace beast {
diff --git a/include/xrpl/beast/container/aged_map.h b/include/xrpl/beast/container/aged_map.h
index c1f6943451..20daab70a4 100644
--- a/include/xrpl/beast/container/aged_map.h
+++ b/include/xrpl/beast/container/aged_map.h
@@ -5,6 +5,7 @@
 #include <chrono>
 #include <functional>
 #include <memory>
+#include <utility>
 
 namespace beast {
 
diff --git a/include/xrpl/beast/container/aged_multimap.h b/include/xrpl/beast/container/aged_multimap.h
index 65efd1bbf9..f6133ced1c 100644
--- a/include/xrpl/beast/container/aged_multimap.h
+++ b/include/xrpl/beast/container/aged_multimap.h
@@ -5,6 +5,7 @@
 #include <chrono>
 #include <functional>
 #include <memory>
+#include <utility>
 
 namespace beast {
 
diff --git a/include/xrpl/beast/container/aged_unordered_map.h b/include/xrpl/beast/container/aged_unordered_map.h
index a2189e2409..d6ea6e97bd 100644
--- a/include/xrpl/beast/container/aged_unordered_map.h
+++ b/include/xrpl/beast/container/aged_unordered_map.h
@@ -5,6 +5,7 @@
 #include <chrono>
 #include <functional>
 #include <memory>
+#include <utility>
 
 namespace beast {
 
diff --git a/include/xrpl/beast/container/aged_unordered_multimap.h b/include/xrpl/beast/container/aged_unordered_multimap.h
index f1348ed39f..3b72be98b7 100644
--- a/include/xrpl/beast/container/aged_unordered_multimap.h
+++ b/include/xrpl/beast/container/aged_unordered_multimap.h
@@ -5,6 +5,7 @@
 #include <chrono>
 #include <functional>
 #include <memory>
+#include <utility>
 
 namespace beast {
 
diff --git a/include/xrpl/beast/container/detail/aged_ordered_container.h b/include/xrpl/beast/container/detail/aged_ordered_container.h
index 4cb2246a22..0533a51f00 100644
--- a/include/xrpl/beast/container/detail/aged_ordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_ordered_container.h
@@ -11,9 +11,14 @@
 #include <boost/version.hpp>
 
 #include <algorithm>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <initializer_list>
 #include <memory>
+#include <stdexcept>
+#include <tuple>
 #include <type_traits>
 #include <utility>
 
@@ -1247,12 +1252,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::AgedOrd
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::AgedOrderedContainer(
     AgedOrderedContainer const& other)
-    : config_(other.config_)
-#if BOOST_VERSION >= 108000
-    , cont_(other.cont_.get_comp())
-#else
-    , cont_(other.cont_.comp())
-#endif
+    : config_(other.config_), cont_(other.cont_.get_comp())
 {
     insert(other.cbegin(), other.cend());
 }
@@ -1261,12 +1261,7 @@ template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compa
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::AgedOrderedContainer(
     AgedOrderedContainer const& other,
     Allocator const& alloc)
-    : config_(other.config_, alloc)
-#if BOOST_VERSION >= 108000
-    , cont_(other.cont_.get_comp())
-#else
-    , cont_(other.cont_.comp())
-#endif
+    : config_(other.config_, alloc), cont_(other.cont_.get_comp())
 {
     insert(other.cbegin(), other.cend());
 }
@@ -1283,13 +1278,7 @@ template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compa
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::AgedOrderedContainer(
     AgedOrderedContainer&& other,  // NOLINT(cppcoreguidelines-rvalue-reference-param-not-moved)
     Allocator const& alloc)
-    : config_(std::move(other.config_), alloc)
-#if BOOST_VERSION >= 108000
-    , cont_(std::move(other.cont_.get_comp()))
-#else
-    , cont_(std::move(other.cont_.comp()))
-#endif
-
+    : config_(std::move(other.config_), alloc), cont_(std::move(other.cont_.get_comp()))
 {
     insert(other.cbegin(), other.cend());
     other.clear();
diff --git a/include/xrpl/beast/container/detail/aged_unordered_container.h b/include/xrpl/beast/container/detail/aged_unordered_container.h
index 3bad12d9e5..782f36cd52 100644
--- a/include/xrpl/beast/container/detail/aged_unordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_unordered_container.h
@@ -10,13 +10,19 @@
 #include <boost/intrusive/unordered_set.hpp>
 
 #include <algorithm>
+#include <chrono>
 #include <cmath>
+#include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <initializer_list>
 #include <iterator>
 #include <memory>
+#include <stdexcept>
+#include <tuple>
 #include <type_traits>
 #include <utility>
+#include <vector>
 
 /*
 
diff --git a/include/xrpl/beast/core/CurrentThreadName.h b/include/xrpl/beast/core/CurrentThreadName.h
index 6175d99b16..3cdfe4c678 100644
--- a/include/xrpl/beast/core/CurrentThreadName.h
+++ b/include/xrpl/beast/core/CurrentThreadName.h
@@ -6,6 +6,7 @@
 
 #include <boost/predef.h>
 
+#include <cstddef>
 #include <string>
 #include <string_view>
 
diff --git a/include/xrpl/beast/core/LexicalCast.h b/include/xrpl/beast/core/LexicalCast.h
index 18e63c9c10..8faf90f53d 100644
--- a/include/xrpl/beast/core/LexicalCast.h
+++ b/include/xrpl/beast/core/LexicalCast.h
@@ -5,11 +5,12 @@
 #include <boost/core/detail/string_view.hpp>
 
 #include <algorithm>
-#include <cerrno>
+#include <cctype>
 #include <charconv>
-#include <cstdlib>
 #include <iterator>
 #include <string>
+#include <string_view>
+#include <system_error>
 #include <type_traits>
 #include <typeinfo>
 
diff --git a/include/xrpl/beast/core/List.h b/include/xrpl/beast/core/List.h
index 1c3827ae1c..1eeeaa87d1 100644
--- a/include/xrpl/beast/core/List.h
+++ b/include/xrpl/beast/core/List.h
@@ -1,6 +1,8 @@
 #pragma once
 
+#include <cstddef>
 #include <iterator>
+#include <type_traits>
 
 namespace beast {
 
diff --git a/include/xrpl/beast/core/LockFreeStack.h b/include/xrpl/beast/core/LockFreeStack.h
index d4ad45cf5c..19225a4343 100644
--- a/include/xrpl/beast/core/LockFreeStack.h
+++ b/include/xrpl/beast/core/LockFreeStack.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <atomic>
+#include <cstddef>
 #include <iterator>
 #include <type_traits>
 
@@ -58,7 +59,7 @@ public:
         return result;
     }
 
-    NodePtr
+    [[nodiscard]] NodePtr
     node() const
     {
         return node_;
diff --git a/include/xrpl/beast/hash/hash_append.h b/include/xrpl/beast/hash/hash_append.h
index 83cff4bdea..0b36d4c983 100644
--- a/include/xrpl/beast/hash/hash_append.h
+++ b/include/xrpl/beast/hash/hash_append.h
@@ -5,8 +5,8 @@
 
 #include <array>
 #include <chrono>
+#include <cstddef>
 #include <cstring>
-#include <functional>
 #include <memory>
 #include <string>
 #include <system_error>
diff --git a/include/xrpl/beast/insight/Collector.h b/include/xrpl/beast/insight/Collector.h
index 2e73d60400..3f83e329d4 100644
--- a/include/xrpl/beast/insight/Collector.h
+++ b/include/xrpl/beast/insight/Collector.h
@@ -4,8 +4,10 @@
 #include <xrpl/beast/insight/Event.h>
 #include <xrpl/beast/insight/Gauge.h>
 #include <xrpl/beast/insight/Hook.h>
+#include <xrpl/beast/insight/HookImpl.h>
 #include <xrpl/beast/insight/Meter.h>
 
+#include <memory>
 #include <string>
 
 namespace beast::insight {
diff --git a/include/xrpl/beast/insight/Insight.h b/include/xrpl/beast/insight/Insight.h
deleted file mode 100644
index bf3743cfd8..0000000000
--- a/include/xrpl/beast/insight/Insight.h
+++ /dev/null
@@ -1,15 +0,0 @@
-#pragma once
-
-#include <xrpl/beast/insight/Collector.h>
-#include <xrpl/beast/insight/Counter.h>
-#include <xrpl/beast/insight/CounterImpl.h>
-#include <xrpl/beast/insight/Event.h>
-#include <xrpl/beast/insight/EventImpl.h>
-#include <xrpl/beast/insight/Gauge.h>
-#include <xrpl/beast/insight/GaugeImpl.h>
-#include <xrpl/beast/insight/Group.h>
-#include <xrpl/beast/insight/Groups.h>
-#include <xrpl/beast/insight/Hook.h>
-#include <xrpl/beast/insight/HookImpl.h>
-#include <xrpl/beast/insight/NullCollector.h>
-#include <xrpl/beast/insight/StatsDCollector.h>
diff --git a/include/xrpl/beast/insight/NullCollector.h b/include/xrpl/beast/insight/NullCollector.h
index b865526ade..67903420fa 100644
--- a/include/xrpl/beast/insight/NullCollector.h
+++ b/include/xrpl/beast/insight/NullCollector.h
@@ -2,6 +2,8 @@
 
 #include <xrpl/beast/insight/Collector.h>
 
+#include <memory>
+
 namespace beast::insight {
 
 /** A Collector which does not collect metrics. */
diff --git a/include/xrpl/beast/insight/StatsDCollector.h b/include/xrpl/beast/insight/StatsDCollector.h
index ad436dc626..9a438c48f1 100644
--- a/include/xrpl/beast/insight/StatsDCollector.h
+++ b/include/xrpl/beast/insight/StatsDCollector.h
@@ -4,6 +4,9 @@
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/Journal.h>
 
+#include <memory>
+#include <string>
+
 namespace beast::insight {
 
 /** A Collector that reports metrics to a StatsD server.
diff --git a/include/xrpl/beast/net/IPAddress.h b/include/xrpl/beast/net/IPAddress.h
index 67deaaa787..f4327b7b8a 100644
--- a/include/xrpl/beast/net/IPAddress.h
+++ b/include/xrpl/beast/net/IPAddress.h
@@ -9,6 +9,7 @@
 #include <boost/asio/ip/address.hpp>
 #include <boost/functional/hash.hpp>
 
+#include <cstddef>
 #include <string>
 
 //------------------------------------------------------------------------------
diff --git a/include/xrpl/beast/net/IPAddressV4.h b/include/xrpl/beast/net/IPAddressV4.h
index dbe5a6095f..9367fbe1eb 100644
--- a/include/xrpl/beast/net/IPAddressV4.h
+++ b/include/xrpl/beast/net/IPAddressV4.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <xrpl/beast/hash/hash_append.h>
-
 #include <boost/asio/ip/address_v4.hpp>
 
 namespace beast::IP {
diff --git a/include/xrpl/beast/net/IPAddressV6.h b/include/xrpl/beast/net/IPAddressV6.h
index 10f806417d..1bfa079990 100644
--- a/include/xrpl/beast/net/IPAddressV6.h
+++ b/include/xrpl/beast/net/IPAddressV6.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <xrpl/beast/utility/instrumentation.h>
-
 #include <boost/asio/ip/address_v6.hpp>
 
 namespace beast::IP {
diff --git a/include/xrpl/beast/net/IPEndpoint.h b/include/xrpl/beast/net/IPEndpoint.h
index fec6e1556f..0b661108f2 100644
--- a/include/xrpl/beast/net/IPEndpoint.h
+++ b/include/xrpl/beast/net/IPEndpoint.h
@@ -3,8 +3,13 @@
 #include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/net/IPAddress.h>
+#include <xrpl/beast/net/IPAddressV4.h>
+#include <xrpl/beast/net/IPAddressV6.h>
 
+#include <cstddef>
 #include <cstdint>
+#include <functional>
+#include <istream>
 #include <optional>
 #include <string>
 
diff --git a/include/xrpl/beast/rfc2616.h b/include/xrpl/beast/rfc2616.h
index e810733210..7c681ab140 100644
--- a/include/xrpl/beast/rfc2616.h
+++ b/include/xrpl/beast/rfc2616.h
@@ -8,6 +8,7 @@
 
 #include <algorithm>
 #include <cctype>
+#include <cstddef>
 #include <iterator>
 #include <string>
 #include <vector>
diff --git a/include/xrpl/beast/test/yield_to.h b/include/xrpl/beast/test/yield_to.h
index 84d7d8846d..1a34ec436e 100644
--- a/include/xrpl/beast/test/yield_to.h
+++ b/include/xrpl/beast/test/yield_to.h
@@ -11,6 +11,8 @@
 #include <boost/thread/csbl/memory/allocator_arg.hpp>
 
 #include <condition_variable>
+#include <cstddef>
+#include <exception>
 #include <mutex>
 #include <thread>
 #include <vector>
diff --git a/include/xrpl/beast/unit_test.h b/include/xrpl/beast/unit_test.h
index 51ac96cacb..b4d53b2b1c 100644
--- a/include/xrpl/beast/unit_test.h
+++ b/include/xrpl/beast/unit_test.h
@@ -1,15 +1,6 @@
 #pragma once
 
-#include <xrpl/beast/unit_test/amount.h>
-#include <xrpl/beast/unit_test/global_suites.h>
-#include <xrpl/beast/unit_test/match.h>
-#include <xrpl/beast/unit_test/recorder.h>
-#include <xrpl/beast/unit_test/reporter.h>
-#include <xrpl/beast/unit_test/results.h>
-#include <xrpl/beast/unit_test/runner.h>
 #include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/unit_test/suite_info.h>
-#include <xrpl/beast/unit_test/suite_list.h>
 
 #ifndef BEAST_EXPECT
 #define BEAST_EXPECT_S1(x) #x
diff --git a/include/xrpl/beast/unit_test/match.h b/include/xrpl/beast/unit_test/match.h
index da466ab228..5faeaa1100 100644
--- a/include/xrpl/beast/unit_test/match.h
+++ b/include/xrpl/beast/unit_test/match.h
@@ -7,6 +7,7 @@
 #include <xrpl/beast/unit_test/suite_info.h>
 
 #include <string>
+#include <utility>
 
 namespace beast::unit_test {
 
diff --git a/include/xrpl/beast/unit_test/recorder.h b/include/xrpl/beast/unit_test/recorder.h
index 2ed88d4a46..1b7347dc2e 100644
--- a/include/xrpl/beast/unit_test/recorder.h
+++ b/include/xrpl/beast/unit_test/recorder.h
@@ -6,6 +6,10 @@
 
 #include <xrpl/beast/unit_test/results.h>
 #include <xrpl/beast/unit_test/runner.h>
+#include <xrpl/beast/unit_test/suite_info.h>
+
+#include <string>
+#include <utility>
 
 namespace beast::unit_test {
 
diff --git a/include/xrpl/beast/unit_test/reporter.h b/include/xrpl/beast/unit_test/reporter.h
index ff990dece5..a903d9f8c2 100644
--- a/include/xrpl/beast/unit_test/reporter.h
+++ b/include/xrpl/beast/unit_test/reporter.h
@@ -5,18 +5,21 @@
 #pragma once
 
 #include <xrpl/beast/unit_test/amount.h>
-#include <xrpl/beast/unit_test/recorder.h>
+#include <xrpl/beast/unit_test/runner.h>
+#include <xrpl/beast/unit_test/suite_info.h>
 
 #include <boost/lexical_cast.hpp>
 #include <boost/optional.hpp>
 
 #include <algorithm>
 #include <chrono>
+#include <cstddef>
 #include <iomanip>
 #include <iostream>
 #include <sstream>
 #include <string>
 #include <utility>
+#include <vector>
 
 namespace beast::unit_test {
 
diff --git a/include/xrpl/beast/unit_test/results.h b/include/xrpl/beast/unit_test/results.h
index 02aa9730d1..718d764c9f 100644
--- a/include/xrpl/beast/unit_test/results.h
+++ b/include/xrpl/beast/unit_test/results.h
@@ -6,6 +6,7 @@
 
 #include <xrpl/beast/unit_test/detail/const_container.h>
 
+#include <cstddef>
 #include <string>
 #include <utility>
 #include <vector>
diff --git a/include/xrpl/beast/unit_test/suite.h b/include/xrpl/beast/unit_test/suite.h
index fded866da0..487663fcc5 100644
--- a/include/xrpl/beast/unit_test/suite.h
+++ b/include/xrpl/beast/unit_test/suite.h
@@ -10,6 +10,8 @@
 #include <boost/lexical_cast.hpp>
 #include <boost/throw_exception.hpp>
 
+#include <exception>
+#include <memory>
 #include <ostream>
 #include <sstream>
 #include <string>
@@ -634,7 +636,7 @@ Suite::run(Runner& r)
 #define BEAST_DEFINE_TESTSUITE_MANUAL_PRIO(Class, Module, Library, Priority)
 
 #else
-#include <xrpl/beast/unit_test/global_suites.h>
+#include <xrpl/beast/unit_test/global_suites.h>  // IWYU pragma: keep
 #define BEAST_DEFINE_TESTSUITE(Class, Module, Library) \
     BEAST_DEFINE_TESTSUITE_INSERT(Class, Module, Library, false, 0)
 #define BEAST_DEFINE_TESTSUITE_MANUAL(Class, Module, Library) \
diff --git a/include/xrpl/beast/unit_test/suite_info.h b/include/xrpl/beast/unit_test/suite_info.h
index c09a0c2257..bda10ae7e3 100644
--- a/include/xrpl/beast/unit_test/suite_info.h
+++ b/include/xrpl/beast/unit_test/suite_info.h
@@ -4,9 +4,9 @@
 
 #pragma once
 
-#include <cstring>
 #include <functional>
 #include <string>
+#include <tuple>
 #include <utility>
 
 namespace beast::unit_test {
diff --git a/include/xrpl/beast/unit_test/suite_list.h b/include/xrpl/beast/unit_test/suite_list.h
index 748f994602..cf9fb9c5b1 100644
--- a/include/xrpl/beast/unit_test/suite_list.h
+++ b/include/xrpl/beast/unit_test/suite_list.h
@@ -10,6 +10,7 @@
 #include <boost/assert.hpp>
 
 #include <set>
+#include <string>
 #include <typeindex>
 #include <unordered_set>
 
diff --git a/include/xrpl/beast/unit_test/thread.h b/include/xrpl/beast/unit_test/thread.h
index 7ae093eb85..0de039cb89 100644
--- a/include/xrpl/beast/unit_test/thread.h
+++ b/include/xrpl/beast/unit_test/thread.h
@@ -6,7 +6,9 @@
 
 #include <xrpl/beast/unit_test/suite.h>
 
+#include <exception>
 #include <functional>
+#include <string>
 #include <thread>
 #include <utility>
 
diff --git a/include/xrpl/beast/utility/Journal.h b/include/xrpl/beast/utility/Journal.h
index 1262a64179..ac08b1384b 100644
--- a/include/xrpl/beast/utility/Journal.h
+++ b/include/xrpl/beast/utility/Journal.h
@@ -3,7 +3,10 @@
 #include <xrpl/beast/utility/instrumentation.h>
 
 #include <cstdint>
+#include <ostream>
 #include <sstream>
+#include <string>
+#include <type_traits>
 
 namespace beast {
 
diff --git a/include/xrpl/beast/utility/PropertyStream.h b/include/xrpl/beast/utility/PropertyStream.h
index 62de019edd..3fb6df53d9 100644
--- a/include/xrpl/beast/utility/PropertyStream.h
+++ b/include/xrpl/beast/utility/PropertyStream.h
@@ -3,8 +3,10 @@
 #include <xrpl/beast/core/List.h>
 
 #include <mutex>
+#include <ostream>
 #include <sstream>
 #include <string>
+#include <utility>
 
 namespace beast {
 
diff --git a/include/xrpl/beast/utility/WrappedSink.h b/include/xrpl/beast/utility/WrappedSink.h
index 22d75927fe..a24ad595db 100644
--- a/include/xrpl/beast/utility/WrappedSink.h
+++ b/include/xrpl/beast/utility/WrappedSink.h
@@ -2,6 +2,7 @@
 
 #include <xrpl/beast/utility/Journal.h>
 
+#include <string>
 #include <utility>
 
 namespace beast {
diff --git a/include/xrpl/beast/utility/rngfill.h b/include/xrpl/beast/utility/rngfill.h
index 2ea84a7a3d..0fc3ffe0d0 100644
--- a/include/xrpl/beast/utility/rngfill.h
+++ b/include/xrpl/beast/utility/rngfill.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <xrpl/beast/utility/instrumentation.h>
-
 #include <array>
 #include <cstdint>
 #include <cstring>
diff --git a/include/xrpl/conditions/Condition.h b/include/xrpl/conditions/Condition.h
index 66d1d24736..3c798663d7 100644
--- a/include/xrpl/conditions/Condition.h
+++ b/include/xrpl/conditions/Condition.h
@@ -4,8 +4,12 @@
 #include <xrpl/basics/Slice.h>
 #include <xrpl/conditions/detail/utils.h>
 
+#include <cstddef>
 #include <cstdint>
+#include <memory>
 #include <set>
+#include <system_error>
+#include <utility>
 
 namespace xrpl::cryptoconditions {
 
diff --git a/include/xrpl/conditions/Fulfillment.h b/include/xrpl/conditions/Fulfillment.h
index fd8cd7d31e..a3001b2620 100644
--- a/include/xrpl/conditions/Fulfillment.h
+++ b/include/xrpl/conditions/Fulfillment.h
@@ -4,6 +4,11 @@
 #include <xrpl/basics/Slice.h>
 #include <xrpl/conditions/Condition.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <system_error>
+
 namespace xrpl::cryptoconditions {
 
 struct Fulfillment
diff --git a/include/xrpl/conditions/detail/PreimageSha256.h b/include/xrpl/conditions/detail/PreimageSha256.h
index c592ea37ee..0973a52e4a 100644
--- a/include/xrpl/conditions/detail/PreimageSha256.h
+++ b/include/xrpl/conditions/detail/PreimageSha256.h
@@ -7,7 +7,11 @@
 #include <xrpl/conditions/detail/error.h>
 #include <xrpl/protocol/digest.h>
 
+#include <cstddef>
+#include <cstdint>
 #include <memory>
+#include <system_error>
+#include <utility>
 
 namespace xrpl::cryptoconditions {
 
diff --git a/include/xrpl/conditions/detail/utils.h b/include/xrpl/conditions/detail/utils.h
index 87f2265034..bf16bfb42b 100644
--- a/include/xrpl/conditions/detail/utils.h
+++ b/include/xrpl/conditions/detail/utils.h
@@ -6,7 +6,10 @@
 
 #include <boost/dynamic_bitset.hpp>
 
+#include <cstddef>
+#include <cstdint>
 #include <limits>
+#include <system_error>
 
 // A collection of functions to decode binary blobs
 // encoded with X.690 Distinguished Encoding Rules.
diff --git a/include/xrpl/config/BasicConfig.h b/include/xrpl/config/BasicConfig.h
index 858bf8bf2e..5680b51fe7 100644
--- a/include/xrpl/config/BasicConfig.h
+++ b/include/xrpl/config/BasicConfig.h
@@ -6,9 +6,13 @@
 #include <boost/lexical_cast.hpp>
 
 #include <algorithm>
+#include <cstddef>
 #include <optional>
+#include <ostream>
+#include <stdexcept>
 #include <string>
 #include <unordered_map>
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/core/ClosureCounter.h b/include/xrpl/core/ClosureCounter.h
index fb13047f40..ed15db032e 100644
--- a/include/xrpl/core/ClosureCounter.h
+++ b/include/xrpl/core/ClosureCounter.h
@@ -1,11 +1,14 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
 
 #include <atomic>
+#include <chrono>
 #include <condition_variable>
 #include <mutex>
 #include <optional>
+#include <type_traits>
 
 namespace xrpl {
 
diff --git a/include/xrpl/core/HashRouter.h b/include/xrpl/core/HashRouter.h
index c8b34d8e93..ef8f24d43c 100644
--- a/include/xrpl/core/HashRouter.h
+++ b/include/xrpl/core/HashRouter.h
@@ -4,10 +4,16 @@
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/basics/hardened_hash.h>
 #include <xrpl/beast/container/aged_unordered_map.h>
 
+#include <chrono>
+#include <cstdint>
+#include <mutex>
 #include <optional>
 #include <set>
+#include <type_traits>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/core/Job.h b/include/xrpl/core/Job.h
index 6af32eb2d8..e16d7412bf 100644
--- a/include/xrpl/core/Job.h
+++ b/include/xrpl/core/Job.h
@@ -2,9 +2,14 @@
 
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/core/ClosureCounter.h>
+#include <xrpl/core/LoadEvent.h>
 #include <xrpl/core/LoadMonitor.h>
 
+#include <chrono>
+#include <cstdint>
 #include <functional>
+#include <memory>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/core/JobQueue.h b/include/xrpl/core/JobQueue.h
index fc15e9a064..14170a39be 100644
--- a/include/xrpl/core/JobQueue.h
+++ b/include/xrpl/core/JobQueue.h
@@ -3,7 +3,6 @@
 #include <xrpl/basics/LocalValue.h>
 #include <xrpl/core/ClosureCounter.h>
 #include <xrpl/core/JobTypeData.h>
-#include <xrpl/core/JobTypes.h>
 #include <xrpl/core/detail/Workers.h>
 #include <xrpl/json/json_value.h>
 
@@ -12,10 +11,27 @@
 // `boost/context/pooled_fixedsize_stack.hpp`, whose `.malloc()` / `.free()`
 // member calls on `boost::pool` collide with MSVC's `_CRTDBG_MAP_ALLOC` macros
 // in Debug builds (see cmake/XrplCompiler.cmake).
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/insight/Gauge.h>
+#include <xrpl/beast/insight/Hook.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/Job.h>
+#include <xrpl/core/LoadEvent.h>
+
 #include <boost/context/protected_fixedsize_stack.hpp>
 #include <boost/coroutine2/coroutine.hpp>
 
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <memory>
+#include <mutex>
 #include <set>
+#include <string>
+#include <type_traits>
 
 namespace xrpl {
 
@@ -112,7 +128,7 @@ public:
         resume();
 
         /** Returns true if the Coro is still runnable (has not returned). */
-        bool
+        [[nodiscard]] bool
         runnable() const;
 
         /** Once called, the Coro allows early exit without an assert. */
@@ -384,7 +400,7 @@ private:
 
 }  // namespace xrpl
 
-#include <xrpl/core/Coro.ipp>
+#include <xrpl/core/Coro.ipp>  // IWYU pragma: keep
 
 namespace xrpl {
 
diff --git a/include/xrpl/core/JobTypeData.h b/include/xrpl/core/JobTypeData.h
index 4e9f95dc04..d53440e1ca 100644
--- a/include/xrpl/core/JobTypeData.h
+++ b/include/xrpl/core/JobTypeData.h
@@ -2,7 +2,10 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/insight/Event.h>
+#include <xrpl/core/Job.h>
 #include <xrpl/core/JobTypeInfo.h>
+#include <xrpl/core/LoadMonitor.h>
 
 #include <utility>
 
diff --git a/include/xrpl/core/JobTypeInfo.h b/include/xrpl/core/JobTypeInfo.h
index 430e80b388..b5db0dbaab 100644
--- a/include/xrpl/core/JobTypeInfo.h
+++ b/include/xrpl/core/JobTypeInfo.h
@@ -2,6 +2,10 @@
 
 #include <xrpl/core/Job.h>
 
+#include <chrono>
+#include <string>
+#include <utility>
+
 namespace xrpl {
 
 /** Holds all the 'static' information about a job, which does not change */
diff --git a/include/xrpl/core/JobTypes.h b/include/xrpl/core/JobTypes.h
index fb5c7988cb..f338b19f6c 100644
--- a/include/xrpl/core/JobTypes.h
+++ b/include/xrpl/core/JobTypes.h
@@ -1,10 +1,14 @@
 #pragma once
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/Job.h>
 #include <xrpl/core/JobTypeInfo.h>
 
+#include <limits>
 #include <map>
 #include <string>
+#include <tuple>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/core/LoadMonitor.h b/include/xrpl/core/LoadMonitor.h
index 32a813baa7..f1a8eb6c56 100644
--- a/include/xrpl/core/LoadMonitor.h
+++ b/include/xrpl/core/LoadMonitor.h
@@ -5,6 +5,7 @@
 #include <xrpl/core/LoadEvent.h>
 
 #include <chrono>
+#include <cstdint>
 #include <mutex>
 
 namespace xrpl {
diff --git a/include/xrpl/core/PeerReservationTable.h b/include/xrpl/core/PeerReservationTable.h
index a9ab894124..e6f6dd622e 100644
--- a/include/xrpl/core/PeerReservationTable.h
+++ b/include/xrpl/core/PeerReservationTable.h
@@ -3,6 +3,7 @@
 #include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/PublicKey.h>
 
 #include <mutex>
diff --git a/include/xrpl/core/PerfLog.h b/include/xrpl/core/PerfLog.h
index ca0d9333a4..f09665e291 100644
--- a/include/xrpl/core/PerfLog.h
+++ b/include/xrpl/core/PerfLog.h
@@ -1,6 +1,7 @@
 #pragma once
 
-#include <xrpl/core/JobTypes.h>
+#include <xrpl/basics/Log.h>
+#include <xrpl/core/Job.h>
 #include <xrpl/json/json_value.h>
 
 #include <boost/filesystem.hpp>
diff --git a/include/xrpl/core/ServiceRegistry.h b/include/xrpl/core/ServiceRegistry.h
index 1d0c9e38f4..50bf2d7c10 100644
--- a/include/xrpl/core/ServiceRegistry.h
+++ b/include/xrpl/core/ServiceRegistry.h
@@ -1,11 +1,17 @@
 #pragma once
 
 #include <xrpl/basics/Blob.h>
+#include <xrpl/basics/Log.h>
 #include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
 
 #include <boost/asio.hpp>
 
+#include <optional>
+#include <string>
+
 namespace xrpl {
 
 // Forward declarations
diff --git a/include/xrpl/core/StartUpType.h b/include/xrpl/core/StartUpType.h
index 46359ad7b6..6d05149618 100644
--- a/include/xrpl/core/StartUpType.h
+++ b/include/xrpl/core/StartUpType.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include <iosfwd>
+#include <ostream>
 #include <type_traits>
 
 namespace xrpl {
diff --git a/include/xrpl/core/detail/semaphore.h b/include/xrpl/core/detail/semaphore.h
index 7bc83f86f5..e40463e322 100644
--- a/include/xrpl/core/detail/semaphore.h
+++ b/include/xrpl/core/detail/semaphore.h
@@ -29,6 +29,7 @@
 #pragma once
 
 #include <condition_variable>
+#include <cstddef>
 #include <mutex>
 
 namespace xrpl {
diff --git a/include/xrpl/crypto/RFC1751.h b/include/xrpl/crypto/RFC1751.h
index 19b636b9dc..278f3c207b 100644
--- a/include/xrpl/crypto/RFC1751.h
+++ b/include/xrpl/crypto/RFC1751.h
@@ -1,5 +1,6 @@
 #pragma once
 
+#include <cstddef>
 #include <string>
 #include <string_view>
 #include <vector>
diff --git a/include/xrpl/crypto/csprng.h b/include/xrpl/crypto/csprng.h
index e386d9d11e..cdc6a723c8 100644
--- a/include/xrpl/crypto/csprng.h
+++ b/include/xrpl/crypto/csprng.h
@@ -1,5 +1,8 @@
 #pragma once
 
+#include <cstddef>
+#include <cstdint>
+#include <limits>
 #include <mutex>
 
 namespace xrpl {
diff --git a/include/xrpl/json/JsonPropertyStream.h b/include/xrpl/json/JsonPropertyStream.h
index 47317b9ddb..405a61cd34 100644
--- a/include/xrpl/json/JsonPropertyStream.h
+++ b/include/xrpl/json/JsonPropertyStream.h
@@ -3,6 +3,9 @@
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/json/json_value.h>
 
+#include <string>
+#include <vector>
+
 namespace xrpl {
 
 /** A PropertyStream::Sink which produces a json::Value of type ValueType::Object. */
diff --git a/include/xrpl/json/Writer.h b/include/xrpl/json/Writer.h
index 87e3e99c7e..024876a43c 100644
--- a/include/xrpl/json/Writer.h
+++ b/include/xrpl/json/Writer.h
@@ -1,11 +1,13 @@
 #pragma once
 
-#include <xrpl/basics/ToString.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/json/Output.h>
 #include <xrpl/json/json_value.h>
 
+#include <cstddef>
 #include <memory>
+#include <stdexcept>
+#include <string>
 
 namespace json {
 
diff --git a/include/xrpl/json/detail/json_assert.h b/include/xrpl/json/detail/json_assert.h
index 8e33f45b65..f501e42aa4 100644
--- a/include/xrpl/json/detail/json_assert.h
+++ b/include/xrpl/json/detail/json_assert.h
@@ -1,8 +1,5 @@
 #pragma once
 
-#include <xrpl/basics/contract.h>
-#include <xrpl/json/json_errors.h>
-
 #define JSON_ASSERT_MESSAGE(condition, message) \
     if (!(condition))                           \
         xrpl::Throw<json::Error>(message);
diff --git a/include/xrpl/json/json_reader.h b/include/xrpl/json/json_reader.h
index 9251183281..c1535bfb55 100644
--- a/include/xrpl/json/json_reader.h
+++ b/include/xrpl/json/json_reader.h
@@ -5,7 +5,10 @@
 
 #include <boost/asio/buffer.hpp>
 
+#include <deque>
+#include <istream>
 #include <stack>
+#include <string>
 
 namespace json {
 
diff --git a/include/xrpl/json/json_writer.h b/include/xrpl/json/json_writer.h
index afc99fe8c9..4bc15b71da 100644
--- a/include/xrpl/json/json_writer.h
+++ b/include/xrpl/json/json_writer.h
@@ -3,7 +3,10 @@
 #include <xrpl/json/json_forwards.h>
 #include <xrpl/json/json_value.h>
 
+#include <cstddef>
 #include <ostream>
+#include <string>
+#include <utility>
 #include <vector>
 
 namespace json {
diff --git a/include/xrpl/ledger/AcceptedLedgerTx.h b/include/xrpl/ledger/AcceptedLedgerTx.h
index 0a1592f6e1..f59b8a074d 100644
--- a/include/xrpl/ledger/AcceptedLedgerTx.h
+++ b/include/xrpl/ledger/AcceptedLedgerTx.h
@@ -1,13 +1,23 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
 #include <xrpl/protocol/TxMeta.h>
 
 #include <boost/container/flat_set.hpp>
 
+#include <cstdint>
+#include <memory>
+#include <string>
+
 namespace xrpl {
 
 /**
diff --git a/include/xrpl/ledger/AmendmentTable.h b/include/xrpl/ledger/AmendmentTable.h
index 8ed3cb81ff..6598be5a5c 100644
--- a/include/xrpl/ledger/AmendmentTable.h
+++ b/include/xrpl/ledger/AmendmentTable.h
@@ -1,14 +1,37 @@
 #pragma once
 
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/strHex.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/View.h>
+#include <xrpl/nodestore/Database.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/STValidation.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/TxFormats.h>
 #include <xrpl/shamap/SHAMap.h>
+#include <xrpl/shamap/SHAMapItem.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
 
+#include <chrono>
+#include <cstdint>
+#include <map>
+#include <memory>
 #include <optional>
+#include <set>
+#include <string>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/ApplyView.h b/include/xrpl/ledger/ApplyView.h
index 362eae0f79..3bf5d479d1 100644
--- a/include/xrpl/ledger/ApplyView.h
+++ b/include/xrpl/ledger/ApplyView.h
@@ -1,9 +1,22 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/ledger/RawView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STVector256.h>
+
+#include <cstdint>
+#include <functional>
+#include <optional>
+#include <type_traits>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/ApplyViewImpl.h b/include/xrpl/ledger/ApplyViewImpl.h
index 1245568630..9a3734a8ca 100644
--- a/include/xrpl/ledger/ApplyViewImpl.h
+++ b/include/xrpl/ledger/ApplyViewImpl.h
@@ -1,9 +1,20 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/detail/ApplyViewBase.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxMeta.h>
+
+#include <cstddef>
+#include <functional>
+#include <optional>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/BookDirs.h b/include/xrpl/ledger/BookDirs.h
index 36798934da..dc4361136d 100644
--- a/include/xrpl/ledger/BookDirs.h
+++ b/include/xrpl/ledger/BookDirs.h
@@ -1,6 +1,13 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Book.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+
+#include <cstddef>
+#include <iterator>
+#include <optional>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/CachedView.h b/include/xrpl/ledger/CachedView.h
index 462db48ee3..f83c3e1297 100644
--- a/include/xrpl/ledger/CachedView.h
+++ b/include/xrpl/ledger/CachedView.h
@@ -1,11 +1,20 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/hardened_hash.h>
 #include <xrpl/ledger/CachedSLEs.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Fees.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 
+#include <memory>
 #include <mutex>
+#include <optional>
 #include <type_traits>
+#include <unordered_map>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/CanonicalTXSet.h b/include/xrpl/ledger/CanonicalTXSet.h
index 4dffadd52f..f8349dfab6 100644
--- a/include/xrpl/ledger/CanonicalTXSet.h
+++ b/include/xrpl/ledger/CanonicalTXSet.h
@@ -1,10 +1,16 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/SeqProxy.h>
 
+#include <cstddef>
+#include <map>
+#include <memory>
+
 namespace xrpl {
 
 /** Holds transactions which were deferred to the next pass of consensus.
diff --git a/include/xrpl/ledger/Dir.h b/include/xrpl/ledger/Dir.h
index d305e21938..05df887d8b 100644
--- a/include/xrpl/ledger/Dir.h
+++ b/include/xrpl/ledger/Dir.h
@@ -1,7 +1,15 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STVector256.h>
+
+#include <cstddef>
+#include <iterator>
+#include <optional>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/Ledger.h b/include/xrpl/ledger/Ledger.h
index 5f7d79c61d..3453389a5e 100644
--- a/include/xrpl/ledger/Ledger.h
+++ b/include/xrpl/ledger/Ledger.h
@@ -1,16 +1,32 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/CachedView.h>
-#include <xrpl/ledger/View.h>
+#include <xrpl/ledger/RawView.h>
 #include <xrpl/protocol/Fees.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/Serializer.h>
-#include <xrpl/protocol/TxMeta.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/shamap/Family.h>
 #include <xrpl/shamap/SHAMap.h>
+#include <xrpl/shamap/SHAMapItem.h>
+
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/LedgerTiming.h b/include/xrpl/ledger/LedgerTiming.h
index 508403d760..a97e229046 100644
--- a/include/xrpl/ledger/LedgerTiming.h
+++ b/include/xrpl/ledger/LedgerTiming.h
@@ -1,9 +1,10 @@
 #pragma once
 
-#include <xrpl/basics/chrono.h>
-#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
 
+#include <algorithm>
 #include <chrono>
+#include <iterator>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/OpenView.h b/include/xrpl/ledger/OpenView.h
index d145473516..de81787906 100644
--- a/include/xrpl/ledger/OpenView.h
+++ b/include/xrpl/ledger/OpenView.h
@@ -1,15 +1,26 @@
 #pragma once
 
+#include <xrpl/basics/ByteUtilities.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/ledger/RawView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/detail/RawStateTable.h>
-#include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/Fees.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/XRPAmount.h>
 
 #include <boost/container/pmr/monotonic_buffer_resource.hpp>
 #include <boost/container/pmr/polymorphic_allocator.hpp>
 
+#include <cstddef>
 #include <functional>
+#include <map>
+#include <memory>
+#include <optional>
 #include <utility>
 
 namespace xrpl {
diff --git a/include/xrpl/ledger/PaymentSandbox.h b/include/xrpl/ledger/PaymentSandbox.h
index 1cd89d9388..0117a962ff 100644
--- a/include/xrpl/ledger/PaymentSandbox.h
+++ b/include/xrpl/ledger/PaymentSandbox.h
@@ -1,11 +1,19 @@
 #pragma once
 
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/RawView.h>
-#include <xrpl/ledger/Sandbox.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/detail/ApplyViewBase.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <cstdint>
 #include <map>
+#include <optional>
+#include <tuple>
 #include <utility>
 
 namespace xrpl {
diff --git a/include/xrpl/ledger/RawView.h b/include/xrpl/ledger/RawView.h
index cf61c3e814..ac2674226f 100644
--- a/include/xrpl/ledger/RawView.h
+++ b/include/xrpl/ledger/RawView.h
@@ -3,6 +3,9 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <memory>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/ReadView.h b/include/xrpl/ledger/ReadView.h
index f4ee7e6fd2..8bbd3e06cb 100644
--- a/include/xrpl/ledger/ReadView.h
+++ b/include/xrpl/ledger/ReadView.h
@@ -1,21 +1,28 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/hash/uhash.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/detail/ReadViewFwdRange.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Fees.h>
-#include <xrpl/protocol/IOUAmount.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STTx.h>
 
 #include <cstdint>
+#include <memory>
 #include <optional>
 #include <unordered_set>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/Sandbox.h b/include/xrpl/ledger/Sandbox.h
index dc80df5ba2..ca8838631f 100644
--- a/include/xrpl/ledger/Sandbox.h
+++ b/include/xrpl/ledger/Sandbox.h
@@ -1,6 +1,8 @@
 #pragma once
 
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/RawView.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/detail/ApplyViewBase.h>
 
 namespace xrpl {
diff --git a/include/xrpl/ledger/View.h b/include/xrpl/ledger/View.h
index 255413e459..c89764df1d 100644
--- a/include/xrpl/ledger/View.h
+++ b/include/xrpl/ledger/View.h
@@ -1,13 +1,22 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
 #include <cstdint>
 #include <functional>
diff --git a/include/xrpl/ledger/detail/ApplyStateTable.h b/include/xrpl/ledger/detail/ApplyStateTable.h
index f40e3d0d1c..752c87d588 100644
--- a/include/xrpl/ledger/detail/ApplyStateTable.h
+++ b/include/xrpl/ledger/detail/ApplyStateTable.h
@@ -1,13 +1,26 @@
 #pragma once
 
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/OpenView.h>
 #include <xrpl/ledger/RawView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxMeta.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <cstddef>
+#include <functional>
+#include <map>
+#include <optional>
+#include <utility>
+
 namespace xrpl::detail {
 
 // Helper class that buffers modifications
diff --git a/include/xrpl/ledger/detail/ApplyViewBase.h b/include/xrpl/ledger/detail/ApplyViewBase.h
index d6493c46a8..b5b01de277 100644
--- a/include/xrpl/ledger/detail/ApplyViewBase.h
+++ b/include/xrpl/ledger/detail/ApplyViewBase.h
@@ -1,10 +1,20 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/RawView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/detail/ApplyStateTable.h>
+#include <xrpl/protocol/Fees.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <memory>
+#include <optional>
+
 namespace xrpl::detail {
 
 class ApplyViewBase : public ApplyView, public RawView
diff --git a/include/xrpl/ledger/detail/RawStateTable.h b/include/xrpl/ledger/detail/RawStateTable.h
index d2567e34f1..cfa528d355 100644
--- a/include/xrpl/ledger/detail/RawStateTable.h
+++ b/include/xrpl/ledger/detail/RawStateTable.h
@@ -1,12 +1,20 @@
 #pragma once
 
+#include <xrpl/basics/ByteUtilities.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/ledger/RawView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 
 #include <boost/container/pmr/monotonic_buffer_resource.hpp>
 #include <boost/container/pmr/polymorphic_allocator.hpp>
 
+#include <cstddef>
+#include <functional>
 #include <map>
+#include <memory>
+#include <optional>
 #include <utility>
 
 namespace xrpl::detail {
diff --git a/include/xrpl/ledger/detail/ReadViewFwdRange.h b/include/xrpl/ledger/detail/ReadViewFwdRange.h
index c548ccb101..82d8b59c6a 100644
--- a/include/xrpl/ledger/detail/ReadViewFwdRange.h
+++ b/include/xrpl/ledger/detail/ReadViewFwdRange.h
@@ -1,8 +1,10 @@
 #pragma once
 
 #include <cstddef>
+#include <iterator>
 #include <memory>
 #include <optional>
+#include <type_traits>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/helpers/AMMHelpers.h b/include/xrpl/ledger/helpers/AMMHelpers.h
index de8bb9d3f7..c6a2053010 100644
--- a/include/xrpl/ledger/helpers/AMMHelpers.h
+++ b/include/xrpl/ledger/helpers/AMMHelpers.h
@@ -2,22 +2,36 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/Number.h>
+#include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/Sandbox.h>
-#include <xrpl/ledger/helpers/RippleStateHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AMMCore.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/AmountConversions.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/IOUAmount.h>
 #include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/MPTAmount.h>
 #include <xrpl/protocol/Quality.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <algorithm>
+#include <cstdint>
 #include <expected>
+#include <functional>
+#include <optional>
+#include <stdexcept>
+#include <tuple>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/helpers/AccountRootHelpers.h b/include/xrpl/ledger/helpers/AccountRootHelpers.h
index cf6082d533..d0cfc175a3 100644
--- a/include/xrpl/ledger/helpers/AccountRootHelpers.h
+++ b/include/xrpl/ledger/helpers/AccountRootHelpers.h
@@ -1,13 +1,18 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <cstdint>
 #include <expected>
 #include <set>
 #include <vector>
diff --git a/include/xrpl/ledger/helpers/CredentialHelpers.h b/include/xrpl/ledger/helpers/CredentialHelpers.h
index d6b797ce34..8e78a00923 100644
--- a/include/xrpl/ledger/helpers/CredentialHelpers.h
+++ b/include/xrpl/ledger/helpers/CredentialHelpers.h
@@ -1,15 +1,22 @@
 #pragma once
 
-#include <xrpl/basics/Log.h>
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/TER.h>
 
+#include <memory>
+#include <set>
+#include <utility>
+
 namespace xrpl {
 namespace credentials {
 
diff --git a/include/xrpl/ledger/helpers/DelegateHelpers.h b/include/xrpl/ledger/helpers/DelegateHelpers.h
index a517eefdaa..3c277cb4f7 100644
--- a/include/xrpl/ledger/helpers/DelegateHelpers.h
+++ b/include/xrpl/ledger/helpers/DelegateHelpers.h
@@ -4,6 +4,9 @@
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
+
+#include <unordered_set>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/helpers/DirectoryHelpers.h b/include/xrpl/ledger/helpers/DirectoryHelpers.h
index a0be52df99..76a5f3bdad 100644
--- a/include/xrpl/ledger/helpers/DirectoryHelpers.h
+++ b/include/xrpl/ledger/helpers/DirectoryHelpers.h
@@ -1,12 +1,16 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STLedgerEntry.h>
-#include <xrpl/protocol/TER.h>
 
+#include <cstdint>
 #include <functional>
 #include <memory>
 #include <type_traits>
diff --git a/include/xrpl/ledger/helpers/EscrowHelpers.h b/include/xrpl/ledger/helpers/EscrowHelpers.h
index dc7c479c42..001dc9cb25 100644
--- a/include/xrpl/ledger/helpers/EscrowHelpers.h
+++ b/include/xrpl/ledger/helpers/EscrowHelpers.h
@@ -1,15 +1,28 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/MPTAmount.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <cstdint>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/helpers/LendingHelpers.h b/include/xrpl/ledger/helpers/LendingHelpers.h
index 8de945233b..c21e5bf0ce 100644
--- a/include/xrpl/ledger/helpers/LendingHelpers.h
+++ b/include/xrpl/ledger/helpers/LendingHelpers.h
@@ -1,11 +1,28 @@
 #pragma once
 
-#include <xrpl/ledger/View.h>
+#include <xrpl/basics/Number.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Rules.h>
-#include <xrpl/protocol/st.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STNumber.h>  // IWYU pragma: keep
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/Units.h>
 
+#include <cstdint>
 #include <expected>
 #include <string_view>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/ledger/helpers/MPTokenHelpers.h b/include/xrpl/ledger/helpers/MPTokenHelpers.h
index b7f87337cf..a725871231 100644
--- a/include/xrpl/ledger/helpers/MPTokenHelpers.h
+++ b/include/xrpl/ledger/helpers/MPTokenHelpers.h
@@ -4,11 +4,17 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <cstdint>
 #include <initializer_list>
 #include <optional>
 
diff --git a/include/xrpl/ledger/helpers/NFTokenHelpers.h b/include/xrpl/ledger/helpers/NFTokenHelpers.h
index 362cfe5a8c..1c4d395fbe 100644
--- a/include/xrpl/ledger/helpers/NFTokenHelpers.h
+++ b/include/xrpl/ledger/helpers/NFTokenHelpers.h
@@ -1,13 +1,25 @@
 #pragma once
 
-#include <xrpl/basics/Log.h>
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/SeqProxy.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
-#include <xrpl/protocol/nft.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <optional>
 #include <utility>
 
 namespace xrpl::nft {
diff --git a/include/xrpl/ledger/helpers/PaymentChannelHelpers.h b/include/xrpl/ledger/helpers/PaymentChannelHelpers.h
index 3c08ee9f32..6e8cd17f7f 100644
--- a/include/xrpl/ledger/helpers/PaymentChannelHelpers.h
+++ b/include/xrpl/ledger/helpers/PaymentChannelHelpers.h
@@ -1,12 +1,13 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>
-#include <xrpl/protocol/UintTypes.h>
 
 #include <cstdint>
-#include <memory>
 #include <optional>
 
 namespace xrpl {
diff --git a/include/xrpl/ledger/helpers/PermissionedDEXHelpers.h b/include/xrpl/ledger/helpers/PermissionedDEXHelpers.h
index 695a4950f0..12681257aa 100644
--- a/include/xrpl/ledger/helpers/PermissionedDEXHelpers.h
+++ b/include/xrpl/ledger/helpers/PermissionedDEXHelpers.h
@@ -1,6 +1,10 @@
 #pragma once
 
-#include <xrpl/ledger/View.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/UintTypes.h>
 
 namespace xrpl::permissioned_dex {
 
diff --git a/include/xrpl/ledger/helpers/RippleStateHelpers.h b/include/xrpl/ledger/helpers/RippleStateHelpers.h
index 3aaaa541fd..ab09b931cc 100644
--- a/include/xrpl/ledger/helpers/RippleStateHelpers.h
+++ b/include/xrpl/ledger/helpers/RippleStateHelpers.h
@@ -1,14 +1,21 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/IOUAmount.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <cstdint>
+#include <optional>
 
 //------------------------------------------------------------------------------
 //
diff --git a/include/xrpl/ledger/helpers/TokenHelpers.h b/include/xrpl/ledger/helpers/TokenHelpers.h
index c8a67f776a..32f785a0d6 100644
--- a/include/xrpl/ledger/helpers/TokenHelpers.h
+++ b/include/xrpl/ledger/helpers/TokenHelpers.h
@@ -1,15 +1,22 @@
 #pragma once
 
+#include <xrpl/basics/Number.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <cstdint>
 #include <initializer_list>
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/net/AutoSocket.h b/include/xrpl/net/AutoSocket.h
index 16ed0d6ca9..72eaed7439 100644
--- a/include/xrpl/net/AutoSocket.h
+++ b/include/xrpl/net/AutoSocket.h
@@ -2,12 +2,20 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/net/IPAddressConversion.h>
+#include <xrpl/beast/net/IPEndpoint.h>
 
 #include <boost/asio.hpp>
 #include <boost/asio/ip/tcp.hpp>
 #include <boost/asio/ssl.hpp>
 #include <boost/beast/core/bind_handler.hpp>
 
+#include <cstddef>
+#include <functional>
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
 // Socket wrapper that supports both SSL and non-SSL connections.
 // Generally, handle it as you would an SSL connection.
 // To force a non-SSL connection, just don't call async_handshake.
diff --git a/include/xrpl/net/HTTPClient.h b/include/xrpl/net/HTTPClient.h
index 456f769922..7ed9b35b9b 100644
--- a/include/xrpl/net/HTTPClient.h
+++ b/include/xrpl/net/HTTPClient.h
@@ -7,6 +7,7 @@
 #include <boost/asio/streambuf.hpp>
 
 #include <chrono>
+#include <cstddef>
 #include <deque>
 #include <functional>
 #include <string>
diff --git a/include/xrpl/net/HTTPClientSSLContext.h b/include/xrpl/net/HTTPClientSSLContext.h
index ca1983f141..4192455ec9 100644
--- a/include/xrpl/net/HTTPClientSSLContext.h
+++ b/include/xrpl/net/HTTPClientSSLContext.h
@@ -10,6 +10,14 @@
 #include <boost/asio/ssl.hpp>
 #include <boost/format.hpp>
 
+#include <openssl/err.h>
+#include <openssl/tls1.h>
+
+#include <functional>
+#include <stdexcept>
+#include <string>
+#include <type_traits>
+
 namespace xrpl {
 
 class HTTPClientSSLContext
diff --git a/include/xrpl/net/RegisterSSLCerts.h b/include/xrpl/net/RegisterSSLCerts.h
index e313b1cb06..5cc9934638 100644
--- a/include/xrpl/net/RegisterSSLCerts.h
+++ b/include/xrpl/net/RegisterSSLCerts.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
 
 #include <boost/asio/ssl/context.hpp>
 
diff --git a/include/xrpl/nodestore/Backend.h b/include/xrpl/nodestore/Backend.h
index 0061890237..29c4a8b526 100644
--- a/include/xrpl/nodestore/Backend.h
+++ b/include/xrpl/nodestore/Backend.h
@@ -1,8 +1,17 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/nodestore/Types.h>
 
+#include <cstddef>
 #include <cstdint>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <stdexcept>
+#include <string>
 
 namespace xrpl::NodeStore {
 
diff --git a/include/xrpl/nodestore/Database.h b/include/xrpl/nodestore/Database.h
index 68c5dcefb6..49002ee301 100644
--- a/include/xrpl/nodestore/Database.h
+++ b/include/xrpl/nodestore/Database.h
@@ -1,13 +1,25 @@
 #pragma once
 
-#include <xrpl/basics/Log.h>
-#include <xrpl/basics/TaggedCache.ipp>
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/TaggedCache.ipp>  // IWYU pragma: keep
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/nodestore/Backend.h>
 #include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/nodestore/Scheduler.h>
-#include <xrpl/protocol/SystemParameters.h>
 
+#include <atomic>
 #include <condition_variable>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <string>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 class Section;
diff --git a/include/xrpl/nodestore/DatabaseRotating.h b/include/xrpl/nodestore/DatabaseRotating.h
index a7deed294a..69eb31261d 100644
--- a/include/xrpl/nodestore/DatabaseRotating.h
+++ b/include/xrpl/nodestore/DatabaseRotating.h
@@ -1,6 +1,13 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/nodestore/Backend.h>
 #include <xrpl/nodestore/Database.h>
+#include <xrpl/nodestore/Scheduler.h>
+
+#include <functional>
+#include <memory>
+#include <string>
 
 namespace xrpl::NodeStore {
 
diff --git a/include/xrpl/nodestore/DummyScheduler.h b/include/xrpl/nodestore/DummyScheduler.h
index 472684ff13..f626115786 100644
--- a/include/xrpl/nodestore/DummyScheduler.h
+++ b/include/xrpl/nodestore/DummyScheduler.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <xrpl/nodestore/Scheduler.h>
+#include <xrpl/nodestore/Task.h>
 
 namespace xrpl::NodeStore {
 
diff --git a/include/xrpl/nodestore/Factory.h b/include/xrpl/nodestore/Factory.h
index 3e6ba76a08..e79ae3e05d 100644
--- a/include/xrpl/nodestore/Factory.h
+++ b/include/xrpl/nodestore/Factory.h
@@ -4,7 +4,11 @@
 #include <xrpl/nodestore/Backend.h>
 #include <xrpl/nodestore/Scheduler.h>
 
-#include <nudb/store.hpp>
+#include <nudb/context.hpp>
+
+#include <cstddef>
+#include <memory>
+#include <string>
 
 namespace xrpl {
 class Section;
diff --git a/include/xrpl/nodestore/Manager.h b/include/xrpl/nodestore/Manager.h
index 1c4e5b63cf..f813412846 100644
--- a/include/xrpl/nodestore/Manager.h
+++ b/include/xrpl/nodestore/Manager.h
@@ -1,7 +1,14 @@
 #pragma once
 
-#include <xrpl/nodestore/DatabaseRotating.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/nodestore/Backend.h>
+#include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/Factory.h>
+#include <xrpl/nodestore/Scheduler.h>
+
+#include <cstddef>
+#include <memory>
+#include <string>
 
 namespace xrpl::NodeStore {
 
diff --git a/include/xrpl/nodestore/NodeObject.h b/include/xrpl/nodestore/NodeObject.h
index 04ba391b2b..3f3b75d5f8 100644
--- a/include/xrpl/nodestore/NodeObject.h
+++ b/include/xrpl/nodestore/NodeObject.h
@@ -4,6 +4,10 @@
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/base_uint.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+
 // VFALCO NOTE Intentionally not in the NodeStore namespace
 
 namespace xrpl {
diff --git a/include/xrpl/nodestore/Types.h b/include/xrpl/nodestore/Types.h
index 21c01e9111..eaee82c99e 100644
--- a/include/xrpl/nodestore/Types.h
+++ b/include/xrpl/nodestore/Types.h
@@ -2,6 +2,7 @@
 
 #include <xrpl/nodestore/NodeObject.h>
 
+#include <memory>
 #include <vector>
 
 namespace xrpl::NodeStore {
diff --git a/include/xrpl/nodestore/detail/BatchWriter.h b/include/xrpl/nodestore/detail/BatchWriter.h
index b0383838dc..7fa23bcb3e 100644
--- a/include/xrpl/nodestore/detail/BatchWriter.h
+++ b/include/xrpl/nodestore/detail/BatchWriter.h
@@ -1,10 +1,12 @@
 #pragma once
 
+#include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/nodestore/Scheduler.h>
 #include <xrpl/nodestore/Task.h>
 #include <xrpl/nodestore/Types.h>
 
 #include <condition_variable>
+#include <memory>
 #include <mutex>
 
 namespace xrpl::NodeStore {
diff --git a/include/xrpl/nodestore/detail/DatabaseNodeImp.h b/include/xrpl/nodestore/detail/DatabaseNodeImp.h
index 38b8763f31..6f2fca682f 100644
--- a/include/xrpl/nodestore/detail/DatabaseNodeImp.h
+++ b/include/xrpl/nodestore/detail/DatabaseNodeImp.h
@@ -1,10 +1,26 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/config/BasicConfig.h>
 #include <xrpl/config/Constants.h>
+#include <xrpl/nodestore/Backend.h>
 #include <xrpl/nodestore/Database.h>
+#include <xrpl/nodestore/NodeObject.h>
+#include <xrpl/nodestore/Scheduler.h>
+
+#include <chrono>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <stdexcept>
+#include <utility>
 
 namespace xrpl::NodeStore {
 
diff --git a/include/xrpl/nodestore/detail/DatabaseRotatingImp.h b/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
index 1ba9435a5f..6343275c76 100644
--- a/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
+++ b/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
@@ -1,8 +1,19 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/nodestore/Backend.h>
+#include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/DatabaseRotating.h>
+#include <xrpl/nodestore/NodeObject.h>
+#include <xrpl/nodestore/Scheduler.h>
 
+#include <cstdint>
+#include <functional>
+#include <memory>
 #include <mutex>
+#include <string>
 
 namespace xrpl::NodeStore {
 
diff --git a/include/xrpl/nodestore/detail/DecodedBlob.h b/include/xrpl/nodestore/detail/DecodedBlob.h
index 90a7b6c9cb..b2d5fc9c26 100644
--- a/include/xrpl/nodestore/detail/DecodedBlob.h
+++ b/include/xrpl/nodestore/detail/DecodedBlob.h
@@ -2,6 +2,8 @@
 
 #include <xrpl/nodestore/NodeObject.h>
 
+#include <memory>
+
 namespace xrpl::NodeStore {
 
 /** Parsed key/value blob into NodeObject components.
diff --git a/include/xrpl/nodestore/detail/EncodedBlob.h b/include/xrpl/nodestore/detail/EncodedBlob.h
index 343e1720a0..3982ab1b95 100644
--- a/include/xrpl/nodestore/detail/EncodedBlob.h
+++ b/include/xrpl/nodestore/detail/EncodedBlob.h
@@ -7,7 +7,10 @@
 
 #include <algorithm>
 #include <array>
+#include <cstddef>
 #include <cstdint>
+#include <memory>
+#include <stdexcept>
 
 namespace xrpl::NodeStore {
 
diff --git a/include/xrpl/nodestore/detail/ManagerImp.h b/include/xrpl/nodestore/detail/ManagerImp.h
index 98aec6459b..fc84b0aa57 100644
--- a/include/xrpl/nodestore/detail/ManagerImp.h
+++ b/include/xrpl/nodestore/detail/ManagerImp.h
@@ -1,6 +1,17 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/nodestore/Backend.h>
+#include <xrpl/nodestore/Database.h>
+#include <xrpl/nodestore/Factory.h>
 #include <xrpl/nodestore/Manager.h>
+#include <xrpl/nodestore/Scheduler.h>
+
+#include <cstddef>
+#include <memory>
+#include <mutex>
+#include <string>
+#include <vector>
 
 namespace xrpl::NodeStore {
 
diff --git a/include/xrpl/nodestore/detail/codec.h b/include/xrpl/nodestore/detail/codec.h
index 49238fa34a..56e1fbcf73 100644
--- a/include/xrpl/nodestore/detail/codec.h
+++ b/include/xrpl/nodestore/detail/codec.h
@@ -1,6 +1,10 @@
 #pragma once
 
 // Disable lz4 deprecation warning due to incompatibility with clang attributes
+#include <array>
+#include <cstdint>
+#include <stdexcept>
+#include <utility>
 #define LZ4_DISABLE_DEPRECATE_WARNINGS
 
 #include <xrpl/basics/contract.h>
diff --git a/include/xrpl/nodestore/detail/varint.h b/include/xrpl/nodestore/detail/varint.h
index 0c49274d70..21a13bd6de 100644
--- a/include/xrpl/nodestore/detail/varint.h
+++ b/include/xrpl/nodestore/detail/varint.h
@@ -2,6 +2,7 @@
 
 #include <nudb/detail/stream.hpp>
 
+#include <cstddef>
 #include <cstdint>
 #include <type_traits>
 
diff --git a/include/xrpl/proto/org/xrpl/rpc/v1/README.md b/include/xrpl/proto/org/xrpl/rpc/v1/README.md
index e8566ec179..d0ff14cd13 100644
--- a/include/xrpl/proto/org/xrpl/rpc/v1/README.md
+++ b/include/xrpl/proto/org/xrpl/rpc/v1/README.md
@@ -70,9 +70,9 @@ into helper functions (see Tx.cpp or AccountTx.cpp for an example).
 #### Testing
 
 When modifying an existing gRPC method, be sure to test that modification in the
-corresponding, existing unit test. When creating a new gRPC method, implement a class that
-derives from GRPCTestClientBase, and use the newly created class to call the new
-method. See the class `GrpcTxClient` in the file Tx_test.cpp for an example.
+corresponding, existing unit test. When creating a new gRPC method, create a
+client stub with `XRPLedgerAPIService::NewStub` and `grpc::CreateChannel`, and
+use it to call the new method. See `GRPCServerTLS_test.cpp` for an example.
 The gRPC tests are paired with their JSON counterpart, and the tests should
 mirror the JSON test as much as possible.
 
diff --git a/include/xrpl/protocol/AMMCore.h b/include/xrpl/protocol/AMMCore.h
index a83c8bfa84..c4fccd029a 100644
--- a/include/xrpl/protocol/AMMCore.h
+++ b/include/xrpl/protocol/AMMCore.h
@@ -3,9 +3,14 @@
 #include <xrpl/basics/Number.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
 
+#include <cstdint>
+#include <optional>
+#include <utility>
+
 namespace xrpl {
 
 constexpr std::uint16_t kTradingFeeThreshold = 1000;  // 1%
diff --git a/include/xrpl/protocol/AccountID.h b/include/xrpl/protocol/AccountID.h
index 4938812ffa..a7d49246ca 100644
--- a/include/xrpl/protocol/AccountID.h
+++ b/include/xrpl/protocol/AccountID.h
@@ -3,13 +3,17 @@
 #include <xrpl/protocol/tokens.h>
 // VFALCO Uncomment when the header issues are resolved
 // #include <xrpl/protocol/PublicKey.h>
-#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/json_get_or_throw.h>
 
 #include <cstddef>
+#include <functional>
 #include <optional>
+#include <ostream>
 #include <string>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/AmountConversions.h b/include/xrpl/protocol/AmountConversions.h
index a5f7ec310f..66ada68d6f 100644
--- a/include/xrpl/protocol/AmountConversions.h
+++ b/include/xrpl/protocol/AmountConversions.h
@@ -1,10 +1,20 @@
 #pragma once
 
+#include <xrpl/basics/Number.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/IOUAmount.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/MPTAmount.h>
+#include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <cstdint>
+#include <limits>
+#include <stdexcept>
 #include <type_traits>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/ApiVersion.h b/include/xrpl/protocol/ApiVersion.h
index 10b7571641..c3292e6074 100644
--- a/include/xrpl/protocol/ApiVersion.h
+++ b/include/xrpl/protocol/ApiVersion.h
@@ -5,6 +5,7 @@
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/jss.h>
 
+#include <cstddef>
 #include <type_traits>
 #include <utility>
 
diff --git a/include/xrpl/protocol/Asset.h b/include/xrpl/protocol/Asset.h
index ec9d8db02f..2bf24b19fe 100644
--- a/include/xrpl/protocol/Asset.h
+++ b/include/xrpl/protocol/Asset.h
@@ -2,10 +2,19 @@
 
 #include <xrpl/basics/Number.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/MPTIssue.h>
-#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <compare>
+#include <ostream>
+#include <stdexcept>
+#include <string>
+#include <variant>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/Batch.h b/include/xrpl/protocol/Batch.h
index 4e021442d6..1e4f811fa9 100644
--- a/include/xrpl/protocol/Batch.h
+++ b/include/xrpl/protocol/Batch.h
@@ -1,10 +1,13 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/HashPrefix.h>
-#include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/Serializer.h>
 
+#include <cstdint>
+#include <vector>
+
 namespace xrpl {
 
 inline void
diff --git a/include/xrpl/protocol/Book.h b/include/xrpl/protocol/Book.h
index 01dc40075b..476bdba35a 100644
--- a/include/xrpl/protocol/Book.h
+++ b/include/xrpl/protocol/Book.h
@@ -2,10 +2,21 @@
 
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/UintTypes.h>
 
 #include <boost/utility/base_from_member.hpp>
 
+#include <compare>
+#include <cstddef>
+#include <functional>
+#include <optional>
+#include <ostream>
+#include <string>
+
 namespace xrpl {
 
 /** Specifies an order book.
diff --git a/include/xrpl/protocol/BuildInfo.h b/include/xrpl/protocol/BuildInfo.h
index 47a27339a8..a60c37e714 100644
--- a/include/xrpl/protocol/BuildInfo.h
+++ b/include/xrpl/protocol/BuildInfo.h
@@ -2,6 +2,7 @@
 
 #include <cstdint>
 #include <string>
+#include <string_view>
 
 /** Versioning information for this build. */
 // VFALCO The namespace is deprecated
diff --git a/include/xrpl/protocol/ConfidentialTransfer.h b/include/xrpl/protocol/ConfidentialTransfer.h
index 5b1bcbf606..325117eed4 100644
--- a/include/xrpl/protocol/ConfidentialTransfer.h
+++ b/include/xrpl/protocol/ConfidentialTransfer.h
@@ -1,22 +1,21 @@
 #pragma once
 
+#include <xrpl/basics/Buffer.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/MPTIssue.h>
-#include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/Rate.h>
-#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STInteger.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STObject.h>
-#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/TER.h>
-#include <xrpl/protocol/TxFormats.h>
+#include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/detail/secp256k1.h>
 
-#include <secp256k1_mpt.h>
+#include <secp256k1.h>
 
 #include <cstdint>
 #include <limits>
+#include <optional>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/ErrorCodes.h b/include/xrpl/protocol/ErrorCodes.h
index f5e67fd572..38b8bc6d76 100644
--- a/include/xrpl/protocol/ErrorCodes.h
+++ b/include/xrpl/protocol/ErrorCodes.h
@@ -1,7 +1,8 @@
 #pragma once
 
 #include <xrpl/json/json_value.h>
-#include <xrpl/protocol/jss.h>
+
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/Feature.h b/include/xrpl/protocol/Feature.h
index 5de8ca64a9..927fde542a 100644
--- a/include/xrpl/protocol/Feature.h
+++ b/include/xrpl/protocol/Feature.h
@@ -1,10 +1,12 @@
 #pragma once
 
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/instrumentation.h>
 
 #include <boost/container/flat_map.hpp>
 
 #include <bitset>
+#include <cstddef>
 #include <map>
 #include <optional>
 #include <string>
diff --git a/include/xrpl/protocol/Fees.h b/include/xrpl/protocol/Fees.h
index 14bcc068bf..4e79204f4c 100644
--- a/include/xrpl/protocol/Fees.h
+++ b/include/xrpl/protocol/Fees.h
@@ -2,6 +2,9 @@
 
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <cstddef>
+#include <cstdint>
+
 namespace xrpl {
 
 // Deprecated constant for backwards compatibility with pre-XRPFees amendment.
diff --git a/include/xrpl/protocol/IOUAmount.h b/include/xrpl/protocol/IOUAmount.h
index b057f1c245..186ce054f1 100644
--- a/include/xrpl/protocol/IOUAmount.h
+++ b/include/xrpl/protocol/IOUAmount.h
@@ -6,6 +6,7 @@
 #include <boost/operators.hpp>
 
 #include <cstdint>
+#include <ostream>
 #include <string>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/Indexes.h b/include/xrpl/protocol/Indexes.h
index 75a2335f6f..053a66787f 100644
--- a/include/xrpl/protocol/Indexes.h
+++ b/include/xrpl/protocol/Indexes.h
@@ -1,18 +1,25 @@
 #pragma once
 
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Book.h>
+#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/STXChainBridge.h>
-#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/jss.h>
 
+#include <array>
 #include <cstdint>
+#include <functional>
 #include <set>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/InnerObjectFormats.h b/include/xrpl/protocol/InnerObjectFormats.h
index 9d07a21d1c..c8312c3701 100644
--- a/include/xrpl/protocol/InnerObjectFormats.h
+++ b/include/xrpl/protocol/InnerObjectFormats.h
@@ -1,6 +1,8 @@
 #pragma once
 
 #include <xrpl/protocol/KnownFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/SOTemplate.h>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/Issue.h b/include/xrpl/protocol/Issue.h
index c8022698d3..3d556e83eb 100644
--- a/include/xrpl/protocol/Issue.h
+++ b/include/xrpl/protocol/Issue.h
@@ -1,9 +1,13 @@
 #pragma once
 
-#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/UintTypes.h>
 
+#include <compare>
+#include <ostream>
+#include <string>
+
 namespace xrpl {
 
 /** A currency issued by an account.
diff --git a/include/xrpl/protocol/KnownFormats.h b/include/xrpl/protocol/KnownFormats.h
index 6e21d4bc3a..c31e28c37d 100644
--- a/include/xrpl/protocol/KnownFormats.h
+++ b/include/xrpl/protocol/KnownFormats.h
@@ -7,7 +7,11 @@
 #include <boost/container/flat_map.hpp>
 
 #include <algorithm>
+#include <cstddef>
 #include <forward_list>
+#include <stdexcept>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/LedgerFormats.h b/include/xrpl/protocol/LedgerFormats.h
index 70afd12f34..5b8a8cc2c5 100644
--- a/include/xrpl/protocol/LedgerFormats.h
+++ b/include/xrpl/protocol/LedgerFormats.h
@@ -3,9 +3,12 @@
 // NOLINTBEGIN(readability-identifier-naming)
 
 #include <xrpl/protocol/KnownFormats.h>
+#include <xrpl/protocol/SOTemplate.h>
 
+#include <cstdint>
 #include <map>
 #include <string>
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/LedgerHeader.h b/include/xrpl/protocol/LedgerHeader.h
index f05b11d1eb..df8f314c5f 100644
--- a/include/xrpl/protocol/LedgerHeader.h
+++ b/include/xrpl/protocol/LedgerHeader.h
@@ -3,10 +3,13 @@
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 /** Information about the notional ledger backing the view. */
diff --git a/include/xrpl/protocol/MPTAmount.h b/include/xrpl/protocol/MPTAmount.h
index 6ea36fc294..329d83610e 100644
--- a/include/xrpl/protocol/MPTAmount.h
+++ b/include/xrpl/protocol/MPTAmount.h
@@ -2,13 +2,15 @@
 
 #include <xrpl/basics/Number.h>
 #include <xrpl/basics/contract.h>
-#include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/utility/Zero.h>
 
 #include <boost/multiprecision/cpp_int.hpp>
 #include <boost/operators.hpp>
 
 #include <cstdint>
+#include <limits>
+#include <ostream>
+#include <stdexcept>
 #include <string>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/MPTIssue.h b/include/xrpl/protocol/MPTIssue.h
index f55029f50d..0c495aa57f 100644
--- a/include/xrpl/protocol/MPTIssue.h
+++ b/include/xrpl/protocol/MPTIssue.h
@@ -1,8 +1,18 @@
 #pragma once
 
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/UintTypes.h>
 
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <compare>
+#include <cstdint>
+#include <functional>
+#include <ostream>
+#include <string>
+
 namespace xrpl {
 
 /* Adapt MPTID to provide the same interface as Issue. Enables using static
diff --git a/include/xrpl/protocol/PathAsset.h b/include/xrpl/protocol/PathAsset.h
index b51dc52b47..ebf6fb68a4 100644
--- a/include/xrpl/protocol/PathAsset.h
+++ b/include/xrpl/protocol/PathAsset.h
@@ -1,7 +1,14 @@
 #pragma once
 
+#include <xrpl/basics/contract.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Concepts.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <ostream>
+#include <stdexcept>
+#include <string>
+#include <variant>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/Permissions.h b/include/xrpl/protocol/Permissions.h
index c6f464082d..703a0939c9 100644
--- a/include/xrpl/protocol/Permissions.h
+++ b/include/xrpl/protocol/Permissions.h
@@ -1,9 +1,12 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/protocol/Rules.h>
-#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/SOTemplate.h>
 #include <xrpl/protocol/TxFormats.h>
 
+#include <cstdint>
+#include <functional>
 #include <optional>
 #include <string>
 #include <unordered_map>
diff --git a/include/xrpl/protocol/Protocol.h b/include/xrpl/protocol/Protocol.h
index ba6347dfa7..f802cfe058 100644
--- a/include/xrpl/protocol/Protocol.h
+++ b/include/xrpl/protocol/Protocol.h
@@ -1,7 +1,9 @@
 #pragma once
 
 #include <xrpl/basics/ByteUtilities.h>
+#include <xrpl/basics/Number.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/safe_cast.h>
 #include <xrpl/protocol/Units.h>
 
 #include <mpt_protocol.h>
diff --git a/include/xrpl/protocol/PublicKey.h b/include/xrpl/protocol/PublicKey.h
index 20693160d3..13db17fc6e 100644
--- a/include/xrpl/protocol/PublicKey.h
+++ b/include/xrpl/protocol/PublicKey.h
@@ -1,8 +1,15 @@
 #pragma once
 
 #include <xrpl/basics/Slice.h>
+#include <xrpl/basics/StringUtilities.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
 #include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/KeyType.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STBlob.h>
 #include <xrpl/protocol/STExchange.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/json_get_or_throw.h>
@@ -11,8 +18,11 @@
 #include <algorithm>
 #include <cstdint>
 #include <cstring>
+#include <memory>
 #include <optional>
 #include <ostream>
+#include <sstream>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/Quality.h b/include/xrpl/protocol/Quality.h
index e261025cb8..6bb2033dc0 100644
--- a/include/xrpl/protocol/Quality.h
+++ b/include/xrpl/protocol/Quality.h
@@ -1,11 +1,13 @@
 #pragma once
 
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/AmountConversions.h>
-#include <xrpl/protocol/IOUAmount.h>
 #include <xrpl/protocol/STAmount.h>
-#include <xrpl/protocol/XRPAmount.h>
 
 #include <algorithm>
+#include <cmath>
+#include <concepts>
 #include <cstdint>
 #include <ostream>
 #include <utility>
diff --git a/include/xrpl/protocol/QualityFunction.h b/include/xrpl/protocol/QualityFunction.h
index 96d30735b8..7830519deb 100644
--- a/include/xrpl/protocol/QualityFunction.h
+++ b/include/xrpl/protocol/QualityFunction.h
@@ -1,9 +1,15 @@
 #pragma once
 
 #include <xrpl/basics/Number.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/protocol/AMMCore.h>
 #include <xrpl/protocol/Quality.h>
 
+#include <cstdint>
+#include <optional>
+#include <stdexcept>
+
 namespace xrpl {
 
 /** Average quality of a path as a function of `out`: q(out) = m * out + b,
diff --git a/include/xrpl/protocol/Rate.h b/include/xrpl/protocol/Rate.h
index 504b17ed80..b8b04c8fb9 100644
--- a/include/xrpl/protocol/Rate.h
+++ b/include/xrpl/protocol/Rate.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/STAmount.h>
 
 #include <boost/operators.hpp>
diff --git a/include/xrpl/protocol/Rules.h b/include/xrpl/protocol/Rules.h
index 47b20756db..da2031650f 100644
--- a/include/xrpl/protocol/Rules.h
+++ b/include/xrpl/protocol/Rules.h
@@ -4,7 +4,10 @@
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/protocol/STVector256.h>
 
+#include <memory>
+#include <optional>
 #include <unordered_set>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/SField.h b/include/xrpl/protocol/SField.h
index 34fb66ce00..d97bcb0a1d 100644
--- a/include/xrpl/protocol/SField.h
+++ b/include/xrpl/protocol/SField.h
@@ -2,10 +2,11 @@
 
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/protocol/Units.h>
 
 #include <cstdint>
 #include <map>
+#include <string>
+#include <unordered_map>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/SOTemplate.h b/include/xrpl/protocol/SOTemplate.h
index 72e0573d29..682a7c655e 100644
--- a/include/xrpl/protocol/SOTemplate.h
+++ b/include/xrpl/protocol/SOTemplate.h
@@ -3,9 +3,11 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/protocol/SField.h>
 
+#include <cstddef>
 #include <functional>
 #include <initializer_list>
 #include <stdexcept>
+#include <string>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/STAccount.h b/include/xrpl/protocol/STAccount.h
index 65f404d58d..17d3affc57 100644
--- a/include/xrpl/protocol/STAccount.h
+++ b/include/xrpl/protocol/STAccount.h
@@ -1,9 +1,13 @@
 #pragma once
 
+#include <xrpl/basics/Buffer.h>
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/Serializer.h>
 
+#include <cstddef>
 #include <string>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/STAmount.h b/include/xrpl/protocol/STAmount.h
index 1a5b442d8b..5e53a85129 100644
--- a/include/xrpl/protocol/STAmount.h
+++ b/include/xrpl/protocol/STAmount.h
@@ -1,14 +1,20 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
-#include <xrpl/basics/LocalValue.h>
 #include <xrpl/basics/Number.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/IOUAmount.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/MPTAmount.h>
+#include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
@@ -16,6 +22,14 @@
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol/json_get_or_throw.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <utility>
+
 namespace xrpl {
 
 // Internal form:
diff --git a/include/xrpl/protocol/STArray.h b/include/xrpl/protocol/STArray.h
index 61753c52dc..ed39e65026 100644
--- a/include/xrpl/protocol/STArray.h
+++ b/include/xrpl/protocol/STArray.h
@@ -1,7 +1,18 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/Serializer.h>
+
+#include <cstddef>
+#include <iterator>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STBase.h b/include/xrpl/protocol/STBase.h
index 6633253d3b..341c80edd7 100644
--- a/include/xrpl/protocol/STBase.h
+++ b/include/xrpl/protocol/STBase.h
@@ -1,9 +1,12 @@
 #pragma once
 
 #include <xrpl/basics/contract.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/Serializer.h>
 
+#include <concepts>
+#include <cstddef>
 #include <ostream>
 #include <string>
 #include <type_traits>
diff --git a/include/xrpl/protocol/STBitString.h b/include/xrpl/protocol/STBitString.h
index 0267eac22d..4f25eccca6 100644
--- a/include/xrpl/protocol/STBitString.h
+++ b/include/xrpl/protocol/STBitString.h
@@ -1,8 +1,15 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/Serializer.h>
+
+#include <cstddef>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STBlob.h b/include/xrpl/protocol/STBlob.h
index 0667c54e30..ab6175f5e3 100644
--- a/include/xrpl/protocol/STBlob.h
+++ b/include/xrpl/protocol/STBlob.h
@@ -3,10 +3,14 @@
 #include <xrpl/basics/Buffer.h>
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/Slice.h>
-#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/Serializer.h>
 
+#include <cstdint>
 #include <cstring>
+#include <string>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STCurrency.h b/include/xrpl/protocol/STCurrency.h
index 55d1ab1e74..18642b20cf 100644
--- a/include/xrpl/protocol/STCurrency.h
+++ b/include/xrpl/protocol/STCurrency.h
@@ -1,11 +1,15 @@
 #pragma once
 
-#include <xrpl/basics/CountedObject.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/UintTypes.h>
 
+#include <cstddef>
+#include <memory>
+#include <string>
+
 namespace xrpl {
 
 class STCurrency final : public STBase
diff --git a/include/xrpl/protocol/STExchange.h b/include/xrpl/protocol/STExchange.h
index c733df37cf..a9c1f57bd8 100644
--- a/include/xrpl/protocol/STExchange.h
+++ b/include/xrpl/protocol/STExchange.h
@@ -1,14 +1,15 @@
 #pragma once
 
-#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/Buffer.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STBlob.h>
 #include <xrpl/protocol/STInteger.h>
 #include <xrpl/protocol/STObject.h>
 
+#include <cstddef>
 #include <memory>
 #include <optional>
 #include <stdexcept>
diff --git a/include/xrpl/protocol/STInteger.h b/include/xrpl/protocol/STInteger.h
index 52e0f7a365..1c7ac98f3e 100644
--- a/include/xrpl/protocol/STInteger.h
+++ b/include/xrpl/protocol/STInteger.h
@@ -1,7 +1,15 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/Serializer.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STIssue.h b/include/xrpl/protocol/STIssue.h
index f5e1f61168..8ff579553f 100644
--- a/include/xrpl/protocol/STIssue.h
+++ b/include/xrpl/protocol/STIssue.h
@@ -1,11 +1,20 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Concepts.h>
+#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/Serializer.h>
 
+#include <compare>
+#include <cstddef>
+#include <stdexcept>
+#include <string>
+
 namespace xrpl {
 
 class STIssue final : public STBase, CountedObject<STIssue>
diff --git a/include/xrpl/protocol/STLedgerEntry.h b/include/xrpl/protocol/STLedgerEntry.h
index aa87411ae6..a5f449f99c 100644
--- a/include/xrpl/protocol/STLedgerEntry.h
+++ b/include/xrpl/protocol/STLedgerEntry.h
@@ -1,7 +1,19 @@
 #pragma once
 
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/Serializer.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STNumber.h b/include/xrpl/protocol/STNumber.h
index 8594a292f4..7efb63ac5e 100644
--- a/include/xrpl/protocol/STNumber.h
+++ b/include/xrpl/protocol/STNumber.h
@@ -2,10 +2,17 @@
 
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/Number.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STTakesAsset.h>
+#include <xrpl/protocol/Serializer.h>
 
+#include <cstddef>
+#include <cstdint>
 #include <ostream>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index 044e48ce62..c254a37aaf 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -1,27 +1,39 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/Number.h>
 #include <xrpl/basics/Slice.h>
-#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/HashPrefix.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/SOTemplate.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/STBitString.h>
 #include <xrpl/protocol/STCurrency.h>
 #include <xrpl/protocol/STIssue.h>
 #include <xrpl/protocol/STPathSet.h>
 #include <xrpl/protocol/STVector256.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/Units.h>
 #include <xrpl/protocol/detail/STVar.h>
 
 #include <boost/iterator/transform_iterator.hpp>
 
+#include <cstddef>
+#include <cstdint>
+#include <memory>
 #include <optional>
 #include <stdexcept>
+#include <string>
 #include <type_traits>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STParsedJSON.h b/include/xrpl/protocol/STParsedJSON.h
index 2557ab055b..1eeecc8b9e 100644
--- a/include/xrpl/protocol/STParsedJSON.h
+++ b/include/xrpl/protocol/STParsedJSON.h
@@ -1,8 +1,11 @@
 #pragma once
 
-#include <xrpl/protocol/STArray.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/STObject.h>
 
+#include <cstddef>
 #include <optional>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STPathSet.h b/include/xrpl/protocol/STPathSet.h
index 1508dcb727..f6b0fde7da 100644
--- a/include/xrpl/protocol/STPathSet.h
+++ b/include/xrpl/protocol/STPathSet.h
@@ -3,14 +3,17 @@
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/PathAsset.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/UintTypes.h>
 
 #include <cstddef>
 #include <optional>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STTakesAsset.h b/include/xrpl/protocol/STTakesAsset.h
index bf75ffccf7..70bafd0e91 100644
--- a/include/xrpl/protocol/STTakesAsset.h
+++ b/include/xrpl/protocol/STTakesAsset.h
@@ -3,6 +3,8 @@
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/STBase.h>
 
+#include <optional>
+
 namespace xrpl {
 
 /** Intermediate class for any STBase-derived class to store an Asset.
diff --git a/include/xrpl/protocol/STTx.h b/include/xrpl/protocol/STTx.h
index e78fce27a1..b36207bf61 100644
--- a/include/xrpl/protocol/STTx.h
+++ b/include/xrpl/protocol/STTx.h
@@ -1,18 +1,30 @@
 #pragma once
 
-#include <xrpl/protocol/Feature.h>
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/SeqProxy.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/TxFormats.h>
 
 #include <boost/container/flat_set.hpp>
 
+#include <cstddef>
+#include <cstdint>
 #include <expected>
 #include <functional>
+#include <memory>
 #include <optional>
+#include <string>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STValidation.h b/include/xrpl/protocol/STValidation.h
index 91ce88b441..67a6594419 100644
--- a/include/xrpl/protocol/STValidation.h
+++ b/include/xrpl/protocol/STValidation.h
@@ -1,15 +1,30 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/SOTemplate.h>
+#include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
-#include <xrpl/protocol/Units.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/tokens.h>
 
+#include <cstddef>
 #include <cstdint>
 #include <optional>
 #include <sstream>
+#include <stdexcept>
+#include <string>
 
 namespace xrpl {
 
@@ -72,35 +87,35 @@ public:
         F&& f);
 
     // Hash of the validated ledger
-    uint256
+    [[nodiscard]] uint256
     getLedgerHash() const;
 
     // Hash of consensus transaction set used to generate ledger
-    uint256
+    [[nodiscard]] uint256
     getConsensusHash() const;
 
-    NetClock::time_point
+    [[nodiscard]] NetClock::time_point
     getSignTime() const;
 
-    NetClock::time_point
+    [[nodiscard]] NetClock::time_point
     getSeenTime() const noexcept;
 
-    PublicKey const&
+    [[nodiscard]] PublicKey const&
     getSignerPublic() const noexcept;
 
-    NodeID const&
+    [[nodiscard]] NodeID const&
     getNodeID() const noexcept;
 
-    bool
+    [[nodiscard]] bool
     isValid() const noexcept;
 
-    bool
+    [[nodiscard]] bool
     isFull() const noexcept;
 
-    bool
+    [[nodiscard]] bool
     isTrusted() const noexcept;
 
-    uint256
+    [[nodiscard]] uint256
     getSigningHash() const;
 
     void
@@ -112,13 +127,13 @@ public:
     void
     setSeen(NetClock::time_point s);
 
-    Blob
+    [[nodiscard]] Blob
     getSerialized() const;
 
-    Blob
+    [[nodiscard]] Blob
     getSignature() const;
 
-    std::string
+    [[nodiscard]] std::string
     render() const
     {
         std::stringstream ss;
diff --git a/include/xrpl/protocol/STVector256.h b/include/xrpl/protocol/STVector256.h
index 5c454b6be0..46a1abc713 100644
--- a/include/xrpl/protocol/STVector256.h
+++ b/include/xrpl/protocol/STVector256.h
@@ -1,9 +1,15 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
-#include <xrpl/protocol/STBitString.h>
-#include <xrpl/protocol/STInteger.h>
+#include <xrpl/protocol/Serializer.h>
+
+#include <cstddef>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/STXChainBridge.h b/include/xrpl/protocol/STXChainBridge.h
index 292ffe2767..24d64ef02b 100644
--- a/include/xrpl/protocol/STXChainBridge.h
+++ b/include/xrpl/protocol/STXChainBridge.h
@@ -1,9 +1,19 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAccount.h>
 #include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STIssue.h>
+#include <xrpl/protocol/Serializer.h>
+
+#include <cstddef>
+#include <memory>
+#include <string>
+#include <tuple>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/SecretKey.h b/include/xrpl/protocol/SecretKey.h
index 712b095f81..8a0d917ab4 100644
--- a/include/xrpl/protocol/SecretKey.h
+++ b/include/xrpl/protocol/SecretKey.h
@@ -2,14 +2,18 @@
 
 #include <xrpl/basics/Buffer.h>
 #include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/Seed.h>
 #include <xrpl/protocol/tokens.h>
 
 #include <array>
+#include <cstdint>
 #include <cstring>
+#include <optional>
 #include <string>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/Seed.h b/include/xrpl/protocol/Seed.h
index 0b93b84516..a669f52079 100644
--- a/include/xrpl/protocol/Seed.h
+++ b/include/xrpl/protocol/Seed.h
@@ -5,7 +5,10 @@
 #include <xrpl/protocol/tokens.h>
 
 #include <array>
+#include <cstddef>
+#include <cstdint>
 #include <optional>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/Serializer.h b/include/xrpl/protocol/Serializer.h
index ffe9afabe8..1d0453d6aa 100644
--- a/include/xrpl/protocol/Serializer.h
+++ b/include/xrpl/protocol/Serializer.h
@@ -6,13 +6,14 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/safe_cast.h>
-#include <xrpl/basics/strHex.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/SField.h>
 
 #include <cstdint>
 #include <cstring>
+#include <stdexcept>
+#include <string>
 #include <type_traits>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/Sign.h b/include/xrpl/protocol/Sign.h
index 0b5b5d7239..18f085352d 100644
--- a/include/xrpl/protocol/Sign.h
+++ b/include/xrpl/protocol/Sign.h
@@ -1,9 +1,13 @@
 #pragma once
 
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/HashPrefix.h>
+#include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Serializer.h>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/SystemParameters.h b/include/xrpl/protocol/SystemParameters.h
index 1cc35a0f31..b31dd0cd42 100644
--- a/include/xrpl/protocol/SystemParameters.h
+++ b/include/xrpl/protocol/SystemParameters.h
@@ -1,9 +1,12 @@
 #pragma once
 
+#include <xrpl/basics/Number.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <chrono>
 #include <cstdint>
+#include <ratio>
 #include <string>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/TER.h b/include/xrpl/protocol/TER.h
index 4ee084e714..b29cb11e15 100644
--- a/include/xrpl/protocol/TER.h
+++ b/include/xrpl/protocol/TER.h
@@ -8,7 +8,9 @@
 #include <optional>
 #include <ostream>
 #include <string>
+#include <type_traits>
 #include <unordered_map>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/TxFormats.h b/include/xrpl/protocol/TxFormats.h
index 77ab069feb..36eb6d0889 100644
--- a/include/xrpl/protocol/TxFormats.h
+++ b/include/xrpl/protocol/TxFormats.h
@@ -1,7 +1,9 @@
 #pragma once
 
 #include <xrpl/protocol/KnownFormats.h>
+#include <xrpl/protocol/SOTemplate.h>
 
+#include <cstdint>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/TxMeta.h b/include/xrpl/protocol/TxMeta.h
index 6895350e9f..813f1b1615 100644
--- a/include/xrpl/protocol/TxMeta.h
+++ b/include/xrpl/protocol/TxMeta.h
@@ -1,12 +1,21 @@
 #pragma once
 
-#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/TER.h>
 
 #include <boost/container/flat_set.hpp>
 
+#include <cstdint>
 #include <optional>
 
 namespace xrpl {
diff --git a/include/xrpl/protocol/UintTypes.h b/include/xrpl/protocol/UintTypes.h
index b38c544096..1a3cb96691 100644
--- a/include/xrpl/protocol/UintTypes.h
+++ b/include/xrpl/protocol/UintTypes.h
@@ -1,9 +1,11 @@
 #pragma once
 
-#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Zero.h>
-#include <xrpl/protocol/AccountID.h>
+
+#include <functional>
+#include <ostream>
+#include <string>
 
 namespace xrpl {
 namespace detail {
diff --git a/include/xrpl/protocol/Units.h b/include/xrpl/protocol/Units.h
index 39f745e84e..8b418704d6 100644
--- a/include/xrpl/protocol/Units.h
+++ b/include/xrpl/protocol/Units.h
@@ -3,14 +3,18 @@
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_forwards.h>
 #include <xrpl/json/json_value.h>
 
 #include <boost/multiprecision/cpp_int.hpp>
 #include <boost/operators.hpp>
 
+#include <cstdint>
 #include <iosfwd>
 #include <limits>
 #include <optional>
+#include <string>
+#include <type_traits>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/XChainAttestations.h b/include/xrpl/protocol/XChainAttestations.h
index 1aec5fe549..8f1c7a4ce3 100644
--- a/include/xrpl/protocol/XChainAttestations.h
+++ b/include/xrpl/protocol/XChainAttestations.h
@@ -1,20 +1,20 @@
 #pragma once
 
 #include <xrpl/basics/Buffer.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STXChainBridge.h>
 #include <xrpl/protocol/SecretKey.h>
-#include <xrpl/protocol/TER.h>
 
 #include <boost/container/flat_set.hpp>
 #include <boost/container/vector.hpp>
 
 #include <cstddef>
-#include <expected>
+#include <cstdint>
+#include <optional>
 #include <utility>
 #include <vector>
 
diff --git a/include/xrpl/protocol/XRPAmount.h b/include/xrpl/protocol/XRPAmount.h
index f09ddc337a..3190980ecb 100644
--- a/include/xrpl/protocol/XRPAmount.h
+++ b/include/xrpl/protocol/XRPAmount.h
@@ -3,6 +3,7 @@
 #include <xrpl/basics/Number.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Zero.h>
+#include <xrpl/json/json_forwards.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/Units.h>
 
@@ -10,7 +11,11 @@
 #include <boost/operators.hpp>
 
 #include <cstdint>
+#include <istream>
+#include <limits>
 #include <optional>
+#include <ostream>
+#include <stdexcept>
 #include <string>
 #include <type_traits>
 
diff --git a/include/xrpl/protocol/detail/STVar.h b/include/xrpl/protocol/detail/STVar.h
index 71077d4b33..6853166174 100644
--- a/include/xrpl/protocol/detail/STVar.h
+++ b/include/xrpl/protocol/detail/STVar.h
@@ -5,6 +5,7 @@
 #include <xrpl/protocol/Serializer.h>
 
 #include <cstddef>
+#include <tuple>
 #include <type_traits>
 
 namespace xrpl::detail {
diff --git a/include/xrpl/protocol/detail/b58_utils.h b/include/xrpl/protocol/detail/b58_utils.h
index e800dbda06..f7aa4e74b4 100644
--- a/include/xrpl/protocol/detail/b58_utils.h
+++ b/include/xrpl/protocol/detail/b58_utils.h
@@ -1,12 +1,14 @@
 #pragma once
 
-#include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/detail/token_errors.h>
 
 #include <boost/outcome.hpp>
 #include <boost/outcome/result.hpp>
 
+#include <array>
+#include <cstddef>
+#include <cstdint>
 #include <span>
 #include <system_error>
 #include <tuple>
diff --git a/include/xrpl/protocol/detail/token_errors.h b/include/xrpl/protocol/detail/token_errors.h
index 97db9288f9..99a04596bb 100644
--- a/include/xrpl/protocol/detail/token_errors.h
+++ b/include/xrpl/protocol/detail/token_errors.h
@@ -1,6 +1,8 @@
 #pragma once
 
+#include <string>
 #include <system_error>
+#include <type_traits>
 
 namespace xrpl {
 enum class TokenCodecErrc {
diff --git a/include/xrpl/protocol/digest.h b/include/xrpl/protocol/digest.h
index 721ce60767..c1e70cada2 100644
--- a/include/xrpl/protocol/digest.h
+++ b/include/xrpl/protocol/digest.h
@@ -6,6 +6,9 @@
 #include <boost/endian/conversion.hpp>
 
 #include <array>
+#include <cstddef>
+#include <cstdint>
+#include <type_traits>
 
 namespace xrpl {
 
diff --git a/include/xrpl/protocol/json_get_or_throw.h b/include/xrpl/protocol/json_get_or_throw.h
index 9399f25827..7c7d9afe6c 100644
--- a/include/xrpl/protocol/json_get_or_throw.h
+++ b/include/xrpl/protocol/json_get_or_throw.h
@@ -7,8 +7,12 @@
 #include <xrpl/protocol/SField.h>
 
 #include <charconv>
+#include <cstdint>
 #include <exception>
 #include <optional>
+#include <string>
+#include <system_error>
+#include <utility>
 
 namespace json {
 struct JsonMissingKeyError : std::exception
diff --git a/include/xrpl/protocol/messages.h b/include/xrpl/protocol/messages.h
index e6654cc183..dcbe8649c0 100644
--- a/include/xrpl/protocol/messages.h
+++ b/include/xrpl/protocol/messages.h
@@ -10,5 +10,3 @@
 #ifdef TYPE_BOOL
 #undef TYPE_BOOL
 #endif
-
-#include <xrpl/proto/xrpl.pb.h>
diff --git a/include/xrpl/protocol/serialize.h b/include/xrpl/protocol/serialize.h
index 5b84a28b5d..e758b57d49 100644
--- a/include/xrpl/protocol/serialize.h
+++ b/include/xrpl/protocol/serialize.h
@@ -1,9 +1,12 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/strHex.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/Serializer.h>
 
+#include <string>
+
 namespace xrpl {
 
 /** Serialize an object to a blob. */
diff --git a/include/xrpl/protocol/st.h b/include/xrpl/protocol/st.h
deleted file mode 100644
index 61571196f2..0000000000
--- a/include/xrpl/protocol/st.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#pragma once
-
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAccount.h>
-#include <xrpl/protocol/STAmount.h>
-#include <xrpl/protocol/STArray.h>
-#include <xrpl/protocol/STBase.h>
-#include <xrpl/protocol/STBitString.h>
-#include <xrpl/protocol/STBlob.h>
-#include <xrpl/protocol/STInteger.h>
-#include <xrpl/protocol/STLedgerEntry.h>
-#include <xrpl/protocol/STNumber.h>
-#include <xrpl/protocol/STObject.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/STPathSet.h>
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/STValidation.h>
-#include <xrpl/protocol/STVector256.h>
diff --git a/include/xrpl/protocol/tokens.h b/include/xrpl/protocol/tokens.h
index 67cb25c7fb..bce7e7b5d6 100644
--- a/include/xrpl/protocol/tokens.h
+++ b/include/xrpl/protocol/tokens.h
@@ -1,14 +1,15 @@
 #pragma once
 
-#include <xrpl/basics/contract.h>
 #include <xrpl/protocol/detail/token_errors.h>
 
+#include <cstddef>
 #include <cstdint>
 #include <expected>
 #include <optional>
 #include <span>
 #include <string>
 #include <string_view>
+#include <system_error>
 
 namespace xrpl {
 
diff --git a/include/xrpl/rdb/DatabaseCon.h b/include/xrpl/rdb/DatabaseCon.h
index 08376f0e71..90aed04337 100644
--- a/include/xrpl/rdb/DatabaseCon.h
+++ b/include/xrpl/rdb/DatabaseCon.h
@@ -1,16 +1,24 @@
 #pragma once
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/PerfLog.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/core/StartUpType.h>
-#include <xrpl/rdb/DBInit.h>
 #include <xrpl/rdb/SociDB.h>
 
 #include <boost/filesystem/path.hpp>
 
+#include <soci/statement.h>
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <memory>
 #include <mutex>
-#include <optional>
 #include <string>
+#include <utility>
+#include <vector>
 
 namespace soci {
 class session;
diff --git a/include/xrpl/rdb/RelationalDatabase.h b/include/xrpl/rdb/RelationalDatabase.h
index a38d6a997f..91c282ff16 100644
--- a/include/xrpl/rdb/RelationalDatabase.h
+++ b/include/xrpl/rdb/RelationalDatabase.h
@@ -1,18 +1,34 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/Log.h>
 #include <xrpl/basics/RangeSet.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/LedgerHeader.h>
 #include <xrpl/protocol/LedgerShortcut.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/TxMeta.h>
 #include <xrpl/protocol/TxSearched.h>
-#include <xrpl/rdb/DatabaseCon.h>
 
 #include <boost/filesystem.hpp>
 #include <boost/variant.hpp>
 
+#include <concepts>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <map>
+#include <memory>
+#include <optional>
+#include <tuple>
+#include <utility>
+#include <variant>
+#include <vector>
+
 namespace xrpl {
 
 class Transaction;
diff --git a/include/xrpl/rdb/SociDB.h b/include/xrpl/rdb/SociDB.h
index e87aa2a182..0f427bd18b 100644
--- a/include/xrpl/rdb/SociDB.h
+++ b/include/xrpl/rdb/SociDB.h
@@ -8,6 +8,10 @@
     This module requires the @ref beast_sqlite external module.
 */
 
+#include <soci/blob.h>
+#include <soci/session.h>
+
+#include <memory>
 #if defined(__clang__)
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated"
@@ -17,7 +21,6 @@
 #include <xrpl/core/ServiceRegistry.h>
 
 #define SOCI_USE_BOOST
-#include <soci/soci.h>
 
 #include <cstdint>
 #include <string>
diff --git a/include/xrpl/resource/Charge.h b/include/xrpl/resource/Charge.h
index 3fd8b02e83..394d641e6c 100644
--- a/include/xrpl/resource/Charge.h
+++ b/include/xrpl/resource/Charge.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include <compare>
+#include <ostream>
 #include <string>
 
 namespace xrpl::Resource {
diff --git a/include/xrpl/resource/Consumer.h b/include/xrpl/resource/Consumer.h
index 14935bb3f1..18207832ac 100644
--- a/include/xrpl/resource/Consumer.h
+++ b/include/xrpl/resource/Consumer.h
@@ -1,10 +1,13 @@
 #pragma once
 
-#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/resource/Charge.h>
 #include <xrpl/resource/Disposition.h>
 
+#include <ostream>
+#include <string>
+
 namespace xrpl::Resource {
 
 struct Entry;
diff --git a/include/xrpl/resource/ResourceManager.h b/include/xrpl/resource/ResourceManager.h
index 42b2a47126..13e0d09343 100644
--- a/include/xrpl/resource/ResourceManager.h
+++ b/include/xrpl/resource/ResourceManager.h
@@ -10,6 +10,10 @@
 
 #include <boost/utility/string_view.hpp>
 
+#include <memory>
+#include <string>
+#include <string_view>
+
 namespace xrpl::Resource {
 
 /** Tracks load and resource consumption. */
diff --git a/include/xrpl/resource/Types.h b/include/xrpl/resource/Types.h
deleted file mode 100644
index fb71cffe37..0000000000
--- a/include/xrpl/resource/Types.h
+++ /dev/null
@@ -1,10 +0,0 @@
-#pragma once
-
-namespace xrpl {
-namespace Resource {
-
-struct Key;
-struct Entry;
-
-}  // namespace Resource
-}  // namespace xrpl
diff --git a/include/xrpl/resource/detail/Entry.h b/include/xrpl/resource/detail/Entry.h
index 361c8409c8..6f44ac2c29 100644
--- a/include/xrpl/resource/detail/Entry.h
+++ b/include/xrpl/resource/detail/Entry.h
@@ -3,10 +3,15 @@
 #include <xrpl/basics/DecayingSample.h>
 #include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/beast/core/List.h>
-#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/resource/detail/Key.h>
 #include <xrpl/resource/detail/Tuning.h>
 
+#include <chrono>
+#include <optional>
+#include <ostream>
+#include <string>
+
 namespace xrpl::Resource {
 
 using clock_type = beast::AbstractClock<std::chrono::steady_clock>;
diff --git a/include/xrpl/resource/detail/Import.h b/include/xrpl/resource/detail/Import.h
index 6e2a7b9e7c..a3df6fd73b 100644
--- a/include/xrpl/resource/detail/Import.h
+++ b/include/xrpl/resource/detail/Import.h
@@ -3,6 +3,8 @@
 #include <xrpl/resource/Consumer.h>
 #include <xrpl/resource/detail/Entry.h>
 
+#include <vector>
+
 namespace xrpl::Resource {
 
 /** A set of imported consumer data from a gossip origin. */
diff --git a/include/xrpl/resource/detail/Key.h b/include/xrpl/resource/detail/Key.h
index 7d24b33955..a0f11422a7 100644
--- a/include/xrpl/resource/detail/Key.h
+++ b/include/xrpl/resource/detail/Key.h
@@ -1,9 +1,10 @@
 #pragma once
 
+#include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/net/IPEndpoint.h>
-#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/resource/detail/Kind.h>
 
+#include <cstddef>
 #include <utility>
 
 namespace xrpl::Resource {
diff --git a/include/xrpl/resource/detail/Logic.h b/include/xrpl/resource/detail/Logic.h
index b11ac100f5..6b1c5e7397 100644
--- a/include/xrpl/resource/detail/Logic.h
+++ b/include/xrpl/resource/detail/Logic.h
@@ -4,16 +4,25 @@
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/clock/abstract_clock.h>
-#include <xrpl/beast/insight/Insight.h>
+#include <xrpl/beast/core/List.h>
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/jss.h>
+#include <xrpl/resource/Charge.h>
+#include <xrpl/resource/Consumer.h>
+#include <xrpl/resource/Disposition.h>
 #include <xrpl/resource/Fees.h>
 #include <xrpl/resource/Gossip.h>
 #include <xrpl/resource/detail/Import.h>
 
 #include <mutex>
+#include <string>
+#include <tuple>
+#include <utility>
 
 namespace xrpl::Resource {
 
diff --git a/include/xrpl/server/InfoSub.h b/include/xrpl/server/InfoSub.h
index f316885fd6..d708a456c4 100644
--- a/include/xrpl/server/InfoSub.h
+++ b/include/xrpl/server/InfoSub.h
@@ -1,13 +1,22 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Book.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/resource/Consumer.h>
 #include <xrpl/server/Manifest.h>
 
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <mutex>
+#include <string>
+
 namespace xrpl {
 
 // Operations that clients may wish to perform against the network
diff --git a/include/xrpl/server/LoadFeeTrack.h b/include/xrpl/server/LoadFeeTrack.h
index aa32e70ac8..a19ca063d5 100644
--- a/include/xrpl/server/LoadFeeTrack.h
+++ b/include/xrpl/server/LoadFeeTrack.h
@@ -7,6 +7,7 @@
 #include <algorithm>
 #include <cstdint>
 #include <mutex>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/Manifest.h b/include/xrpl/server/Manifest.h
index eed1c14dae..eb625d220a 100644
--- a/include/xrpl/server/Manifest.h
+++ b/include/xrpl/server/Manifest.h
@@ -1,14 +1,22 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/SecretKey.h>
 
+#include <atomic>
+#include <cstdint>
+#include <functional>
 #include <optional>
 #include <shared_mutex>
 #include <string>
+#include <type_traits>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/NetworkOPs.h b/include/xrpl/server/NetworkOPs.h
index 785d808935..ed2dbbb220 100644
--- a/include/xrpl/server/NetworkOPs.h
+++ b/include/xrpl/server/NetworkOPs.h
@@ -1,16 +1,24 @@
 #pragma once
 
-#include <xrpl/core/JobQueue.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Book.h>
 #include <xrpl/protocol/STValidation.h>
 #include <xrpl/protocol/TER.h>
-#include <xrpl/protocol/messages.h>
 #include <xrpl/server/InfoSub.h>
-#include <xrpl/shamap/SHAMap.h>
 
 #include <boost/asio.hpp>
 
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
 #include <memory>
+#include <optional>
+#include <sstream>
+#include <string>
 
 namespace xrpl {
 
@@ -25,6 +33,7 @@ class Transaction;
 class ValidatorKeys;
 class CanonicalTXSet;
 class RCLCxPeerPos;
+class SHAMap;
 
 // This is the primary interface into the "client" portion of the program.
 // Code that wants to do normal operations on the network such as
diff --git a/include/xrpl/server/Port.h b/include/xrpl/server/Port.h
index fd773c78fc..c48a2546c1 100644
--- a/include/xrpl/server/Port.h
+++ b/include/xrpl/server/Port.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <xrpl/beast/net/IPEndpoint.h>
-
 #include <boost/asio/ip/address.hpp>
 #include <boost/asio/ip/network_v4.hpp>
 #include <boost/asio/ip/network_v6.hpp>
@@ -11,6 +9,7 @@
 #include <cstdint>
 #include <memory>
 #include <optional>
+#include <ostream>
 #include <set>
 #include <string>
 #include <vector>
diff --git a/include/xrpl/server/Server.h b/include/xrpl/server/Server.h
index 4d97fe9877..956a414be8 100644
--- a/include/xrpl/server/Server.h
+++ b/include/xrpl/server/Server.h
@@ -1,12 +1,12 @@
 #pragma once
 
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/beast/utility/PropertyStream.h>
-#include <xrpl/server/Port.h>
 #include <xrpl/server/detail/ServerImpl.h>
 
 #include <boost/asio/io_context.hpp>
 
+#include <memory>
+
 namespace xrpl {
 
 /** Create the HTTP server using the specified handler. */
diff --git a/include/xrpl/server/Session.h b/include/xrpl/server/Session.h
index 151e57e7f2..266570862a 100644
--- a/include/xrpl/server/Session.h
+++ b/include/xrpl/server/Session.h
@@ -2,16 +2,16 @@
 
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/server/Handoff.h>
+#include <xrpl/server/Port.h>
 #include <xrpl/server/WSSession.h>
 #include <xrpl/server/Writer.h>
 
 #include <boost/beast/http/message.hpp>
 
-#include <functional>
+#include <cstddef>
 #include <memory>
-#include <ostream>
 #include <string_view>
-#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/SimpleWriter.h b/include/xrpl/server/SimpleWriter.h
index dfb0b165e8..996403eafb 100644
--- a/include/xrpl/server/SimpleWriter.h
+++ b/include/xrpl/server/SimpleWriter.h
@@ -7,7 +7,10 @@
 #include <boost/beast/http/message.hpp>
 #include <boost/beast/http/write.hpp>
 
-#include <utility>
+#include <cstddef>
+#include <functional>
+#include <iterator>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/State.h b/include/xrpl/server/State.h
index c3cc4f609c..8590f6e18f 100644
--- a/include/xrpl/server/State.h
+++ b/include/xrpl/server/State.h
@@ -2,10 +2,12 @@
 
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/rdb/DatabaseCon.h>
-#include <xrpl/server/Manifest.h>
+#include <xrpl/rdb/SociDB.h>
 
 #include <boost/filesystem.hpp>
 
+#include <string>
+
 namespace xrpl {
 
 struct SavedState
diff --git a/include/xrpl/server/Vacuum.h b/include/xrpl/server/Vacuum.h
index 5f80eced87..7930265e76 100644
--- a/include/xrpl/server/Vacuum.h
+++ b/include/xrpl/server/Vacuum.h
@@ -1,5 +1,6 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/rdb/DatabaseCon.h>
 
 namespace xrpl {
diff --git a/include/xrpl/server/WSSession.h b/include/xrpl/server/WSSession.h
index b2fa52c859..0087f9f50f 100644
--- a/include/xrpl/server/WSSession.h
+++ b/include/xrpl/server/WSSession.h
@@ -2,7 +2,6 @@
 
 #include <xrpl/server/Handoff.h>
 #include <xrpl/server/Port.h>
-#include <xrpl/server/Writer.h>
 
 #include <boost/asio/buffer.hpp>
 #include <boost/asio/ip/tcp.hpp>
@@ -11,7 +10,9 @@
 #include <boost/logic/tribool.hpp>
 
 #include <algorithm>
+#include <cstddef>
 #include <functional>
+#include <iterator>
 #include <memory>
 #include <utility>
 #include <vector>
diff --git a/include/xrpl/server/Wallet.h b/include/xrpl/server/Wallet.h
index c15014b1ef..eea44db200 100644
--- a/include/xrpl/server/Wallet.h
+++ b/include/xrpl/server/Wallet.h
@@ -1,9 +1,21 @@
 #pragma once
 
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/hash/uhash.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/PeerReservationTable.h>
+#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/SecretKey.h>
 #include <xrpl/rdb/DatabaseCon.h>
 #include <xrpl/server/Manifest.h>
 
+#include <functional>
+#include <memory>
+#include <string>
+#include <unordered_set>
+#include <utility>
+
 namespace xrpl {
 
 /**
diff --git a/include/xrpl/server/Writer.h b/include/xrpl/server/Writer.h
index 05fea863be..fe9d9519e1 100644
--- a/include/xrpl/server/Writer.h
+++ b/include/xrpl/server/Writer.h
@@ -2,6 +2,7 @@
 
 #include <boost/asio/buffer.hpp>
 
+#include <cstddef>
 #include <functional>
 #include <vector>
 
diff --git a/include/xrpl/server/detail/BaseHTTPPeer.h b/include/xrpl/server/detail/BaseHTTPPeer.h
index d26817bc45..f096d3c5a9 100644
--- a/include/xrpl/server/detail/BaseHTTPPeer.h
+++ b/include/xrpl/server/detail/BaseHTTPPeer.h
@@ -2,8 +2,12 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/net/IPAddressConversion.h>
-#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/server/Handoff.h>
+#include <xrpl/server/Port.h>
 #include <xrpl/server/Session.h>
+#include <xrpl/server/Writer.h>
 #include <xrpl/server/detail/Spawn.h>
 #include <xrpl/server/detail/io_list.h>
 
@@ -20,9 +24,12 @@
 
 #include <atomic>
 #include <chrono>
+#include <cstddef>
+#include <cstring>
 #include <functional>
 #include <memory>
 #include <mutex>
+#include <string>
 #include <utility>
 #include <vector>
 
@@ -392,7 +399,7 @@ BaseHTTPPeer<Handler, Impl>::write(void const* buf, std::size_t bytes)
     if ([&] {
             std::scoped_lock const lock(mutex_);
             wq_.emplace_back(buf, bytes);
-            return wq_.size() == 1 && wq2_.size() == 0;
+            return wq_.size() == 1 && wq2_.empty();
         }())
     {
         if (!strand_.running_in_this_thread())
diff --git a/include/xrpl/server/detail/BasePeer.h b/include/xrpl/server/detail/BasePeer.h
index edde28981c..5301a2f018 100644
--- a/include/xrpl/server/detail/BasePeer.h
+++ b/include/xrpl/server/detail/BasePeer.h
@@ -1,7 +1,7 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/WrappedSink.h>
-#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/server/Port.h>
 #include <xrpl/server/detail/LowestLayer.h>
 #include <xrpl/server/detail/io_list.h>
@@ -9,6 +9,7 @@
 #include <boost/asio.hpp>
 
 #include <atomic>
+#include <chrono>
 #include <functional>
 #include <string>
 #include <utility>
diff --git a/include/xrpl/server/detail/BaseWSPeer.h b/include/xrpl/server/detail/BaseWSPeer.h
index 13225dcba1..1b6a9faca3 100644
--- a/include/xrpl/server/detail/BaseWSPeer.h
+++ b/include/xrpl/server/detail/BaseWSPeer.h
@@ -1,10 +1,13 @@
 #pragma once
 
 #include <xrpl/basics/safe_cast.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/beast/utility/rngfill.h>
 #include <xrpl/crypto/csprng.h>
 #include <xrpl/protocol/BuildInfo.h>
+#include <xrpl/server/Handoff.h>
+#include <xrpl/server/Port.h>
 #include <xrpl/server/WSSession.h>
 #include <xrpl/server/detail/BasePeer.h>
 #include <xrpl/server/detail/LowestLayer.h>
@@ -16,8 +19,13 @@
 #include <boost/logic/tribool.hpp>
 
 #include <algorithm>
+#include <chrono>
 #include <functional>
+#include <iterator>
 #include <list>
+#include <memory>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/detail/Door.h b/include/xrpl/server/detail/Door.h
index 79d36cae0c..09b0adc5f2 100644
--- a/include/xrpl/server/detail/Door.h
+++ b/include/xrpl/server/detail/Door.h
@@ -2,6 +2,8 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/server/Port.h>
 #include <xrpl/server/detail/PlainHTTPPeer.h>
 #include <xrpl/server/detail/SSLHTTPPeer.h>
 #include <xrpl/server/detail/io_list.h>
@@ -19,6 +21,9 @@
 #include <boost/container/flat_map.hpp>
 #include <boost/predef.h>
 
+#include <exception>
+#include <stdexcept>
+
 #if !BOOST_OS_WINDOWS
 #include <sys/resource.h>
 
diff --git a/include/xrpl/server/detail/JSONRPCUtil.h b/include/xrpl/server/detail/JSONRPCUtil.h
index b2e87f5332..1c157708c2 100644
--- a/include/xrpl/server/detail/JSONRPCUtil.h
+++ b/include/xrpl/server/detail/JSONRPCUtil.h
@@ -2,7 +2,8 @@
 
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/json/Output.h>
-#include <xrpl/json/json_value.h>
+
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/detail/LowestLayer.h b/include/xrpl/server/detail/LowestLayer.h
index d28510d1a5..4daf91cd4c 100644
--- a/include/xrpl/server/detail/LowestLayer.h
+++ b/include/xrpl/server/detail/LowestLayer.h
@@ -1,23 +1,14 @@
 #pragma once
 
-#if BOOST_VERSION >= 107000
 #include <boost/beast/core/stream_traits.hpp>
-#else
-#include <boost/beast/core/type_traits.hpp>
-#endif
 
 namespace xrpl {
 
-// Before boost 1.70, get_lowest_layer required an explicit template parameter
 template <class T>
 decltype(auto)
 getLowestLayer(T& t) noexcept
 {
-#if BOOST_VERSION >= 107000
     return boost::beast::get_lowest_layer(t);
-#else
-    return t.lowest_layer();
-#endif
 }
 
 }  // namespace xrpl
diff --git a/include/xrpl/server/detail/PlainHTTPPeer.h b/include/xrpl/server/detail/PlainHTTPPeer.h
index 791ab91acf..b89272fe9e 100644
--- a/include/xrpl/server/detail/PlainHTTPPeer.h
+++ b/include/xrpl/server/detail/PlainHTTPPeer.h
@@ -1,12 +1,17 @@
 #pragma once
 
 #include <xrpl/beast/rfc2616.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/server/Port.h>
+#include <xrpl/server/WSSession.h>
 #include <xrpl/server/detail/BaseHTTPPeer.h>
 #include <xrpl/server/detail/PlainWSPeer.h>
 
 #include <boost/beast/core/tcp_stream.hpp>
 
+#include <functional>
 #include <memory>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/detail/PlainWSPeer.h b/include/xrpl/server/detail/PlainWSPeer.h
index 593973a3ed..279e256f51 100644
--- a/include/xrpl/server/detail/PlainWSPeer.h
+++ b/include/xrpl/server/detail/PlainWSPeer.h
@@ -1,10 +1,14 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/server/Port.h>
 #include <xrpl/server/detail/BaseWSPeer.h>
 
 #include <boost/beast/core/tcp_stream.hpp>
 
+#include <chrono>
 #include <memory>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/detail/SSLHTTPPeer.h b/include/xrpl/server/detail/SSLHTTPPeer.h
index f3b047150f..ea2108b917 100644
--- a/include/xrpl/server/detail/SSLHTTPPeer.h
+++ b/include/xrpl/server/detail/SSLHTTPPeer.h
@@ -1,5 +1,9 @@
 #pragma once
 
+#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/server/Port.h>
+#include <xrpl/server/WSSession.h>
 #include <xrpl/server/detail/BaseHTTPPeer.h>
 #include <xrpl/server/detail/SSLWSPeer.h>
 
@@ -9,7 +13,9 @@
 #include <boost/beast/core/tcp_stream.hpp>
 #include <boost/beast/ssl/ssl_stream.hpp>
 
+#include <functional>
 #include <memory>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/detail/SSLWSPeer.h b/include/xrpl/server/detail/SSLWSPeer.h
index cb03d5a796..fe522e3c9a 100644
--- a/include/xrpl/server/detail/SSLWSPeer.h
+++ b/include/xrpl/server/detail/SSLWSPeer.h
@@ -1,7 +1,9 @@
 #pragma once
 
-#include <xrpl/server/WSSession.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/server/Port.h>
 #include <xrpl/server/detail/BaseHTTPPeer.h>
+#include <xrpl/server/detail/BaseWSPeer.h>
 
 #include <boost/asio/ip/tcp.hpp>
 #include <boost/asio/ssl/context.hpp>
@@ -9,8 +11,11 @@
 #include <boost/beast/core/tcp_stream.hpp>
 #include <boost/beast/ssl/ssl_stream.hpp>
 #include <boost/beast/websocket/ssl.hpp>
+#include <boost/beast/websocket/stream.hpp>
 
+#include <chrono>
 #include <memory>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/detail/ServerImpl.h b/include/xrpl/server/detail/ServerImpl.h
index 48ffa26cfe..df2bba0284 100644
--- a/include/xrpl/server/detail/ServerImpl.h
+++ b/include/xrpl/server/detail/ServerImpl.h
@@ -1,7 +1,8 @@
 #pragma once
 
-#include <xrpl/basics/chrono.h>
-#include <xrpl/beast/core/List.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/server/Port.h>
 #include <xrpl/server/detail/Door.h>
 #include <xrpl/server/detail/io_list.h>
 
@@ -11,9 +12,15 @@
 
 #include <array>
 #include <chrono>
+#include <cstddef>
+#include <memory>
 #include <mutex>
 #include <optional>
+#include <stdexcept>
+#include <string>
 #include <unordered_map>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/server/detail/Spawn.h b/include/xrpl/server/detail/Spawn.h
index 2560a2718b..1ba32c2f0b 100644
--- a/include/xrpl/server/detail/Spawn.h
+++ b/include/xrpl/server/detail/Spawn.h
@@ -6,6 +6,7 @@
 #include <boost/asio/strand.hpp>
 
 #include <concepts>
+#include <exception>
 #include <type_traits>
 
 namespace xrpl::util {
diff --git a/include/xrpl/server/detail/io_list.h b/include/xrpl/server/detail/io_list.h
index 4daa23fb7e..0153bd3457 100644
--- a/include/xrpl/server/detail/io_list.h
+++ b/include/xrpl/server/detail/io_list.h
@@ -3,6 +3,7 @@
 #include <boost/container/flat_map.hpp>
 
 #include <condition_variable>
+#include <cstddef>
 #include <functional>
 #include <memory>
 #include <mutex>
diff --git a/include/xrpl/shamap/Family.h b/include/xrpl/shamap/Family.h
index b9dd85443a..c5bf953bfd 100644
--- a/include/xrpl/shamap/Family.h
+++ b/include/xrpl/shamap/Family.h
@@ -1,11 +1,13 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/nodestore/Database.h>
 #include <xrpl/shamap/FullBelowCache.h>
 #include <xrpl/shamap/TreeNodeCache.h>
 
 #include <cstdint>
+#include <memory>
 
 namespace xrpl {
 
diff --git a/include/xrpl/shamap/FullBelowCache.h b/include/xrpl/shamap/FullBelowCache.h
index e9fd04ac58..dc597278df 100644
--- a/include/xrpl/shamap/FullBelowCache.h
+++ b/include/xrpl/shamap/FullBelowCache.h
@@ -4,9 +4,13 @@
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/insight/NullCollector.h>
 #include <xrpl/beast/utility/Journal.h>
 
 #include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
 #include <string>
 
 namespace xrpl {
diff --git a/include/xrpl/shamap/SHAMap.h b/include/xrpl/shamap/SHAMap.h
index 3d08318cf6..d49e323b3f 100644
--- a/include/xrpl/shamap/SHAMap.h
+++ b/include/xrpl/shamap/SHAMap.h
@@ -1,11 +1,14 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/IntrusivePointer.h>
-#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/SHAMapHash.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/NodeObject.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/shamap/Family.h>
 #include <xrpl/shamap/SHAMapAddNode.h>
 #include <xrpl/shamap/SHAMapInnerNode.h>
@@ -14,8 +17,20 @@
 #include <xrpl/shamap/SHAMapMissingNode.h>
 #include <xrpl/shamap/SHAMapTreeNode.h>
 
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <deque>
+#include <functional>
+#include <iterator>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <optional>
 #include <set>
 #include <stack>
+#include <tuple>
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/shamap/SHAMapAccountStateLeafNode.h b/include/xrpl/shamap/SHAMapAccountStateLeafNode.h
index e388d205d1..ee81107f61 100644
--- a/include/xrpl/shamap/SHAMapAccountStateLeafNode.h
+++ b/include/xrpl/shamap/SHAMapAccountStateLeafNode.h
@@ -1,10 +1,17 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/protocol/HashPrefix.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/digest.h>
 #include <xrpl/shamap/SHAMapItem.h>
 #include <xrpl/shamap/SHAMapLeafNode.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <cstdint>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/shamap/SHAMapInnerNode.h b/include/xrpl/shamap/SHAMapInnerNode.h
index cafb498218..0fb4e24077 100644
--- a/include/xrpl/shamap/SHAMapInnerNode.h
+++ b/include/xrpl/shamap/SHAMapInnerNode.h
@@ -1,7 +1,11 @@
 #pragma once
 
-#include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/SHAMapHash.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/shamap/SHAMapNodeID.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
 #include <xrpl/shamap/detail/TaggedPointer.h>
 
 #include <atomic>
diff --git a/include/xrpl/shamap/SHAMapItem.h b/include/xrpl/shamap/SHAMapItem.h
index 41558197bf..846f0bab4e 100644
--- a/include/xrpl/shamap/SHAMapItem.h
+++ b/include/xrpl/shamap/SHAMapItem.h
@@ -5,10 +5,18 @@
 #include <xrpl/basics/SlabAllocator.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
 #include <boost/smart_ptr/intrusive_ptr.hpp>
 
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <memory>
+#include <type_traits>
+
 namespace xrpl {
 
 // an item stored in a SHAMap
diff --git a/include/xrpl/shamap/SHAMapLeafNode.h b/include/xrpl/shamap/SHAMapLeafNode.h
index af5ed29702..112c243131 100644
--- a/include/xrpl/shamap/SHAMapLeafNode.h
+++ b/include/xrpl/shamap/SHAMapLeafNode.h
@@ -1,9 +1,12 @@
 #pragma once
 
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/shamap/SHAMapItem.h>
+#include <xrpl/shamap/SHAMapNodeID.h>
 #include <xrpl/shamap/SHAMapTreeNode.h>
 
 #include <cstdint>
+#include <string>
 
 namespace xrpl {
 
diff --git a/include/xrpl/shamap/SHAMapMissingNode.h b/include/xrpl/shamap/SHAMapMissingNode.h
index 0bc072463e..3168d0eff1 100644
--- a/include/xrpl/shamap/SHAMapMissingNode.h
+++ b/include/xrpl/shamap/SHAMapMissingNode.h
@@ -1,9 +1,9 @@
 #pragma once
 
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/basics/base_uint.h>
-#include <xrpl/shamap/SHAMapTreeNode.h>
+#include <xrpl/basics/safe_cast.h>
 
-#include <iosfwd>
 #include <stdexcept>
 #include <string>
 #include <type_traits>
diff --git a/include/xrpl/shamap/SHAMapNodeID.h b/include/xrpl/shamap/SHAMapNodeID.h
index 248c9cb80b..b812c10ca9 100644
--- a/include/xrpl/shamap/SHAMapNodeID.h
+++ b/include/xrpl/shamap/SHAMapNodeID.h
@@ -3,7 +3,9 @@
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/base_uint.h>
 
+#include <cstddef>
 #include <optional>
+#include <ostream>
 #include <string>
 #include <string_view>
 #include <tuple>
diff --git a/include/xrpl/shamap/SHAMapSyncFilter.h b/include/xrpl/shamap/SHAMapSyncFilter.h
index 4104220a3f..b6ce175915 100644
--- a/include/xrpl/shamap/SHAMapSyncFilter.h
+++ b/include/xrpl/shamap/SHAMapSyncFilter.h
@@ -1,7 +1,10 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/shamap/SHAMapTreeNode.h>
 
+#include <cstdint>
 #include <optional>
 
 /** Callback for filtering SHAMap during sync. */
diff --git a/include/xrpl/shamap/SHAMapTreeNode.h b/include/xrpl/shamap/SHAMapTreeNode.h
index 5cca2ea41a..1eebbaa17f 100644
--- a/include/xrpl/shamap/SHAMapTreeNode.h
+++ b/include/xrpl/shamap/SHAMapTreeNode.h
@@ -3,8 +3,8 @@
 #include <xrpl/basics/IntrusivePointer.h>
 #include <xrpl/basics/IntrusiveRefCounts.h>
 #include <xrpl/basics/SHAMapHash.h>
+#include <xrpl/basics/Slice.h>
 #include <xrpl/protocol/Serializer.h>
-#include <xrpl/shamap/SHAMapItem.h>
 #include <xrpl/shamap/SHAMapNodeID.h>
 
 #include <cstddef>
diff --git a/include/xrpl/shamap/SHAMapTxLeafNode.h b/include/xrpl/shamap/SHAMapTxLeafNode.h
index 49f4f90906..86186434f8 100644
--- a/include/xrpl/shamap/SHAMapTxLeafNode.h
+++ b/include/xrpl/shamap/SHAMapTxLeafNode.h
@@ -1,10 +1,17 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/protocol/HashPrefix.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/digest.h>
 #include <xrpl/shamap/SHAMapItem.h>
 #include <xrpl/shamap/SHAMapLeafNode.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <cstdint>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/shamap/SHAMapTxPlusMetaLeafNode.h b/include/xrpl/shamap/SHAMapTxPlusMetaLeafNode.h
index 3f4163ac41..9e4573d45b 100644
--- a/include/xrpl/shamap/SHAMapTxPlusMetaLeafNode.h
+++ b/include/xrpl/shamap/SHAMapTxPlusMetaLeafNode.h
@@ -1,10 +1,17 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/protocol/HashPrefix.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/digest.h>
 #include <xrpl/shamap/SHAMapItem.h>
 #include <xrpl/shamap/SHAMapLeafNode.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <cstdint>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/shamap/TreeNodeCache.h b/include/xrpl/shamap/TreeNodeCache.h
index 2d5782c7e9..bff03a76e2 100644
--- a/include/xrpl/shamap/TreeNodeCache.h
+++ b/include/xrpl/shamap/TreeNodeCache.h
@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/IntrusivePointer.h>
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/shamap/SHAMapTreeNode.h>
 
 namespace xrpl {
diff --git a/include/xrpl/shamap/detail/TaggedPointer.h b/include/xrpl/shamap/detail/TaggedPointer.h
index 5eb3863de0..79f3464d5b 100644
--- a/include/xrpl/shamap/detail/TaggedPointer.h
+++ b/include/xrpl/shamap/detail/TaggedPointer.h
@@ -1,11 +1,14 @@
 #pragma once
 
-#include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/shamap/SHAMapTreeNode.h>
 
-#include <array>
+#include <bit>
 #include <cstdint>
 #include <optional>
+#include <tuple>
+#include <utility>
+#include <version>  // IWYU pragma: keep
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/ApplyContext.h b/include/xrpl/tx/ApplyContext.h
index c98b3f82c5..ca778387cd 100644
--- a/include/xrpl/tx/ApplyContext.h
+++ b/include/xrpl/tx/ApplyContext.h
@@ -1,12 +1,23 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ApplyViewImpl.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/RawView.h>
+#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxMeta.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <cstddef>
+#include <functional>
 #include <optional>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/SignerEntries.h b/include/xrpl/tx/SignerEntries.h
index af0c9b9d28..c8481f6062 100644
--- a/include/xrpl/tx/SignerEntries.h
+++ b/include/xrpl/tx/SignerEntries.h
@@ -1,13 +1,15 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>  // beast::Journal
-#include <xrpl/protocol/TER.h>           // temMALFORMED
-#include <xrpl/protocol/UintTypes.h>     // AccountID
-#include <xrpl/tx/Transactor.h>          // NotTEC
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/TER.h>  // temMALFORMED
 
+#include <cstdint>
 #include <expected>
 #include <optional>
 #include <string_view>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/Transactor.h b/include/xrpl/tx/Transactor.h
index 2b50cfa6e7..bc5e8c80e7 100644
--- a/include/xrpl/tx/Transactor.h
+++ b/include/xrpl/tx/Transactor.h
@@ -1,14 +1,30 @@
 #pragma once
 
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/WrappedSink.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Permissions.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/Units.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/applySteps.h>
 
+#include <cstddef>
 #include <cstdint>
+#include <functional>
+#include <optional>
 #include <tuple>
+#include <unordered_set>
 #include <utility>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/apply.h b/include/xrpl/tx/apply.h
index 49b30fea02..55d365c31b 100644
--- a/include/xrpl/tx/apply.h
+++ b/include/xrpl/tx/apply.h
@@ -1,10 +1,14 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/ledger/View.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/tx/applySteps.h>
 
+#include <string>
 #include <utility>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/applySteps.h b/include/xrpl/tx/applySteps.h
index 897cf500d6..3298e49192 100644
--- a/include/xrpl/tx/applySteps.h
+++ b/include/xrpl/tx/applySteps.h
@@ -1,7 +1,19 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/ledger/ApplyViewImpl.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/SeqProxy.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxMeta.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <cstdint>
+#include <optional>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/invariants/AMMInvariant.h b/include/xrpl/tx/invariants/AMMInvariant.h
index 4b56370774..29d962fb79 100644
--- a/include/xrpl/tx/invariants/AMMInvariant.h
+++ b/include/xrpl/tx/invariants/AMMInvariant.h
@@ -2,9 +2,12 @@
 
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
 #include <optional>
 
diff --git a/include/xrpl/tx/invariants/DirectoryInvariant.h b/include/xrpl/tx/invariants/DirectoryInvariant.h
index 96643ea465..d18ac539cc 100644
--- a/include/xrpl/tx/invariants/DirectoryInvariant.h
+++ b/include/xrpl/tx/invariants/DirectoryInvariant.h
@@ -1,8 +1,10 @@
 #pragma once
 
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/XRPAmount.h>
diff --git a/include/xrpl/tx/invariants/FreezeInvariant.h b/include/xrpl/tx/invariants/FreezeInvariant.h
index a76eb66497..4b3e9beec4 100644
--- a/include/xrpl/tx/invariants/FreezeInvariant.h
+++ b/include/xrpl/tx/invariants/FreezeInvariant.h
@@ -2,10 +2,13 @@
 
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
 #include <map>
 #include <vector>
diff --git a/include/xrpl/tx/invariants/InvariantCheck.h b/include/xrpl/tx/invariants/InvariantCheck.h
index ba91cba064..d19f34635d 100644
--- a/include/xrpl/tx/invariants/InvariantCheck.h
+++ b/include/xrpl/tx/invariants/InvariantCheck.h
@@ -1,10 +1,11 @@
 #pragma once
 
-#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/invariants/AMMInvariant.h>
 #include <xrpl/tx/invariants/DirectoryInvariant.h>
 #include <xrpl/tx/invariants/FreezeInvariant.h>
@@ -17,7 +18,11 @@
 #include <xrpl/tx/invariants/VaultInvariant.h>
 
 #include <cstdint>
+#include <set>
+#include <string>
 #include <tuple>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/invariants/InvariantCheckPrivilege.h b/include/xrpl/tx/invariants/InvariantCheckPrivilege.h
index e55419dfc1..b2f1c62a54 100644
--- a/include/xrpl/tx/invariants/InvariantCheckPrivilege.h
+++ b/include/xrpl/tx/invariants/InvariantCheckPrivilege.h
@@ -1,5 +1,6 @@
 #pragma once
 
+#include <xrpl/basics/safe_cast.h>
 #include <xrpl/protocol/STTx.h>
 
 #include <type_traits>
diff --git a/include/xrpl/tx/invariants/LoanBrokerInvariant.h b/include/xrpl/tx/invariants/LoanBrokerInvariant.h
index 684bbff423..979f57de35 100644
--- a/include/xrpl/tx/invariants/LoanBrokerInvariant.h
+++ b/include/xrpl/tx/invariants/LoanBrokerInvariant.h
@@ -3,8 +3,10 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
 #include <map>
 #include <vector>
diff --git a/include/xrpl/tx/invariants/LoanInvariant.h b/include/xrpl/tx/invariants/LoanInvariant.h
index 3f408d169a..0648881423 100644
--- a/include/xrpl/tx/invariants/LoanInvariant.h
+++ b/include/xrpl/tx/invariants/LoanInvariant.h
@@ -2,9 +2,12 @@
 
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/invariants/MPTInvariant.h b/include/xrpl/tx/invariants/MPTInvariant.h
index aa90f1b8ef..1d39fd13d8 100644
--- a/include/xrpl/tx/invariants/MPTInvariant.h
+++ b/include/xrpl/tx/invariants/MPTInvariant.h
@@ -1,13 +1,21 @@
 #pragma once
 
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <array>
 #include <cstdint>
+#include <map>
 #include <memory>
+#include <optional>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/invariants/NFTInvariant.h b/include/xrpl/tx/invariants/NFTInvariant.h
index 698df05247..11bdf5a569 100644
--- a/include/xrpl/tx/invariants/NFTInvariant.h
+++ b/include/xrpl/tx/invariants/NFTInvariant.h
@@ -1,10 +1,11 @@
 #pragma once
 
-#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
 #include <cstdint>
 
diff --git a/include/xrpl/tx/invariants/PermissionedDEXInvariant.h b/include/xrpl/tx/invariants/PermissionedDEXInvariant.h
index 2ec22ded88..2763b80a94 100644
--- a/include/xrpl/tx/invariants/PermissionedDEXInvariant.h
+++ b/include/xrpl/tx/invariants/PermissionedDEXInvariant.h
@@ -1,10 +1,13 @@
 #pragma once
 
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/invariants/PermissionedDomainInvariant.h b/include/xrpl/tx/invariants/PermissionedDomainInvariant.h
index 19edcc0b39..fae7c24d25 100644
--- a/include/xrpl/tx/invariants/PermissionedDomainInvariant.h
+++ b/include/xrpl/tx/invariants/PermissionedDomainInvariant.h
@@ -2,9 +2,12 @@
 
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <cstddef>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/invariants/VaultInvariant.h b/include/xrpl/tx/invariants/VaultInvariant.h
index 2a9ffc8282..bc8246b234 100644
--- a/include/xrpl/tx/invariants/VaultInvariant.h
+++ b/include/xrpl/tx/invariants/VaultInvariant.h
@@ -3,13 +3,18 @@
 #include <xrpl/basics/Number.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <cstdint>
 #include <optional>
 #include <unordered_map>
 #include <vector>
diff --git a/include/xrpl/tx/paths/AMMLiquidity.h b/include/xrpl/tx/paths/AMMLiquidity.h
index 9abe37f868..bf62155b61 100644
--- a/include/xrpl/tx/paths/AMMLiquidity.h
+++ b/include/xrpl/tx/paths/AMMLiquidity.h
@@ -1,13 +1,17 @@
 #pragma once
 
-#include <xrpl/basics/Log.h>
+#include <xrpl/basics/Number.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/ledger/View.h>
-#include <xrpl/ledger/helpers/AMMHelpers.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Quality.h>
+#include <xrpl/protocol/Rules.h>
 #include <xrpl/tx/transactors/dex/AMMContext.h>
 
+#include <cstdint>
+#include <optional>
+
 namespace xrpl {
 
 template <StepAmount TIn, StepAmount TOut>
diff --git a/include/xrpl/tx/paths/AMMOffer.h b/include/xrpl/tx/paths/AMMOffer.h
index 21c45c36a3..40a9cf40b3 100644
--- a/include/xrpl/tx/paths/AMMOffer.h
+++ b/include/xrpl/tx/paths/AMMOffer.h
@@ -1,12 +1,18 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Quality.h>
 #include <xrpl/protocol/TER.h>
 
+#include <cstdint>
+#include <optional>
+#include <utility>
+
 namespace xrpl {
 
 template <typename TIn, typename TOut>
diff --git a/include/xrpl/tx/paths/BookTip.h b/include/xrpl/tx/paths/BookTip.h
index c4bdb0415c..bad007ca5b 100644
--- a/include/xrpl/tx/paths/BookTip.h
+++ b/include/xrpl/tx/paths/BookTip.h
@@ -1,8 +1,11 @@
 #pragma once
 
-#include <xrpl/ledger/View.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/protocol/Book.h>
 #include <xrpl/protocol/Quality.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/paths/Flow.h b/include/xrpl/tx/paths/Flow.h
index c746249866..f73b9a3440 100644
--- a/include/xrpl/tx/paths/Flow.h
+++ b/include/xrpl/tx/paths/Flow.h
@@ -1,9 +1,16 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Quality.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STPathSet.h>
 #include <xrpl/tx/paths/RippleCalc.h>
 #include <xrpl/tx/paths/detail/Steps.h>
 
+#include <optional>
+
 namespace xrpl {
 
 namespace path::detail {
diff --git a/include/xrpl/tx/paths/Offer.h b/include/xrpl/tx/paths/Offer.h
index 2dab5bcebf..164a933ba1 100644
--- a/include/xrpl/tx/paths/Offer.h
+++ b/include/xrpl/tx/paths/Offer.h
@@ -1,16 +1,26 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
-#include <xrpl/ledger/View.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
+#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Quality.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
 
+#include <cstdint>
+#include <optional>
+#include <ostream>
 #include <stdexcept>
+#include <string>
 #include <utility>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/paths/OfferStream.h b/include/xrpl/tx/paths/OfferStream.h
index 69409b9ef7..98c58876c9 100644
--- a/include/xrpl/tx/paths/OfferStream.h
+++ b/include/xrpl/tx/paths/OfferStream.h
@@ -1,15 +1,20 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/ledger/View.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/protocol/Book.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/tx/paths/BookTip.h>
 #include <xrpl/tx/paths/Offer.h>
 
 #include <boost/container/flat_set.hpp>
 
+#include <cstdint>
+#include <optional>
+
 namespace xrpl {
 
 template <StepAmount TIn, StepAmount TOut>
diff --git a/include/xrpl/tx/paths/RippleCalc.h b/include/xrpl/tx/paths/RippleCalc.h
index c747787820..62c966d384 100644
--- a/include/xrpl/tx/paths/RippleCalc.h
+++ b/include/xrpl/tx/paths/RippleCalc.h
@@ -1,12 +1,17 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/PaymentSandbox.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STPathSet.h>
 #include <xrpl/protocol/TER.h>
 
 #include <boost/container/flat_set.hpp>
 
+#include <optional>
+
 namespace xrpl {
 class Config;
 namespace path {
diff --git a/include/xrpl/tx/paths/detail/EitherAmount.h b/include/xrpl/tx/paths/detail/EitherAmount.h
index ffd90751b8..68ad90d2d4 100644
--- a/include/xrpl/tx/paths/detail/EitherAmount.h
+++ b/include/xrpl/tx/paths/detail/EitherAmount.h
@@ -1,10 +1,15 @@
 #pragma once
 
+#include <xrpl/basics/contract.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/IOUAmount.h>
-#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/MPTAmount.h>  // IWYU pragma: keep
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <ostream>
+#include <stdexcept>
+#include <variant>
+
 namespace xrpl {
 
 struct EitherAmount
diff --git a/include/xrpl/tx/paths/detail/FlowDebugInfo.h b/include/xrpl/tx/paths/detail/FlowDebugInfo.h
index 1ccfba34ce..48066840f5 100644
--- a/include/xrpl/tx/paths/detail/FlowDebugInfo.h
+++ b/include/xrpl/tx/paths/detail/FlowDebugInfo.h
@@ -1,14 +1,22 @@
 #pragma once
 
-#include <xrpl/ledger/PaymentSandbox.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/IOUAmount.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/paths/detail/EitherAmount.h>
 
 #include <boost/container/flat_map.hpp>
 
 #include <chrono>
-#include <optional>
+#include <cstddef>
 #include <sstream>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <vector>
 
 namespace xrpl::path::detail {
 // Track performance information of a single payment
diff --git a/include/xrpl/tx/paths/detail/StepChecks.h b/include/xrpl/tx/paths/detail/StepChecks.h
index 4955c4f8e6..f62613e95c 100644
--- a/include/xrpl/tx/paths/detail/StepChecks.h
+++ b/include/xrpl/tx/paths/detail/StepChecks.h
@@ -2,9 +2,15 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/View.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/paths/detail/Steps.h b/include/xrpl/tx/paths/detail/Steps.h
index 9909c4bdcd..7eb6b938a5 100644
--- a/include/xrpl/tx/paths/detail/Steps.h
+++ b/include/xrpl/tx/paths/detail/Steps.h
@@ -1,16 +1,30 @@
 #pragma once
 
-#include <xrpl/basics/Log.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Book.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Quality.h>
 #include <xrpl/protocol/QualityFunction.h>
+#include <xrpl/protocol/STPathSet.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
 #include <xrpl/tx/paths/detail/EitherAmount.h>
 
 #include <boost/container/flat_set.hpp>
 
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
 #include <optional>
+#include <ostream>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 class PaymentSandbox;
diff --git a/include/xrpl/tx/paths/detail/StrandFlow.h b/include/xrpl/tx/paths/detail/StrandFlow.h
index 4d988a4c7e..fe657b2100 100644
--- a/include/xrpl/tx/paths/detail/StrandFlow.h
+++ b/include/xrpl/tx/paths/detail/StrandFlow.h
@@ -1,12 +1,21 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
-#include <xrpl/ledger/View.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/helpers/AMMHelpers.h>
 #include <xrpl/ledger/helpers/OfferHelpers.h>
-#include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/IOUAmount.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/MPTAmount.h>
+#include <xrpl/protocol/Quality.h>
+#include <xrpl/protocol/QualityFunction.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/paths/Flow.h>
 #include <xrpl/tx/paths/detail/FlatSets.h>
@@ -17,8 +26,16 @@
 #include <boost/container/flat_set.hpp>
 
 #include <algorithm>
+#include <cstddef>
+#include <cstdint>
 #include <iterator>
+#include <memory>
 #include <numeric>
+#include <optional>
+#include <tuple>
+#include <type_traits>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/transactors/account/AccountDelete.h b/include/xrpl/tx/transactors/account/AccountDelete.h
index 16661a4b7c..e69d948bb8 100644
--- a/include/xrpl/tx/transactors/account/AccountDelete.h
+++ b/include/xrpl/tx/transactors/account/AccountDelete.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/account/AccountSet.h b/include/xrpl/tx/transactors/account/AccountSet.h
index 91b38e7968..4326621f3d 100644
--- a/include/xrpl/tx/transactors/account/AccountSet.h
+++ b/include/xrpl/tx/transactors/account/AccountSet.h
@@ -1,8 +1,16 @@
 #pragma once
 
-#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class AccountSet : public Transactor
diff --git a/include/xrpl/tx/transactors/account/SetRegularKey.h b/include/xrpl/tx/transactors/account/SetRegularKey.h
index 6ff9c5aa52..90e4cd96cd 100644
--- a/include/xrpl/tx/transactors/account/SetRegularKey.h
+++ b/include/xrpl/tx/transactors/account/SetRegularKey.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/account/SignerListSet.h b/include/xrpl/tx/transactors/account/SignerListSet.h
index 46e3191323..da2274a1de 100644
--- a/include/xrpl/tx/transactors/account/SignerListSet.h
+++ b/include/xrpl/tx/transactors/account/SignerListSet.h
@@ -1,11 +1,20 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/SignerEntries.h>
 #include <xrpl/tx/Transactor.h>
 
 #include <cstdint>
+#include <tuple>
 #include <vector>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/bridge/XChainBridge.h b/include/xrpl/tx/transactors/bridge/XChainBridge.h
index 58a546de2f..24f49eb340 100644
--- a/include/xrpl/tx/transactors/bridge/XChainBridge.h
+++ b/include/xrpl/tx/transactors/bridge/XChainBridge.h
@@ -1,8 +1,17 @@
 #pragma once
 
-#include <xrpl/protocol/XChainAttestations.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstddef>
+#include <cstdint>
+
 namespace xrpl {
 
 constexpr size_t kXbridgeMaxAccountCreateClaims = 128;
diff --git a/include/xrpl/tx/transactors/check/CheckCancel.h b/include/xrpl/tx/transactors/check/CheckCancel.h
index b8e8b6c52d..b54d1e6c84 100644
--- a/include/xrpl/tx/transactors/check/CheckCancel.h
+++ b/include/xrpl/tx/transactors/check/CheckCancel.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/check/CheckCash.h b/include/xrpl/tx/transactors/check/CheckCash.h
index 7d4e615cfd..4656f941f4 100644
--- a/include/xrpl/tx/transactors/check/CheckCash.h
+++ b/include/xrpl/tx/transactors/check/CheckCash.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/check/CheckCreate.h b/include/xrpl/tx/transactors/check/CheckCreate.h
index 178fe4707c..50a1f076e0 100644
--- a/include/xrpl/tx/transactors/check/CheckCreate.h
+++ b/include/xrpl/tx/transactors/check/CheckCreate.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/credentials/CredentialAccept.h b/include/xrpl/tx/transactors/credentials/CredentialAccept.h
index 8630ac3f7f..b9dfa684e7 100644
--- a/include/xrpl/tx/transactors/credentials/CredentialAccept.h
+++ b/include/xrpl/tx/transactors/credentials/CredentialAccept.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class CredentialAccept : public Transactor
diff --git a/include/xrpl/tx/transactors/credentials/CredentialCreate.h b/include/xrpl/tx/transactors/credentials/CredentialCreate.h
index 91b5e829d3..ce9f9305be 100644
--- a/include/xrpl/tx/transactors/credentials/CredentialCreate.h
+++ b/include/xrpl/tx/transactors/credentials/CredentialCreate.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class CredentialCreate : public Transactor
diff --git a/include/xrpl/tx/transactors/credentials/CredentialDelete.h b/include/xrpl/tx/transactors/credentials/CredentialDelete.h
index 70fe5cb3d0..2f151a9fa0 100644
--- a/include/xrpl/tx/transactors/credentials/CredentialDelete.h
+++ b/include/xrpl/tx/transactors/credentials/CredentialDelete.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class CredentialDelete : public Transactor
diff --git a/include/xrpl/tx/transactors/delegate/DelegateSet.h b/include/xrpl/tx/transactors/delegate/DelegateSet.h
index a55524ecff..b7141276de 100644
--- a/include/xrpl/tx/transactors/delegate/DelegateSet.h
+++ b/include/xrpl/tx/transactors/delegate/DelegateSet.h
@@ -1,5 +1,13 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/dex/AMMBid.h b/include/xrpl/tx/transactors/dex/AMMBid.h
index dfa50d06ba..fa257696e8 100644
--- a/include/xrpl/tx/transactors/dex/AMMBid.h
+++ b/include/xrpl/tx/transactors/dex/AMMBid.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/dex/AMMClawback.h b/include/xrpl/tx/transactors/dex/AMMClawback.h
index 6f31480490..54eb3c9f27 100644
--- a/include/xrpl/tx/transactors/dex/AMMClawback.h
+++ b/include/xrpl/tx/transactors/dex/AMMClawback.h
@@ -1,7 +1,20 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+#include <optional>
+#include <tuple>
+
 namespace xrpl {
 class Sandbox;
 class AMMClawback : public Transactor
diff --git a/include/xrpl/tx/transactors/dex/AMMCreate.h b/include/xrpl/tx/transactors/dex/AMMCreate.h
index 64d2a1e3b1..188af8d4ef 100644
--- a/include/xrpl/tx/transactors/dex/AMMCreate.h
+++ b/include/xrpl/tx/transactors/dex/AMMCreate.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/dex/AMMDelete.h b/include/xrpl/tx/transactors/dex/AMMDelete.h
index d3e8cfeeb4..4a0905fe10 100644
--- a/include/xrpl/tx/transactors/dex/AMMDelete.h
+++ b/include/xrpl/tx/transactors/dex/AMMDelete.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/dex/AMMDeposit.h b/include/xrpl/tx/transactors/dex/AMMDeposit.h
index 453046ddad..b87db19b2d 100644
--- a/include/xrpl/tx/transactors/dex/AMMDeposit.h
+++ b/include/xrpl/tx/transactors/dex/AMMDeposit.h
@@ -1,7 +1,21 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+#include <optional>
+#include <utility>
+
 namespace xrpl {
 
 class Sandbox;
diff --git a/include/xrpl/tx/transactors/dex/AMMVote.h b/include/xrpl/tx/transactors/dex/AMMVote.h
index 8defc1369e..10ad284bb3 100644
--- a/include/xrpl/tx/transactors/dex/AMMVote.h
+++ b/include/xrpl/tx/transactors/dex/AMMVote.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/dex/AMMWithdraw.h b/include/xrpl/tx/transactors/dex/AMMWithdraw.h
index 8b6d39349b..8f6700037d 100644
--- a/include/xrpl/tx/transactors/dex/AMMWithdraw.h
+++ b/include/xrpl/tx/transactors/dex/AMMWithdraw.h
@@ -1,9 +1,23 @@
 #pragma once
 
-#include <xrpl/ledger/View.h>
-#include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+#include <optional>
+#include <tuple>
+#include <utility>
+
 namespace xrpl {
 
 class Sandbox;
diff --git a/include/xrpl/tx/transactors/dex/OfferCancel.h b/include/xrpl/tx/transactors/dex/OfferCancel.h
index 2806b6942f..974478475c 100644
--- a/include/xrpl/tx/transactors/dex/OfferCancel.h
+++ b/include/xrpl/tx/transactors/dex/OfferCancel.h
@@ -1,6 +1,12 @@
 #pragma once
 
-#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/dex/OfferCreate.h b/include/xrpl/tx/transactors/dex/OfferCreate.h
index 7faf613d3a..a3bf7626f9 100644
--- a/include/xrpl/tx/transactors/dex/OfferCreate.h
+++ b/include/xrpl/tx/transactors/dex/OfferCreate.h
@@ -1,8 +1,28 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/Quality.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+#include <functional>
+#include <optional>
+#include <string>
+#include <utility>
+
 namespace xrpl {
 
 class PaymentSandbox;
diff --git a/include/xrpl/tx/transactors/did/DIDDelete.h b/include/xrpl/tx/transactors/did/DIDDelete.h
index 94615f51b6..c119b0348e 100644
--- a/include/xrpl/tx/transactors/did/DIDDelete.h
+++ b/include/xrpl/tx/transactors/did/DIDDelete.h
@@ -1,5 +1,15 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/did/DIDSet.h b/include/xrpl/tx/transactors/did/DIDSet.h
index 8c84ea6c9b..481222243b 100644
--- a/include/xrpl/tx/transactors/did/DIDSet.h
+++ b/include/xrpl/tx/transactors/did/DIDSet.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/escrow/EscrowCancel.h b/include/xrpl/tx/transactors/escrow/EscrowCancel.h
index af09f70202..b52fb2a9fa 100644
--- a/include/xrpl/tx/transactors/escrow/EscrowCancel.h
+++ b/include/xrpl/tx/transactors/escrow/EscrowCancel.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/escrow/EscrowCreate.h b/include/xrpl/tx/transactors/escrow/EscrowCreate.h
index 8800e97b80..b8e22aa24e 100644
--- a/include/xrpl/tx/transactors/escrow/EscrowCreate.h
+++ b/include/xrpl/tx/transactors/escrow/EscrowCreate.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/escrow/EscrowFinish.h b/include/xrpl/tx/transactors/escrow/EscrowFinish.h
index 061fa0527c..07459bf959 100644
--- a/include/xrpl/tx/transactors/escrow/EscrowFinish.h
+++ b/include/xrpl/tx/transactors/escrow/EscrowFinish.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/lending/LoanBrokerCoverClawback.h b/include/xrpl/tx/transactors/lending/LoanBrokerCoverClawback.h
index 81ea97ce7e..cd72a01bc3 100644
--- a/include/xrpl/tx/transactors/lending/LoanBrokerCoverClawback.h
+++ b/include/xrpl/tx/transactors/lending/LoanBrokerCoverClawback.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/lending/LoanBrokerCoverDeposit.h b/include/xrpl/tx/transactors/lending/LoanBrokerCoverDeposit.h
index 43b932726b..03ed295766 100644
--- a/include/xrpl/tx/transactors/lending/LoanBrokerCoverDeposit.h
+++ b/include/xrpl/tx/transactors/lending/LoanBrokerCoverDeposit.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.h b/include/xrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.h
index a757ac51bf..1132211e58 100644
--- a/include/xrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.h
+++ b/include/xrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/lending/LoanBrokerDelete.h b/include/xrpl/tx/transactors/lending/LoanBrokerDelete.h
index 0ce5f29387..7a9a529510 100644
--- a/include/xrpl/tx/transactors/lending/LoanBrokerDelete.h
+++ b/include/xrpl/tx/transactors/lending/LoanBrokerDelete.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/lending/LoanBrokerSet.h b/include/xrpl/tx/transactors/lending/LoanBrokerSet.h
index 75175e2dd6..e7137c9311 100644
--- a/include/xrpl/tx/transactors/lending/LoanBrokerSet.h
+++ b/include/xrpl/tx/transactors/lending/LoanBrokerSet.h
@@ -1,7 +1,17 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <vector>
+
 namespace xrpl {
 
 class LoanBrokerSet : public Transactor
diff --git a/include/xrpl/tx/transactors/lending/LoanDelete.h b/include/xrpl/tx/transactors/lending/LoanDelete.h
index 9e8c3c172a..604388a2bd 100644
--- a/include/xrpl/tx/transactors/lending/LoanDelete.h
+++ b/include/xrpl/tx/transactors/lending/LoanDelete.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/lending/LoanManage.h b/include/xrpl/tx/transactors/lending/LoanManage.h
index d2344c0ec0..c8a5584131 100644
--- a/include/xrpl/tx/transactors/lending/LoanManage.h
+++ b/include/xrpl/tx/transactors/lending/LoanManage.h
@@ -1,7 +1,18 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class LoanManage : public Transactor
diff --git a/include/xrpl/tx/transactors/lending/LoanPay.h b/include/xrpl/tx/transactors/lending/LoanPay.h
index 9be9695c64..599bea6ae6 100644
--- a/include/xrpl/tx/transactors/lending/LoanPay.h
+++ b/include/xrpl/tx/transactors/lending/LoanPay.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class LoanPay : public Transactor
diff --git a/include/xrpl/tx/transactors/lending/LoanSet.h b/include/xrpl/tx/transactors/lending/LoanSet.h
index d277629e44..fab489e3db 100644
--- a/include/xrpl/tx/transactors/lending/LoanSet.h
+++ b/include/xrpl/tx/transactors/lending/LoanSet.h
@@ -1,8 +1,19 @@
 #pragma once
 
-#include <xrpl/ledger/helpers/LendingHelpers.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STNumber.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+#include <vector>
+
 namespace xrpl {
 
 class LoanSet : public Transactor
diff --git a/include/xrpl/tx/transactors/nft/NFTokenAcceptOffer.h b/include/xrpl/tx/transactors/nft/NFTokenAcceptOffer.h
index c5cd10fa6a..28037ae3b9 100644
--- a/include/xrpl/tx/transactors/nft/NFTokenAcceptOffer.h
+++ b/include/xrpl/tx/transactors/nft/NFTokenAcceptOffer.h
@@ -1,5 +1,15 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/nft/NFTokenBurn.h b/include/xrpl/tx/transactors/nft/NFTokenBurn.h
index 849d09cb7e..a9640e3a9e 100644
--- a/include/xrpl/tx/transactors/nft/NFTokenBurn.h
+++ b/include/xrpl/tx/transactors/nft/NFTokenBurn.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/nft/NFTokenCancelOffer.h b/include/xrpl/tx/transactors/nft/NFTokenCancelOffer.h
index a74a1c3e59..35c9067f63 100644
--- a/include/xrpl/tx/transactors/nft/NFTokenCancelOffer.h
+++ b/include/xrpl/tx/transactors/nft/NFTokenCancelOffer.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/nft/NFTokenCreateOffer.h b/include/xrpl/tx/transactors/nft/NFTokenCreateOffer.h
index c874381dd0..f11ac5c373 100644
--- a/include/xrpl/tx/transactors/nft/NFTokenCreateOffer.h
+++ b/include/xrpl/tx/transactors/nft/NFTokenCreateOffer.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class NFTokenCreateOffer : public Transactor
diff --git a/include/xrpl/tx/transactors/nft/NFTokenMint.h b/include/xrpl/tx/transactors/nft/NFTokenMint.h
index 9267e8e801..9d5874fa60 100644
--- a/include/xrpl/tx/transactors/nft/NFTokenMint.h
+++ b/include/xrpl/tx/transactors/nft/NFTokenMint.h
@@ -1,9 +1,19 @@
 #pragma once
 
-#include <xrpl/ledger/helpers/NFTokenHelpers.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol/nft.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class NFTokenMint : public Transactor
diff --git a/include/xrpl/tx/transactors/nft/NFTokenModify.h b/include/xrpl/tx/transactors/nft/NFTokenModify.h
index 0d18e4a6d4..970914bbfe 100644
--- a/include/xrpl/tx/transactors/nft/NFTokenModify.h
+++ b/include/xrpl/tx/transactors/nft/NFTokenModify.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/oracle/OracleDelete.h b/include/xrpl/tx/transactors/oracle/OracleDelete.h
index c16d5fb2a9..f9e9230527 100644
--- a/include/xrpl/tx/transactors/oracle/OracleDelete.h
+++ b/include/xrpl/tx/transactors/oracle/OracleDelete.h
@@ -1,5 +1,14 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/oracle/OracleSet.h b/include/xrpl/tx/transactors/oracle/OracleSet.h
index 831c11b8c4..e95970923b 100644
--- a/include/xrpl/tx/transactors/oracle/OracleSet.h
+++ b/include/xrpl/tx/transactors/oracle/OracleSet.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/payment/DepositPreauth.h b/include/xrpl/tx/transactors/payment/DepositPreauth.h
index 742b1ef3f7..b9b42ddac6 100644
--- a/include/xrpl/tx/transactors/payment/DepositPreauth.h
+++ b/include/xrpl/tx/transactors/payment/DepositPreauth.h
@@ -1,5 +1,14 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/payment/Payment.h b/include/xrpl/tx/transactors/payment/Payment.h
index dd792aa1c2..1356a368e9 100644
--- a/include/xrpl/tx/transactors/payment/Payment.h
+++ b/include/xrpl/tx/transactors/payment/Payment.h
@@ -1,7 +1,19 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Permissions.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <unordered_set>
+
 namespace xrpl {
 
 class Payment : public Transactor
diff --git a/include/xrpl/tx/transactors/payment_channel/PaymentChannelClaim.h b/include/xrpl/tx/transactors/payment_channel/PaymentChannelClaim.h
index e13fea6d6c..85df2a02e7 100644
--- a/include/xrpl/tx/transactors/payment_channel/PaymentChannelClaim.h
+++ b/include/xrpl/tx/transactors/payment_channel/PaymentChannelClaim.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class PaymentChannelClaim : public Transactor
diff --git a/include/xrpl/tx/transactors/payment_channel/PaymentChannelCreate.h b/include/xrpl/tx/transactors/payment_channel/PaymentChannelCreate.h
index 56e984cd57..f0c9da6349 100644
--- a/include/xrpl/tx/transactors/payment_channel/PaymentChannelCreate.h
+++ b/include/xrpl/tx/transactors/payment_channel/PaymentChannelCreate.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/payment_channel/PaymentChannelFund.h b/include/xrpl/tx/transactors/payment_channel/PaymentChannelFund.h
index 272076ff20..377fbe9cf2 100644
--- a/include/xrpl/tx/transactors/payment_channel/PaymentChannelFund.h
+++ b/include/xrpl/tx/transactors/payment_channel/PaymentChannelFund.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.h b/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.h
index 88883fb86f..5a07262a3b 100644
--- a/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.h
+++ b/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.h b/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.h
index 4afa8cef5a..38de800284 100644
--- a/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.h
+++ b/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/system/Batch.h b/include/xrpl/tx/transactors/system/Batch.h
index 927a5b27cd..6540005877 100644
--- a/include/xrpl/tx/transactors/system/Batch.h
+++ b/include/xrpl/tx/transactors/system/Batch.h
@@ -1,7 +1,18 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <array>
+#include <cstdint>
+
 namespace xrpl {
 
 class Batch : public Transactor
diff --git a/include/xrpl/tx/transactors/system/Change.h b/include/xrpl/tx/transactors/system/Change.h
index 339723ae8e..b25208f075 100644
--- a/include/xrpl/tx/transactors/system/Change.h
+++ b/include/xrpl/tx/transactors/system/Change.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/system/LedgerStateFix.h b/include/xrpl/tx/transactors/system/LedgerStateFix.h
index 973f89faa9..dd91f6f367 100644
--- a/include/xrpl/tx/transactors/system/LedgerStateFix.h
+++ b/include/xrpl/tx/transactors/system/LedgerStateFix.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class LedgerStateFix : public Transactor
diff --git a/include/xrpl/tx/transactors/system/TicketCreate.h b/include/xrpl/tx/transactors/system/TicketCreate.h
index 5783faa6d1..2a1036c732 100644
--- a/include/xrpl/tx/transactors/system/TicketCreate.h
+++ b/include/xrpl/tx/transactors/system/TicketCreate.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class TicketCreate : public Transactor
diff --git a/include/xrpl/tx/transactors/token/Clawback.h b/include/xrpl/tx/transactors/token/Clawback.h
index ed90776e59..5eaa32fe48 100644
--- a/include/xrpl/tx/transactors/token/Clawback.h
+++ b/include/xrpl/tx/transactors/token/Clawback.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTClawback.h b/include/xrpl/tx/transactors/token/ConfidentialMPTClawback.h
index ff6f76e8ea..21d95326c9 100644
--- a/include/xrpl/tx/transactors/token/ConfidentialMPTClawback.h
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTClawback.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <memory>
+
 namespace xrpl {
 
 /**
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTConvert.h b/include/xrpl/tx/transactors/token/ConfidentialMPTConvert.h
index 2e2591844f..6de2ce141f 100644
--- a/include/xrpl/tx/transactors/token/ConfidentialMPTConvert.h
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTConvert.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <memory>
+
 namespace xrpl {
 
 /**
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h b/include/xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h
index cb4b6295a0..e2ee844560 100644
--- a/include/xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <memory>
+
 namespace xrpl {
 
 /**
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h b/include/xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h
index 585c273e12..7c348d36a5 100644
--- a/include/xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTMergeInbox.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <memory>
+
 namespace xrpl {
 
 /**
diff --git a/include/xrpl/tx/transactors/token/ConfidentialMPTSend.h b/include/xrpl/tx/transactors/token/ConfidentialMPTSend.h
index 72599ab987..aecf1ea5e2 100644
--- a/include/xrpl/tx/transactors/token/ConfidentialMPTSend.h
+++ b/include/xrpl/tx/transactors/token/ConfidentialMPTSend.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <memory>
+
 namespace xrpl {
 
 /**
diff --git a/include/xrpl/tx/transactors/token/MPTokenAuthorize.h b/include/xrpl/tx/transactors/token/MPTokenAuthorize.h
index e30d123e52..b9fd48abe3 100644
--- a/include/xrpl/tx/transactors/token/MPTokenAuthorize.h
+++ b/include/xrpl/tx/transactors/token/MPTokenAuthorize.h
@@ -1,7 +1,19 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+#include <optional>
+
 namespace xrpl {
 
 struct MPTAuthorizeArgs
diff --git a/include/xrpl/tx/transactors/token/MPTokenIssuanceCreate.h b/include/xrpl/tx/transactors/token/MPTokenIssuanceCreate.h
index d946587e32..045911c7ae 100644
--- a/include/xrpl/tx/transactors/token/MPTokenIssuanceCreate.h
+++ b/include/xrpl/tx/transactors/token/MPTokenIssuanceCreate.h
@@ -1,9 +1,22 @@
 #pragma once
 
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
 #include <expected>
+#include <optional>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/transactors/token/MPTokenIssuanceDestroy.h b/include/xrpl/tx/transactors/token/MPTokenIssuanceDestroy.h
index 21032e7337..743e5a9502 100644
--- a/include/xrpl/tx/transactors/token/MPTokenIssuanceDestroy.h
+++ b/include/xrpl/tx/transactors/token/MPTokenIssuanceDestroy.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/token/MPTokenIssuanceSet.h b/include/xrpl/tx/transactors/token/MPTokenIssuanceSet.h
index 428c573e2f..52f155e8fe 100644
--- a/include/xrpl/tx/transactors/token/MPTokenIssuanceSet.h
+++ b/include/xrpl/tx/transactors/token/MPTokenIssuanceSet.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class MPTokenIssuanceSet : public Transactor
diff --git a/include/xrpl/tx/transactors/token/TrustSet.h b/include/xrpl/tx/transactors/token/TrustSet.h
index d719f06326..fbf50f56ee 100644
--- a/include/xrpl/tx/transactors/token/TrustSet.h
+++ b/include/xrpl/tx/transactors/token/TrustSet.h
@@ -1,8 +1,18 @@
 #pragma once
 
-#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Permissions.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+#include <unordered_set>
+
 namespace xrpl {
 
 class TrustSet : public Transactor
diff --git a/include/xrpl/tx/transactors/vault/VaultClawback.h b/include/xrpl/tx/transactors/vault/VaultClawback.h
index 2ff97abca2..ba0eb9f320 100644
--- a/include/xrpl/tx/transactors/vault/VaultClawback.h
+++ b/include/xrpl/tx/transactors/vault/VaultClawback.h
@@ -1,8 +1,18 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 #include <expected>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/include/xrpl/tx/transactors/vault/VaultCreate.h b/include/xrpl/tx/transactors/vault/VaultCreate.h
index 9b11f97957..f946a22c3a 100644
--- a/include/xrpl/tx/transactors/vault/VaultCreate.h
+++ b/include/xrpl/tx/transactors/vault/VaultCreate.h
@@ -1,7 +1,16 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 class VaultCreate : public Transactor
diff --git a/include/xrpl/tx/transactors/vault/VaultDelete.h b/include/xrpl/tx/transactors/vault/VaultDelete.h
index b8bb3c4096..ca73b1a685 100644
--- a/include/xrpl/tx/transactors/vault/VaultDelete.h
+++ b/include/xrpl/tx/transactors/vault/VaultDelete.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/vault/VaultDeposit.h b/include/xrpl/tx/transactors/vault/VaultDeposit.h
index 523b3f2e53..d49f504243 100644
--- a/include/xrpl/tx/transactors/vault/VaultDeposit.h
+++ b/include/xrpl/tx/transactors/vault/VaultDeposit.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/vault/VaultSet.h b/include/xrpl/tx/transactors/vault/VaultSet.h
index 5c362d5db4..835ed69610 100644
--- a/include/xrpl/tx/transactors/vault/VaultSet.h
+++ b/include/xrpl/tx/transactors/vault/VaultSet.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/include/xrpl/tx/transactors/vault/VaultWithdraw.h b/include/xrpl/tx/transactors/vault/VaultWithdraw.h
index 7bbe06187d..22ad39d26d 100644
--- a/include/xrpl/tx/transactors/vault/VaultWithdraw.h
+++ b/include/xrpl/tx/transactors/vault/VaultWithdraw.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {
diff --git a/src/libxrpl/core/detail/JobQueue.cpp b/src/libxrpl/core/detail/JobQueue.cpp
index 5c07bf68cc..ffb91db72d 100644
--- a/src/libxrpl/core/detail/JobQueue.cpp
+++ b/src/libxrpl/core/detail/JobQueue.cpp
@@ -6,6 +6,7 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/Job.h>
 #include <xrpl/core/JobTypeInfo.h>
+#include <xrpl/core/JobTypes.h>
 #include <xrpl/core/LoadEvent.h>
 #include <xrpl/core/PerfLog.h>
 #include <xrpl/json/json_value.h>
diff --git a/src/libxrpl/json/json_value.cpp b/src/libxrpl/json/json_value.cpp
index 93875f497a..074a88428c 100644
--- a/src/libxrpl/json/json_value.cpp
+++ b/src/libxrpl/json/json_value.cpp
@@ -1,9 +1,11 @@
 #include <xrpl/json/json_value.h>
 
 #include <xrpl/basics/Number.h>
+#include <xrpl/basics/contract.h>  // IWYU pragma: keep
 #include <xrpl/beast/core/LexicalCast.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/detail/json_assert.h>
+#include <xrpl/json/json_errors.h>  // IWYU pragma: keep
 #include <xrpl/json/json_forwards.h>
 #include <xrpl/json/json_writer.h>
 
diff --git a/src/libxrpl/net/RegisterSSLCerts.cpp b/src/libxrpl/net/RegisterSSLCerts.cpp
index ff59b5971e..2f005554a0 100644
--- a/src/libxrpl/net/RegisterSSLCerts.cpp
+++ b/src/libxrpl/net/RegisterSSLCerts.cpp
@@ -6,6 +6,8 @@
 #include <boost/system/detail/error_code.hpp>
 
 #if BOOST_OS_WINDOWS
+#include <xrpl/basics/Log.h>
+
 #include <boost/asio/ssl/error.hpp>
 #include <boost/system/error_code.hpp>
 
diff --git a/src/libxrpl/protocol/AMMCore.cpp b/src/libxrpl/protocol/AMMCore.cpp
index e58ab29257..52b7fe82c2 100644
--- a/src/libxrpl/protocol/AMMCore.cpp
+++ b/src/libxrpl/protocol/AMMCore.cpp
@@ -12,6 +12,7 @@
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STInteger.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
diff --git a/src/libxrpl/protocol/ConfidentialTransfer.cpp b/src/libxrpl/protocol/ConfidentialTransfer.cpp
index 0baff1e33a..fe8a08c2ef 100644
--- a/src/libxrpl/protocol/ConfidentialTransfer.cpp
+++ b/src/libxrpl/protocol/ConfidentialTransfer.cpp
@@ -7,6 +7,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STBlob.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
diff --git a/src/libxrpl/protocol/Permissions.cpp b/src/libxrpl/protocol/Permissions.cpp
index 80aa1b1f4e..2f3e25f823 100644
--- a/src/libxrpl/protocol/Permissions.cpp
+++ b/src/libxrpl/protocol/Permissions.cpp
@@ -3,6 +3,7 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/Feature.h>  // IWYU pragma: keep
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/SOTemplate.h>
diff --git a/src/libxrpl/protocol/STNumber.cpp b/src/libxrpl/protocol/STNumber.cpp
index 8ef7b9760f..fcc0077f6b 100644
--- a/src/libxrpl/protocol/STNumber.cpp
+++ b/src/libxrpl/protocol/STNumber.cpp
@@ -5,7 +5,7 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/Asset.h>
-#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/Rules.h>  // IWYU pragma: keep
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STBase.h>
diff --git a/src/libxrpl/server/State.cpp b/src/libxrpl/server/State.cpp
index d9793f53d0..ce17505ee6 100644
--- a/src/libxrpl/server/State.cpp
+++ b/src/libxrpl/server/State.cpp
@@ -7,6 +7,7 @@
 
 #include <boost/optional/optional.hpp>  // IWYU pragma: keep
 
+#include <soci/boost-optional.h>  // IWYU pragma: keep
 #include <soci/into.h>
 #include <soci/session.h>
 #include <soci/use.h>
diff --git a/src/libxrpl/server/Wallet.cpp b/src/libxrpl/server/Wallet.cpp
index f3ae9dc925..f3a7ff76ba 100644
--- a/src/libxrpl/server/Wallet.cpp
+++ b/src/libxrpl/server/Wallet.cpp
@@ -19,7 +19,9 @@
 #include <boost/format/free_funcs.hpp>
 #include <boost/optional/optional.hpp>  // IWYU pragma: keep
 
+#include <soci/blob-exchange.h>  // IWYU pragma: keep
 #include <soci/blob.h>
+#include <soci/boost-optional.h>  // IWYU pragma: keep
 #include <soci/into.h>
 #include <soci/session.h>
 #include <soci/statement.h>
diff --git a/src/libxrpl/tx/invariants/PermissionedDomainInvariant.cpp b/src/libxrpl/tx/invariants/PermissionedDomainInvariant.cpp
index 544a3af2dc..fcb53e7c8f 100644
--- a/src/libxrpl/tx/invariants/PermissionedDomainInvariant.cpp
+++ b/src/libxrpl/tx/invariants/PermissionedDomainInvariant.cpp
@@ -8,6 +8,7 @@
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAccount.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
diff --git a/src/libxrpl/tx/transactors/dex/OfferCreate.cpp b/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
index ed5a22e3db..a915bb60d1 100644
--- a/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
+++ b/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
@@ -8,6 +8,7 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/OrderBookDB.h>
 #include <xrpl/ledger/PaymentSandbox.h>
+#include <xrpl/ledger/Sandbox.h>
 #include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
diff --git a/src/libxrpl/tx/transactors/nft/NFTokenCreateOffer.cpp b/src/libxrpl/tx/transactors/nft/NFTokenCreateOffer.cpp
index 1948f3803d..259b9d7864 100644
--- a/src/libxrpl/tx/transactors/nft/NFTokenCreateOffer.cpp
+++ b/src/libxrpl/tx/transactors/nft/NFTokenCreateOffer.cpp
@@ -5,6 +5,7 @@
 #include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/NFTokenHelpers.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAccount.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
diff --git a/src/libxrpl/tx/transactors/system/Batch.cpp b/src/libxrpl/tx/transactors/system/Batch.cpp
index 16d27f98d9..ba54c14b1e 100644
--- a/src/libxrpl/tx/transactors/system/Batch.cpp
+++ b/src/libxrpl/tx/transactors/system/Batch.cpp
@@ -10,6 +10,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAccount.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STTx.h>
diff --git a/src/test/app/FlowMPT_test.cpp b/src/test/app/FlowMPT_test.cpp
index 2e224a7eb1..39d722da65 100644
--- a/src/test/app/FlowMPT_test.cpp
+++ b/src/test/app/FlowMPT_test.cpp
@@ -5,6 +5,7 @@
 #include <test/jtx/amount.h>
 #include <test/jtx/balance.h>
 #include <test/jtx/mpt.h>
+#include <test/jtx/offer.h>
 #include <test/jtx/owners.h>
 #include <test/jtx/paths.h>
 #include <test/jtx/pay.h>
diff --git a/src/test/app/LedgerReplay_test.cpp b/src/test/app/LedgerReplay_test.cpp
index da98c03380..bac1d8b61f 100644
--- a/src/test/app/LedgerReplay_test.cpp
+++ b/src/test/app/LedgerReplay_test.cpp
@@ -12,6 +12,7 @@
 
 #include <xrpld/app/ledger/BuildLedger.h>
 #include <xrpld/app/ledger/InboundLedger.h>
+#include <xrpld/app/ledger/InboundLedgers.h>
 #include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/ledger/LedgerReplay.h>
 #include <xrpld/app/ledger/LedgerReplayTask.h>
diff --git a/src/test/app/MultiSign_test.cpp b/src/test/app/MultiSign_test.cpp
index 8fb1eb31ab..5f02f1b079 100644
--- a/src/test/app/MultiSign_test.cpp
+++ b/src/test/app/MultiSign_test.cpp
@@ -35,6 +35,7 @@
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
diff --git a/src/test/app/OfferMPT_test.cpp b/src/test/app/OfferMPT_test.cpp
index 9958515c5f..800b14877a 100644
--- a/src/test/app/OfferMPT_test.cpp
+++ b/src/test/app/OfferMPT_test.cpp
@@ -12,11 +12,13 @@
 #include <test/jtx/offer.h>
 #include <test/jtx/owners.h>
 #include <test/jtx/paths.h>
+#include <test/jtx/pay.h>
 #include <test/jtx/require.h>
 #include <test/jtx/sendmax.h>
 #include <test/jtx/tags.h>
 #include <test/jtx/ter.h>
 #include <test/jtx/ticket.h>
+#include <test/jtx/trust.h>
 #include <test/jtx/txflags.h>
 
 #include <xrpl/beast/unit_test/suite.h>
diff --git a/src/test/app/PayStrand_test.cpp b/src/test/app/PayStrand_test.cpp
index 1f9290de63..11a0e5bab0 100644
--- a/src/test/app/PayStrand_test.cpp
+++ b/src/test/app/PayStrand_test.cpp
@@ -8,6 +8,7 @@
 #include <test/jtx/jtx_json.h>
 #include <test/jtx/offer.h>
 #include <test/jtx/owners.h>  // IWYU pragma: keep
+#include <test/jtx/paths.h>
 #include <test/jtx/pay.h>
 #include <test/jtx/sendmax.h>
 #include <test/jtx/ter.h>
diff --git a/src/test/app/SHAMapStore_test.cpp b/src/test/app/SHAMapStore_test.cpp
index 7a149b2f64..c219bd8737 100644
--- a/src/test/app/SHAMapStore_test.cpp
+++ b/src/test/app/SHAMapStore_test.cpp
@@ -15,6 +15,7 @@
 #include <xrpl/config/Constants.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/nodestore/Backend.h>
+#include <xrpl/nodestore/Manager.h>
 #include <xrpl/nodestore/detail/DatabaseRotatingImp.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/LedgerHeader.h>
diff --git a/src/test/basics/hardened_hash_test.cpp b/src/test/basics/hardened_hash_test.cpp
index 885ba9d60b..8b10967932 100644
--- a/src/test/basics/hardened_hash_test.cpp
+++ b/src/test/basics/hardened_hash_test.cpp
@@ -1,4 +1,5 @@
 #include <xrpl/basics/hardened_hash.h>
+#include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/unit_test/suite.h>
 
 #include <array>
diff --git a/src/test/beast/IPEndpointCommon.h b/src/test/beast/IPEndpointCommon.h
index 0ff0da35be..45d036476c 100644
--- a/src/test/beast/IPEndpointCommon.h
+++ b/src/test/beast/IPEndpointCommon.h
@@ -1,8 +1,12 @@
 #pragma once
 
 #include <xrpl/basics/random.h>
+#include <xrpl/beast/net/IPAddressV4.h>
+#include <xrpl/beast/net/IPAddressV6.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 
+#include <cstdint>
+
 namespace beast::IP {
 
 inline Endpoint
diff --git a/src/test/beast/aged_associative_container_test.cpp b/src/test/beast/aged_associative_container_test.cpp
index 413194491a..3dbaf74040 100644
--- a/src/test/beast/aged_associative_container_test.cpp
+++ b/src/test/beast/aged_associative_container_test.cpp
@@ -1,12 +1,12 @@
 #include <xrpl/beast/clock/manual_clock.h>
-#include <xrpl/beast/container/aged_map.h>
-#include <xrpl/beast/container/aged_multimap.h>
-#include <xrpl/beast/container/aged_multiset.h>
-#include <xrpl/beast/container/aged_set.h>
-#include <xrpl/beast/container/aged_unordered_map.h>
-#include <xrpl/beast/container/aged_unordered_multimap.h>
-#include <xrpl/beast/container/aged_unordered_multiset.h>
-#include <xrpl/beast/container/aged_unordered_set.h>
+#include <xrpl/beast/container/aged_map.h>                 // IWYU pragma: keep
+#include <xrpl/beast/container/aged_multimap.h>            // IWYU pragma: keep
+#include <xrpl/beast/container/aged_multiset.h>            // IWYU pragma: keep
+#include <xrpl/beast/container/aged_set.h>                 // IWYU pragma: keep
+#include <xrpl/beast/container/aged_unordered_map.h>       // IWYU pragma: keep
+#include <xrpl/beast/container/aged_unordered_multimap.h>  // IWYU pragma: keep
+#include <xrpl/beast/container/aged_unordered_multiset.h>  // IWYU pragma: keep
+#include <xrpl/beast/container/aged_unordered_set.h>       // IWYU pragma: keep
 #include <xrpl/beast/container/detail/aged_ordered_container.h>
 #include <xrpl/beast/container/detail/aged_unordered_container.h>
 #include <xrpl/beast/unit_test/suite.h>
@@ -18,9 +18,9 @@
 #include <memory>
 #include <stdexcept>
 #include <string>
-#include <type_traits>
+#include <type_traits>  // IWYU pragma: keep
 #include <utility>
-#include <vector>
+#include <vector>  // IWYU pragma: keep
 
 #ifndef BEAST_AGED_UNORDERED_NO_ALLOC_DEFAULTCTOR
 #ifdef _MSC_VER
diff --git a/src/test/core/SociDB_test.cpp b/src/test/core/SociDB_test.cpp
index 57ff19fec5..d37569d6cd 100644
--- a/src/test/core/SociDB_test.cpp
+++ b/src/test/core/SociDB_test.cpp
@@ -11,6 +11,7 @@
 #include <boost/filesystem/path.hpp>
 #include <boost/optional/optional.hpp>  // IWYU pragma: keep
 
+#include <soci/boost-optional.h>  // IWYU pragma: keep
 #include <soci/into.h>
 #include <soci/session.h>
 #include <soci/use.h>
diff --git a/src/test/csf.h b/src/test/csf.h
deleted file mode 100644
index d2ddbb460d..0000000000
--- a/src/test/csf.h
+++ /dev/null
@@ -1,19 +0,0 @@
-#pragma once
-
-#include <test/csf/BasicNetwork.h>
-#include <test/csf/Digraph.h>
-#include <test/csf/Histogram.h>
-#include <test/csf/Peer.h>
-#include <test/csf/PeerGroup.h>
-#include <test/csf/Proposal.h>
-#include <test/csf/Scheduler.h>
-#include <test/csf/Sim.h>
-#include <test/csf/SimTime.h>
-#include <test/csf/TrustGraph.h>
-#include <test/csf/Tx.h>
-#include <test/csf/collectors.h>
-#include <test/csf/events.h>
-#include <test/csf/ledgers.h>
-#include <test/csf/random.h>
-#include <test/csf/submitters.h>
-#include <test/csf/timers.h>
diff --git a/src/test/csf/BasicNetwork.h b/src/test/csf/BasicNetwork.h
index 418cdcf289..4b88592128 100644
--- a/src/test/csf/BasicNetwork.h
+++ b/src/test/csf/BasicNetwork.h
@@ -3,6 +3,8 @@
 #include <test/csf/Digraph.h>
 #include <test/csf/Scheduler.h>
 
+#include <cassert>
+
 namespace xrpl::test::csf {
 /** Peer to peer network simulator.
 
diff --git a/src/test/csf/CollectorRef.h b/src/test/csf/CollectorRef.h
index 23baa020b8..5bc55c7515 100644
--- a/src/test/csf/CollectorRef.h
+++ b/src/test/csf/CollectorRef.h
@@ -1,7 +1,14 @@
 #pragma once
 
+#include <test/csf/Proposal.h>
 #include <test/csf/SimTime.h>
+#include <test/csf/Tx.h>
+#include <test/csf/Validation.h>
 #include <test/csf/events.h>
+#include <test/csf/ledgers.h>
+
+#include <memory>
+#include <vector>
 
 namespace xrpl::test::csf {
 
diff --git a/src/test/csf/Digraph.h b/src/test/csf/Digraph.h
index 20e45faa5b..82ed713561 100644
--- a/src/test/csf/Digraph.h
+++ b/src/test/csf/Digraph.h
@@ -4,10 +4,11 @@
 #include <boost/range/adaptor/transformed.hpp>
 #include <boost/range/iterator_range.hpp>
 
+#include <cstddef>
 #include <fstream>
 #include <optional>
-#include <type_traits>
-#include <unordered_map>
+#include <ostream>
+#include <string>
 
 namespace xrpl {
 namespace detail {
diff --git a/src/test/csf/Histogram.h b/src/test/csf/Histogram.h
index 84f1cc7b72..60cb9a132e 100644
--- a/src/test/csf/Histogram.h
+++ b/src/test/csf/Histogram.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include <algorithm>
 #include <cassert>
-#include <chrono>
 #include <cmath>
+#include <cstddef>
+#include <functional>
 #include <map>
 
 namespace xrpl::test::csf {
diff --git a/src/test/csf/Peer.h b/src/test/csf/Peer.h
index 3e9eed1c52..9d29704172 100644
--- a/src/test/csf/Peer.h
+++ b/src/test/csf/Peer.h
@@ -2,7 +2,9 @@
 
 #include <test/csf/BasicNetwork.h>
 #include <test/csf/CollectorRef.h>
+#include <test/csf/Proposal.h>
 #include <test/csf/Scheduler.h>
+#include <test/csf/SimTime.h>
 #include <test/csf/TrustGraph.h>
 #include <test/csf/Tx.h>
 #include <test/csf/Validation.h>
@@ -10,15 +12,31 @@
 #include <test/csf/ledgers.h>
 
 #include <xrpld/consensus/Consensus.h>
+#include <xrpld/consensus/ConsensusParms.h>
+#include <xrpld/consensus/ConsensusTypes.h>
 #include <xrpld/consensus/Validations.h>
 
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/tagged_integer.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/WrappedSink.h>
-#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/json/json_writer.h>
 
 #include <boost/container/flat_map.hpp>
 #include <boost/container/flat_set.hpp>
 
 #include <algorithm>
+#include <chrono>
+#include <cmath>
+#include <cstddef>
+#include <limits>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
 
 namespace xrpl::test::csf {
 
diff --git a/src/test/csf/PeerGroup.h b/src/test/csf/PeerGroup.h
index 01bba82c98..e5efecac34 100644
--- a/src/test/csf/PeerGroup.h
+++ b/src/test/csf/PeerGroup.h
@@ -1,9 +1,18 @@
 #pragma once
 
 #include <test/csf/Peer.h>
+#include <test/csf/SimTime.h>
+#include <test/csf/Validation.h>
 #include <test/csf/random.h>
 
 #include <algorithm>
+#include <cassert>
+#include <cstddef>
+#include <iterator>
+#include <ostream>
+#include <random>
+#include <set>
+#include <utility>
 #include <vector>
 
 namespace xrpl::test::csf {
diff --git a/src/test/csf/Scheduler.h b/src/test/csf/Scheduler.h
index e7cbe27036..3fc187e1e7 100644
--- a/src/test/csf/Scheduler.h
+++ b/src/test/csf/Scheduler.h
@@ -6,6 +6,7 @@
 #include <boost/container/pmr/monotonic_buffer_resource.hpp>
 #include <boost/intrusive/set.hpp>
 
+#include <chrono>
 #include <type_traits>
 #include <utility>
 
diff --git a/src/test/csf/Sim.h b/src/test/csf/Sim.h
index b5b7f5f9c2..d2a63f6507 100644
--- a/src/test/csf/Sim.h
+++ b/src/test/csf/Sim.h
@@ -2,16 +2,22 @@
 
 #include <test/csf/BasicNetwork.h>
 #include <test/csf/CollectorRef.h>
-#include <test/csf/Digraph.h>
 #include <test/csf/Peer.h>
 #include <test/csf/PeerGroup.h>
 #include <test/csf/Scheduler.h>
 #include <test/csf/SimTime.h>
 #include <test/csf/TrustGraph.h>
+#include <test/csf/ledgers.h>
 
+#include <xrpl/beast/utility/Journal.h>
+
+#include <cstddef>
+#include <cstdint>
 #include <deque>
 #include <iostream>
 #include <random>
+#include <string>
+#include <vector>
 
 namespace xrpl::test::csf {
 
diff --git a/src/test/csf/TrustGraph.h b/src/test/csf/TrustGraph.h
index 202d17a6d5..a10e318706 100644
--- a/src/test/csf/TrustGraph.h
+++ b/src/test/csf/TrustGraph.h
@@ -1,13 +1,11 @@
 #pragma once
 
 #include <test/csf/Digraph.h>
-#include <test/csf/random.h>
 
 #include <boost/container/flat_set.hpp>
 
-#include <chrono>
-#include <numeric>
-#include <random>
+#include <algorithm>
+#include <set>
 #include <vector>
 
 namespace xrpl::test::csf {
diff --git a/src/test/csf/Tx.h b/src/test/csf/Tx.h
index 5a0f6a9bae..f871909f48 100644
--- a/src/test/csf/Tx.h
+++ b/src/test/csf/Tx.h
@@ -7,6 +7,7 @@
 #include <boost/iterator/function_output_iterator.hpp>
 
 #include <algorithm>
+#include <cstdint>
 #include <map>
 #include <ostream>
 #include <sstream>
diff --git a/src/test/csf/Validation.h b/src/test/csf/Validation.h
index 81f14efa18..73b6784534 100644
--- a/src/test/csf/Validation.h
+++ b/src/test/csf/Validation.h
@@ -2,10 +2,12 @@
 
 #include <test/csf/ledgers.h>
 
+#include <xrpl/basics/chrono.h>
 #include <xrpl/basics/tagged_integer.h>
 
-#include <memory>
+#include <cstdint>
 #include <optional>
+#include <tuple>
 #include <utility>
 
 namespace xrpl::test::csf {
diff --git a/src/test/csf/collectors.h b/src/test/csf/collectors.h
index 6dcbd65a1e..1100f6c690 100644
--- a/src/test/csf/collectors.h
+++ b/src/test/csf/collectors.h
@@ -2,14 +2,24 @@
 
 #include <test/csf/Histogram.h>
 #include <test/csf/SimTime.h>
+#include <test/csf/Tx.h>
+#include <test/csf/Validation.h>
 #include <test/csf/events.h>
 
 #include <xrpl/basics/UnorderedContainers.h>
 
+#include <algorithm>
+#include <cassert>
 #include <chrono>
+#include <cstddef>
+#include <iomanip>
+#include <ios>
+#include <map>
 #include <optional>
 #include <ostream>
 #include <tuple>
+#include <utility>
+#include <vector>
 
 namespace xrpl::test::csf {
 
diff --git a/src/test/csf/events.h b/src/test/csf/events.h
index ea163d3a80..dfedd2627a 100644
--- a/src/test/csf/events.h
+++ b/src/test/csf/events.h
@@ -1,12 +1,9 @@
 #pragma once
 
-#include <test/csf/Proposal.h>
 #include <test/csf/Tx.h>
 #include <test/csf/Validation.h>
 #include <test/csf/ledgers.h>
 
-#include <chrono>
-
 namespace xrpl::test::csf {
 
 // Events are emitted by peers at a variety of points during the simulation.
@@ -77,7 +74,7 @@ struct SubmitTx
 struct StartRound
 {
     //! The preferred ledger for the start of consensus
-    Ledger::ID bestLedger;
+    Ledger::ID bestLedger{};
 
     //! The prior ledger on hand
     Ledger prevLedger;
diff --git a/src/test/csf/ledgers.h b/src/test/csf/ledgers.h
index 25672de133..dc5ec5277c 100644
--- a/src/test/csf/ledgers.h
+++ b/src/test/csf/ledgers.h
@@ -2,7 +2,6 @@
 
 #include <test/csf/Tx.h>
 
-#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/basics/comparators.h>
 #include <xrpl/basics/tagged_integer.h>
@@ -11,8 +10,15 @@
 
 #include <boost/bimap/bimap.hpp>
 
+#include <cassert>
+#include <cstddef>
+#include <cstdint>
 #include <optional>
 #include <set>
+#include <string>
+#include <tuple>
+#include <unordered_map>
+#include <vector>
 
 namespace xrpl::test::csf {
 
diff --git a/src/test/csf/random.h b/src/test/csf/random.h
index c506397d88..9fc51f1217 100644
--- a/src/test/csf/random.h
+++ b/src/test/csf/random.h
@@ -1,5 +1,8 @@
 #pragma once
 
+#include <algorithm>
+#include <cstddef>
+#include <iterator>
 #include <random>
 #include <vector>
 
diff --git a/src/test/csf/submitters.h b/src/test/csf/submitters.h
index a5c494beb0..546681abe0 100644
--- a/src/test/csf/submitters.h
+++ b/src/test/csf/submitters.h
@@ -1,10 +1,11 @@
 #pragma once
 
-#include <test/csf/Peer.h>
 #include <test/csf/Scheduler.h>
 #include <test/csf/SimTime.h>
 #include <test/csf/Tx.h>
 
+#include <cstddef>
+#include <cstdint>
 #include <type_traits>
 
 namespace xrpl::test::csf {
diff --git a/src/test/csf/timers.h b/src/test/csf/timers.h
index 2f2ec4dc93..2f86fe7729 100644
--- a/src/test/csf/timers.h
+++ b/src/test/csf/timers.h
@@ -4,6 +4,7 @@
 #include <test/csf/SimTime.h>
 
 #include <chrono>
+#include <iostream>
 #include <ostream>
 
 namespace xrpl::test::csf {
diff --git a/src/test/json/TestOutputSuite.h b/src/test/json/TestOutputSuite.h
index e954a043b8..1be2a72c6d 100644
--- a/src/test/json/TestOutputSuite.h
+++ b/src/test/json/TestOutputSuite.h
@@ -5,8 +5,10 @@
 #include <xrpl/json/Output.h>
 #include <xrpl/json/Writer.h>
 
-namespace xrpl {
-namespace test {
+#include <memory>
+#include <string>
+
+namespace xrpl::test {
 
 class TestOutputSuite : public TestSuite
 {
@@ -32,5 +34,4 @@ protected:
     }
 };
 
-}  // namespace test
-}  // namespace xrpl
+}  // namespace xrpl::test
diff --git a/src/test/jtx.h b/src/test/jtx.h
deleted file mode 100644
index d4b88b0b9e..0000000000
--- a/src/test/jtx.h
+++ /dev/null
@@ -1,60 +0,0 @@
-#pragma once
-
-// Convenience header that includes everything
-
-#include <test/jtx/AMM.h>
-#include <test/jtx/Account.h>
-#include <test/jtx/Env.h>
-#include <test/jtx/Env_ss.h>
-#include <test/jtx/JTx.h>
-#include <test/jtx/TestHelpers.h>
-#include <test/jtx/account_txn_id.h>
-#include <test/jtx/acctdelete.h>
-#include <test/jtx/amount.h>
-#include <test/jtx/balance.h>
-#include <test/jtx/batch.h>
-#include <test/jtx/check.h>
-#include <test/jtx/credentials.h>
-#include <test/jtx/delegate.h>
-#include <test/jtx/delivermin.h>
-#include <test/jtx/deposit.h>
-#include <test/jtx/did.h>
-#include <test/jtx/directory.h>
-#include <test/jtx/domain.h>
-#include <test/jtx/escrow.h>
-#include <test/jtx/fee.h>
-#include <test/jtx/flags.h>
-#include <test/jtx/invoice_id.h>
-#include <test/jtx/jtx_json.h>
-#include <test/jtx/last_ledger_sequence.h>
-#include <test/jtx/ledgerStateFix.h>
-#include <test/jtx/memo.h>
-#include <test/jtx/mpt.h>
-#include <test/jtx/multisign.h>
-#include <test/jtx/noop.h>
-#include <test/jtx/offer.h>
-#include <test/jtx/owners.h>
-#include <test/jtx/paths.h>
-#include <test/jtx/pay.h>
-#include <test/jtx/permissioned_dex.h>
-#include <test/jtx/permissioned_domains.h>
-#include <test/jtx/prop.h>
-#include <test/jtx/quality.h>
-#include <test/jtx/rate.h>
-#include <test/jtx/regkey.h>
-#include <test/jtx/require.h>
-#include <test/jtx/requires.h>
-#include <test/jtx/rpc.h>
-#include <test/jtx/sendmax.h>
-#include <test/jtx/seq.h>
-#include <test/jtx/sig.h>
-#include <test/jtx/tag.h>
-#include <test/jtx/tags.h>
-#include <test/jtx/ter.h>
-#include <test/jtx/ticket.h>
-#include <test/jtx/token.h>
-#include <test/jtx/trust.h>
-#include <test/jtx/txflags.h>
-#include <test/jtx/utility.h>
-
-#include <xrpl/json/to_string.h>
diff --git a/src/test/jtx/AMM.h b/src/test/jtx/AMM.h
index 99131637bb..605f15f812 100644
--- a/src/test/jtx/AMM.h
+++ b/src/test/jtx/AMM.h
@@ -6,14 +6,33 @@
 #include <test/jtx/seq.h>
 #include <test/jtx/ter.h>
 
-#include <xrpld/rpc/GRPCHandlers.h>
-
+#include <xrpl/basics/Number.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
 #include <xrpl/json/json_value.h>
+#include <xrpl/json/json_writer.h>  // IWYU pragma: keep
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/ApiVersion.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/IOUAmount.h>
+#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/jss.h>
 
 #include <nudb/detail/stream.hpp>
 
+#include <cstdint>
+#include <iostream>
+#include <optional>
+#include <ostream>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <variant>
+#include <vector>
+
 namespace xrpl::test::jtx {
 
 class LPToken
diff --git a/src/test/jtx/AMMTest.h b/src/test/jtx/AMMTest.h
index a2e6c38db3..971cc5db84 100644
--- a/src/test/jtx/AMMTest.h
+++ b/src/test/jtx/AMMTest.h
@@ -1,11 +1,23 @@
 #pragma once
 
 #include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
 #include <test/jtx/amount.h>
 #include <test/jtx/ter.h>
 
 #include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <functional>
+#include <mutex>
+#include <optional>
+#include <utility>
+#include <vector>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/AbstractClient.h b/src/test/jtx/AbstractClient.h
index 1eb51f2123..7c7107ca79 100644
--- a/src/test/jtx/AbstractClient.h
+++ b/src/test/jtx/AbstractClient.h
@@ -2,6 +2,8 @@
 
 #include <xrpl/json/json_value.h>
 
+#include <string>
+
 namespace xrpl::test {
 
 /* Abstract XRPL client interface.
diff --git a/src/test/jtx/Account.h b/src/test/jtx/Account.h
index b20b4a359a..264a39f08b 100644
--- a/src/test/jtx/Account.h
+++ b/src/test/jtx/Account.h
@@ -1,12 +1,14 @@
 #pragma once
 
 #include <xrpl/beast/hash/uhash.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/KeyType.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/SecretKey.h>
-#include <xrpl/protocol/UintTypes.h>
 
 #include <string>
 #include <unordered_map>
+#include <utility>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/CaptureLogs.h b/src/test/jtx/CaptureLogs.h
index b5fe302629..38db19219a 100644
--- a/src/test/jtx/CaptureLogs.h
+++ b/src/test/jtx/CaptureLogs.h
@@ -1,6 +1,12 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
+
+#include <memory>
+#include <mutex>
+#include <sstream>
+#include <string>
 
 namespace xrpl::test {
 
diff --git a/src/test/jtx/CheckMessageLogs.h b/src/test/jtx/CheckMessageLogs.h
index 4bbdec6f06..fc46f41671 100644
--- a/src/test/jtx/CheckMessageLogs.h
+++ b/src/test/jtx/CheckMessageLogs.h
@@ -1,6 +1,11 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
+
+#include <memory>
+#include <string>
+#include <utility>
 
 namespace xrpl::test {
 
diff --git a/src/test/jtx/ConfidentialTransfer.h b/src/test/jtx/ConfidentialTransfer.h
index b758683da6..404ddbe31d 100644
--- a/src/test/jtx/ConfidentialTransfer.h
+++ b/src/test/jtx/ConfidentialTransfer.h
@@ -1,19 +1,8 @@
 #pragma once
 
-#include <test/jtx/AMM.h>
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
-#include <test/jtx/TestHelpers.h>
-#include <test/jtx/amount.h>
-#include <test/jtx/batch.h>
-#include <test/jtx/credentials.h>
-#include <test/jtx/delegate.h>
-#include <test/jtx/deposit.h>
-#include <test/jtx/flags.h>
 #include <test/jtx/mpt.h>
-#include <test/jtx/pay.h>
-#include <test/jtx/ter.h>
-#include <test/jtx/ticket.h>
 #include <test/jtx/vault.h>
 
 #include <xrpl/basics/Buffer.h>
@@ -22,21 +11,10 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/strHex.h>
 #include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/core/ServiceRegistry.h>
-#include <xrpl/json/json_value.h>
-#include <xrpl/ledger/OpenView.h>
 #include <xrpl/protocol/ConfidentialTransfer.h>
-#include <xrpl/protocol/Feature.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STObject.h>
-#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
-#include <xrpl/protocol/jss.h>
 
 #include <utility/mpt_utility.h>
 
diff --git a/src/test/jtx/Env.h b/src/test/jtx/Env.h
index aca6074c4a..ba28d19738 100644
--- a/src/test/jtx/Env.h
+++ b/src/test/jtx/Env.h
@@ -7,7 +7,6 @@
 #include <test/jtx/amount.h>
 #include <test/jtx/envconfig.h>
 #include <test/jtx/require.h>
-#include <test/jtx/tags.h>
 #include <test/jtx/vault.h>
 #include <test/unit_test/SuiteJournal.h>
 
@@ -17,25 +16,39 @@
 #include <xrpld/rpc/detail/Pathfinder.h>
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/json/to_string.h>
-#include <xrpl/ledger/Ledger.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/ApiVersion.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/Feature.h>
-#include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
 
-#include <functional>
+#include <array>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
 #include <future>
+#include <initializer_list>
+#include <memory>
+#include <optional>
 #include <source_location>
+#include <stdexcept>
 #include <string>
-#include <tuple>
-#include <type_traits>
+#include <thread>
 #include <unordered_map>
 #include <utility>
 #include <vector>
diff --git a/src/test/jtx/Env_ss.h b/src/test/jtx/Env_ss.h
index ca0825eac7..16e1cdbc82 100644
--- a/src/test/jtx/Env_ss.h
+++ b/src/test/jtx/Env_ss.h
@@ -1,6 +1,12 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <xrpl/json/json_value.h>
+
+#include <source_location>
+#include <utility>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/JTx.h b/src/test/jtx/JTx.h
index 121e6cc825..da105e01aa 100644
--- a/src/test/jtx/JTx.h
+++ b/src/test/jtx/JTx.h
@@ -10,6 +10,9 @@
 
 #include <functional>
 #include <memory>
+#include <optional>
+#include <string>
+#include <utility>
 #include <vector>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/Oracle.h b/src/test/jtx/Oracle.h
index cf091c6d13..2c296ba705 100644
--- a/src/test/jtx/Oracle.h
+++ b/src/test/jtx/Oracle.h
@@ -1,8 +1,25 @@
 #pragma once
 
-#include <test/jtx.h>
+#include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
+#include <test/jtx/multisign.h>
+#include <test/jtx/seq.h>
+#include <test/jtx/ter.h>
 
-#include <date/date.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/json/json_forwards.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+
+#include <chrono>
+#include <cstdint>
+#include <optional>
+#include <ostream>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <variant>
+#include <vector>
 
 namespace xrpl::test::jtx::oracle {
 
diff --git a/src/test/jtx/PathSet.h b/src/test/jtx/PathSet.h
index a391adcb1b..fa3f0d40f9 100644
--- a/src/test/jtx/PathSet.h
+++ b/src/test/jtx/PathSet.h
@@ -1,10 +1,20 @@
 #pragma once
 
-#include <test/jtx.h>
+#include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
 
-#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
-#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STPathSet.h>
+
+#include <cstddef>
 
 namespace xrpl::test {
 
diff --git a/src/test/jtx/TestHelpers.h b/src/test/jtx/TestHelpers.h
index 34532b17f7..b1643de362 100644
--- a/src/test/jtx/TestHelpers.h
+++ b/src/test/jtx/TestHelpers.h
@@ -1,20 +1,51 @@
 #pragma once
 
+#include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+#include <test/jtx/amount.h>
 
 #include <xrpld/app/misc/TxQ.h>
 
+#include <xrpl/basics/Number.h>
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/strHex.h>
+#include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Book.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/PathAsset.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/Quality.h>
-#include <xrpl/protocol/STNumber.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STNumber.h>  // IWYU pragma: keep
+#include <xrpl/protocol/STPathSet.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/Units.h>
+#include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol/jss.h>
 #include <xrpl/tx/paths/detail/Steps.h>
 
 #include <algorithm>
+#include <array>
+#include <chrono>
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <optional>
 #include <source_location>
+#include <string>
+#include <tuple>
+#include <type_traits>
 #include <utility>
 #include <vector>
 
diff --git a/src/test/jtx/TestSuite.h b/src/test/jtx/TestSuite.h
index 705adbb620..d40cc6aba6 100644
--- a/src/test/jtx/TestSuite.h
+++ b/src/test/jtx/TestSuite.h
@@ -1,7 +1,9 @@
 #pragma once
 
-#include <xrpl/beast/unit_test.h>
+#include <xrpl/beast/unit_test/suite.h>
 
+#include <exception>
+#include <sstream>
 #include <string>
 
 namespace xrpl {
diff --git a/src/test/jtx/TrustedPublisherServer.h b/src/test/jtx/TrustedPublisherServer.h
index 9a53a32481..008bbe70c3 100644
--- a/src/test/jtx/TrustedPublisherServer.h
+++ b/src/test/jtx/TrustedPublisherServer.h
@@ -2,11 +2,18 @@
 
 #include <test/jtx/envconfig.h>
 
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base64.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/basics/random.h>
 #include <xrpl/basics/strHex.h>
+#include <xrpl/protocol/HashPrefix.h>
+#include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/Sign.h>
 
 #include <boost/algorithm/string/predicate.hpp>
@@ -19,9 +26,21 @@
 #include <boost/beast/version.hpp>
 #include <boost/lexical_cast.hpp>
 
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <exception>
+#include <functional>
+#include <limits>
 #include <memory>
+#include <optional>
+#include <sstream>
+#include <string>
+#include <string_view>
 #include <thread>
 #include <utility>
+#include <vector>
 
 namespace xrpl::test {
 
diff --git a/src/test/jtx/WSClient.h b/src/test/jtx/WSClient.h
index 5a22fafe2e..4aa41e072c 100644
--- a/src/test/jtx/WSClient.h
+++ b/src/test/jtx/WSClient.h
@@ -4,9 +4,14 @@
 
 #include <xrpld/core/Config.h>
 
+#include <xrpl/json/json_value.h>
+
 #include <chrono>
+#include <functional>
 #include <memory>
 #include <optional>
+#include <string>
+#include <unordered_map>
 
 namespace xrpl::test {
 
diff --git a/src/test/jtx/account_txn_id.h b/src/test/jtx/account_txn_id.h
index 89f7368ee6..ffee4123aa 100644
--- a/src/test/jtx/account_txn_id.h
+++ b/src/test/jtx/account_txn_id.h
@@ -1,6 +1,9 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <xrpl/basics/base_uint.h>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/acctdelete.h b/src/test/jtx/acctdelete.h
index 5c8a136617..3f8b9f1ed2 100644
--- a/src/test/jtx/acctdelete.h
+++ b/src/test/jtx/acctdelete.h
@@ -3,7 +3,9 @@
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
 
-#include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/json/json_value.h>
+
+#include <cstdint>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/amount.h b/src/test/jtx/amount.h
index db281419ef..ce0234b41a 100644
--- a/src/test/jtx/amount.h
+++ b/src/test/jtx/amount.h
@@ -3,14 +3,26 @@
 #include <test/jtx/Account.h>
 #include <test/jtx/tags.h>
 
+#include <xrpl/basics/Number.h>
 #include <xrpl/basics/contract.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/STAmount.h>
-#include <xrpl/protocol/Units.h>
+#include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <cmath>
+#include <concepts>
+#include <cstddef>
 #include <cstdint>
 #include <ostream>
+#include <stdexcept>
 #include <string>
 #include <type_traits>
 #include <utility>
diff --git a/src/test/jtx/balance.h b/src/test/jtx/balance.h
index 5ea80c77f8..3f39e9f0fb 100644
--- a/src/test/jtx/balance.h
+++ b/src/test/jtx/balance.h
@@ -1,8 +1,12 @@
 #pragma once
 
+#include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/amount.h>
 #include <test/jtx/tags.h>
 
+#include <xrpl/protocol/STAmount.h>
+
 #include <utility>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/batch.h b/src/test/jtx/batch.h
index 4d564f150a..bb1deec1a2 100644
--- a/src/test/jtx/batch.h
+++ b/src/test/jtx/batch.h
@@ -2,17 +2,21 @@
 
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 #include <test/jtx/SignerUtils.h>
-#include <test/jtx/amount.h>
-#include <test/jtx/owners.h>
-#include <test/jtx/tags.h>
 
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/protocol/jss.h>
 
 #include <concepts>
 #include <cstdint>
 #include <optional>
 #include <utility>
+#include <vector>
 
 /** @brief Helpers for constructing Batch test transactions. */
 namespace xrpl::test::jtx::batch {
diff --git a/src/test/jtx/check.h b/src/test/jtx/check.h
index 7c3dc6aa80..f66d802247 100644
--- a/src/test/jtx/check.h
+++ b/src/test/jtx/check.h
@@ -1,9 +1,13 @@
 #pragma once
 
 #include <test/jtx/Account.h>
-#include <test/jtx/Env.h>
 #include <test/jtx/owners.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/STAmount.h>
+
 #include <utility>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/credentials.h b/src/test/jtx/credentials.h
index 4bdd716918..8da2f289a1 100644
--- a/src/test/jtx/credentials.h
+++ b/src/test/jtx/credentials.h
@@ -2,7 +2,18 @@
 
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
-#include <test/jtx/owners.h>
+#include <test/jtx/JTx.h>
+
+#include <xrpl/basics/strHex.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/SField.h>
+
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
 
 namespace xrpl::test::jtx::credentials {
 
diff --git a/src/test/jtx/delegate.h b/src/test/jtx/delegate.h
index ae848603a7..9b64c105ba 100644
--- a/src/test/jtx/delegate.h
+++ b/src/test/jtx/delegate.h
@@ -2,8 +2,14 @@
 
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
+
+#include <string>
 #include <utility>
+#include <vector>
 
 namespace xrpl::test::jtx::delegate {
 
diff --git a/src/test/jtx/delivermin.h b/src/test/jtx/delivermin.h
index 0a8fa9f823..29256e37bd 100644
--- a/src/test/jtx/delivermin.h
+++ b/src/test/jtx/delivermin.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 
 #include <xrpl/protocol/STAmount.h>
 
diff --git a/src/test/jtx/deposit.h b/src/test/jtx/deposit.h
index 0d8e363138..5ba12648e2 100644
--- a/src/test/jtx/deposit.h
+++ b/src/test/jtx/deposit.h
@@ -1,7 +1,14 @@
 #pragma once
 
 #include <test/jtx/Account.h>
-#include <test/jtx/Env.h>
+
+#include <xrpl/basics/strHex.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/jss.h>
+
+#include <string>
+#include <vector>
 
 /** Deposit preauthorize operations */
 namespace xrpl::test::jtx::deposit {
diff --git a/src/test/jtx/did.h b/src/test/jtx/did.h
index 7662c6556a..30c89fd879 100644
--- a/src/test/jtx/did.h
+++ b/src/test/jtx/did.h
@@ -2,7 +2,13 @@
 
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
-#include <test/jtx/owners.h>
+#include <test/jtx/JTx.h>
+
+#include <xrpl/basics/strHex.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
+
+#include <string>
 
 /** DID operations. */
 namespace xrpl::test::jtx::did {
diff --git a/src/test/jtx/directory.h b/src/test/jtx/directory.h
index c63640ae1f..13473f949e 100644
--- a/src/test/jtx/directory.h
+++ b/src/test/jtx/directory.h
@@ -2,11 +2,15 @@
 
 #include <test/jtx/Env.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/protocol/Feature.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/Protocol.h>
 
 #include <cstdint>
 #include <expected>
+#include <functional>
 #include <limits>
 
 /** Directory operations. */
diff --git a/src/test/jtx/domain.h b/src/test/jtx/domain.h
index b3a0744768..ebcfdb662a 100644
--- a/src/test/jtx/domain.h
+++ b/src/test/jtx/domain.h
@@ -1,6 +1,9 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <xrpl/basics/base_uint.h>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/envconfig.h b/src/test/jtx/envconfig.h
index 4c56ec8217..0079605637 100644
--- a/src/test/jtx/envconfig.h
+++ b/src/test/jtx/envconfig.h
@@ -2,6 +2,11 @@
 
 #include <xrpld/core/Config.h>
 
+#include <atomic>
+#include <map>
+#include <memory>
+#include <string>
+
 namespace xrpl::test {
 
 extern std::atomic<bool> gEnvUseIPv4;
diff --git a/src/test/jtx/escrow.h b/src/test/jtx/escrow.h
index 58be9b701a..728b2e3643 100644
--- a/src/test/jtx/escrow.h
+++ b/src/test/jtx/escrow.h
@@ -3,10 +3,15 @@
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
 #include <test/jtx/TestHelpers.h>
-#include <test/jtx/owners.h>
-#include <test/jtx/rate.h>
 
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+
+#include <array>
+#include <cstdint>
 
 /** Escrow operations. */
 namespace xrpl::test::jtx::escrow {
diff --git a/src/test/jtx/fee.h b/src/test/jtx/fee.h
index 048b262e88..ad3002dc75 100644
--- a/src/test/jtx/fee.h
+++ b/src/test/jtx/fee.h
@@ -1,12 +1,15 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 #include <test/jtx/tags.h>
 
 #include <xrpl/basics/contract.h>
 #include <xrpl/protocol/STAmount.h>
 
+#include <cstdint>
 #include <optional>
+#include <stdexcept>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/flags.h b/src/test/jtx/flags.h
index 6e0c49b752..83470f9a1b 100644
--- a/src/test/jtx/flags.h
+++ b/src/test/jtx/flags.h
@@ -1,11 +1,15 @@
 #pragma once
 
+#include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
 
 #include <xrpl/basics/contract.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/TxFlags.h>
 
+#include <cstdint>
+#include <stdexcept>
 #include <utility>
 
 namespace xrpl {
diff --git a/src/test/jtx/impl/Oracle.cpp b/src/test/jtx/impl/Oracle.cpp
index 991c84fc18..cd96ef5c0d 100644
--- a/src/test/jtx/impl/Oracle.cpp
+++ b/src/test/jtx/impl/Oracle.cpp
@@ -13,6 +13,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/jss.h>
 
diff --git a/src/test/jtx/invoice_id.h b/src/test/jtx/invoice_id.h
index 2246d54abf..b2f13a1d96 100644
--- a/src/test/jtx/invoice_id.h
+++ b/src/test/jtx/invoice_id.h
@@ -1,6 +1,9 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <xrpl/basics/base_uint.h>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/jtx_json.h b/src/test/jtx/jtx_json.h
index d58f0b47ac..b22d4c30e1 100644
--- a/src/test/jtx/jtx_json.h
+++ b/src/test/jtx/jtx_json.h
@@ -1,9 +1,12 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 
 #include <xrpl/json/json_value.h>
 
+#include <string>
+
 namespace xrpl::test::jtx {
 
 /** Inject raw JSON. */
diff --git a/src/test/jtx/last_ledger_sequence.h b/src/test/jtx/last_ledger_sequence.h
index 6170c2e4e1..ff6390298e 100644
--- a/src/test/jtx/last_ledger_sequence.h
+++ b/src/test/jtx/last_ledger_sequence.h
@@ -1,6 +1,9 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <cstdint>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/ledgerStateFix.h b/src/test/jtx/ledgerStateFix.h
index 71f3f76101..dd1ac19f04 100644
--- a/src/test/jtx/ledgerStateFix.h
+++ b/src/test/jtx/ledgerStateFix.h
@@ -1,7 +1,9 @@
 #pragma once
 
 #include <test/jtx/Account.h>
-#include <test/jtx/Env.h>
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
 
 /** LedgerStateFix operations. */
 namespace xrpl::test::jtx::ledgerStateFix {
diff --git a/src/test/jtx/memo.h b/src/test/jtx/memo.h
index 9b5c1118ac..cea4923d38 100644
--- a/src/test/jtx/memo.h
+++ b/src/test/jtx/memo.h
@@ -1,7 +1,9 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 
+#include <string>
 #include <utility>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/mpt.h b/src/test/jtx/mpt.h
index d5fba82e08..1a7fe94785 100644
--- a/src/test/jtx/mpt.h
+++ b/src/test/jtx/mpt.h
@@ -2,6 +2,7 @@
 
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/amount.h>
 #include <test/jtx/delegate.h>
 #include <test/jtx/owners.h>
 #include <test/jtx/tag.h>
@@ -9,14 +10,33 @@
 #include <test/jtx/ticket.h>
 #include <test/jtx/txflags.h>
 
+#include <xrpl/basics/Buffer.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/protocol/jss.h>
 
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
+#include <functional>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <utility>
+#include <variant>
+#include <vector>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/multisign.h b/src/test/jtx/multisign.h
index 3fef2ab446..c90e28537a 100644
--- a/src/test/jtx/multisign.h
+++ b/src/test/jtx/multisign.h
@@ -1,14 +1,22 @@
 #pragma once
 
 #include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 #include <test/jtx/SignerUtils.h>
-#include <test/jtx/amount.h>
 #include <test/jtx/owners.h>
 #include <test/jtx/tags.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+
 #include <concepts>
 #include <cstdint>
 #include <optional>
+#include <utility>
+#include <vector>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/noop.h b/src/test/jtx/noop.h
index 095e20f387..c38dfdde25 100644
--- a/src/test/jtx/noop.h
+++ b/src/test/jtx/noop.h
@@ -1,7 +1,10 @@
 #pragma once
 
+#include <test/jtx/Account.h>
 #include <test/jtx/flags.h>
 
+#include <xrpl/json/json_value.h>
+
 namespace xrpl::test::jtx {
 
 /** The null transaction. */
diff --git a/src/test/jtx/offer.h b/src/test/jtx/offer.h
index 9a31904058..f3e7277933 100644
--- a/src/test/jtx/offer.h
+++ b/src/test/jtx/offer.h
@@ -5,6 +5,8 @@
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/STAmount.h>
 
+#include <cstdint>
+
 namespace xrpl::test::jtx {
 
 /** Create an offer. */
diff --git a/src/test/jtx/owners.h b/src/test/jtx/owners.h
index 44fd3762c2..0fb38b407c 100644
--- a/src/test/jtx/owners.h
+++ b/src/test/jtx/owners.h
@@ -1,10 +1,11 @@
 #pragma once
 
+#include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
 
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/LedgerFormats.h>
-#include <xrpl/protocol/UintTypes.h>
 
 #include <cstdint>
 #include <utility>
diff --git a/src/test/jtx/paths.h b/src/test/jtx/paths.h
index a8a8f7900c..1450985687 100644
--- a/src/test/jtx/paths.h
+++ b/src/test/jtx/paths.h
@@ -1,8 +1,13 @@
 #pragma once
 
+#include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+#include <test/jtx/amount.h>
 
-#include <xrpl/protocol/Issue.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
 
 #include <type_traits>
 
diff --git a/src/test/jtx/pay.h b/src/test/jtx/pay.h
index 8f4f3287ae..fa193e7b02 100644
--- a/src/test/jtx/pay.h
+++ b/src/test/jtx/pay.h
@@ -4,6 +4,7 @@
 #include <test/jtx/amount.h>
 
 #include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/permissioned_dex.h b/src/test/jtx/permissioned_dex.h
index b0a4d4e2d5..a8afcac2eb 100644
--- a/src/test/jtx/permissioned_dex.h
+++ b/src/test/jtx/permissioned_dex.h
@@ -3,6 +3,11 @@
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
 
+#include <xrpl/basics/base_uint.h>
+
+#include <string>
+#include <vector>
+
 namespace xrpl::test::jtx {
 
 uint256
diff --git a/src/test/jtx/permissioned_domains.h b/src/test/jtx/permissioned_domains.h
index fdd2b0da1d..f4dc080cbf 100644
--- a/src/test/jtx/permissioned_domains.h
+++ b/src/test/jtx/permissioned_domains.h
@@ -4,6 +4,18 @@
 #include <test/jtx/Env.h>
 #include <test/jtx/deposit.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STObject.h>
+
+#include <map>
+#include <memory>
+#include <optional>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
 namespace xrpl::test::jtx::pdomain {
 
 // Helpers for PermissionedDomains testing
diff --git a/src/test/jtx/prop.h b/src/test/jtx/prop.h
index c3ec6bc0fe..e85751e4c9 100644
--- a/src/test/jtx/prop.h
+++ b/src/test/jtx/prop.h
@@ -1,6 +1,8 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+#include <test/jtx/basic_prop.h>
 
 #include <memory>
 
diff --git a/src/test/jtx/quality.h b/src/test/jtx/quality.h
index 75bf930434..c7896fadf9 100644
--- a/src/test/jtx/quality.h
+++ b/src/test/jtx/quality.h
@@ -1,6 +1,9 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <cstdint>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/require.h b/src/test/jtx/require.h
index 91cc75b3f5..19e161b938 100644
--- a/src/test/jtx/require.h
+++ b/src/test/jtx/require.h
@@ -1,5 +1,6 @@
 #pragma once
 
+#include <test/jtx/JTx.h>
 #include <test/jtx/requires.h>
 
 #include <functional>
diff --git a/src/test/jtx/rpc.h b/src/test/jtx/rpc.h
index 1f538f9ca5..bc05450909 100644
--- a/src/test/jtx/rpc.h
+++ b/src/test/jtx/rpc.h
@@ -1,8 +1,13 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 
-#include <tuple>
+#include <xrpl/protocol/ErrorCodes.h>
+#include <xrpl/protocol/TER.h>
+
+#include <optional>
+#include <string>
 #include <utility>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/sendmax.h b/src/test/jtx/sendmax.h
index 125b10b7d4..1241d76b91 100644
--- a/src/test/jtx/sendmax.h
+++ b/src/test/jtx/sendmax.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 
 #include <xrpl/protocol/STAmount.h>
 
diff --git a/src/test/jtx/seq.h b/src/test/jtx/seq.h
index de06ac3fbc..956c0a77e8 100644
--- a/src/test/jtx/seq.h
+++ b/src/test/jtx/seq.h
@@ -1,8 +1,10 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 #include <test/jtx/tags.h>
 
+#include <cstdint>
 #include <optional>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/sig.h b/src/test/jtx/sig.h
index e88785ef15..76f0a34dff 100644
--- a/src/test/jtx/sig.h
+++ b/src/test/jtx/sig.h
@@ -1,6 +1,11 @@
 #pragma once
 
+#include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+#include <test/jtx/tags.h>
+
+#include <xrpl/protocol/SField.h>
 
 #include <optional>
 
diff --git a/src/test/jtx/tag.h b/src/test/jtx/tag.h
index 9279e2a13b..77870367a9 100644
--- a/src/test/jtx/tag.h
+++ b/src/test/jtx/tag.h
@@ -1,6 +1,9 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <cstdint>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/ter.h b/src/test/jtx/ter.h
index c410b46a1e..880711dca0 100644
--- a/src/test/jtx/ter.h
+++ b/src/test/jtx/ter.h
@@ -1,7 +1,11 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 
+#include <xrpl/protocol/TER.h>
+
+#include <optional>
 #include <tuple>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/ticket.h b/src/test/jtx/ticket.h
index 02f742ee93..1035be7674 100644
--- a/src/test/jtx/ticket.h
+++ b/src/test/jtx/ticket.h
@@ -2,8 +2,12 @@
 
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
 #include <test/jtx/owners.h>
 
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
 #include <cstdint>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/token.h b/src/test/jtx/token.h
index 206d170534..97f968fdfc 100644
--- a/src/test/jtx/token.h
+++ b/src/test/jtx/token.h
@@ -2,11 +2,17 @@
 
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
-#include <test/jtx/owners.h>
+#include <test/jtx/JTx.h>
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/strHex.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/STAmount.h>
 
+#include <cstdint>
 #include <initializer_list>
+#include <string>
+#include <vector>
 
 namespace xrpl::test::jtx::token {
 
diff --git a/src/test/jtx/trust.h b/src/test/jtx/trust.h
index 07fd0f7c4e..034f80fcec 100644
--- a/src/test/jtx/trust.h
+++ b/src/test/jtx/trust.h
@@ -5,6 +5,9 @@
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/STAmount.h>
 
+#include <cstdint>
+#include <optional>
+
 namespace xrpl::test::jtx {
 
 /** Modify a trust line. */
diff --git a/src/test/jtx/txflags.h b/src/test/jtx/txflags.h
index 975038d26a..7f5b31b2ac 100644
--- a/src/test/jtx/txflags.h
+++ b/src/test/jtx/txflags.h
@@ -1,6 +1,9 @@
 #pragma once
 
 #include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <cstdint>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/jtx/utility.h b/src/test/jtx/utility.h
index c3ed91f672..f1cf3f7ae8 100644
--- a/src/test/jtx/utility.h
+++ b/src/test/jtx/utility.h
@@ -2,11 +2,13 @@
 
 #include <test/jtx/Account.h>
 
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/ledger/Ledger.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/STObject.h>
 
 #include <stdexcept>
+#include <string>
 #include <vector>
 
 namespace xrpl::test::jtx {
diff --git a/src/test/jtx/vault.h b/src/test/jtx/vault.h
index c1e0831a66..4e6b90fe1f 100644
--- a/src/test/jtx/vault.h
+++ b/src/test/jtx/vault.h
@@ -1,13 +1,13 @@
 #pragma once
 
 #include <test/jtx/Account.h>
-#include <test/jtx/amount.h>
 
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Keylet.h>
 
+#include <cstdint>
 #include <optional>
 #include <tuple>
 
diff --git a/src/test/jtx/xchain_bridge.h b/src/test/jtx/xchain_bridge.h
index e4c012510d..aacef80bbe 100644
--- a/src/test/jtx/xchain_bridge.h
+++ b/src/test/jtx/xchain_bridge.h
@@ -1,12 +1,19 @@
 #pragma once
 
 #include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
 #include <test/jtx/amount.h>
 #include <test/jtx/multisign.h>
 
 #include <xrpl/json/json_value.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/XChainAttestations.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <vector>
 
 namespace xrpl::test::jtx {
 
diff --git a/src/test/nodestore/TestBase.h b/src/test/nodestore/TestBase.h
index 885c3bbeac..1254fc51aa 100644
--- a/src/test/nodestore/TestBase.h
+++ b/src/test/nodestore/TestBase.h
@@ -1,17 +1,22 @@
 #pragma once
 
-#include <xrpl/basics/StringUtilities.h>
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/random.h>
-#include <xrpl/beast/unit_test.h>
+#include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/beast/utility/rngfill.h>
 #include <xrpl/beast/xor_shift_engine.h>
 #include <xrpl/nodestore/Backend.h>
 #include <xrpl/nodestore/Database.h>
+#include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/nodestore/Types.h>
 
 #include <boost/algorithm/string.hpp>
 
-#include <iomanip>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <utility>
 
 namespace xrpl::NodeStore {
 
diff --git a/src/test/protocol/STObject_test.cpp b/src/test/protocol/STObject_test.cpp
index 801eebbe63..b823b24962 100644
--- a/src/test/protocol/STObject_test.cpp
+++ b/src/test/protocol/STObject_test.cpp
@@ -4,6 +4,7 @@
 #include <xrpl/basics/Buffer.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/json/json_writer.h>
 #include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/SOTemplate.h>
diff --git a/src/test/protocol/STParsedJSON_test.cpp b/src/test/protocol/STParsedJSON_test.cpp
index bc5c72b4fc..24981053f5 100644
--- a/src/test/protocol/STParsedJSON_test.cpp
+++ b/src/test/protocol/STParsedJSON_test.cpp
@@ -10,6 +10,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/STNumber.h>
 #include <xrpl/protocol/STParsedJSON.h>
 #include <xrpl/protocol/STXChainBridge.h>
diff --git a/src/test/rpc/GRPCTestClientBase.h b/src/test/rpc/GRPCTestClientBase.h
deleted file mode 100644
index 15d335781d..0000000000
--- a/src/test/rpc/GRPCTestClientBase.h
+++ /dev/null
@@ -1,32 +0,0 @@
-#pragma once
-
-#include <test/jtx/envconfig.h>
-
-#include <xrpl/proto/org/xrpl/rpc/v1/xrp_ledger.grpc.pb.h>
-
-#include <grpcpp/grpcpp.h>
-
-namespace xrpl {
-namespace test {
-
-struct GRPCTestClientBase
-{
-    explicit GRPCTestClientBase(std::string const& port)
-        : stub(
-              org::xrpl::rpc::v1::XRPLedgerAPIService::NewStub(
-                  grpc::CreateChannel(
-                      beast::IP::Endpoint(
-                          boost::asio::ip::make_address(getEnvLocalhostAddr()),
-                          std::stoi(port))
-                          .to_string(),
-                      grpc::InsecureChannelCredentials())))
-    {
-    }
-
-    grpc::Status status;
-    grpc::ClientContext context;
-    std::unique_ptr<org::xrpl::rpc::v1::XRPLedgerAPIService::Stub> stub;
-};
-
-}  // namespace test
-}  // namespace xrpl
diff --git a/src/test/shamap/common.h b/src/test/shamap/common.h
index 0475acdf6d..9bef10d851 100644
--- a/src/test/shamap/common.h
+++ b/src/test/shamap/common.h
@@ -1,11 +1,24 @@
 #pragma once
 
+#include <xrpl/basics/ByteUtilities.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/clock/manual_clock.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/config/BasicConfig.h>
 #include <xrpl/config/Constants.h>
+#include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/DummyScheduler.h>
 #include <xrpl/nodestore/Manager.h>
 #include <xrpl/shamap/Family.h>
+#include <xrpl/shamap/FullBelowCache.h>
+#include <xrpl/shamap/TreeNodeCache.h>
+
+#include <chrono>
+#include <cstdint>
+#include <memory>
+#include <stdexcept>
 
 namespace xrpl::tests {
 
diff --git a/src/test/unit_test/FileDirGuard.h b/src/test/unit_test/FileDirGuard.h
index 19110469ee..3fc5d015b0 100644
--- a/src/test/unit_test/FileDirGuard.h
+++ b/src/test/unit_test/FileDirGuard.h
@@ -1,12 +1,16 @@
 #pragma once
 
-#include <test/jtx/TestSuite.h>
-
 #include <xrpl/basics/contract.h>
+#include <xrpl/beast/unit_test/suite.h>
 
 #include <boost/filesystem.hpp>
 
+#include <exception>
 #include <fstream>
+#include <ostream>
+#include <stdexcept>
+#include <string>
+#include <utility>
 
 namespace xrpl::detail {
 
diff --git a/src/test/unit_test/SuiteJournal.h b/src/test/unit_test/SuiteJournal.h
index 174e9ff2ff..66287e328c 100644
--- a/src/test/unit_test/SuiteJournal.h
+++ b/src/test/unit_test/SuiteJournal.h
@@ -1,8 +1,13 @@
 #pragma once
 
-#include <xrpl/beast/unit_test.h>
+#include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/beast/utility/Journal.h>
 
+#include <mutex>
+#include <ostream>
+#include <sstream>
+#include <string>
+
 namespace xrpl::test {
 
 // A Journal::Sink intended for use with the beast unit test framework.
diff --git a/src/test/unit_test/multi_runner.h b/src/test/unit_test/multi_runner.h
index 55cf6c25fa..3390014cb8 100644
--- a/src/test/unit_test/multi_runner.h
+++ b/src/test/unit_test/multi_runner.h
@@ -2,6 +2,7 @@
 
 #include <xrpl/beast/unit_test/global_suites.h>
 #include <xrpl/beast/unit_test/runner.h>
+#include <xrpl/beast/unit_test/suite_info.h>
 
 #include <boost/beast/core/static_string.hpp>
 #include <boost/container/static_vector.hpp>
@@ -12,11 +13,15 @@
 
 #include <atomic>
 #include <chrono>
-#include <numeric>
+#include <cstddef>
+#include <cstdint>
+#include <iterator>
+#include <memory>
+#include <ostream>
+#include <set>
 #include <sstream>
 #include <string>
 #include <thread>
-#include <unordered_set>
 #include <utility>
 
 namespace xrpl {
diff --git a/src/tests/libxrpl/CMakeLists.txt b/src/tests/libxrpl/CMakeLists.txt
index bd56028728..df483a36d8 100644
--- a/src/tests/libxrpl/CMakeLists.txt
+++ b/src/tests/libxrpl/CMakeLists.txt
@@ -1,5 +1,6 @@
 include(GoogleTest)
 include(isolate_headers)
+include(verify_headers)
 
 # Test requirements.
 find_package(GTest REQUIRED)
@@ -54,4 +55,10 @@ foreach(module IN LISTS test_modules)
     )
 endforeach()
 
+# The test helpers and per-module test headers are not built with add_module,
+# so verify them against the test binary's own compile environment.
+if(verify_headers)
+    verify_target_headers(xrpl_tests "${CMAKE_CURRENT_SOURCE_DIR}")
+endif()
+
 gtest_discover_tests(xrpl_tests DISCOVERY_TIMEOUT 60)
diff --git a/src/tests/libxrpl/helpers/IOU.h b/src/tests/libxrpl/helpers/IOU.h
index d80f962edf..10deaee99b 100644
--- a/src/tests/libxrpl/helpers/IOU.h
+++ b/src/tests/libxrpl/helpers/IOU.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <xrpl/basics/Number.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/STAmount.h>
@@ -8,7 +9,6 @@
 
 #include <helpers/Account.h>
 
-#include <concepts>
 #include <string>
 #include <string_view>
 #include <type_traits>
diff --git a/src/tests/libxrpl/helpers/TestFamily.h b/src/tests/libxrpl/helpers/TestFamily.h
index 50f514480a..a5ff34a111 100644
--- a/src/tests/libxrpl/helpers/TestFamily.h
+++ b/src/tests/libxrpl/helpers/TestFamily.h
@@ -1,13 +1,22 @@
 #pragma once
 
+#include <xrpl/basics/ByteUtilities.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/config/BasicConfig.h>
 #include <xrpl/config/Constants.h>
+#include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/DummyScheduler.h>
 #include <xrpl/nodestore/Manager.h>
 #include <xrpl/shamap/Family.h>
+#include <xrpl/shamap/FullBelowCache.h>
+#include <xrpl/shamap/TreeNodeCache.h>
 
+#include <cstdint>
 #include <memory>
+#include <stdexcept>
 
 namespace xrpl::test {
 
diff --git a/src/tests/libxrpl/helpers/TestServiceRegistry.h b/src/tests/libxrpl/helpers/TestServiceRegistry.h
index 0536176344..0108f886d3 100644
--- a/src/tests/libxrpl/helpers/TestServiceRegistry.h
+++ b/src/tests/libxrpl/helpers/TestServiceRegistry.h
@@ -1,7 +1,9 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/HashRouter.h>
 #include <xrpl/core/NetworkIDService.h>
 #include <xrpl/core/ServiceRegistry.h>
@@ -13,8 +15,11 @@
 #include <helpers/TestFamily.h>
 #include <helpers/TestSink.h>
 
+#include <cstdint>
+#include <memory>
 #include <optional>
 #include <stdexcept>
+#include <string>
 
 namespace xrpl::test {
 
diff --git a/src/tests/libxrpl/helpers/TestSink.h b/src/tests/libxrpl/helpers/TestSink.h
index 28c85f00e4..b8637b7038 100644
--- a/src/tests/libxrpl/helpers/TestSink.h
+++ b/src/tests/libxrpl/helpers/TestSink.h
@@ -2,6 +2,8 @@
 
 #include <xrpl/beast/utility/Journal.h>
 
+#include <string>
+
 namespace xrpl {
 class TestSink : public beast::Journal::Sink
 {
diff --git a/src/tests/libxrpl/helpers/TxTest.h b/src/tests/libxrpl/helpers/TxTest.h
index 1b3ce460a2..cb75cd5ee0 100644
--- a/src/tests/libxrpl/helpers/TxTest.h
+++ b/src/tests/libxrpl/helpers/TxTest.h
@@ -1,18 +1,23 @@
 #pragma once
 
 #include <xrpl/basics/Number.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
-#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/hash/uhash.h>
 #include <xrpl/core/ServiceRegistry.h>
-#include <xrpl/ledger/ApplyViewImpl.h>
 #include <xrpl/ledger/Ledger.h>
 #include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/TxMeta.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol_autogen/TransactionBuilderBase.h>
 #include <xrpl/protocol_autogen/ledger_entries/AccountRoot.h>
@@ -24,6 +29,7 @@
 
 #include <cmath>
 #include <concepts>
+#include <cstdint>
 #include <memory>
 #include <optional>
 #include <stdexcept>
diff --git a/src/tests/libxrpl/protocol_autogen/TestHelpers.h b/src/tests/libxrpl/protocol_autogen/TestHelpers.h
index a32ab5e20c..0fc26032f0 100644
--- a/src/tests/libxrpl/protocol_autogen/TestHelpers.h
+++ b/src/tests/libxrpl/protocol_autogen/TestHelpers.h
@@ -9,6 +9,7 @@
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/STBlob.h>
+#include <xrpl/protocol/STInteger.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STNumber.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STPathSet.h>
diff --git a/src/xrpld/app/consensus/RCLCensorshipDetector.h b/src/xrpld/app/consensus/RCLCensorshipDetector.h
index 48df7368d9..4318a7b4ff 100644
--- a/src/xrpld/app/consensus/RCLCensorshipDetector.h
+++ b/src/xrpld/app/consensus/RCLCensorshipDetector.h
@@ -1,9 +1,9 @@
 #pragma once
 
 #include <xrpl/basics/algorithm.h>
-#include <xrpl/shamap/SHAMap.h>
 
 #include <algorithm>
+#include <functional>
 #include <utility>
 #include <vector>
 
diff --git a/src/xrpld/app/consensus/RCLConsensus.h b/src/xrpld/app/consensus/RCLConsensus.h
index 32759300fa..359f6b8009 100644
--- a/src/xrpld/app/consensus/RCLConsensus.h
+++ b/src/xrpld/app/consensus/RCLConsensus.h
@@ -4,21 +4,37 @@
 #include <xrpld/app/consensus/RCLCxLedger.h>
 #include <xrpld/app/consensus/RCLCxPeerPos.h>
 #include <xrpld/app/consensus/RCLCxTx.h>
+#include <xrpld/app/main/Application.h>
 #include <xrpld/app/misc/FeeVote.h>
 #include <xrpld/app/misc/NegativeUNLVote.h>
 #include <xrpld/consensus/Consensus.h>
+#include <xrpld/consensus/ConsensusParms.h>
+#include <xrpld/consensus/ConsensusTypes.h>
 
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/core/JobQueue.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/ledger/CanonicalTXSet.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
-#include <xrpl/shamap/SHAMap.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <xrpl.pb.h>
 
 #include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
 #include <memory>
 #include <mutex>
+#include <optional>
 #include <set>
 #include <sstream>
 #include <string>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/consensus/RCLCxLedger.h b/src/xrpld/app/consensus/RCLCxLedger.h
index 9f7984aaa6..89f70f9add 100644
--- a/src/xrpld/app/consensus/RCLCxLedger.h
+++ b/src/xrpld/app/consensus/RCLCxLedger.h
@@ -2,10 +2,16 @@
 
 #include <xrpld/app/ledger/LedgerToJson.h>
 
+#include <xrpl/basics/chrono.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/Ledger.h>
-#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
 
+#include <memory>
+#include <utility>
+
 namespace xrpl {
 
 /** Represents a ledger in RCLConsensus.
diff --git a/src/xrpld/app/consensus/RCLCxPeerPos.h b/src/xrpld/app/consensus/RCLCxPeerPos.h
index 4618bdb746..e73ac3b532 100644
--- a/src/xrpld/app/consensus/RCLCxPeerPos.h
+++ b/src/xrpld/app/consensus/RCLCxPeerPos.h
@@ -2,11 +2,14 @@
 
 #include <xrpld/consensus/ConsensusProposal.h>
 
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/UintTypes.h>
 
 #include <boost/container/static_vector.hpp>
 
diff --git a/src/xrpld/app/consensus/RCLCxTx.h b/src/xrpld/app/consensus/RCLCxTx.h
index 52637d32b3..f174a2fd54 100644
--- a/src/xrpld/app/consensus/RCLCxTx.h
+++ b/src/xrpld/app/consensus/RCLCxTx.h
@@ -1,6 +1,14 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/shamap/SHAMap.h>
+#include <xrpl/shamap/SHAMapItem.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <map>
+#include <memory>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/consensus/RCLValidations.h b/src/xrpld/app/consensus/RCLValidations.h
index 37a6f6c743..e8a1996204 100644
--- a/src/xrpld/app/consensus/RCLValidations.h
+++ b/src/xrpld/app/consensus/RCLValidations.h
@@ -2,12 +2,23 @@
 
 #include <xrpld/consensus/Validations.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/Ledger.h>
 #include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STValidation.h>
+#include <xrpl/protocol/UintTypes.h>
 
+#include <cstdint>
+#include <memory>
+#include <mutex>
 #include <optional>
+#include <string>
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/src/xrpld/app/ledger/AcceptedLedger.h b/src/xrpld/app/ledger/AcceptedLedger.h
index b05af1f18a..ec83839d7a 100644
--- a/src/xrpld/app/ledger/AcceptedLedger.h
+++ b/src/xrpld/app/ledger/AcceptedLedger.h
@@ -3,6 +3,11 @@
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/AcceptedLedgerTx.h>
+#include <xrpl/ledger/ReadView.h>
+
+#include <cstddef>
+#include <memory>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/AccountStateSF.h b/src/xrpld/app/ledger/AccountStateSF.h
index 5d00e65120..f5117db4d4 100644
--- a/src/xrpld/app/ledger/AccountStateSF.h
+++ b/src/xrpld/app/ledger/AccountStateSF.h
@@ -2,8 +2,14 @@
 
 #include <xrpld/app/ledger/AbstractFetchPackContainer.h>
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/nodestore/Database.h>
 #include <xrpl/shamap/SHAMapSyncFilter.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <cstdint>
+#include <optional>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/BuildLedger.h b/src/xrpld/app/ledger/BuildLedger.h
index 32d45daea3..faa800daa7 100644
--- a/src/xrpld/app/ledger/BuildLedger.h
+++ b/src/xrpld/app/ledger/BuildLedger.h
@@ -3,6 +3,10 @@
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
+#include <xrpl/protocol/Protocol.h>
+
+#include <memory>
+#include <set>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/ConsensusTransSetSF.cpp b/src/xrpld/app/ledger/ConsensusTransSetSF.cpp
index 7c74c10b1b..a8ce70d978 100644
--- a/src/xrpld/app/ledger/ConsensusTransSetSF.cpp
+++ b/src/xrpld/app/ledger/ConsensusTransSetSF.cpp
@@ -6,6 +6,7 @@
 #include <xrpl/basics/Blob.h>
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/SHAMapHash.h>
+#include <xrpl/basics/TaggedCache.ipp>  // IWYU pragma: keep
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/Job.h>
 #include <xrpl/core/JobQueue.h>
diff --git a/src/xrpld/app/ledger/ConsensusTransSetSF.h b/src/xrpld/app/ledger/ConsensusTransSetSF.h
index f1d0e26d26..59894add7f 100644
--- a/src/xrpld/app/ledger/ConsensusTransSetSF.h
+++ b/src/xrpld/app/ledger/ConsensusTransSetSF.h
@@ -2,8 +2,15 @@
 
 #include <xrpld/app/main/Application.h>
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/shamap/SHAMapSyncFilter.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <cstdint>
+#include <optional>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/InboundLedger.h b/src/xrpld/app/ledger/InboundLedger.h
index b82e2f69cd..5f9f0e1baf 100644
--- a/src/xrpld/app/ledger/InboundLedger.h
+++ b/src/xrpld/app/ledger/InboundLedger.h
@@ -2,14 +2,31 @@
 
 #include <xrpld/app/ledger/detail/TimeoutCounter.h>
 #include <xrpld/app/main/Application.h>
+#include <xrpld/overlay/Peer.h>
 #include <xrpld/overlay/PeerSet.h>
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/clock/abstract_clock.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/Ledger.h>
+#include <xrpl/nodestore/Database.h>
+#include <xrpl/shamap/SHAMap.h>
+#include <xrpl/shamap/SHAMapAddNode.h>
+#include <xrpl/shamap/SHAMapNodeID.h>
 
+#include <xrpl.pb.h>
+
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
 #include <mutex>
 #include <set>
+#include <string>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/InboundLedgers.h b/src/xrpld/app/ledger/InboundLedgers.h
index f6c864f777..65b2db7d8e 100644
--- a/src/xrpld/app/ledger/InboundLedgers.h
+++ b/src/xrpld/app/ledger/InboundLedgers.h
@@ -1,9 +1,23 @@
 #pragma once
 
 #include <xrpld/app/ledger/InboundLedger.h>
+#include <xrpld/app/main/Application.h>
+#include <xrpld/overlay/Peer.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/clock/abstract_clock.h>
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/ledger/Ledger.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
 
+#include <xrpl.pb.h>
+
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+
 namespace xrpl {
 
 /** Manages the lifetime of inbound ledgers.
diff --git a/src/xrpld/app/ledger/InboundTransactions.h b/src/xrpld/app/ledger/InboundTransactions.h
index bd176dbd95..d9799d9ad0 100644
--- a/src/xrpld/app/ledger/InboundTransactions.h
+++ b/src/xrpld/app/ledger/InboundTransactions.h
@@ -2,9 +2,16 @@
 
 #include <xrpld/overlay/Peer.h>
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/clock/abstract_clock.h>
+#include <xrpl/beast/insight/Collector.h>
 #include <xrpl/shamap/SHAMap.h>
 
+#include <xrpl.pb.h>
+
+#include <chrono>
+#include <cstdint>
+#include <functional>
 #include <memory>
 
 namespace xrpl {
diff --git a/src/xrpld/app/ledger/LedgerCleaner.h b/src/xrpld/app/ledger/LedgerCleaner.h
index 3f76f5593c..fd693d6bec 100644
--- a/src/xrpld/app/ledger/LedgerCleaner.h
+++ b/src/xrpld/app/ledger/LedgerCleaner.h
@@ -6,6 +6,8 @@
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/json/json_value.h>
 
+#include <memory>
+
 namespace xrpl {
 
 /** Check the ledger/transaction databases to make sure they have continuity */
diff --git a/src/xrpld/app/ledger/LedgerHistory.h b/src/xrpld/app/ledger/LedgerHistory.h
index 057de7b1bc..3fb6e345cf 100644
--- a/src/xrpld/app/ledger/LedgerHistory.h
+++ b/src/xrpld/app/ledger/LedgerHistory.h
@@ -2,10 +2,17 @@
 
 #include <xrpld/app/main/Application.h>
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/insight/Counter.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/Ledger.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
 
+#include <map>
+#include <memory>
 #include <optional>
 
 namespace xrpl {
diff --git a/src/xrpld/app/ledger/LedgerHolder.h b/src/xrpld/app/ledger/LedgerHolder.h
index 69fe00b439..3e70544bfc 100644
--- a/src/xrpld/app/ledger/LedgerHolder.h
+++ b/src/xrpld/app/ledger/LedgerHolder.h
@@ -2,8 +2,11 @@
 
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/contract.h>
+#include <xrpl/ledger/Ledger.h>
 
+#include <memory>
 #include <mutex>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/LedgerMaster.h b/src/xrpld/app/ledger/LedgerMaster.h
index 885ab6db25..efd8c15e20 100644
--- a/src/xrpld/app/ledger/LedgerMaster.h
+++ b/src/xrpld/app/ledger/LedgerMaster.h
@@ -1,25 +1,42 @@
 #pragma once
 
 #include <xrpld/app/ledger/AbstractFetchPackContainer.h>
-#include <xrpld/app/ledger/InboundLedgers.h>
+#include <xrpld/app/ledger/InboundLedger.h>
 #include <xrpld/app/ledger/LedgerHistory.h>
 #include <xrpld/app/ledger/LedgerHolder.h>
 #include <xrpld/app/ledger/LedgerReplay.h>
 #include <xrpld/app/main/Application.h>
 #include <xrpld/core/TimeKeeper.h>
 
+#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/RangeSet.h>
 #include <xrpl/basics/UptimeClock.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/insight/Gauge.h>
+#include <xrpl/beast/insight/Hook.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/CanonicalTXSet.h>
 #include <xrpl/ledger/Ledger.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
-#include <xrpl/protocol/messages.h>
+#include <xrpl/protocol/Rules.h>
 
+#include <xrpl.pb.h>
+
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
 #include <mutex>
 #include <optional>
+#include <string>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/LedgerPersistence.h b/src/xrpld/app/ledger/LedgerPersistence.h
index e131932af4..f466c32296 100644
--- a/src/xrpld/app/ledger/LedgerPersistence.h
+++ b/src/xrpld/app/ledger/LedgerPersistence.h
@@ -1,7 +1,11 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/ledger/Ledger.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/Rules.h>
 
+#include <cstdint>
 #include <memory>
 #include <tuple>
 
diff --git a/src/xrpld/app/ledger/LedgerReplayTask.h b/src/xrpld/app/ledger/LedgerReplayTask.h
index 7bb75253f2..09329761c1 100644
--- a/src/xrpld/app/ledger/LedgerReplayTask.h
+++ b/src/xrpld/app/ledger/LedgerReplayTask.h
@@ -4,6 +4,11 @@
 #include <xrpld/app/ledger/detail/TimeoutCounter.h>
 #include <xrpld/app/main/Application.h>
 
+#include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/base_uint.h>
+
+#include <cstdint>
+#include <memory>
 #include <vector>
 
 namespace xrpl {
diff --git a/src/xrpld/app/ledger/LedgerReplayer.h b/src/xrpld/app/ledger/LedgerReplayer.h
index e2d256f597..d44289121c 100644
--- a/src/xrpld/app/ledger/LedgerReplayer.h
+++ b/src/xrpld/app/ledger/LedgerReplayer.h
@@ -1,11 +1,20 @@
 #pragma once
 
-#include <xrpld/app/ledger/LedgerMaster.h>
+#include <xrpld/app/ledger/InboundLedger.h>
 #include <xrpld/app/ledger/LedgerReplayTask.h>
 #include <xrpld/app/main/Application.h>
+#include <xrpld/overlay/PeerSet.h>
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/shamap/SHAMapItem.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <map>
+#include <memory>
 #include <mutex>
 #include <vector>
 
diff --git a/src/xrpld/app/ledger/LedgerToJson.h b/src/xrpld/app/ledger/LedgerToJson.h
index 853d4468cd..c9939fd2f4 100644
--- a/src/xrpld/app/ledger/LedgerToJson.h
+++ b/src/xrpld/app/ledger/LedgerToJson.h
@@ -5,8 +5,12 @@
 #include <xrpld/rpc/Context.h>
 
 #include <xrpl/basics/chrono.h>
-#include <xrpl/ledger/Ledger.h>
-#include <xrpl/protocol/serialize.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/ledger/ReadView.h>
+
+#include <optional>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/LocalTxs.h b/src/xrpld/app/ledger/LocalTxs.h
index 1575a18075..fe955eba24 100644
--- a/src/xrpld/app/ledger/LocalTxs.h
+++ b/src/xrpld/app/ledger/LocalTxs.h
@@ -2,7 +2,10 @@
 
 #include <xrpl/ledger/CanonicalTXSet.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/STTx.h>
 
+#include <cstddef>
 #include <memory>
 
 namespace xrpl {
diff --git a/src/xrpld/app/ledger/OpenLedger.h b/src/xrpld/app/ledger/OpenLedger.h
index 554002d6af..3e0577a9be 100644
--- a/src/xrpld/app/ledger/OpenLedger.h
+++ b/src/xrpld/app/ledger/OpenLedger.h
@@ -3,15 +3,23 @@
 #include <xrpld/core/Config.h>
 
 #include <xrpl/basics/Log.h>
-#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/core/PerfLog.h>
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/CachedSLEs.h>
 #include <xrpl/ledger/CanonicalTXSet.h>
 #include <xrpl/ledger/Ledger.h>
 #include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/shamap/SHAMap.h>
 
+#include <exception>
+#include <functional>
+#include <memory>
 #include <mutex>
+#include <string>
 #include <string_view>
 
 namespace xrpl {
diff --git a/src/xrpld/app/ledger/OrderBookDBImpl.h b/src/xrpld/app/ledger/OrderBookDBImpl.h
index a68f63c043..d57d051cce 100644
--- a/src/xrpld/app/ledger/OrderBookDBImpl.h
+++ b/src/xrpld/app/ledger/OrderBookDBImpl.h
@@ -1,11 +1,22 @@
 #pragma once
 
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/OrderBookDB.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Book.h>
 #include <xrpl/protocol/UintTypes.h>
 
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <memory>
 #include <mutex>
 #include <optional>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/TransactionMaster.h b/src/xrpld/app/ledger/TransactionMaster.h
index 84cbf56e8b..5dcad09f51 100644
--- a/src/xrpld/app/ledger/TransactionMaster.h
+++ b/src/xrpld/app/ledger/TransactionMaster.h
@@ -4,10 +4,19 @@
 
 #include <xrpl/basics/RangeSet.h>
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/protocol/ErrorCodes.h>
+#include <xrpl/protocol/TxMeta.h>
+#include <xrpl/protocol/TxSearched.h>
 #include <xrpl/shamap/SHAMapItem.h>
 #include <xrpl/shamap/SHAMapTreeNode.h>
 
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <utility>
+#include <variant>
+
 namespace xrpl {
 
 class Application;
diff --git a/src/xrpld/app/ledger/TransactionStateSF.h b/src/xrpld/app/ledger/TransactionStateSF.h
index c5c113be7f..a3f7e7f55a 100644
--- a/src/xrpld/app/ledger/TransactionStateSF.h
+++ b/src/xrpld/app/ledger/TransactionStateSF.h
@@ -2,8 +2,14 @@
 
 #include <xrpld/app/ledger/AbstractFetchPackContainer.h>
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/nodestore/Database.h>
 #include <xrpl/shamap/SHAMapSyncFilter.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <cstdint>
+#include <optional>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/detail/LedgerDeltaAcquire.cpp b/src/xrpld/app/ledger/detail/LedgerDeltaAcquire.cpp
index 4c79068bca..7ac85b892e 100644
--- a/src/xrpld/app/ledger/detail/LedgerDeltaAcquire.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerDeltaAcquire.cpp
@@ -2,6 +2,8 @@
 
 #include <xrpld/app/ledger/BuildLedger.h>
 #include <xrpld/app/ledger/InboundLedger.h>
+#include <xrpld/app/ledger/InboundLedgers.h>
+#include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/ledger/LedgerReplay.h>
 #include <xrpld/app/ledger/LedgerReplayer.h>
 #include <xrpld/app/ledger/detail/TimeoutCounter.h>
diff --git a/src/xrpld/app/ledger/detail/LedgerDeltaAcquire.h b/src/xrpld/app/ledger/detail/LedgerDeltaAcquire.h
index 57e8fb5652..10c8a21b3a 100644
--- a/src/xrpld/app/ledger/detail/LedgerDeltaAcquire.h
+++ b/src/xrpld/app/ledger/detail/LedgerDeltaAcquire.h
@@ -2,12 +2,22 @@
 
 #include <xrpld/app/ledger/InboundLedger.h>
 #include <xrpld/app/ledger/detail/TimeoutCounter.h>
+#include <xrpld/app/main/Application.h>
 
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/ledger/Ledger.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/STTx.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <functional>
 #include <map>
+#include <memory>
+#include <optional>
+#include <set>
+#include <vector>
 
 namespace xrpl {
 class InboundLedgers;
diff --git a/src/xrpld/app/ledger/detail/LedgerMaster.cpp b/src/xrpld/app/ledger/detail/LedgerMaster.cpp
index 31510b44d2..3fcac03ed5 100644
--- a/src/xrpld/app/ledger/detail/LedgerMaster.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerMaster.cpp
@@ -2,6 +2,7 @@
 
 #include <xrpld/app/consensus/RCLValidations.h>
 #include <xrpld/app/ledger/InboundLedger.h>
+#include <xrpld/app/ledger/InboundLedgers.h>
 #include <xrpld/app/ledger/LedgerPersistence.h>
 #include <xrpld/app/ledger/LedgerReplay.h>
 #include <xrpld/app/ledger/LedgerReplayer.h>
diff --git a/src/xrpld/app/ledger/detail/LedgerReplayMsgHandler.h b/src/xrpld/app/ledger/detail/LedgerReplayMsgHandler.h
index 260f1ff753..5a8951fb25 100644
--- a/src/xrpld/app/ledger/detail/LedgerReplayMsgHandler.h
+++ b/src/xrpld/app/ledger/detail/LedgerReplayMsgHandler.h
@@ -1,7 +1,10 @@
 #pragma once
 
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/protocol/messages.h>
+
+#include <xrpl.pb.h>
+
+#include <memory>
 
 namespace xrpl {
 class Application;
diff --git a/src/xrpld/app/ledger/detail/LedgerReplayTask.cpp b/src/xrpld/app/ledger/detail/LedgerReplayTask.cpp
index f9f1aa3188..e7cd031247 100644
--- a/src/xrpld/app/ledger/detail/LedgerReplayTask.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerReplayTask.cpp
@@ -2,6 +2,7 @@
 
 #include <xrpld/app/ledger/InboundLedger.h>
 #include <xrpld/app/ledger/InboundLedgers.h>
+#include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/ledger/LedgerReplayer.h>
 #include <xrpld/app/ledger/detail/LedgerDeltaAcquire.h>
 #include <xrpld/app/ledger/detail/SkipListAcquire.h>
diff --git a/src/xrpld/app/ledger/detail/SkipListAcquire.cpp b/src/xrpld/app/ledger/detail/SkipListAcquire.cpp
index 6c6679ed87..8ebd14083a 100644
--- a/src/xrpld/app/ledger/detail/SkipListAcquire.cpp
+++ b/src/xrpld/app/ledger/detail/SkipListAcquire.cpp
@@ -1,6 +1,8 @@
 #include <xrpld/app/ledger/detail/SkipListAcquire.h>
 
 #include <xrpld/app/ledger/InboundLedger.h>
+#include <xrpld/app/ledger/InboundLedgers.h>
+#include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/ledger/LedgerReplayer.h>
 #include <xrpld/app/ledger/detail/TimeoutCounter.h>
 #include <xrpld/app/main/Application.h>
diff --git a/src/xrpld/app/ledger/detail/SkipListAcquire.h b/src/xrpld/app/ledger/detail/SkipListAcquire.h
index 6600b495c9..6f8ceb8b74 100644
--- a/src/xrpld/app/ledger/detail/SkipListAcquire.h
+++ b/src/xrpld/app/ledger/detail/SkipListAcquire.h
@@ -1,11 +1,19 @@
 #pragma once
 
-#include <xrpld/app/ledger/InboundLedger.h>
 #include <xrpld/app/ledger/detail/TimeoutCounter.h>
 #include <xrpld/app/main/Application.h>
 
+#include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/ledger/Ledger.h>
-#include <xrpl/shamap/SHAMap.h>
+#include <xrpl/shamap/SHAMapItem.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 class InboundLedgers;
diff --git a/src/xrpld/app/ledger/detail/TimeoutCounter.h b/src/xrpld/app/ledger/detail/TimeoutCounter.h
index 18b443c67d..ab4dd28e47 100644
--- a/src/xrpld/app/ledger/detail/TimeoutCounter.h
+++ b/src/xrpld/app/ledger/detail/TimeoutCounter.h
@@ -2,12 +2,18 @@
 
 #include <xrpld/app/main/Application.h>
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/Job.h>
 
 #include <boost/asio/basic_waitable_timer.hpp>
 
+#include <chrono>
+#include <cstdint>
+#include <memory>
 #include <mutex>
+#include <optional>
+#include <string>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/ledger/detail/TransactionAcquire.h b/src/xrpld/app/ledger/detail/TransactionAcquire.h
index b94a9f4bfc..5b33066390 100644
--- a/src/xrpld/app/ledger/detail/TransactionAcquire.h
+++ b/src/xrpld/app/ledger/detail/TransactionAcquire.h
@@ -1,9 +1,20 @@
 #pragma once
 
 #include <xrpld/app/ledger/detail/TimeoutCounter.h>
+#include <xrpld/app/main/Application.h>
+#include <xrpld/overlay/Peer.h>
 #include <xrpld/overlay/PeerSet.h>
 
+#include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/shamap/SHAMap.h>
+#include <xrpl/shamap/SHAMapAddNode.h>
+
+#include <cstddef>
+#include <memory>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/main/Application.cpp b/src/xrpld/app/main/Application.cpp
index 08d84636f6..b99c98afa1 100644
--- a/src/xrpld/app/main/Application.cpp
+++ b/src/xrpld/app/main/Application.cpp
@@ -73,6 +73,7 @@
 #include <xrpl/ledger/PendingSaves.h>
 #include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/DummyScheduler.h>
+#include <xrpl/nodestore/Manager.h>
 #include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/ApiVersion.h>
diff --git a/src/xrpld/app/main/Application.h b/src/xrpld/app/main/Application.h
index 08e41e2c4c..33876b97b9 100644
--- a/src/xrpld/app/main/Application.h
+++ b/src/xrpld/app/main/Application.h
@@ -2,17 +2,25 @@
 
 #include <xrpld/core/Config.h>
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/PropertyStream.h>
-#include <xrpl/core/PeerReservationTable.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/protocol/Protocol.h>
-#include <xrpl/shamap/TreeNodeCache.h>
 
 #include <boost/asio.hpp>
 #include <boost/program_options.hpp>
 
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
 #include <mutex>
+#include <optional>
+#include <string>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/main/BasicApp.h b/src/xrpld/app/main/BasicApp.h
index 5ba7c719e3..aa367ca674 100644
--- a/src/xrpld/app/main/BasicApp.h
+++ b/src/xrpld/app/main/BasicApp.h
@@ -2,6 +2,7 @@
 
 #include <boost/asio/io_context.hpp>
 
+#include <cstddef>
 #include <optional>
 #include <thread>
 #include <vector>
diff --git a/src/xrpld/app/main/CollectorManager.h b/src/xrpld/app/main/CollectorManager.h
index d07da15353..e695ddc956 100644
--- a/src/xrpld/app/main/CollectorManager.h
+++ b/src/xrpld/app/main/CollectorManager.h
@@ -1,8 +1,13 @@
 #pragma once
 
-#include <xrpl/beast/insight/Insight.h>
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/insight/Group.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/config/BasicConfig.h>
 
+#include <memory>
+#include <string>
+
 namespace xrpl {
 
 /** Provides the beast::insight::Collector service. */
diff --git a/src/xrpld/app/main/GRPCServer.cpp b/src/xrpld/app/main/GRPCServer.cpp
index 1af1343fc5..1146cbdc08 100644
--- a/src/xrpld/app/main/GRPCServer.cpp
+++ b/src/xrpld/app/main/GRPCServer.cpp
@@ -1,5 +1,6 @@
 #include <xrpld/app/main/GRPCServer.h>
 
+#include <xrpld/app/ledger/LedgerMaster.h>  // IWYU pragma: keep
 #include <xrpld/app/main/Application.h>
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/GRPCHandlers.h>
diff --git a/src/xrpld/app/main/GRPCServer.h b/src/xrpld/app/main/GRPCServer.h
index 7d299474d9..db948cab99 100644
--- a/src/xrpld/app/main/GRPCServer.h
+++ b/src/xrpld/app/main/GRPCServer.h
@@ -2,16 +2,27 @@
 
 #include <xrpld/app/main/Application.h>
 #include <xrpld/rpc/Context.h>
-#include <xrpld/rpc/GRPCHandlers.h>
 #include <xrpld/rpc/Role.h>
 #include <xrpld/rpc/detail/Handler.h>
 
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/JobQueue.h>
 #include <xrpl/proto/org/xrpl/rpc/v1/xrp_ledger.grpc.pb.h>
 #include <xrpl/resource/Charge.h>
-#include <xrpl/server/InfoSub.h>
+#include <xrpl/resource/Consumer.h>
 
 #include <grpcpp/grpcpp.h>
+#include <grpcpp/support/status.h>
+
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/main/LoadManager.h b/src/xrpld/app/main/LoadManager.h
index 5baa01550e..794048567a 100644
--- a/src/xrpld/app/main/LoadManager.h
+++ b/src/xrpld/app/main/LoadManager.h
@@ -2,7 +2,7 @@
 
 #include <xrpl/beast/utility/Journal.h>
 
-#include <atomic>
+#include <chrono>
 #include <condition_variable>
 #include <memory>
 #include <mutex>
diff --git a/src/xrpld/app/main/NodeIdentity.h b/src/xrpld/app/main/NodeIdentity.h
index bebd5c261d..789d061021 100644
--- a/src/xrpld/app/main/NodeIdentity.h
+++ b/src/xrpld/app/main/NodeIdentity.h
@@ -7,6 +7,8 @@
 
 #include <boost/program_options.hpp>
 
+#include <utility>
+
 namespace xrpl {
 
 /** The cryptographic credentials identifying this server instance.
diff --git a/src/xrpld/app/main/NodeStoreScheduler.h b/src/xrpld/app/main/NodeStoreScheduler.h
index 19e8d9d212..48e606bb45 100644
--- a/src/xrpld/app/main/NodeStoreScheduler.h
+++ b/src/xrpld/app/main/NodeStoreScheduler.h
@@ -2,6 +2,7 @@
 
 #include <xrpl/core/JobQueue.h>
 #include <xrpl/nodestore/Scheduler.h>
+#include <xrpl/nodestore/Task.h>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/main/Tuning.h b/src/xrpld/app/main/Tuning.h
index d61f27ec03..0f7a69f5b1 100644
--- a/src/xrpld/app/main/Tuning.h
+++ b/src/xrpld/app/main/Tuning.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <chrono>
+#include <cstddef>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/misc/AmendmentTableImpl.h b/src/xrpld/app/misc/AmendmentTableImpl.h
index fe7c067d5a..db71189170 100644
--- a/src/xrpld/app/misc/AmendmentTableImpl.h
+++ b/src/xrpld/app/misc/AmendmentTableImpl.h
@@ -1,8 +1,12 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/AmendmentTable.h>
+#include <xrpl/nodestore/Database.h>
 
-#include <optional>
+#include <chrono>
+#include <memory>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/misc/FeeVote.h b/src/xrpld/app/misc/FeeVote.h
index 5c6206558a..d6b4b0fc6a 100644
--- a/src/xrpld/app/misc/FeeVote.h
+++ b/src/xrpld/app/misc/FeeVote.h
@@ -1,9 +1,15 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Fees.h>
+#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STValidation.h>
 #include <xrpl/shamap/SHAMap.h>
 
+#include <memory>
+#include <vector>
+
 namespace xrpl {
 
 /** Manager to process fee votes. */
diff --git a/src/xrpld/app/misc/FeeVoteImpl.cpp b/src/xrpld/app/misc/FeeVoteImpl.cpp
index c4e6c3cdc2..363c17f4fa 100644
--- a/src/xrpld/app/misc/FeeVoteImpl.cpp
+++ b/src/xrpld/app/misc/FeeVoteImpl.cpp
@@ -10,6 +10,7 @@
 #include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAccount.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/STValidation.h>
 #include <xrpl/protocol/Serializer.h>
diff --git a/src/xrpld/app/misc/NegativeUNLVote.h b/src/xrpld/app/misc/NegativeUNLVote.h
index 5c2d3f8630..2896962a84 100644
--- a/src/xrpld/app/misc/NegativeUNLVote.h
+++ b/src/xrpld/app/misc/NegativeUNLVote.h
@@ -1,12 +1,19 @@
 #pragma once
 
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/Ledger.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/UintTypes.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <mutex>
 #include <optional>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/misc/SHAMapStore.h b/src/xrpld/app/misc/SHAMapStore.h
index 3f43bc8fa4..9f12546463 100644
--- a/src/xrpld/app/misc/SHAMapStore.h
+++ b/src/xrpld/app/misc/SHAMapStore.h
@@ -2,9 +2,14 @@
 
 #include <xrpld/app/main/Application.h>
 
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/Ledger.h>
-#include <xrpl/nodestore/Manager.h>
+#include <xrpl/nodestore/Database.h>
+#include <xrpl/nodestore/Scheduler.h>
+#include <xrpl/protocol/Protocol.h>
 
+#include <cstdint>
+#include <memory>
 #include <optional>
 
 namespace xrpl {
diff --git a/src/xrpld/app/misc/SHAMapStoreImp.cpp b/src/xrpld/app/misc/SHAMapStoreImp.cpp
index 33bbf1c613..0389130f7a 100644
--- a/src/xrpld/app/misc/SHAMapStoreImp.cpp
+++ b/src/xrpld/app/misc/SHAMapStoreImp.cpp
@@ -15,6 +15,7 @@
 #include <xrpl/config/Constants.h>
 #include <xrpl/ledger/Ledger.h>
 #include <xrpl/nodestore/Database.h>
+#include <xrpl/nodestore/Manager.h>
 #include <xrpl/nodestore/Scheduler.h>
 #include <xrpl/nodestore/detail/DatabaseRotatingImp.h>
 #include <xrpl/protocol/Protocol.h>
diff --git a/src/xrpld/app/misc/SHAMapStoreImp.h b/src/xrpld/app/misc/SHAMapStoreImp.h
index 1803c15e71..4025236868 100644
--- a/src/xrpld/app/misc/SHAMapStoreImp.h
+++ b/src/xrpld/app/misc/SHAMapStoreImp.h
@@ -1,17 +1,33 @@
 #pragma once
 
 #include <xrpld/app/ledger/LedgerMaster.h>
+#include <xrpld/app/main/Application.h>
 #include <xrpld/app/misc/SHAMapStore.h>
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/config/BasicConfig.h>
+#include <xrpl/ledger/Ledger.h>
+#include <xrpl/nodestore/Backend.h>
+#include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/DatabaseRotating.h>
 #include <xrpl/nodestore/Scheduler.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/rdb/DatabaseCon.h>
 #include <xrpl/server/State.h>
 #include <xrpl/shamap/FullBelowCache.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
 #include <xrpl/shamap/TreeNodeCache.h>
 
+#include <algorithm>
 #include <atomic>
 #include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <string>
 #include <thread>
 
 namespace xrpl {
diff --git a/src/xrpld/app/misc/Transaction.h b/src/xrpld/app/misc/Transaction.h
index 80e041f5b7..ab0fa1f4d8 100644
--- a/src/xrpld/app/misc/Transaction.h
+++ b/src/xrpld/app/misc/Transaction.h
@@ -1,7 +1,11 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/RangeSet.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STBase.h>
@@ -9,8 +13,13 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxMeta.h>
 #include <xrpl/protocol/TxSearched.h>
+#include <xrpl/protocol/XRPAmount.h>
 
+#include <cstdint>
+#include <memory>
 #include <optional>
+#include <string>
+#include <utility>
 #include <variant>
 
 namespace xrpl {
diff --git a/src/xrpld/app/misc/TxQ.h b/src/xrpld/app/misc/TxQ.h
index d3caec55cf..135cd592f0 100644
--- a/src/xrpld/app/misc/TxQ.h
+++ b/src/xrpld/app/misc/TxQ.h
@@ -1,17 +1,35 @@
 #pragma once
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/RippleLedgerHash.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/SeqProxy.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/Units.h>
+#include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/applySteps.h>
 
 #include <boost/circular_buffer.hpp>
 #include <boost/intrusive/set.hpp>
 
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <map>
+#include <memory>
+#include <mutex>
 #include <optional>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/misc/ValidatorKeys.h b/src/xrpld/app/misc/ValidatorKeys.h
index 1f96815681..df88ec33a3 100644
--- a/src/xrpld/app/misc/ValidatorKeys.h
+++ b/src/xrpld/app/misc/ValidatorKeys.h
@@ -5,6 +5,8 @@
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/UintTypes.h>
 
+#include <cstdint>
+#include <optional>
 #include <string>
 
 namespace xrpl {
diff --git a/src/xrpld/app/misc/ValidatorList.h b/src/xrpld/app/misc/ValidatorList.h
index 3f1823f930..0db3eee284 100644
--- a/src/xrpld/app/misc/ValidatorList.h
+++ b/src/xrpld/app/misc/ValidatorList.h
@@ -3,17 +3,30 @@
 #include <xrpld/core/TimeKeeper.h>
 #include <xrpld/overlay/Message.h>
 
-#include <xrpl/basics/Log.h>
 #include <xrpl/basics/UnorderedContainers.h>
-#include <xrpl/crypto/csprng.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/UintTypes.h>
 #include <xrpl/server/Manifest.h>
 
 #include <boost/thread/shared_mutex.hpp>
 
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <memory>
 #include <mutex>
+#include <optional>
 #include <shared_mutex>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
 
 namespace protocol {
 class TMValidatorList;
diff --git a/src/xrpld/app/misc/ValidatorSite.h b/src/xrpld/app/misc/ValidatorSite.h
index 55f060baf1..7302ebbb52 100644
--- a/src/xrpld/app/misc/ValidatorSite.h
+++ b/src/xrpld/app/misc/ValidatorSite.h
@@ -4,14 +4,21 @@
 #include <xrpld/app/misc/ValidatorList.h>
 #include <xrpld/app/misc/detail/Work.h>
 
-#include <xrpl/basics/Log.h>
 #include <xrpl/basics/StringUtilities.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/json/json_value.h>
 
 #include <boost/asio.hpp>
 
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <cstddef>
+#include <memory>
 #include <mutex>
 #include <optional>
+#include <string>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/app/misc/detail/AccountTxPaging.h b/src/xrpld/app/misc/detail/AccountTxPaging.h
index a895549322..628ef82c3d 100644
--- a/src/xrpld/app/misc/detail/AccountTxPaging.h
+++ b/src/xrpld/app/misc/detail/AccountTxPaging.h
@@ -1,8 +1,11 @@
 #pragma once
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/core/PerfLog.h>
 #include <xrpl/rdb/RelationalDatabase.h>
 
 #include <cstdint>
+#include <string>
 
 //------------------------------------------------------------------------------
 
diff --git a/src/xrpld/app/misc/detail/ValidatorSite.cpp b/src/xrpld/app/misc/detail/ValidatorSite.cpp
index 6ce3711652..7b51fbd597 100644
--- a/src/xrpld/app/misc/detail/ValidatorSite.cpp
+++ b/src/xrpld/app/misc/detail/ValidatorSite.cpp
@@ -8,7 +8,6 @@
 #include <xrpld/app/misc/detail/WorkSSL.h>
 
 #include <xrpl/basics/Log.h>
-#include <xrpl/basics/SlabAllocator.h>
 #include <xrpl/basics/StringUtilities.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
diff --git a/src/xrpld/app/misc/detail/WorkBase.h b/src/xrpld/app/misc/detail/WorkBase.h
index 56b227613f..5f5fdd28b7 100644
--- a/src/xrpld/app/misc/detail/WorkBase.h
+++ b/src/xrpld/app/misc/detail/WorkBase.h
@@ -2,7 +2,7 @@
 
 #include <xrpld/app/misc/detail/Work.h>
 
-#include <xrpl/basics/random.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/BuildInfo.h>
 
 #include <boost/asio.hpp>
@@ -12,6 +12,8 @@
 #include <boost/beast/http/read.hpp>
 #include <boost/beast/http/write.hpp>
 
+#include <functional>
+#include <string>
 #include <utility>
 
 namespace xrpl::detail {
diff --git a/src/xrpld/app/misc/detail/WorkFile.h b/src/xrpld/app/misc/detail/WorkFile.h
index 067dc4c38b..2fc7ab952d 100644
--- a/src/xrpld/app/misc/detail/WorkFile.h
+++ b/src/xrpld/app/misc/detail/WorkFile.h
@@ -10,6 +10,9 @@
 #include <boost/asio/io_context.hpp>
 #include <boost/asio/strand.hpp>
 
+#include <functional>
+#include <memory>
+#include <string>
 #include <utility>
 
 namespace xrpl::detail {
diff --git a/src/xrpld/app/misc/detail/WorkPlain.h b/src/xrpld/app/misc/detail/WorkPlain.h
index d3c0309e77..4c45fb4801 100644
--- a/src/xrpld/app/misc/detail/WorkPlain.h
+++ b/src/xrpld/app/misc/detail/WorkPlain.h
@@ -2,6 +2,9 @@
 
 #include <xrpld/app/misc/detail/WorkBase.h>
 
+#include <memory>
+#include <string>
+
 namespace xrpl::detail {
 
 // Work over TCP/IP
diff --git a/src/xrpld/app/misc/detail/WorkSSL.h b/src/xrpld/app/misc/detail/WorkSSL.h
index 74676bb7c1..d4b3b9ff25 100644
--- a/src/xrpld/app/misc/detail/WorkSSL.h
+++ b/src/xrpld/app/misc/detail/WorkSSL.h
@@ -3,13 +3,14 @@
 #include <xrpld/app/misc/detail/WorkBase.h>
 #include <xrpld/core/Config.h>
 
-#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/net/HTTPClientSSLContext.h>
 
 #include <boost/asio/ssl.hpp>
 #include <boost/format.hpp>
 
-#include <functional>
+#include <memory>
+#include <string>
 
 namespace xrpl::detail {
 
diff --git a/src/xrpld/app/misc/make_NetworkOPs.h b/src/xrpld/app/misc/make_NetworkOPs.h
index a848067e36..b4dba2b065 100644
--- a/src/xrpld/app/misc/make_NetworkOPs.h
+++ b/src/xrpld/app/misc/make_NetworkOPs.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include <xrpl/beast/insight/Insight.h>
+#include <xrpl/beast/insight/Collector.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/JobQueue.h>
 #include <xrpl/core/ServiceRegistry.h>
@@ -8,6 +8,7 @@
 
 #include <boost/asio.hpp>
 
+#include <cstddef>
 #include <memory>
 
 namespace xrpl {
diff --git a/src/xrpld/app/rdb/PeerFinder.h b/src/xrpld/app/rdb/PeerFinder.h
index e5ac6dda8c..4f186ff7e2 100644
--- a/src/xrpld/app/rdb/PeerFinder.h
+++ b/src/xrpld/app/rdb/PeerFinder.h
@@ -1,10 +1,15 @@
 #pragma once
 
-#include <xrpld/core/Config.h>
 #include <xrpld/peerfinder/detail/Store.h>
 
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/config/BasicConfig.h>
 #include <xrpl/rdb/DatabaseCon.h>
 
+#include <functional>
+#include <string>
+#include <vector>
+
 namespace xrpl {
 
 /**
diff --git a/src/xrpld/app/rdb/backend/SQLiteDatabase.h b/src/xrpld/app/rdb/backend/SQLiteDatabase.h
index e5c69c2703..f5b930d23e 100644
--- a/src/xrpld/app/rdb/backend/SQLiteDatabase.h
+++ b/src/xrpld/app/rdb/backend/SQLiteDatabase.h
@@ -1,10 +1,22 @@
 #pragma once
 
+#include <xrpl/basics/RangeSet.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/ErrorCodes.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/TxSearched.h>
+#include <xrpl/rdb/DatabaseCon.h>
 #include <xrpl/rdb/RelationalDatabase.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <functional>
 #include <map>
 #include <memory>
 #include <optional>
+#include <utility>
 #include <variant>
 #include <vector>
 
diff --git a/src/xrpld/app/rdb/backend/detail/Node.cpp b/src/xrpld/app/rdb/backend/detail/Node.cpp
index dcc146397b..6e92a0de60 100644
--- a/src/xrpld/app/rdb/backend/detail/Node.cpp
+++ b/src/xrpld/app/rdb/backend/detail/Node.cpp
@@ -43,7 +43,9 @@
 #include <boost/optional/optional.hpp>  // IWYU pragma: keep
 #include <boost/system/detail/error_code.hpp>
 
+#include <soci/blob-exchange.h>  // IWYU pragma: keep
 #include <soci/blob.h>
+#include <soci/boost-optional.h>  // IWYU pragma: keep
 #include <soci/into.h>
 #include <soci/soci-backend.h>
 #include <soci/statement.h>
diff --git a/src/xrpld/app/rdb/backend/detail/Node.h b/src/xrpld/app/rdb/backend/detail/Node.h
index 8267bb1a82..ba3eb91ca3 100644
--- a/src/xrpld/app/rdb/backend/detail/Node.h
+++ b/src/xrpld/app/rdb/backend/detail/Node.h
@@ -2,9 +2,33 @@
 
 #include <xrpld/core/Config.h>
 
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/RangeSet.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/PerfLog.h>
+#include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/Ledger.h>
+#include <xrpl/protocol/ErrorCodes.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/TxSearched.h>
+#include <xrpl/rdb/DatabaseCon.h>
 #include <xrpl/rdb/RelationalDatabase.h>
 
+#include <soci/session.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+#include <variant>
+#include <vector>
+
 namespace xrpl::detail {
 
 /* Need to change TableTypeCount if TableType is modified. */
diff --git a/src/xrpld/app/rdb/detail/PeerFinder.cpp b/src/xrpld/app/rdb/detail/PeerFinder.cpp
index 9452c3af99..c40e3e42c6 100644
--- a/src/xrpld/app/rdb/detail/PeerFinder.cpp
+++ b/src/xrpld/app/rdb/detail/PeerFinder.cpp
@@ -11,6 +11,7 @@
 
 #include <boost/optional/optional.hpp>  // IWYU pragma: keep
 
+#include <soci/boost-optional.h>  // IWYU pragma: keep
 #include <soci/into.h>
 #include <soci/session.h>
 #include <soci/statement.h>
diff --git a/src/xrpld/consensus/Consensus.h b/src/xrpld/consensus/Consensus.h
index b8d04e18b5..fa41f25be1 100644
--- a/src/xrpld/consensus/Consensus.h
+++ b/src/xrpld/consensus/Consensus.h
@@ -3,19 +3,28 @@
 #include <xrpld/consensus/ConsensusParms.h>
 #include <xrpld/consensus/ConsensusProposal.h>
 #include <xrpld/consensus/ConsensusTypes.h>
-#include <xrpld/consensus/DisputedTx.h>
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/json/json_writer.h>
 #include <xrpl/ledger/LedgerTiming.h>
 
 #include <algorithm>
 #include <chrono>
+#include <cstddef>
+#include <cstdint>
 #include <deque>
+#include <map>
+#include <memory>
 #include <optional>
 #include <sstream>
+#include <string>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/consensus/ConsensusParms.h b/src/xrpld/consensus/ConsensusParms.h
index e6dd7f046e..d00a5dc3c7 100644
--- a/src/xrpld/consensus/ConsensusParms.h
+++ b/src/xrpld/consensus/ConsensusParms.h
@@ -4,9 +4,9 @@
 
 #include <chrono>
 #include <cstddef>
-#include <functional>
 #include <map>
 #include <optional>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/consensus/ConsensusProposal.h b/src/xrpld/consensus/ConsensusProposal.h
index d16679bfb5..c27d5c2819 100644
--- a/src/xrpld/consensus/ConsensusProposal.h
+++ b/src/xrpld/consensus/ConsensusProposal.h
@@ -10,6 +10,7 @@
 #include <cstdint>
 #include <optional>
 #include <sstream>
+#include <string>
 
 namespace xrpl {
 /** Represents a proposed position taken during a round of consensus.
diff --git a/src/xrpld/consensus/ConsensusTypes.h b/src/xrpld/consensus/ConsensusTypes.h
index f043fc0663..6b33f50662 100644
--- a/src/xrpld/consensus/ConsensusTypes.h
+++ b/src/xrpld/consensus/ConsensusTypes.h
@@ -3,10 +3,14 @@
 #include <xrpld/consensus/ConsensusProposal.h>
 #include <xrpld/consensus/DisputedTx.h>
 
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/instrumentation.h>
 
 #include <chrono>
+#include <cstddef>
 #include <map>
+#include <string>
 
 namespace xrpl {
 
diff --git a/src/xrpld/consensus/DisputedTx.h b/src/xrpld/consensus/DisputedTx.h
index ba8329714b..96df1536f5 100644
--- a/src/xrpld/consensus/DisputedTx.h
+++ b/src/xrpld/consensus/DisputedTx.h
@@ -4,10 +4,15 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/json/json_writer.h>
 
 #include <boost/container/flat_map.hpp>
 
+#include <cstddef>
+#include <memory>
+#include <sstream>
+#include <string>
 #include <utility>
 
 namespace xrpl {
diff --git a/src/xrpld/consensus/LedgerTrie.h b/src/xrpld/consensus/LedgerTrie.h
index b11a69a641..a21eea2a8a 100644
--- a/src/xrpld/consensus/LedgerTrie.h
+++ b/src/xrpld/consensus/LedgerTrie.h
@@ -5,9 +5,13 @@
 #include <xrpl/json/json_value.h>
 
 #include <algorithm>
+#include <cstddef>
+#include <cstdint>
 #include <iomanip>
+#include <map>
 #include <memory>
 #include <optional>
+#include <ostream>
 #include <sstream>
 #include <stack>
 #include <utility>
diff --git a/src/xrpld/consensus/Validations.h b/src/xrpld/consensus/Validations.h
index d4da8a2887..a204cd0c78 100644
--- a/src/xrpld/consensus/Validations.h
+++ b/src/xrpld/consensus/Validations.h
@@ -5,12 +5,21 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/beast/container/aged_container_utility.h>
 #include <xrpl/beast/container/aged_unordered_map.h>
-#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/beast/hash/uhash.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
 
+#include <algorithm>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
 #include <mutex>
 #include <optional>
+#include <string>
 #include <type_traits>
 #include <utility>
 #include <vector>
diff --git a/src/xrpld/core/Config.h b/src/xrpld/core/Config.h
index 45b36808b2..285ea7b9ac 100644
--- a/src/xrpld/core/Config.h
+++ b/src/xrpld/core/Config.h
@@ -1,16 +1,20 @@
 #pragma once
 
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/config/BasicConfig.h>
 #include <xrpl/core/StartUpType.h>
 #include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/SystemParameters.h>  // VFALCO Breaks levelization
+#include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/rdb/DatabaseCon.h>
 
 #include <boost/filesystem.hpp>  // VFALCO FIX: This include should not be here
 
+#include <chrono>
+#include <cstddef>
 #include <cstdint>
 #include <optional>
 #include <string>
diff --git a/src/xrpld/core/TimeKeeper.h b/src/xrpld/core/TimeKeeper.h
index 8eb13e75c0..9e067759ec 100644
--- a/src/xrpld/core/TimeKeeper.h
+++ b/src/xrpld/core/TimeKeeper.h
@@ -4,6 +4,7 @@
 #include <xrpl/beast/clock/abstract_clock.h>
 
 #include <atomic>
+#include <chrono>
 
 namespace xrpl {
 
diff --git a/src/xrpld/overlay/Cluster.h b/src/xrpld/overlay/Cluster.h
index a8c2083fbc..b3864e0fc6 100644
--- a/src/xrpld/overlay/Cluster.h
+++ b/src/xrpld/overlay/Cluster.h
@@ -7,9 +7,14 @@
 #include <xrpl/config/BasicConfig.h>
 #include <xrpl/protocol/PublicKey.h>
 
+#include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <mutex>
+#include <optional>
 #include <set>
+#include <string>
+#include <type_traits>
 
 namespace xrpl {
 
diff --git a/src/xrpld/overlay/Compression.h b/src/xrpld/overlay/Compression.h
index fb58bd128a..4b7493e7e6 100644
--- a/src/xrpld/overlay/Compression.h
+++ b/src/xrpld/overlay/Compression.h
@@ -2,6 +2,10 @@
 
 #include <xrpl/basics/CompressionAlgorithms.h>
 #include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/instrumentation.h>
+
+#include <cstddef>
+#include <cstdint>
 
 namespace xrpl::compression {
 
diff --git a/src/xrpld/overlay/Message.h b/src/xrpld/overlay/Message.h
index cd21ca40c6..63aa360f92 100644
--- a/src/xrpld/overlay/Message.h
+++ b/src/xrpld/overlay/Message.h
@@ -4,10 +4,17 @@
 
 #include <xrpl/basics/ByteUtilities.h>
 #include <xrpl/protocol/PublicKey.h>
-#include <xrpl/protocol/messages.h>
 
-#include <algorithm>
+#include <google/protobuf/message.h>
+
+#include <xrpl.pb.h>
+
+#include <cstddef>
 #include <cstdint>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/overlay/Overlay.h b/src/xrpld/overlay/Overlay.h
index 87c6ff132a..cc5be791a7 100644
--- a/src/xrpld/overlay/Overlay.h
+++ b/src/xrpld/overlay/Overlay.h
@@ -2,8 +2,12 @@
 
 #include <xrpld/overlay/Peer.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/net/IPAddress.h>
+#include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/json/json_value.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/server/Handoff.h>
 
 #include <boost/asio/ip/tcp.hpp>
@@ -11,8 +15,15 @@
 #include <boost/beast/core/tcp_stream.hpp>
 #include <boost/beast/ssl/ssl_stream.hpp>
 
+#include <xrpl.pb.h>
+
+#include <cstddef>
+#include <cstdint>
 #include <functional>
+#include <memory>
 #include <optional>
+#include <set>
+#include <vector>
 
 namespace boost::asio::ssl {
 class context;
diff --git a/src/xrpld/overlay/Peer.h b/src/xrpld/overlay/Peer.h
index 0c86776030..29778b42a6 100644
--- a/src/xrpld/overlay/Peer.h
+++ b/src/xrpld/overlay/Peer.h
@@ -7,6 +7,12 @@
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/PublicKey.h>
 
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <string>
+
 namespace xrpl {
 
 namespace Resource {
diff --git a/src/xrpld/overlay/PeerSet.h b/src/xrpld/overlay/PeerSet.h
index f50b7130f4..4670ec9783 100644
--- a/src/xrpld/overlay/PeerSet.h
+++ b/src/xrpld/overlay/PeerSet.h
@@ -4,6 +4,15 @@
 #include <xrpld/overlay/Peer.h>
 #include <xrpld/overlay/detail/ProtocolMessage.h>
 
+#include <google/protobuf/message.h>
+
+#include <xrpl.pb.h>
+
+#include <cstddef>
+#include <functional>
+#include <memory>
+#include <set>
+
 namespace xrpl {
 
 /** Supports data retrieval by managing a set of peers.
diff --git a/src/xrpld/overlay/ReduceRelayCommon.h b/src/xrpld/overlay/ReduceRelayCommon.h
index 2389c21f0e..243ce167f9 100644
--- a/src/xrpld/overlay/ReduceRelayCommon.h
+++ b/src/xrpld/overlay/ReduceRelayCommon.h
@@ -1,6 +1,8 @@
 #pragma once
 
 #include <chrono>
+#include <cstddef>
+#include <cstdint>
 
 // Blog post explaining the rationale behind reduction of flooding gossip
 // protocol:
diff --git a/src/xrpld/overlay/Slot.h b/src/xrpld/overlay/Slot.h
index 7490798787..a29020e03a 100644
--- a/src/xrpld/overlay/Slot.h
+++ b/src/xrpld/overlay/Slot.h
@@ -5,19 +5,33 @@
 #include <xrpld/overlay/ReduceRelayCommon.h>
 
 #include <xrpl/basics/Log.h>
-#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/hardened_hash.h>
 #include <xrpl/basics/random.h>
 #include <xrpl/beast/container/aged_unordered_map.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/protocol/PublicKey.h>
-#include <xrpl/protocol/messages.h>
+
+#include <xrpl.pb.h>
 
 #include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <iterator>
 #include <optional>
 #include <set>
+#include <sstream>
 #include <tuple>
 #include <unordered_map>
 #include <unordered_set>
+#include <vector>
 
 namespace xrpl::reduce_relay {
 
diff --git a/src/xrpld/overlay/Squelch.h b/src/xrpld/overlay/Squelch.h
index 96d8c26f1d..0485c91c81 100644
--- a/src/xrpld/overlay/Squelch.h
+++ b/src/xrpld/overlay/Squelch.h
@@ -3,6 +3,7 @@
 #include <xrpld/overlay/ReduceRelayCommon.h>
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/protocol/PublicKey.h>
 
diff --git a/src/xrpld/overlay/detail/ConnectAttempt.h b/src/xrpld/overlay/detail/ConnectAttempt.h
index aba224d5c7..bed3f672be 100644
--- a/src/xrpld/overlay/detail/ConnectAttempt.h
+++ b/src/xrpld/overlay/detail/ConnectAttempt.h
@@ -1,9 +1,21 @@
 #pragma once
 
+#include <xrpld/app/main/Application.h>
 #include <xrpld/overlay/Peer.h>
 #include <xrpld/overlay/detail/OverlayImpl.h>
+#include <xrpld/peerfinder/Slot.h>
 
+#include <xrpl/beast/net/IPAddressConversion.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/WrappedSink.h>
+#include <xrpl/resource/Consumer.h>
+
+#include <chrono>
+#include <cstdint>
+#include <memory>
 #include <sstream>
+#include <string>
 
 namespace xrpl {
 
diff --git a/src/xrpld/overlay/detail/Handshake.h b/src/xrpld/overlay/detail/Handshake.h
index 3cbaa118da..6dcc06bbf1 100644
--- a/src/xrpld/overlay/detail/Handshake.h
+++ b/src/xrpld/overlay/detail/Handshake.h
@@ -3,8 +3,9 @@
 #include <xrpld/app/main/Application.h>
 #include <xrpld/overlay/detail/ProtocolVersion.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/net/IPAddress.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/protocol/BuildInfo.h>
 
 #include <boost/asio/ssl.hpp>
 #include <boost/beast/core/tcp_stream.hpp>
@@ -13,8 +14,9 @@
 #include <boost/beast/http/fields.hpp>
 #include <boost/beast/ssl/ssl_stream.hpp>
 
+#include <cstdint>
 #include <optional>
-#include <utility>
+#include <string>
 
 namespace xrpl {
 
diff --git a/src/xrpld/overlay/detail/OverlayImpl.h b/src/xrpld/overlay/detail/OverlayImpl.h
index 545d9eb75c..7db32c0d23 100644
--- a/src/xrpld/overlay/detail/OverlayImpl.h
+++ b/src/xrpld/overlay/detail/OverlayImpl.h
@@ -3,20 +3,30 @@
 #include <xrpld/app/main/Application.h>
 #include <xrpld/overlay/Message.h>
 #include <xrpld/overlay/Overlay.h>
+#include <xrpld/overlay/Peer.h>
 #include <xrpld/overlay/Slot.h>
 #include <xrpld/overlay/detail/Handshake.h>
 #include <xrpld/overlay/detail/TrafficCount.h>
 #include <xrpld/overlay/detail/TxMetrics.h>
 #include <xrpld/peerfinder/PeerfinderManager.h>
+#include <xrpld/peerfinder/Slot.h>
 #include <xrpld/rpc/ServerHandler.h>
 
 #include <xrpl/basics/Resolver.h>
 #include <xrpl/basics/UnorderedContainers.h>
-#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/UptimeClock.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/insight/Gauge.h>
+#include <xrpl/beast/insight/Hook.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/core/Job.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/resource/ResourceManager.h>
 #include <xrpl/server/Handoff.h>
+#include <xrpl/server/Writer.h>
 
 #include <boost/algorithm/string/predicate.hpp>
 #include <boost/asio/basic_waitable_timer.hpp>
@@ -25,14 +35,22 @@
 #include <boost/asio/strand.hpp>
 #include <boost/container/flat_map.hpp>
 
+#include <xrpl.pb.h>
+
 #include <atomic>
 #include <chrono>
 #include <condition_variable>
+#include <cstddef>
 #include <cstdint>
+#include <functional>
 #include <memory>
 #include <mutex>
 #include <optional>
+#include <set>
+#include <string>
 #include <unordered_map>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/overlay/detail/PeerImp.h b/src/xrpld/overlay/detail/PeerImp.h
index 28fb6b33a4..4a96f9a6e6 100644
--- a/src/xrpld/overlay/detail/PeerImp.h
+++ b/src/xrpld/overlay/detail/PeerImp.h
@@ -2,28 +2,59 @@
 
 #include <xrpld/app/consensus/RCLCxPeerPos.h>
 #include <xrpld/app/ledger/detail/LedgerReplayMsgHandler.h>
+#include <xrpld/app/main/Application.h>
+#include <xrpld/overlay/Compression.h>
+#include <xrpld/overlay/Message.h>
+#include <xrpld/overlay/Peer.h>
 #include <xrpld/overlay/Squelch.h>
 #include <xrpld/overlay/detail/OverlayImpl.h>
 #include <xrpld/overlay/detail/ProtocolVersion.h>
 #include <xrpld/peerfinder/PeerfinderManager.h>
+#include <xrpld/peerfinder/Slot.h>
 
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/Number.h>
 #include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/UptimeClock.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/WrappedSink.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/HashRouter.h>
+#include <xrpl/core/LoadEvent.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/STValidation.h>
+#include <xrpl/resource/Charge.h>
+#include <xrpl/resource/Consumer.h>
 #include <xrpl/resource/Fees.h>
+#include <xrpl/server/Handoff.h>
 
 #include <boost/circular_buffer.hpp>
 #include <boost/endian/conversion.hpp>
 #include <boost/thread/shared_mutex.hpp>
 
+#include <google/protobuf/message.h>
+
+#include <xrpl.pb.h>
+
 #include <atomic>
+#include <chrono>
+#include <cstddef>
 #include <cstdint>
+#include <iterator>
+#include <memory>
+#include <mutex>
 #include <optional>
 #include <queue>
+#include <shared_mutex>
+#include <string>
+#include <type_traits>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/overlay/detail/ProtocolMessage.h b/src/xrpld/overlay/detail/ProtocolMessage.h
index b1a30bad10..da418f8e82 100644
--- a/src/xrpld/overlay/detail/ProtocolMessage.h
+++ b/src/xrpld/overlay/detail/ProtocolMessage.h
@@ -5,14 +5,21 @@
 #include <xrpld/overlay/detail/ZeroCopyStream.h>
 
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/messages.h>
 
 #include <boost/asio/buffer.hpp>
 #include <boost/asio/buffers_iterator.hpp>
 
+#include <google/protobuf/message.h>
+
+#include <xrpl.pb.h>
+
+#include <cstddef>
 #include <cstdint>
+#include <memory>
 #include <optional>
+#include <string>
 #include <type_traits>
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/src/xrpld/overlay/detail/TrafficCount.h b/src/xrpld/overlay/detail/TrafficCount.h
index cb77c2359f..b96ee022d6 100644
--- a/src/xrpld/overlay/detail/TrafficCount.h
+++ b/src/xrpld/overlay/detail/TrafficCount.h
@@ -1,10 +1,16 @@
 #pragma once
 
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/messages.h>
+
+#include <google/protobuf/message.h>
+
+#include <xrpl.pb.h>
 
 #include <atomic>
+#include <cstddef>
 #include <cstdint>
+#include <string>
+#include <unordered_map>
 
 namespace xrpl {
 
diff --git a/src/xrpld/overlay/detail/TxMetrics.h b/src/xrpld/overlay/detail/TxMetrics.h
index 50df7a65cc..44cd0272ee 100644
--- a/src/xrpld/overlay/detail/TxMetrics.h
+++ b/src/xrpld/overlay/detail/TxMetrics.h
@@ -1,11 +1,13 @@
 #pragma once
 
 #include <xrpl/json/json_value.h>
-#include <xrpl/protocol/messages.h>
 
 #include <boost/circular_buffer.hpp>
 
+#include <xrpl.pb.h>
+
 #include <chrono>
+#include <cstdint>
 #include <mutex>
 
 namespace xrpl::metrics {
diff --git a/src/xrpld/overlay/detail/ZeroCopyStream.h b/src/xrpld/overlay/detail/ZeroCopyStream.h
index f77f266321..deccb627b9 100644
--- a/src/xrpld/overlay/detail/ZeroCopyStream.h
+++ b/src/xrpld/overlay/detail/ZeroCopyStream.h
@@ -6,6 +6,9 @@
 
 #include <google/protobuf/io/zero_copy_stream.h>
 
+#include <cstddef>
+#include <cstdint>
+
 namespace xrpl {
 
 /** Implements ZeroCopyInputStream around a buffer sequence.
@@ -20,7 +23,7 @@ private:
     using iterator = Buffers::const_iterator;
     using const_buffer = boost::asio::const_buffer;
 
-    google::protobuf::int64 count_ = 0;
+    std::int64_t count_ = 0;
     iterator last_;
     iterator first_;    // Where pos_ comes from
     const_buffer pos_;  // What Next() will return
@@ -37,7 +40,7 @@ public:
     bool
     Skip(int count) override;
 
-    [[nodiscard]] google::protobuf::int64
+    [[nodiscard]] std::int64_t
     ByteCount() const override
     {
         return count_;
@@ -116,7 +119,7 @@ private:
 
     Streambuf& streambuf_;
     std::size_t blockSize_;
-    google::protobuf::int64 count_ = 0;
+    std::int64_t count_ = 0;
     std::size_t commit_ = 0;
     buffers_type buffers_;
     iterator pos_;
@@ -132,7 +135,7 @@ public:
     void
     BackUp(int count) override;
 
-    [[nodiscard]] google::protobuf::int64
+    [[nodiscard]] std::int64_t
     ByteCount() const override
     {
         return count_;
diff --git a/src/xrpld/overlay/make_Overlay.h b/src/xrpld/overlay/make_Overlay.h
index acd477deec..f0dfa429c0 100644
--- a/src/xrpld/overlay/make_Overlay.h
+++ b/src/xrpld/overlay/make_Overlay.h
@@ -1,12 +1,19 @@
 #pragma once
 
+#include <xrpld/app/main/Application.h>
 #include <xrpld/overlay/Overlay.h>
 #include <xrpld/rpc/ServerHandler.h>
 
 #include <xrpl/basics/Resolver.h>
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/config/BasicConfig.h>
+#include <xrpl/resource/ResourceManager.h>
 
 #include <boost/asio/io_context.hpp>
 
+#include <memory>
+
 namespace xrpl {
 
 Overlay::Setup
diff --git a/src/xrpld/overlay/predicates.h b/src/xrpld/overlay/predicates.h
index d7c2add937..2527b8c728 100644
--- a/src/xrpld/overlay/predicates.h
+++ b/src/xrpld/overlay/predicates.h
@@ -3,6 +3,7 @@
 #include <xrpld/overlay/Message.h>
 #include <xrpld/overlay/Peer.h>
 
+#include <memory>
 #include <set>
 
 namespace xrpl {
diff --git a/src/xrpld/peerfinder/PeerfinderManager.h b/src/xrpld/peerfinder/PeerfinderManager.h
index ec4beb2db4..d482ae7241 100644
--- a/src/xrpld/peerfinder/PeerfinderManager.h
+++ b/src/xrpld/peerfinder/PeerfinderManager.h
@@ -5,11 +5,20 @@
 #include <xrpld/peerfinder/detail/Tuning.h>
 
 #include <xrpl/beast/clock/abstract_clock.h>
+#include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/protocol/PublicKey.h>
 
 #include <boost/asio/ip/tcp.hpp>
 
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <string>
 #include <string_view>
+#include <utility>
+#include <vector>
 
 namespace xrpl::PeerFinder {
 
diff --git a/src/xrpld/peerfinder/Slot.h b/src/xrpld/peerfinder/Slot.h
index 289252e3fa..f43b7d1009 100644
--- a/src/xrpld/peerfinder/Slot.h
+++ b/src/xrpld/peerfinder/Slot.h
@@ -3,6 +3,8 @@
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/protocol/PublicKey.h>
 
+#include <cstdint>
+#include <memory>
 #include <optional>
 
 namespace xrpl::PeerFinder {
diff --git a/src/xrpld/peerfinder/detail/Bootcache.h b/src/xrpld/peerfinder/detail/Bootcache.h
index 01ee2cad33..5384bb356a 100644
--- a/src/xrpld/peerfinder/detail/Bootcache.h
+++ b/src/xrpld/peerfinder/detail/Bootcache.h
@@ -4,6 +4,7 @@
 #include <xrpld/peerfinder/detail/Store.h>
 
 #include <xrpl/basics/comparators.h>
+#include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/PropertyStream.h>
 
diff --git a/src/xrpld/peerfinder/detail/Checker.h b/src/xrpld/peerfinder/detail/Checker.h
index 2f324bf8b6..20687448df 100644
--- a/src/xrpld/peerfinder/detail/Checker.h
+++ b/src/xrpld/peerfinder/detail/Checker.h
@@ -1,12 +1,14 @@
 #pragma once
 
 #include <xrpl/beast/net/IPAddressConversion.h>
+#include <xrpl/beast/net/IPEndpoint.h>
 
 #include <boost/asio/io_context.hpp>
 #include <boost/asio/ip/tcp.hpp>
 #include <boost/intrusive/list.hpp>
 
 #include <condition_variable>
+#include <functional>
 #include <memory>
 #include <mutex>
 
diff --git a/src/xrpld/peerfinder/detail/Counts.h b/src/xrpld/peerfinder/detail/Counts.h
index 67b8370996..0d8bf1c56e 100644
--- a/src/xrpld/peerfinder/detail/Counts.h
+++ b/src/xrpld/peerfinder/detail/Counts.h
@@ -4,7 +4,12 @@
 #include <xrpld/peerfinder/Slot.h>
 #include <xrpld/peerfinder/detail/Tuning.h>
 
-#include <xrpl/basics/random.h>
+#include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/beast/utility/instrumentation.h>
+
+#include <cstddef>
+#include <sstream>
+#include <string>
 
 namespace xrpl::PeerFinder {
 
diff --git a/src/xrpld/peerfinder/detail/Fixed.h b/src/xrpld/peerfinder/detail/Fixed.h
index 61df9caddb..3319994251 100644
--- a/src/xrpld/peerfinder/detail/Fixed.h
+++ b/src/xrpld/peerfinder/detail/Fixed.h
@@ -1,7 +1,12 @@
 #pragma once
 
+#include <xrpld/peerfinder/PeerfinderManager.h>
 #include <xrpld/peerfinder/detail/Tuning.h>
 
+#include <algorithm>
+#include <chrono>
+#include <cstddef>
+
 namespace xrpl::PeerFinder {
 
 /** Metadata for a Fixed slot. */
diff --git a/src/xrpld/peerfinder/detail/Handouts.h b/src/xrpld/peerfinder/detail/Handouts.h
index 7523197c40..faadb51fd2 100644
--- a/src/xrpld/peerfinder/detail/Handouts.h
+++ b/src/xrpld/peerfinder/detail/Handouts.h
@@ -1,12 +1,17 @@
 #pragma once
 
+#include <xrpld/peerfinder/PeerfinderManager.h>
 #include <xrpld/peerfinder/detail/SlotImp.h>
 #include <xrpld/peerfinder/detail/Tuning.h>
 
 #include <xrpl/beast/container/aged_set.h>
+#include <xrpl/beast/net/IPAddress.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
+#include <algorithm>
+#include <cstddef>
 #include <utility>
+#include <vector>
 
 namespace xrpl::PeerFinder {
 
diff --git a/src/xrpld/peerfinder/detail/Livecache.h b/src/xrpld/peerfinder/detail/Livecache.h
index c5f04be90a..1dcc8f6daf 100644
--- a/src/xrpld/peerfinder/detail/Livecache.h
+++ b/src/xrpld/peerfinder/detail/Livecache.h
@@ -7,13 +7,27 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/random.h>
 #include <xrpl/beast/container/aged_map.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/beast/utility/maybe_const.h>
 
 #include <boost/intrusive/list.hpp>
 #include <boost/iterator/transform_iterator.hpp>
 
 #include <algorithm>
+#include <array>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <iterator>
+#include <memory>
+#include <sstream>
+#include <string>
 #include <utility>
+#include <vector>
 
 namespace xrpl::PeerFinder {
 
diff --git a/src/xrpld/peerfinder/detail/Logic.h b/src/xrpld/peerfinder/detail/Logic.h
index b74643f7a5..7d10f7f516 100644
--- a/src/xrpld/peerfinder/detail/Logic.h
+++ b/src/xrpld/peerfinder/detail/Logic.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <xrpld/peerfinder/PeerfinderManager.h>
+#include <xrpld/peerfinder/Slot.h>
 #include <xrpld/peerfinder/detail/Bootcache.h>
 #include <xrpld/peerfinder/detail/Counts.h>
 #include <xrpld/peerfinder/detail/Fixed.h>
@@ -14,14 +15,29 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/random.h>
+#include <xrpl/beast/net/IPAddress.h>
 #include <xrpl/beast/net/IPAddressConversion.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/beast/utility/WrappedSink.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/PublicKey.h>
 
 #include <algorithm>
+#include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <map>
 #include <memory>
+#include <mutex>
+#include <optional>
 #include <set>
+#include <stdexcept>
+#include <string_view>
+#include <tuple>
+#include <utility>
+#include <vector>
 
 namespace xrpl::PeerFinder {
 
diff --git a/src/xrpld/peerfinder/detail/SlotImp.h b/src/xrpld/peerfinder/detail/SlotImp.h
index 0cf4d7a3c8..cf1915268f 100644
--- a/src/xrpld/peerfinder/detail/SlotImp.h
+++ b/src/xrpld/peerfinder/detail/SlotImp.h
@@ -4,9 +4,14 @@
 #include <xrpld/peerfinder/Slot.h>
 
 #include <xrpl/beast/container/aged_unordered_map.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/protocol/PublicKey.h>
 
 #include <atomic>
+#include <cstdint>
+#include <memory>
 #include <optional>
+#include <string>
 
 namespace xrpl::PeerFinder {
 
diff --git a/src/xrpld/peerfinder/detail/Source.h b/src/xrpld/peerfinder/detail/Source.h
index c86176911e..cf8920e056 100644
--- a/src/xrpld/peerfinder/detail/Source.h
+++ b/src/xrpld/peerfinder/detail/Source.h
@@ -2,8 +2,12 @@
 
 #include <xrpld/peerfinder/PeerfinderManager.h>
 
+#include <xrpl/beast/utility/Journal.h>
+
 #include <boost/system/error_code.hpp>
 
+#include <string>
+
 namespace xrpl::PeerFinder {
 
 /** A static or dynamic source of peer addresses.
diff --git a/src/xrpld/peerfinder/detail/SourceStrings.h b/src/xrpld/peerfinder/detail/SourceStrings.h
index 156db0ce85..618970fa03 100644
--- a/src/xrpld/peerfinder/detail/SourceStrings.h
+++ b/src/xrpld/peerfinder/detail/SourceStrings.h
@@ -3,6 +3,8 @@
 #include <xrpld/peerfinder/detail/Source.h>
 
 #include <memory>
+#include <string>
+#include <vector>
 
 namespace xrpl::PeerFinder {
 
diff --git a/src/xrpld/peerfinder/detail/Store.h b/src/xrpld/peerfinder/detail/Store.h
index 347fc09b15..570dba0523 100644
--- a/src/xrpld/peerfinder/detail/Store.h
+++ b/src/xrpld/peerfinder/detail/Store.h
@@ -1,5 +1,11 @@
 #pragma once
 
+#include <xrpl/beast/net/IPEndpoint.h>
+
+#include <cstddef>
+#include <functional>
+#include <vector>
+
 namespace xrpl::PeerFinder {
 
 /** Abstract persistence for PeerFinder data. */
diff --git a/src/xrpld/peerfinder/detail/StoreSqdb.h b/src/xrpld/peerfinder/detail/StoreSqdb.h
index 19cdd774b7..f868e89ff7 100644
--- a/src/xrpld/peerfinder/detail/StoreSqdb.h
+++ b/src/xrpld/peerfinder/detail/StoreSqdb.h
@@ -3,8 +3,17 @@
 #include <xrpld/app/rdb/PeerFinder.h>
 #include <xrpld/peerfinder/detail/Store.h>
 
+#include <xrpl/basics/Log.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/rdb/SociDB.h>
 
+#include <soci/session.h>
+
+#include <cstddef>
+#include <string>
+#include <vector>
+
 namespace xrpl::PeerFinder {
 
 /** Database persistence for PeerFinder using SQLite */
diff --git a/src/xrpld/peerfinder/detail/Tuning.h b/src/xrpld/peerfinder/detail/Tuning.h
index b4781495b8..1bf9df382e 100644
--- a/src/xrpld/peerfinder/detail/Tuning.h
+++ b/src/xrpld/peerfinder/detail/Tuning.h
@@ -1,6 +1,9 @@
 #pragma once
 
+#include <algorithm>
 #include <array>
+#include <chrono>
+#include <cstdint>
 
 /** Heuristically tuned constants. */
 /** @{ */
diff --git a/src/xrpld/peerfinder/detail/iosformat.h b/src/xrpld/peerfinder/detail/iosformat.h
index 632ac10c16..a0b9ff537a 100644
--- a/src/xrpld/peerfinder/detail/iosformat.h
+++ b/src/xrpld/peerfinder/detail/iosformat.h
@@ -1,5 +1,8 @@
 #pragma once
 
+#include <cstddef>
+#include <ios>
+#include <memory>
 #include <ostream>
 #include <sstream>
 #include <string>
diff --git a/src/xrpld/peerfinder/make_Manager.h b/src/xrpld/peerfinder/make_Manager.h
index 846330988b..1f3f226397 100644
--- a/src/xrpld/peerfinder/make_Manager.h
+++ b/src/xrpld/peerfinder/make_Manager.h
@@ -2,6 +2,10 @@
 
 #include <xrpld/peerfinder/PeerfinderManager.h>
 
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/config/BasicConfig.h>
+
 #include <boost/asio/io_context.hpp>
 
 #include <memory>
diff --git a/src/xrpld/perflog/detail/PerfLogImp.cpp b/src/xrpld/perflog/detail/PerfLogImp.cpp
index 5ace4d8c8b..3aa7e38ea2 100644
--- a/src/xrpld/perflog/detail/PerfLogImp.cpp
+++ b/src/xrpld/perflog/detail/PerfLogImp.cpp
@@ -1,5 +1,7 @@
 #include <xrpld/perflog/detail/PerfLogImp.h>
 
+#include <xrpld/app/main/Application.h>
+
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/core/CurrentThreadName.h>
@@ -12,6 +14,7 @@
 #include <xrpl/core/PerfLog.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/json_writer.h>
+#include <xrpl/nodestore/Database.h>
 #include <xrpl/protocol/jss.h>
 
 #include <boost/filesystem/operations.hpp>
diff --git a/src/xrpld/perflog/detail/PerfLogImp.h b/src/xrpld/perflog/detail/PerfLogImp.h
index bd60912c18..88bf473554 100644
--- a/src/xrpld/perflog/detail/PerfLogImp.h
+++ b/src/xrpld/perflog/detail/PerfLogImp.h
@@ -3,17 +3,23 @@
 #include <xrpld/rpc/detail/Handler.h>
 
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/Job.h>
+#include <xrpl/core/JobTypes.h>
 #include <xrpl/core/PerfLog.h>
+#include <xrpl/json/json_value.h>
 
 #include <boost/asio/ip/host_name.hpp>
 
 #include <condition_variable>
 #include <cstdint>
 #include <fstream>
-#include <memory>
+#include <functional>
+#include <mutex>
+#include <set>
 #include <string>
 #include <thread>
 #include <unordered_map>
+#include <utility>
 #include <vector>
 
 namespace xrpl::perf {
diff --git a/src/xrpld/rpc/BookChanges.h b/src/xrpld/rpc/BookChanges.h
index 45c3cf2e4b..3c10ece78f 100644
--- a/src/xrpld/rpc/BookChanges.h
+++ b/src/xrpld/rpc/BookChanges.h
@@ -1,13 +1,25 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/json/json_value.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/TxFormats.h>
 #include <xrpl/protocol/jss.h>
 
+#include <cstdint>
+#include <map>
 #include <memory>
+#include <optional>
+#include <sstream>
+#include <string>
+#include <tuple>
 
 namespace json {
 class Value;
diff --git a/src/xrpld/rpc/CTID.h b/src/xrpld/rpc/CTID.h
index 781cd85e29..c2133a19b5 100644
--- a/src/xrpld/rpc/CTID.h
+++ b/src/xrpld/rpc/CTID.h
@@ -2,9 +2,14 @@
 
 #include <boost/regex.hpp>
 
+#include <cstdint>
+#include <iomanip>
+#include <ios>
 #include <optional>
-#include <regex>
 #include <sstream>
+#include <string>
+#include <string_view>
+#include <tuple>
 
 namespace xrpl::RPC {
 
diff --git a/src/xrpld/rpc/Context.h b/src/xrpld/rpc/Context.h
index 3724ce1783..fe6bb81ce3 100644
--- a/src/xrpld/rpc/Context.h
+++ b/src/xrpld/rpc/Context.h
@@ -4,8 +4,14 @@
 
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/JobQueue.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/resource/Charge.h>
+#include <xrpl/resource/Consumer.h>
 #include <xrpl/server/InfoSub.h>
 
+#include <memory>
+#include <string_view>
+
 namespace xrpl {
 
 class Application;
diff --git a/src/xrpld/rpc/DeliveredAmount.h b/src/xrpld/rpc/DeliveredAmount.h
index b603fa4acd..bba045d494 100644
--- a/src/xrpld/rpc/DeliveredAmount.h
+++ b/src/xrpld/rpc/DeliveredAmount.h
@@ -3,8 +3,8 @@
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STAmount.h>
 
-#include <functional>
 #include <memory>
+#include <optional>
 
 namespace json {
 class Value;
diff --git a/src/xrpld/rpc/GRPCHandlers.h b/src/xrpld/rpc/GRPCHandlers.h
index ac419c18ee..9dc7e0b13a 100644
--- a/src/xrpld/rpc/GRPCHandlers.h
+++ b/src/xrpld/rpc/GRPCHandlers.h
@@ -2,9 +2,13 @@
 
 #include <xrpld/rpc/Context.h>
 
-#include <xrpl/proto/org/xrpl/rpc/v1/xrp_ledger.pb.h>
+#include <grpcpp/support/status.h>
+#include <org/xrpl/rpc/v1/get_ledger.pb.h>
+#include <org/xrpl/rpc/v1/get_ledger_data.pb.h>
+#include <org/xrpl/rpc/v1/get_ledger_diff.pb.h>
+#include <org/xrpl/rpc/v1/get_ledger_entry.pb.h>
 
-#include <grpcpp/grpcpp.h>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/MPTokenIssuanceID.h b/src/xrpld/rpc/MPTokenIssuanceID.h
index 8a8f6f3d51..cb2bfd1bdc 100644
--- a/src/xrpld/rpc/MPTokenIssuanceID.h
+++ b/src/xrpld/rpc/MPTokenIssuanceID.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include <xrpl/basics/base_uint.h>
 #include <xrpl/json/json_forwards.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TxMeta.h>
+#include <xrpl/protocol/UintTypes.h>
 
 #include <memory>
 #include <optional>
diff --git a/src/xrpld/rpc/Output.h b/src/xrpld/rpc/Output.h
index 1c74562842..30b5c090d7 100644
--- a/src/xrpld/rpc/Output.h
+++ b/src/xrpld/rpc/Output.h
@@ -2,8 +2,10 @@
 
 #include <boost/utility/string_ref.hpp>
 
-namespace xrpl {
-namespace RPC {
+#include <functional>
+#include <string>
+
+namespace xrpl::RPC {
 
 using Output = std::function<void(boost::string_ref const&)>;
 
@@ -13,5 +15,4 @@ stringOutput(std::string& s)
     return [&](boost::string_ref const& b) { s.append(b.data(), b.size()); };
 }
 
-}  // namespace RPC
-}  // namespace xrpl
+}  // namespace xrpl::RPC
diff --git a/src/xrpld/rpc/RPCCall.h b/src/xrpld/rpc/RPCCall.h
index 7a09115e42..a06eca4413 100644
--- a/src/xrpld/rpc/RPCCall.h
+++ b/src/xrpld/rpc/RPCCall.h
@@ -2,14 +2,17 @@
 
 #include <xrpld/core/Config.h>
 
-#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/json/json_value.h>
 
 #include <boost/asio/io_context.hpp>
 
+#include <cstdint>
 #include <functional>
 #include <string>
 #include <unordered_map>
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/src/xrpld/rpc/RPCHandler.h b/src/xrpld/rpc/RPCHandler.h
index 7e57b456fc..d1cd54145d 100644
--- a/src/xrpld/rpc/RPCHandler.h
+++ b/src/xrpld/rpc/RPCHandler.h
@@ -1,8 +1,13 @@
 #pragma once
 
 #include <xrpld/rpc/Context.h>
+#include <xrpld/rpc/Role.h>
 #include <xrpld/rpc/Status.h>
 
+#include <xrpl/json/json_value.h>
+
+#include <string>
+
 namespace xrpl::RPC {
 
 struct JsonContext;
diff --git a/src/xrpld/rpc/RPCSub.h b/src/xrpld/rpc/RPCSub.h
index 4c0903ed3e..95206e5cf6 100644
--- a/src/xrpld/rpc/RPCSub.h
+++ b/src/xrpld/rpc/RPCSub.h
@@ -6,6 +6,9 @@
 
 #include <boost/asio/io_context.hpp>
 
+#include <memory>
+#include <string>
+
 namespace xrpl {
 
 /** Subscription object for JSON RPC. */
diff --git a/src/xrpld/rpc/Role.h b/src/xrpld/rpc/Role.h
index d1b641f067..660fb92c7c 100644
--- a/src/xrpld/rpc/Role.h
+++ b/src/xrpld/rpc/Role.h
@@ -1,7 +1,9 @@
 #pragma once
 
+#include <xrpl/beast/net/IPAddress.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/json/json_value.h>
+#include <xrpl/resource/Consumer.h>
 #include <xrpl/resource/ResourceManager.h>
 #include <xrpl/server/Handoff.h>
 #include <xrpl/server/Port.h>
@@ -10,7 +12,7 @@
 #include <boost/asio/ip/network_v6.hpp>
 #include <boost/utility/string_view.hpp>
 
-#include <string>
+#include <string_view>
 #include <vector>
 
 namespace xrpl {
diff --git a/src/xrpld/rpc/ServerHandler.h b/src/xrpld/rpc/ServerHandler.h
index 0aac05ea44..054bec9b5b 100644
--- a/src/xrpld/rpc/ServerHandler.h
+++ b/src/xrpld/rpc/ServerHandler.h
@@ -2,11 +2,19 @@
 
 #include <xrpld/app/main/Application.h>
 #include <xrpld/app/main/CollectorManager.h>
+#include <xrpld/core/Config.h>
 #include <xrpld/rpc/detail/WSInfoSub.h>
 
+#include <xrpl/beast/insight/Counter.h>
+#include <xrpl/beast/insight/Event.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/JobQueue.h>
 #include <xrpl/json/Output.h>
-#include <xrpl/server/Server.h>
+#include <xrpl/resource/ResourceManager.h>
+#include <xrpl/server/Handoff.h>
+#include <xrpl/server/Port.h>
+#include <xrpl/server/Server.h>  // IWYU pragma: keep
 #include <xrpl/server/Session.h>
 #include <xrpl/server/WSSession.h>
 
@@ -15,8 +23,15 @@
 #include <boost/utility/string_view.hpp>
 
 #include <condition_variable>
+#include <cstdint>
+#include <functional>
 #include <map>
+#include <memory>
 #include <mutex>
+#include <ostream>
+#include <string>
+#include <string_view>
+#include <utility>
 #include <vector>
 
 namespace xrpl {
diff --git a/src/xrpld/rpc/Status.h b/src/xrpld/rpc/Status.h
index 8f7c620baa..4f15ab0242 100644
--- a/src/xrpld/rpc/Status.h
+++ b/src/xrpld/rpc/Status.h
@@ -1,9 +1,16 @@
 #pragma once
 
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/TER.h>
 
+#include <exception>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
 namespace xrpl::RPC {
 
 /** Status represents the results of an operation that might fail.
diff --git a/src/xrpld/rpc/detail/AccountAssets.h b/src/xrpld/rpc/detail/AccountAssets.h
index 55fce62fa6..16c6087e3f 100644
--- a/src/xrpld/rpc/detail/AccountAssets.h
+++ b/src/xrpld/rpc/detail/AccountAssets.h
@@ -2,7 +2,11 @@
 
 #include <xrpld/rpc/detail/AssetCache.h>
 
-#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/PathAsset.h>
+
+#include <memory>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/detail/AssetCache.h b/src/xrpld/rpc/detail/AssetCache.h
index e53bc3ff94..4b89487526 100644
--- a/src/xrpld/rpc/detail/AssetCache.h
+++ b/src/xrpld/rpc/detail/AssetCache.h
@@ -4,10 +4,14 @@
 #include <xrpld/rpc/detail/TrustLine.h>
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/hardened_hash.h>
-#include <xrpl/ledger/Ledger.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
 
 #include <cstddef>
+#include <memory>
 #include <mutex>
 #include <vector>
 
diff --git a/src/xrpld/rpc/detail/Handler.h b/src/xrpld/rpc/detail/Handler.h
index 140f421ed3..5e583aa5bb 100644
--- a/src/xrpld/rpc/detail/Handler.h
+++ b/src/xrpld/rpc/detail/Handler.h
@@ -1,13 +1,21 @@
 #pragma once
 
-#include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/rpc/RPCHandler.h>
+#include <xrpld/rpc/Role.h>
 #include <xrpld/rpc/Status.h>
 #include <xrpld/rpc/detail/Tuning.h>
 
+#include <xrpl/basics/Log.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/ApiVersion.h>
+#include <xrpl/protocol/ErrorCodes.h>
+#include <xrpl/protocol/jss.h>
 #include <xrpl/server/NetworkOPs.h>
 
+#include <functional>
+#include <set>
+#include <string>
+
 namespace json {
 class Object;
 }  // namespace json
diff --git a/src/xrpld/rpc/detail/MPT.h b/src/xrpld/rpc/detail/MPT.h
index 5cf2d5490f..93c8517539 100644
--- a/src/xrpld/rpc/detail/MPT.h
+++ b/src/xrpld/rpc/detail/MPT.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/UintTypes.h>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/detail/PathRequest.h b/src/xrpld/rpc/detail/PathRequest.h
index 372223e99f..64bc6ef181 100644
--- a/src/xrpld/rpc/detail/PathRequest.h
+++ b/src/xrpld/rpc/detail/PathRequest.h
@@ -1,19 +1,31 @@
 #pragma once
 
+#include <xrpld/app/main/Application.h>
 #include <xrpld/rpc/detail/AssetCache.h>
 #include <xrpld/rpc/detail/Pathfinder.h>
 
+#include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/ledger/Ledger.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/PathAsset.h>
-#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STPathSet.h>
+#include <xrpl/resource/Consumer.h>
 #include <xrpl/server/InfoSub.h>
 
+#include <chrono>
+#include <functional>
 #include <map>
+#include <memory>
 #include <mutex>
 #include <optional>
 #include <set>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/detail/PathRequestManager.h b/src/xrpld/rpc/detail/PathRequestManager.h
index c8e272a97d..94d126ed23 100644
--- a/src/xrpld/rpc/detail/PathRequestManager.h
+++ b/src/xrpld/rpc/detail/PathRequestManager.h
@@ -4,7 +4,17 @@
 #include <xrpld/rpc/detail/AssetCache.h>
 #include <xrpld/rpc/detail/PathRequest.h>
 
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/resource/Consumer.h>
+#include <xrpl/server/InfoSub.h>
+
 #include <atomic>
+#include <chrono>
+#include <functional>
+#include <memory>
 #include <mutex>
 #include <vector>
 
diff --git a/src/xrpld/rpc/detail/Pathfinder.h b/src/xrpld/rpc/detail/Pathfinder.h
index 36caab308e..5ef6c31b25 100644
--- a/src/xrpld/rpc/detail/Pathfinder.h
+++ b/src/xrpld/rpc/detail/Pathfinder.h
@@ -4,11 +4,25 @@
 #include <xrpld/rpc/detail/AssetCache.h>
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/LoadEvent.h>
-#include <xrpl/ledger/Ledger.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/PathAsset.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STPathSet.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <memory>
+#include <optional>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/detail/PathfinderUtils.h b/src/xrpld/rpc/detail/PathfinderUtils.h
index a703127148..ad48b3e9d7 100644
--- a/src/xrpld/rpc/detail/PathfinderUtils.h
+++ b/src/xrpld/rpc/detail/PathfinderUtils.h
@@ -1,6 +1,10 @@
 #pragma once
 
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/SystemParameters.h>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/detail/RPCHandler.cpp b/src/xrpld/rpc/detail/RPCHandler.cpp
index 7e30b81fa6..e839d9d78d 100644
--- a/src/xrpld/rpc/detail/RPCHandler.cpp
+++ b/src/xrpld/rpc/detail/RPCHandler.cpp
@@ -1,5 +1,6 @@
 #include <xrpld/rpc/RPCHandler.h>
 
+#include <xrpld/app/ledger/LedgerMaster.h>  // IWYU pragma: keep
 #include <xrpld/app/main/Application.h>
 #include <xrpld/core/Config.h>
 #include <xrpld/rpc/Context.h>
diff --git a/src/xrpld/rpc/detail/RPCHelpers.h b/src/xrpld/rpc/detail/RPCHelpers.h
index bbc101a072..4a4dca42e5 100644
--- a/src/xrpld/rpc/detail/RPCHelpers.h
+++ b/src/xrpld/rpc/detail/RPCHelpers.h
@@ -1,16 +1,27 @@
 #pragma once
 
-#include <xrpld/app/misc/TxQ.h>
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/Status.h>
 #include <xrpld/rpc/detail/Tuning.h>
 
-#include <xrpl/proto/org/xrpl/rpc/v1/xrp_ledger.pb.h>
+#include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/ApiVersion.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/ErrorCodes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/STLedgerEntry.h>  // IWYU pragma: keep
 #include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Seed.h>
 #include <xrpl/server/NetworkOPs.h>
 
+#include <cstdint>
 #include <optional>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/detail/RPCLedgerHelpers.cpp b/src/xrpld/rpc/detail/RPCLedgerHelpers.cpp
index 38827dc93c..6843c34b19 100644
--- a/src/xrpld/rpc/detail/RPCLedgerHelpers.cpp
+++ b/src/xrpld/rpc/detail/RPCLedgerHelpers.cpp
@@ -1,6 +1,7 @@
 #include <xrpld/rpc/detail/RPCLedgerHelpers.h>
 
 #include <xrpld/app/ledger/InboundLedger.h>
+#include <xrpld/app/ledger/InboundLedgers.h>
 #include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/ledger/LedgerToJson.h>
 #include <xrpld/app/main/Application.h>
@@ -20,6 +21,9 @@
 #include <xrpl/protocol/RippleLedgerHash.h>
 #include <xrpl/protocol/jss.h>
 
+#include <org/xrpl/rpc/v1/get_ledger.pb.h>        // IWYU pragma: keep
+#include <org/xrpl/rpc/v1/get_ledger_data.pb.h>   // IWYU pragma: keep
+#include <org/xrpl/rpc/v1/get_ledger_entry.pb.h>  // IWYU pragma: keep
 #include <org/xrpl/rpc/v1/ledger.pb.h>
 
 #include <cstdint>
diff --git a/src/xrpld/rpc/detail/RPCLedgerHelpers.h b/src/xrpld/rpc/detail/RPCLedgerHelpers.h
index 9ec2a6673c..cbd47d38e6 100644
--- a/src/xrpld/rpc/detail/RPCLedgerHelpers.h
+++ b/src/xrpld/rpc/detail/RPCLedgerHelpers.h
@@ -1,17 +1,20 @@
 #pragma once
 
-#include <xrpld/app/misc/TxQ.h>
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/Status.h>
 #include <xrpld/rpc/detail/Tuning.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/Ledger.h>
-#include <xrpl/proto/org/xrpl/rpc/v1/xrp_ledger.pb.h>
 #include <xrpl/protocol/LedgerShortcut.h>
 #include <xrpl/server/NetworkOPs.h>
 
+#include <org/xrpl/rpc/v1/ledger.pb.h>
+
+#include <cstdint>
 #include <expected>
-#include <optional>
+#include <memory>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/detail/TransactionSign.h b/src/xrpld/rpc/detail/TransactionSign.h
index 1fd9e87b54..cb3fb176dc 100644
--- a/src/xrpld/rpc/detail/TransactionSign.h
+++ b/src/xrpld/rpc/detail/TransactionSign.h
@@ -4,9 +4,14 @@
 #include <xrpld/rpc/Role.h>
 #include <xrpld/rpc/detail/Tuning.h>
 
+#include <xrpl/json/json_value.h>
 #include <xrpl/server/LoadFeeTrack.h>
 #include <xrpl/server/NetworkOPs.h>
 
+#include <chrono>
+#include <functional>
+#include <memory>
+
 namespace xrpl {
 
 // Forward declarations
diff --git a/src/xrpld/rpc/detail/TrustLine.h b/src/xrpld/rpc/detail/TrustLine.h
index 7a0a01d744..a80d81e4ae 100644
--- a/src/xrpld/rpc/detail/TrustLine.h
+++ b/src/xrpld/rpc/detail/TrustLine.h
@@ -1,13 +1,18 @@
 #pragma once
 
 #include <xrpl/basics/CountedObject.h>
-#include <xrpl/ledger/View.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 
 #include <cstdint>
 #include <optional>
+#include <vector>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/detail/Tuning.h b/src/xrpld/rpc/detail/Tuning.h
index 12c09bcb15..5a9d546472 100644
--- a/src/xrpld/rpc/detail/Tuning.h
+++ b/src/xrpld/rpc/detail/Tuning.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include <chrono>
+
 /** Tuned constants. */
 /** @{ */
 namespace xrpl::RPC::Tuning {
diff --git a/src/xrpld/rpc/detail/WSInfoSub.h b/src/xrpld/rpc/detail/WSInfoSub.h
index c224b93e0e..cefb7ad2e4 100644
--- a/src/xrpld/rpc/detail/WSInfoSub.h
+++ b/src/xrpld/rpc/detail/WSInfoSub.h
@@ -7,8 +7,11 @@
 #include <xrpl/server/InfoSub.h>
 #include <xrpl/server/WSSession.h>
 
+#include <cstddef>
 #include <memory>
 #include <string>
+#include <string_view>
+#include <utility>
 
 namespace xrpl {
 
diff --git a/src/xrpld/rpc/handlers/Handlers.h b/src/xrpld/rpc/handlers/Handlers.h
index 2d39e42e02..7b347b2ecc 100644
--- a/src/xrpld/rpc/handlers/Handlers.h
+++ b/src/xrpld/rpc/handlers/Handlers.h
@@ -2,6 +2,8 @@
 
 #include <xrpld/rpc/handlers/ledger/Ledger.h>
 
+#include <xrpl/json/json_value.h>
+
 namespace xrpl {
 
 json::Value
diff --git a/src/xrpld/rpc/handlers/account/AccountNFTs.cpp b/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
index 0249963908..5ce10f6121 100644
--- a/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
@@ -12,6 +12,7 @@
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/RPCErr.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/jss.h>
 #include <xrpl/protocol/nft.h>
 #include <xrpl/protocol/nftPageMask.h>
diff --git a/src/xrpld/rpc/handlers/admin/peer/PeerReservationsDel.cpp b/src/xrpld/rpc/handlers/admin/peer/PeerReservationsDel.cpp
index 40042a0390..c2a8319876 100644
--- a/src/xrpld/rpc/handlers/admin/peer/PeerReservationsDel.cpp
+++ b/src/xrpld/rpc/handlers/admin/peer/PeerReservationsDel.cpp
@@ -1,6 +1,7 @@
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/handlers/Handlers.h>
 
+#include <xrpl/core/PeerReservationTable.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/PublicKey.h>
diff --git a/src/xrpld/rpc/handlers/admin/peer/PeerReservationsList.cpp b/src/xrpld/rpc/handlers/admin/peer/PeerReservationsList.cpp
index 95da4c8567..e0204159fd 100644
--- a/src/xrpld/rpc/handlers/admin/peer/PeerReservationsList.cpp
+++ b/src/xrpld/rpc/handlers/admin/peer/PeerReservationsList.cpp
@@ -1,6 +1,7 @@
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/handlers/Handlers.h>
 
+#include <xrpl/core/PeerReservationTable.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/jss.h>
 
diff --git a/src/xrpld/rpc/handlers/admin/status/GetCounts.h b/src/xrpld/rpc/handlers/admin/status/GetCounts.h
index 05751637ee..15cfa32a29 100644
--- a/src/xrpld/rpc/handlers/admin/status/GetCounts.h
+++ b/src/xrpld/rpc/handlers/admin/status/GetCounts.h
@@ -2,6 +2,8 @@
 
 #include <xrpld/app/main/Application.h>
 
+#include <xrpl/json/json_value.h>
+
 namespace xrpl {
 
 json::Value
diff --git a/src/xrpld/rpc/handlers/ledger/Ledger.h b/src/xrpld/rpc/handlers/ledger/Ledger.h
index 719e635170..59b64832f7 100644
--- a/src/xrpld/rpc/handlers/ledger/Ledger.h
+++ b/src/xrpld/rpc/handlers/ledger/Ledger.h
@@ -1,16 +1,18 @@
 #pragma once
 
-#include <xrpld/app/ledger/LedgerMaster.h>
-#include <xrpld/app/ledger/LedgerToJson.h>
 #include <xrpld/app/main/Application.h>
+#include <xrpld/app/misc/TxQ.h>  // IWYU pragma: keep
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/Role.h>
 #include <xrpld/rpc/Status.h>
 #include <xrpld/rpc/detail/Handler.h>
 
+#include <xrpl/json/json_value.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/ApiVersion.h>
-#include <xrpl/protocol/jss.h>
+
+#include <memory>
+#include <vector>
 
 namespace json {
 class Object;
diff --git a/src/xrpld/rpc/handlers/ledger/LedgerEntryHelpers.h b/src/xrpld/rpc/handlers/ledger/LedgerEntryHelpers.h
index 11f6553dfa..57c4e58242 100644
--- a/src/xrpld/rpc/handlers/ledger/LedgerEntryHelpers.h
+++ b/src/xrpld/rpc/handlers/ledger/LedgerEntryHelpers.h
@@ -2,18 +2,25 @@
 
 #include <xrpld/rpc/detail/RPCHelpers.h>
 
+#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/StringUtilities.h>
-#include <xrpl/basics/strHex.h>
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/core/LexicalCast.h>
-#include <xrpl/json/json_errors.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/ErrorCodes.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/RPCErr.h>
+#include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/STXChainBridge.h>
 #include <xrpl/protocol/jss.h>
 
+#include <cstddef>
+#include <cstdint>
 #include <expected>
-#include <functional>
+#include <initializer_list>
+#include <optional>
+#include <stdexcept>
+#include <string>
 
 namespace xrpl::LedgerEntryHelpers {
 
diff --git a/src/xrpld/rpc/handlers/orderbook/BookChanges.cpp b/src/xrpld/rpc/handlers/orderbook/BookChanges.cpp
index 947a257916..abad196246 100644
--- a/src/xrpld/rpc/handlers/orderbook/BookChanges.cpp
+++ b/src/xrpld/rpc/handlers/orderbook/BookChanges.cpp
@@ -4,6 +4,7 @@
 #include <xrpld/rpc/detail/RPCLedgerHelpers.h>
 
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STArray.h>  // IWYU pragma: keep
 
 #include <memory>
 
diff --git a/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp b/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
index 6a75277b1b..c1c8712655 100644
--- a/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
+++ b/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
@@ -17,6 +17,7 @@
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/STCurrency.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/jss.h>
diff --git a/src/xrpld/rpc/handlers/orderbook/NFTOffersHelpers.h b/src/xrpld/rpc/handlers/orderbook/NFTOffersHelpers.h
index 42b99a0009..70bc258d77 100644
--- a/src/xrpld/rpc/handlers/orderbook/NFTOffersHelpers.h
+++ b/src/xrpld/rpc/handlers/orderbook/NFTOffersHelpers.h
@@ -5,15 +5,25 @@
 #include <xrpld/rpc/detail/RPCLedgerHelpers.h>
 #include <xrpld/rpc/detail/Tuning.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/ErrorCodes.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/RPCErr.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/jss.h>
 #include <xrpl/resource/Fees.h>
 
+#include <cstdint>
+#include <memory>
+#include <vector>
+
 namespace xrpl {
 
 inline void
diff --git a/src/xrpld/rpc/handlers/server_info/Version.h b/src/xrpld/rpc/handlers/server_info/Version.h
index 1868df5d40..f25d8679ba 100644
--- a/src/xrpld/rpc/handlers/server_info/Version.h
+++ b/src/xrpld/rpc/handlers/server_info/Version.h
@@ -1,5 +1,12 @@
 #pragma once
 
+#include <xrpld/app/main/Application.h>  // IWYU pragma: keep
+#include <xrpld/rpc/Context.h>
+#include <xrpld/rpc/Role.h>
+#include <xrpld/rpc/Status.h>
+#include <xrpld/rpc/detail/Handler.h>
+
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/ApiVersion.h>
 
 namespace xrpl::RPC {
diff --git a/src/xrpld/rpc/json_body.h b/src/xrpld/rpc/json_body.h
index 5c4c56cef8..49c2b0e6e0 100644
--- a/src/xrpld/rpc/json_body.h
+++ b/src/xrpld/rpc/json_body.h
@@ -6,6 +6,11 @@
 #include <boost/beast/core/multi_buffer.hpp>
 #include <boost/beast/http/message.hpp>
 
+#include <cstddef>
+#include <string>
+#include <type_traits>
+#include <utility>
+
 namespace xrpl {
 
 /// Body that holds JSON
diff --git a/src/xrpld/shamap/NodeFamily.cpp b/src/xrpld/shamap/NodeFamily.cpp
index a1668e80b2..2e48117d6a 100644
--- a/src/xrpld/shamap/NodeFamily.cpp
+++ b/src/xrpld/shamap/NodeFamily.cpp
@@ -1,6 +1,7 @@
 #include <xrpld/shamap/NodeFamily.h>
 
 #include <xrpld/app/ledger/InboundLedger.h>
+#include <xrpld/app/ledger/InboundLedgers.h>
 #include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/main/Application.h>
 #include <xrpld/app/main/CollectorManager.h>
diff --git a/src/xrpld/shamap/NodeFamily.h b/src/xrpld/shamap/NodeFamily.h
index e0655292a0..d532f13ecc 100644
--- a/src/xrpld/shamap/NodeFamily.h
+++ b/src/xrpld/shamap/NodeFamily.h
@@ -2,8 +2,17 @@
 
 #include <xrpld/app/main/CollectorManager.h>
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/nodestore/Database.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/shamap/Family.h>
+#include <xrpl/shamap/FullBelowCache.h>
+#include <xrpl/shamap/TreeNodeCache.h>
+
+#include <cstdint>
+#include <memory>
+#include <mutex>
 
 namespace xrpl {
 

From 4c619e8a85cc1ca162a9d12522548d51c29c8170 Mon Sep 17 00:00:00 2001
From: Timothy Banks <tbanks@ripple.com>
Date: Thu, 2 Jul 2026 10:17:32 -0400
Subject: [PATCH 037/100] refactor: Retire DisallowIncomingV1 fix (#7364)

---
 include/xrpl/protocol/detail/features.macro   |  2 +-
 src/libxrpl/tx/transactors/token/TrustSet.cpp | 18 +----
 src/test/app/TrustSet_test.cpp                | 69 +++++++++----------
 3 files changed, 37 insertions(+), 52 deletions(-)

diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index 7e64a49b0c..a7a62f0322 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -60,7 +60,6 @@ XRPL_FEATURE(PriceOracle,                Supported::Yes, VoteBehavior::DefaultNo
 XRPL_FIX    (AMMOverflowOffer,           Supported::Yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (FillOrKill,                 Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(DID,                        Supported::Yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (DisallowIncomingV1,         Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(XChainBridge,               Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(AMM,                        Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(XRPFees,                    Supported::Yes, VoteBehavior::DefaultNo)
@@ -100,6 +99,7 @@ XRPL_RETIRE_FIX(1623)
 XRPL_RETIRE_FIX(1781)
 XRPL_RETIRE_FIX(AmendmentMajorityCalc)
 XRPL_RETIRE_FIX(CheckThreading)
+XRPL_RETIRE_FIX(DisallowIncomingV1)
 XRPL_RETIRE_FIX(InnerObjTemplate)
 XRPL_RETIRE_FIX(MasterKeyAsRegularKey)
 XRPL_RETIRE_FIX(NonFungibleTokensV1_2)
diff --git a/src/libxrpl/tx/transactors/token/TrustSet.cpp b/src/libxrpl/tx/transactors/token/TrustSet.cpp
index 151e82bab9..e79e3cad5a 100644
--- a/src/libxrpl/tx/transactors/token/TrustSet.cpp
+++ b/src/libxrpl/tx/transactors/token/TrustSet.cpp
@@ -184,22 +184,10 @@ TrustSet::preclaim(PreclaimContext const& ctx)
 
     // If the destination has opted to disallow incoming trustlines
     // then honour that flag
-    if (sleDst->isFlag(lsfDisallowIncomingTrustline))
+    if (sleDst && sleDst->isFlag(lsfDisallowIncomingTrustline) &&
+        !ctx.view.exists(keylet::trustLine(id, uDstAccountID, currency)))
     {
-        // The original implementation of featureDisallowIncoming was
-        // too restrictive. If
-        //   o fixDisallowIncomingV1 is enabled and
-        //   o The trust line already exists
-        // Then allow the TrustSet.
-        if (ctx.view.rules().enabled(fixDisallowIncomingV1) &&
-            ctx.view.exists(keylet::trustLine(id, uDstAccountID, currency)))
-        {
-            // pass
-        }
-        else
-        {
-            return tecNO_PERMISSION;
-        }
+        return tecNO_PERMISSION;
     }
 
     // In general, trust lines to pseudo accounts are not permitted, unless
diff --git a/src/test/app/TrustSet_test.cpp b/src/test/app/TrustSet_test.cpp
index e9f0553840..15abc3bd06 100644
--- a/src/test/app/TrustSet_test.cpp
+++ b/src/test/app/TrustSet_test.cpp
@@ -474,6 +474,38 @@ public:
         checkQuality(!createQuality);
     }
 
+    void
+    testDisallowIncomingWithRequireAuth()
+    {
+        testcase("Create trustline with disallow incoming requiring auth");
+
+        using namespace test::jtx;
+
+        Env env{*this};
+        auto const dist = Account("dist");
+        auto const gw = Account("gw");
+        auto const usd = gw["USD"];
+        auto const distUSD = dist["USD"];
+
+        env.fund(XRP(1000), gw, dist);
+        env.close();
+
+        env(fset(gw, asfRequireAuth));
+        env.close();
+
+        env(fset(dist, asfDisallowIncomingTrustline));
+        env.close();
+
+        env(trust(dist, usd(10000)));
+        env.close();
+
+        env(trust(gw, distUSD(10000)), Txflags(tfSetfAuth), Ter(tesSUCCESS));
+        env.close();
+
+        env(pay(gw, dist, usd(1000)), Ter(tesSUCCESS));
+        env.close();
+    }
+
     void
     testDisallowIncoming(FeatureBitset features)
     {
@@ -481,42 +513,6 @@ public:
 
         using namespace test::jtx;
 
-        // fixDisallowIncomingV1
-        {
-            for (bool const withFix : {true, false})
-            {
-                auto const amend = withFix ? features : features - fixDisallowIncomingV1;
-
-                Env env{*this, amend};
-                auto const dist = Account("dist");
-                auto const gw = Account("gw");
-                auto const usd = gw["USD"];
-                auto const distUSD = dist["USD"];
-
-                env.fund(XRP(1000), gw, dist);
-                env.close();
-
-                env(fset(gw, asfRequireAuth));
-                env.close();
-
-                env(fset(dist, asfDisallowIncomingTrustline));
-                env.close();
-
-                env(trust(dist, usd(10000)));
-                env.close();
-
-                // withFix: can set trustline
-                // withOutFix: cannot set trustline
-                auto const trustResult = withFix ? Ter(tesSUCCESS) : Ter(tecNO_PERMISSION);
-                env(trust(gw, distUSD(10000)), Txflags(tfSetfAuth), trustResult);
-                env.close();
-
-                auto const txResult = withFix ? Ter(tesSUCCESS) : Ter(tecPATH_DRY);
-                env(pay(gw, dist, usd(1000)), txResult);
-                env.close();
-            }
-        }
-
         Env env{*this, features};
 
         auto const gw = Account{"gateway"};
@@ -601,6 +597,7 @@ public:
         testModifyQualityOfTrustline(features, false, true);
         testModifyQualityOfTrustline(features, true, false);
         testModifyQualityOfTrustline(features, true, true);
+        testDisallowIncomingWithRequireAuth();
         testDisallowIncoming(features);
         testTrustLineResetWithAuthFlag();
         testTrustLineDelete();

From 3b9e24e0e0bf3a5941808446ac1fca28bd8e8e69 Mon Sep 17 00:00:00 2001
From: Bart <bthomee@users.noreply.github.com>
Date: Thu, 2 Jul 2026 11:01:30 -0400
Subject: [PATCH 038/100] chore: Improve pre-commit hooks (#7702)

Co-authored-by: Bart <11445373+bthomee@users.noreply.github.com>
---
 cspell.config.yaml => .cspell.config.yaml | 4 +---
 .pre-commit-config.yaml                   | 9 ++++-----
 2 files changed, 5 insertions(+), 8 deletions(-)
 rename cspell.config.yaml => .cspell.config.yaml (96%)

diff --git a/cspell.config.yaml b/.cspell.config.yaml
similarity index 96%
rename from cspell.config.yaml
rename to .cspell.config.yaml
index c120c31855..c558fc0984 100644
--- a/cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -36,9 +36,7 @@ overrides:
       - /'[^']*'/g # single-quoted strings
       - /`[^`]*`/g # backtick strings
 suggestWords:
-  - xprl->xrpl
-  - xprld->xrpld # cspell: disable-line not sure what this problem is....
-  - unsynched->unsynced # cspell: disable-line not sure what this problem is....
+  - unsynched->unsynced
   - synched->synced
   - synch->sync
 words:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2e4521870d..910bda8d4c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -90,20 +90,19 @@ repos:
   - repo: https://github.com/streetsidesoftware/cspell-cli
     rev: ea11f9efc0bec520073405bc30552da887ba71bc # frozen: v10.0.1
     hooks:
-      - id: cspell # Spell check changed files
+      - id: cspell
+        name: check changed files spelling
         exclude: |
           (?x)^(
-              .config/cspell.config.yaml|
+              \.cspell\.config\.yaml|
               include/xrpl/protocol_autogen/(transactions|ledger_entries)/.*
           )$
-      - id: cspell # Spell check the commit message
+      - id: cspell
         name: check commit message spelling
         args:
           - --no-must-find-files
           - --no-progress
           - --no-summary
-          - --files
-          - .git/COMMIT_EDITMSG
         stages: [commit-msg]
 
   - repo: local

From 6f0f5b8bb36c30c2578a62d1b2a5befa736da4c4 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:26:09 +0100
Subject: [PATCH 039/100] chore: Make clang-tidy happy on macOS (#7701)

---
 BUILD.md                                           | 2 +-
 bin/pre-commit/clang_tidy_check.py                 | 8 +++++---
 include/xrpl/beast/unit_test/suite_list.h          | 6 +++---
 include/xrpl/ledger/ApplyView.h                    | 2 +-
 include/xrpl/ledger/ReadView.h                     | 2 +-
 include/xrpl/ledger/helpers/LendingHelpers.h       | 2 +-
 include/xrpl/protocol/AmountConversions.h          | 2 +-
 include/xrpl/tx/paths/detail/EitherAmount.h        | 2 +-
 src/libxrpl/ledger/helpers/NFTokenHelpers.cpp      | 2 +-
 src/libxrpl/ledger/helpers/OfferHelpers.cpp        | 2 +-
 src/libxrpl/ledger/helpers/VaultHelpers.cpp        | 2 +-
 src/libxrpl/protocol/Quality.cpp                   | 4 ++--
 src/libxrpl/protocol/STInteger.cpp                 | 2 +-
 src/libxrpl/protocol/STTx.cpp                      | 1 +
 src/libxrpl/protocol/STValidation.cpp              | 2 +-
 src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp | 2 +-
 src/test/app/PayChan_test.cpp                      | 2 +-
 src/test/app/Vault_test.cpp                        | 2 +-
 src/test/beast/beast_io_latency_probe_test.cpp     | 2 +-
 src/test/jtx/impl/amount.cpp                       | 2 +-
 src/test/rpc/DepositAuthorized_test.cpp            | 2 +-
 src/xrpld/app/ledger/detail/BuildLedger.cpp        | 4 ++--
 src/xrpld/app/ledger/detail/InboundLedger.cpp      | 4 ++--
 src/xrpld/app/ledger/detail/LedgerPersistence.cpp  | 4 ++--
 src/xrpld/app/ledger/detail/OpenLedger.cpp         | 2 +-
 src/xrpld/app/main/Application.cpp                 | 4 ++--
 src/xrpld/app/misc/FeeVoteImpl.cpp                 | 2 +-
 src/xrpld/overlay/detail/PeerImp.cpp               | 1 +
 28 files changed, 39 insertions(+), 35 deletions(-)

diff --git a/BUILD.md b/BUILD.md
index 6ccdde12d5..a15c94edc9 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -25,7 +25,7 @@ You can verify that the required tools are installed and runnable with:
 | ----------- | --------------- |
 | GCC         | 15.2            |
 | Clang       | 22              |
-| Apple Clang | 17              |
+| Apple Clang | 21              |
 | MSVC        | 19.44[^windows] |
 
 ## Operating Systems
diff --git a/bin/pre-commit/clang_tidy_check.py b/bin/pre-commit/clang_tidy_check.py
index d074c56acf..5b5792b405 100755
--- a/bin/pre-commit/clang_tidy_check.py
+++ b/bin/pre-commit/clang_tidy_check.py
@@ -17,9 +17,11 @@ import subprocess
 import sys
 from pathlib import Path
 
+CLANG_TIDY_VERSION = 22
+
 
 def find_run_clang_tidy() -> str | None:
-    for candidate in ("run-clang-tidy-21", "run-clang-tidy"):
+    for candidate in (f"run-clang-tidy-{CLANG_TIDY_VERSION}", "run-clang-tidy"):
         if path := shutil.which(candidate):
             return path
     return None
@@ -44,8 +46,8 @@ def main():
     run_clang_tidy = find_run_clang_tidy()
     if not run_clang_tidy:
         print(
-            "clang-tidy check failed: TIDY is enabled but neither "
-            "'run-clang-tidy-21' nor 'run-clang-tidy' was found in PATH.",
+            f"clang-tidy check failed: TIDY is enabled but neither "
+            f"'run-clang-tidy-{CLANG_TIDY_VERSION}' nor 'run-clang-tidy' was found in PATH.",
             file=sys.stderr,
         )
         return 1
diff --git a/include/xrpl/beast/unit_test/suite_list.h b/include/xrpl/beast/unit_test/suite_list.h
index cf9fb9c5b1..7dd0dd80f0 100644
--- a/include/xrpl/beast/unit_test/suite_list.h
+++ b/include/xrpl/beast/unit_test/suite_list.h
@@ -10,9 +10,9 @@
 #include <boost/assert.hpp>
 
 #include <set>
-#include <string>
-#include <typeindex>
-#include <unordered_set>
+#include <string>         // IWYU pragma: keep
+#include <typeindex>      // IWYU pragma: keep
+#include <unordered_set>  // IWYU pragma: keep
 
 namespace beast::unit_test {
 
diff --git a/include/xrpl/ledger/ApplyView.h b/include/xrpl/ledger/ApplyView.h
index 3bf5d479d1..e519013d9a 100644
--- a/include/xrpl/ledger/ApplyView.h
+++ b/include/xrpl/ledger/ApplyView.h
@@ -5,7 +5,7 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/Issue.h>  // IWYU pragma: keep
 #include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/MPTIssue.h>
diff --git a/include/xrpl/ledger/ReadView.h b/include/xrpl/ledger/ReadView.h
index 8bbd3e06cb..724533039b 100644
--- a/include/xrpl/ledger/ReadView.h
+++ b/include/xrpl/ledger/ReadView.h
@@ -7,7 +7,7 @@
 #include <xrpl/ledger/detail/ReadViewFwdRange.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Fees.h>
-#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/Issue.h>  // IWYU pragma: keep
 #include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/LedgerHeader.h>
 #include <xrpl/protocol/MPTIssue.h>
diff --git a/include/xrpl/ledger/helpers/LendingHelpers.h b/include/xrpl/ledger/helpers/LendingHelpers.h
index c21e5bf0ce..873abae272 100644
--- a/include/xrpl/ledger/helpers/LendingHelpers.h
+++ b/include/xrpl/ledger/helpers/LendingHelpers.h
@@ -8,7 +8,7 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/Asset.h>
-#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/LedgerFormats.h>  // IWYU pragma: keep
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
diff --git a/include/xrpl/protocol/AmountConversions.h b/include/xrpl/protocol/AmountConversions.h
index 66ada68d6f..3bcd80e827 100644
--- a/include/xrpl/protocol/AmountConversions.h
+++ b/include/xrpl/protocol/AmountConversions.h
@@ -13,7 +13,7 @@
 #include <xrpl/protocol/XRPAmount.h>
 
 #include <cstdint>
-#include <limits>
+#include <limits>  // IWYU pragma: keep
 #include <stdexcept>
 #include <type_traits>
 
diff --git a/include/xrpl/tx/paths/detail/EitherAmount.h b/include/xrpl/tx/paths/detail/EitherAmount.h
index 68ad90d2d4..bc9488d5db 100644
--- a/include/xrpl/tx/paths/detail/EitherAmount.h
+++ b/include/xrpl/tx/paths/detail/EitherAmount.h
@@ -6,7 +6,7 @@
 #include <xrpl/protocol/MPTAmount.h>  // IWYU pragma: keep
 #include <xrpl/protocol/XRPAmount.h>
 
-#include <ostream>
+#include <ostream>  // IWYU pragma: keep
 #include <stdexcept>
 #include <variant>
 
diff --git a/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp b/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
index af429358bb..6dca715a8c 100644
--- a/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
@@ -24,7 +24,7 @@
 #include <xrpl/protocol/SeqProxy.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
-#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/UintTypes.h>  // IWYU pragma: keep
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol/nft.h>
 #include <xrpl/protocol/nftPageMask.h>
diff --git a/src/libxrpl/ledger/helpers/OfferHelpers.cpp b/src/libxrpl/ledger/helpers/OfferHelpers.cpp
index 5249870143..6e72b71564 100644
--- a/src/libxrpl/ledger/helpers/OfferHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/OfferHelpers.cpp
@@ -6,7 +6,7 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/LedgerFormats.h>  // IWYU pragma: keep
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STArray.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STLedgerEntry.h>
diff --git a/src/libxrpl/ledger/helpers/VaultHelpers.cpp b/src/libxrpl/ledger/helpers/VaultHelpers.cpp
index 3a3a756499..b5b076d1cb 100644
--- a/src/libxrpl/ledger/helpers/VaultHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/VaultHelpers.cpp
@@ -5,7 +5,7 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/LedgerFormats.h>  // IWYU pragma: keep
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
diff --git a/src/libxrpl/protocol/Quality.cpp b/src/libxrpl/protocol/Quality.cpp
index 7ad426bef7..dde7921a76 100644
--- a/src/libxrpl/protocol/Quality.cpp
+++ b/src/libxrpl/protocol/Quality.cpp
@@ -1,12 +1,12 @@
 #include <xrpl/protocol/Quality.h>
 
-#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/Zero.h>  // IWYU pragma: keep
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/STAmount.h>
 
 #include <cstdint>
-#include <limits>
+#include <limits>  // IWYU pragma: keep
 
 namespace xrpl {
 
diff --git a/src/libxrpl/protocol/STInteger.cpp b/src/libxrpl/protocol/STInteger.cpp
index 5f3fb6ffa4..b65504dd5f 100644
--- a/src/libxrpl/protocol/STInteger.cpp
+++ b/src/libxrpl/protocol/STInteger.cpp
@@ -16,7 +16,7 @@
 #include <cstdint>
 #include <iterator>
 #include <string>
-#include <system_error>
+#include <system_error>  // IWYU pragma: keep
 
 namespace xrpl {
 
diff --git a/src/libxrpl/protocol/STTx.cpp b/src/libxrpl/protocol/STTx.cpp
index cd2da12316..b3de717da8 100644
--- a/src/libxrpl/protocol/STTx.cpp
+++ b/src/libxrpl/protocol/STTx.cpp
@@ -596,6 +596,7 @@ STTx::getBatchTransactionIDs() const
     XRPL_ASSERT(
         batchTxnIds_->size() == getFieldArray(sfRawTransactions).size(),
         "STTx::getBatchTransactionIDs : batch transaction IDs size mismatch");
+    // NOLINTNEXTLINE(bugprone-unchecked-optional-access): guarded by assert above
     return *batchTxnIds_;
 }
 
diff --git a/src/libxrpl/protocol/STValidation.cpp b/src/libxrpl/protocol/STValidation.cpp
index 5eafb407ec..1656aad3a2 100644
--- a/src/libxrpl/protocol/STValidation.cpp
+++ b/src/libxrpl/protocol/STValidation.cpp
@@ -6,7 +6,7 @@
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/HashPrefix.h>
-#include <xrpl/protocol/KeyType.h>
+#include <xrpl/protocol/KeyType.h>  // IWYU pragma: keep
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/SOTemplate.h>
diff --git a/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp b/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
index 3d30005876..ad91c55723 100644
--- a/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
@@ -11,7 +11,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/LedgerFormats.h>  // IWYU pragma: keep
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
diff --git a/src/test/app/PayChan_test.cpp b/src/test/app/PayChan_test.cpp
index fd2c7790d5..f1a9506e0c 100644
--- a/src/test/app/PayChan_test.cpp
+++ b/src/test/app/PayChan_test.cpp
@@ -19,7 +19,7 @@
 #include <xrpl/basics/chrono.h>
 #include <xrpl/basics/strHex.h>
 #include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/Zero.h>  // IWYU pragma: keep
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/to_string.h>
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index f6574872f9..3877e08f7e 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -7542,7 +7542,7 @@ class Vault_test : public beast::unit_test::Suite
         // Transaction fails if the data field is set, but is empty
         {
             testcase("VaultDelete memo data featureLendingProtocolV1_1 enabled data empty");
-            delTx[sfMemoData] = strHex(std::string(0, 'A'));
+            delTx[sfMemoData] = strHex(std::string());
             env(delTx, Ter(temMALFORMED));
             env.close();
         }
diff --git a/src/test/beast/beast_io_latency_probe_test.cpp b/src/test/beast/beast_io_latency_probe_test.cpp
index 9a93968dab..807ad81c49 100644
--- a/src/test/beast/beast_io_latency_probe_test.cpp
+++ b/src/test/beast/beast_io_latency_probe_test.cpp
@@ -8,7 +8,7 @@
 #include <boost/asio/spawn.hpp>
 #include <boost/system/detail/error_code.hpp>
 
-#include <algorithm>
+#include <algorithm>  // IWYU pragma: keep
 #include <chrono>
 #include <condition_variable>  // IWYU pragma: keep
 #include <cstddef>
diff --git a/src/test/jtx/impl/amount.cpp b/src/test/jtx/impl/amount.cpp
index b07703dace..f90102245a 100644
--- a/src/test/jtx/impl/amount.cpp
+++ b/src/test/jtx/impl/amount.cpp
@@ -12,7 +12,7 @@
 #include <cstdint>
 #include <iomanip>
 #include <ios>
-#include <limits>
+#include <limits>  // IWYU pragma: keep
 #include <ostream>
 #include <sstream>
 #include <string>
diff --git a/src/test/rpc/DepositAuthorized_test.cpp b/src/test/rpc/DepositAuthorized_test.cpp
index e6720602c9..6d6b54d70a 100644
--- a/src/test/rpc/DepositAuthorized_test.cpp
+++ b/src/test/rpc/DepositAuthorized_test.cpp
@@ -8,7 +8,7 @@
 
 #include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/Protocol.h>  // IWYU pragma: keep
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/jss.h>
diff --git a/src/xrpld/app/ledger/detail/BuildLedger.cpp b/src/xrpld/app/ledger/detail/BuildLedger.cpp
index 038a7be4b7..d11e0610ba 100644
--- a/src/xrpld/app/ledger/detail/BuildLedger.cpp
+++ b/src/xrpld/app/ledger/detail/BuildLedger.cpp
@@ -13,10 +13,10 @@
 #include <xrpl/ledger/Ledger.h>
 #include <xrpl/ledger/OpenView.h>
 #include <xrpl/nodestore/NodeObject.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Indexes.h>  // IWYU pragma: keep
 #include <xrpl/protocol/LedgerHeader.h>
 #include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/SystemParameters.h>
+#include <xrpl/protocol/SystemParameters.h>  // IWYU pragma: keep
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/tx/apply.h>
 
diff --git a/src/xrpld/app/ledger/detail/InboundLedger.cpp b/src/xrpld/app/ledger/detail/InboundLedger.cpp
index 4affffd1c1..4d34f60374 100644
--- a/src/xrpld/app/ledger/detail/InboundLedger.cpp
+++ b/src/xrpld/app/ledger/detail/InboundLedger.cpp
@@ -21,11 +21,11 @@
 #include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/protocol/HashPrefix.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Indexes.h>  // IWYU pragma: keep
 #include <xrpl/protocol/LedgerHeader.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/Serializer.h>
-#include <xrpl/protocol/SystemParameters.h>
+#include <xrpl/protocol/SystemParameters.h>  // IWYU pragma: keep
 #include <xrpl/protocol/jss.h>
 #include <xrpl/resource/Fees.h>
 #include <xrpl/shamap/SHAMapNodeID.h>
diff --git a/src/xrpld/app/ledger/detail/LedgerPersistence.cpp b/src/xrpld/app/ledger/detail/LedgerPersistence.cpp
index 3561b66951..6baf64e923 100644
--- a/src/xrpld/app/ledger/detail/LedgerPersistence.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerPersistence.cpp
@@ -8,9 +8,9 @@
 #include <xrpl/core/JobQueue.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/PendingSaves.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Indexes.h>  // IWYU pragma: keep
 #include <xrpl/protocol/Rules.h>
-#include <xrpl/protocol/SystemParameters.h>
+#include <xrpl/protocol/SystemParameters.h>  // IWYU pragma: keep
 #include <xrpl/rdb/RelationalDatabase.h>
 
 #include <cstdint>
diff --git a/src/xrpld/app/ledger/detail/OpenLedger.cpp b/src/xrpld/app/ledger/detail/OpenLedger.cpp
index 60599c80d3..4d8a37cdf1 100644
--- a/src/xrpld/app/ledger/detail/OpenLedger.cpp
+++ b/src/xrpld/app/ledger/detail/OpenLedger.cpp
@@ -14,7 +14,7 @@
 #include <xrpl/ledger/OpenView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/Rules.h>
-#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/SField.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/Serializer.h>
diff --git a/src/xrpld/app/main/Application.cpp b/src/xrpld/app/main/Application.cpp
index b99c98afa1..594195b93e 100644
--- a/src/xrpld/app/main/Application.cpp
+++ b/src/xrpld/app/main/Application.cpp
@@ -79,11 +79,11 @@
 #include <xrpl/protocol/ApiVersion.h>
 #include <xrpl/protocol/BuildInfo.h>
 #include <xrpl/protocol/Feature.h>
-#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Indexes.h>  // IWYU pragma: keep
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STParsedJSON.h>
 #include <xrpl/protocol/Serializer.h>
-#include <xrpl/protocol/SystemParameters.h>
+#include <xrpl/protocol/SystemParameters.h>  // IWYU pragma: keep
 #include <xrpl/protocol/jss.h>
 #include <xrpl/rdb/DatabaseCon.h>
 #include <xrpl/resource/Charge.h>
diff --git a/src/xrpld/app/misc/FeeVoteImpl.cpp b/src/xrpld/app/misc/FeeVoteImpl.cpp
index 363c17f4fa..76a4d8f186 100644
--- a/src/xrpld/app/misc/FeeVoteImpl.cpp
+++ b/src/xrpld/app/misc/FeeVoteImpl.cpp
@@ -8,7 +8,7 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Fees.h>
-#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/Protocol.h>  // IWYU pragma: keep
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAccount.h>  // IWYU pragma: keep
 #include <xrpl/protocol/STTx.h>
diff --git a/src/xrpld/overlay/detail/PeerImp.cpp b/src/xrpld/overlay/detail/PeerImp.cpp
index 5ac61cfd91..83e4d9c851 100644
--- a/src/xrpld/overlay/detail/PeerImp.cpp
+++ b/src/xrpld/overlay/detail/PeerImp.cpp
@@ -2134,6 +2134,7 @@ PeerImp::onValidatorListMessage(
             publisherListSequences_[pubKey] = applyResult.sequence;
         }
         break;
+        // NOLINTNEXTLINE(bugprone-branch-clone): identical to the next branch only in Release
         case ListDisposition::SameSequence:
         case ListDisposition::KnownSequence:
 #ifndef NDEBUG

From 41622b87aeeb6d5e9f03f12d0a6847e0a04e6174 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Thu, 2 Jul 2026 19:30:59 +0100
Subject: [PATCH 040/100] chore: Enable modernize-unary-static-assert (#7705)

---
 .clang-tidy                                   |   1 -
 include/xrpl/basics/base_uint.h               |   2 +-
 include/xrpl/beast/utility/Journal.h          |  48 ++--
 include/xrpl/ledger/CachedView.h              |   2 +-
 include/xrpl/ledger/detail/ReadViewFwdRange.h |   4 +-
 include/xrpl/protocol/STObject.h              |   2 +-
 include/xrpl/protocol/Serializer.h            |   2 +-
 src/libxrpl/protocol/Serializer.cpp           |   2 +-
 src/libxrpl/protocol/digest.cpp               |   6 +-
 src/test/app/PayStrand_test.cpp               |   2 +-
 src/test/basics/Buffer_test.cpp               |   4 +-
 src/test/jtx/Env_test.cpp                     |   8 +-
 src/test/protocol/Quality_test.cpp            |   4 +-
 src/test/protocol/STObject_test.cpp           |   6 +-
 src/test/protocol/SeqProxy_test.cpp           | 220 +++++++++---------
 src/test/shamap/SHAMap_test.cpp               |  88 +++----
 src/xrpld/app/misc/detail/TxQ.cpp             |   8 +-
 17 files changed, 203 insertions(+), 206 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index 84849db7a0..2b0b7e4418 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -80,7 +80,6 @@ Checks: "-*,
   -modernize-replace-random-shuffle,
   -modernize-return-braced-init-list,
   -modernize-shrink-to-fit,
-  -modernize-unary-static-assert,
   -modernize-use-auto,
   -modernize-use-bool-literals,
   -modernize-use-constraints,
diff --git a/include/xrpl/basics/base_uint.h b/include/xrpl/basics/base_uint.h
index e6ca1993f9..c60fbf35b4 100644
--- a/include/xrpl/basics/base_uint.h
+++ b/include/xrpl/basics/base_uint.h
@@ -97,7 +97,7 @@ public:
     //
 
     static constexpr std::size_t kBytes = Bits / 8;
-    static_assert(sizeof(data_) == kBytes, "");
+    static_assert(sizeof(data_) == kBytes);
 
     using size_type = std::size_t;
     using difference_type = std::ptrdiff_t;
diff --git a/include/xrpl/beast/utility/Journal.h b/include/xrpl/beast/utility/Journal.h
index ac08b1384b..3de3cfb0e0 100644
--- a/include/xrpl/beast/utility/Journal.h
+++ b/include/xrpl/beast/utility/Journal.h
@@ -108,12 +108,12 @@ public:
     };
 
 #ifndef __INTELLISENSE__
-    static_assert(!std::is_default_constructible_v<Sink>, "");
-    static_assert(!std::is_copy_constructible_v<Sink>, "");
-    static_assert(!std::is_move_constructible_v<Sink>, "");
-    static_assert(!std::is_copy_assignable_v<Sink>, "");
-    static_assert(!std::is_move_assignable_v<Sink>, "");
-    static_assert(std::is_nothrow_destructible_v<Sink>, "");
+    static_assert(!std::is_default_constructible_v<Sink>);
+    static_assert(!std::is_copy_constructible_v<Sink>);
+    static_assert(!std::is_move_constructible_v<Sink>);
+    static_assert(!std::is_copy_assignable_v<Sink>);
+    static_assert(!std::is_move_assignable_v<Sink>);
+    static_assert(std::is_nothrow_destructible_v<Sink>);
 #endif
 
     /** Returns a Sink which does nothing. */
@@ -164,12 +164,12 @@ public:
     };
 
 #ifndef __INTELLISENSE__
-    static_assert(!std::is_default_constructible_v<ScopedStream>, "");
-    static_assert(std::is_copy_constructible_v<ScopedStream>, "");
-    static_assert(std::is_move_constructible_v<ScopedStream>, "");
-    static_assert(!std::is_copy_assignable_v<ScopedStream>, "");
-    static_assert(!std::is_move_assignable_v<ScopedStream>, "");
-    static_assert(std::is_nothrow_destructible_v<ScopedStream>, "");
+    static_assert(!std::is_default_constructible_v<ScopedStream>);
+    static_assert(std::is_copy_constructible_v<ScopedStream>);
+    static_assert(std::is_move_constructible_v<ScopedStream>);
+    static_assert(!std::is_copy_assignable_v<ScopedStream>);
+    static_assert(!std::is_move_assignable_v<ScopedStream>);
+    static_assert(std::is_nothrow_destructible_v<ScopedStream>);
 #endif
 
     //--------------------------------------------------------------------------
@@ -246,12 +246,12 @@ public:
     };
 
 #ifndef __INTELLISENSE__
-    static_assert(std::is_default_constructible_v<Stream>, "");
-    static_assert(std::is_copy_constructible_v<Stream>, "");
-    static_assert(std::is_move_constructible_v<Stream>, "");
-    static_assert(!std::is_copy_assignable_v<Stream>, "");
-    static_assert(!std::is_move_assignable_v<Stream>, "");
-    static_assert(std::is_nothrow_destructible_v<Stream>, "");
+    static_assert(std::is_default_constructible_v<Stream>);
+    static_assert(std::is_copy_constructible_v<Stream>);
+    static_assert(std::is_move_constructible_v<Stream>);
+    static_assert(!std::is_copy_assignable_v<Stream>);
+    static_assert(!std::is_move_assignable_v<Stream>);
+    static_assert(std::is_nothrow_destructible_v<Stream>);
 #endif
 
     //--------------------------------------------------------------------------
@@ -329,12 +329,12 @@ public:
 };
 
 #ifndef __INTELLISENSE__
-static_assert(!std::is_default_constructible_v<Journal>, "");
-static_assert(std::is_copy_constructible_v<Journal>, "");
-static_assert(std::is_move_constructible_v<Journal>, "");
-static_assert(std::is_copy_assignable_v<Journal>, "");
-static_assert(std::is_move_assignable_v<Journal>, "");
-static_assert(std::is_nothrow_destructible_v<Journal>, "");
+static_assert(!std::is_default_constructible_v<Journal>);
+static_assert(std::is_copy_constructible_v<Journal>);
+static_assert(std::is_move_constructible_v<Journal>);
+static_assert(std::is_copy_assignable_v<Journal>);
+static_assert(std::is_move_assignable_v<Journal>);
+static_assert(std::is_nothrow_destructible_v<Journal>);
 #endif
 
 //------------------------------------------------------------------------------
diff --git a/include/xrpl/ledger/CachedView.h b/include/xrpl/ledger/CachedView.h
index f83c3e1297..1da3a67563 100644
--- a/include/xrpl/ledger/CachedView.h
+++ b/include/xrpl/ledger/CachedView.h
@@ -141,7 +141,7 @@ template <class Base>
 class CachedView : public detail::CachedViewImpl
 {
 private:
-    static_assert(std::is_base_of_v<DigestAwareReadView, Base>, "");
+    static_assert(std::is_base_of_v<DigestAwareReadView, Base>);
 
     std::shared_ptr<Base const> sp_;
 
diff --git a/include/xrpl/ledger/detail/ReadViewFwdRange.h b/include/xrpl/ledger/detail/ReadViewFwdRange.h
index 82d8b59c6a..19ac0698c2 100644
--- a/include/xrpl/ledger/detail/ReadViewFwdRange.h
+++ b/include/xrpl/ledger/detail/ReadViewFwdRange.h
@@ -108,8 +108,8 @@ public:
         std::optional<value_type> mutable cache_;
     };
 
-    static_assert(std::is_nothrow_move_constructible<Iterator>{}, "");
-    static_assert(std::is_nothrow_move_assignable<Iterator>{}, "");
+    static_assert(std::is_nothrow_move_constructible<Iterator>{});
+    static_assert(std::is_nothrow_move_assignable<Iterator>{});
 
     using const_iterator = Iterator;
 
diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index c254a37aaf..a60e8f7fe8 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -1241,7 +1241,7 @@ template <typename T, typename V>
 void
 STObject::setFieldUsingSetValue(SField const& field, V value)
 {
-    static_assert(!std::is_lvalue_reference_v<V>, "");
+    static_assert(!std::is_lvalue_reference_v<V>);
 
     STBase* rf = getPField(field, true);
 
diff --git a/include/xrpl/protocol/Serializer.h b/include/xrpl/protocol/Serializer.h
index 1d0453d6aa..73bd9c8289 100644
--- a/include/xrpl/protocol/Serializer.h
+++ b/include/xrpl/protocol/Serializer.h
@@ -334,7 +334,7 @@ public:
     template <int N>
     explicit SerialIter(std::uint8_t const (&data)[N]) : SerialIter(&data[0], N)
     {
-        static_assert(N > 0, "");
+        static_assert(N > 0);
     }
 
     [[nodiscard]] bool
diff --git a/src/libxrpl/protocol/Serializer.cpp b/src/libxrpl/protocol/Serializer.cpp
index d500919df9..1eda04705f 100644
--- a/src/libxrpl/protocol/Serializer.cpp
+++ b/src/libxrpl/protocol/Serializer.cpp
@@ -444,7 +444,7 @@ template <class T>
 T
 SerialIter::getRawHelper(int size)
 {
-    static_assert(std::is_same_v<T, Blob> || std::is_same_v<T, Buffer>, "");
+    static_assert(std::is_same_v<T, Blob> || std::is_same_v<T, Buffer>);
     if (remain_ < size)
         Throw<std::runtime_error>("invalid SerialIter getRaw");
     T result(size);
diff --git a/src/libxrpl/protocol/digest.cpp b/src/libxrpl/protocol/digest.cpp
index 2e1b2b25cf..1d84f8779e 100644
--- a/src/libxrpl/protocol/digest.cpp
+++ b/src/libxrpl/protocol/digest.cpp
@@ -9,7 +9,7 @@ namespace xrpl {
 
 OpensslRipemd160Hasher::OpensslRipemd160Hasher()
 {
-    static_assert(sizeof(decltype(OpensslRipemd160Hasher::ctx_)) == sizeof(RIPEMD160_CTX), "");
+    static_assert(sizeof(decltype(OpensslRipemd160Hasher::ctx_)) == sizeof(RIPEMD160_CTX));
     auto const ctx = reinterpret_cast<RIPEMD160_CTX*>(ctx_);
     RIPEMD160_Init(ctx);
 }
@@ -34,7 +34,7 @@ operator result_type() noexcept
 
 OpensslSha512Hasher::OpensslSha512Hasher()
 {
-    static_assert(sizeof(decltype(OpensslSha512Hasher::ctx_)) == sizeof(SHA512_CTX), "");
+    static_assert(sizeof(decltype(OpensslSha512Hasher::ctx_)) == sizeof(SHA512_CTX));
     auto const ctx = reinterpret_cast<SHA512_CTX*>(ctx_);
     SHA512_Init(ctx);
 }
@@ -59,7 +59,7 @@ operator result_type() noexcept
 
 OpensslSha256Hasher::OpensslSha256Hasher()
 {
-    static_assert(sizeof(decltype(OpensslSha256Hasher::ctx_)) == sizeof(SHA256_CTX), "");
+    static_assert(sizeof(decltype(OpensslSha256Hasher::ctx_)) == sizeof(SHA256_CTX));
     auto const ctx = reinterpret_cast<SHA256_CTX*>(ctx_);
     SHA256_Init(ctx);
 }
diff --git a/src/test/app/PayStrand_test.cpp b/src/test/app/PayStrand_test.cpp
index 11a0e5bab0..ddbcfe8b70 100644
--- a/src/test/app/PayStrand_test.cpp
+++ b/src/test/app/PayStrand_test.cpp
@@ -112,7 +112,7 @@ class ElementComboIter
         };
 
     std::uint16_t state_ = 0;
-    static_assert(safeCast<size_t>(SB::Last) <= sizeof(decltype(state_)) * 8, "");
+    static_assert(safeCast<size_t>(SB::Last) <= sizeof(decltype(state_)) * 8);
     STPathElement const* prev_ = nullptr;
     // disallow iss and cur to be specified with acc is specified (simplifies
     // some tests)
diff --git a/src/test/basics/Buffer_test.cpp b/src/test/basics/Buffer_test.cpp
index 816a697ca4..c748a3f9dd 100644
--- a/src/test/basics/Buffer_test.cpp
+++ b/src/test/basics/Buffer_test.cpp
@@ -103,8 +103,8 @@ struct Buffer_test : beast::unit_test::Suite
         {
             testcase("Move Construction / Assignment");
 
-            static_assert(std::is_nothrow_move_constructible_v<Buffer>, "");
-            static_assert(std::is_nothrow_move_assignable_v<Buffer>, "");
+            static_assert(std::is_nothrow_move_constructible_v<Buffer>);
+            static_assert(std::is_nothrow_move_assignable_v<Buffer>);
 
             {  // Move-construct from empty buf
                 Buffer x;
diff --git a/src/test/jtx/Env_test.cpp b/src/test/jtx/Env_test.cpp
index d82cb86b36..47cfb604f4 100644
--- a/src/test/jtx/Env_test.cpp
+++ b/src/test/jtx/Env_test.cpp
@@ -110,10 +110,10 @@ public:
         PrettyAmount(0u);  // NOLINT(bugprone-unused-raii)
         PrettyAmount(1u);  // NOLINT(bugprone-unused-raii)
         PrettyAmount(-1);  // NOLINT(bugprone-unused-raii)
-        static_assert(!std::is_trivially_constructible_v<PrettyAmount, char>, "");
-        static_assert(!std::is_trivially_constructible_v<PrettyAmount, unsigned char>, "");
-        static_assert(!std::is_trivially_constructible_v<PrettyAmount, short>, "");
-        static_assert(!std::is_trivially_constructible_v<PrettyAmount, unsigned short>, "");
+        static_assert(!std::is_trivially_constructible_v<PrettyAmount, char>);
+        static_assert(!std::is_trivially_constructible_v<PrettyAmount, unsigned char>);
+        static_assert(!std::is_trivially_constructible_v<PrettyAmount, short>);
+        static_assert(!std::is_trivially_constructible_v<PrettyAmount, unsigned short>);
 
         try
         {
diff --git a/src/test/protocol/Quality_test.cpp b/src/test/protocol/Quality_test.cpp
index df95cea8ef..db81886e94 100644
--- a/src/test/protocol/Quality_test.cpp
+++ b/src/test/protocol/Quality_test.cpp
@@ -24,7 +24,7 @@ public:
     static STAmount
     amount(Integer integer, std::enable_if_t<std::is_signed_v<Integer>>* = 0)
     {
-        static_assert(std::is_integral_v<Integer>, "");
+        static_assert(std::is_integral_v<Integer>);
         return STAmount(integer, false);
     }
 
@@ -32,7 +32,7 @@ public:
     static STAmount
     amount(Integer integer, std::enable_if_t<!std::is_signed_v<Integer>>* = 0)
     {
-        static_assert(std::is_integral_v<Integer>, "");
+        static_assert(std::is_integral_v<Integer>);
         if (integer < 0)
             return STAmount(-integer, true);
         return STAmount(integer, false);
diff --git a/src/test/protocol/STObject_test.cpp b/src/test/protocol/STObject_test.cpp
index b823b24962..8b7db632c5 100644
--- a/src/test/protocol/STObject_test.cpp
+++ b/src/test/protocol/STObject_test.cpp
@@ -356,8 +356,7 @@ public:
         {
             STObject st(sfGeneric);
             auto const v = ~st[~sf1Outer];
-            static_assert(
-                std::is_same_v<std::decay_t<decltype(v)>, std::optional<std::uint32_t>>, "");
+            static_assert(std::is_same_v<std::decay_t<decltype(v)>, std::optional<std::uint32_t>>);
         }
 
         // UDT scalar fields
@@ -431,8 +430,7 @@ public:
             BEAST_EXPECT(cst[~sf]->size() == 2);  // NOLINT(bugprone-unchecked-optional-access)
             BEAST_EXPECT(cst[sf][0] == 1);
             BEAST_EXPECT(cst[sf][1] == 2);
-            static_assert(
-                std::is_same_v<decltype(cst[sfIndexes]), std::vector<uint256> const&>, "");
+            static_assert(std::is_same_v<decltype(cst[sfIndexes]), std::vector<uint256> const&>);
         }
 
         // Default by reference field
diff --git a/src/test/protocol/SeqProxy_test.cpp b/src/test/protocol/SeqProxy_test.cpp
index 90345ddc22..44aab41992 100644
--- a/src/test/protocol/SeqProxy_test.cpp
+++ b/src/test/protocol/SeqProxy_test.cpp
@@ -81,128 +81,128 @@ struct SeqProxy_test : public beast::unit_test::Suite
         static constexpr SeqProxy kTicBig{kTicket, kUintMax};
 
         // Verify operation of value(), isSeq() and isTicket().
-        static_assert(expectValues(kSeqZero, 0, kSeq), "");
-        static_assert(expectValues(kSeqSmall, 1, kSeq), "");
-        static_assert(expectValues(kSeqMiD0, 2, kSeq), "");
-        static_assert(expectValues(kSeqMiD1, 2, kSeq), "");
-        static_assert(expectValues(kSeqBig, kUintMax, kSeq), "");
+        static_assert(expectValues(kSeqZero, 0, kSeq));
+        static_assert(expectValues(kSeqSmall, 1, kSeq));
+        static_assert(expectValues(kSeqMiD0, 2, kSeq));
+        static_assert(expectValues(kSeqMiD1, 2, kSeq));
+        static_assert(expectValues(kSeqBig, kUintMax, kSeq));
 
-        static_assert(expectValues(kTicZero, 0, kTicket), "");
-        static_assert(expectValues(kTicSmall, 1, kTicket), "");
-        static_assert(expectValues(kTicMid0, 2, kTicket), "");
-        static_assert(expectValues(kTicMid1, 2, kTicket), "");
-        static_assert(expectValues(kTicBig, kUintMax, kTicket), "");
+        static_assert(expectValues(kTicZero, 0, kTicket));
+        static_assert(expectValues(kTicSmall, 1, kTicket));
+        static_assert(expectValues(kTicMid0, 2, kTicket));
+        static_assert(expectValues(kTicMid1, 2, kTicket));
+        static_assert(expectValues(kTicBig, kUintMax, kTicket));
 
         // Verify expected behavior of comparison operators.
-        static_assert(expectEq(kSeqZero, kSeqZero), "");
-        static_assert(expectLt(kSeqZero, kSeqSmall), "");
-        static_assert(expectLt(kSeqZero, kSeqMiD0), "");
-        static_assert(expectLt(kSeqZero, kSeqMiD1), "");
-        static_assert(expectLt(kSeqZero, kSeqBig), "");
-        static_assert(expectLt(kSeqZero, kTicZero), "");
-        static_assert(expectLt(kSeqZero, kTicSmall), "");
-        static_assert(expectLt(kSeqZero, kTicMid0), "");
-        static_assert(expectLt(kSeqZero, kTicMid1), "");
-        static_assert(expectLt(kSeqZero, kTicBig), "");
+        static_assert(expectEq(kSeqZero, kSeqZero));
+        static_assert(expectLt(kSeqZero, kSeqSmall));
+        static_assert(expectLt(kSeqZero, kSeqMiD0));
+        static_assert(expectLt(kSeqZero, kSeqMiD1));
+        static_assert(expectLt(kSeqZero, kSeqBig));
+        static_assert(expectLt(kSeqZero, kTicZero));
+        static_assert(expectLt(kSeqZero, kTicSmall));
+        static_assert(expectLt(kSeqZero, kTicMid0));
+        static_assert(expectLt(kSeqZero, kTicMid1));
+        static_assert(expectLt(kSeqZero, kTicBig));
 
-        static_assert(expectGt(kSeqSmall, kSeqZero), "");
-        static_assert(expectEq(kSeqSmall, kSeqSmall), "");
-        static_assert(expectLt(kSeqSmall, kSeqMiD0), "");
-        static_assert(expectLt(kSeqSmall, kSeqMiD1), "");
-        static_assert(expectLt(kSeqSmall, kSeqBig), "");
-        static_assert(expectLt(kSeqSmall, kTicZero), "");
-        static_assert(expectLt(kSeqSmall, kTicSmall), "");
-        static_assert(expectLt(kSeqSmall, kTicMid0), "");
-        static_assert(expectLt(kSeqSmall, kTicMid1), "");
-        static_assert(expectLt(kSeqSmall, kTicBig), "");
+        static_assert(expectGt(kSeqSmall, kSeqZero));
+        static_assert(expectEq(kSeqSmall, kSeqSmall));
+        static_assert(expectLt(kSeqSmall, kSeqMiD0));
+        static_assert(expectLt(kSeqSmall, kSeqMiD1));
+        static_assert(expectLt(kSeqSmall, kSeqBig));
+        static_assert(expectLt(kSeqSmall, kTicZero));
+        static_assert(expectLt(kSeqSmall, kTicSmall));
+        static_assert(expectLt(kSeqSmall, kTicMid0));
+        static_assert(expectLt(kSeqSmall, kTicMid1));
+        static_assert(expectLt(kSeqSmall, kTicBig));
 
-        static_assert(expectGt(kSeqMiD0, kSeqZero), "");
-        static_assert(expectGt(kSeqMiD0, kSeqSmall), "");
-        static_assert(expectEq(kSeqMiD0, kSeqMiD0), "");
-        static_assert(expectEq(kSeqMiD0, kSeqMiD1), "");
-        static_assert(expectLt(kSeqMiD0, kSeqBig), "");
-        static_assert(expectLt(kSeqMiD0, kTicZero), "");
-        static_assert(expectLt(kSeqMiD0, kTicSmall), "");
-        static_assert(expectLt(kSeqMiD0, kTicMid0), "");
-        static_assert(expectLt(kSeqMiD0, kTicMid1), "");
-        static_assert(expectLt(kSeqMiD0, kTicBig), "");
+        static_assert(expectGt(kSeqMiD0, kSeqZero));
+        static_assert(expectGt(kSeqMiD0, kSeqSmall));
+        static_assert(expectEq(kSeqMiD0, kSeqMiD0));
+        static_assert(expectEq(kSeqMiD0, kSeqMiD1));
+        static_assert(expectLt(kSeqMiD0, kSeqBig));
+        static_assert(expectLt(kSeqMiD0, kTicZero));
+        static_assert(expectLt(kSeqMiD0, kTicSmall));
+        static_assert(expectLt(kSeqMiD0, kTicMid0));
+        static_assert(expectLt(kSeqMiD0, kTicMid1));
+        static_assert(expectLt(kSeqMiD0, kTicBig));
 
-        static_assert(expectGt(kSeqMiD1, kSeqZero), "");
-        static_assert(expectGt(kSeqMiD1, kSeqSmall), "");
-        static_assert(expectEq(kSeqMiD1, kSeqMiD0), "");
-        static_assert(expectEq(kSeqMiD1, kSeqMiD1), "");
-        static_assert(expectLt(kSeqMiD1, kSeqBig), "");
-        static_assert(expectLt(kSeqMiD1, kTicZero), "");
-        static_assert(expectLt(kSeqMiD1, kTicSmall), "");
-        static_assert(expectLt(kSeqMiD1, kTicMid0), "");
-        static_assert(expectLt(kSeqMiD1, kTicMid1), "");
-        static_assert(expectLt(kSeqMiD1, kTicBig), "");
+        static_assert(expectGt(kSeqMiD1, kSeqZero));
+        static_assert(expectGt(kSeqMiD1, kSeqSmall));
+        static_assert(expectEq(kSeqMiD1, kSeqMiD0));
+        static_assert(expectEq(kSeqMiD1, kSeqMiD1));
+        static_assert(expectLt(kSeqMiD1, kSeqBig));
+        static_assert(expectLt(kSeqMiD1, kTicZero));
+        static_assert(expectLt(kSeqMiD1, kTicSmall));
+        static_assert(expectLt(kSeqMiD1, kTicMid0));
+        static_assert(expectLt(kSeqMiD1, kTicMid1));
+        static_assert(expectLt(kSeqMiD1, kTicBig));
 
-        static_assert(expectGt(kSeqBig, kSeqZero), "");
-        static_assert(expectGt(kSeqBig, kSeqSmall), "");
-        static_assert(expectGt(kSeqBig, kSeqMiD0), "");
-        static_assert(expectGt(kSeqBig, kSeqMiD1), "");
-        static_assert(expectEq(kSeqBig, kSeqBig), "");
-        static_assert(expectLt(kSeqBig, kTicZero), "");
-        static_assert(expectLt(kSeqBig, kTicSmall), "");
-        static_assert(expectLt(kSeqBig, kTicMid0), "");
-        static_assert(expectLt(kSeqBig, kTicMid1), "");
-        static_assert(expectLt(kSeqBig, kTicBig), "");
+        static_assert(expectGt(kSeqBig, kSeqZero));
+        static_assert(expectGt(kSeqBig, kSeqSmall));
+        static_assert(expectGt(kSeqBig, kSeqMiD0));
+        static_assert(expectGt(kSeqBig, kSeqMiD1));
+        static_assert(expectEq(kSeqBig, kSeqBig));
+        static_assert(expectLt(kSeqBig, kTicZero));
+        static_assert(expectLt(kSeqBig, kTicSmall));
+        static_assert(expectLt(kSeqBig, kTicMid0));
+        static_assert(expectLt(kSeqBig, kTicMid1));
+        static_assert(expectLt(kSeqBig, kTicBig));
 
-        static_assert(expectGt(kTicZero, kSeqZero), "");
-        static_assert(expectGt(kTicZero, kSeqSmall), "");
-        static_assert(expectGt(kTicZero, kSeqMiD0), "");
-        static_assert(expectGt(kTicZero, kSeqMiD1), "");
-        static_assert(expectGt(kTicZero, kSeqBig), "");
-        static_assert(expectEq(kTicZero, kTicZero), "");
-        static_assert(expectLt(kTicZero, kTicSmall), "");
-        static_assert(expectLt(kTicZero, kTicMid0), "");
-        static_assert(expectLt(kTicZero, kTicMid1), "");
-        static_assert(expectLt(kTicZero, kTicBig), "");
+        static_assert(expectGt(kTicZero, kSeqZero));
+        static_assert(expectGt(kTicZero, kSeqSmall));
+        static_assert(expectGt(kTicZero, kSeqMiD0));
+        static_assert(expectGt(kTicZero, kSeqMiD1));
+        static_assert(expectGt(kTicZero, kSeqBig));
+        static_assert(expectEq(kTicZero, kTicZero));
+        static_assert(expectLt(kTicZero, kTicSmall));
+        static_assert(expectLt(kTicZero, kTicMid0));
+        static_assert(expectLt(kTicZero, kTicMid1));
+        static_assert(expectLt(kTicZero, kTicBig));
 
-        static_assert(expectGt(kTicSmall, kSeqZero), "");
-        static_assert(expectGt(kTicSmall, kSeqSmall), "");
-        static_assert(expectGt(kTicSmall, kSeqMiD0), "");
-        static_assert(expectGt(kTicSmall, kSeqMiD1), "");
-        static_assert(expectGt(kTicSmall, kSeqBig), "");
-        static_assert(expectGt(kTicSmall, kTicZero), "");
-        static_assert(expectEq(kTicSmall, kTicSmall), "");
-        static_assert(expectLt(kTicSmall, kTicMid0), "");
-        static_assert(expectLt(kTicSmall, kTicMid1), "");
-        static_assert(expectLt(kTicSmall, kTicBig), "");
+        static_assert(expectGt(kTicSmall, kSeqZero));
+        static_assert(expectGt(kTicSmall, kSeqSmall));
+        static_assert(expectGt(kTicSmall, kSeqMiD0));
+        static_assert(expectGt(kTicSmall, kSeqMiD1));
+        static_assert(expectGt(kTicSmall, kSeqBig));
+        static_assert(expectGt(kTicSmall, kTicZero));
+        static_assert(expectEq(kTicSmall, kTicSmall));
+        static_assert(expectLt(kTicSmall, kTicMid0));
+        static_assert(expectLt(kTicSmall, kTicMid1));
+        static_assert(expectLt(kTicSmall, kTicBig));
 
-        static_assert(expectGt(kTicMid0, kSeqZero), "");
-        static_assert(expectGt(kTicMid0, kSeqSmall), "");
-        static_assert(expectGt(kTicMid0, kSeqMiD0), "");
-        static_assert(expectGt(kTicMid0, kSeqMiD1), "");
-        static_assert(expectGt(kTicMid0, kSeqBig), "");
-        static_assert(expectGt(kTicMid0, kTicZero), "");
-        static_assert(expectGt(kTicMid0, kTicSmall), "");
-        static_assert(expectEq(kTicMid0, kTicMid0), "");
-        static_assert(expectEq(kTicMid0, kTicMid1), "");
-        static_assert(expectLt(kTicMid0, kTicBig), "");
+        static_assert(expectGt(kTicMid0, kSeqZero));
+        static_assert(expectGt(kTicMid0, kSeqSmall));
+        static_assert(expectGt(kTicMid0, kSeqMiD0));
+        static_assert(expectGt(kTicMid0, kSeqMiD1));
+        static_assert(expectGt(kTicMid0, kSeqBig));
+        static_assert(expectGt(kTicMid0, kTicZero));
+        static_assert(expectGt(kTicMid0, kTicSmall));
+        static_assert(expectEq(kTicMid0, kTicMid0));
+        static_assert(expectEq(kTicMid0, kTicMid1));
+        static_assert(expectLt(kTicMid0, kTicBig));
 
-        static_assert(expectGt(kTicMid1, kSeqZero), "");
-        static_assert(expectGt(kTicMid1, kSeqSmall), "");
-        static_assert(expectGt(kTicMid1, kSeqMiD0), "");
-        static_assert(expectGt(kTicMid1, kSeqMiD1), "");
-        static_assert(expectGt(kTicMid1, kSeqBig), "");
-        static_assert(expectGt(kTicMid1, kTicZero), "");
-        static_assert(expectGt(kTicMid1, kTicSmall), "");
-        static_assert(expectEq(kTicMid1, kTicMid0), "");
-        static_assert(expectEq(kTicMid1, kTicMid1), "");
-        static_assert(expectLt(kTicMid1, kTicBig), "");
+        static_assert(expectGt(kTicMid1, kSeqZero));
+        static_assert(expectGt(kTicMid1, kSeqSmall));
+        static_assert(expectGt(kTicMid1, kSeqMiD0));
+        static_assert(expectGt(kTicMid1, kSeqMiD1));
+        static_assert(expectGt(kTicMid1, kSeqBig));
+        static_assert(expectGt(kTicMid1, kTicZero));
+        static_assert(expectGt(kTicMid1, kTicSmall));
+        static_assert(expectEq(kTicMid1, kTicMid0));
+        static_assert(expectEq(kTicMid1, kTicMid1));
+        static_assert(expectLt(kTicMid1, kTicBig));
 
-        static_assert(expectGt(kTicBig, kSeqZero), "");
-        static_assert(expectGt(kTicBig, kSeqSmall), "");
-        static_assert(expectGt(kTicBig, kSeqMiD0), "");
-        static_assert(expectGt(kTicBig, kSeqMiD1), "");
-        static_assert(expectGt(kTicBig, kSeqBig), "");
-        static_assert(expectGt(kTicBig, kTicZero), "");
-        static_assert(expectGt(kTicBig, kTicSmall), "");
-        static_assert(expectGt(kTicBig, kTicMid0), "");
-        static_assert(expectGt(kTicBig, kTicMid1), "");
-        static_assert(expectEq(kTicBig, kTicBig), "");
+        static_assert(expectGt(kTicBig, kSeqZero));
+        static_assert(expectGt(kTicBig, kSeqSmall));
+        static_assert(expectGt(kTicBig, kSeqMiD0));
+        static_assert(expectGt(kTicBig, kSeqMiD1));
+        static_assert(expectGt(kTicBig, kSeqBig));
+        static_assert(expectGt(kTicBig, kTicZero));
+        static_assert(expectGt(kTicBig, kTicSmall));
+        static_assert(expectGt(kTicBig, kTicMid0));
+        static_assert(expectGt(kTicBig, kTicMid1));
+        static_assert(expectEq(kTicBig, kTicBig));
 
         // Verify streaming.
         BEAST_EXPECT(streamTest(kSeqZero));
diff --git a/src/test/shamap/SHAMap_test.cpp b/src/test/shamap/SHAMap_test.cpp
index ab7e01e3af..5ff5ef5e05 100644
--- a/src/test/shamap/SHAMap_test.cpp
+++ b/src/test/shamap/SHAMap_test.cpp
@@ -26,57 +26,57 @@
 namespace xrpl::tests {
 
 #ifndef __INTELLISENSE__
-static_assert(std::is_nothrow_destructible<SHAMap>{}, "");
-static_assert(!std::is_default_constructible<SHAMap>{}, "");
-static_assert(!std::is_copy_constructible<SHAMap>{}, "");
-static_assert(!std::is_copy_assignable<SHAMap>{}, "");
-static_assert(!std::is_move_constructible<SHAMap>{}, "");
-static_assert(!std::is_move_assignable<SHAMap>{}, "");
+static_assert(std::is_nothrow_destructible<SHAMap>{});
+static_assert(!std::is_default_constructible<SHAMap>{});
+static_assert(!std::is_copy_constructible<SHAMap>{});
+static_assert(!std::is_copy_assignable<SHAMap>{});
+static_assert(!std::is_move_constructible<SHAMap>{});
+static_assert(!std::is_move_assignable<SHAMap>{});
 
-static_assert(std::is_nothrow_destructible<SHAMap::ConstIterator>{}, "");
-static_assert(std::is_copy_constructible<SHAMap::ConstIterator>{}, "");
-static_assert(std::is_copy_assignable<SHAMap::ConstIterator>{}, "");
-static_assert(std::is_move_constructible<SHAMap::ConstIterator>{}, "");
-static_assert(std::is_move_assignable<SHAMap::ConstIterator>{}, "");
+static_assert(std::is_nothrow_destructible<SHAMap::ConstIterator>{});
+static_assert(std::is_copy_constructible<SHAMap::ConstIterator>{});
+static_assert(std::is_copy_assignable<SHAMap::ConstIterator>{});
+static_assert(std::is_move_constructible<SHAMap::ConstIterator>{});
+static_assert(std::is_move_assignable<SHAMap::ConstIterator>{});
 
-static_assert(std::is_nothrow_destructible<SHAMapItem>{}, "");
-static_assert(!std::is_default_constructible<SHAMapItem>{}, "");
-static_assert(!std::is_copy_constructible<SHAMapItem>{}, "");
+static_assert(std::is_nothrow_destructible<SHAMapItem>{});
+static_assert(!std::is_default_constructible<SHAMapItem>{});
+static_assert(!std::is_copy_constructible<SHAMapItem>{});
 
-static_assert(std::is_nothrow_destructible<SHAMapNodeID>{}, "");
-static_assert(std::is_default_constructible<SHAMapNodeID>{}, "");
-static_assert(std::is_copy_constructible<SHAMapNodeID>{}, "");
-static_assert(std::is_copy_assignable<SHAMapNodeID>{}, "");
-static_assert(std::is_move_constructible<SHAMapNodeID>{}, "");
-static_assert(std::is_move_assignable<SHAMapNodeID>{}, "");
+static_assert(std::is_nothrow_destructible<SHAMapNodeID>{});
+static_assert(std::is_default_constructible<SHAMapNodeID>{});
+static_assert(std::is_copy_constructible<SHAMapNodeID>{});
+static_assert(std::is_copy_assignable<SHAMapNodeID>{});
+static_assert(std::is_move_constructible<SHAMapNodeID>{});
+static_assert(std::is_move_assignable<SHAMapNodeID>{});
 
-static_assert(std::is_nothrow_destructible<SHAMapHash>{}, "");
-static_assert(std::is_default_constructible<SHAMapHash>{}, "");
-static_assert(std::is_copy_constructible<SHAMapHash>{}, "");
-static_assert(std::is_copy_assignable<SHAMapHash>{}, "");
-static_assert(std::is_move_constructible<SHAMapHash>{}, "");
-static_assert(std::is_move_assignable<SHAMapHash>{}, "");
+static_assert(std::is_nothrow_destructible<SHAMapHash>{});
+static_assert(std::is_default_constructible<SHAMapHash>{});
+static_assert(std::is_copy_constructible<SHAMapHash>{});
+static_assert(std::is_copy_assignable<SHAMapHash>{});
+static_assert(std::is_move_constructible<SHAMapHash>{});
+static_assert(std::is_move_assignable<SHAMapHash>{});
 
-static_assert(std::is_nothrow_destructible<SHAMapTreeNode>{}, "");
-static_assert(!std::is_default_constructible<SHAMapTreeNode>{}, "");
-static_assert(!std::is_copy_constructible<SHAMapTreeNode>{}, "");
-static_assert(!std::is_copy_assignable<SHAMapTreeNode>{}, "");
-static_assert(!std::is_move_constructible<SHAMapTreeNode>{}, "");
-static_assert(!std::is_move_assignable<SHAMapTreeNode>{}, "");
+static_assert(std::is_nothrow_destructible<SHAMapTreeNode>{});
+static_assert(!std::is_default_constructible<SHAMapTreeNode>{});
+static_assert(!std::is_copy_constructible<SHAMapTreeNode>{});
+static_assert(!std::is_copy_assignable<SHAMapTreeNode>{});
+static_assert(!std::is_move_constructible<SHAMapTreeNode>{});
+static_assert(!std::is_move_assignable<SHAMapTreeNode>{});
 
-static_assert(std::is_nothrow_destructible<SHAMapInnerNode>{}, "");
-static_assert(!std::is_default_constructible<SHAMapInnerNode>{}, "");
-static_assert(!std::is_copy_constructible<SHAMapInnerNode>{}, "");
-static_assert(!std::is_copy_assignable<SHAMapInnerNode>{}, "");
-static_assert(!std::is_move_constructible<SHAMapInnerNode>{}, "");
-static_assert(!std::is_move_assignable<SHAMapInnerNode>{}, "");
+static_assert(std::is_nothrow_destructible<SHAMapInnerNode>{});
+static_assert(!std::is_default_constructible<SHAMapInnerNode>{});
+static_assert(!std::is_copy_constructible<SHAMapInnerNode>{});
+static_assert(!std::is_copy_assignable<SHAMapInnerNode>{});
+static_assert(!std::is_move_constructible<SHAMapInnerNode>{});
+static_assert(!std::is_move_assignable<SHAMapInnerNode>{});
 
-static_assert(std::is_nothrow_destructible<SHAMapLeafNode>{}, "");
-static_assert(!std::is_default_constructible<SHAMapLeafNode>{}, "");
-static_assert(!std::is_copy_constructible<SHAMapLeafNode>{}, "");
-static_assert(!std::is_copy_assignable<SHAMapLeafNode>{}, "");
-static_assert(!std::is_move_constructible<SHAMapLeafNode>{}, "");
-static_assert(!std::is_move_assignable<SHAMapLeafNode>{}, "");
+static_assert(std::is_nothrow_destructible<SHAMapLeafNode>{});
+static_assert(!std::is_default_constructible<SHAMapLeafNode>{});
+static_assert(!std::is_copy_constructible<SHAMapLeafNode>{});
+static_assert(!std::is_copy_assignable<SHAMapLeafNode>{});
+static_assert(!std::is_move_constructible<SHAMapLeafNode>{});
+static_assert(!std::is_move_assignable<SHAMapLeafNode>{});
 #endif
 
 inline bool
diff --git a/src/xrpld/app/misc/detail/TxQ.cpp b/src/xrpld/app/misc/detail/TxQ.cpp
index 7e57302d23..5d1020d296 100644
--- a/src/xrpld/app/misc/detail/TxQ.cpp
+++ b/src/xrpld/app/misc/detail/TxQ.cpp
@@ -228,11 +228,11 @@ static_assert(sumOfFirstSquares(1).second == 1);
 static_assert(sumOfFirstSquares(2).first);
 static_assert(sumOfFirstSquares(2).second == 5);
 
-static_assert(sumOfFirstSquares(0x1FFFFF).first, "");
-static_assert(sumOfFirstSquares(0x1FFFFF).second == 0x2AAAA8AAAAB00000ul, "");
+static_assert(sumOfFirstSquares(0x1FFFFF).first);
+static_assert(sumOfFirstSquares(0x1FFFFF).second == 0x2AAAA8AAAAB00000ul);
 
-static_assert(!sumOfFirstSquares(0x200000).first, "");
-static_assert(sumOfFirstSquares(0x200000).second == std::numeric_limits<std::uint64_t>::max(), "");
+static_assert(!sumOfFirstSquares(0x200000).first);
+static_assert(sumOfFirstSquares(0x200000).second == std::numeric_limits<std::uint64_t>::max());
 
 }  // namespace detail
 

From 6003fd03fc11c7675a9f03ba791e63aaa0e8265a Mon Sep 17 00:00:00 2001
From: yinyiqian1 <yqian@ripple.com>
Date: Thu, 2 Jul 2026 14:37:37 -0400
Subject: [PATCH 041/100] feat: Enable ConfidentialTransfer and BatchV1_1
 (#7698)

---
 include/xrpl/protocol/detail/features.macro | 4 ++--
 src/test/app/Delegate_test.cpp              | 2 --
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index a7a62f0322..3f078561a3 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -15,9 +15,9 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
 
-XRPL_FEATURE(BatchV1_1,                   Supported::No,  VoteBehavior::DefaultNo)
+XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(LendingProtocolV1_1,         Supported::No,  VoteBehavior::DefaultNo)
-XRPL_FEATURE(ConfidentialTransfer,        Supported::No,  VoteBehavior::DefaultNo)
+XRPL_FEATURE(ConfidentialTransfer,        Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_3_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_2_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(MPTokensV2,                  Supported::No,  VoteBehavior::DefaultNo)
diff --git a/src/test/app/Delegate_test.cpp b/src/test/app/Delegate_test.cpp
index 02ee0750d5..6f1d2ce7de 100644
--- a/src/test/app/Delegate_test.cpp
+++ b/src/test/app/Delegate_test.cpp
@@ -2747,8 +2747,6 @@ class Delegate_test : public beast::unit_test::Suite
         // DO NOT modify expectedDelegableCount unless all scenarios, including
         // edge cases, have been fully tested and verified.
         // ====================================================================
-        // Includes the five confidential MPT transaction types, which are
-        // explicitly marked Delegable in transactions.macro.
         std::size_t const expectedDelegableCount = 56;
 
         BEAST_EXPECTS(

From 3d847f2a6039be6837d7ed8329a9a8496283dc4a Mon Sep 17 00:00:00 2001
From: Bart <bthomee@users.noreply.github.com>
Date: Thu, 2 Jul 2026 14:46:27 -0400
Subject: [PATCH 042/100] build: Add protobuf dependencies to Nix (#7706)

Co-authored-by: Bart <11445373+bthomee@users.noreply.github.com>
---
 nix/packages.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/nix/packages.nix b/nix/packages.nix
index 6202168733..bcadfe7456 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -32,6 +32,15 @@ in
     perl # needed for openssl
     pkg-config
     pre-commit
+    # protoc generates the Go gRPC bindings and embeds its own version string into every committed
+    # .pb.go file. To allow CI to verify those files with a plain `git diff`, we pin the version to
+    # `protobuf_34` rather than the rolling `protobuf` to keep regeneration reproducible across the
+    # Nix frequently changing unstable channel. The protoc-gen-go* plugins have no versioned
+    # attributes in nixpkgs; protoc-gen-go's version is in turn constrained by the go.mod require
+    # on google.golang.org/protobuf.
+    protobuf_34 # provides protoc
+    protoc-gen-go # protoc plugin for the Go message bindings
+    protoc-gen-go-grpc # protoc plugin for the Go gRPC service stubs
     python3
     runClangTidy
     vim

From 7ba1d76d0543c94e74df3c634b11448b293cdaf8 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Thu, 2 Jul 2026 21:02:55 +0100
Subject: [PATCH 043/100] chore: Enable modernize-use-auto (#7707)

---
 .clang-tidy                                      |  1 -
 include/xrpl/beast/hash/hash_append.h            |  2 +-
 include/xrpl/beast/utility/rngfill.h             |  4 ++--
 include/xrpl/core/JobTypes.h                     |  2 +-
 include/xrpl/ledger/helpers/EscrowHelpers.h      |  2 +-
 include/xrpl/nodestore/detail/codec.h            |  8 ++++----
 include/xrpl/nodestore/detail/varint.h           |  4 ++--
 include/xrpl/protocol/Quality.h                  |  2 +-
 include/xrpl/protocol/STBitString.h              |  2 +-
 include/xrpl/protocol/STInteger.h                |  2 +-
 src/libxrpl/basics/Number.cpp                    |  2 +-
 src/libxrpl/beast/insight/StatsDCollector.cpp    |  4 ++--
 src/libxrpl/core/detail/JobQueue.cpp             | 10 +++++-----
 src/libxrpl/crypto/RFC1751.cpp                   |  2 +-
 src/libxrpl/json/json_reader.cpp                 |  2 +-
 src/libxrpl/json/json_value.cpp                  | 16 ++++++++--------
 src/libxrpl/json/json_writer.cpp                 |  6 +++---
 src/libxrpl/nodestore/DecodedBlob.cpp            |  2 +-
 src/libxrpl/nodestore/backend/MemoryFactory.cpp  |  2 +-
 src/libxrpl/nodestore/backend/NuDBFactory.cpp    |  2 +-
 src/libxrpl/nodestore/backend/RocksDBFactory.cpp |  2 +-
 src/libxrpl/protocol/IOUAmount.cpp               |  2 +-
 src/libxrpl/protocol/MPTIssue.cpp                |  3 +--
 src/libxrpl/protocol/NFTokenID.cpp               |  3 +--
 src/libxrpl/protocol/STAmount.cpp                |  2 +-
 src/libxrpl/protocol/STBlob.cpp                  |  2 +-
 src/libxrpl/protocol/STCurrency.cpp              |  2 +-
 src/libxrpl/protocol/STIssue.cpp                 |  2 +-
 src/libxrpl/protocol/STNumber.cpp                |  2 +-
 src/libxrpl/protocol/STObject.cpp                | 10 +++++-----
 src/libxrpl/protocol/STPathSet.cpp               |  4 ++--
 src/libxrpl/protocol/STVector256.cpp             |  2 +-
 src/libxrpl/protocol/STXChainBridge.cpp          |  2 +-
 .../tx/transactors/escrow/EscrowCreate.cpp       |  2 +-
 src/test/app/ConfidentialTransfer_test.cpp       |  2 +-
 src/test/app/Loan_test.cpp                       |  2 +-
 src/test/app/Offer_test.cpp                      |  2 +-
 src/test/beast/LexicalCast_test.cpp              |  6 +++---
 .../beast/aged_associative_container_test.cpp    |  2 +-
 src/test/shamap/FetchPack_test.cpp               |  2 +-
 src/xrpld/app/consensus/RCLConsensus.cpp         |  2 +-
 src/xrpld/app/ledger/detail/InboundLedgers.cpp   |  2 +-
 src/xrpld/app/main/Application.cpp               |  2 +-
 src/xrpld/app/misc/NetworkOPs.cpp                |  4 ++--
 src/xrpld/app/misc/detail/Transaction.cpp        |  2 +-
 src/xrpld/app/misc/detail/TxQ.cpp                | 10 +++++-----
 src/xrpld/app/rdb/backend/detail/Node.cpp        |  2 +-
 src/xrpld/core/detail/Config.cpp                 |  2 +-
 src/xrpld/rpc/CTID.h                             |  6 +++---
 src/xrpld/rpc/handlers/orderbook/BookOffers.cpp  |  2 +-
 50 files changed, 82 insertions(+), 85 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index 2b0b7e4418..6a24cbc8d3 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -80,7 +80,6 @@ Checks: "-*,
   -modernize-replace-random-shuffle,
   -modernize-return-braced-init-list,
   -modernize-shrink-to-fit,
-  -modernize-use-auto,
   -modernize-use-bool-literals,
   -modernize-use-constraints,
   -modernize-use-default-member-init,
diff --git a/include/xrpl/beast/hash/hash_append.h b/include/xrpl/beast/hash/hash_append.h
index 0b36d4c983..5f77f41e5d 100644
--- a/include/xrpl/beast/hash/hash_append.h
+++ b/include/xrpl/beast/hash/hash_append.h
@@ -26,7 +26,7 @@ template <class T>
 inline void
 reverseBytes(T& t)
 {
-    unsigned char* bytes =
+    auto* bytes =
         static_cast<unsigned char*>(std::memmove(std::addressof(t), std::addressof(t), sizeof(T)));
     for (unsigned i = 0; i < sizeof(T) / 2; ++i)
         std::swap(bytes[i], bytes[sizeof(T) - 1 - i]);
diff --git a/include/xrpl/beast/utility/rngfill.h b/include/xrpl/beast/utility/rngfill.h
index 0fc3ffe0d0..ee7a5e2434 100644
--- a/include/xrpl/beast/utility/rngfill.h
+++ b/include/xrpl/beast/utility/rngfill.h
@@ -14,7 +14,7 @@ rngfill(void* const buffer, std::size_t const bytes, Generator& g)
     using result_type = Generator::result_type;
     constexpr std::size_t kResultSize = sizeof(result_type);
 
-    std::uint8_t* const bufferStart = static_cast<std::uint8_t*>(buffer);
+    auto* const bufferStart = static_cast<std::uint8_t*>(buffer);
     std::size_t const completeIterations = bytes / kResultSize;
     std::size_t const bytesRemaining = bytes % kResultSize;
 
@@ -42,7 +42,7 @@ rngfill(std::array<std::uint8_t, N>& a, Generator& g)
 {
     using result_type = Generator::result_type;
     auto i = N / sizeof(result_type);
-    result_type* p = reinterpret_cast<result_type*>(a.data());
+    auto* p = reinterpret_cast<result_type*>(a.data());
     while (i--)
         *p++ = g();
 }
diff --git a/include/xrpl/core/JobTypes.h b/include/xrpl/core/JobTypes.h
index f338b19f6c..cc2f3ecbf5 100644
--- a/include/xrpl/core/JobTypes.h
+++ b/include/xrpl/core/JobTypes.h
@@ -118,7 +118,7 @@ public:
     [[nodiscard]] JobTypeInfo const&
     get(JobType jt) const
     {
-        Map::const_iterator const iter(map.find(jt));
+        auto const iter = map.find(jt);
         XRPL_ASSERT(iter != map.end(), "xrpl::JobTypes::get : valid input");
 
         if (iter != map.end())
diff --git a/include/xrpl/ledger/helpers/EscrowHelpers.h b/include/xrpl/ledger/helpers/EscrowHelpers.h
index 001dc9cb25..d173c33c56 100644
--- a/include/xrpl/ledger/helpers/EscrowHelpers.h
+++ b/include/xrpl/ledger/helpers/EscrowHelpers.h
@@ -54,7 +54,7 @@ escrowUnlockApplyHelper<Issue>(
     bool createAsset,
     beast::Journal journal)
 {
-    Issue const& issue = amount.get<Issue>();
+    auto const& issue = amount.get<Issue>();
     Keylet const trustLineKey = keylet::trustLine(receiver, issue);
     bool const recvLow = issuer > receiver;
     bool const senderIssuer = issuer == sender;
diff --git a/include/xrpl/nodestore/detail/codec.h b/include/xrpl/nodestore/detail/codec.h
index 56e1fbcf73..2f69d532be 100644
--- a/include/xrpl/nodestore/detail/codec.h
+++ b/include/xrpl/nodestore/detail/codec.h
@@ -62,7 +62,7 @@ lz4Compress(void const* in, std::size_t inSize, BufferFactory&& bf)
     std::array<std::uint8_t, varint_traits<std::size_t>::kMax> vi{};
     auto const n = writeVarint(vi.data(), inSize);
     auto const outMax = LZ4_compressBound(inSize);
-    std::uint8_t* out = reinterpret_cast<std::uint8_t*>(bf(n + outMax));
+    auto* out = reinterpret_cast<std::uint8_t*>(bf(n + outMax));
     result.first = out;
     std::memcpy(out, vi.data(), n);
     auto const outSize = LZ4_compress_default(
@@ -90,7 +90,7 @@ nodeobjectDecompress(void const* in, std::size_t inSize, BufferFactory&& bf)
 {
     using namespace nudb::detail;
 
-    std::uint8_t const* p = reinterpret_cast<std::uint8_t const*>(in);
+    auto const* p = reinterpret_cast<std::uint8_t const*>(in);
     std::size_t type = 0;
     auto const vn = readVarint(p, inSize, type);
     if (vn == 0)
@@ -237,7 +237,7 @@ nodeobjectCompress(void const* in, std::size_t inSize, BufferFactory&& bf)
                 auto const vs = sizeVarint(type);
                 result.second = vs + field<std::uint16_t>::size +  // mask
                     (n * 32);                                      // hashes
-                std::uint8_t* out = reinterpret_cast<std::uint8_t*>(bf(result.second));
+                auto* out = reinterpret_cast<std::uint8_t*>(bf(result.second));
                 result.first = out;
                 ostream os(out, result.second);
                 write<varint>(os, type);
@@ -249,7 +249,7 @@ nodeobjectCompress(void const* in, std::size_t inSize, BufferFactory&& bf)
             auto const type = 3U;
             auto const vs = sizeVarint(type);
             result.second = vs + (n * 32);  // hashes
-            std::uint8_t* out = reinterpret_cast<std::uint8_t*>(bf(result.second));
+            auto* out = reinterpret_cast<std::uint8_t*>(bf(result.second));
             result.first = out;
             ostream os(out, result.second);
             write<varint>(os, type);
diff --git a/include/xrpl/nodestore/detail/varint.h b/include/xrpl/nodestore/detail/varint.h
index 21a13bd6de..6102c0cf2d 100644
--- a/include/xrpl/nodestore/detail/varint.h
+++ b/include/xrpl/nodestore/detail/varint.h
@@ -39,7 +39,7 @@ readVarint(void const* buf, std::size_t buflen, std::size_t& t)
     if (buflen == 0)
         return 0;
     t = 0;
-    std::uint8_t const* p = reinterpret_cast<std::uint8_t const*>(buf);
+    auto const* p = reinterpret_cast<std::uint8_t const*>(buf);
     std::size_t n = 0;
     while (p[n] & 0x80)
     {
@@ -86,7 +86,7 @@ std::size_t
 writeVarint(void* p0, std::size_t v)
 {
     // NOLINTNEXTLINE(misc-const-correctness)
-    std::uint8_t* p = reinterpret_cast<std::uint8_t*>(p0);
+    auto* p = reinterpret_cast<std::uint8_t*>(p0);
     do
     {
         std::uint8_t d = v % 127;
diff --git a/include/xrpl/protocol/Quality.h b/include/xrpl/protocol/Quality.h
index 6bb2033dc0..de61d79ca5 100644
--- a/include/xrpl/protocol/Quality.h
+++ b/include/xrpl/protocol/Quality.h
@@ -282,7 +282,7 @@ public:
         auto const maxVMantissa = mantissa(maxV);
         auto const expDiff = exponent(maxV) - exponent(minV);
 
-        double const minVD = static_cast<double>(minVMantissa);
+        auto const minVD = static_cast<double>(minVMantissa);
         double const maxVD =
             (expDiff != 0) ? maxVMantissa * pow(10, expDiff) : static_cast<double>(maxVMantissa);
 
diff --git a/include/xrpl/protocol/STBitString.h b/include/xrpl/protocol/STBitString.h
index 4f25eccca6..6f71f48f25 100644
--- a/include/xrpl/protocol/STBitString.h
+++ b/include/xrpl/protocol/STBitString.h
@@ -148,7 +148,7 @@ template <int Bits>
 bool
 STBitString<Bits>::isEquivalent(STBase const& t) const
 {
-    STBitString const* v = dynamic_cast<STBitString const*>(&t);
+    auto const* v = dynamic_cast<STBitString const*>(&t);
     return v && (value_ == v->value_);
 }
 
diff --git a/include/xrpl/protocol/STInteger.h b/include/xrpl/protocol/STInteger.h
index 1c7ac98f3e..951c4fc52f 100644
--- a/include/xrpl/protocol/STInteger.h
+++ b/include/xrpl/protocol/STInteger.h
@@ -115,7 +115,7 @@ template <typename Integer>
 inline bool
 STInteger<Integer>::isEquivalent(STBase const& t) const
 {
-    STInteger const* v = dynamic_cast<STInteger const*>(&t);
+    auto const* v = dynamic_cast<STInteger const*>(&t);
     return v && (value_ == v->value_);
 }
 
diff --git a/src/libxrpl/basics/Number.cpp b/src/libxrpl/basics/Number.cpp
index 23e913bbdc..4d7a821040 100644
--- a/src/libxrpl/basics/Number.cpp
+++ b/src/libxrpl/basics/Number.cpp
@@ -876,7 +876,7 @@ Number::operator/=(Number const& y)
     int const ds = (dp ? -1 : 1);
     // Create the denominator as 128-bit unsigned, since that's what we
     // need to work with.
-    uint128_t const dm = static_cast<uint128_t>(y.mantissa_);
+    auto const dm = static_cast<uint128_t>(y.mantissa_);
     auto const de = y.exponent_;
 
     auto const& range = kRange.get();
diff --git a/src/libxrpl/beast/insight/StatsDCollector.cpp b/src/libxrpl/beast/insight/StatsDCollector.cpp
index 0d0e013274..1da5315de1 100644
--- a/src/libxrpl/beast/insight/StatsDCollector.cpp
+++ b/src/libxrpl/beast/insight/StatsDCollector.cpp
@@ -640,14 +640,14 @@ StatsDGaugeImpl::doIncrement(GaugeImpl::difference_type amount)
 
     if (amount > 0)
     {
-        GaugeImpl::value_type const d(static_cast<GaugeImpl::value_type>(amount));
+        auto const d = static_cast<GaugeImpl::value_type>(amount);
         value += (d >= std::numeric_limits<GaugeImpl::value_type>::max() - value_)
             ? std::numeric_limits<GaugeImpl::value_type>::max() - value_
             : d;
     }
     else if (amount < 0)
     {
-        GaugeImpl::value_type const d(static_cast<GaugeImpl::value_type>(-amount));
+        auto const d = static_cast<GaugeImpl::value_type>(-amount);
         value = (d >= value) ? 0 : value - d;
     }
 
diff --git a/src/libxrpl/core/detail/JobQueue.cpp b/src/libxrpl/core/detail/JobQueue.cpp
index ffb91db72d..f773270af3 100644
--- a/src/libxrpl/core/detail/JobQueue.cpp
+++ b/src/libxrpl/core/detail/JobQueue.cpp
@@ -122,7 +122,7 @@ JobQueue::getJobCount(JobType t) const
 {
     std::scoped_lock const lock(mutex_);
 
-    JobDataMap::const_iterator const c = jobData_.find(t);
+    auto const c = jobData_.find(t);
 
     return (c == jobData_.end()) ? 0 : c->second.waiting;
 }
@@ -132,7 +132,7 @@ JobQueue::getJobCountTotal(JobType t) const
 {
     std::scoped_lock const lock(mutex_);
 
-    JobDataMap::const_iterator const c = jobData_.find(t);
+    auto const c = jobData_.find(t);
 
     return (c == jobData_.end()) ? 0 : (c->second.waiting + c->second.running);
 }
@@ -157,7 +157,7 @@ JobQueue::getJobCountGE(JobType t) const
 std::unique_ptr<LoadEvent>
 JobQueue::makeLoadEvent(JobType t, std::string const& name)
 {
-    JobDataMap::iterator const iter(jobData_.find(t));
+    auto const iter = jobData_.find(t);
     XRPL_ASSERT(iter != jobData_.end(), "xrpl::JobQueue::makeLoadEvent : valid job type input");
 
     if (iter == jobData_.end())
@@ -172,7 +172,7 @@ JobQueue::addLoadEvents(JobType t, int count, std::chrono::milliseconds elapsed)
     if (isStopped())
         logicError("JobQueue::addLoadEvents() called after JobQueue stopped");
 
-    JobDataMap::iterator const iter(jobData_.find(t));
+    auto const iter = jobData_.find(t);
     XRPL_ASSERT(iter != jobData_.end(), "xrpl::JobQueue::addLoadEvents : valid job type input");
     iter->second.load().addSamples(count, elapsed);
 }
@@ -250,7 +250,7 @@ JobQueue::rendezvous()
 JobTypeData&
 JobQueue::getJobTypeData(JobType type)
 {
-    JobDataMap::iterator const c(jobData_.find(type));
+    auto const c = jobData_.find(type);
     XRPL_ASSERT(c != jobData_.end(), "xrpl::JobQueue::getJobTypeData : valid job type input");
 
     // NIKB: This is ugly and I hate it. We must remove JtInvalid completely
diff --git a/src/libxrpl/crypto/RFC1751.cpp b/src/libxrpl/crypto/RFC1751.cpp
index 16482945d2..41e29ee00c 100644
--- a/src/libxrpl/crypto/RFC1751.cpp
+++ b/src/libxrpl/crypto/RFC1751.cpp
@@ -434,7 +434,7 @@ RFC1751::getWordFromBlob(void const* blob, size_t bytes)
     // This is a simple implementation of the Jenkins one-at-a-time hash
     // algorithm:
     // http://en.wikipedia.org/wiki/Jenkins_hash_function#one-at-a-time
-    unsigned char const* data = static_cast<unsigned char const*>(blob);
+    auto const* data = static_cast<unsigned char const*>(blob);
     std::uint32_t hash = 0;
 
     for (size_t i = 0; i < bytes; ++i)
diff --git a/src/libxrpl/json/json_reader.cpp b/src/libxrpl/json/json_reader.cpp
index 3786f51fdd..45e448c480 100644
--- a/src/libxrpl/json/json_reader.cpp
+++ b/src/libxrpl/json/json_reader.cpp
@@ -908,7 +908,7 @@ Reader::getFormattedErrorMessages() const
 {
     std::string formattedMessage;
 
-    for (Errors::const_iterator itError = errors_.begin(); itError != errors_.end(); ++itError)
+    for (auto itError = errors_.begin(); itError != errors_.end(); ++itError)
     {
         ErrorInfo const& error = *itError;
         formattedMessage += "* " + getLocationLineAndColumn(error.token.start) + "\n";
diff --git a/src/libxrpl/json/json_value.cpp b/src/libxrpl/json/json_value.cpp
index 074a88428c..7218b8c6cf 100644
--- a/src/libxrpl/json/json_value.cpp
+++ b/src/libxrpl/json/json_value.cpp
@@ -802,7 +802,7 @@ Value::size() const
         case ValueType::Array:  // size of the array is highest index + 1
             if (!value_.mapVal->empty())
             {
-                ObjectValues::const_iterator itLast = value_.mapVal->end();
+                auto itLast = value_.mapVal->end();
                 --itLast;
                 return (*itLast).first.index() + 1;
             }
@@ -866,7 +866,7 @@ Value::operator[](UInt index)
         *this = Value(ValueType::Array);
 
     CZString const key(index);
-    ObjectValues::iterator it = value_.mapVal->lower_bound(key);
+    auto it = value_.mapVal->lower_bound(key);
 
     if (it != value_.mapVal->end() && (*it).first == key)
         return (*it).second;
@@ -887,7 +887,7 @@ Value::operator[](UInt index) const
         return kNull;
 
     CZString const key(index);
-    ObjectValues::const_iterator const it = value_.mapVal->find(key);
+    auto const it = value_.mapVal->find(key);
 
     if (it == value_.mapVal->end())
         return kNull;
@@ -915,7 +915,7 @@ Value::resolveReference(char const* key, bool isStatic)
         key,
         isStatic ? CZString::DuplicationPolicy::NoDuplication
                  : CZString::DuplicationPolicy::DuplicateOnCopy);
-    ObjectValues::iterator it = value_.mapVal->lower_bound(actualKey);
+    auto it = value_.mapVal->lower_bound(actualKey);
 
     if (it != value_.mapVal->end() && (*it).first == actualKey)
         return (*it).second;
@@ -950,7 +950,7 @@ Value::operator[](char const* key) const
         return kNull;
 
     CZString const actualKey(key, CZString::DuplicationPolicy::NoDuplication);
-    ObjectValues::const_iterator const it = value_.mapVal->find(actualKey);
+    auto const it = value_.mapVal->find(actualKey);
 
     if (it == value_.mapVal->end())
         return kNull;
@@ -1018,7 +1018,7 @@ Value::removeMember(char const* key)
         return kNull;
 
     CZString const actualKey(key, CZString::DuplicationPolicy::NoDuplication);
-    ObjectValues::iterator const it = value_.mapVal->find(actualKey);
+    auto const it = value_.mapVal->find(actualKey);
 
     if (it == value_.mapVal->end())
         return kNull;
@@ -1068,8 +1068,8 @@ Value::getMemberNames() const
 
     Members members;
     members.reserve(value_.mapVal->size());
-    ObjectValues::const_iterator it = value_.mapVal->begin();
-    ObjectValues::const_iterator const itEnd = value_.mapVal->end();
+    auto it = value_.mapVal->begin();
+    auto const itEnd = value_.mapVal->end();
 
     for (; it != itEnd; ++it)
         members.emplace_back((*it).first.cStr());
diff --git a/src/libxrpl/json/json_writer.cpp b/src/libxrpl/json/json_writer.cpp
index 4c38bdcf92..c9f8cb688b 100644
--- a/src/libxrpl/json/json_writer.cpp
+++ b/src/libxrpl/json/json_writer.cpp
@@ -232,7 +232,7 @@ FastWriter::writeValue(Value const& value)
             Value::Members members(value.getMemberNames());
             document_ += "{";
 
-            for (Value::Members::iterator it = members.begin(); it != members.end(); ++it)
+            for (auto it = members.begin(); it != members.end(); ++it)
             {
                 std::string const& name = *it;
 
@@ -310,7 +310,7 @@ StyledWriter::writeValue(Value const& value)
             {
                 writeWithIndent("{");
                 indent();
-                Value::Members::iterator it = members.begin();
+                auto it = members.begin();
 
                 while (true)
                 {
@@ -545,7 +545,7 @@ StyledStreamWriter::writeValue(Value const& value)
             {
                 writeWithIndent("{");
                 indent();
-                Value::Members::iterator it = members.begin();
+                auto it = members.begin();
 
                 while (true)
                 {
diff --git a/src/libxrpl/nodestore/DecodedBlob.cpp b/src/libxrpl/nodestore/DecodedBlob.cpp
index fb7569bd8c..fe07252f23 100644
--- a/src/libxrpl/nodestore/DecodedBlob.cpp
+++ b/src/libxrpl/nodestore/DecodedBlob.cpp
@@ -33,7 +33,7 @@ DecodedBlob::DecodedBlob(void const* key, void const* value, int valueBytes)
 
     if (valueBytes > 8)
     {
-        unsigned char const* byte = static_cast<unsigned char const*>(value);
+        auto const* byte = static_cast<unsigned char const*>(value);
         objectType_ = safeCast<NodeObjectType>(byte[8]);
     }
 
diff --git a/src/libxrpl/nodestore/backend/MemoryFactory.cpp b/src/libxrpl/nodestore/backend/MemoryFactory.cpp
index 70578c8613..22557d652e 100644
--- a/src/libxrpl/nodestore/backend/MemoryFactory.cpp
+++ b/src/libxrpl/nodestore/backend/MemoryFactory.cpp
@@ -136,7 +136,7 @@ public:
 
         std::scoped_lock const _(db_->mutex);
 
-        Map::iterator const iter = db_->table.find(hash);
+        auto const iter = db_->table.find(hash);
         if (iter == db_->table.end())
         {
             pObject->reset();
diff --git a/src/libxrpl/nodestore/backend/NuDBFactory.cpp b/src/libxrpl/nodestore/backend/NuDBFactory.cpp
index 749d4020b5..38ea34258f 100644
--- a/src/libxrpl/nodestore/backend/NuDBFactory.cpp
+++ b/src/libxrpl/nodestore/backend/NuDBFactory.cpp
@@ -367,7 +367,7 @@ private:
 
         try
         {
-            std::size_t const parsedBlockSize = beast::lexicalCastThrow<std::size_t>(blockSizeStr);
+            auto const parsedBlockSize = beast::lexicalCastThrow<std::size_t>(blockSizeStr);
 
             // Validate: must be power of 2 between 4K and 32K
             if (parsedBlockSize < 4096 || parsedBlockSize > 32768 ||
diff --git a/src/libxrpl/nodestore/backend/RocksDBFactory.cpp b/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
index 69a648f2f4..bcf4ba4a49 100644
--- a/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
+++ b/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
@@ -80,7 +80,7 @@ public:
     void
     StartThread(void (*f)(void*), void* a) override
     {
-        ThreadParams* const p(new ThreadParams(f, a));
+        auto* const p = new ThreadParams(f, a);
         EnvWrapper::StartThread(&RocksDBEnv::threadEntry, p);
     }
 };
diff --git a/src/libxrpl/protocol/IOUAmount.cpp b/src/libxrpl/protocol/IOUAmount.cpp
index acbf6724e1..111edbf8b5 100644
--- a/src/libxrpl/protocol/IOUAmount.cpp
+++ b/src/libxrpl/protocol/IOUAmount.cpp
@@ -181,7 +181,7 @@ mulRatio(IOUAmount const& amt, std::uint32_t num, std::uint32_t den, bool roundU
             hasRem = bool(sav - low * kPowerTable[mustShrink]);
     }
 
-    std::int64_t mantissa = low.convert_to<std::int64_t>();
+    auto mantissa = low.convert_to<std::int64_t>();
 
     // normalize before rounding
     if (neg)
diff --git a/src/libxrpl/protocol/MPTIssue.cpp b/src/libxrpl/protocol/MPTIssue.cpp
index e9ec852d1d..35ee743b2a 100644
--- a/src/libxrpl/protocol/MPTIssue.cpp
+++ b/src/libxrpl/protocol/MPTIssue.cpp
@@ -31,8 +31,7 @@ MPTIssue::getIssuer() const
     // MPTID is concatenation of sequence + account
     static_assert(sizeof(MPTID) == (sizeof(std::uint32_t) + sizeof(AccountID)));
     // copy from id skipping the sequence
-    AccountID const* account =
-        reinterpret_cast<AccountID const*>(mptID_.data() + sizeof(std::uint32_t));
+    auto const* account = reinterpret_cast<AccountID const*>(mptID_.data() + sizeof(std::uint32_t));
 
     return *account;
 }
diff --git a/src/libxrpl/protocol/NFTokenID.cpp b/src/libxrpl/protocol/NFTokenID.cpp
index cd2c46b66b..729f052101 100644
--- a/src/libxrpl/protocol/NFTokenID.cpp
+++ b/src/libxrpl/protocol/NFTokenID.cpp
@@ -72,8 +72,7 @@ getNFTokenIDFromPage(TxMeta const& transactionMeta)
             // However, there will always be NFTs listed in the final fields,
             // as xrpld outputs all fields in final fields even if they were
             // not changed.
-            STObject const& previousFields =
-                node.peekAtField(sfPreviousFields).downcast<STObject>();
+            auto const& previousFields = node.peekAtField(sfPreviousFields).downcast<STObject>();
             if (!previousFields.isFieldPresent(sfNFTokens))
                 continue;
 
diff --git a/src/libxrpl/protocol/STAmount.cpp b/src/libxrpl/protocol/STAmount.cpp
index 748d00f25a..212c34322b 100644
--- a/src/libxrpl/protocol/STAmount.cpp
+++ b/src/libxrpl/protocol/STAmount.cpp
@@ -789,7 +789,7 @@ STAmount::add(Serializer& s) const
 bool
 STAmount::isEquivalent(STBase const& t) const
 {
-    STAmount const* v = dynamic_cast<STAmount const*>(&t);
+    auto const* v = dynamic_cast<STAmount const*>(&t);
     return (v != nullptr) && (*v == *this);
 }
 
diff --git a/src/libxrpl/protocol/STBlob.cpp b/src/libxrpl/protocol/STBlob.cpp
index 3f44c9b529..14d09b633c 100644
--- a/src/libxrpl/protocol/STBlob.cpp
+++ b/src/libxrpl/protocol/STBlob.cpp
@@ -53,7 +53,7 @@ STBlob::add(Serializer& s) const
 bool
 STBlob::isEquivalent(STBase const& t) const
 {
-    STBlob const* v = dynamic_cast<STBlob const*>(&t);
+    auto const* v = dynamic_cast<STBlob const*>(&t);
     return (v != nullptr) && (value_ == v->value_);
 }
 
diff --git a/src/libxrpl/protocol/STCurrency.cpp b/src/libxrpl/protocol/STCurrency.cpp
index 9b761864d9..fc8bd756ed 100644
--- a/src/libxrpl/protocol/STCurrency.cpp
+++ b/src/libxrpl/protocol/STCurrency.cpp
@@ -56,7 +56,7 @@ STCurrency::add(Serializer& s) const
 bool
 STCurrency::isEquivalent(STBase const& t) const
 {
-    STCurrency const* v = dynamic_cast<STCurrency const*>(&t);
+    auto const* v = dynamic_cast<STCurrency const*>(&t);
     return (v != nullptr) && (*v == *this);
 }
 
diff --git a/src/libxrpl/protocol/STIssue.cpp b/src/libxrpl/protocol/STIssue.cpp
index c9b8109e32..10403d2c50 100644
--- a/src/libxrpl/protocol/STIssue.cpp
+++ b/src/libxrpl/protocol/STIssue.cpp
@@ -107,7 +107,7 @@ STIssue::add(Serializer& s) const
 bool
 STIssue::isEquivalent(STBase const& t) const
 {
-    STIssue const* v = dynamic_cast<STIssue const*>(&t);
+    auto const* v = dynamic_cast<STIssue const*>(&t);
     return (v != nullptr) && (*v == *this);
 }
 
diff --git a/src/libxrpl/protocol/STNumber.cpp b/src/libxrpl/protocol/STNumber.cpp
index fcc0077f6b..79f7655869 100644
--- a/src/libxrpl/protocol/STNumber.cpp
+++ b/src/libxrpl/protocol/STNumber.cpp
@@ -142,7 +142,7 @@ STNumber::isEquivalent(STBase const& t) const
 {
     XRPL_ASSERT(
         t.getSType() == this->getSType(), "xrpl::STNumber::isEquivalent : field type match");
-    STNumber const& v = dynamic_cast<STNumber const&>(t);
+    auto const& v = dynamic_cast<STNumber const&>(t);
     return value_ == v;
 }
 
diff --git a/src/libxrpl/protocol/STObject.cpp b/src/libxrpl/protocol/STObject.cpp
index c493ba65af..ea8553dc4f 100644
--- a/src/libxrpl/protocol/STObject.cpp
+++ b/src/libxrpl/protocol/STObject.cpp
@@ -338,7 +338,7 @@ STObject::getText() const
 bool
 STObject::isEquivalent(STBase const& t) const
 {
-    STObject const* v = dynamic_cast<STObject const*>(&t);
+    auto const* v = dynamic_cast<STObject const*>(&t);
 
     if (v == nullptr)
         return false;
@@ -474,7 +474,7 @@ STObject::peekFieldArray(SField const& field)
 bool
 STObject::setFlag(std::uint32_t f)
 {
-    STUInt32* t = dynamic_cast<STUInt32*>(getPField(sfFlags, true));
+    auto* t = dynamic_cast<STUInt32*>(getPField(sfFlags, true));
 
     if (t == nullptr)
         return false;
@@ -486,7 +486,7 @@ STObject::setFlag(std::uint32_t f)
 bool
 STObject::clearFlag(std::uint32_t f)
 {
-    STUInt32* t = dynamic_cast<STUInt32*>(getPField(sfFlags));
+    auto* t = dynamic_cast<STUInt32*>(getPField(sfFlags));
 
     if (t == nullptr)
         return false;
@@ -504,7 +504,7 @@ STObject::isFlag(std::uint32_t f) const
 std::uint32_t
 STObject::getFlags(void) const
 {
-    STUInt32 const* t = dynamic_cast<STUInt32 const*>(peekAtPField(sfFlags));
+    auto const* t = dynamic_cast<STUInt32 const*>(peekAtPField(sfFlags));
 
     if (t == nullptr)
         return 0;
@@ -651,7 +651,7 @@ Blob
 STObject::getFieldVL(SField const& field) const
 {
     STBlob const empty;
-    STBlob const& b = getFieldByConstRef<STBlob>(field, empty);
+    auto const& b = getFieldByConstRef<STBlob>(field, empty);
     return Blob(b.data(), b.data() + b.size());
 }
 
diff --git a/src/libxrpl/protocol/STPathSet.cpp b/src/libxrpl/protocol/STPathSet.cpp
index cb70ac36fe..d61f17ecc6 100644
--- a/src/libxrpl/protocol/STPathSet.cpp
+++ b/src/libxrpl/protocol/STPathSet.cpp
@@ -127,7 +127,7 @@ STPathSet::assembleAdd(STPath const& base, STPathElement const& tail)
 {  // assemble base+tail and add it to the set if it's not a duplicate
     value_.push_back(base);
 
-    std::vector<STPath>::reverse_iterator it = value_.rbegin();
+    auto it = value_.rbegin();
 
     STPath& newPath = *it;
     newPath.pushBack(tail);
@@ -146,7 +146,7 @@ STPathSet::assembleAdd(STPath const& base, STPathElement const& tail)
 bool
 STPathSet::isEquivalent(STBase const& t) const
 {
-    STPathSet const* v = dynamic_cast<STPathSet const*>(&t);
+    auto const* v = dynamic_cast<STPathSet const*>(&t);
     return (v != nullptr) && (value_ == v->value_);
 }
 
diff --git a/src/libxrpl/protocol/STVector256.cpp b/src/libxrpl/protocol/STVector256.cpp
index 7aca309667..877e34c73c 100644
--- a/src/libxrpl/protocol/STVector256.cpp
+++ b/src/libxrpl/protocol/STVector256.cpp
@@ -68,7 +68,7 @@ STVector256::add(Serializer& s) const
 bool
 STVector256::isEquivalent(STBase const& t) const
 {
-    STVector256 const* v = dynamic_cast<STVector256 const*>(&t);
+    auto const* v = dynamic_cast<STVector256 const*>(&t);
     return (v != nullptr) && (value_ == v->value_);
 }
 
diff --git a/src/libxrpl/protocol/STXChainBridge.cpp b/src/libxrpl/protocol/STXChainBridge.cpp
index ce6ad2368a..005c9ccbce 100644
--- a/src/libxrpl/protocol/STXChainBridge.cpp
+++ b/src/libxrpl/protocol/STXChainBridge.cpp
@@ -168,7 +168,7 @@ STXChainBridge::getSType() const
 bool
 STXChainBridge::isEquivalent(STBase const& t) const
 {
-    STXChainBridge const* v = dynamic_cast<STXChainBridge const*>(&t);
+    auto const* v = dynamic_cast<STXChainBridge const*>(&t);
     return (v != nullptr) && (*v == *this);
 }
 
diff --git a/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp b/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
index 0d83885349..531098bd1c 100644
--- a/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
+++ b/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
@@ -194,7 +194,7 @@ escrowCreatePreclaimHelper<Issue>(
     AccountID const& dest,
     STAmount const& amount)
 {
-    Issue const& issue = amount.get<Issue>();
+    auto const& issue = amount.get<Issue>();
     AccountID const& issuer = amount.getIssuer();
     // If the issuer is the same as the account, return tecNO_PERMISSION
     if (issuer == account)
diff --git a/src/test/app/ConfidentialTransfer_test.cpp b/src/test/app/ConfidentialTransfer_test.cpp
index e6faf0a2ae..d3e0182db5 100644
--- a/src/test/app/ConfidentialTransfer_test.cpp
+++ b/src/test/app/ConfidentialTransfer_test.cpp
@@ -6920,7 +6920,7 @@ class ConfidentialTransfer_test : public ConfidentialTransferTestBase
         auto& mptAlice = confEnv.mpt;
 
         uint64_t const sendAmount = 10;
-        uint64_t const negativeRemaining = static_cast<uint64_t>(-10);  // 0xFFFFFFFFFFFFFFF6
+        auto const negativeRemaining = static_cast<uint64_t>(-10);  // 0xFFFFFFFFFFFFFFF6
 
         ConfidentialSendSetup const setup(mptAlice, bob, carol, alice, sendAmount);
 
diff --git a/src/test/app/Loan_test.cpp b/src/test/app/Loan_test.cpp
index 56a7cab47a..3e62af48ff 100644
--- a/src/test/app/Loan_test.cpp
+++ b/src/test/app/Loan_test.cpp
@@ -8651,7 +8651,7 @@ protected:
         Account const borrower("borrower");
 
         // Determine all the random parameters at once
-        AssetType const assetType = static_cast<AssetType>(assetDist_(engine_));
+        auto const assetType = static_cast<AssetType>(assetDist_(engine_));
         auto const principalRequest = principalDist_(engine_);
         TenthBips16 const managementFeeRate{managementFeeRateDist_(engine_)};
         auto const serviceFee = serviceFeeDist_(engine_);
diff --git a/src/test/app/Offer_test.cpp b/src/test/app/Offer_test.cpp
index 804bd9b86c..2724a6474b 100644
--- a/src/test/app/Offer_test.cpp
+++ b/src/test/app/Offer_test.cpp
@@ -2195,7 +2195,7 @@ public:
         jtx::Account const& account,
         jtx::PrettyAmount const& expectBalance)
     {
-        Issue const& issue = expectBalance.value().get<Issue>();
+        auto const& issue = expectBalance.value().get<Issue>();
         auto const sleTrust = env.le(keylet::trustLine(account.id(), issue));
         BEAST_EXPECT(sleTrust);
         if (sleTrust)
diff --git a/src/test/beast/LexicalCast_test.cpp b/src/test/beast/LexicalCast_test.cpp
index f988aa03cf..b1d37daab8 100644
--- a/src/test/beast/LexicalCast_test.cpp
+++ b/src/test/beast/LexicalCast_test.cpp
@@ -24,7 +24,7 @@ public:
     testInteger(IntType in)
     {
         std::string s;
-        IntType out = static_cast<IntType>(~in);  // Ensure out != in
+        auto out = static_cast<IntType>(~in);  // Ensure out != in
 
         expect(lexicalCastChecked(s, in));
         expect(lexicalCastChecked(out, s));
@@ -42,7 +42,7 @@ public:
 
             for (int i = 0; i < 1000; ++i)
             {
-                IntType const value(nextRandomInt<IntType>(r));
+                auto const value = nextRandomInt<IntType>(r);
                 testInteger(value);
             }
         }
@@ -229,7 +229,7 @@ public:
 
         while (i <= std::numeric_limits<std::int16_t>::max())
         {
-            std::int16_t const j = static_cast<std::int16_t>(i);
+            auto const j = static_cast<std::int16_t>(i);
 
             auto actual = std::to_string(j);
 
diff --git a/src/test/beast/aged_associative_container_test.cpp b/src/test/beast/aged_associative_container_test.cpp
index 3dbaf74040..df61824c99 100644
--- a/src/test/beast/aged_associative_container_test.cpp
+++ b/src/test/beast/aged_associative_container_test.cpp
@@ -1391,7 +1391,7 @@ AgedAssociativeContainerTestBase::reverseFillAgedContainer(Container& c, Values
     // c.clock() returns an abstract_clock, so dynamic_cast to ManualClock.
     // VFALCO NOTE This is sketchy
     using ManualClock = TestTraitsBase::ManualClock;
-    ManualClock& clk(dynamic_cast<ManualClock&>(c.clock()));
+    auto& clk = dynamic_cast<ManualClock&>(c.clock());
     clk.set(0);
 
     Values rev(values);
diff --git a/src/test/shamap/FetchPack_test.cpp b/src/test/shamap/FetchPack_test.cpp
index b2fc185b31..bcc5129f01 100644
--- a/src/test/shamap/FetchPack_test.cpp
+++ b/src/test/shamap/FetchPack_test.cpp
@@ -68,7 +68,7 @@ public:
         [[nodiscard]] std::optional<Blob>
         getNode(SHAMapHash const& nodeHash) const override
         {
-            Map::iterator const it = map.find(nodeHash);
+            auto const it = map.find(nodeHash);
             if (it == map.end())
             {
                 JLOG(journal.fatal()) << "Test filter missing node";
diff --git a/src/xrpld/app/consensus/RCLConsensus.cpp b/src/xrpld/app/consensus/RCLConsensus.cpp
index a7c2b26c04..2abc881adc 100644
--- a/src/xrpld/app/consensus/RCLConsensus.cpp
+++ b/src/xrpld/app/consensus/RCLConsensus.cpp
@@ -690,7 +690,7 @@ RCLConsensus::Adaptor::doAccept(
 
         JLOG(j_.info()) << "We closed at " << closeTime.time_since_epoch().count();
         using usec64_t = std::chrono::duration<std::uint64_t>;
-        usec64_t closeTotal = std::chrono::duration_cast<usec64_t>(closeTime.time_since_epoch());
+        auto closeTotal = std::chrono::duration_cast<usec64_t>(closeTime.time_since_epoch());
         int closeCount = 1;
 
         for (auto const& [t, v] : rawCloseTimes.peers)
diff --git a/src/xrpld/app/ledger/detail/InboundLedgers.cpp b/src/xrpld/app/ledger/detail/InboundLedgers.cpp
index 95e3e46f73..07daa7560e 100644
--- a/src/xrpld/app/ledger/detail/InboundLedgers.cpp
+++ b/src/xrpld/app/ledger/detail/InboundLedgers.cpp
@@ -378,7 +378,7 @@ public:
 
         {
             ScopedLockType const sl(lock_);
-            MapType::iterator it(ledgers_.begin());
+            auto it = ledgers_.begin();
             total = ledgers_.size();
 
             stuffToSweep.reserve(total);
diff --git a/src/xrpld/app/main/Application.cpp b/src/xrpld/app/main/Application.cpp
index 594195b93e..d329475874 100644
--- a/src/xrpld/app/main/Application.cpp
+++ b/src/xrpld/app/main/Application.cpp
@@ -2178,7 +2178,7 @@ fixConfigPorts(Config& config, Endpoints const& endpoints)
         auto const optPort = section.get(Keys::kPort);
         if (optPort)
         {
-            std::uint16_t const port = beast::lexicalCast<std::uint16_t>(*optPort);
+            auto const port = beast::lexicalCast<std::uint16_t>(*optPort);
             if (port == 0u)
                 section.set(Keys::kPort, std::to_string(ep.port()));
         }
diff --git a/src/xrpld/app/misc/NetworkOPs.cpp b/src/xrpld/app/misc/NetworkOPs.cpp
index 82445f3625..d1f794b74d 100644
--- a/src/xrpld/app/misc/NetworkOPs.cpp
+++ b/src/xrpld/app/misc/NetworkOPs.cpp
@@ -4392,7 +4392,7 @@ NetworkOPsImp::findRpcSub(std::string const& strUrl)
 {
     std::scoped_lock const sl(subLock_);
 
-    subRpcMapType::iterator const it = rpcSubMap_.find(strUrl);
+    auto const it = rpcSubMap_.find(strUrl);
 
     if (it != rpcSubMap_.end())
         return it->second;
@@ -4827,7 +4827,7 @@ NetworkOPsImp::StateAccounting::json(json::Value& obj) const
     counters[static_cast<std::size_t>(mode)].dur += current;
 
     obj[jss::state_accounting] = json::ValueType::Object;
-    for (std::size_t i = static_cast<std::size_t>(OperatingMode::DISCONNECTED);
+    for (auto i = static_cast<std::size_t>(OperatingMode::DISCONNECTED);
          i <= static_cast<std::size_t>(OperatingMode::FULL);
          ++i)
     {
diff --git a/src/xrpld/app/misc/detail/Transaction.cpp b/src/xrpld/app/misc/detail/Transaction.cpp
index 2c55c474eb..e29181bfe9 100644
--- a/src/xrpld/app/misc/detail/Transaction.cpp
+++ b/src/xrpld/app/misc/detail/Transaction.cpp
@@ -103,7 +103,7 @@ Transaction::transactionFromSQL(
     Blob const& rawTxn,
     Application& app)
 {
-    std::uint32_t const inLedger = rangeCheckedCast<std::uint32_t>(ledgerSeq.value_or(0));
+    auto const inLedger = rangeCheckedCast<std::uint32_t>(ledgerSeq.value_or(0));
 
     SerialIter it(makeSlice(rawTxn));
     auto txn = std::make_shared<STTx const>(it);
diff --git a/src/xrpld/app/misc/detail/TxQ.cpp b/src/xrpld/app/misc/detail/TxQ.cpp
index 5d1020d296..f6d00974b4 100644
--- a/src/xrpld/app/misc/detail/TxQ.cpp
+++ b/src/xrpld/app/misc/detail/TxQ.cpp
@@ -788,7 +788,7 @@ TxQ::apply(
     std::scoped_lock const lock(mutex_);
 
     // accountIter is not const because it may be updated further down.
-    AccountMap::iterator accountIter = byAccount_.find(account);
+    auto accountIter = byAccount_.find(account);
     bool const accountIsInQueue = accountIter != byAccount_.end();
 
     // _If_ the account is in the queue, then ignore any sequence-based
@@ -817,7 +817,7 @@ TxQ::apply(
 
         // Find the first transaction in the queue that we might apply.
         TxQAccount::TxMap& acctTxs = accountIter->second.transactions;
-        TxQAccount::TxMap::iterator const firstIter = acctTxs.lower_bound(acctSeqProx);
+        auto const firstIter = acctTxs.lower_bound(acctSeqProx);
 
         if (firstIter == acctTxs.end())
         {
@@ -996,7 +996,7 @@ TxQ::apply(
 
             // Find the entry in the queue that precedes the new
             // transaction, if one does.
-            TxQAccount::TxMap::const_iterator const prevIter = txQAcct.getPrevTx(txSeqProx);
+            auto const prevIter = txQAcct.getPrevTx(txSeqProx);
 
             // Does the new transaction go to the front of the queue?
             // This can happen if:
@@ -1615,7 +1615,7 @@ TxQ::nextQueuableSeqImpl(SLE::const_ref sleAccount, std::scoped_lock<std::mutex>
     // Ignore any sequence-based queued transactions that slipped into the
     // ledger while we were not watching.  This does actually happen in the
     // wild, but it's uncommon.
-    TxQAccount::TxMap::const_iterator txIter = acctTxs.lower_bound(acctSeqProx);
+    auto txIter = acctTxs.lower_bound(acctSeqProx);
 
     if (txIter == acctTxs.end() || !txIter->first.isSeq() || txIter->first != acctSeqProx)
     {
@@ -1700,7 +1700,7 @@ TxQ::tryDirectApply(
             // queue then remove the replaced transaction.
             std::scoped_lock const lock(mutex_);
 
-            AccountMap::iterator const accountIter = byAccount_.find(account);
+            auto const accountIter = byAccount_.find(account);
             if (accountIter != byAccount_.end())
             {
                 TxQAccount& txQAcct = accountIter->second;
diff --git a/src/xrpld/app/rdb/backend/detail/Node.cpp b/src/xrpld/app/rdb/backend/detail/Node.cpp
index 6e92a0de60..f8dc4a6981 100644
--- a/src/xrpld/app/rdb/backend/detail/Node.cpp
+++ b/src/xrpld/app/rdb/backend/detail/Node.cpp
@@ -1273,7 +1273,7 @@ getTransaction(
         if (!ledgerSeq)
             return std::pair{std::move(txn), nullptr};
 
-        std::uint32_t const inLedger = rangeCheckedCast<std::uint32_t>(ledgerSeq.value());
+        auto const inLedger = rangeCheckedCast<std::uint32_t>(ledgerSeq.value());
 
         auto txMeta = std::make_shared<TxMeta>(id, inLedger, rawMeta);
 
diff --git a/src/xrpld/core/detail/Config.cpp b/src/xrpld/core/detail/Config.cpp
index 523cde743a..07c780118a 100644
--- a/src/xrpld/core/detail/Config.cpp
+++ b/src/xrpld/core/detail/Config.cpp
@@ -926,7 +926,7 @@ Config::loadFromString(std::string const& fileContents)
                 ", must be: [0-9]+ [minutes|hours|days|weeks]");
         }
 
-        std::uint32_t const duration = beast::lexicalCastThrow<std::uint32_t>(match[1].str());
+        auto const duration = beast::lexicalCastThrow<std::uint32_t>(match[1].str());
 
         if (boost::iequals(match[2], "minutes"))
         {
diff --git a/src/xrpld/rpc/CTID.h b/src/xrpld/rpc/CTID.h
index c2133a19b5..7566e0e143 100644
--- a/src/xrpld/rpc/CTID.h
+++ b/src/xrpld/rpc/CTID.h
@@ -104,9 +104,9 @@ decodeCTID(T const ctid) noexcept
     if ((ctidValue & kCtidPrefixMask) != kCtidPrefix)
         return std::nullopt;
 
-    uint32_t const ledgerSeq = static_cast<uint32_t>((ctidValue >> 32) & 0x0FFF'FFFF);
-    uint16_t const txnIndex = static_cast<uint16_t>((ctidValue >> 16) & 0xFFFF);
-    uint16_t const networkID = static_cast<uint16_t>(ctidValue & 0xFFFF);
+    auto const ledgerSeq = static_cast<uint32_t>((ctidValue >> 32) & 0x0FFF'FFFF);
+    auto const txnIndex = static_cast<uint16_t>((ctidValue >> 16) & 0xFFFF);
+    auto const networkID = static_cast<uint16_t>(ctidValue & 0xFFFF);
 
     return std::make_tuple(ledgerSeq, txnIndex, networkID);
 }
diff --git a/src/xrpld/rpc/handlers/orderbook/BookOffers.cpp b/src/xrpld/rpc/handlers/orderbook/BookOffers.cpp
index 5d031c2c74..63dee76f1b 100644
--- a/src/xrpld/rpc/handlers/orderbook/BookOffers.cpp
+++ b/src/xrpld/rpc/handlers/orderbook/BookOffers.cpp
@@ -107,7 +107,7 @@ parseTakerIssuerJSON(
 
     if (taker.isMember(jss::currency))
     {
-        Issue& issue = asset.get<Issue>();
+        auto& issue = asset.get<Issue>();
 
         if (taker.isMember(jss::issuer))
         {

From f151293e8a87d192ed1e4f3c95d9782c602a2efb Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Fri, 3 Jul 2026 12:17:03 +0100
Subject: [PATCH 044/100] chore: Enable modernize-avoid-bind (#7711)

---
 .clang-tidy                                   |  1 -
 include/xrpl/basics/TaggedCache.ipp           |  5 +-
 include/xrpl/beast/unit_test/thread.h         |  5 +-
 include/xrpl/net/AutoSocket.h                 |  9 +-
 include/xrpl/net/HTTPClientSSLContext.h       |  6 +-
 include/xrpl/server/detail/BaseHTTPPeer.h     | 74 +++++---------
 include/xrpl/server/detail/BasePeer.h         |  3 +-
 include/xrpl/server/detail/BaseWSPeer.h       | 66 ++++++-------
 include/xrpl/server/detail/Door.h             |  9 +-
 include/xrpl/server/detail/PlainHTTPPeer.h    | 10 +-
 include/xrpl/server/detail/SSLHTTPPeer.h      | 18 ++--
 src/libxrpl/basics/ResolverAsio.cpp           | 34 +++----
 src/libxrpl/beast/insight/StatsDCollector.cpp | 63 +++++-------
 src/libxrpl/core/detail/JobQueue.cpp          |  3 +-
 src/libxrpl/net/HTTPClient.cpp                | 69 +++++++------
 src/test/jtx/impl/WSClient.cpp                | 13 +--
 src/test/overlay/short_read_test.cpp          | 99 +++++++++----------
 src/test/resource/Logic_test.cpp              |  8 +-
 src/test/rpc/AccountTx_test.cpp               |  3 +-
 src/test/rpc/LedgerRequest_test.cpp           |  3 +-
 src/test/rpc/RPCCall_test.cpp                 |  3 +-
 src/test/rpc/TransactionEntry_test.cpp        |  3 +-
 src/test/rpc/Transaction_test.cpp             |  6 +-
 src/test/shamap/FetchPack_test.cpp            | 96 ++++++++----------
 src/xrpld/app/ledger/detail/LedgerMaster.cpp  |  2 +-
 src/xrpld/app/misc/NetworkOPs.cpp             |  2 +-
 src/xrpld/app/misc/SHAMapStoreImp.cpp         |  8 +-
 src/xrpld/app/misc/detail/WorkBase.h          | 38 +++----
 src/xrpld/app/misc/detail/WorkFile.h          |  6 +-
 src/xrpld/app/misc/detail/WorkSSL.cpp         |  3 +-
 .../app/rdb/backend/detail/SQLiteDatabase.cpp | 20 ++--
 src/xrpld/overlay/detail/ConnectAttempt.cpp   | 20 ++--
 src/xrpld/overlay/detail/OverlayImpl.cpp      | 10 +-
 src/xrpld/overlay/detail/OverlayImpl.h        |  2 +-
 src/xrpld/overlay/detail/PeerImp.cpp          | 28 +++---
 src/xrpld/peerfinder/detail/Checker.h         |  3 +-
 src/xrpld/peerfinder/detail/Logic.h           | 10 +-
 .../peerfinder/detail/PeerfinderManager.cpp   |  3 +-
 src/xrpld/rpc/detail/Pathfinder.cpp           |  9 +-
 src/xrpld/rpc/detail/RPCCall.cpp              | 28 +++---
 40 files changed, 356 insertions(+), 445 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index 6a24cbc8d3..c5f638b395 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -64,7 +64,6 @@ Checks: "-*,
   -misc-use-internal-linkage,
 
   modernize-*,
-  -modernize-avoid-bind,
   -modernize-avoid-c-arrays,
   -modernize-avoid-c-style-cast,
   -modernize-avoid-setjmp-longjmp,
diff --git a/include/xrpl/basics/TaggedCache.ipp b/include/xrpl/basics/TaggedCache.ipp
index ffcd533216..ca50bb64b7 100644
--- a/include/xrpl/basics/TaggedCache.ipp
+++ b/include/xrpl/basics/TaggedCache.ipp
@@ -57,7 +57,10 @@ inline TaggedCache<
         beast::insight::Collector::ptr const& collector)
     : journal_(journal)
     , clock_(clock)
-    , stats_(name, std::bind(&TaggedCache::collectMetrics, this), collector)
+    , stats_(
+          name,
+          [this] { collectMetrics(); },
+          collector)
     , name_(name)
     , targetSize_(size)
     , targetAge_(expiration)
diff --git a/include/xrpl/beast/unit_test/thread.h b/include/xrpl/beast/unit_test/thread.h
index 0de039cb89..91d8cf3cab 100644
--- a/include/xrpl/beast/unit_test/thread.h
+++ b/include/xrpl/beast/unit_test/thread.h
@@ -45,7 +45,10 @@ public:
     template <class F, class... Args>
     explicit Thread(Suite& s, F&& f, Args&&... args) : s_(&s)
     {
-        std::function<void(void)> b = std::bind(std::forward<F>(f), std::forward<Args>(args)...);
+        std::function<void(void)> b = [f = std::forward<F>(f),
+                                       ... args = std::forward<Args>(args)]() mutable {
+            std::invoke(f, args...);
+        };
         t_ = std::thread(&Thread::run, this, std::move(b));
     }
 
diff --git a/include/xrpl/net/AutoSocket.h b/include/xrpl/net/AutoSocket.h
index 72eaed7439..b98885959d 100644
--- a/include/xrpl/net/AutoSocket.h
+++ b/include/xrpl/net/AutoSocket.h
@@ -120,12 +120,9 @@ public:
             socket_->next_layer().async_receive(
                 boost::asio::buffer(buffer_),
                 boost::asio::socket_base::message_peek,
-                std::bind(
-                    &AutoSocket::handleAutodetect,
-                    this,
-                    cbFunc,
-                    std::placeholders::_1,
-                    std::placeholders::_2));
+                [this, cbFunc](error_code const& ec, size_t bytesTransferred) {
+                    handleAutodetect(cbFunc, ec, bytesTransferred);
+                });
         }
     }
 
diff --git a/include/xrpl/net/HTTPClientSSLContext.h b/include/xrpl/net/HTTPClientSSLContext.h
index 4192455ec9..2b26d7e404 100644
--- a/include/xrpl/net/HTTPClientSSLContext.h
+++ b/include/xrpl/net/HTTPClientSSLContext.h
@@ -13,7 +13,6 @@
 #include <openssl/err.h>
 #include <openssl/tls1.h>
 
-#include <functional>
 #include <stdexcept>
 #include <string>
 #include <type_traits>
@@ -127,8 +126,9 @@ public:
             if (!ec)
             {
                 strm.set_verify_callback(
-                    std::bind(
-                        &rfc6125Verify, host, std::placeholders::_1, std::placeholders::_2, j_),
+                    [host, j = j_](bool preverified, boost::asio::ssl::verify_context& ctx) {
+                        return rfc6125Verify(host, preverified, ctx, j);
+                    },
                     ec);
             }
         }
diff --git a/include/xrpl/server/detail/BaseHTTPPeer.h b/include/xrpl/server/detail/BaseHTTPPeer.h
index f096d3c5a9..7b35dbd4be 100644
--- a/include/xrpl/server/detail/BaseHTTPPeer.h
+++ b/include/xrpl/server/detail/BaseHTTPPeer.h
@@ -223,10 +223,7 @@ BaseHTTPPeer<Handler, Impl>::close()
 {
     if (!strand_.running_in_this_thread())
     {
-        return post(
-            strand_,
-            std::bind(
-                (void (BaseHTTPPeer::*)(void))&BaseHTTPPeer::close, impl().shared_from_this()));
+        return post(strand_, [self = impl().shared_from_this()] { self->close(); });
     }
     boost::beast::get_lowest_layer(impl().stream_).close();
 }
@@ -322,22 +319,18 @@ BaseHTTPPeer<Handler, Impl>::onWrite(error_code const& ec, std::size_t bytesTran
             v,
             bind_executor(
                 strand_,
-                std::bind(
-                    &BaseHTTPPeer::onWrite,
-                    impl().shared_from_this(),
-                    std::placeholders::_1,
-                    std::placeholders::_2)));
+                [self = impl().shared_from_this()](
+                    error_code const& ec, std::size_t bytesTransferred) {
+                    self->onWrite(ec, bytesTransferred);
+                }));
     }
     if (!complete_)
         return;
     if (graceful_)
         return doClose();
-    util::spawn(
-        strand_,
-        std::bind(
-            &BaseHTTPPeer<Handler, Impl>::doRead,
-            impl().shared_from_this(),
-            std::placeholders::_1));
+    util::spawn(strand_, [self = impl().shared_from_this()](yield_context doYield) {
+        self->doRead(doYield);
+    });
 }
 
 template <class Handler, class Impl>
@@ -351,14 +344,9 @@ BaseHTTPPeer<Handler, Impl>::doWriter(
     {
         auto const p = impl().shared_from_this();
         resume = std::function<void(void)>([this, p, writer, keepAlive]() {
-            util::spawn(
-                strand_,
-                std::bind(
-                    &BaseHTTPPeer<Handler, Impl>::doWriter,
-                    p,
-                    writer,
-                    keepAlive,
-                    std::placeholders::_1));
+            util::spawn(strand_, [p, writer, keepAlive](yield_context doYield) {
+                p->doWriter(writer, keepAlive, doYield);
+            });
         });
     }
 
@@ -379,12 +367,9 @@ BaseHTTPPeer<Handler, Impl>::doWriter(
     if (!keepAlive)
         return doClose();
 
-    util::spawn(
-        strand_,
-        std::bind(
-            &BaseHTTPPeer<Handler, Impl>::doRead,
-            impl().shared_from_this(),
-            std::placeholders::_1));
+    util::spawn(strand_, [self = impl().shared_from_this()](yield_context doYield) {
+        self->doRead(doYield);
+    });
 }
 
 //------------------------------------------------------------------------------
@@ -405,8 +390,7 @@ BaseHTTPPeer<Handler, Impl>::write(void const* buf, std::size_t bytes)
         if (!strand_.running_in_this_thread())
         {
             return post(
-                strand_,
-                std::bind(&BaseHTTPPeer::onWrite, impl().shared_from_this(), error_code{}, 0));
+                strand_, [self = impl().shared_from_this()] { self->onWrite(error_code{}, 0); });
         }
         return onWrite(error_code{}, 0);
     }
@@ -417,13 +401,9 @@ void
 BaseHTTPPeer<Handler, Impl>::write(std::shared_ptr<Writer> const& writer, bool keepAlive)
 {
     util::spawn(
-        strand_,
-        std::bind(
-            &BaseHTTPPeer<Handler, Impl>::doWriter,
-            impl().shared_from_this(),
-            writer,
-            keepAlive,
-            std::placeholders::_1));
+        strand_, [self = impl().shared_from_this(), writer, keepAlive](yield_context doYield) {
+            self->doWriter(writer, keepAlive, doYield);
+        });
 }
 
 // DEPRECATED
@@ -443,8 +423,7 @@ BaseHTTPPeer<Handler, Impl>::complete()
 {
     if (!strand_.running_in_this_thread())
     {
-        return post(
-            strand_, std::bind(&BaseHTTPPeer<Handler, Impl>::complete, impl().shared_from_this()));
+        return post(strand_, [self = impl().shared_from_this()] { self->complete(); });
     }
 
     message_ = {};
@@ -457,12 +436,9 @@ BaseHTTPPeer<Handler, Impl>::complete()
     }
 
     // keep-alive
-    util::spawn(
-        strand_,
-        std::bind(
-            &BaseHTTPPeer<Handler, Impl>::doRead,
-            impl().shared_from_this(),
-            std::placeholders::_1));
+    util::spawn(strand_, [self = impl().shared_from_this()](yield_context doYield) {
+        self->doRead(doYield);
+    });
 }
 
 // DEPRECATED
@@ -474,11 +450,7 @@ BaseHTTPPeer<Handler, Impl>::close(bool graceful)
     if (!strand_.running_in_this_thread())
     {
         return post(
-            strand_,
-            std::bind(
-                (void (BaseHTTPPeer::*)(bool))&BaseHTTPPeer<Handler, Impl>::close,
-                impl().shared_from_this(),
-                graceful));
+            strand_, [self = impl().shared_from_this(), graceful] { self->close(graceful); });
     }
 
     complete_ = true;
diff --git a/include/xrpl/server/detail/BasePeer.h b/include/xrpl/server/detail/BasePeer.h
index 5301a2f018..84aa1e0da9 100644
--- a/include/xrpl/server/detail/BasePeer.h
+++ b/include/xrpl/server/detail/BasePeer.h
@@ -10,7 +10,6 @@
 
 #include <atomic>
 #include <chrono>
-#include <functional>
 #include <string>
 #include <utility>
 
@@ -84,7 +83,7 @@ void
 BasePeer<Handler, Impl>::close()
 {
     if (!strand_.running_in_this_thread())
-        return post(strand_, std::bind(&BasePeer::close, impl().shared_from_this()));
+        return post(strand_, [self = impl().shared_from_this()] { self->close(); });
     error_code ec;
     xrpl::getLowestLayer(impl().ws_).socket().close(ec);
 }
diff --git a/include/xrpl/server/detail/BaseWSPeer.h b/include/xrpl/server/detail/BaseWSPeer.h
index 1b6a9faca3..d557140bd4 100644
--- a/include/xrpl/server/detail/BaseWSPeer.h
+++ b/include/xrpl/server/detail/BaseWSPeer.h
@@ -20,6 +20,7 @@
 
 #include <algorithm>
 #include <chrono>
+#include <cstddef>
 #include <functional>
 #include <iterator>
 #include <list>
@@ -180,12 +181,13 @@ void
 BaseWSPeer<Handler, Impl>::run()
 {
     if (!strand_.running_in_this_thread())
-        return post(strand_, std::bind(&BaseWSPeer::run, impl().shared_from_this()));
+        return post(strand_, [self = impl().shared_from_this()] { self->run(); });
     impl().ws_.set_option(port().pmdOptions);
     // Must manage the control callback memory outside of the `control_callback`
     // function
-    controlCallback_ =
-        std::bind(&BaseWSPeer::onPingPong, this, std::placeholders::_1, std::placeholders::_2);
+    controlCallback_ = [this](
+                           boost::beast::websocket::frame_type kind,
+                           boost::beast::string_view payload) { onPingPong(kind, payload); };
     impl().ws_.control_callback(controlCallback_);
     startTimer();
     closeOnTimer_ = true;
@@ -193,11 +195,9 @@ BaseWSPeer<Handler, Impl>::run()
         res.set(boost::beast::http::field::server, BuildInfo::getFullVersionString());
     }));
     impl().ws_.async_accept(
-        request_,
-        bind_executor(
-            strand_,
-            std::bind(
-                &BaseWSPeer::onWsHandshake, impl().shared_from_this(), std::placeholders::_1)));
+        request_, bind_executor(strand_, [self = impl().shared_from_this()](error_code const& ec) {
+            self->onWsHandshake(ec);
+        }));
 }
 
 template <class Handler, class Impl>
@@ -205,7 +205,10 @@ void
 BaseWSPeer<Handler, Impl>::send(std::shared_ptr<WSMsg> w)
 {
     if (!strand_.running_in_this_thread())
-        return post(strand_, std::bind(&BaseWSPeer::send, impl().shared_from_this(), std::move(w)));
+    {
+        return post(
+            strand_, [self = impl().shared_from_this(), w = std::move(w)] { self->send(w); });
+    }
     if (doClose_)
         return;
     if (wq_.size() > port().wsQueueLimit)
@@ -258,7 +261,7 @@ void
 BaseWSPeer<Handler, Impl>::complete()
 {
     if (!strand_.running_in_this_thread())
-        return post(strand_, std::bind(&BaseWSPeer::complete, impl().shared_from_this()));
+        return post(strand_, [self = impl().shared_from_this()] { self->complete(); });
     doRead();
 }
 
@@ -277,7 +280,7 @@ void
 BaseWSPeer<Handler, Impl>::doWrite()
 {
     if (!strand_.running_in_this_thread())
-        return post(strand_, std::bind(&BaseWSPeer::doWrite, impl().shared_from_this()));
+        return post(strand_, [self = impl().shared_from_this()] { self->doWrite(); });
     onWrite({});
 }
 
@@ -288,8 +291,7 @@ BaseWSPeer<Handler, Impl>::onWrite(error_code const& ec)
     if (ec)
         return fail(ec, "write");
     auto& w = *wq_.front();
-    auto const result =
-        w.prepare(65536, std::bind(&BaseWSPeer::doWrite, impl().shared_from_this()));
+    auto const result = w.prepare(65536, [self = impl().shared_from_this()] { self->doWrite(); });
     if (boost::indeterminate(result.first))
         return;
     startTimer();
@@ -299,8 +301,9 @@ BaseWSPeer<Handler, Impl>::onWrite(error_code const& ec)
             static_cast<bool>(result.first),
             result.second,
             bind_executor(
-                strand_,
-                std::bind(&BaseWSPeer::onWrite, impl().shared_from_this(), std::placeholders::_1)));
+                strand_, [self = impl().shared_from_this()](error_code const& ec, std::size_t) {
+                    self->onWrite(ec);
+                }));
     }
     else
     {
@@ -308,9 +311,9 @@ BaseWSPeer<Handler, Impl>::onWrite(error_code const& ec)
             static_cast<bool>(result.first),
             result.second,
             bind_executor(
-                strand_,
-                std::bind(
-                    &BaseWSPeer::onWriteFin, impl().shared_from_this(), std::placeholders::_1)));
+                strand_, [self = impl().shared_from_this()](error_code const& ec, std::size_t) {
+                    self->onWriteFin(ec);
+                }));
     }
 }
 
@@ -324,10 +327,9 @@ BaseWSPeer<Handler, Impl>::onWriteFin(error_code const& ec)
     if (doClose_)
     {
         impl().ws_.async_close(
-            cr_,
-            bind_executor(
-                strand_,
-                std::bind(&BaseWSPeer::onClose, impl().shared_from_this(), std::placeholders::_1)));
+            cr_, bind_executor(strand_, [self = impl().shared_from_this()](error_code const& ec) {
+                self->onClose(ec);
+            }));
     }
     else if (!wq_.empty())
     {
@@ -340,12 +342,13 @@ void
 BaseWSPeer<Handler, Impl>::doRead()
 {
     if (!strand_.running_in_this_thread())
-        return post(strand_, std::bind(&BaseWSPeer::doRead, impl().shared_from_this()));
+        return post(strand_, [self = impl().shared_from_this()] { self->doRead(); });
     impl().ws_.async_read(
         rb_,
         bind_executor(
-            strand_,
-            std::bind(&BaseWSPeer::onRead, impl().shared_from_this(), std::placeholders::_1)));
+            strand_, [self = impl().shared_from_this()](error_code const& ec, std::size_t) {
+                self->onRead(ec);
+            }));
 }
 
 template <class Handler, class Impl>
@@ -389,11 +392,7 @@ BaseWSPeer<Handler, Impl>::startTimer()
     }
 
     timer_.async_wait(bind_executor(
-        strand_,
-        std::bind(
-            &BaseWSPeer<Handler, Impl>::onTimer,
-            impl().shared_from_this(),
-            std::placeholders::_1)));
+        strand_, [self = impl().shared_from_this()](error_code const& ec) { self->onTimer(ec); }));
 }
 
 // Convenience for discarding the error code
@@ -461,10 +460,9 @@ BaseWSPeer<Handler, Impl>::onTimer(error_code ec)
             beast::rngfill(payload_.begin(), payload_.size(), cryptoPrng());
             impl().ws_.async_ping(
                 payload_,
-                bind_executor(
-                    strand_,
-                    std::bind(
-                        &BaseWSPeer::onPing, impl().shared_from_this(), std::placeholders::_1)));
+                bind_executor(strand_, [self = impl().shared_from_this()](error_code const& ec) {
+                    self->onPing(ec);
+                }));
             JLOG(this->j_.trace()) << "sent ping";
             return;
         }
diff --git a/include/xrpl/server/detail/Door.h b/include/xrpl/server/detail/Door.h
index 09b0adc5f2..d2d7a7baf4 100644
--- a/include/xrpl/server/detail/Door.h
+++ b/include/xrpl/server/detail/Door.h
@@ -33,7 +33,6 @@
 #include <algorithm>
 #include <chrono>
 #include <cstdint>
-#include <functional>
 #include <memory>
 #include <optional>
 #include <sstream>
@@ -182,7 +181,7 @@ void
 Door<Handler>::Detector::run()
 {
     util::spawn(
-        strand_, std::bind(&Detector::doDetect, this->shared_from_this(), std::placeholders::_1));
+        strand_, [self = this->shared_from_this()](yield_context yield) { self->doDetect(yield); });
 }
 
 template <class Handler>
@@ -297,8 +296,7 @@ void
 Door<Handler>::run()
 {
     util::spawn(
-        strand_,
-        std::bind(&Door<Handler>::doAccept, this->shared_from_this(), std::placeholders::_1));
+        strand_, [self = this->shared_from_this()](yield_context yield) { self->doAccept(yield); });
 }
 
 template <class Handler>
@@ -307,8 +305,7 @@ Door<Handler>::close()
 {
     if (!strand_.running_in_this_thread())
     {
-        return boost::asio::post(
-            strand_, std::bind(&Door<Handler>::close, this->shared_from_this()));
+        return boost::asio::post(strand_, [self = this->shared_from_this()] { self->close(); });
     }
     backoffTimer_.cancel();
     error_code ec;
diff --git a/include/xrpl/server/detail/PlainHTTPPeer.h b/include/xrpl/server/detail/PlainHTTPPeer.h
index b89272fe9e..688fbbd425 100644
--- a/include/xrpl/server/detail/PlainHTTPPeer.h
+++ b/include/xrpl/server/detail/PlainHTTPPeer.h
@@ -9,7 +9,6 @@
 
 #include <boost/beast/core/tcp_stream.hpp>
 
-#include <functional>
 #include <memory>
 #include <utility>
 
@@ -89,7 +88,9 @@ PlainHTTPPeer<Handler>::run()
 {
     if (!this->handler_.onAccept(this->session(), this->remoteAddress_))
     {
-        util::spawn(this->strand_, std::bind(&PlainHTTPPeer::doClose, this->shared_from_this()));
+        util::spawn(this->strand_, [self = this->shared_from_this()](boost::asio::yield_context) {
+            self->doClose();
+        });
         return;
     }
 
@@ -97,8 +98,9 @@ PlainHTTPPeer<Handler>::run()
         return;
 
     util::spawn(
-        this->strand_,
-        std::bind(&PlainHTTPPeer::doRead, this->shared_from_this(), std::placeholders::_1));
+        this->strand_, [self = this->shared_from_this()](boost::asio::yield_context doYield) {
+            self->doRead(doYield);
+        });
 }
 
 template <class Handler>
diff --git a/include/xrpl/server/detail/SSLHTTPPeer.h b/include/xrpl/server/detail/SSLHTTPPeer.h
index ea2108b917..7fe21ed6b5 100644
--- a/include/xrpl/server/detail/SSLHTTPPeer.h
+++ b/include/xrpl/server/detail/SSLHTTPPeer.h
@@ -13,7 +13,6 @@
 #include <boost/beast/core/tcp_stream.hpp>
 #include <boost/beast/ssl/ssl_stream.hpp>
 
-#include <functional>
 #include <memory>
 #include <utility>
 
@@ -99,14 +98,15 @@ SSLHTTPPeer<Handler>::run()
 {
     if (!this->handler_.onAccept(this->session(), this->remoteAddress_))
     {
-        util::spawn(this->strand_, std::bind(&SSLHTTPPeer::doClose, this->shared_from_this()));
+        util::spawn(
+            this->strand_, [self = this->shared_from_this()](yield_context) { self->doClose(); });
         return;
     }
     if (!socket_.is_open())
         return;
-    util::spawn(
-        this->strand_,
-        std::bind(&SSLHTTPPeer::doHandshake, this->shared_from_this(), std::placeholders::_1));
+    util::spawn(this->strand_, [self = this->shared_from_this()](yield_context doYield) {
+        self->doHandshake(doYield);
+    });
 }
 
 template <class Handler>
@@ -142,9 +142,9 @@ SSLHTTPPeer<Handler>::doHandshake(yield_context doYield)
         this->port().protocol.count("https") > 0;
     if (http)
     {
-        util::spawn(
-            this->strand_,
-            std::bind(&SSLHTTPPeer::doRead, this->shared_from_this(), std::placeholders::_1));
+        util::spawn(this->strand_, [self = this->shared_from_this()](yield_context doYield) {
+            self->doRead(doYield);
+        });
         return;
     }
     // `this` will be destroyed
@@ -172,7 +172,7 @@ SSLHTTPPeer<Handler>::doClose()
     this->startTimer();
     stream_.async_shutdown(bind_executor(
         this->strand_,
-        std::bind(&SSLHTTPPeer::onShutdown, this->shared_from_this(), std::placeholders::_1)));
+        [self = this->shared_from_this()](error_code const& ec) { self->onShutdown(ec); }));
 }
 
 template <class Handler>
diff --git a/src/libxrpl/basics/ResolverAsio.cpp b/src/libxrpl/basics/ResolverAsio.cpp
index ddf006b681..7e1b56f87a 100644
--- a/src/libxrpl/basics/ResolverAsio.cpp
+++ b/src/libxrpl/basics/ResolverAsio.cpp
@@ -192,7 +192,7 @@ public:
             boost::asio::dispatch(
                 ioContext,
                 boost::asio::bind_executor(
-                    strand, std::bind(&ResolverAsioImpl::doStop, this, CompletionCounter(this))));
+                    strand, [this, counter = CompletionCounter(this)] { doStop(counter); }));
 
             JLOG(journal.debug()) << "Queued a stop request";
         }
@@ -221,9 +221,9 @@ public:
         boost::asio::dispatch(
             ioContext,
             boost::asio::bind_executor(
-                strand,
-                std::bind(
-                    &ResolverAsioImpl::doResolve, this, names, handler, CompletionCounter(this))));
+                strand, [this, names, handler, counter = CompletionCounter(this)] {
+                    doResolve(names, handler, counter);
+                }));
     }
 
     //-------------------------------------------------------------------------
@@ -272,7 +272,7 @@ public:
         boost::asio::post(
             ioContext,
             boost::asio::bind_executor(
-                strand, std::bind(&ResolverAsioImpl::doWork, this, CompletionCounter(this))));
+                strand, [this, counter = CompletionCounter(this)] { doWork(counter); }));
     }
 
     static HostAndPort
@@ -291,8 +291,10 @@ public:
         // a port separator
 
         // Attempt to find the first and last non-whitespace
-        auto const findWhitespace =
-            std::bind(&std::isspace<std::string::value_type>, std::placeholders::_1, std::locale());
+        std::locale const loc;
+        auto const findWhitespace = [&loc](std::string::value_type c) {
+            return std::isspace<std::string::value_type>(c, loc);
+        };
 
         auto hostFirst = std::ranges::find_if_not(str, findWhitespace);
 
@@ -348,7 +350,7 @@ public:
             boost::asio::post(
                 ioContext,
                 boost::asio::bind_executor(
-                    strand, std::bind(&ResolverAsioImpl::doWork, this, CompletionCounter(this))));
+                    strand, [this, counter = CompletionCounter(this)] { doWork(counter); }));
 
             return;
         }
@@ -356,14 +358,11 @@ public:
         resolver.async_resolve(
             host,
             port,
-            std::bind(
-                &ResolverAsioImpl::doFinish,
-                this,
-                name,
-                std::placeholders::_1,
-                handler,
-                std::placeholders::_2,
-                CompletionCounter(this)));
+            [this, name, handler, counter = CompletionCounter(this)](
+                boost::system::error_code const& ec,
+                boost::asio::ip::tcp::resolver::results_type results) {
+                doFinish(name, ec, handler, results, counter);
+            });
     }
 
     void
@@ -383,8 +382,7 @@ public:
                 boost::asio::post(
                     ioContext,
                     boost::asio::bind_executor(
-                        strand,
-                        std::bind(&ResolverAsioImpl::doWork, this, CompletionCounter(this))));
+                        strand, [this, counter = CompletionCounter(this)] { doWork(counter); }));
             }
         }
     }
diff --git a/src/libxrpl/beast/insight/StatsDCollector.cpp b/src/libxrpl/beast/insight/StatsDCollector.cpp
index 1da5315de1..3cff5d93b5 100644
--- a/src/libxrpl/beast/insight/StatsDCollector.cpp
+++ b/src/libxrpl/beast/insight/StatsDCollector.cpp
@@ -325,9 +325,9 @@ public:
     postBuffer(std::string&& buffer)
     {
         boost::asio::dispatch(
-            ioContext_,
-            boost::asio::bind_executor(
-                strand_, std::bind(&StatsDCollectorImp::doPostBuffer, this, std::move(buffer))));
+            ioContext_, boost::asio::bind_executor(strand_, [this, buffer = std::move(buffer)] {
+                doPostBuffer(buffer);
+            }));
     }
 
     // The keepAlive parameter makes sure the buffers sent to
@@ -392,12 +392,10 @@ public:
                 log(buffers);
                 socket_.async_send(
                     buffers,
-                    std::bind(
-                        &StatsDCollectorImp::onSend,
-                        this,
-                        keepAlive,
-                        std::placeholders::_1,
-                        std::placeholders::_2));
+                    [this, keepAlive](
+                        boost::system::error_code const& ec, std::size_t bytesTransferred) {
+                        onSend(keepAlive, ec, bytesTransferred);
+                    });
                 buffers.clear();
                 size = 0;
             }
@@ -411,12 +409,10 @@ public:
             log(buffers);
             socket_.async_send(
                 buffers,
-                std::bind(
-                    &StatsDCollectorImp::onSend,
-                    this,
-                    keepAlive,
-                    std::placeholders::_1,
-                    std::placeholders::_2));
+                [this, keepAlive](
+                    boost::system::error_code const& ec, std::size_t bytesTransferred) {
+                    onSend(keepAlive, ec, bytesTransferred);
+                });
         }
     }
 
@@ -425,7 +421,7 @@ public:
     {
         using namespace std::chrono_literals;
         timer_.expires_after(1s);
-        timer_.async_wait(std::bind(&StatsDCollectorImp::onTimer, this, std::placeholders::_1));
+        timer_.async_wait([this](boost::system::error_code const& ec) { onTimer(ec); });
     }
 
     void
@@ -513,10 +509,9 @@ StatsDCounterImpl::increment(CounterImpl::value_type amount)
 {
     boost::asio::dispatch(
         impl_->getIoContext(),
-        std::bind(
-            &StatsDCounterImpl::doIncrement,
-            std::static_pointer_cast<StatsDCounterImpl>(shared_from_this()),
-            amount));
+        [self = std::static_pointer_cast<StatsDCounterImpl>(shared_from_this()), amount] {
+            self->doIncrement(amount);
+        });
 }
 
 void
@@ -558,10 +553,9 @@ StatsDEventImpl::notify(EventImpl::value_type const& value)
 {
     boost::asio::dispatch(
         impl_->getIoContext(),
-        std::bind(
-            &StatsDEventImpl::doNotify,
-            std::static_pointer_cast<StatsDEventImpl>(shared_from_this()),
-            value));
+        [self = std::static_pointer_cast<StatsDEventImpl>(shared_from_this()), value] {
+            self->doNotify(value);
+        });
 }
 
 void
@@ -591,10 +585,9 @@ StatsDGaugeImpl::set(GaugeImpl::value_type value)
 {
     boost::asio::dispatch(
         impl_->getIoContext(),
-        std::bind(
-            &StatsDGaugeImpl::doSet,
-            std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
-            value));
+        [self = std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()), value] {
+            self->doSet(value);
+        });
 }
 
 void
@@ -602,10 +595,9 @@ StatsDGaugeImpl::increment(GaugeImpl::difference_type amount)
 {
     boost::asio::dispatch(
         impl_->getIoContext(),
-        std::bind(
-            &StatsDGaugeImpl::doIncrement,
-            std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
-            amount));
+        [self = std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()), amount] {
+            self->doIncrement(amount);
+        });
 }
 
 void
@@ -678,10 +670,9 @@ StatsDMeterImpl::increment(MeterImpl::value_type amount)
 {
     boost::asio::dispatch(
         impl_->getIoContext(),
-        std::bind(
-            &StatsDMeterImpl::doIncrement,
-            std::static_pointer_cast<StatsDMeterImpl>(shared_from_this()),
-            amount));
+        [self = std::static_pointer_cast<StatsDMeterImpl>(shared_from_this()), amount] {
+            self->doIncrement(amount);
+        });
 }
 
 void
diff --git a/src/libxrpl/core/detail/JobQueue.cpp b/src/libxrpl/core/detail/JobQueue.cpp
index f773270af3..8f95a8a5fa 100644
--- a/src/libxrpl/core/detail/JobQueue.cpp
+++ b/src/libxrpl/core/detail/JobQueue.cpp
@@ -13,7 +13,6 @@
 
 #include <algorithm>
 #include <chrono>
-#include <functional>
 #include <memory>
 #include <mutex>
 #include <set>
@@ -36,7 +35,7 @@ JobQueue::JobQueue(
 {
     JLOG(journal_.info()) << "Using " << threadCount << "  threads";
 
-    hook_ = collector_->makeHook(std::bind(&JobQueue::collect, this));
+    hook_ = collector_->makeHook([this] { collect(); });
     jobCount_ = collector_->makeGauge("job_count");
 
     {
diff --git a/src/libxrpl/net/HTTPClient.cpp b/src/libxrpl/net/HTTPClient.cpp
index 4b9cc9d6e6..7294633964 100644
--- a/src/libxrpl/net/HTTPClient.cpp
+++ b/src/libxrpl/net/HTTPClient.cpp
@@ -134,12 +134,10 @@ public:
         request(
             bSSL,
             deqSites,
-            std::bind(
-                &HTTPClientImp::makeGet,
-                shared_from_this(),
-                strPath,
-                std::placeholders::_1,
-                std::placeholders::_2),
+            [self = shared_from_this(), strPath](
+                boost::asio::streambuf& sb, std::string const& strHost) {
+                self->makeGet(strPath, sb, strHost);
+            },
             timeout,
             complete);
     }
@@ -166,9 +164,9 @@ public:
             shutdown_ = e.code();
 
             JLOG(j_.trace()) << "expires_after: " << shutdown_.message();
-            deadline_.async_wait(
-                std::bind(
-                    &HTTPClientImp::handleDeadline, shared_from_this(), std::placeholders::_1));
+            deadline_.async_wait([self = shared_from_this()](boost::system::error_code const& ec) {
+                self->handleDeadline(ec);
+            });
         }
 
         if (!shutdown_)
@@ -179,11 +177,11 @@ public:
                 query_->host,
                 query_->port,
                 query_->flags,
-                std::bind(
-                    &HTTPClientImp::handleResolve,
-                    shared_from_this(),
-                    std::placeholders::_1,
-                    std::placeholders::_2));
+                [self = shared_from_this()](
+                    boost::system::error_code const& ecResult,
+                    boost::asio::ip::tcp::resolver::results_type results) {
+                    self->handleResolve(ecResult, results);
+                });
         }
 
         if (shutdown_)
@@ -220,9 +218,9 @@ public:
             resolver_.cancel();
 
             // Stop the transaction.
-            socket_.asyncShutdown(
-                std::bind(
-                    &HTTPClientImp::handleShutdown, shared_from_this(), std::placeholders::_1));
+            socket_.asyncShutdown([self = shared_from_this()](boost::system::error_code const& ec) {
+                self->handleShutdown(ec);
+            });
         }
     }
 
@@ -262,8 +260,9 @@ public:
             boost::asio::async_connect(
                 socket_.lowestLayer(),
                 result,
-                std::bind(
-                    &HTTPClientImp::handleConnect, shared_from_this(), std::placeholders::_1));
+                [self = shared_from_this()](
+                    boost::system::error_code const& ecResult,
+                    boost::asio::ip::tcp::endpoint const&) { self->handleConnect(ecResult); });
         }
     }
 
@@ -301,8 +300,9 @@ public:
         {
             socket_.asyncHandshake(
                 AutoSocket::ssl_socket::client,
-                std::bind(
-                    &HTTPClientImp::handleRequest, shared_from_this(), std::placeholders::_1));
+                [self = shared_from_this()](boost::system::error_code const& ec) {
+                    self->handleRequest(ec);
+                });
         }
         else
         {
@@ -330,11 +330,10 @@ public:
 
             socket_.asyncWrite(
                 request_,
-                std::bind(
-                    &HTTPClientImp::handleWrite,
-                    shared_from_this(),
-                    std::placeholders::_1,
-                    std::placeholders::_2));
+                [self = shared_from_this()](
+                    boost::system::error_code const& ecResult, std::size_t bytesTransferred) {
+                    self->handleWrite(ecResult, bytesTransferred);
+                });
         }
     }
 
@@ -357,11 +356,10 @@ public:
             socket_.asyncReadUntil(
                 header_,
                 "\r\n\r\n",
-                std::bind(
-                    &HTTPClientImp::handleHeader,
-                    shared_from_this(),
-                    std::placeholders::_1,
-                    std::placeholders::_2));
+                [self = shared_from_this()](
+                    boost::system::error_code const& ecResult, std::size_t bytesTransferred) {
+                    self->handleHeader(ecResult, bytesTransferred);
+                });
         }
     }
 
@@ -424,11 +422,10 @@ public:
             socket_.asyncRead(
                 response_.prepare(responseSize - body_.size()),
                 boost::asio::transfer_all(),
-                std::bind(
-                    &HTTPClientImp::handleData,
-                    shared_from_this(),
-                    std::placeholders::_1,
-                    std::placeholders::_2));
+                [self = shared_from_this()](
+                    boost::system::error_code const& ecResult, std::size_t bytesTransferred) {
+                    self->handleData(ecResult, bytesTransferred);
+                });
         }
     }
 
diff --git a/src/test/jtx/impl/WSClient.cpp b/src/test/jtx/impl/WSClient.cpp
index c00a88f270..ca322415fb 100644
--- a/src/test/jtx/impl/WSClient.cpp
+++ b/src/test/jtx/impl/WSClient.cpp
@@ -30,6 +30,7 @@
 
 #include <chrono>
 #include <condition_variable>
+#include <cstddef>
 #include <exception>
 #include <functional>
 #include <iostream>
@@ -172,9 +173,9 @@ public:
                     }));
             ws_.handshake(ep.address().to_string() + ":" + std::to_string(ep.port()), "/");
             ws_.async_read(
-                rb_,
-                boost::asio::bind_executor(
-                    strand_, std::bind(&WSClientImpl::onReadMsg, this, std::placeholders::_1)));
+                rb_, boost::asio::bind_executor(strand_, [this](error_code const& ec, std::size_t) {
+                    onReadMsg(ec);
+                }));
         }
         catch (std::exception&)
         {
@@ -310,9 +311,9 @@ private:
             cv_.notify_all();
         }
         ws_.async_read(
-            rb_,
-            boost::asio::bind_executor(
-                strand_, std::bind(&WSClientImpl::onReadMsg, this, std::placeholders::_1)));
+            rb_, boost::asio::bind_executor(strand_, [this](error_code const& ec, std::size_t) {
+                onReadMsg(ec);
+            }));
     }
 
     // Called when the read op terminates
diff --git a/src/test/overlay/short_read_test.cpp b/src/test/overlay/short_read_test.cpp
index 9af632d65c..f235008d89 100644
--- a/src/test/overlay/short_read_test.cpp
+++ b/src/test/overlay/short_read_test.cpp
@@ -26,7 +26,6 @@
 #include <chrono>
 #include <condition_variable>
 #include <cstddef>
-#include <functional>
 #include <map>
 #include <memory>
 #include <mutex>
@@ -199,7 +198,7 @@ private:
             {
                 if (!strand.running_in_this_thread())
                 {
-                    post(strand, std::bind(&Acceptor::close, shared_from_this()));
+                    post(strand, [self = shared_from_this()] { self->close(); });
                     return;
                 }
                 acceptor.close();
@@ -210,9 +209,9 @@ private:
             {
                 acceptor.async_accept(
                     socket,
-                    bind_executor(
-                        strand,
-                        std::bind(&Acceptor::onAccept, shared_from_this(), std::placeholders::_1)));
+                    bind_executor(strand, [self = shared_from_this()](error_code const& ec) {
+                        self->onAccept(ec);
+                    }));
             }
 
             void
@@ -239,9 +238,9 @@ private:
                 p->run();
                 acceptor.async_accept(
                     socket,
-                    bind_executor(
-                        strand,
-                        std::bind(&Acceptor::onAccept, shared_from_this(), std::placeholders::_1)));
+                    bind_executor(strand, [self = shared_from_this()](error_code const& ec) {
+                        self->onAccept(ec);
+                    }));
             }
         };
 
@@ -271,7 +270,7 @@ private:
             {
                 if (!strand.running_in_this_thread())
                 {
-                    post(strand, std::bind(&Connection::close, shared_from_this()));
+                    post(strand, [self = shared_from_this()] { self->close(); });
                     return;
                 }
                 if (socket.is_open())
@@ -287,13 +286,12 @@ private:
                 timer.expires_after(std::chrono::seconds(3));
                 timer.async_wait(bind_executor(
                     strand,
-                    std::bind(&Connection::onTimer, shared_from_this(), std::placeholders::_1)));
+                    [self = shared_from_this()](error_code const& ec) { self->onTimer(ec); }));
                 stream.async_handshake(
                     stream_type::server,
-                    bind_executor(
-                        strand,
-                        std::bind(
-                            &Connection::onHandshake, shared_from_this(), std::placeholders::_1)));
+                    bind_executor(strand, [self = shared_from_this()](error_code const& ec) {
+                        self->onHandshake(ec);
+                    }));
             }
 
             void
@@ -337,11 +335,10 @@ private:
                     "\n",
                     bind_executor(
                         strand,
-                        std::bind(
-                            &Connection::onRead,
-                            shared_from_this(),
-                            std::placeholders::_1,
-                            std::placeholders::_2)));
+                        [self = shared_from_this()](
+                            error_code const& ec, std::size_t bytesTransferred) {
+                            self->onRead(ec, bytesTransferred);
+                        }));
 #else
                 close();
 #endif
@@ -353,10 +350,10 @@ private:
                 if (ec == boost::asio::error::eof)
                 {
                     server.test_.log << "[server] read: EOF" << std::endl;
-                    stream.async_shutdown(bind_executor(
-                        strand,
-                        std::bind(
-                            &Connection::onShutdown, shared_from_this(), std::placeholders::_1)));
+                    stream.async_shutdown(
+                        bind_executor(strand, [self = shared_from_this()](error_code const& ec) {
+                            self->onShutdown(ec);
+                        }));
                     return;
                 }
                 if (ec)
@@ -373,11 +370,10 @@ private:
                     buf.data(),
                     bind_executor(
                         strand,
-                        std::bind(
-                            &Connection::onWrite,
-                            shared_from_this(),
-                            std::placeholders::_1,
-                            std::placeholders::_2)));
+                        [self = shared_from_this()](
+                            error_code const& ec, std::size_t bytesTransferred) {
+                            self->onWrite(ec, bytesTransferred);
+                        }));
             }
 
             void
@@ -391,7 +387,7 @@ private:
                 }
                 stream.async_shutdown(bind_executor(
                     strand,
-                    std::bind(&Connection::onShutdown, shared_from_this(), std::placeholders::_1)));
+                    [self = shared_from_this()](error_code const& ec) { self->onShutdown(ec); }));
             }
 
             void
@@ -463,7 +459,7 @@ private:
             {
                 if (!strand.running_in_this_thread())
                 {
-                    post(strand, std::bind(&Connection::close, shared_from_this()));
+                    post(strand, [self = shared_from_this()] { self->close(); });
                     return;
                 }
                 if (socket.is_open())
@@ -479,13 +475,11 @@ private:
                 timer.expires_after(std::chrono::seconds(3));
                 timer.async_wait(bind_executor(
                     strand,
-                    std::bind(&Connection::onTimer, shared_from_this(), std::placeholders::_1)));
+                    [self = shared_from_this()](error_code const& ec) { self->onTimer(ec); }));
                 socket.async_connect(
-                    ep,
-                    bind_executor(
-                        strand,
-                        std::bind(
-                            &Connection::onConnect, shared_from_this(), std::placeholders::_1)));
+                    ep, bind_executor(strand, [self = shared_from_this()](error_code const& ec) {
+                        self->onConnect(ec);
+                    }));
             }
 
             void
@@ -524,10 +518,9 @@ private:
                 }
                 stream.async_handshake(
                     stream_type::client,
-                    bind_executor(
-                        strand,
-                        std::bind(
-                            &Connection::onHandshake, shared_from_this(), std::placeholders::_1)));
+                    bind_executor(strand, [self = shared_from_this()](error_code const& ec) {
+                        self->onHandshake(ec);
+                    }));
             }
 
             void
@@ -546,16 +539,14 @@ private:
                     buf.data(),
                     bind_executor(
                         strand,
-                        std::bind(
-                            &Connection::onWrite,
-                            shared_from_this(),
-                            std::placeholders::_1,
-                            std::placeholders::_2)));
+                        [self = shared_from_this()](
+                            error_code const& ec, std::size_t bytesTransferred) {
+                            self->onWrite(ec, bytesTransferred);
+                        }));
 #else
                 stream_.async_shutdown(bind_executor(
                     strand_,
-                    std::bind(
-                        &Connection::on_shutdown, shared_from_this(), std::placeholders::_1)));
+                    [self = shared_from_this()](error_code const& ec) { self->on_shutdown(ec); }));
 #endif
             }
 
@@ -575,16 +566,14 @@ private:
                     "\n",
                     bind_executor(
                         strand,
-                        std::bind(
-                            &Connection::onRead,
-                            shared_from_this(),
-                            std::placeholders::_1,
-                            std::placeholders::_2)));
+                        [self = shared_from_this()](
+                            error_code const& ec, std::size_t bytesTransferred) {
+                            self->onRead(ec, bytesTransferred);
+                        }));
 #else
                 stream_.async_shutdown(bind_executor(
                     strand_,
-                    std::bind(
-                        &Connection::on_shutdown, shared_from_this(), std::placeholders::_1)));
+                    [self = shared_from_this()](error_code const& ec) { self->on_shutdown(ec); }));
 #endif
             }
 
@@ -599,7 +588,7 @@ private:
                 buf.commit(bytesTransferred);
                 stream.async_shutdown(bind_executor(
                     strand,
-                    std::bind(&Connection::onShutdown, shared_from_this(), std::placeholders::_1)));
+                    [self = shared_from_this()](error_code const& ec) { self->onShutdown(ec); }));
             }
 
             void
diff --git a/src/test/resource/Logic_test.cpp b/src/test/resource/Logic_test.cpp
index de4575cb16..f6b4875356 100644
--- a/src/test/resource/Logic_test.cpp
+++ b/src/test/resource/Logic_test.cpp
@@ -89,9 +89,11 @@ public:
         Charge const fee(kDropThreshold + 1);
         beast::IP::Endpoint const addr(beast::IP::Endpoint::fromString("192.0.2.2"));
 
-        std::function<Consumer(beast::IP::Endpoint)> const ep = limited
-            ? std::bind(&TestLogic::newInboundEndpoint, &logic, std::placeholders::_1)
-            : std::bind(&TestLogic::newUnlimitedEndpoint, &logic, std::placeholders::_1);
+        std::function<Consumer(beast::IP::Endpoint)> const ep =
+            [&logic, limited](beast::IP::Endpoint const& address) {
+                return limited ? logic.newInboundEndpoint(address)
+                               : logic.newUnlimitedEndpoint(address);
+            };
 
         {
             Consumer c(ep(addr));
diff --git a/src/test/rpc/AccountTx_test.cpp b/src/test/rpc/AccountTx_test.cpp
index bd7b07e936..ace8743e1e 100644
--- a/src/test/rpc/AccountTx_test.cpp
+++ b/src/test/rpc/AccountTx_test.cpp
@@ -41,7 +41,6 @@
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
-#include <functional>
 #include <initializer_list>
 #include <iterator>
 #include <memory>
@@ -893,7 +892,7 @@ public:
     void
     run() override
     {
-        forAllApiVersions(std::bind_front(&AccountTx_test::testParameters, this));
+        forAllApiVersions([this](unsigned apiVersion) { testParameters(apiVersion); });
         testContents();
         testAccountDelete();
         testMPT();
diff --git a/src/test/rpc/LedgerRequest_test.cpp b/src/test/rpc/LedgerRequest_test.cpp
index 4759256b96..93feee9497 100644
--- a/src/test/rpc/LedgerRequest_test.cpp
+++ b/src/test/rpc/LedgerRequest_test.cpp
@@ -11,7 +11,6 @@
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/jss.h>
 
-#include <functional>
 #include <memory>
 #include <string>
 #include <utility>
@@ -350,7 +349,7 @@ public:
     {
         testLedgerRequest();
         testEvolution();
-        forAllApiVersions(std::bind_front(&LedgerRequest_test::testBadInput, this));
+        forAllApiVersions([this](unsigned apiVersion) { testBadInput(apiVersion); });
         testMoreThan256Closed();
         testNonAdmin();
     }
diff --git a/src/test/rpc/RPCCall_test.cpp b/src/test/rpc/RPCCall_test.cpp
index cd3cd3cb41..4b5ab1f230 100644
--- a/src/test/rpc/RPCCall_test.cpp
+++ b/src/test/rpc/RPCCall_test.cpp
@@ -14,7 +14,6 @@
 
 #include <cstdint>
 #include <cstring>
-#include <functional>
 #include <initializer_list>
 #include <memory>
 #include <string>
@@ -5927,7 +5926,7 @@ public:
     void
     run() override
     {
-        forAllApiVersions(std::bind_front(&RPCCall_test::testRPCCall, this));
+        forAllApiVersions([this](unsigned apiVersion) { testRPCCall(apiVersion); });
     }
 };
 
diff --git a/src/test/rpc/TransactionEntry_test.cpp b/src/test/rpc/TransactionEntry_test.cpp
index 8724e2974d..38a95e84f8 100644
--- a/src/test/rpc/TransactionEntry_test.cpp
+++ b/src/test/rpc/TransactionEntry_test.cpp
@@ -17,7 +17,6 @@
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/jss.h>
 
-#include <functional>
 #include <memory>
 #include <stdexcept>
 #include <string>
@@ -353,7 +352,7 @@ public:
     run() override
     {
         testBadInput();
-        forAllApiVersions(std::bind_front(&TransactionEntry_test::testRequest, this));
+        forAllApiVersions([this](unsigned apiVersion) { testRequest(apiVersion); });
     }
 };
 
diff --git a/src/test/rpc/Transaction_test.cpp b/src/test/rpc/Transaction_test.cpp
index 8c50736b85..c3bf707ec4 100644
--- a/src/test/rpc/Transaction_test.cpp
+++ b/src/test/rpc/Transaction_test.cpp
@@ -31,7 +31,6 @@
 #include <cctype>
 #include <cstddef>
 #include <cstdint>
-#include <functional>
 #include <memory>
 #include <optional>
 #include <string>
@@ -886,7 +885,7 @@ public:
     run() override
     {
         using namespace test::jtx;
-        forAllApiVersions(std::bind_front(&Transaction_test::testBinaryRequest, this));
+        forAllApiVersions([this](unsigned apiVersion) { testBinaryRequest(apiVersion); });
 
         FeatureBitset const all{testableAmendments()};
         testWithFeats(all);
@@ -899,7 +898,8 @@ public:
         testRangeCTIDRequest(features);
         testCTIDValidation(features);
         testRPCsForCTID(features);
-        forAllApiVersions(std::bind_front(&Transaction_test::testRequest, this, features));
+        forAllApiVersions(
+            [this, features](unsigned apiVersion) { testRequest(features, apiVersion); });
     }
 };
 
diff --git a/src/test/shamap/FetchPack_test.cpp b/src/test/shamap/FetchPack_test.cpp
index bcc5129f01..f2e7578ee2 100644
--- a/src/test/shamap/FetchPack_test.cpp
+++ b/src/test/shamap/FetchPack_test.cpp
@@ -6,7 +6,6 @@
 #include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/UnorderedContainers.h>
-#include <xrpl/basics/contract.h>
 #include <xrpl/basics/random.h>
 #include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/beast/utility/Journal.h>
@@ -26,7 +25,6 @@
 #include <cstdint>
 #include <memory>
 #include <optional>
-#include <stdexcept>
 
 namespace xrpl::tests {
 
@@ -40,15 +38,6 @@ public:
     using Table = SHAMap;
     using Item = SHAMapItem;
 
-    struct Handler
-    {
-        void
-        operator()(std::uint32_t refNum) const
-        {
-            Throw<std::runtime_error>("missing node");
-        }
-    };
-
     struct TestFilter : SHAMapSyncFilter
     {
         TestFilter(Map& map, beast::Journal journal) : map(map), journal(journal)
@@ -93,7 +82,7 @@ public:
     static void
     addRandomItems(std::size_t n, Table& t, beast::xor_shift_engine& r)
     {
-        while ((n--) != 0u)
+        for (std::size_t i = 0; i < n; ++i)
         {
             auto const result(t.addItem(SHAMapNodeType::TnAccountState, makeRandomItemMember(r)));
             assert(result);
@@ -111,56 +100,51 @@ public:
     void
     run() override
     {
-        using beast::Severity;
+        testFetchPack();
+    }
+
+    // Exercises a fetch-pack round trip: build a SHAMap, serialize every node
+    // into a pack keyed by node hash, then rebuild the map in a fresh SHAMap by
+    // sourcing every node from the pack through a SHAMapSyncFilter and comparing
+    // the result. This covers the filter-based reconstruction path (fetchRoot +
+    // getMissingNodes with a SHAMapSyncFilter), complementing SHAMapSync_test,
+    // which drives the getNodeFat/addKnownNode path.
+    void
+    testFetchPack()
+    {
         test::SuiteJournal journal("FetchPack_test", *this);
+        TestNodeFamily f(journal), f2(journal);
+        beast::xor_shift_engine r;
 
-        TestNodeFamily f(journal);
-        std::shared_ptr<Table> const t1(std::make_shared<Table>(SHAMapType::FREE, f));
+        // Build a source map. getHash() unshares the tree and computes every
+        // node hash; this must happen before serializing nodes below, otherwise
+        // inner nodes still carry stale cached hashes.
+        auto const source = std::make_shared<Table>(SHAMapType::FREE, f);
+        addRandomItems(kTableItems + kTableItemsExtra, *source, r);
+        source->setImmutable();
+        auto const rootHash = source->getHash();
 
-        pass();
+        // Turn the source into a fetch pack: node hash -> serialized node.
+        Map map;
+        source->visitNodes([this, &map](SHAMapTreeNode& node) {
+            Serializer s;
+            node.serializeWithPrefix(s);
+            onFetch(map, node.getHash(), s.getData());
+            return true;
+        });
 
-        //         beast::Random r;
-        //         add_random_items_ (tableItems, *t1, r);
-        //         std::shared_ptr <Table> t2 (t1->snapShot (true));
-        //
-        //         add_random_items_ (tableItemsExtra, *t1, r);
-        //         add_random_items_ (tableItemsExtra, *t2, r);
+        // Rebuild the map in a fresh family, sourcing every node from the pack
+        // through the SHAMapSyncFilter.
+        auto const rebuilt = std::make_shared<Table>(SHAMapType::FREE, rootHash.asUInt256(), f2);
+        TestFilter filter(map, journal);
+        rebuilt->setSynching();
+        BEAST_EXPECT(rebuilt->fetchRoot(rootHash, &filter));
 
-        // turn t1 into t2
-        //         Map map;
-        //         t2->getFetchPack (t1.get(), true, 1000000, std::bind (
-        //             &FetchPack_test::on_fetch, this, std::ref (map),
-        //             std::placeholders::_1, std::placeholders::_2));
-        //         t1->getFetchPack (nullptr, true, 1000000, std::bind (
-        //             &FetchPack_test::on_fetch, this, std::ref (map),
-        //             std::placeholders::_1, std::placeholders::_2));
+        // Everything should be in the pack, so no nodes should be missing.
+        BEAST_EXPECT(rebuilt->getMissingNodes(2048, &filter).empty());
+        rebuilt->clearSynching();
 
-        // try to rebuild t2 from the fetch pack
-        //         std::shared_ptr <Table> t3;
-        //         try
-        //         {
-        //             TestFilter filter (map, beast::Journal());
-        //
-        //             t3 = std::make_shared <Table> (SHAMapType::FREE,
-        //             t2->getHash (),
-        //                 fullBelowCache);
-        //
-        //             BEAST_EXPECT(t3->fetchRoot (t2->getHash (), &filter),
-        //             "unable to get root");
-        //
-        //             // everything should be in the pack, no hashes should be
-        //             needed std::vector <uint256> hashes =
-        //             t3->getNeededHashes(1, &filter);
-        //             BEAST_EXPECT(hashes.empty(), "missing hashes");
-        //
-        //             BEAST_EXPECT(t3->getHash () == t2->getHash (), "root
-        //             hashes do not match"); BEAST_EXPECT(t3->deepCompare
-        //             (*t2), "failed compare");
-        //         }
-        //         catch (std::exception const&)
-        //         {
-        //             fail ("unhandled exception");
-        //         }
+        BEAST_EXPECT(rebuilt->deepCompare(*source));
     }
 };
 
diff --git a/src/xrpld/app/ledger/detail/LedgerMaster.cpp b/src/xrpld/app/ledger/detail/LedgerMaster.cpp
index 3fcac03ed5..bab0dca827 100644
--- a/src/xrpld/app/ledger/detail/LedgerMaster.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerMaster.cpp
@@ -137,7 +137,7 @@ LedgerMaster::LedgerMaster(
           std::chrono::seconds{45},
           stopwatch,
           app_.getJournal("TaggedCache"))
-    , stats_(std::bind(&LedgerMaster::collectMetrics, this), collector)
+    , stats_([this] { collectMetrics(); }, collector)
 {
 }
 
diff --git a/src/xrpld/app/misc/NetworkOPs.cpp b/src/xrpld/app/misc/NetworkOPs.cpp
index d1f794b74d..4d40247a29 100644
--- a/src/xrpld/app/misc/NetworkOPs.cpp
+++ b/src/xrpld/app/misc/NetworkOPs.cpp
@@ -330,7 +330,7 @@ public:
         , jobQueue_(jobQueue)
         , standalone_(standalone)
         , minPeerCount_(startValid ? 0 : minPeerCount)
-        , stats_(std::bind(&NetworkOPsImp::collectMetrics, this), collector)
+        , stats_([this] { collectMetrics(); }, collector)
     {
     }
 
diff --git a/src/xrpld/app/misc/SHAMapStoreImp.cpp b/src/xrpld/app/misc/SHAMapStoreImp.cpp
index 0389130f7a..0e0099cdbf 100644
--- a/src/xrpld/app/misc/SHAMapStoreImp.cpp
+++ b/src/xrpld/app/misc/SHAMapStoreImp.cpp
@@ -331,11 +331,9 @@ SHAMapStoreImp::run()
             try
             {
                 validatedLedger->stateMap().snapShot(false)->visitNodes(
-                    std::bind(
-                        &SHAMapStoreImp::copyNode,
-                        this,
-                        std::ref(nodeCount),
-                        std::placeholders::_1));
+                    [this, &nodeCount](SHAMapTreeNode const& node) {
+                        return copyNode(nodeCount, node);
+                    });
             }
             catch (SHAMapMissingNode const& e)
             {
diff --git a/src/xrpld/app/misc/detail/WorkBase.h b/src/xrpld/app/misc/detail/WorkBase.h
index 5f5fdd28b7..73e5081036 100644
--- a/src/xrpld/app/misc/detail/WorkBase.h
+++ b/src/xrpld/app/misc/detail/WorkBase.h
@@ -12,6 +12,7 @@
 #include <boost/beast/http/read.hpp>
 #include <boost/beast/http/write.hpp>
 
+#include <cstddef>
 #include <functional>
 #include <string>
 #include <utility>
@@ -138,9 +139,9 @@ WorkBase<Impl>::run()
     if (!strand_.running_in_this_thread())
     {
         return boost::asio::post(
-            ios_,
-            boost::asio::bind_executor(
-                strand_, std::bind(&WorkBase::run, impl().shared_from_this())));
+            ios_, boost::asio::bind_executor(strand_, [self = impl().shared_from_this()] {
+                self->run();
+            }));
     }
 
     resolver_.async_resolve(
@@ -148,11 +149,9 @@ WorkBase<Impl>::run()
         port_,
         boost::asio::bind_executor(
             strand_,
-            std::bind(
-                &WorkBase::onResolve,
-                impl().shared_from_this(),
-                std::placeholders::_1,
-                std::placeholders::_2)));
+            [self = impl().shared_from_this()](error_code const& ec, results_type results) {
+                self->onResolve(ec, results);
+            }));
 }
 
 template <class Impl>
@@ -165,7 +164,7 @@ WorkBase<Impl>::cancel()
             ios_,
 
             boost::asio::bind_executor(
-                strand_, std::bind(&WorkBase::cancel, impl().shared_from_this())));
+                strand_, [self = impl().shared_from_this()] { self->cancel(); }));
     }
 
     error_code ec;
@@ -196,11 +195,12 @@ WorkBase<Impl>::onResolve(error_code const& ec, results_type results)
         results,
         boost::asio::bind_executor(
             strand_,
-            std::bind(
-                &WorkBase::onConnect,
-                impl().shared_from_this(),
-                std::placeholders::_1,
-                std::placeholders::_2)));
+            [self = impl().shared_from_this()](
+                error_code const& ec, endpoint_type const& endpoint) {
+                // Call the base-class overload explicitly: the derived Impl
+                // hides it with its own single-argument onConnect(ec).
+                self->WorkBase::onConnect(ec, endpoint);
+            }));
 }
 
 template <class Impl>
@@ -229,8 +229,9 @@ WorkBase<Impl>::onStart()
         impl().stream(),
         req_,
         boost::asio::bind_executor(
-            strand_,
-            std::bind(&WorkBase::onRequest, impl().shared_from_this(), std::placeholders::_1)));
+            strand_, [self = impl().shared_from_this()](error_code const& ec, std::size_t) {
+                self->onRequest(ec);
+            }));
 }
 
 template <class Impl>
@@ -245,8 +246,9 @@ WorkBase<Impl>::onRequest(error_code const& ec)
         readBuf_,
         res_,
         boost::asio::bind_executor(
-            strand_,
-            std::bind(&WorkBase::onResponse, impl().shared_from_this(), std::placeholders::_1)));
+            strand_, [self = impl().shared_from_this()](error_code const& ec, std::size_t) {
+                self->onResponse(ec);
+            }));
 }
 
 template <class Impl>
diff --git a/src/xrpld/app/misc/detail/WorkFile.h b/src/xrpld/app/misc/detail/WorkFile.h
index 2fc7ab952d..eb42d14db4 100644
--- a/src/xrpld/app/misc/detail/WorkFile.h
+++ b/src/xrpld/app/misc/detail/WorkFile.h
@@ -63,9 +63,9 @@ WorkFile::run()
 {
     if (!strand_.running_in_this_thread())
     {
-        boost::asio::post(
-            ios_,
-            boost::asio::bind_executor(strand_, std::bind(&WorkFile::run, shared_from_this())));
+        boost::asio::post(ios_, boost::asio::bind_executor(strand_, [self = shared_from_this()] {
+                              self->run();
+                          }));
         return;
     }
 
diff --git a/src/xrpld/app/misc/detail/WorkSSL.cpp b/src/xrpld/app/misc/detail/WorkSSL.cpp
index e1b864e81f..e8d24b55d6 100644
--- a/src/xrpld/app/misc/detail/WorkSSL.cpp
+++ b/src/xrpld/app/misc/detail/WorkSSL.cpp
@@ -12,7 +12,6 @@
 #include <boost/asio/ssl/stream_base.hpp>
 #include <boost/format/free_funcs.hpp>
 
-#include <functional>
 #include <stdexcept>
 #include <string>
 
@@ -55,7 +54,7 @@ WorkSSL::onConnect(error_code const& ec)
     stream_.async_handshake(
         boost::asio::ssl::stream_base::client,
         boost::asio::bind_executor(
-            strand_, std::bind(&WorkSSL::onHandshake, shared_from_this(), std::placeholders::_1)));
+            strand_, [self = shared_from_this()](error_code const& ec) { self->onHandshake(ec); }));
 }
 
 void
diff --git a/src/xrpld/app/rdb/backend/detail/SQLiteDatabase.cpp b/src/xrpld/app/rdb/backend/detail/SQLiteDatabase.cpp
index fd1298516f..338a3a33df 100644
--- a/src/xrpld/app/rdb/backend/detail/SQLiteDatabase.cpp
+++ b/src/xrpld/app/rdb/backend/detail/SQLiteDatabase.cpp
@@ -421,8 +421,9 @@ SQLiteDatabase::oldestAccountTxPage(AccountTxPageOptions const& options)
         return {};
 
     static std::uint32_t const kPageLength(200);
-    auto onUnsavedLedger =
-        std::bind(saveLedgerAsync, std::ref(registry_.get().getApp()), std::placeholders::_1);
+    auto onUnsavedLedger = [&app = registry_.get().getApp()](std::uint32_t seq) {
+        saveLedgerAsync(app, seq);
+    };
     AccountTxs ret;
     auto onTransaction = [&ret, &app = registry_.get().getApp()](
                              std::uint32_t ledgerIndex,
@@ -451,8 +452,9 @@ SQLiteDatabase::newestAccountTxPage(AccountTxPageOptions const& options)
         return {};
 
     static std::uint32_t const kPageLength(200);
-    auto onUnsavedLedger =
-        std::bind(saveLedgerAsync, std::ref(registry_.get().getApp()), std::placeholders::_1);
+    auto onUnsavedLedger = [&app = registry_.get().getApp()](std::uint32_t seq) {
+        saveLedgerAsync(app, seq);
+    };
     AccountTxs ret;
     auto onTransaction = [&ret, &app = registry_.get().getApp()](
                              std::uint32_t ledgerIndex,
@@ -481,8 +483,9 @@ SQLiteDatabase::oldestAccountTxPageB(AccountTxPageOptions const& options)
         return {};
 
     static std::uint32_t const kPageLength(500);
-    auto onUnsavedLedger =
-        std::bind(saveLedgerAsync, std::ref(registry_.get().getApp()), std::placeholders::_1);
+    auto onUnsavedLedger = [&app = registry_.get().getApp()](std::uint32_t seq) {
+        saveLedgerAsync(app, seq);
+    };
     MetaTxsList ret;
     auto onTransaction =
         [&ret](
@@ -509,8 +512,9 @@ SQLiteDatabase::newestAccountTxPageB(AccountTxPageOptions const& options)
         return {};
 
     static std::uint32_t const kPageLength(500);
-    auto onUnsavedLedger =
-        std::bind(saveLedgerAsync, std::ref(registry_.get().getApp()), std::placeholders::_1);
+    auto onUnsavedLedger = [&app = registry_.get().getApp()](std::uint32_t seq) {
+        saveLedgerAsync(app, seq);
+    };
     MetaTxsList ret;
     auto onTransaction =
         [&ret](
diff --git a/src/xrpld/overlay/detail/ConnectAttempt.cpp b/src/xrpld/overlay/detail/ConnectAttempt.cpp
index 295f4f5497..064b4ecd3e 100644
--- a/src/xrpld/overlay/detail/ConnectAttempt.cpp
+++ b/src/xrpld/overlay/detail/ConnectAttempt.cpp
@@ -35,8 +35,8 @@
 #include <boost/system/system_error.hpp>
 
 #include <chrono>
+#include <cstddef>
 #include <exception>
-#include <functional>
 #include <memory>
 #include <optional>
 #include <string>
@@ -86,7 +86,7 @@ ConnectAttempt::stop()
 {
     if (!strand_.running_in_this_thread())
     {
-        boost::asio::post(strand_, std::bind(&ConnectAttempt::stop, shared_from_this()));
+        boost::asio::post(strand_, [self = shared_from_this()] { self->stop(); });
         return;
     }
     if (socket_.is_open())
@@ -104,8 +104,7 @@ ConnectAttempt::run()
     stream_.next_layer().async_connect(
         remoteEndpoint_,
         boost::asio::bind_executor(
-            strand_,
-            std::bind(&ConnectAttempt::onConnect, shared_from_this(), std::placeholders::_1)));
+            strand_, [self = shared_from_this()](error_code const& ec) { self->onConnect(ec); }));
 }
 
 //------------------------------------------------------------------------------
@@ -160,8 +159,7 @@ ConnectAttempt::setTimer()
 
     timer_.async_wait(
         boost::asio::bind_executor(
-            strand_,
-            std::bind(&ConnectAttempt::onTimer, shared_from_this(), std::placeholders::_1)));
+            strand_, [self = shared_from_this()](error_code const& ec) { self->onTimer(ec); }));
 }
 
 void
@@ -228,8 +226,7 @@ ConnectAttempt::onConnect(error_code ec)
     stream_.async_handshake(
         boost::asio::ssl::stream_base::client,
         boost::asio::bind_executor(
-            strand_,
-            std::bind(&ConnectAttempt::onHandshake, shared_from_this(), std::placeholders::_1)));
+            strand_, [self = shared_from_this()](error_code const& ec) { self->onHandshake(ec); }));
 }
 
 void
@@ -290,7 +287,7 @@ ConnectAttempt::onHandshake(error_code ec)
         req_,
         boost::asio::bind_executor(
             strand_,
-            std::bind(&ConnectAttempt::onWrite, shared_from_this(), std::placeholders::_1)));
+            [self = shared_from_this()](error_code const& ec, std::size_t) { self->onWrite(ec); }));
 }
 
 void
@@ -316,7 +313,7 @@ ConnectAttempt::onWrite(error_code ec)
         response_,
         boost::asio::bind_executor(
             strand_,
-            std::bind(&ConnectAttempt::onRead, shared_from_this(), std::placeholders::_1)));
+            [self = shared_from_this()](error_code const& ec, std::size_t) { self->onRead(ec); }));
 }
 
 void
@@ -339,8 +336,7 @@ ConnectAttempt::onRead(error_code ec)
             stream_.async_shutdown(
                 boost::asio::bind_executor(
                     strand_,
-                    std::bind(
-                        &ConnectAttempt::onShutdown, shared_from_this(), std::placeholders::_1)));
+                    [self = shared_from_this()](error_code const& ec) { self->onShutdown(ec); }));
             return;
         }
 
diff --git a/src/xrpld/overlay/detail/OverlayImpl.cpp b/src/xrpld/overlay/detail/OverlayImpl.cpp
index 89c7dfe5eb..b7af3b6ace 100644
--- a/src/xrpld/overlay/detail/OverlayImpl.cpp
+++ b/src/xrpld/overlay/detail/OverlayImpl.cpp
@@ -133,7 +133,7 @@ OverlayImpl::Timer::asyncWait()
     timer.async_wait(
         boost::asio::bind_executor(
             overlay_.strand_,
-            std::bind(&Timer::onTimer, shared_from_this(), std::placeholders::_1)));
+            [self = shared_from_this()](error_code const& ec) { self->onTimer(ec); }));
 }
 
 void
@@ -190,7 +190,7 @@ OverlayImpl::OverlayImpl(
     , nextId_(1)
     , slots_(app, *this, app.config())
     , stats_(
-          std::bind(&OverlayImpl::collectMetrics, this),
+          [this] { collectMetrics(); },
           collector,
           [counts = traffic_.getCounts(), collector]() {
               std::unordered_map<TrafficCount::Category, TrafficGauges> ret;
@@ -593,7 +593,7 @@ OverlayImpl::start()
 void
 OverlayImpl::stop()
 {
-    boost::asio::dispatch(strand_, std::bind(&OverlayImpl::stopChildren, this));
+    boost::asio::dispatch(strand_, [this] { stopChildren(); });
     {
         std::unique_lock<decltype(mutex_)> lock(mutex_);
         cond_.wait(lock, [this] { return list_.empty(); });
@@ -1490,7 +1490,7 @@ OverlayImpl::deletePeer(Peer::id_t id)
 {
     if (!strand_.running_in_this_thread())
     {
-        post(strand_, std::bind(&OverlayImpl::deletePeer, this, id));
+        post(strand_, [this, id] { deletePeer(id); });
         return;
     }
 
@@ -1502,7 +1502,7 @@ OverlayImpl::deleteIdlePeers()
 {
     if (!strand_.running_in_this_thread())
     {
-        post(strand_, std::bind(&OverlayImpl::deleteIdlePeers, this));
+        post(strand_, [this] { deleteIdlePeers(); });
         return;
     }
 
diff --git a/src/xrpld/overlay/detail/OverlayImpl.h b/src/xrpld/overlay/detail/OverlayImpl.h
index 7db32c0d23..83d5a81a89 100644
--- a/src/xrpld/overlay/detail/OverlayImpl.h
+++ b/src/xrpld/overlay/detail/OverlayImpl.h
@@ -427,7 +427,7 @@ public:
     addTxMetrics(Args... args)
     {
         if (!strand_.running_in_this_thread())
-            return post(strand_, std::bind(&OverlayImpl::addTxMetrics<Args...>, this, args...));
+            return post(strand_, [this, args...] { addTxMetrics(args...); });
 
         txMetrics_.addMetrics(args...);
     }
diff --git a/src/xrpld/overlay/detail/PeerImp.cpp b/src/xrpld/overlay/detail/PeerImp.cpp
index 83e4d9c851..4e42d46f46 100644
--- a/src/xrpld/overlay/detail/PeerImp.cpp
+++ b/src/xrpld/overlay/detail/PeerImp.cpp
@@ -321,9 +321,9 @@ PeerImp::send(std::shared_ptr<Message> const& m)
             self->stream_,
             boost::asio::buffer(self->sendQueue_.front()->getBuffer(self->compressionEnabled_)),
             bind_executor(
-                self->strand_,
-                std::bind(
-                    &PeerImp::onWriteMessage, self, std::placeholders::_1, std::placeholders::_2)));
+                self->strand_, [self](error_code const& ec, std::size_t bytesTransferred) {
+                    self->onWriteMessage(ec, bytesTransferred);
+                }));
     });
 }
 
@@ -650,7 +650,7 @@ PeerImp::gracefulClose()
         return;
     setTimer();
     stream_.async_shutdown(bind_executor(
-        strand_, std::bind(&PeerImp::onShutdown, shared_from_this(), std::placeholders::_1)));
+        strand_, [self = shared_from_this()](error_code const& ec) { self->onShutdown(ec); }));
 }
 
 void
@@ -666,7 +666,7 @@ PeerImp::setTimer()
         return;
     }
     timer_.async_wait(bind_executor(
-        strand_, std::bind(&PeerImp::onTimer, shared_from_this(), std::placeholders::_1)));
+        strand_, [self = shared_from_this()](error_code const& ec) { self->onTimer(ec); }));
 }
 
 // convenience for ignoring the error code
@@ -975,11 +975,9 @@ PeerImp::onReadMessage(error_code ec, std::size_t bytesTransferred)
         readBuffer_.prepare(std::max(Tuning::kReadBufferBytes, hint)),
         bind_executor(
             strand_,
-            std::bind(
-                &PeerImp::onReadMessage,
-                shared_from_this(),
-                std::placeholders::_1,
-                std::placeholders::_2)));
+            [self = shared_from_this()](error_code const& ec, std::size_t bytesTransferred) {
+                self->onReadMessage(ec, bytesTransferred);
+            }));
 }
 
 void
@@ -1014,18 +1012,16 @@ PeerImp::onWriteMessage(error_code ec, std::size_t bytesTransferred)
             boost::asio::buffer(sendQueue_.front()->getBuffer(compressionEnabled_)),
             bind_executor(
                 strand_,
-                std::bind(
-                    &PeerImp::onWriteMessage,
-                    shared_from_this(),
-                    std::placeholders::_1,
-                    std::placeholders::_2)));
+                [self = shared_from_this()](error_code const& ec, std::size_t bytesTransferred) {
+                    self->onWriteMessage(ec, bytesTransferred);
+                }));
         return;
     }
 
     if (gracefulClose_)
     {
         stream_.async_shutdown(bind_executor(
-            strand_, std::bind(&PeerImp::onShutdown, shared_from_this(), std::placeholders::_1)));
+            strand_, [self = shared_from_this()](error_code const& ec) { self->onShutdown(ec); }));
         return;
     }
 }
diff --git a/src/xrpld/peerfinder/detail/Checker.h b/src/xrpld/peerfinder/detail/Checker.h
index 20687448df..208bad390c 100644
--- a/src/xrpld/peerfinder/detail/Checker.h
+++ b/src/xrpld/peerfinder/detail/Checker.h
@@ -8,7 +8,6 @@
 #include <boost/intrusive/list.hpp>
 
 #include <condition_variable>
-#include <functional>
 #include <memory>
 #include <mutex>
 
@@ -183,7 +182,7 @@ Checker<Protocol>::asyncConnect(beast::IP::Endpoint const& endpoint, Handler&& h
     }
     op->socket.async_connect(
         beast::IPAddressConversion::toAsioEndpoint(endpoint),
-        std::bind(&BasicAsyncOp::operator(), op, std::placeholders::_1));
+        [op](error_code const& ec) { (*op)(ec); });
 }
 
 template <class Protocol>
diff --git a/src/xrpld/peerfinder/detail/Logic.h b/src/xrpld/peerfinder/detail/Logic.h
index 7d10f7f516..8ea348f560 100644
--- a/src/xrpld/peerfinder/detail/Logic.h
+++ b/src/xrpld/peerfinder/detail/Logic.h
@@ -802,12 +802,10 @@ public:
                     //
                     checker.asyncConnect(
                         ep.address,
-                        std::bind(
-                            &Logic::checkComplete,
-                            this,
-                            slot->remoteEndpoint(),
-                            ep.address,
-                            std::placeholders::_1));
+                        [this, remoteAddress = slot->remoteEndpoint(), checkedAddress = ep.address](
+                            boost::system::error_code const& ec) {
+                            checkComplete(remoteAddress, checkedAddress, ec);
+                        });
 
                     // Note that we simply discard the first Endpoint
                     // that the neighbor sends when we perform the
diff --git a/src/xrpld/peerfinder/detail/PeerfinderManager.cpp b/src/xrpld/peerfinder/detail/PeerfinderManager.cpp
index 9dbedfe4f1..2727a03013 100644
--- a/src/xrpld/peerfinder/detail/PeerfinderManager.cpp
+++ b/src/xrpld/peerfinder/detail/PeerfinderManager.cpp
@@ -20,7 +20,6 @@
 #include <boost/asio/io_context.hpp>
 #include <boost/asio/ip/tcp.hpp>
 
-#include <functional>
 #include <memory>
 #include <mutex>
 #include <optional>
@@ -61,7 +60,7 @@ public:
         , checker_(io_context_)
         , logic_(clock, store_, checker_, journal)
         , config_(config)
-        , stats_(std::bind(&ManagerImp::collectMetrics, this), collector)
+        , stats_([this] { collectMetrics(); }, collector)
     {
     }
 
diff --git a/src/xrpld/rpc/detail/Pathfinder.cpp b/src/xrpld/rpc/detail/Pathfinder.cpp
index fc788dea7d..5b7f1415a2 100644
--- a/src/xrpld/rpc/detail/Pathfinder.cpp
+++ b/src/xrpld/rpc/detail/Pathfinder.cpp
@@ -1158,11 +1158,10 @@ Pathfinder::addLink(
                 {
                     std::ranges::sort(
                         candidates,
-                        std::bind(
-                            compareAccountCandidate,
-                            ledger_->seq(),
-                            std::placeholders::_1,
-                            std::placeholders::_2));
+                        [seq = ledger_->seq()](
+                            AccountCandidate const& first, AccountCandidate const& second) {
+                            return compareAccountCandidate(seq, first, second);
+                        });
 
                     int count = candidates.size();
                     // allow more paths from source
diff --git a/src/xrpld/rpc/detail/RPCCall.cpp b/src/xrpld/rpc/detail/RPCCall.cpp
index 123b9fc7a5..af5677008d 100644
--- a/src/xrpld/rpc/detail/RPCCall.cpp
+++ b/src/xrpld/rpc/detail/RPCCall.cpp
@@ -1745,7 +1745,9 @@ rpcClient(
                     static_cast<int>(setup.client.secure) != 0,  // Use SSL
                     config.quiet(),
                     logs,
-                    std::bind(RPCCallImp::callRPCHandler, &jvOutput, std::placeholders::_1),
+                    [&jvOutput](json::Value const& jvInput) {
+                        RPCCallImp::callRPCHandler(&jvOutput, jvInput);
+                    },
                     headers);
                 isService.run();  // This blocks until there are no more
                                   // outstanding async calls.
@@ -1870,24 +1872,16 @@ fromNetwork(
         ioContext,
         strIp,
         iPort,
-        std::bind(
-            &RPCCallImp::onRequest,
-            strMethod,
-            jvParams,
-            headers,
-            strPath,
-            std::placeholders::_1,
-            std::placeholders::_2,
-            j),
+        [strMethod, jvParams, headers, strPath, j](
+            boost::asio::streambuf& sb, std::string const& strHost) {
+            RPCCallImp::onRequest(strMethod, jvParams, headers, strPath, sb, strHost, j);
+        },
         kRpcReplyMaxBytes,
         kRpcWebhookTimeout,
-        std::bind(
-            &RPCCallImp::onResponse,
-            callbackFuncP,
-            std::placeholders::_1,
-            std::placeholders::_2,
-            std::placeholders::_3,
-            j),
+        [callbackFuncP, j](
+            boost::system::error_code const& ecResult, int iStatus, std::string const& strData) {
+            return RPCCallImp::onResponse(callbackFuncP, ecResult, iStatus, strData, j);
+        },
         j);
 }
 

From 53649cc298c5a7c23aa75cb09b66b62431a28c69 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Fri, 3 Jul 2026 15:28:15 +0100
Subject: [PATCH 045/100] chore: Enable modernize-use-constraints (#7715)

---
 .clang-tidy                                   |   1 -
 include/xrpl/basics/Slice.h                   |   6 +-
 include/xrpl/basics/TaggedCache.h             |   6 +-
 include/xrpl/basics/TaggedCache.ipp           |   6 +-
 include/xrpl/basics/ToString.h                |   3 +-
 include/xrpl/basics/base_uint.h               |  26 ++-
 include/xrpl/basics/random.h                  |  29 ++-
 include/xrpl/basics/safe_cast.h               |  18 +-
 include/xrpl/basics/scope.h                   |  25 +--
 include/xrpl/basics/tagged_integer.h          |   8 +-
 .../beast/container/aged_container_utility.h  |   4 +-
 .../detail/aged_container_iterator.h          |  16 +-
 .../container/detail/aged_ordered_container.h | 189 +++++++++---------
 .../detail/aged_unordered_container.h         | 158 ++++++++-------
 include/xrpl/beast/core/LexicalCast.h         |   9 +-
 include/xrpl/beast/hash/hash_append.h         |  93 +++++----
 include/xrpl/beast/hash/xxhasher.h            |  12 +-
 include/xrpl/beast/utility/rngfill.h          |   7 +-
 include/xrpl/core/JobQueue.h                  |   8 +-
 .../xrpl/ledger/helpers/DirectoryHelpers.h    |  14 +-
 include/xrpl/net/HTTPClientSSLContext.h       |  18 +-
 include/xrpl/nodestore/detail/varint.h        |   9 +-
 include/xrpl/protocol/STArray.h               |  28 +--
 include/xrpl/protocol/STObject.h              |  16 +-
 include/xrpl/protocol/TER.h                   |  59 +++---
 include/xrpl/server/Manifest.h                |   5 +-
 src/libxrpl/protocol/STParsedJSON.cpp         |   6 +-
 src/libxrpl/protocol/STTx.cpp                 |   2 +-
 src/libxrpl/protocol/tokens.cpp               |   3 +-
 src/test/app/NFToken_test.cpp                 |   2 +-
 .../beast/aged_associative_container_test.cpp | 119 +++++++----
 src/test/csf/Tx.h                             |   6 +-
 src/test/csf/submitters.h                     |   3 +-
 src/test/jtx/TestHelpers.h                    |   3 +-
 src/test/jtx/amount.h                         |  22 +-
 src/test/jtx/paths.h                          |   3 +-
 src/test/protocol/Quality_test.cpp            |   6 +-
 src/test/protocol/TER_test.cpp                |   9 +-
 src/xrpld/overlay/detail/PeerImp.h            |  12 +-
 src/xrpld/overlay/detail/ProtocolMessage.h    |  13 +-
 src/xrpld/rpc/Status.h                        |   8 +-
 41 files changed, 549 insertions(+), 441 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index c5f638b395..3bad686a11 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -80,7 +80,6 @@ Checks: "-*,
   -modernize-return-braced-init-list,
   -modernize-shrink-to-fit,
   -modernize-use-bool-literals,
-  -modernize-use-constraints,
   -modernize-use-default-member-init,
   -modernize-use-integer-sign-comparison,
   -modernize-use-noexcept,
diff --git a/include/xrpl/basics/Slice.h b/include/xrpl/basics/Slice.h
index 948d012958..f87ca063b8 100644
--- a/include/xrpl/basics/Slice.h
+++ b/include/xrpl/basics/Slice.h
@@ -211,15 +211,17 @@ operator<<(Stream& s, Slice const& v)
 }
 
 template <class T, std::size_t N>
-std::enable_if_t<std::is_same_v<T, char> || std::is_same_v<T, unsigned char>, Slice>
+Slice
 makeSlice(std::array<T, N> const& a)
+    requires(std::is_same_v<T, char> || std::is_same_v<T, unsigned char>)
 {
     return Slice(a.data(), a.size());
 }
 
 template <class T, class Alloc>
-std::enable_if_t<std::is_same_v<T, char> || std::is_same_v<T, unsigned char>, Slice>
+Slice
 makeSlice(std::vector<T, Alloc> const& v)
+    requires(std::is_same_v<T, char> || std::is_same_v<T, unsigned char>)
 {
     return Slice(v.data(), v.size());
 }
diff --git a/include/xrpl/basics/TaggedCache.h b/include/xrpl/basics/TaggedCache.h
index 71ebfc57a4..16c87cf833 100644
--- a/include/xrpl/basics/TaggedCache.h
+++ b/include/xrpl/basics/TaggedCache.h
@@ -212,11 +212,13 @@ public:
     */
     template <class ReturnType = bool>
     auto
-    insert(key_type const& key, T const& value) -> std::enable_if_t<!IsKeyCache, ReturnType>;
+    insert(key_type const& key, T const& value) -> ReturnType
+        requires(!IsKeyCache);
 
     template <class ReturnType = bool>
     auto
-    insert(key_type const& key) -> std::enable_if_t<IsKeyCache, ReturnType>;
+    insert(key_type const& key) -> ReturnType
+        requires IsKeyCache;
 
     // VFALCO NOTE It looks like this returns a copy of the data in
     //             the output parameter 'data'. This could be expensive.
diff --git a/include/xrpl/basics/TaggedCache.ipp b/include/xrpl/basics/TaggedCache.ipp
index ca50bb64b7..b79561c71a 100644
--- a/include/xrpl/basics/TaggedCache.ipp
+++ b/include/xrpl/basics/TaggedCache.ipp
@@ -503,7 +503,8 @@ template <
 template <class ReturnType>
 inline auto
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    insert(key_type const& key, T const& value) -> std::enable_if_t<!IsKeyCache, ReturnType>
+    insert(key_type const& key, T const& value) -> ReturnType
+    requires(!IsKeyCache)
 {
     static_assert(
         std::is_same_v<std::shared_ptr<T>, SharedPointerType> ||
@@ -533,7 +534,8 @@ template <
 template <class ReturnType>
 inline auto
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    insert(key_type const& key) -> std::enable_if_t<IsKeyCache, ReturnType>
+    insert(key_type const& key) -> ReturnType
+    requires IsKeyCache
 {
     std::scoped_lock const lock(mutex_);
     clock_type::time_point const now(clock_.now());
diff --git a/include/xrpl/basics/ToString.h b/include/xrpl/basics/ToString.h
index 7764c1e3e3..e9f8f43633 100644
--- a/include/xrpl/basics/ToString.h
+++ b/include/xrpl/basics/ToString.h
@@ -12,8 +12,9 @@ namespace xrpl {
  */
 
 template <class T>
-std::enable_if_t<std::is_arithmetic_v<T>, std::string>
+std::string
 to_string(T t)  // NOLINT(readability-identifier-naming)
+    requires(std::is_arithmetic_v<T>)
 {
     return std::to_string(t);
 }
diff --git a/include/xrpl/basics/base_uint.h b/include/xrpl/basics/base_uint.h
index c60fbf35b4..481a7dbd77 100644
--- a/include/xrpl/basics/base_uint.h
+++ b/include/xrpl/basics/base_uint.h
@@ -280,12 +280,11 @@ public:
     {
     }
 
-    template <
-        class Container,
-        class = std::enable_if_t<
-            detail::IsContiguousContainer<Container>::value &&
-            std::is_trivially_copyable_v<typename Container::value_type>>>
+    template <class Container>
     explicit BaseUInt(Container const& c)
+        requires(
+            detail::IsContiguousContainer<Container>::value &&
+            std::is_trivially_copyable_v<typename Container::value_type>)
     {
         // Use AlwaysFalseT so the static_assert condition is dependent
         // and only triggers when this constructor template is instantiated.
@@ -295,13 +294,12 @@ public:
             "Use base_uint::fromRaw instead.");
     }
 
-    template <
-        class Container,
-        class = std::enable_if_t<
-            detail::IsContiguousContainer<Container>::value &&
-            std::is_trivially_copyable_v<typename Container::value_type>>>
+    template <class Container>
     static BaseUInt
     fromRaw(Container const& c)
+        requires(
+            detail::IsContiguousContainer<Container>::value &&
+            std::is_trivially_copyable_v<typename Container::value_type>)
     {
         BaseUInt result;
         XRPL_ASSERT(
@@ -312,11 +310,11 @@ public:
     }
 
     template <class Container>
-    std::enable_if_t<
-        detail::IsContiguousContainer<Container>::value &&
-            std::is_trivially_copyable_v<typename Container::value_type>,
-        BaseUInt&>
+    BaseUInt&
     operator=(Container const& c)
+        requires(
+            detail::IsContiguousContainer<Container>::value &&
+            std::is_trivially_copyable_v<typename Container::value_type>)
     {
         XRPL_ASSERT(
             c.size() * sizeof(typename Container::value_type) == size(),
diff --git a/include/xrpl/basics/random.h b/include/xrpl/basics/random.h
index cceaa6f029..c544e7d0c8 100644
--- a/include/xrpl/basics/random.h
+++ b/include/xrpl/basics/random.h
@@ -91,8 +91,9 @@ defaultPrng()
 */
 /** @{ */
 template <class Engine, class Integral>
-std::enable_if_t<std::is_integral_v<Integral> && detail::is_engine<Engine>::value, Integral>
+Integral
 randInt(Engine& engine, Integral min, Integral max)
+    requires(std::is_integral_v<Integral> && detail::is_engine<Engine>::value)
 {
     XRPL_ASSERT(max > min, "xrpl::randInt : max over min inputs");
 
@@ -103,36 +104,41 @@ randInt(Engine& engine, Integral min, Integral max)
 }
 
 template <class Integral>
-std::enable_if_t<std::is_integral_v<Integral>, Integral>
+Integral
 randInt(Integral min, Integral max)
+    requires(std::is_integral_v<Integral>)
 {
     return randInt(defaultPrng(), min, max);
 }
 
 template <class Engine, class Integral>
-std::enable_if_t<std::is_integral_v<Integral> && detail::is_engine<Engine>::value, Integral>
+Integral
 randInt(Engine& engine, Integral max)
+    requires(std::is_integral_v<Integral> && detail::is_engine<Engine>::value)
 {
     return randInt(engine, Integral(0), max);
 }
 
 template <class Integral>
-std::enable_if_t<std::is_integral_v<Integral>, Integral>
+Integral
 randInt(Integral max)
+    requires(std::is_integral_v<Integral>)
 {
     return randInt(defaultPrng(), max);
 }
 
 template <class Integral, class Engine>
-std::enable_if_t<std::is_integral_v<Integral> && detail::is_engine<Engine>::value, Integral>
+Integral
 randInt(Engine& engine)
+    requires(std::is_integral_v<Integral> && detail::is_engine<Engine>::value)
 {
     return randInt(engine, std::numeric_limits<Integral>::max());
 }
 
 template <class Integral = int>
-std::enable_if_t<std::is_integral_v<Integral>, Integral>
+Integral
 randInt()
+    requires(std::is_integral_v<Integral>)
 {
     return randInt(defaultPrng(), std::numeric_limits<Integral>::max());
 }
@@ -141,19 +147,20 @@ randInt()
 /** Return a random byte */
 /** @{ */
 template <class Byte, class Engine>
-std::enable_if_t<
-    (std::is_same_v<Byte, unsigned char> || std::is_same_v<Byte, std::uint8_t>) &&
-        detail::is_engine<Engine>::value,
-    Byte>
+Byte
 randByte(Engine& engine)
+    requires(
+        (std::is_same_v<Byte, unsigned char> || std::is_same_v<Byte, std::uint8_t>) &&
+        detail::is_engine<Engine>::value)
 {
     return static_cast<Byte>(randInt<Engine, std::uint32_t>(
         engine, std::numeric_limits<Byte>::min(), std::numeric_limits<Byte>::max()));
 }
 
 template <class Byte = std::uint8_t>
-std::enable_if_t<(std::is_same_v<Byte, unsigned char> || std::is_same_v<Byte, std::uint8_t>), Byte>
+Byte
 randByte()
+    requires(std::is_same_v<Byte, unsigned char> || std::is_same_v<Byte, std::uint8_t>)
 {
     return randByte<Byte>(defaultPrng());
 }
diff --git a/include/xrpl/basics/safe_cast.h b/include/xrpl/basics/safe_cast.h
index 714146e089..483a783f5d 100644
--- a/include/xrpl/basics/safe_cast.h
+++ b/include/xrpl/basics/safe_cast.h
@@ -15,8 +15,9 @@ concept SafeToCast = (std::is_integral_v<Src> && std::is_integral_v<Dest>) &&
                                                      : sizeof(Dest) >= sizeof(Src));
 
 template <class Dest, class Src>
-constexpr std::enable_if_t<std::is_integral_v<Dest> && std::is_integral_v<Src>, Dest>
+constexpr Dest
 safeCast(Src s) noexcept
+    requires(std::is_integral_v<Dest> && std::is_integral_v<Src>)
 {
     static_assert(
         std::is_signed_v<Dest> || std::is_unsigned_v<Src>, "Cannot cast signed to unsigned");
@@ -28,15 +29,17 @@ safeCast(Src s) noexcept
 }
 
 template <class Dest, class Src>
-constexpr std::enable_if_t<std::is_enum_v<Dest> && std::is_integral_v<Src>, Dest>
+constexpr Dest
 safeCast(Src s) noexcept
+    requires(std::is_enum_v<Dest> && std::is_integral_v<Src>)
 {
     return static_cast<Dest>(safeCast<std::underlying_type_t<Dest>>(s));
 }
 
 template <class Dest, class Src>
-constexpr std::enable_if_t<std::is_integral_v<Dest> && std::is_enum_v<Src>, Dest>
+constexpr Dest
 safeCast(Src s) noexcept
+    requires(std::is_integral_v<Dest> && std::is_enum_v<Src>)
 {
     return safeCast<Dest>(static_cast<std::underlying_type_t<Src>>(s));
 }
@@ -46,8 +49,9 @@ safeCast(Src s) noexcept
 // underlying types become safe, it can be converted to a safe_cast.
 
 template <class Dest, class Src>
-constexpr std::enable_if_t<std::is_integral_v<Dest> && std::is_integral_v<Src>, Dest>
+constexpr Dest
 unsafeCast(Src s) noexcept
+    requires(std::is_integral_v<Dest> && std::is_integral_v<Src>)
 {
     static_assert(
         !SafeToCast<Src, Dest>,
@@ -57,15 +61,17 @@ unsafeCast(Src s) noexcept
 }
 
 template <class Dest, class Src>
-constexpr std::enable_if_t<std::is_enum_v<Dest> && std::is_integral_v<Src>, Dest>
+constexpr Dest
 unsafeCast(Src s) noexcept
+    requires(std::is_enum_v<Dest> && std::is_integral_v<Src>)
 {
     return static_cast<Dest>(unsafeCast<std::underlying_type_t<Dest>>(s));
 }
 
 template <class Dest, class Src>
-constexpr std::enable_if_t<std::is_integral_v<Dest> && std::is_enum_v<Src>, Dest>
+constexpr Dest
 unsafeCast(Src s) noexcept
+    requires(std::is_integral_v<Dest> && std::is_enum_v<Src>)
 {
     return unsafeCast<Dest>(static_cast<std::underlying_type_t<Src>>(s));
 }
diff --git a/include/xrpl/basics/scope.h b/include/xrpl/basics/scope.h
index cfd21e6e30..e63bb69eb5 100644
--- a/include/xrpl/basics/scope.h
+++ b/include/xrpl/basics/scope.h
@@ -46,11 +46,9 @@ public:
     operator=(ScopeExit&&) = delete;
 
     template <class EFP>
-    explicit ScopeExit(
-        EFP&& f,
-        std::enable_if_t<
-            !std::is_same_v<std::remove_cv_t<EFP>, ScopeExit> &&
-            std::is_constructible_v<EF, EFP>>* = 0) noexcept
+    explicit ScopeExit(EFP&& f) noexcept
+        requires(
+            !std::is_same_v<std::remove_cv_t<EFP>, ScopeExit> && std::is_constructible_v<EF, EFP>)
         : exitFunction_{std::forward<EFP>(f)}
     {
         static_assert(std::is_nothrow_constructible_v<EF, decltype(std::forward<EFP>(f))>);
@@ -93,11 +91,9 @@ public:
     operator=(ScopeFail&&) = delete;
 
     template <class EFP>
-    explicit ScopeFail(
-        EFP&& f,
-        std::enable_if_t<
-            !std::is_same_v<std::remove_cv_t<EFP>, ScopeFail> &&
-            std::is_constructible_v<EF, EFP>>* = 0) noexcept
+    explicit ScopeFail(EFP&& f) noexcept
+        requires(
+            !std::is_same_v<std::remove_cv_t<EFP>, ScopeFail> && std::is_constructible_v<EF, EFP>)
         : exitFunction_{std::forward<EFP>(f)}
     {
         static_assert(std::is_nothrow_constructible_v<EF, decltype(std::forward<EFP>(f))>);
@@ -140,12 +136,11 @@ public:
     operator=(ScopeSuccess&&) = delete;
 
     template <class EFP>
-    explicit ScopeSuccess(
-        EFP&& f,
-        std::enable_if_t<
+    explicit ScopeSuccess(EFP&& f) noexcept(
+        std::is_nothrow_constructible_v<EF, EFP> || std::is_nothrow_constructible_v<EF, EFP&>)
+        requires(
             !std::is_same_v<std::remove_cv_t<EFP>, ScopeSuccess> &&
-            std::is_constructible_v<EF, EFP>>* =
-            0) noexcept(std::is_nothrow_constructible_v<EF, EFP> || std::is_nothrow_constructible_v<EF, EFP&>)
+            std::is_constructible_v<EF, EFP>)
         : exitFunction_{std::forward<EFP>(f)}
     {
     }
diff --git a/include/xrpl/basics/tagged_integer.h b/include/xrpl/basics/tagged_integer.h
index 8fbd2a274b..5a088db863 100644
--- a/include/xrpl/basics/tagged_integer.h
+++ b/include/xrpl/basics/tagged_integer.h
@@ -43,10 +43,10 @@ public:
 
     TaggedInteger() = default;
 
-    template <
-        class OtherInt,
-        class = std::enable_if_t<std::is_integral_v<OtherInt> && sizeof(OtherInt) <= sizeof(Int)>>
-    explicit constexpr TaggedInteger(OtherInt value) noexcept : value_(value)
+    template <class OtherInt>
+    explicit constexpr TaggedInteger(OtherInt value) noexcept
+        requires(std::is_integral_v<OtherInt> && sizeof(OtherInt) <= sizeof(Int))
+        : value_(value)
     {
         static_assert(sizeof(TaggedInteger) == sizeof(Int), "tagged_integer is adding padding");
     }
diff --git a/include/xrpl/beast/container/aged_container_utility.h b/include/xrpl/beast/container/aged_container_utility.h
index 7cda863fab..f43e59b0f7 100644
--- a/include/xrpl/beast/container/aged_container_utility.h
+++ b/include/xrpl/beast/container/aged_container_utility.h
@@ -4,14 +4,14 @@
 
 #include <chrono>
 #include <cstddef>
-#include <type_traits>
 
 namespace beast {
 
 /** Expire aged container items past the specified age. */
 template <class AgedContainer, class Rep, class Period>
-std::enable_if_t<IsAgedContainer<AgedContainer>::value, std::size_t>
+std::size_t
 expire(AgedContainer& c, std::chrono::duration<Rep, Period> const& age)
+    requires(IsAgedContainer<AgedContainer>::value)
 {
     std::size_t n(0);
     auto const expired(c.clock().now() - age);
diff --git a/include/xrpl/beast/container/detail/aged_container_iterator.h b/include/xrpl/beast/container/detail/aged_container_iterator.h
index 02fb3927dd..d6c061bb86 100644
--- a/include/xrpl/beast/container/detail/aged_container_iterator.h
+++ b/include/xrpl/beast/container/detail/aged_container_iterator.h
@@ -30,20 +30,19 @@ public:
 
     // Disable constructing a const_iterator from a non-const_iterator.
     // Converting between reverse and non-reverse iterators should be explicit.
-    template <
-        bool OtherIsConst,
-        class OtherIterator,
-        class = std::enable_if_t<
-            (!OtherIsConst || IsConst) &&
-            !static_cast<bool>(std::is_same_v<Iterator, OtherIterator>)>>
+    template <bool OtherIsConst, class OtherIterator>
     explicit AgedContainerIterator(AgedContainerIterator<OtherIsConst, OtherIterator> const& other)
+        requires(
+            (!OtherIsConst || IsConst) &&
+            !static_cast<bool>(std::is_same_v<Iterator, OtherIterator>))
         : iter_(other.iter_)
     {
     }
 
     // Disable constructing a const_iterator from a non-const_iterator.
-    template <bool OtherIsConst, class = std::enable_if_t<!OtherIsConst || IsConst>>
+    template <bool OtherIsConst>
     AgedContainerIterator(AgedContainerIterator<OtherIsConst, Iterator> const& other)
+        requires(!OtherIsConst || IsConst)
         : iter_(other.iter_)
     {
     }
@@ -52,7 +51,8 @@ public:
     template <bool OtherIsConst, class OtherIterator>
     auto
     operator=(AgedContainerIterator<OtherIsConst, OtherIterator> const& other)
-        -> std::enable_if_t<!OtherIsConst || IsConst, AgedContainerIterator&>
+        -> AgedContainerIterator&
+        requires(!OtherIsConst || IsConst)
     {
         iter_ = other.iter_;
         return *this;
diff --git a/include/xrpl/beast/container/detail/aged_ordered_container.h b/include/xrpl/beast/container/detail/aged_ordered_container.h
index 0533a51f00..f739f05d2c 100644
--- a/include/xrpl/beast/container/detail/aged_ordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_ordered_container.h
@@ -111,10 +111,9 @@ private:
         {
         }
 
-        template <
-            class... Args,
-            class = std::enable_if_t<std::is_constructible_v<value_type, Args...>>>
+        template <class... Args>
         Element(time_point const& when, Args&&... args)
+            requires(std::is_constructible_v<value_type, Args...>)
             : value(std::forward<Args>(args)...), when(when)
         {
         }
@@ -608,35 +607,25 @@ public:
     //
     //--------------------------------------------------------------------------
 
-    template <
-        class K,
-        bool MaybeMulti = IsMulti,
-        bool MaybeMap = IsMap,
-        class = std::enable_if_t<MaybeMap && !MaybeMulti>>
+    template <class K, bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     std::conditional_t<IsMap, T, void*>&
-    at(K const& k);
+    at(K const& k)
+        requires(MaybeMap && !MaybeMulti);
 
-    template <
-        class K,
-        bool MaybeMulti = IsMulti,
-        bool MaybeMap = IsMap,
-        class = std::enable_if_t<MaybeMap && !MaybeMulti>>
+    template <class K, bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     std::conditional<IsMap, T, void*>::type const&
-    at(K const& k) const;
+    at(K const& k) const
+        requires(MaybeMap && !MaybeMulti);
 
-    template <
-        bool MaybeMulti = IsMulti,
-        bool MaybeMap = IsMap,
-        class = std::enable_if_t<MaybeMap && !MaybeMulti>>
+    template <bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     std::conditional_t<IsMap, T, void*>&
-    operator[](Key const& key);
+    operator[](Key const& key)
+        requires(MaybeMap && !MaybeMulti);
 
-    template <
-        bool MaybeMulti = IsMulti,
-        bool MaybeMap = IsMap,
-        class = std::enable_if_t<MaybeMap && !MaybeMulti>>
+    template <bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     std::conditional_t<IsMap, T, void*>&
-    operator[](Key&& key);
+    operator[](Key&& key)
+        requires(MaybeMap && !MaybeMulti);
 
     //--------------------------------------------------------------------------
     //
@@ -770,35 +759,40 @@ public:
     // map, set
     template <bool MaybeMulti = IsMulti>
     auto
-    insert(value_type const& value) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>;
+    insert(value_type const& value) -> std::pair<iterator, bool>
+        requires(!MaybeMulti);
 
     // multimap, multiset
     template <bool MaybeMulti = IsMulti>
     auto
-    insert(value_type const& value) -> std::enable_if_t<MaybeMulti, iterator>;
+    insert(value_type const& value) -> iterator
+        requires MaybeMulti;
 
     // set
     template <bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     auto
-    insert(value_type&& value)
-        -> std::enable_if_t<!MaybeMulti && !MaybeMap, std::pair<iterator, bool>>;
+    insert(value_type&& value) -> std::pair<iterator, bool>
+        requires(!MaybeMulti && !MaybeMap);
 
     // multiset
     template <bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     auto
-    insert(value_type&& value) -> std::enable_if_t<MaybeMulti && !MaybeMap, iterator>;
+    insert(value_type&& value) -> iterator
+        requires(MaybeMulti && !MaybeMap);
 
     //---
 
     // map, set
     template <bool MaybeMulti = IsMulti>
     auto
-    insert(const_iterator hint, value_type const& value) -> std::enable_if_t<!MaybeMulti, iterator>;
+    insert(const_iterator hint, value_type const& value) -> iterator
+        requires(!MaybeMulti);
 
     // multimap, multiset
     template <bool MaybeMulti = IsMulti>
-    std::enable_if_t<MaybeMulti, iterator>
+    iterator
     insert(const_iterator /*hint*/, value_type const& value)
+        requires MaybeMulti
     {
         // VFALCO TODO Figure out how to utilize 'hint'
         return insert(value);
@@ -807,12 +801,14 @@ public:
     // map, set
     template <bool MaybeMulti = IsMulti>
     auto
-    insert(const_iterator hint, value_type&& value) -> std::enable_if_t<!MaybeMulti, iterator>;
+    insert(const_iterator hint, value_type&& value) -> iterator
+        requires(!MaybeMulti);
 
     // multimap, multiset
     template <bool MaybeMulti = IsMulti>
-    std::enable_if_t<MaybeMulti, iterator>
+    iterator
     insert(const_iterator /*hint*/, value_type&& value)
+        requires MaybeMulti
     {
         // VFALCO TODO Figure out how to utilize 'hint'
         return insert(std::move(value));
@@ -820,20 +816,18 @@ public:
 
     // map, multimap
     template <class P, bool MaybeMap = IsMap>
-    std::enable_if_t<
-        MaybeMap && std::is_constructible_v<value_type, P&&>,
-        std::conditional_t<IsMulti, iterator, std::pair<iterator, bool>>>
+    std::conditional_t<IsMulti, iterator, std::pair<iterator, bool>>
     insert(P&& value)
+        requires(MaybeMap && std::is_constructible_v<value_type, P &&>)
     {
         return emplace(std::forward<P>(value));
     }
 
     // map, multimap
     template <class P, bool MaybeMap = IsMap>
-    std::enable_if_t<
-        MaybeMap && std::is_constructible_v<value_type, P&&>,
-        std::conditional_t<IsMulti, iterator, std::pair<iterator, bool>>>
+    std::conditional_t<IsMulti, iterator, std::pair<iterator, bool>>
     insert(const_iterator hint, P&& value)
+        requires(MaybeMap && std::is_constructible_v<value_type, P &&>)
     {
         return emplaceHint(hint, std::forward<P>(value));
     }
@@ -855,46 +849,45 @@ public:
     // map, set
     template <bool MaybeMulti = IsMulti, class... Args>
     auto
-    emplace(Args&&... args) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>;
+    emplace(Args&&... args) -> std::pair<iterator, bool>
+        requires(!MaybeMulti);
 
     // multiset, multimap
     template <bool MaybeMulti = IsMulti, class... Args>
     auto
-    emplace(Args&&... args) -> std::enable_if_t<MaybeMulti, iterator>;
+    emplace(Args&&... args) -> iterator
+        requires MaybeMulti;
 
     // map, set
     template <bool MaybeMulti = IsMulti, class... Args>
     auto
-    emplaceHint(const_iterator hint, Args&&... args)
-        -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>;
+    emplaceHint(const_iterator hint, Args&&... args) -> std::pair<iterator, bool>
+        requires(!MaybeMulti);
 
     // multiset, multimap
     template <bool MaybeMulti = IsMulti, class... Args>
-    std::enable_if_t<MaybeMulti, iterator>
+    iterator
     emplaceHint(const_iterator /*hint*/, Args&&... args)
+        requires MaybeMulti
     {
         // VFALCO TODO Figure out how to utilize 'hint'
         return emplace<MaybeMulti>(std::forward<Args>(args)...);
     }
 
-    // enable_if prevents erase (reverse_iterator pos) from compiling
-    template <
-        bool IsConst,
-        class Iterator,
-        class = std::enable_if_t<!IsBoostReverseIterator<Iterator>::value>>
+    // The constraint prevents erase (reverse_iterator pos) from compiling
+    template <bool IsConst, class Iterator>
     beast::detail::AgedContainerIterator<false, Iterator>
-    erase(beast::detail::AgedContainerIterator<IsConst, Iterator> pos);
+    erase(beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
+        requires(!IsBoostReverseIterator<Iterator>::value);
 
-    // enable_if prevents erase (reverse_iterator first, reverse_iterator last)
+    // The constraint prevents erase (reverse_iterator first, reverse_iterator last)
     // from compiling
-    template <
-        bool IsConst,
-        class Iterator,
-        class = std::enable_if_t<!IsBoostReverseIterator<Iterator>::value>>
+    template <bool IsConst, class Iterator>
     beast::detail::AgedContainerIterator<false, Iterator>
     erase(
         beast::detail::AgedContainerIterator<IsConst, Iterator> first,
-        beast::detail::AgedContainerIterator<IsConst, Iterator> last);
+        beast::detail::AgedContainerIterator<IsConst, Iterator> last)
+        requires(!IsBoostReverseIterator<Iterator>::value);
 
     template <class K>
     auto
@@ -905,13 +898,11 @@ public:
 
     //--------------------------------------------------------------------------
 
-    // enable_if prevents touch (reverse_iterator pos) from compiling
-    template <
-        bool IsConst,
-        class Iterator,
-        class = std::enable_if_t<!IsBoostReverseIterator<Iterator>::value>>
+    // The constraint prevents touch (reverse_iterator pos) from compiling
+    template <bool IsConst, class Iterator>
     void
     touch(beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
+        requires(!IsBoostReverseIterator<Iterator>::value)
     {
         touch(pos, clock().now());
     }
@@ -1142,25 +1133,25 @@ public:
     }
 
 private:
-    // enable_if prevents erase (reverse_iterator pos, now) from compiling
-    template <
-        bool IsConst,
-        class Iterator,
-        class = std::enable_if_t<!IsBoostReverseIterator<Iterator>::value>>
+    // The constraint prevents erase (reverse_iterator pos, now) from compiling
+    template <bool IsConst, class Iterator>
     void
     touch(
         beast::detail::AgedContainerIterator<IsConst, Iterator> pos,
-        clock_type::time_point const& now);
+        clock_type::time_point const& now)
+        requires(!IsBoostReverseIterator<Iterator>::value);
 
     template <
         bool MaybePropagate = std::allocator_traits<Allocator>::propagate_on_container_swap::value>
-    std::enable_if_t<MaybePropagate>
-    swapData(AgedOrderedContainer& other) noexcept;
+    void
+    swapData(AgedOrderedContainer& other) noexcept
+        requires MaybePropagate;
 
     template <
         bool MaybePropagate = std::allocator_traits<Allocator>::propagate_on_container_swap::value>
-    std::enable_if_t<!MaybePropagate>
-    swapData(AgedOrderedContainer& other) noexcept;
+    void
+    swapData(AgedOrderedContainer& other) noexcept
+        requires(!MaybePropagate);
 
 private:
     ConfigT config_;
@@ -1369,9 +1360,10 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::operato
 //------------------------------------------------------------------------------
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
-template <class K, bool MaybeMulti, bool MaybeMap, class>
+template <class K, bool MaybeMulti, bool MaybeMap>
 std::conditional_t<IsMap, T, void*>&
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::at(K const& k)
+    requires(MaybeMap && !MaybeMulti)
 {
     auto const iter(cont_.find(k, std::cref(config_.keyCompare())));
     if (iter == cont_.end())
@@ -1380,9 +1372,10 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::at(K co
 }
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
-template <class K, bool MaybeMulti, bool MaybeMap, class>
+template <class K, bool MaybeMulti, bool MaybeMap>
 std::conditional<IsMap, T, void*>::type const&
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::at(K const& k) const
+    requires(MaybeMap && !MaybeMulti)
 {
     auto const iter(cont_.find(k, std::cref(config_.keyCompare())));
     if (iter == cont_.end())
@@ -1391,9 +1384,10 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::at(K co
 }
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
-template <bool MaybeMulti, bool MaybeMap, class>
+template <bool MaybeMulti, bool MaybeMap>
 std::conditional_t<IsMap, T, void*>&
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::operator[](Key const& key)
+    requires(MaybeMap && !MaybeMulti)
 {
     typename cont_type::insert_commit_data d;
     auto const result(cont_.insert_check(key, std::cref(config_.keyCompare()), d));
@@ -1409,9 +1403,10 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::operato
 }
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
-template <bool MaybeMulti, bool MaybeMap, class>
+template <bool MaybeMulti, bool MaybeMap>
 std::conditional_t<IsMap, T, void*>&
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::operator[](Key&& key)
+    requires(MaybeMap && !MaybeMulti)
 {
     typename cont_type::insert_commit_data d;
     auto const result(cont_.insert_check(key, std::cref(config_.keyCompare()), d));
@@ -1445,7 +1440,8 @@ template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compa
 template <bool MaybeMulti>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::insert(
-    value_type const& value) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>
+    value_type const& value) -> std::pair<iterator, bool>
+    requires(!MaybeMulti)
 {
     typename cont_type::insert_commit_data d;
     auto const result(cont_.insert_check(extract(value), std::cref(config_.keyCompare()), d));
@@ -1464,7 +1460,8 @@ template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compa
 template <bool MaybeMulti>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::insert(
-    value_type const& value) -> std::enable_if_t<MaybeMulti, iterator>
+    value_type const& value) -> iterator
+    requires MaybeMulti
 {
     auto const before(cont_.upper_bound(extract(value), std::cref(config_.keyCompare())));
     Element* const p(newElement(value));
@@ -1478,7 +1475,8 @@ template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compa
 template <bool MaybeMulti, bool MaybeMap>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::insert(value_type&& value)
-    -> std::enable_if_t<!MaybeMulti && !MaybeMap, std::pair<iterator, bool>>
+    -> std::pair<iterator, bool>
+    requires(!MaybeMulti && !MaybeMap)
 {
     typename cont_type::insert_commit_data d;
     auto const result(cont_.insert_check(extract(value), std::cref(config_.keyCompare()), d));
@@ -1497,7 +1495,8 @@ template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compa
 template <bool MaybeMulti, bool MaybeMap>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::insert(value_type&& value)
-    -> std::enable_if_t<MaybeMulti && !MaybeMap, iterator>
+    -> iterator
+    requires(MaybeMulti && !MaybeMap)
 {
     auto const before(cont_.upper_bound(extract(value), std::cref(config_.keyCompare())));
     Element* const p(newElement(std::move(value)));
@@ -1514,7 +1513,8 @@ template <bool MaybeMulti>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::insert(
     const_iterator hint,
-    value_type const& value) -> std::enable_if_t<!MaybeMulti, iterator>
+    value_type const& value) -> iterator
+    requires(!MaybeMulti)
 {
     typename cont_type::insert_commit_data d;
     auto const result(
@@ -1535,7 +1535,8 @@ template <bool MaybeMulti>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::insert(
     const_iterator hint,
-    value_type&& value) -> std::enable_if_t<!MaybeMulti, iterator>
+    value_type&& value) -> iterator
+    requires(!MaybeMulti)
 {
     typename cont_type::insert_commit_data d;
     auto const result(
@@ -1555,7 +1556,8 @@ template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compa
 template <bool MaybeMulti, class... Args>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::emplace(Args&&... args)
-    -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>
+    -> std::pair<iterator, bool>
+    requires(!MaybeMulti)
 {
     // VFALCO NOTE Its unfortunate that we need to
     //             construct element here
@@ -1577,7 +1579,8 @@ template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compa
 template <bool MaybeMulti, class... Args>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::emplace(Args&&... args)
-    -> std::enable_if_t<MaybeMulti, iterator>
+    -> iterator
+    requires MaybeMulti
 {
     Element* const p(newElement(std::forward<Args>(args)...));
     auto const before(cont_.upper_bound(extract(p->value), std::cref(config_.keyCompare())));
@@ -1592,7 +1595,8 @@ template <bool MaybeMulti, class... Args>
 auto
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::emplaceHint(
     const_iterator hint,
-    Args&&... args) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>
+    Args&&... args) -> std::pair<iterator, bool>
+    requires(!MaybeMulti)
 {
     // VFALCO NOTE Its unfortunate that we need to
     //             construct element here
@@ -1611,21 +1615,23 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::emplace
 }
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
-template <bool IsConst, class Iterator, class>
+template <bool IsConst, class Iterator>
 beast::detail::AgedContainerIterator<false, Iterator>
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::erase(
     beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
+    requires(!IsBoostReverseIterator<Iterator>::value)
 {
     unlinkAndDeleteElement(&*((pos++).iterator()));
     return beast::detail::AgedContainerIterator<false, Iterator>(pos.iterator());
 }
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
-template <bool IsConst, class Iterator, class>
+template <bool IsConst, class Iterator>
 beast::detail::AgedContainerIterator<false, Iterator>
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::erase(
     beast::detail::AgedContainerIterator<IsConst, Iterator> first,
     beast::detail::AgedContainerIterator<IsConst, Iterator> last)
+    requires(!IsBoostReverseIterator<Iterator>::value)
 {
     for (; first != last;)
         unlinkAndDeleteElement(&*((first++).iterator()));
@@ -1728,11 +1734,12 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::operato
 //------------------------------------------------------------------------------
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
-template <bool IsConst, class Iterator, class>
+template <bool IsConst, class Iterator>
 void
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::touch(
     beast::detail::AgedContainerIterator<IsConst, Iterator> pos,
     clock_type::time_point const& now)
+    requires(!IsBoostReverseIterator<Iterator>::value)
 {
     auto& e(*pos.iterator());
     e.when = now;
@@ -1742,9 +1749,10 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::touch(
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
 template <bool MaybePropagate>
-std::enable_if_t<MaybePropagate>
+void
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::swapData(
     AgedOrderedContainer& other) noexcept
+    requires MaybePropagate
 {
     std::swap(config_.keyCompare(), other.config_.keyCompare());
     std::swap(config_.alloc(), other.config_.alloc());
@@ -1753,9 +1761,10 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::swapDat
 
 template <bool IsMulti, bool IsMap, class Key, class T, class Clock, class Compare, class Allocator>
 template <bool MaybePropagate>
-std::enable_if_t<!MaybePropagate>
+void
 AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::swapData(
     AgedOrderedContainer& other) noexcept
+    requires(!MaybePropagate)
 {
     std::swap(config_.keyCompare(), other.config_.keyCompare());
     std::swap(config_.clock, other.config_.clock);
diff --git a/include/xrpl/beast/container/detail/aged_unordered_container.h b/include/xrpl/beast/container/detail/aged_unordered_container.h
index 782f36cd52..4c0882b04a 100644
--- a/include/xrpl/beast/container/detail/aged_unordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_unordered_container.h
@@ -117,10 +117,9 @@ private:
         {
         }
 
-        template <
-            class... Args,
-            class = std::enable_if_t<std::is_constructible_v<value_type, Args...>>>
+        template <class... Args>
         Element(time_point const& when, Args&&... args)
+            requires(std::is_constructible_v<value_type, Args...>)
             : value(std::forward<Args>(args)...), when(when)
         {
         }
@@ -841,35 +840,25 @@ public:
     //
     //--------------------------------------------------------------------------
 
-    template <
-        class K,
-        bool MaybeMulti = IsMulti,
-        bool MaybeMap = IsMap,
-        class = std::enable_if_t<MaybeMap && !MaybeMulti>>
+    template <class K, bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     std::conditional_t<IsMap, T, void*>&
-    at(K const& k);
+    at(K const& k)
+        requires(MaybeMap && !MaybeMulti);
 
-    template <
-        class K,
-        bool MaybeMulti = IsMulti,
-        bool MaybeMap = IsMap,
-        class = std::enable_if_t<MaybeMap && !MaybeMulti>>
+    template <class K, bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     std::conditional<IsMap, T, void*>::type const&
-    at(K const& k) const;
+    at(K const& k) const
+        requires(MaybeMap && !MaybeMulti);
 
-    template <
-        bool MaybeMulti = IsMulti,
-        bool MaybeMap = IsMap,
-        class = std::enable_if_t<MaybeMap && !MaybeMulti>>
+    template <bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     std::conditional_t<IsMap, T, void*>&
-    operator[](Key const& key);
+    operator[](Key const& key)
+        requires(MaybeMap && !MaybeMulti);
 
-    template <
-        bool MaybeMulti = IsMulti,
-        bool MaybeMap = IsMap,
-        class = std::enable_if_t<MaybeMap && !MaybeMulti>>
+    template <bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     std::conditional_t<IsMap, T, void*>&
-    operator[](Key&& key);
+    operator[](Key&& key)
+        requires(MaybeMap && !MaybeMulti);
 
     //--------------------------------------------------------------------------
     //
@@ -967,28 +956,32 @@ public:
     // map, set
     template <bool MaybeMulti = IsMulti>
     auto
-    insert(value_type const& value) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>;
+    insert(value_type const& value) -> std::pair<iterator, bool>
+        requires(!MaybeMulti);
 
     // multimap, multiset
     template <bool MaybeMulti = IsMulti>
     auto
-    insert(value_type const& value) -> std::enable_if_t<MaybeMulti, iterator>;
+    insert(value_type const& value) -> iterator
+        requires MaybeMulti;
 
     // map, set
     template <bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     auto
-    insert(value_type&& value)
-        -> std::enable_if_t<!MaybeMulti && !MaybeMap, std::pair<iterator, bool>>;
+    insert(value_type&& value) -> std::pair<iterator, bool>
+        requires(!MaybeMulti && !MaybeMap);
 
     // multimap, multiset
     template <bool MaybeMulti = IsMulti, bool MaybeMap = IsMap>
     auto
-    insert(value_type&& value) -> std::enable_if_t<MaybeMulti && !MaybeMap, iterator>;
+    insert(value_type&& value) -> iterator
+        requires(MaybeMulti && !MaybeMap);
 
     // map, set
     template <bool MaybeMulti = IsMulti>
-    std::enable_if_t<!MaybeMulti, iterator>
+    iterator
     insert(const_iterator /*hint*/, value_type const& value)
+        requires(!MaybeMulti)
     {
         // Hint is ignored but we provide the interface so
         // callers may use ordered and unordered interchangeably.
@@ -997,8 +990,9 @@ public:
 
     // multimap, multiset
     template <bool MaybeMulti = IsMulti>
-    std::enable_if_t<MaybeMulti, iterator>
+    iterator
     insert(const_iterator /*hint*/, value_type const& value)
+        requires MaybeMulti
     {
         // VFALCO TODO The hint could be used to let
         //             the client order equal ranges
@@ -1007,8 +1001,9 @@ public:
 
     // map, set
     template <bool MaybeMulti = IsMulti>
-    std::enable_if_t<!MaybeMulti, iterator>
+    iterator
     insert(const_iterator /*hint*/, value_type&& value)
+        requires(!MaybeMulti)
     {
         // Hint is ignored but we provide the interface so
         // callers may use ordered and unordered interchangeably.
@@ -1017,8 +1012,9 @@ public:
 
     // multimap, multiset
     template <bool MaybeMulti = IsMulti>
-    std::enable_if_t<MaybeMulti, iterator>
+    iterator
     insert(const_iterator /*hint*/, value_type&& value)
+        requires MaybeMulti
     {
         // VFALCO TODO The hint could be used to let
         //             the client order equal ranges
@@ -1027,20 +1023,18 @@ public:
 
     // map, multimap
     template <class P, bool MaybeMap = IsMap>
-    std::enable_if_t<
-        MaybeMap && std::is_constructible_v<value_type, P&&>,
-        std::conditional_t<IsMulti, iterator, std::pair<iterator, bool>>>
+    std::conditional_t<IsMulti, iterator, std::pair<iterator, bool>>
     insert(P&& value)
+        requires(MaybeMap && std::is_constructible_v<value_type, P &&>)
     {
         return emplace(std::forward<P>(value));
     }
 
     // map, multimap
     template <class P, bool MaybeMap = IsMap>
-    std::enable_if_t<
-        MaybeMap && std::is_constructible_v<value_type, P&&>,
-        std::conditional_t<IsMulti, iterator, std::pair<iterator, bool>>>
+    std::conditional_t<IsMulti, iterator, std::pair<iterator, bool>>
     insert(const_iterator hint, P&& value)
+        requires(MaybeMap && std::is_constructible_v<value_type, P &&>)
     {
         return emplaceHint(hint, std::forward<P>(value));
     }
@@ -1061,23 +1055,26 @@ public:
     // set, map
     template <bool MaybeMulti = IsMulti, class... Args>
     auto
-    emplace(Args&&... args) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>;
+    emplace(Args&&... args) -> std::pair<iterator, bool>
+        requires(!MaybeMulti);
 
     // multiset, multimap
     template <bool MaybeMulti = IsMulti, class... Args>
     auto
-    emplace(Args&&... args) -> std::enable_if_t<MaybeMulti, iterator>;
+    emplace(Args&&... args) -> iterator
+        requires MaybeMulti;
 
     // set, map
     template <bool MaybeMulti = IsMulti, class... Args>
     auto
-    emplaceHint(const_iterator /*hint*/, Args&&... args)
-        -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>;
+    emplaceHint(const_iterator /*hint*/, Args&&... args) -> std::pair<iterator, bool>
+        requires(!MaybeMulti);
 
     // multiset, multimap
     template <bool MaybeMulti = IsMulti, class... Args>
-    std::enable_if_t<MaybeMulti, iterator>
+    iterator
     emplaceHint(const_iterator /*hint*/, Args&&... args)
+        requires MaybeMulti
     {
         // VFALCO TODO The hint could be used for multi, to let
         //             the client order equal ranges
@@ -1308,7 +1305,7 @@ public:
         class OtherHash,
         class OtherAllocator,
         bool MaybeMulti = IsMulti>
-    std::enable_if_t<!MaybeMulti, bool>
+    bool
     operator==(AgedUnorderedContainer<
                false,
                OtherIsMap,
@@ -1317,7 +1314,8 @@ public:
                OtherDuration,
                OtherHash,
                KeyEqual,
-               OtherAllocator> const& other) const;
+               OtherAllocator> const& other) const
+        requires(!MaybeMulti);
 
     template <
         bool OtherIsMap,
@@ -1327,7 +1325,7 @@ public:
         class OtherHash,
         class OtherAllocator,
         bool MaybeMulti = IsMulti>
-    std::enable_if_t<MaybeMulti, bool>
+    bool
     operator==(AgedUnorderedContainer<
                true,
                OtherIsMap,
@@ -1336,7 +1334,8 @@ public:
                OtherDuration,
                OtherHash,
                KeyEqual,
-               OtherAllocator> const& other) const;
+               OtherAllocator> const& other) const
+        requires MaybeMulti;
 
     template <
         bool OtherIsMulti,
@@ -1381,13 +1380,14 @@ private:
     // map, set
     template <bool MaybeMulti = IsMulti>
     auto
-    insertUnchecked(value_type const& value)
-        -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>;
+    insertUnchecked(value_type const& value) -> std::pair<iterator, bool>
+        requires(!MaybeMulti);
 
     // multimap, multiset
     template <bool MaybeMulti = IsMulti>
     auto
-    insertUnchecked(value_type const& value) -> std::enable_if_t<MaybeMulti, iterator>;
+    insertUnchecked(value_type const& value) -> iterator
+        requires MaybeMulti;
 
     template <class InputIt>
     void
@@ -1428,8 +1428,9 @@ private:
 
     template <
         bool MaybePropagate = std::allocator_traits<Allocator>::propagate_on_container_swap::value>
-    std::enable_if_t<MaybePropagate>
+    void
     swapData(AgedUnorderedContainer& other) noexcept
+        requires MaybePropagate
     {
         std::swap(config_.hashFunction(), other.config_.hashFunction());
         std::swap(config_.keyEq(), other.config_.keyEq());
@@ -1439,8 +1440,9 @@ private:
 
     template <
         bool MaybePropagate = std::allocator_traits<Allocator>::propagate_on_container_swap::value>
-    std::enable_if_t<!MaybePropagate>
+    void
     swapData(AgedUnorderedContainer& other) noexcept
+        requires(!MaybePropagate)
     {
         std::swap(config_.hashFunction(), other.config_.hashFunction());
         std::swap(config_.keyEq(), other.config_.keyEq());
@@ -2094,9 +2096,10 @@ template <
     class Hash,
     class KeyEqual,
     class Allocator>
-template <class K, bool MaybeMulti, bool MaybeMap, class>
+template <class K, bool MaybeMulti, bool MaybeMap>
 std::conditional_t<IsMap, T, void*>&
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::at(K const& k)
+    requires(MaybeMap && !MaybeMulti)
 {
     auto const iter(
         cont_.find(k, std::cref(config_.hashFunction()), std::cref(config_.keyValueEqual())));
@@ -2114,10 +2117,11 @@ template <
     class Hash,
     class KeyEqual,
     class Allocator>
-template <class K, bool MaybeMulti, bool MaybeMap, class>
+template <class K, bool MaybeMulti, bool MaybeMap>
 std::conditional<IsMap, T, void*>::type const&
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::at(
     K const& k) const
+    requires(MaybeMap && !MaybeMulti)
 {
     auto const iter(
         cont_.find(k, std::cref(config_.hashFunction()), std::cref(config_.keyValueEqual())));
@@ -2135,10 +2139,11 @@ template <
     class Hash,
     class KeyEqual,
     class Allocator>
-template <bool MaybeMulti, bool MaybeMap, class>
+template <bool MaybeMulti, bool MaybeMap>
 std::conditional_t<IsMap, T, void*>&
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::operator[](
     Key const& key)
+    requires(MaybeMap && !MaybeMulti)
 {
     maybeRehash(1);
     typename cont_type::insert_commit_data d;
@@ -2164,10 +2169,11 @@ template <
     class Hash,
     class KeyEqual,
     class Allocator>
-template <bool MaybeMulti, bool MaybeMap, class>
+template <bool MaybeMulti, bool MaybeMap>
 std::conditional_t<IsMap, T, void*>&
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::operator[](
     Key&& key)
+    requires(MaybeMap && !MaybeMulti)
 {
     maybeRehash(1);
     typename cont_type::insert_commit_data d;
@@ -2220,7 +2226,8 @@ template <
 template <bool MaybeMulti>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::insert(
-    value_type const& value) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>
+    value_type const& value) -> std::pair<iterator, bool>
+    requires(!MaybeMulti)
 {
     maybeRehash(1);
     typename cont_type::insert_commit_data d;
@@ -2249,7 +2256,8 @@ template <
 template <bool MaybeMulti>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::insert(
-    value_type const& value) -> std::enable_if_t<MaybeMulti, iterator>
+    value_type const& value) -> iterator
+    requires MaybeMulti
 {
     maybeRehash(1);
     Element* const p(newElement(value));
@@ -2271,7 +2279,8 @@ template <
 template <bool MaybeMulti, bool MaybeMap>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::insert(
-    value_type&& value) -> std::enable_if_t<!MaybeMulti && !MaybeMap, std::pair<iterator, bool>>
+    value_type&& value) -> std::pair<iterator, bool>
+    requires(!MaybeMulti && !MaybeMap)
 {
     maybeRehash(1);
     typename cont_type::insert_commit_data d;
@@ -2300,7 +2309,8 @@ template <
 template <bool MaybeMulti, bool MaybeMap>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::insert(
-    value_type&& value) -> std::enable_if_t<MaybeMulti && !MaybeMap, iterator>
+    value_type&& value) -> iterator
+    requires(MaybeMulti && !MaybeMap)
 {
     maybeRehash(1);
     Element* const p(newElement(std::move(value)));
@@ -2323,7 +2333,8 @@ template <
 template <bool MaybeMulti, class... Args>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::emplace(
-    Args&&... args) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>
+    Args&&... args) -> std::pair<iterator, bool>
+    requires(!MaybeMulti)
 {
     maybeRehash(1);
     // VFALCO NOTE Its unfortunate that we need to
@@ -2352,7 +2363,8 @@ template <
 template <bool maybe_multi, class... Args>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::emplace(
-    Args&&... args) -> typename std::enable_if<!maybe_multi, std::pair<iterator, bool>>::type
+    Args&&... args) -> std::pair<iterator, bool>
+    requires(!maybe_multi)
 {
     maybe_rehash(1);
     // VFALCO NOTE Its unfortunate that we need to
@@ -2388,7 +2400,8 @@ template <
 template <bool MaybeMulti, class... Args>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::emplace(
-    Args&&... args) -> std::enable_if_t<MaybeMulti, iterator>
+    Args&&... args) -> iterator
+    requires MaybeMulti
 {
     maybeRehash(1);
     Element* const p(newElement(std::forward<Args>(args)...));
@@ -2411,7 +2424,8 @@ template <bool MaybeMulti, class... Args>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::emplaceHint(
     const_iterator /*hint*/,
-    Args&&... args) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>
+    Args&&... args) -> std::pair<iterator, bool>
+    requires(!MaybeMulti)
 {
     maybeRehash(1);
     // VFALCO NOTE Its unfortunate that we need to
@@ -2562,7 +2576,7 @@ template <
     class OtherHash,
     class OtherAllocator,
     bool MaybeMulti>
-std::enable_if_t<!MaybeMulti, bool>
+bool
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::operator==(
     AgedUnorderedContainer<
         false,
@@ -2573,6 +2587,7 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
         OtherHash,
         KeyEqual,
         OtherAllocator> const& other) const
+    requires(!MaybeMulti)
 {
     if (size() != other.size())
         return false;
@@ -2602,7 +2617,7 @@ template <
     class OtherHash,
     class OtherAllocator,
     bool MaybeMulti>
-std::enable_if_t<MaybeMulti, bool>
+bool
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::operator==(
     AgedUnorderedContainer<
         true,
@@ -2613,6 +2628,7 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
         OtherHash,
         KeyEqual,
         OtherAllocator> const& other) const
+    requires MaybeMulti
 {
     if (size() != other.size())
         return false;
@@ -2649,7 +2665,8 @@ template <
 template <bool MaybeMulti>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::insertUnchecked(
-    value_type const& value) -> std::enable_if_t<!MaybeMulti, std::pair<iterator, bool>>
+    value_type const& value) -> std::pair<iterator, bool>
+    requires(!MaybeMulti)
 {
     typename cont_type::insert_commit_data d;
     auto const result(cont_.insert_check(
@@ -2677,7 +2694,8 @@ template <
 template <bool MaybeMulti>
 auto
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::insertUnchecked(
-    value_type const& value) -> std::enable_if_t<MaybeMulti, iterator>
+    value_type const& value) -> iterator
+    requires MaybeMulti
 {
     Element* const p(newElement(value));
     chronological.list_.push_back(*p);
diff --git a/include/xrpl/beast/core/LexicalCast.h b/include/xrpl/beast/core/LexicalCast.h
index 8faf90f53d..1162d83078 100644
--- a/include/xrpl/beast/core/LexicalCast.h
+++ b/include/xrpl/beast/core/LexicalCast.h
@@ -29,16 +29,18 @@ struct LexicalCast<std::string, In>
     explicit LexicalCast() = default;
 
     template <class Arithmetic = In>
-    std::enable_if_t<std::is_arithmetic_v<Arithmetic>, bool>
+    bool
     operator()(std::string& out, Arithmetic in)
+        requires(std::is_arithmetic_v<Arithmetic>)
     {
         out = std::to_string(in);
         return true;
     }
 
     template <class Enumeration = In>
-    std::enable_if_t<std::is_enum_v<Enumeration>, bool>
+    bool
     operator()(std::string& out, Enumeration in)
+        requires(std::is_enum_v<Enumeration>)
     {
         out = std::to_string(static_cast<std::underlying_type_t<Enumeration>>(in));
         return true;
@@ -56,8 +58,9 @@ struct LexicalCast<Out, std::string_view>
         "beast::LexicalCast can only be used with integral types");
 
     template <class Integral = Out>
-    std::enable_if_t<std::is_integral_v<Integral> && !std::is_same_v<Integral, bool>, bool>
+    bool
     operator()(Integral& out, std::string_view in) const
+        requires(std::is_integral_v<Integral> && !std::is_same_v<Integral, bool>)
     {
         auto first = in.data();
         auto last = in.data() + in.size();
diff --git a/include/xrpl/beast/hash/hash_append.h b/include/xrpl/beast/hash/hash_append.h
index 5f77f41e5d..da499dc612 100644
--- a/include/xrpl/beast/hash/hash_append.h
+++ b/include/xrpl/beast/hash/hash_append.h
@@ -200,26 +200,29 @@ struct IsContiguouslyHashable<T[N], HashAlgorithm>
 // scalars
 
 template <class Hasher, class T>
-inline std::enable_if_t<IsContiguouslyHashable<T, Hasher>::value>
+inline void
 hash_append(Hasher& h, T const& t) noexcept
+    requires(IsContiguouslyHashable<T, Hasher>::value)
 {
     // NOLINTNEXTLINE(bugprone-sizeof-expression)
     h(static_cast<void const*>(std::addressof(t)), sizeof(t));
 }
 
 template <class Hasher, class T>
-inline std::enable_if_t<
-    !IsContiguouslyHashable<T, Hasher>::value &&
-    (std::is_integral_v<T> || std::is_pointer_v<T> || std::is_enum_v<T>)>
+inline void
 hash_append(Hasher& h, T t) noexcept
+    requires(
+        !IsContiguouslyHashable<T, Hasher>::value &&
+        (std::is_integral_v<T> || std::is_pointer_v<T> || std::is_enum_v<T>))
 {
     detail::reverseBytes(t);
     h(std::addressof(t), sizeof(t));
 }
 
 template <class Hasher, class T>
-inline std::enable_if_t<std::is_floating_point_v<T>>
+inline void
 hash_append(Hasher& h, T t) noexcept
+    requires(std::is_floating_point_v<T>)
 {
     if (t == 0)
         t = 0;
@@ -239,36 +242,44 @@ hash_append(Hasher& h, std::nullptr_t) noexcept
 // Forward declarations for ADL purposes
 
 template <class Hasher, class T, std::size_t N>
-std::enable_if_t<!IsContiguouslyHashable<T, Hasher>::value>
-hash_append(Hasher& h, T (&a)[N]) noexcept;
+void
+hash_append(Hasher& h, T (&a)[N]) noexcept
+    requires(!IsContiguouslyHashable<T, Hasher>::value);
 
 template <class Hasher, class CharT, class Traits, class Alloc>
-std::enable_if_t<!IsContiguouslyHashable<CharT, Hasher>::value>
-hash_append(Hasher& h, std::basic_string<CharT, Traits, Alloc> const& s) noexcept;
+void
+hash_append(Hasher& h, std::basic_string<CharT, Traits, Alloc> const& s) noexcept
+    requires(!IsContiguouslyHashable<CharT, Hasher>::value);
 
 template <class Hasher, class CharT, class Traits, class Alloc>
-std::enable_if_t<IsContiguouslyHashable<CharT, Hasher>::value>
-hash_append(Hasher& h, std::basic_string<CharT, Traits, Alloc> const& s) noexcept;
+void
+hash_append(Hasher& h, std::basic_string<CharT, Traits, Alloc> const& s) noexcept
+    requires(IsContiguouslyHashable<CharT, Hasher>::value);
 
 template <class Hasher, class T, class U>
-std::enable_if_t<!IsContiguouslyHashable<std::pair<T, U>, Hasher>::value>
-hash_append(Hasher& h, std::pair<T, U> const& p) noexcept;
+void
+hash_append(Hasher& h, std::pair<T, U> const& p) noexcept
+    requires(!IsContiguouslyHashable<std::pair<T, U>, Hasher>::value);
 
 template <class Hasher, class T, class Alloc>
-std::enable_if_t<!IsContiguouslyHashable<T, Hasher>::value>
-hash_append(Hasher& h, std::vector<T, Alloc> const& v) noexcept;
+void
+hash_append(Hasher& h, std::vector<T, Alloc> const& v) noexcept
+    requires(!IsContiguouslyHashable<T, Hasher>::value);
 
 template <class Hasher, class T, class Alloc>
-std::enable_if_t<IsContiguouslyHashable<T, Hasher>::value>
-hash_append(Hasher& h, std::vector<T, Alloc> const& v) noexcept;
+void
+hash_append(Hasher& h, std::vector<T, Alloc> const& v) noexcept
+    requires(IsContiguouslyHashable<T, Hasher>::value);
 
 template <class Hasher, class T, std::size_t N>
-std::enable_if_t<!IsContiguouslyHashable<std::array<T, N>, Hasher>::value>
-hash_append(Hasher& h, std::array<T, N> const& a) noexcept;
+void
+hash_append(Hasher& h, std::array<T, N> const& a) noexcept
+    requires(!IsContiguouslyHashable<std::array<T, N>, Hasher>::value);
 
 template <class Hasher, class... T>
-std::enable_if_t<!IsContiguouslyHashable<std::tuple<T...>, Hasher>::value>
-hash_append(Hasher& h, std::tuple<T...> const& t) noexcept;
+void
+hash_append(Hasher& h, std::tuple<T...> const& t) noexcept
+    requires(!IsContiguouslyHashable<std::tuple<T...>, Hasher>::value);
 
 template <class Hasher, class Key, class T, class Hash, class Pred, class Alloc>
 void
@@ -279,11 +290,13 @@ void
 hash_append(Hasher& h, std::unordered_set<Key, Hash, Pred, Alloc> const& s);
 
 template <class Hasher, class Key, class Compare, class Alloc>
-std::enable_if_t<!IsContiguouslyHashable<Key, Hasher>::value>
-hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept;
+void
+hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept
+    requires(!IsContiguouslyHashable<Key, Hasher>::value);
 template <class Hasher, class Key, class Compare, class Alloc>
-std::enable_if_t<IsContiguouslyHashable<Key, Hasher>::value>
-hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept;
+void
+hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept
+    requires(IsContiguouslyHashable<Key, Hasher>::value);
 template <class Hasher, class T0, class T1, class... T>
 void
 hash_append(Hasher& h, T0 const& t0, T1 const& t1, T const&... t) noexcept;
@@ -291,8 +304,9 @@ hash_append(Hasher& h, T0 const& t0, T1 const& t1, T const&... t) noexcept;
 // c-array
 
 template <class Hasher, class T, std::size_t N>
-std::enable_if_t<!IsContiguouslyHashable<T, Hasher>::value>
+void
 hash_append(Hasher& h, T (&a)[N]) noexcept
+    requires(!IsContiguouslyHashable<T, Hasher>::value)
 {
     for (auto const& t : a)
         hash_append(h, t);
@@ -301,8 +315,9 @@ hash_append(Hasher& h, T (&a)[N]) noexcept
 // basic_string
 
 template <class Hasher, class CharT, class Traits, class Alloc>
-inline std::enable_if_t<!IsContiguouslyHashable<CharT, Hasher>::value>
+inline void
 hash_append(Hasher& h, std::basic_string<CharT, Traits, Alloc> const& s) noexcept
+    requires(!IsContiguouslyHashable<CharT, Hasher>::value)
 {
     for (auto c : s)
         hash_append(h, c);
@@ -310,8 +325,9 @@ hash_append(Hasher& h, std::basic_string<CharT, Traits, Alloc> const& s) noexcep
 }
 
 template <class Hasher, class CharT, class Traits, class Alloc>
-inline std::enable_if_t<IsContiguouslyHashable<CharT, Hasher>::value>
+inline void
 hash_append(Hasher& h, std::basic_string<CharT, Traits, Alloc> const& s) noexcept
+    requires(IsContiguouslyHashable<CharT, Hasher>::value)
 {
     h(s.data(), s.size() * sizeof(CharT));
     hash_append(h, s.size());
@@ -320,8 +336,9 @@ hash_append(Hasher& h, std::basic_string<CharT, Traits, Alloc> const& s) noexcep
 // pair
 
 template <class Hasher, class T, class U>
-inline std::enable_if_t<!IsContiguouslyHashable<std::pair<T, U>, Hasher>::value>
+inline void
 hash_append(Hasher& h, std::pair<T, U> const& p) noexcept
+    requires(!IsContiguouslyHashable<std::pair<T, U>, Hasher>::value)
 {
     hash_append(h, p.first, p.second);
 }
@@ -329,8 +346,9 @@ hash_append(Hasher& h, std::pair<T, U> const& p) noexcept
 // vector
 
 template <class Hasher, class T, class Alloc>
-inline std::enable_if_t<!IsContiguouslyHashable<T, Hasher>::value>
+inline void
 hash_append(Hasher& h, std::vector<T, Alloc> const& v) noexcept
+    requires(!IsContiguouslyHashable<T, Hasher>::value)
 {
     for (auto const& t : v)
         hash_append(h, t);
@@ -338,8 +356,9 @@ hash_append(Hasher& h, std::vector<T, Alloc> const& v) noexcept
 }
 
 template <class Hasher, class T, class Alloc>
-inline std::enable_if_t<IsContiguouslyHashable<T, Hasher>::value>
+inline void
 hash_append(Hasher& h, std::vector<T, Alloc> const& v) noexcept
+    requires(IsContiguouslyHashable<T, Hasher>::value)
 {
     h(v.data(), v.size() * sizeof(T));
     hash_append(h, v.size());
@@ -348,23 +367,26 @@ hash_append(Hasher& h, std::vector<T, Alloc> const& v) noexcept
 // array
 
 template <class Hasher, class T, std::size_t N>
-std::enable_if_t<!IsContiguouslyHashable<std::array<T, N>, Hasher>::value>
+void
 hash_append(Hasher& h, std::array<T, N> const& a) noexcept
+    requires(!IsContiguouslyHashable<std::array<T, N>, Hasher>::value)
 {
     for (auto const& t : a)
         hash_append(h, t);
 }
 
 template <class Hasher, class Key, class Compare, class Alloc>
-std::enable_if_t<!IsContiguouslyHashable<Key, Hasher>::value>
+void
 hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept
+    requires(!IsContiguouslyHashable<Key, Hasher>::value)
 {
     for (auto const& t : v)
         hash_append(h, t);
 }
 template <class Hasher, class Key, class Compare, class Alloc>
-std::enable_if_t<IsContiguouslyHashable<Key, Hasher>::value>
+void
 hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept
+    requires(IsContiguouslyHashable<Key, Hasher>::value)
 {
     h(&(v.begin()), v.size() * sizeof(Key));
 }
@@ -395,8 +417,9 @@ tuple_hash(Hasher& h, std::tuple<T...> const& t, std::index_sequence<I...>) noex
 }  // namespace detail
 
 template <class Hasher, class... T>
-inline std::enable_if_t<!IsContiguouslyHashable<std::tuple<T...>, Hasher>::value>
+inline void
 hash_append(Hasher& h, std::tuple<T...> const& t) noexcept
+    requires(!IsContiguouslyHashable<std::tuple<T...>, Hasher>::value)
 {
     detail::tuple_hash(h, t, std::index_sequence_for<T...>{});
 }
diff --git a/include/xrpl/beast/hash/xxhasher.h b/include/xrpl/beast/hash/xxhasher.h
index 978bbc6917..73dbb8e8ab 100644
--- a/include/xrpl/beast/hash/xxhasher.h
+++ b/include/xrpl/beast/hash/xxhasher.h
@@ -124,14 +124,18 @@ public:
         }
     }
 
-    template <class Seed, std::enable_if_t<std::is_unsigned_v<Seed>>* = nullptr>
-    explicit Xxhasher(Seed seed) : seed_(seed)
+    template <class Seed>
+    explicit Xxhasher(Seed seed)
+        requires(std::is_unsigned_v<Seed>)
+        : seed_(seed)
     {
         resetBuffers();
     }
 
-    template <class Seed, std::enable_if_t<std::is_unsigned_v<Seed>>* = nullptr>
-    Xxhasher(Seed seed, Seed) : seed_(seed)
+    template <class Seed>
+    Xxhasher(Seed seed, Seed)
+        requires(std::is_unsigned_v<Seed>)
+        : seed_(seed)
     {
         resetBuffers();
     }
diff --git a/include/xrpl/beast/utility/rngfill.h b/include/xrpl/beast/utility/rngfill.h
index ee7a5e2434..5bd9d8bc5c 100644
--- a/include/xrpl/beast/utility/rngfill.h
+++ b/include/xrpl/beast/utility/rngfill.h
@@ -3,7 +3,6 @@
 #include <array>
 #include <cstdint>
 #include <cstring>
-#include <type_traits>
 
 namespace beast {
 
@@ -33,12 +32,10 @@ rngfill(void* const buffer, std::size_t const bytes, Generator& g)
     }
 }
 
-template <
-    class Generator,
-    std::size_t N,
-    class = std::enable_if_t<N % sizeof(typename Generator::result_type) == 0>>
+template <class Generator, std::size_t N>
 void
 rngfill(std::array<std::uint8_t, N>& a, Generator& g)
+    requires(N % sizeof(typename Generator::result_type) == 0)
 {
     using result_type = Generator::result_type;
     auto i = N / sizeof(result_type);
diff --git a/include/xrpl/core/JobQueue.h b/include/xrpl/core/JobQueue.h
index 14170a39be..e4b64546f3 100644
--- a/include/xrpl/core/JobQueue.h
+++ b/include/xrpl/core/JobQueue.h
@@ -154,16 +154,14 @@ public:
 
         @param type The type of job.
         @param name Name of the job.
-        @param jobHandler Lambda with signature void (Job&).  Called when the
-       job is executed.
+        @param jobHandler Callable with signature void(). Called when the job is executed.
 
         @return true if jobHandler added to queue.
     */
-    template <
-        typename JobHandler,
-        typename = std::enable_if_t<std::is_same_v<decltype(std::declval<JobHandler&&>()()), void>>>
+    template <typename JobHandler>
     bool
     addJob(JobType type, std::string const& name, JobHandler&& jobHandler)
+        requires(std::is_void_v<std::invoke_result_t<JobHandler>>)
     {
         if (auto optionalCountedJob = jobCounter_.wrap(std::forward<JobHandler>(jobHandler)))
         {
diff --git a/include/xrpl/ledger/helpers/DirectoryHelpers.h b/include/xrpl/ledger/helpers/DirectoryHelpers.h
index 76a5f3bdad..a95b9bc95a 100644
--- a/include/xrpl/ledger/helpers/DirectoryHelpers.h
+++ b/include/xrpl/ledger/helpers/DirectoryHelpers.h
@@ -19,11 +19,7 @@ namespace xrpl {
 
 namespace detail {
 
-template <
-    class V,
-    class N,
-    class = std::enable_if_t<
-        std::is_same_v<std::remove_cv_t<N>, SLE> && std::is_base_of_v<ReadView, V>>>
+template <class V, class N>
 bool
 internalDirNext(
     V& view,
@@ -31,6 +27,7 @@ internalDirNext(
     std::shared_ptr<N>& page,
     unsigned int& index,
     uint256& entry)
+    requires(std::is_same_v<std::remove_cv_t<N>, SLE> && std::is_base_of_v<ReadView, V>)
 {
     auto const& svIndexes = page->getFieldV256(sfIndexes);
     XRPL_ASSERT(index <= svIndexes.size(), "xrpl::detail::internalDirNext : index inside range");
@@ -68,11 +65,7 @@ internalDirNext(
     return true;
 }
 
-template <
-    class V,
-    class N,
-    class = std::enable_if_t<
-        std::is_same_v<std::remove_cv_t<N>, SLE> && std::is_base_of_v<ReadView, V>>>
+template <class V, class N>
 bool
 internalDirFirst(
     V& view,
@@ -80,6 +73,7 @@ internalDirFirst(
     std::shared_ptr<N>& page,
     unsigned int& index,
     uint256& entry)
+    requires(std::is_same_v<std::remove_cv_t<N>, SLE> && std::is_base_of_v<ReadView, V>)
 {
     if constexpr (std::is_const_v<N>)
     {
diff --git a/include/xrpl/net/HTTPClientSSLContext.h b/include/xrpl/net/HTTPClientSSLContext.h
index 2b26d7e404..51b50a084c 100644
--- a/include/xrpl/net/HTTPClientSSLContext.h
+++ b/include/xrpl/net/HTTPClientSSLContext.h
@@ -83,13 +83,12 @@ public:
      *
      * @return error_code indicating failures, if any
      */
-    template <
-        class T,
-        class = std::enable_if_t<
-            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket>> ||
-            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket&>>>>
+    template <class T>
     boost::system::error_code
     preConnectVerify(T& strm, std::string const& host)
+        requires(
+            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket>> ||
+            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket&>>)
     {
         boost::system::error_code ec;
         if (!SSL_set_tlsext_host_name(strm.native_handle(), host.c_str()))
@@ -103,11 +102,7 @@ public:
         return ec;
     }
 
-    template <
-        class T,
-        class = std::enable_if_t<
-            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket>> ||
-            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket&>>>>
+    template <class T>
     /**
      * @brief invoked after connect/async_connect but before sending data
      * on an ssl stream - to setup name verification.
@@ -117,6 +112,9 @@ public:
      */
     boost::system::error_code
     postConnectVerify(T& strm, std::string const& host)
+        requires(
+            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket>> ||
+            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket&>>)
     {
         boost::system::error_code ec;
 
diff --git a/include/xrpl/nodestore/detail/varint.h b/include/xrpl/nodestore/detail/varint.h
index 6102c0cf2d..5a65545d3a 100644
--- a/include/xrpl/nodestore/detail/varint.h
+++ b/include/xrpl/nodestore/detail/varint.h
@@ -68,9 +68,10 @@ readVarint(void const* buf, std::size_t buflen, std::size_t& t)
     return used;
 }
 
-template <class T, std::enable_if_t<std::is_unsigned_v<T>>* = nullptr>
+template <class T>
 std::size_t
 sizeVarint(T v)
+    requires(std::is_unsigned_v<T>)
 {
     std::size_t n = 0;
     do
@@ -100,9 +101,10 @@ writeVarint(void* p0, std::size_t v)
 
 // input stream
 
-template <class T, std::enable_if_t<std::is_same_v<T, varint>>* = nullptr>
+template <class T>
 void
 read(nudb::detail::istream& is, std::size_t& u)
+    requires(std::is_same_v<T, varint>)
 {
     auto p0 = is(1);
     auto p1 = p0;
@@ -113,9 +115,10 @@ read(nudb::detail::istream& is, std::size_t& u)
 
 // output stream
 
-template <class T, std::enable_if_t<std::is_same_v<T, varint>>* = nullptr>
+template <class T>
 void
 write(nudb::detail::ostream& os, std::size_t t)
+    requires(std::is_same_v<T, varint>)
 {
     writeVarint(os.data(sizeVarint(t)), t);
 }
diff --git a/include/xrpl/protocol/STArray.h b/include/xrpl/protocol/STArray.h
index ed39e65026..573bb6dad8 100644
--- a/include/xrpl/protocol/STArray.h
+++ b/include/xrpl/protocol/STArray.h
@@ -32,17 +32,13 @@ public:
     STArray() = default;
     STArray(STArray const&) = default;
 
-    template <
-        class Iter,
-        class = std::enable_if_t<
-            std::is_convertible_v<typename std::iterator_traits<Iter>::reference, STObject>>>
-    explicit STArray(Iter first, Iter last);
+    template <class Iter>
+    explicit STArray(Iter first, Iter last)
+        requires(std::is_convertible_v<typename std::iterator_traits<Iter>::reference, STObject>);
 
-    template <
-        class Iter,
-        class = std::enable_if_t<
-            std::is_convertible_v<typename std::iterator_traits<Iter>::reference, STObject>>>
-    STArray(SField const& f, Iter first, Iter last);
+    template <class Iter>
+    STArray(SField const& f, Iter first, Iter last)
+        requires(std::is_convertible_v<typename std::iterator_traits<Iter>::reference, STObject>);
 
     STArray&
     operator=(STArray const&) = default;
@@ -170,13 +166,17 @@ private:
     friend class detail::STVar;
 };
 
-template <class Iter, class>
-STArray::STArray(Iter first, Iter last) : v_(first, last)
+template <class Iter>
+STArray::STArray(Iter first, Iter last)
+    requires(std::is_convertible_v<typename std::iterator_traits<Iter>::reference, STObject>)
+    : v_(first, last)
 {
 }
 
-template <class Iter, class>
-STArray::STArray(SField const& f, Iter first, Iter last) : STBase(f), v_(first, last)
+template <class Iter>
+STArray::STArray(SField const& f, Iter first, Iter last)
+    requires(std::is_convertible_v<typename std::iterator_traits<Iter>::reference, STObject>)
+    : STBase(f), v_(first, last)
 {
 }
 
diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index a60e8f7fe8..c96086b1d0 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -556,8 +556,9 @@ public:
     operator=(ValueProxy const&) = delete;
 
     template <class U>
-    std::enable_if_t<std::is_assignable_v<T, U>, ValueProxy&>
-    operator=(U&& u);
+    ValueProxy&
+    operator=(U&& u)
+        requires(std::is_assignable_v<T, U>);
 
     // Convenience operators for value types supporting
     // arithmetic operations
@@ -691,8 +692,9 @@ public:
     operator=(optional_type const& v);
 
     template <class U>
-    std::enable_if_t<std::is_assignable_v<T, U>, OptionalProxy&>
-    operator=(U&& u);
+    OptionalProxy&
+    operator=(U&& u)
+        requires(std::is_assignable_v<T, U>);
 
 private:
     friend class STObject;
@@ -798,8 +800,9 @@ STObject::Proxy<T>::assign(U&& u)
 
 template <class T>
 template <class U>
-std::enable_if_t<std::is_assignable_v<T, U>, STObject::ValueProxy<T>&>
+STObject::ValueProxy<T>&
 STObject::ValueProxy<T>::operator=(U&& u)
+    requires(std::is_assignable_v<T, U>)
 {
     this->assign(std::forward<U>(u));
     return *this;
@@ -902,8 +905,9 @@ STObject::OptionalProxy<T>::operator=(optional_type const& v) -> OptionalProxy&
 
 template <class T>
 template <class U>
-std::enable_if_t<std::is_assignable_v<T, U>, STObject::OptionalProxy<T>&>
+STObject::OptionalProxy<T>&
 STObject::OptionalProxy<T>::operator=(U&& u)
+    requires(std::is_assignable_v<T, U>)
 {
     this->assign(std::forward<U>(u));
     return *this;
diff --git a/include/xrpl/protocol/TER.h b/include/xrpl/protocol/TER.h
index b29cb11e15..54b081f358 100644
--- a/include/xrpl/protocol/TER.h
+++ b/include/xrpl/protocol/TER.h
@@ -411,7 +411,7 @@ TERtoInt(TECcodes v)
 
 //------------------------------------------------------------------------------
 // Template class that is specific to selected ranges of error codes.  The
-// Trait tells std::enable_if which ranges are allowed.
+// Trait tells the requires-clause which ranges are allowed.
 template <template <typename> class Trait>
 class TERSubset
 {
@@ -437,11 +437,11 @@ public:
         return TERSubset(from);
     }
 
-    // Trait tells enable_if which types are allowed for construction.
-    template <
-        typename T,
-        typename = std::enable_if_t<Trait<std::remove_cv_t<std::remove_reference_t<T>>>::value>>
-    constexpr TERSubset(T rhs) : code_(TERtoInt(rhs))
+    // Trait tells the requires-clause which types are allowed for construction.
+    template <typename T>
+    constexpr TERSubset(T rhs)
+        requires(Trait<std::remove_cv_t<std::remove_reference_t<T>>>::value)
+        : code_(TERtoInt(rhs))
     {
     }
 
@@ -451,10 +451,11 @@ public:
     constexpr TERSubset&
     operator=(TERSubset&& rhs) = default;
 
-    // Trait tells enable_if which types are allowed for assignment.
+    // Trait tells the requires-clause which types are allowed for assignment.
     template <typename T>
     constexpr auto
-    operator=(T rhs) -> std::enable_if_t<Trait<T>::value, TERSubset&>
+    operator=(T rhs) -> TERSubset&
+        requires(Trait<T>::value)
     {
         code_ = TERtoInt(rhs);
         return *this;
@@ -508,54 +509,60 @@ public:
 // Only enabled if both arguments return int if TERtiInt is called with them.
 template <typename L, typename R>
 constexpr auto
-operator==(L const& lhs, R const& rhs) -> std::enable_if_t<
-    std::is_same_v<decltype(TERtoInt(lhs)), int> && std::is_same_v<decltype(TERtoInt(rhs)), int>,
-    bool>
+operator==(L const& lhs, R const& rhs) -> bool
+    requires(
+        std::is_same_v<decltype(TERtoInt(lhs)), int> &&
+        std::is_same_v<decltype(TERtoInt(rhs)), int>)
 {
     return TERtoInt(lhs) == TERtoInt(rhs);
 }
 
 template <typename L, typename R>
 constexpr auto
-operator!=(L const& lhs, R const& rhs) -> std::enable_if_t<
-    std::is_same_v<decltype(TERtoInt(lhs)), int> && std::is_same_v<decltype(TERtoInt(rhs)), int>,
-    bool>
+operator!=(L const& lhs, R const& rhs) -> bool
+    requires(
+        std::is_same_v<decltype(TERtoInt(lhs)), int> &&
+        std::is_same_v<decltype(TERtoInt(rhs)), int>)
 {
     return TERtoInt(lhs) != TERtoInt(rhs);
 }
 
 template <typename L, typename R>
 constexpr auto
-operator<(L const& lhs, R const& rhs) -> std::enable_if_t<
-    std::is_same_v<decltype(TERtoInt(lhs)), int> && std::is_same_v<decltype(TERtoInt(rhs)), int>,
-    bool>
+operator<(L const& lhs, R const& rhs) -> bool
+    requires(
+        std::is_same_v<decltype(TERtoInt(lhs)), int> &&
+        std::is_same_v<decltype(TERtoInt(rhs)), int>)
 {
     return TERtoInt(lhs) < TERtoInt(rhs);
 }
 
 template <typename L, typename R>
 constexpr auto
-operator<=(L const& lhs, R const& rhs) -> std::enable_if_t<
-    std::is_same_v<decltype(TERtoInt(lhs)), int> && std::is_same_v<decltype(TERtoInt(rhs)), int>,
-    bool>
+operator<=(L const& lhs, R const& rhs) -> bool
+    requires(
+        std::is_same_v<decltype(TERtoInt(lhs)), int> &&
+        std::is_same_v<decltype(TERtoInt(rhs)), int>)
 {
     return TERtoInt(lhs) <= TERtoInt(rhs);
 }
 
 template <typename L, typename R>
 constexpr auto
-operator>(L const& lhs, R const& rhs) -> std::enable_if_t<
-    std::is_same_v<decltype(TERtoInt(lhs)), int> && std::is_same_v<decltype(TERtoInt(rhs)), int>,
-    bool>
+operator>(L const& lhs, R const& rhs) -> bool
+    requires(
+        std::is_same_v<decltype(TERtoInt(lhs)), int> &&
+        std::is_same_v<decltype(TERtoInt(rhs)), int>)
 {
     return TERtoInt(lhs) > TERtoInt(rhs);
 }
 
 template <typename L, typename R>
 constexpr auto
-operator>=(L const& lhs, R const& rhs) -> std::enable_if_t<
-    std::is_same_v<decltype(TERtoInt(lhs)), int> && std::is_same_v<decltype(TERtoInt(rhs)), int>,
-    bool>
+operator>=(L const& lhs, R const& rhs) -> bool
+    requires(
+        std::is_same_v<decltype(TERtoInt(lhs)), int> &&
+        std::is_same_v<decltype(TERtoInt(rhs)), int>)
 {
     return TERtoInt(lhs) >= TERtoInt(rhs);
 }
diff --git a/include/xrpl/server/Manifest.h b/include/xrpl/server/Manifest.h
index eb625d220a..c58c784de3 100644
--- a/include/xrpl/server/Manifest.h
+++ b/include/xrpl/server/Manifest.h
@@ -161,13 +161,12 @@ deserializeManifest(
     return deserializeManifest(makeSlice(s), journal);
 }
 
-template <
-    class T,
-    class = std::enable_if_t<std::is_same_v<T, char> || std::is_same_v<T, unsigned char>>>
+template <class T>
 std::optional<Manifest>
 deserializeManifest(
     std::vector<T> const& v,
     beast::Journal journal = beast::Journal(beast::Journal::getNullSink()))
+    requires(std::is_same_v<T, char> || std::is_same_v<T, unsigned char>)
 {
     return deserializeManifest(makeSlice(v), journal);
 }
diff --git a/src/libxrpl/protocol/STParsedJSON.cpp b/src/libxrpl/protocol/STParsedJSON.cpp
index 64c4dfd1be..d3342ef728 100644
--- a/src/libxrpl/protocol/STParsedJSON.cpp
+++ b/src/libxrpl/protocol/STParsedJSON.cpp
@@ -50,8 +50,9 @@ namespace xrpl {
 
 namespace STParsedJSONDetail {
 template <typename U, typename S>
-constexpr std::enable_if_t<std::is_unsigned_v<U> && std::is_signed_v<S>, U>
+constexpr U
 toUnsigned(S value)
+    requires(std::is_unsigned_v<U> && std::is_signed_v<S>)
 {
     if (value < 0 || std::numeric_limits<U>::max() < value)
         Throw<std::runtime_error>("Value out of range");
@@ -59,8 +60,9 @@ toUnsigned(S value)
 }
 
 template <typename U1, typename U2>
-constexpr std::enable_if_t<std::is_unsigned_v<U1> && std::is_unsigned_v<U2>, U1>
+constexpr U1
 toUnsigned(U2 value)
+    requires(std::is_unsigned_v<U1> && std::is_unsigned_v<U2>)
 {
     if (std::numeric_limits<U1>::max() < value)
         Throw<std::runtime_error>("Value out of range");
diff --git a/src/libxrpl/protocol/STTx.cpp b/src/libxrpl/protocol/STTx.cpp
index b3de717da8..9f3c6738ae 100644
--- a/src/libxrpl/protocol/STTx.cpp
+++ b/src/libxrpl/protocol/STTx.cpp
@@ -765,7 +765,7 @@ isBatchRawTransactionOkay(STObject const& st, std::string& reason)
     {
         try
         {
-            TxType const tt = safeCast<TxType>(raw.getFieldU16(sfTransactionType));
+            auto const tt = safeCast<TxType>(raw.getFieldU16(sfTransactionType));
             if (tt == ttBATCH)
             {
                 reason = "Raw Transactions may not contain batch transactions.";
diff --git a/src/libxrpl/protocol/tokens.cpp b/src/libxrpl/protocol/tokens.cpp
index d04ceaa3a6..6716b1185f 100644
--- a/src/libxrpl/protocol/tokens.cpp
+++ b/src/libxrpl/protocol/tokens.cpp
@@ -143,9 +143,10 @@ digest(void const* data, std::size_t size) noexcept
     return static_cast<Hasher::result_type>(h);
 }
 
-template <class Hasher, class T, std::size_t N, class = std::enable_if_t<sizeof(T) == 1>>
+template <class Hasher, class T, std::size_t N>
 static Hasher::result_type
 digest(std::array<T, N> const& v)
+    requires(sizeof(T) == 1)
 {
     return digest<Hasher>(v.data(), v.size());
 }
diff --git a/src/test/app/NFToken_test.cpp b/src/test/app/NFToken_test.cpp
index f191e04a47..844bb4ee87 100644
--- a/src/test/app/NFToken_test.cpp
+++ b/src/test/app/NFToken_test.cpp
@@ -2404,7 +2404,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
         // Do some touch testing to show that the taxon is recoverable no
         // matter what else changes around it in the nft ID.
         {
-            std::uint32_t const taxon = randInt<std::uint32_t>();
+            auto const taxon = randInt<std::uint32_t>();
             for (int i = 0; i < 10; ++i)
             {
                 // lambda to produce a useful message on error.
diff --git a/src/test/beast/aged_associative_container_test.cpp b/src/test/beast/aged_associative_container_test.cpp
index df61824c99..2752ff3127 100644
--- a/src/test/beast/aged_associative_container_test.cpp
+++ b/src/test/beast/aged_associative_container_test.cpp
@@ -404,23 +404,27 @@ public:
     //--------------------------------------------------------------------------
 
     template <class Container, class Values>
-    std::enable_if_t<Container::is_map::value && !Container::is_multi::value>
-    checkMapContents(Container& c, Values const& v);
+    void
+    checkMapContents(Container& c, Values const& v)
+        requires(Container::is_map::value && !Container::is_multi::value);
 
     template <class Container, class Values>
-    std::enable_if_t<!(Container::is_map::value && !Container::is_multi::value)>
+    void
     checkMapContents(Container, Values const&)
+        requires(!(Container::is_map::value && !Container::is_multi::value))
     {
     }
 
     // unordered
     template <class C, class Values>
-    std::enable_if_t<std::remove_reference_t<C>::is_unordered::value>
-    checkUnorderedContentsRefRef(C&& c, Values const& v);
+    void
+    checkUnorderedContentsRefRef(C&& c, Values const& v)
+        requires(std::remove_reference_t<C>::is_unordered::value);
 
     template <class C, class Values>
-    std::enable_if_t<!std::remove_reference_t<C>::is_unordered::value>
+    void
     checkUnorderedContentsRefRef(C&&, Values const&)
+        requires(!std::remove_reference_t<C>::is_unordered::value)
     {
     }
 
@@ -440,33 +444,39 @@ public:
 
     // ordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<!IsUnordered>
-    testConstructEmpty();
+    void
+    testConstructEmpty()
+        requires(!IsUnordered);
 
     // unordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<IsUnordered>
-    testConstructEmpty();
+    void
+    testConstructEmpty()
+        requires IsUnordered;
 
     // ordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<!IsUnordered>
-    testConstructRange();
+    void
+    testConstructRange()
+        requires(!IsUnordered);
 
     // unordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<IsUnordered>
-    testConstructRange();
+    void
+    testConstructRange()
+        requires IsUnordered;
 
     // ordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<!IsUnordered>
-    testConstructInitList();
+    void
+    testConstructInitList()
+        requires(!IsUnordered);
 
     // unordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<IsUnordered>
-    testConstructInitList();
+    void
+    testConstructInitList()
+        requires IsUnordered;
 
     //--------------------------------------------------------------------------
 
@@ -482,12 +492,14 @@ public:
 
     // Unordered containers don't have reverse iterators
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<!IsUnordered>
-    testReverseIterator();
+    void
+    testReverseIterator()
+        requires(!IsUnordered);
 
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<IsUnordered>
+    void
     testReverseIterator()
+        requires IsUnordered
     {
     }
 
@@ -531,12 +543,14 @@ public:
 
     // map, unordered_map
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<IsMap && !IsMulti>
-    testArrayCreate();
+    void
+    testArrayCreate()
+        requires(IsMap && !IsMulti);
 
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<!IsMap || IsMulti>
+    void
     testArrayCreate()
+        requires(!IsMap || IsMulti)
     {
     }
 
@@ -575,12 +589,14 @@ public:
 
     // ordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<!IsUnordered>
-    testCompare();
+    void
+    testCompare()
+        requires(!IsUnordered);
 
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<IsUnordered>
+    void
     testCompare()
+        requires IsUnordered
     {
     }
 
@@ -588,13 +604,15 @@ public:
 
     // ordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<!IsUnordered>
-    testObservers();
+    void
+    testObservers()
+        requires(!IsUnordered);
 
     // unordered
     template <bool IsUnordered, bool IsMulti, bool IsMap>
-    std::enable_if_t<IsUnordered>
-    testObservers();
+    void
+    testObservers()
+        requires IsUnordered;
 
     //--------------------------------------------------------------------------
 
@@ -616,8 +634,9 @@ public:
 // Check contents via at() and operator[]
 // map, unordered_map
 template <class Container, class Values>
-std::enable_if_t<Container::is_map::value && !Container::is_multi::value>
+void
 AgedAssociativeContainerTestBase::checkMapContents(Container& c, Values const& v)
+    requires(Container::is_map::value && !Container::is_multi::value)
 {
     if (v.empty())
     {
@@ -642,8 +661,9 @@ AgedAssociativeContainerTestBase::checkMapContents(Container& c, Values const& v
 
 // unordered
 template <class C, class Values>
-std::enable_if_t<std::remove_reference_t<C>::is_unordered::value>
+void
 AgedAssociativeContainerTestBase::checkUnorderedContentsRefRef(C&& c, Values const& v)
+    requires(std::remove_reference_t<C>::is_unordered::value)
 {
     using Cont = std::remove_reference_t<C>;
     using Traits =
@@ -715,8 +735,9 @@ AgedAssociativeContainerTestBase::checkContents(Cont& c)
 
 // ordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<!IsUnordered>
+void
 AgedAssociativeContainerTestBase::testConstructEmpty()
+    requires(!IsUnordered)
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     using Comp = Traits::Comp;
@@ -751,8 +772,9 @@ AgedAssociativeContainerTestBase::testConstructEmpty()
 
 // unordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<IsUnordered>
+void
 AgedAssociativeContainerTestBase::testConstructEmpty()
+    requires IsUnordered
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     using Hash = Traits::Hash;
@@ -809,8 +831,9 @@ AgedAssociativeContainerTestBase::testConstructEmpty()
 
 // ordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<!IsUnordered>
+void
 AgedAssociativeContainerTestBase::testConstructRange()
+    requires(!IsUnordered)
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     using Comp = Traits::Comp;
@@ -856,8 +879,9 @@ AgedAssociativeContainerTestBase::testConstructRange()
 
 // unordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<IsUnordered>
+void
 AgedAssociativeContainerTestBase::testConstructRange()
+    requires IsUnordered
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     using Hash = Traits::Hash;
@@ -922,8 +946,9 @@ AgedAssociativeContainerTestBase::testConstructRange()
 
 // ordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<!IsUnordered>
+void
 AgedAssociativeContainerTestBase::testConstructInitList()
+    requires(!IsUnordered)
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     typename Traits::ManualClock const clock;
@@ -938,8 +963,9 @@ AgedAssociativeContainerTestBase::testConstructInitList()
 
 // unordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<IsUnordered>
+void
 AgedAssociativeContainerTestBase::testConstructInitList()
+    requires IsUnordered
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     typename Traits::ManualClock const clock;
@@ -1084,8 +1110,9 @@ AgedAssociativeContainerTestBase::testIterator()
 }
 
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<!IsUnordered>
+void
 AgedAssociativeContainerTestBase::testReverseIterator()
+    requires(!IsUnordered)
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     typename Traits::ManualClock clock;
@@ -1348,8 +1375,9 @@ AgedAssociativeContainerTestBase::testChronological()
 
 // map, unordered_map
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<IsMap && !IsMulti>
+void
 AgedAssociativeContainerTestBase::testArrayCreate()
+    requires(IsMap && !IsMulti)
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     typename Traits::ManualClock clock;
@@ -1631,8 +1659,9 @@ AgedAssociativeContainerTestBase::testRangeErase()
 
 // ordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<!IsUnordered>
+void
 AgedAssociativeContainerTestBase::testCompare()
+    requires(!IsUnordered)
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     typename Traits::ManualClock clock;
@@ -1662,8 +1691,9 @@ AgedAssociativeContainerTestBase::testCompare()
 
 // ordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<!IsUnordered>
+void
 AgedAssociativeContainerTestBase::testObservers()
+    requires(!IsUnordered)
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     typename Traits::ManualClock clock;
@@ -1680,8 +1710,9 @@ AgedAssociativeContainerTestBase::testObservers()
 
 // unordered
 template <bool IsUnordered, bool IsMulti, bool IsMap>
-std::enable_if_t<IsUnordered>
+void
 AgedAssociativeContainerTestBase::testObservers()
+    requires IsUnordered
 {
     using Traits = TestTraits<IsUnordered, IsMulti, IsMap>;
     typename Traits::ManualClock clock;
diff --git a/src/test/csf/Tx.h b/src/test/csf/Tx.h
index f871909f48..75254f865a 100644
--- a/src/test/csf/Tx.h
+++ b/src/test/csf/Tx.h
@@ -27,8 +27,10 @@ public:
     {
     }
 
-    template <typename T, typename = std::enable_if_t<std::is_same_v<T, Tx>>>
-    Tx(T const* t) : id_{t->id_}
+    template <typename T>
+    Tx(T const* t)
+        requires(std::is_same_v<T, Tx>)
+        : id_{t->id_}
     {
     }
 
diff --git a/src/test/csf/submitters.h b/src/test/csf/submitters.h
index 546681abe0..a71c849fb7 100644
--- a/src/test/csf/submitters.h
+++ b/src/test/csf/submitters.h
@@ -61,8 +61,9 @@ class Submitter
     }
 
     template <class T>
-    static std::enable_if_t<std::is_arithmetic_v<T>, SimDuration>
+    static SimDuration
     asDuration(T t)
+        requires(std::is_arithmetic_v<T>)
     {
         return SimDuration{static_cast<SimDuration::rep>(t)};
     }
diff --git a/src/test/jtx/TestHelpers.h b/src/test/jtx/TestHelpers.h
index b1643de362..cb2193db99 100644
--- a/src/test/jtx/TestHelpers.h
+++ b/src/test/jtx/TestHelpers.h
@@ -401,8 +401,9 @@ void
 stpathAppendOne(STPath& st, Account const& account);
 
 template <class T>
-std::enable_if_t<std::is_constructible_v<Account, T>>
+void
 stpathAppendOne(STPath& st, T const& t)
+    requires(std::is_constructible_v<Account, T>)
 {
     stpathAppendOne(st, Account{t});
 }
diff --git a/src/test/jtx/amount.h b/src/test/jtx/amount.h
index ce0234b41a..db7dbd1cc1 100644
--- a/src/test/jtx/amount.h
+++ b/src/test/jtx/amount.h
@@ -93,19 +93,16 @@ public:
 
     /** drops */
     template <class T>
-    PrettyAmount(
-        T v,
-        std::enable_if_t<
-            sizeof(T) >= sizeof(int) && std::is_integral_v<T> && std::is_signed_v<T>>* = nullptr)
+    PrettyAmount(T v)
+        requires(sizeof(T) >= sizeof(int) && std::is_integral_v<T> && std::is_signed_v<T>)
         : amount_((v > 0) ? v : -v, v < 0)
     {
     }
 
     /** drops */
     template <class T>
-    PrettyAmount(
-        T v,
-        std::enable_if_t<sizeof(T) >= sizeof(int) && std::is_unsigned_v<T>>* = nullptr)
+    PrettyAmount(T v)
+        requires(sizeof(T) >= sizeof(int) && std::is_unsigned_v<T>)
         : amount_(v)
     {
     }
@@ -282,9 +279,10 @@ struct XrpT
         @param v The number of XRP (not drops)
     */
     /** @{ */
-    template <class T, class = std::enable_if_t<std::is_integral_v<T>>>
+    template <class T>
     PrettyAmount
     operator()(T v) const
+        requires(std::is_integral_v<T>)
     {
         using TOut = std::conditional_t<std::is_signed_v<T>, std::int64_t, std::uint64_t>;
         return {TOut{v} * kJtxDropsPerXrp};
@@ -350,9 +348,10 @@ extern XrpT const XRP;  // NOLINT(readability-identifier-naming)
     Example:
         drops(10)   Returns PrettyAmount of 10 drops
 */
-template <class Integer, class = std::enable_if_t<std::is_integral_v<Integer>>>
+template <class Integer>
 PrettyAmount
 drops(Integer i)
+    requires(std::is_integral_v<Integer>)
 {
     return {i};
 }
@@ -436,11 +435,10 @@ public:
         return asset();
     }
 
-    template <
-        class T,
-        class = std::enable_if_t<sizeof(T) >= sizeof(int) && std::is_arithmetic_v<T>>>
+    template <class T>
     PrettyAmount
     operator()(T v) const
+        requires(sizeof(T) >= sizeof(int) && std::is_arithmetic_v<T>)
     {
         // VFALCO NOTE Should throw if the
         //             representation of v is not exact.
diff --git a/src/test/jtx/paths.h b/src/test/jtx/paths.h
index 1450985687..b141300a66 100644
--- a/src/test/jtx/paths.h
+++ b/src/test/jtx/paths.h
@@ -67,8 +67,9 @@ private:
     appendOne(AccountID const& account);
 
     template <class T>
-    std::enable_if_t<std::is_constructible_v<Account, T>>
+    void
     appendOne(T const& t)
+        requires(std::is_constructible_v<Account, T>)
     {
         appendOne(Account{t});
     }
diff --git a/src/test/protocol/Quality_test.cpp b/src/test/protocol/Quality_test.cpp
index db81886e94..e7ffa9f305 100644
--- a/src/test/protocol/Quality_test.cpp
+++ b/src/test/protocol/Quality_test.cpp
@@ -22,7 +22,8 @@ public:
 
     template <class Integer>
     static STAmount
-    amount(Integer integer, std::enable_if_t<std::is_signed_v<Integer>>* = 0)
+    amount(Integer integer)
+        requires(std::is_signed_v<Integer>)
     {
         static_assert(std::is_integral_v<Integer>);
         return STAmount(integer, false);
@@ -30,7 +31,8 @@ public:
 
     template <class Integer>
     static STAmount
-    amount(Integer integer, std::enable_if_t<!std::is_signed_v<Integer>>* = 0)
+    amount(Integer integer)
+        requires(!std::is_signed_v<Integer>)
     {
         static_assert(std::is_integral_v<Integer>);
         if (integer < 0)
diff --git a/src/test/protocol/TER_test.cpp b/src/test/protocol/TER_test.cpp
index af1cfced0e..77f12ff2b7 100644
--- a/src/test/protocol/TER_test.cpp
+++ b/src/test/protocol/TER_test.cpp
@@ -72,8 +72,9 @@ struct TER_test : public beast::unit_test::Suite
         std::size_t I2,
         template <std::size_t, std::size_t> class Func,
         typename Tup>
-    std::enable_if_t<I1 != 0>
+    void
     testIterate(Tup const& tup, beast::unit_test::Suite& s)
+        requires(I1 != 0)
     {
         Func<I1, I2> const func;
         func(tup, s);
@@ -86,8 +87,9 @@ struct TER_test : public beast::unit_test::Suite
         std::size_t I2,
         template <std::size_t, std::size_t> class Func,
         typename Tup>
-    std::enable_if_t<I1 == 0 && I2 != 0>
+    void
     testIterate(Tup const& tup, beast::unit_test::Suite& s)
+        requires(I1 == 0 && I2 != 0)
     {
         Func<I1, I2> const func;
         func(tup, s);
@@ -100,8 +102,9 @@ struct TER_test : public beast::unit_test::Suite
         std::size_t I2,
         template <std::size_t, std::size_t> class Func,
         typename Tup>
-    std::enable_if_t<I1 == 0 && I2 == 0>
+    void
     testIterate(Tup const& tup, beast::unit_test::Suite& s)
+        requires(I1 == 0 && I2 == 0)
     {
         Func<I1, I2> const func;
         func(tup, s);
diff --git a/src/xrpld/overlay/detail/PeerImp.h b/src/xrpld/overlay/detail/PeerImp.h
index 4a96f9a6e6..e9ef948d48 100644
--- a/src/xrpld/overlay/detail/PeerImp.h
+++ b/src/xrpld/overlay/detail/PeerImp.h
@@ -322,12 +322,11 @@ public:
     removeTxQueue(uint256 const& hash) override;
 
     /** Send a set of PeerFinder endpoints as a protocol message. */
-    template <
-        class FwdIt,
-        class = std::enable_if_t<
-            std::is_same_v<typename std::iterator_traits<FwdIt>::value_type, PeerFinder::Endpoint>>>
+    template <class FwdIt>
     void
-    sendEndpoints(FwdIt first, FwdIt last);
+    sendEndpoints(FwdIt first, FwdIt last)
+        requires(
+            std::is_same_v<typename std::iterator_traits<FwdIt>::value_type, PeerFinder::Endpoint>);
 
     beast::IP::Endpoint
     getRemoteAddress() const override
@@ -787,9 +786,10 @@ PeerImp::PeerImp(
         << id_;
 }
 
-template <class FwdIt, class>
+template <class FwdIt>
 void
 PeerImp::sendEndpoints(FwdIt first, FwdIt last)
+    requires(std::is_same_v<typename std::iterator_traits<FwdIt>::value_type, PeerFinder::Endpoint>)
 {
     protocol::TMEndpoints tm;
 
diff --git a/src/xrpld/overlay/detail/ProtocolMessage.h b/src/xrpld/overlay/detail/ProtocolMessage.h
index da418f8e82..156fcfc104 100644
--- a/src/xrpld/overlay/detail/ProtocolMessage.h
+++ b/src/xrpld/overlay/detail/ProtocolMessage.h
@@ -237,12 +237,10 @@ parseMessageHeader(boost::system::error_code& ec, BufferSequence const& bufs, st
     return std::nullopt;
 }
 
-template <
-    class T,
-    class Buffers,
-    class = std::enable_if_t<std::is_base_of_v<::google::protobuf::Message, T>>>
+template <class T, class Buffers>
 std::shared_ptr<T>
 parseMessageContent(MessageHeader const& header, Buffers const& buffers)
+    requires(std::is_base_of_v<::google::protobuf::Message, T>)
 {
     auto m = std::make_shared<T>();
 
@@ -272,13 +270,10 @@ parseMessageContent(MessageHeader const& header, Buffers const& buffers)
     return m;
 }
 
-template <
-    class T,
-    class Buffers,
-    class Handler,
-    class = std::enable_if_t<std::is_base_of_v<::google::protobuf::Message, T>>>
+template <class T, class Buffers, class Handler>
 bool
 invoke(MessageHeader const& header, Buffers const& buffers, Handler& handler)
+    requires(std::is_base_of_v<::google::protobuf::Message, T>)
 {
     auto const m = parseMessageContent<T>(header, buffers);
     if (!m)
diff --git a/src/xrpld/rpc/Status.h b/src/xrpld/rpc/Status.h
index 4f15ab0242..ff77f2ace7 100644
--- a/src/xrpld/rpc/Status.h
+++ b/src/xrpld/rpc/Status.h
@@ -33,9 +33,11 @@ public:
 
     Status() = default;
 
-    // The enable_if allows only integers (not enums).  Prevents enum narrowing.
-    template <typename T, typename = std::enable_if_t<std::is_integral_v<T>>>
-    Status(T code, Strings d = {}) : code_(code), messages_(std::move(d))
+    // The constraint allows only integers (not enums).  Prevents enum narrowing.
+    template <typename T>
+    Status(T code, Strings d = {})
+        requires(std::is_integral_v<T>)
+        : code_(code), messages_(std::move(d))
     {
     }
 

From c92285f10d1e992300833579f977e0df4ea78cb8 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Fri, 3 Jul 2026 16:59:20 +0100
Subject: [PATCH 046/100] chore: Delete dead code (#7718)

---
 .../detail/aged_unordered_container.h         |  38 -----
 src/test/overlay/short_read_test.cpp          |  16 --
 src/test/shamap/FetchPack_test.cpp            | 153 ------------------
 3 files changed, 207 deletions(-)
 delete mode 100644 src/test/shamap/FetchPack_test.cpp

diff --git a/include/xrpl/beast/container/detail/aged_unordered_container.h b/include/xrpl/beast/container/detail/aged_unordered_container.h
index 4c0882b04a..ea24141bfb 100644
--- a/include/xrpl/beast/container/detail/aged_unordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_unordered_container.h
@@ -2319,7 +2319,6 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
     return iterator(iter);
 }
 
-#if 1  // Use insert() instead of insert_check() insert_commit()
 // set, map
 template <
     bool IsMulti,
@@ -2349,43 +2348,6 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
     deleteElement(p);
     return std::make_pair(iterator(result.first), false);
 }
-#else   // As original, use insert_check() / insert_commit () pair.
-// set, map
-template <
-    bool IsMulti,
-    bool IsMap,
-    class Key,
-    class T,
-    class Clock,
-    class Hash,
-    class KeyEqual,
-    class Allocator>
-template <bool maybe_multi, class... Args>
-auto
-AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::emplace(
-    Args&&... args) -> std::pair<iterator, bool>
-    requires(!maybe_multi)
-{
-    maybe_rehash(1);
-    // VFALCO NOTE Its unfortunate that we need to
-    //             construct element here
-    element* const p(new_element(std::forward<Args>(args)...));
-    typename cont_type::insert_commit_data d;
-    auto const result(m_cont.insert_check(
-        extract(p->value),
-        std::cref(m_config.hashFunction()),
-        std::cref(m_config.keyValueEqual()),
-        d));
-    if (result.second)
-    {
-        auto const iter(m_cont.insert_commit(*p, d));
-        chronological.list.push_back(*p);
-        return std::make_pair(iterator(iter), true);
-    }
-    delete_element(p);
-    return std::make_pair(iterator(result.first), false);
-}
-#endif  // 0
 
 // multiset, multimap
 template <
diff --git a/src/test/overlay/short_read_test.cpp b/src/test/overlay/short_read_test.cpp
index f235008d89..d856231b8d 100644
--- a/src/test/overlay/short_read_test.cpp
+++ b/src/test/overlay/short_read_test.cpp
@@ -328,7 +328,6 @@ private:
                     fail("handshake", ec);
                     return;
                 }
-#if 1
                 boost::asio::async_read_until(
                     stream,
                     buf,
@@ -339,9 +338,6 @@ private:
                             error_code const& ec, std::size_t bytesTransferred) {
                             self->onRead(ec, bytesTransferred);
                         }));
-#else
-                close();
-#endif
             }
 
             void
@@ -533,7 +529,6 @@ private:
                 }
                 write(buf, "HELLO\n");
 
-#if 1
                 boost::asio::async_write(
                     stream,
                     buf.data(),
@@ -543,11 +538,6 @@ private:
                             error_code const& ec, std::size_t bytesTransferred) {
                             self->onWrite(ec, bytesTransferred);
                         }));
-#else
-                stream_.async_shutdown(bind_executor(
-                    strand_,
-                    [self = shared_from_this()](error_code const& ec) { self->on_shutdown(ec); }));
-#endif
             }
 
             void
@@ -559,7 +549,6 @@ private:
                     fail("write", ec);
                     return;
                 }
-#if 1
                 boost::asio::async_read_until(
                     stream,
                     buf,
@@ -570,11 +559,6 @@ private:
                             error_code const& ec, std::size_t bytesTransferred) {
                             self->onRead(ec, bytesTransferred);
                         }));
-#else
-                stream_.async_shutdown(bind_executor(
-                    strand_,
-                    [self = shared_from_this()](error_code const& ec) { self->on_shutdown(ec); }));
-#endif
             }
 
             void
diff --git a/src/test/shamap/FetchPack_test.cpp b/src/test/shamap/FetchPack_test.cpp
deleted file mode 100644
index f2e7578ee2..0000000000
--- a/src/test/shamap/FetchPack_test.cpp
+++ /dev/null
@@ -1,153 +0,0 @@
-#include <test/shamap/common.h>
-#include <test/unit_test/SuiteJournal.h>
-
-#include <xrpl/basics/Blob.h>
-#include <xrpl/basics/Log.h>
-#include <xrpl/basics/SHAMapHash.h>
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/UnorderedContainers.h>
-#include <xrpl/basics/random.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/beast/xor_shift_engine.h>
-#include <xrpl/protocol/Serializer.h>
-#include <xrpl/protocol/digest.h>
-#include <xrpl/shamap/SHAMap.h>
-#include <xrpl/shamap/SHAMapItem.h>
-#include <xrpl/shamap/SHAMapMissingNode.h>
-#include <xrpl/shamap/SHAMapSyncFilter.h>
-#include <xrpl/shamap/SHAMapTreeNode.h>
-
-#include <boost/smart_ptr/intrusive_ptr.hpp>
-
-#include <cassert>
-#include <cstddef>
-#include <cstdint>
-#include <memory>
-#include <optional>
-
-namespace xrpl::tests {
-
-class FetchPack_test : public beast::unit_test::Suite
-{
-public:
-    static constexpr auto kTableItems = 100;
-    static constexpr auto kTableItemsExtra = 20;
-
-    using Map = hash_map<SHAMapHash, Blob>;
-    using Table = SHAMap;
-    using Item = SHAMapItem;
-
-    struct TestFilter : SHAMapSyncFilter
-    {
-        TestFilter(Map& map, beast::Journal journal) : map(map), journal(journal)
-        {
-        }
-
-        void
-        gotNode(
-            bool fromFilter,
-            SHAMapHash const& nodeHash,
-            std::uint32_t ledgerSeq,
-            Blob&& nodeData,  // NOLINT(cppcoreguidelines-rvalue-reference-param-not-moved)
-            SHAMapNodeType type) const override
-        {
-        }
-
-        [[nodiscard]] std::optional<Blob>
-        getNode(SHAMapHash const& nodeHash) const override
-        {
-            auto const it = map.find(nodeHash);
-            if (it == map.end())
-            {
-                JLOG(journal.fatal()) << "Test filter missing node";
-                return std::nullopt;
-            }
-            return it->second;
-        }
-
-        Map& map;
-        beast::Journal journal;
-    };
-
-    static boost::intrusive_ptr<Item>
-    makeRandomItemMember(beast::xor_shift_engine& r)
-    {
-        Serializer s;
-        for (int d = 0; d < 3; ++d)
-            s.add32(xrpl::randInt<std::uint32_t>(r));
-        return makeShamapitem(s.getSHA512Half(), s.slice());
-    }
-
-    static void
-    addRandomItems(std::size_t n, Table& t, beast::xor_shift_engine& r)
-    {
-        for (std::size_t i = 0; i < n; ++i)
-        {
-            auto const result(t.addItem(SHAMapNodeType::TnAccountState, makeRandomItemMember(r)));
-            assert(result);
-            (void)result;
-        }
-    }
-
-    void
-    onFetch(Map& map, SHAMapHash const& hash, Blob const& blob)
-    {
-        BEAST_EXPECT(sha512Half(makeSlice(blob)) == hash.asUInt256());
-        map.emplace(hash, blob);
-    }
-
-    void
-    run() override
-    {
-        testFetchPack();
-    }
-
-    // Exercises a fetch-pack round trip: build a SHAMap, serialize every node
-    // into a pack keyed by node hash, then rebuild the map in a fresh SHAMap by
-    // sourcing every node from the pack through a SHAMapSyncFilter and comparing
-    // the result. This covers the filter-based reconstruction path (fetchRoot +
-    // getMissingNodes with a SHAMapSyncFilter), complementing SHAMapSync_test,
-    // which drives the getNodeFat/addKnownNode path.
-    void
-    testFetchPack()
-    {
-        test::SuiteJournal journal("FetchPack_test", *this);
-        TestNodeFamily f(journal), f2(journal);
-        beast::xor_shift_engine r;
-
-        // Build a source map. getHash() unshares the tree and computes every
-        // node hash; this must happen before serializing nodes below, otherwise
-        // inner nodes still carry stale cached hashes.
-        auto const source = std::make_shared<Table>(SHAMapType::FREE, f);
-        addRandomItems(kTableItems + kTableItemsExtra, *source, r);
-        source->setImmutable();
-        auto const rootHash = source->getHash();
-
-        // Turn the source into a fetch pack: node hash -> serialized node.
-        Map map;
-        source->visitNodes([this, &map](SHAMapTreeNode& node) {
-            Serializer s;
-            node.serializeWithPrefix(s);
-            onFetch(map, node.getHash(), s.getData());
-            return true;
-        });
-
-        // Rebuild the map in a fresh family, sourcing every node from the pack
-        // through the SHAMapSyncFilter.
-        auto const rebuilt = std::make_shared<Table>(SHAMapType::FREE, rootHash.asUInt256(), f2);
-        TestFilter filter(map, journal);
-        rebuilt->setSynching();
-        BEAST_EXPECT(rebuilt->fetchRoot(rootHash, &filter));
-
-        // Everything should be in the pack, so no nodes should be missing.
-        BEAST_EXPECT(rebuilt->getMissingNodes(2048, &filter).empty());
-        rebuilt->clearSynching();
-
-        BEAST_EXPECT(rebuilt->deepCompare(*source));
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(FetchPack, shamap, xrpl);
-
-}  // namespace xrpl::tests

From d07d2aba2e3a6704042d10606348c91ae6aaf65f Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 6 Jul 2026 13:19:52 +0100
Subject: [PATCH 047/100] chore: Enable most modernize checks (#7664)

---
 .clang-tidy                                   | 20 -------
 include/xrpl/basics/comparators.h             | 54 -------------------
 include/xrpl/beast/hash/hash_append.h         | 26 +--------
 include/xrpl/core/HashRouter.h                |  2 +-
 include/xrpl/json/json_reader.h               |  2 +-
 include/xrpl/ledger/OpenView.h                |  2 +-
 include/xrpl/ledger/detail/RawStateTable.h    |  2 +-
 include/xrpl/resource/detail/Logic.h          |  5 +-
 include/xrpl/shamap/FullBelowCache.h          |  2 +-
 src/libxrpl/json/json_reader.cpp              |  7 ++-
 src/libxrpl/json/json_value.cpp               | 11 ++--
 src/libxrpl/net/HTTPClient.cpp                |  6 +--
 src/libxrpl/protocol/PublicKey.cpp            |  6 +--
 src/libxrpl/protocol/STObject.cpp             |  2 +-
 src/libxrpl/protocol/tokens.cpp               | 11 ++--
 src/test/app/AMMMPT_test.cpp                  |  6 +--
 src/test/app/AMM_test.cpp                     |  8 +--
 src/test/app/PayChan_test.cpp                 |  6 +--
 src/test/app/PermissionedDomains_test.cpp     |  4 +-
 src/test/app/ValidatorList_test.cpp           |  4 +-
 src/test/basics/Number_test.cpp               |  7 +--
 src/test/basics/base58_test.cpp               |  5 +-
 .../beast/aged_associative_container_test.cpp |  2 +-
 src/test/core/Config_test.cpp                 |  2 +-
 src/test/csf/ledgers.h                        |  6 +--
 src/test/jtx/TrustedPublisherServer.h         | 16 +++---
 src/test/nodestore/Basics_test.cpp            |  6 +--
 src/test/nodestore/TestBase.h                 | 20 ++++---
 src/test/nodestore/Timing_test.cpp            |  4 +-
 src/test/resource/Logic_test.cpp              |  4 +-
 src/test/rpc/AccountInfo_test.cpp             |  2 +-
 src/test/rpc/GetAggregatePrice_test.cpp       |  6 +--
 src/test/rpc/JSONRPC_test.cpp                 |  4 +-
 src/test/rpc/LedgerEntry_test.cpp             | 27 +++++-----
 src/test/rpc/ServerDefinitions_test.cpp       |  4 +-
 src/test/rpc/Version_test.cpp                 |  2 +-
 src/test/shamap/SHAMapSync_test.cpp           |  5 +-
 src/tests/libxrpl/json/Value.cpp              |  2 +-
 src/xrpld/app/ledger/TransactionMaster.h      |  2 +-
 .../app/ledger/detail/TransactionMaster.cpp   |  2 +-
 src/xrpld/app/rdb/detail/PeerFinder.cpp       |  6 +--
 src/xrpld/core/detail/Config.cpp              |  4 +-
 src/xrpld/peerfinder/detail/Bootcache.h       | 11 ++--
 src/xrpld/peerfinder/detail/SourceStrings.cpp |  6 +--
 .../rpc/handlers/account/GatewayBalances.cpp  |  4 +-
 .../handlers/orderbook/GetAggregatePrice.cpp  |  3 +-
 46 files changed, 125 insertions(+), 223 deletions(-)
 delete mode 100644 include/xrpl/basics/comparators.h

diff --git a/.clang-tidy b/.clang-tidy
index 3bad686a11..a79b565e59 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -66,29 +66,9 @@ Checks: "-*,
   modernize-*,
   -modernize-avoid-c-arrays,
   -modernize-avoid-c-style-cast,
-  -modernize-avoid-setjmp-longjmp,
-  -modernize-avoid-variadic-functions,
-  -modernize-deprecated-ios-base-aliases,
-  -modernize-loop-convert,
-  -modernize-macro-to-enum,
-  -modernize-min-max-use-initializer-list,
-  -modernize-raw-string-literal,
-  -modernize-redundant-void-arg,
-  -modernize-replace-auto-ptr,
-  -modernize-replace-disallow-copy-and-assign-macro,
-  -modernize-replace-random-shuffle,
   -modernize-return-braced-init-list,
-  -modernize-shrink-to-fit,
-  -modernize-use-bool-literals,
-  -modernize-use-default-member-init,
   -modernize-use-integer-sign-comparison,
-  -modernize-use-noexcept,
-  -modernize-use-nullptr,
-  -modernize-use-std-format,
-  -modernize-use-std-print,
   -modernize-use-trailing-return-type,
-  -modernize-use-transparent-functors,
-  -modernize-use-uncaught-exceptions,
 
   performance-*,
   -performance-avoid-endl,
diff --git a/include/xrpl/basics/comparators.h b/include/xrpl/basics/comparators.h
deleted file mode 100644
index 0e21d38d6b..0000000000
--- a/include/xrpl/basics/comparators.h
+++ /dev/null
@@ -1,54 +0,0 @@
-#pragma once
-
-#include <functional>
-
-namespace xrpl {
-
-#ifdef _MSC_VER
-
-/*
- * MSVC 2019 version 16.9.0 added [[nodiscard]] to the std comparison
- * operator() functions. boost::bimap checks that the comparator is a
- * BinaryFunction, in part by calling the function and ignoring the value.
- * These two things don't play well together. These wrapper classes simply
- * strip [[nodiscard]] from operator() for use in boost::bimap.
- *
- * See also:
- *  https://www.boost.org/doc/libs/1_75_0/libs/bimap/doc/html/boost_bimap/the_tutorial/controlling_collection_types.html
- */
-
-template <class T = void>
-struct less
-{
-    using result_type = bool;
-
-    constexpr bool
-    operator()(T const& left, T const& right) const
-    {
-        return std::less<T>()(left, right);
-    }
-};
-
-template <class T = void>
-struct equal_to
-{
-    using result_type = bool;
-
-    constexpr bool
-    operator()(T const& left, T const& right) const
-    {
-        return std::equal_to<T>()(left, right);
-    }
-};
-
-#else
-
-template <class T = void>
-using less = std::less<T>;
-
-template <class T = void>
-using equal_to = std::equal_to<T>;
-
-#endif
-
-}  // namespace xrpl
diff --git a/include/xrpl/beast/hash/hash_append.h b/include/xrpl/beast/hash/hash_append.h
index da499dc612..3592ffbfe8 100644
--- a/include/xrpl/beast/hash/hash_append.h
+++ b/include/xrpl/beast/hash/hash_append.h
@@ -392,36 +392,12 @@ hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v)
 }
 // tuple
 
-namespace detail {
-
-inline void
-forEachItem(...) noexcept
-{
-}
-
-template <class Hasher, class T>
-inline int
-hashOne(Hasher& h, T const& t) noexcept
-{
-    hash_append(h, t);
-    return 0;
-}
-
-template <class Hasher, class... T, std::size_t... I>
-inline void
-tuple_hash(Hasher& h, std::tuple<T...> const& t, std::index_sequence<I...>) noexcept
-{
-    for_each_item(hash_one(h, std::get<I>(t))...);
-}
-
-}  // namespace detail
-
 template <class Hasher, class... T>
 inline void
 hash_append(Hasher& h, std::tuple<T...> const& t) noexcept
     requires(!IsContiguouslyHashable<std::tuple<T...>, Hasher>::value)
 {
-    detail::tuple_hash(h, t, std::index_sequence_for<T...>{});
+    std::apply([&h](auto const&... item) { (hash_append(h, item), ...); }, t);
 }
 
 // shared_ptr
diff --git a/include/xrpl/core/HashRouter.h b/include/xrpl/core/HashRouter.h
index ef8f24d43c..dad1afb405 100644
--- a/include/xrpl/core/HashRouter.h
+++ b/include/xrpl/core/HashRouter.h
@@ -127,7 +127,7 @@ private:
         }
 
         [[nodiscard]] HashRouterFlags
-        getFlags(void) const
+        getFlags() const
         {
             return flags_;
         }
diff --git a/include/xrpl/json/json_reader.h b/include/xrpl/json/json_reader.h
index c1535bfb55..d1e4ada579 100644
--- a/include/xrpl/json/json_reader.h
+++ b/include/xrpl/json/json_reader.h
@@ -154,7 +154,7 @@ private:
         Location end,
         unsigned int& unicode);
     bool
-    addError(std::string const& message, Token& token, Location extra = 0);
+    addError(std::string const& message, Token& token, Location extra = nullptr);
     bool
     recoverFromError(TokenType skipUntilToken);
     bool
diff --git a/include/xrpl/ledger/OpenView.h b/include/xrpl/ledger/OpenView.h
index de81787906..875909715c 100644
--- a/include/xrpl/ledger/OpenView.h
+++ b/include/xrpl/ledger/OpenView.h
@@ -82,7 +82,7 @@ private:
     using txs_map = std::map<
         key_type,
         TxData,
-        std::less<key_type>,
+        std::less<>,
         boost::container::pmr::polymorphic_allocator<std::pair<key_type const, TxData>>>;
 
     // monotonic_resource_ must outlive `items_`. Make a pointer so it may be
diff --git a/include/xrpl/ledger/detail/RawStateTable.h b/include/xrpl/ledger/detail/RawStateTable.h
index cfa528d355..2e36a42eaf 100644
--- a/include/xrpl/ledger/detail/RawStateTable.h
+++ b/include/xrpl/ledger/detail/RawStateTable.h
@@ -105,7 +105,7 @@ private:
     using items_t = std::map<
         key_type,
         SleAction,
-        std::less<key_type>,
+        std::less<>,
         boost::container::pmr::polymorphic_allocator<std::pair<key_type const, SleAction>>>;
     // monotonic_resource_ must outlive `items_`. Make a pointer so it may be
     // easily moved.
diff --git a/include/xrpl/resource/detail/Logic.h b/include/xrpl/resource/detail/Logic.h
index 6b1c5e7397..78cd0ac36c 100644
--- a/include/xrpl/resource/detail/Logic.h
+++ b/include/xrpl/resource/detail/Logic.h
@@ -351,10 +351,9 @@ public:
             Import& import(iter->second);
             if (iter->second.whenExpires <= elapsed)
             {
-                for (auto itemIter(import.items.begin()); itemIter != import.items.end();
-                     ++itemIter)
+                for (auto& item : import.items)
                 {
-                    itemIter->consumer.entry().remoteBalance -= itemIter->balance;
+                    item.consumer.entry().remoteBalance -= item.balance;
                 }
 
                 iter = importTable_.erase(iter);
diff --git a/include/xrpl/shamap/FullBelowCache.h b/include/xrpl/shamap/FullBelowCache.h
index dc597278df..b6d1142eb4 100644
--- a/include/xrpl/shamap/FullBelowCache.h
+++ b/include/xrpl/shamap/FullBelowCache.h
@@ -103,7 +103,7 @@ public:
 
     /** generation determines whether cached entry is valid */
     std::uint32_t
-    getGeneration(void) const
+    getGeneration() const
     {
         return gen_;
     }
diff --git a/src/libxrpl/json/json_reader.cpp b/src/libxrpl/json/json_reader.cpp
index 45e448c480..a12ec7b565 100644
--- a/src/libxrpl/json/json_reader.cpp
+++ b/src/libxrpl/json/json_reader.cpp
@@ -86,8 +86,8 @@ Reader::parse(char const* beginDoc, char const* endDoc, Value& root)
     begin_ = beginDoc;
     end_ = endDoc;
     current_ = begin_;
-    lastValueEnd_ = 0;
-    lastValue_ = 0;
+    lastValueEnd_ = nullptr;
+    lastValue_ = nullptr;
     errors_.clear();
 
     while (!nodes_.empty())
@@ -908,9 +908,8 @@ Reader::getFormattedErrorMessages() const
 {
     std::string formattedMessage;
 
-    for (auto itError = errors_.begin(); itError != errors_.end(); ++itError)
+    for (auto const& error : errors_)
     {
-        ErrorInfo const& error = *itError;
         formattedMessage += "* " + getLocationLineAndColumn(error.token.start) + "\n";
         formattedMessage += "  " + error.message + "\n";
 
diff --git a/src/libxrpl/json/json_value.cpp b/src/libxrpl/json/json_value.cpp
index 7218b8c6cf..c679e30e16 100644
--- a/src/libxrpl/json/json_value.cpp
+++ b/src/libxrpl/json/json_value.cpp
@@ -90,7 +90,7 @@ static struct DummyValueAllocatorInitializer
 // Notes: index_ indicates if the string was allocated when
 // a string is stored.
 
-Value::CZString::CZString(int index) : cstr_(0), index_(index)
+Value::CZString::CZString(int index) : cstr_(nullptr), index_(index)
 {
 }
 
@@ -103,7 +103,8 @@ Value::CZString::CZString(char const* cstr, DuplicationPolicy allocate)
 
 Value::CZString::CZString(CZString const& other)
     : cstr_(
-          other.index_ != static_cast<int>(DuplicationPolicy::NoDuplication) && other.cstr_ != 0
+          other.index_ != static_cast<int>(DuplicationPolicy::NoDuplication) &&
+                  other.cstr_ != nullptr
               ? valueAllocator()->makeMemberName(other.cstr_)
               : other.cstr_)
     , index_([&]() -> int {
@@ -187,7 +188,7 @@ Value::Value(ValueType type) : type_(type)
             break;
 
         case ValueType::String:
-            value_.stringVal = 0;
+            value_.stringVal = nullptr;
             break;
 
         case ValueType::Array:
@@ -268,7 +269,7 @@ Value::Value(Value const& other) : type_(other.type_)
             }
             else
             {
-                value_.stringVal = 0;
+                value_.stringVal = nullptr;
             }
 
             break;
@@ -405,7 +406,7 @@ operator<(Value const& x, Value const& y)
             return static_cast<int>(x.value_.boolVal) < static_cast<int>(y.value_.boolVal);
 
         case ValueType::String:
-            return (x.value_.stringVal == 0 && (y.value_.stringVal != nullptr)) ||
+            return (x.value_.stringVal == nullptr && (y.value_.stringVal != nullptr)) ||
                 ((y.value_.stringVal != nullptr) && (x.value_.stringVal != nullptr) &&
                  strcmp(x.value_.stringVal, y.value_.stringVal) < 0);
 
diff --git a/src/libxrpl/net/HTTPClient.cpp b/src/libxrpl/net/HTTPClient.cpp
index 7294633964..5edd8b5b47 100644
--- a/src/libxrpl/net/HTTPClient.cpp
+++ b/src/libxrpl/net/HTTPClient.cpp
@@ -370,10 +370,10 @@ public:
             {std::istreambuf_iterator<char>(&header_)}, std::istreambuf_iterator<char>()};
         JLOG(j_.trace()) << "Header: \"" << strHeader << "\"";
 
-        static boost::regex const kReStatus{"\\`HTTP/1\\S+ (\\d{3}) .*\\'"};  // HTTP/1.1 200 OK
+        static boost::regex const kReStatus{R"(\`HTTP/1\S+ (\d{3}) .*\')"};  // HTTP/1.1 200 OK
         static boost::regex const kReSize{
-            "\\`.*\\r\\nContent-Length:\\s+([0-9]+).*\\'", boost::regex::icase};
-        static boost::regex const kReBody{"\\`.*\\r\\n\\r\\n(.*)\\'"};
+            R"(\`.*\r\nContent-Length:\s+([0-9]+).*\')", boost::regex::icase};
+        static boost::regex const kReBody{R"(\`.*\r\n\r\n(.*)\')"};
 
         boost::smatch smMatch;
         // Match status code.
diff --git a/src/libxrpl/protocol/PublicKey.cpp b/src/libxrpl/protocol/PublicKey.cpp
index c6e6c1d324..97948fcae3 100644
--- a/src/libxrpl/protocol/PublicKey.cpp
+++ b/src/libxrpl/protocol/PublicKey.cpp
@@ -87,11 +87,11 @@ sliceToHex(Slice const& slice)
         s.reserve(2 * (slice.size() + 1));
         s = "0x";
     }
-    for (int i = 0; i < slice.size(); ++i)
+    for (std::uint8_t const byte : slice)
     {
         static constexpr char kHex[] = "0123456789ABCDEF";
-        s += kHex[((slice[i] & 0xf0) >> 4)];
-        s += kHex[((slice[i] & 0x0f) >> 0)];
+        s += kHex[((byte & 0xf0) >> 4)];
+        s += kHex[((byte & 0x0f) >> 0)];
     }
     return s;
 }
diff --git a/src/libxrpl/protocol/STObject.cpp b/src/libxrpl/protocol/STObject.cpp
index ea8553dc4f..869700baed 100644
--- a/src/libxrpl/protocol/STObject.cpp
+++ b/src/libxrpl/protocol/STObject.cpp
@@ -502,7 +502,7 @@ STObject::isFlag(std::uint32_t f) const
 }
 
 std::uint32_t
-STObject::getFlags(void) const
+STObject::getFlags() const
 {
     auto const* t = dynamic_cast<STUInt32 const*>(peekAtPField(sfFlags));
 
diff --git a/src/libxrpl/protocol/tokens.cpp b/src/libxrpl/protocol/tokens.cpp
index 6716b1185f..21984c67e7 100644
--- a/src/libxrpl/protocol/tokens.cpp
+++ b/src/libxrpl/protocol/tokens.cpp
@@ -23,6 +23,7 @@
 #include <cstdint>
 #include <cstring>
 #include <expected>
+#include <ranges>
 #include <span>
 #include <string>
 #include <string_view>
@@ -265,17 +266,17 @@ decodeBase58(std::string const& s)
 
     // Allocate enough space in big-endian base256 representation.
     // log(58) / log(256), rounded up.
-    std::vector<unsigned char> b256((remain * 733 / 1000) + 1);
+    std::vector<std::uint8_t> b256((remain * 733 / 1000) + 1);
     while (remain > 0)
     {
         auto carry = kAlphabetReverse[*psz];
         if (carry == -1)
             return {};
         // Apply "b256 = b256 * 58 + carry".
-        for (auto iter = b256.rbegin(); iter != b256.rend(); ++iter)
+        for (std::uint8_t& byte : std::views::reverse(b256))
         {
-            carry += 58 * *iter;
-            *iter = carry % 256;
+            carry += 58 * byte;
+            byte = carry % 256;
             carry /= 256;
         }
         XRPL_ASSERT(carry == 0, "xrpl::b58_ref::detail::decodeBase58 : zero carry");
@@ -283,7 +284,7 @@ decodeBase58(std::string const& s)
         --remain;
     }
     // Skip leading zeroes in b256.
-    auto iter = std::ranges::find_if(b256, [](unsigned char c) { return c != 0; });
+    auto iter = std::ranges::find_if(b256, [](std::uint8_t c) { return c != 0; });
     std::string result;
     result.reserve(zeroes + (b256.end() - iter));
     result.assign(zeroes, 0x00);
diff --git a/src/test/app/AMMMPT_test.cpp b/src/test/app/AMMMPT_test.cpp
index c68270591a..4877406ca1 100644
--- a/src/test/app/AMMMPT_test.cpp
+++ b/src/test/app/AMMMPT_test.cpp
@@ -3482,8 +3482,8 @@ private:
             // The vote is not added to the slots
             ammAlice.vote(carol_, 1'000);
             auto const info = ammAlice.ammRpcInfo()[jss::amm][jss::vote_slots];
-            for (auto i = 0; i < info.size(); ++i)
-                BEAST_EXPECT(info[i][jss::account] != carol_.human());
+            for (auto const& entry : info)
+                BEAST_EXPECT(entry[jss::account] != carol_.human());
             // But the slots are refreshed and the fee is changed
             BEAST_EXPECT(ammAlice.expectTradingFee(82));
         }
@@ -6270,7 +6270,7 @@ private:
                 auto const info = env.rpc(
                     "json",
                     "account_info",
-                    std::string("{\"account\": \"" + to_string(amm.ammAccount()) + "\"}"));
+                    std::string(R"({"account": ")" + to_string(amm.ammAccount()) + "\"}"));
                 try
                 {
                     BEAST_EXPECT(
diff --git a/src/test/app/AMM_test.cpp b/src/test/app/AMM_test.cpp
index d4b6ba5429..f19743026c 100644
--- a/src/test/app/AMM_test.cpp
+++ b/src/test/app/AMM_test.cpp
@@ -2463,8 +2463,8 @@ private:
             // The vote is not added to the slots
             ammAlice.vote(carol_, 1'000);
             auto const info = ammAlice.ammRpcInfo()[jss::amm][jss::vote_slots];
-            for (std::uint32_t i = 0; i < info.size(); ++i)
-                BEAST_EXPECT(info[i][jss::account] != carol_.human());
+            for (auto const& entry : info)
+                BEAST_EXPECT(entry[jss::account] != carol_.human());
             // But the slots are refreshed and the fee is changed
             BEAST_EXPECT(ammAlice.expectTradingFee(82));
         });
@@ -4436,7 +4436,7 @@ private:
             auto const info = env.rpc(
                 "json",
                 "account_info",
-                std::string("{\"account\": \"" + to_string(ammAlice.ammAccount()) + "\"}"));
+                std::string(R"({"account": ")" + to_string(ammAlice.ammAccount()) + "\"}"));
             auto const flags = info[jss::result][jss::account_data][jss::Flags].asUInt();
             BEAST_EXPECT(flags == (lsfDisableMaster | lsfDefaultRipple | lsfDepositAuth));
         });
@@ -5265,7 +5265,7 @@ private:
             auto const info = env.rpc(
                 "json",
                 "account_info",
-                std::string("{\"account\": \"" + to_string(amm.ammAccount()) + "\"}"));
+                std::string(R"({"account": ")" + to_string(amm.ammAccount()) + "\"}"));
             try
             {
                 BEAST_EXPECT(
diff --git a/src/test/app/PayChan_test.cpp b/src/test/app/PayChan_test.cpp
index f1a9506e0c..5068472135 100644
--- a/src/test/app/PayChan_test.cpp
+++ b/src/test/app/PayChan_test.cpp
@@ -1323,10 +1323,10 @@ struct PayChan_test : public beast::unit_test::Suite
         auto sliceToHex = [](Slice const& slice) {
             std::string s;
             s.reserve(2 * slice.size());
-            for (int i = 0; i < slice.size(); ++i)
+            for (std::uint8_t const byte : slice)
             {
-                s += "0123456789ABCDEF"[((slice[i] & 0xf0) >> 4)];
-                s += "0123456789ABCDEF"[((slice[i] & 0x0f) >> 0)];
+                s += "0123456789ABCDEF"[((byte & 0xf0) >> 4)];
+                s += "0123456789ABCDEF"[((byte & 0x0f) >> 0)];
             }
             return s;
         };
diff --git a/src/test/app/PermissionedDomains_test.cpp b/src/test/app/PermissionedDomains_test.cpp
index 2cffc18682..784c2b4f56 100644
--- a/src/test/app/PermissionedDomains_test.cpp
+++ b/src/test/app/PermissionedDomains_test.cpp
@@ -289,8 +289,8 @@ class PermissionedDomains_test : public beast::unit_test::Suite
         for (auto const& c : alice)
             human2Acc.emplace(c.human(), c);
 
-        for (int i = 0; i < accNum; ++i)
-            env.fund(XRP(1000), alice[i]);
+        for (auto const& account : alice)
+            env.fund(XRP(1000), account);
 
         // Create new from existing account with a single credential.
         pdomain::Credentials const credentials1{{.issuer = alice[2], .credType = "credential1"}};
diff --git a/src/test/app/ValidatorList_test.cpp b/src/test/app/ValidatorList_test.cpp
index d71554f714..8077c21863 100644
--- a/src/test/app/ValidatorList_test.cpp
+++ b/src/test/app/ValidatorList_test.cpp
@@ -146,8 +146,8 @@ private:
 
         for (auto const& val : validators)
         {
-            data += "{\"validation_public_key\":\"" + strHex(val.masterPublic) +
-                "\",\"manifest\":\"" + val.manifest + "\"},";
+            data += R"({"validation_public_key":")" + strHex(val.masterPublic) +
+                R"(","manifest":")" + val.manifest + "\"},";
         }
 
         data.pop_back();
diff --git a/src/test/basics/Number_test.cpp b/src/test/basics/Number_test.cpp
index 2d2745de14..d704efa27a 100644
--- a/src/test/basics/Number_test.cpp
+++ b/src/test/basics/Number_test.cpp
@@ -17,6 +17,7 @@
 #include <iomanip>
 #include <limits>
 #include <map>
+#include <ranges>
 #include <sstream>
 #include <stdexcept>
 #include <string>
@@ -36,11 +37,11 @@ class Number_test : public beast::unit_test::Suite
         auto s = to_string(value);
         std::string out;
         int count = 0;
-        for (auto it = s.rbegin(); it != s.rend(); ++it)
+        for (char const& ch : std::views::reverse(s))
         {
-            if (count != 0 && count % 3 == 0 && (isdigit(*it) != 0))
+            if (count != 0 && count % 3 == 0 && (isdigit(ch) != 0))
                 out.insert(out.begin(), '_');
-            out.insert(out.begin(), *it);
+            out.insert(out.begin(), ch);
             ++count;
         }
         return out;
diff --git a/src/test/basics/base58_test.cpp b/src/test/basics/base58_test.cpp
index 3c76308813..d2c8d9eabc 100644
--- a/src/test/basics/base58_test.cpp
+++ b/src/test/basics/base58_test.cpp
@@ -10,6 +10,7 @@
 #include <iomanip>
 #include <iostream>
 #include <limits>
+#include <ranges>
 #include <stdexcept>
 #include <string>
 #include <tuple>
@@ -132,10 +133,10 @@ boost::multiprecision::checked_uint512_t
 toBoostMP(std::span<std::uint64_t> in)
 {
     boost::multiprecision::checked_uint512_t mbp = 0;
-    for (auto i = in.rbegin(); i != in.rend(); ++i)
+    for (auto& word : std::views::reverse(in))
     {
         mbp <<= 64;
-        mbp += *i;
+        mbp += word;
     }
     return mbp;
 }
diff --git a/src/test/beast/aged_associative_container_test.cpp b/src/test/beast/aged_associative_container_test.cpp
index 2752ff3127..76be44b793 100644
--- a/src/test/beast/aged_associative_container_test.cpp
+++ b/src/test/beast/aged_associative_container_test.cpp
@@ -145,7 +145,7 @@ public:
         }
 
         T*
-        allocate(std::size_t n, T const* = 0)
+        allocate(std::size_t n, T const* = nullptr)
         {
             return static_cast<T*>(::operator new(n * sizeof(T)));
         }
diff --git a/src/test/core/Config_test.cpp b/src/test/core/Config_test.cpp
index fdac1e450d..38c14b8ac5 100644
--- a/src/test/core/Config_test.cpp
+++ b/src/test/core/Config_test.cpp
@@ -1136,7 +1136,7 @@ trust-these-validators.gov
     testZeroPort()
     {
         auto const contents = std::regex_replace(
-            detail::configContents("", ""), std::regex("port\\s*=\\s*\\d+"), "port = 0");
+            detail::configContents("", ""), std::regex(R"(port\s*=\s*\d+)"), "port = 0");
 
         try
         {
diff --git a/src/test/csf/ledgers.h b/src/test/csf/ledgers.h
index dc5ec5277c..4873519dee 100644
--- a/src/test/csf/ledgers.h
+++ b/src/test/csf/ledgers.h
@@ -3,7 +3,6 @@
 #include <test/csf/Tx.h>
 
 #include <xrpl/basics/chrono.h>
-#include <xrpl/basics/comparators.h>
 #include <xrpl/basics/tagged_integer.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/ledger/LedgerTiming.h>
@@ -13,6 +12,7 @@
 #include <cassert>
 #include <cstddef>
 #include <cstdint>
+#include <functional>
 #include <optional>
 #include <set>
 #include <string>
@@ -232,8 +232,8 @@ private:
 class LedgerOracle
 {
     using InstanceMap = boost::bimaps::bimap<
-        boost::bimaps::set_of<Ledger::Instance, xrpl::less<Ledger::Instance>>,
-        boost::bimaps::set_of<Ledger::ID, xrpl::less<Ledger::ID>>>;
+        boost::bimaps::set_of<Ledger::Instance, std::less<>>,
+        boost::bimaps::set_of<Ledger::ID, std::less<>>>;
     using InstanceEntry = InstanceMap::value_type;
 
     // Set of all known ledgers; note this is never pruned
diff --git a/src/test/jtx/TrustedPublisherServer.h b/src/test/jtx/TrustedPublisherServer.h
index 008bbe70c3..f5ee8aac3a 100644
--- a/src/test/jtx/TrustedPublisherServer.h
+++ b/src/test/jtx/TrustedPublisherServer.h
@@ -188,8 +188,8 @@ public:
 
             for (auto const& val : validators)
             {
-                data += "{\"validation_public_key\":\"" + strHex(val.masterPublic) +
-                    "\",\"manifest\":\"" + val.manifest + "\"},";
+                data += R"({"validation_public_key":")" + strHex(val.masterPublic) +
+                    R"(","manifest":")" + val.manifest + "\"},";
             }
             data.pop_back();
             data += "]}";
@@ -201,8 +201,8 @@ public:
         getList_ = [blob = blob, sig, manifest, version](int interval) {
             // Build the contents of a version 1 format UNL file
             std::stringstream l;
-            l << "{\"blob\":\"" << blob << "\"" << ",\"signature\":\"" << sig << "\""
-              << ",\"manifest\":\"" << manifest << "\""
+            l << R"({"blob":")" << blob << "\"" << R"(,"signature":")" << sig << "\""
+              << R"(,"manifest":")" << manifest << "\""
               << ",\"refresh_interval\": " << interval << ",\"version\":" << version << '}';
             return l.str();
         };
@@ -216,8 +216,8 @@ public:
             // Use the same set of validators for simplicity
             for (auto const& val : validators)
             {
-                data += "{\"validation_public_key\":\"" + strHex(val.masterPublic) +
-                    "\",\"manifest\":\"" + val.manifest + "\"},";
+                data += R"({"validation_public_key":")" + strHex(val.masterPublic) +
+                    R"(","manifest":")" + val.manifest + "\"},";
             }
             data.pop_back();
             data += "]}";
@@ -232,13 +232,13 @@ public:
             std::stringstream l;
             for (auto const& info : blobInfo)
             {
-                l << "{\"blob\":\"" << info.blob << "\"" << ",\"signature\":\"" << info.signature
+                l << R"({"blob":")" << info.blob << "\"" << R"(,"signature":")" << info.signature
                   << "\"},";
             }
             std::string blobs = l.str();
             blobs.pop_back();
             l.str(std::string());
-            l << "{\"blobs_v2\": [ " << blobs << "],\"manifest\":\"" << manifest << "\""
+            l << "{\"blobs_v2\": [ " << blobs << R"(],"manifest":")" << manifest << "\""
               << ",\"refresh_interval\": " << interval << ",\"version\":" << (version + 1) << '}';
             return l.str();
         };
diff --git a/src/test/nodestore/Basics_test.cpp b/src/test/nodestore/Basics_test.cpp
index 5565399cc2..7d77b18630 100644
--- a/src/test/nodestore/Basics_test.cpp
+++ b/src/test/nodestore/Basics_test.cpp
@@ -40,9 +40,9 @@ public:
 
         auto batch = createPredictableBatch(kNumObjectsToTest, seedValue);
 
-        for (int i = 0; i < batch.size(); ++i)
+        for (auto const& expected : batch)
         {
-            EncodedBlob const encoded(batch[i]);
+            EncodedBlob const encoded(expected);
 
             DecodedBlob decoded(encoded.getKey(), encoded.getData(), encoded.getSize());
 
@@ -52,7 +52,7 @@ public:
             {
                 std::shared_ptr<NodeObject> const object(decoded.createObject());
 
-                BEAST_EXPECT(isSame(batch[i], object));
+                BEAST_EXPECT(isSame(expected, object));
             }
         }
     }
diff --git a/src/test/nodestore/TestBase.h b/src/test/nodestore/TestBase.h
index 1254fc51aa..a1245ec963 100644
--- a/src/test/nodestore/TestBase.h
+++ b/src/test/nodestore/TestBase.h
@@ -124,9 +124,9 @@ public:
     static void
     storeBatch(Backend& backend, Batch const& batch)
     {
-        for (int i = 0; i < batch.size(); ++i)
+        for (auto const& object : batch)
         {
-            backend.store(batch[i]);
+            backend.store(object);
         }
     }
 
@@ -137,11 +137,11 @@ public:
         pCopy->clear();
         pCopy->reserve(batch.size());
 
-        for (int i = 0; i < batch.size(); ++i)
+        for (auto const& expected : batch)
         {
             std::shared_ptr<NodeObject> object;
 
-            Status const status = backend.fetch(batch[i]->getHash(), &object);
+            Status const status = backend.fetch(expected->getHash(), &object);
 
             BEAST_EXPECT(status == Status::Ok);
 
@@ -157,11 +157,11 @@ public:
     void
     fetchMissing(Backend& backend, Batch const& batch)
     {
-        for (int i = 0; i < batch.size(); ++i)
+        for (auto const& expected : batch)
         {
             std::shared_ptr<NodeObject> object;
 
-            Status const status = backend.fetch(batch[i]->getHash(), &object);
+            Status const status = backend.fetch(expected->getHash(), &object);
 
             BEAST_EXPECT(status == Status::NotFound);
         }
@@ -171,10 +171,8 @@ public:
     static void
     storeBatch(Database& db, Batch const& batch)
     {
-        for (int i = 0; i < batch.size(); ++i)
+        for (auto const& object : batch)
         {
-            std::shared_ptr<NodeObject> const object(batch[i]);
-
             Blob data(object->getData());
 
             db.store(object->getType(), std::move(data), object->getHash(), db.earliestLedgerSeq());
@@ -188,9 +186,9 @@ public:
         pCopy->clear();
         pCopy->reserve(batch.size());
 
-        for (int i = 0; i < batch.size(); ++i)
+        for (auto const& expected : batch)
         {
-            std::shared_ptr<NodeObject> const object = db.fetchNodeObject(batch[i]->getHash(), 0);
+            std::shared_ptr<NodeObject> const object = db.fetchNodeObject(expected->getHash(), 0);
 
             if (object != nullptr)
                 pCopy->push_back(object);
diff --git a/src/test/nodestore/Timing_test.cpp b/src/test/nodestore/Timing_test.cpp
index e308d0d5ff..1c296ca44c 100644
--- a/src/test/nodestore/Timing_test.cpp
+++ b/src/test/nodestore/Timing_test.cpp
@@ -564,10 +564,10 @@ public:
                     char p[2];
                     p[0] = rand_(gen_) < 50 ? 0 : 1;
                     p[1] = 1 - p[0];
-                    for (int q = 0; q < 2; ++q)
+                    for (char const op : p)
                     {
                         // NOLINTNEXTLINE(bugprone-switch-missing-default-case)
-                        switch (p[q])
+                        switch (op)
                         {
                             case 0: {
                                 // fetch recent
diff --git a/src/test/resource/Logic_test.cpp b/src/test/resource/Logic_test.cpp
index f6b4875356..40a81503f1 100644
--- a/src/test/resource/Logic_test.cpp
+++ b/src/test/resource/Logic_test.cpp
@@ -211,8 +211,8 @@ public:
 
         Gossip g[5];
 
-        for (int i = 0; i < 5; ++i)
-            createGossip(g[i]);
+        for (auto& gossip : g)
+            createGossip(gossip);
 
         for (int i = 0; i < 5; ++i)
             logic.importConsumers(std::to_string(i), g[i]);
diff --git a/src/test/rpc/AccountInfo_test.cpp b/src/test/rpc/AccountInfo_test.cpp
index d061be1f0e..61a11d0b93 100644
--- a/src/test/rpc/AccountInfo_test.cpp
+++ b/src/test/rpc/AccountInfo_test.cpp
@@ -234,7 +234,7 @@ public:
         withSigners[jss::account] = alice.human();
         withSigners[jss::signer_lists] = true;
 
-        auto const withSignersAsString = std::string("{ ") + "\"api_version\": 2, \"account\": \"" +
+        auto const withSignersAsString = std::string("{ ") + R"("api_version": 2, "account": ")" +
             alice.human() + "\", " + "\"signer_lists\": asdfggh }";
 
         // Alice has no SignerList yet.
diff --git a/src/test/rpc/GetAggregatePrice_test.cpp b/src/test/rpc/GetAggregatePrice_test.cpp
index 214bd12183..22c021865d 100644
--- a/src/test/rpc/GetAggregatePrice_test.cpp
+++ b/src/test/rpc/GetAggregatePrice_test.cpp
@@ -297,13 +297,13 @@ public:
 
             OraclesData oracles;
             prep(env, oracles);
-            for (int i = 0; i < oracles.size(); ++i)
+            for (auto& oracleData : oracles)
             {
                 Oracle oracle(
                     env,
-                    {.owner = oracles[i].first,
+                    {.owner = oracleData.first,
                      // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
-                     .documentID = asUInt(*oracles[i].second),
+                     .documentID = asUInt(*oracleData.second),
                      .fee = baseFee},
                     false);
                 // push XRP/USD by two ledgers, so this price
diff --git a/src/test/rpc/JSONRPC_test.cpp b/src/test/rpc/JSONRPC_test.cpp
index 7f6b123533..e18974e7e7 100644
--- a/src/test/rpc/JSONRPC_test.cpp
+++ b/src/test/rpc/JSONRPC_test.cpp
@@ -2238,7 +2238,7 @@ public:
 
         {
             json::Value req;
-            json::Reader().parse("{ \"fee_mult_max\" : 1, \"tx_json\" : { } } ", req);
+            json::Reader().parse(R"({ "fee_mult_max" : 1, "tx_json" : { } } )", req);
             json::Value const result = checkFee(
                 req,
                 Role::ADMIN,
@@ -2275,7 +2275,7 @@ public:
 
         {
             json::Value req;
-            json::Reader().parse("{ \"fee_mult_max\" : 0, \"tx_json\" : { } } ", req);
+            json::Reader().parse(R"({ "fee_mult_max" : 0, "tx_json" : { } } )", req);
             json::Value const result = checkFee(
                 req,
                 Role::ADMIN,
diff --git a/src/test/rpc/LedgerEntry_test.cpp b/src/test/rpc/LedgerEntry_test.cpp
index 59dbf618f0..c7ef5cef2d 100644
--- a/src/test/rpc/LedgerEntry_test.cpp
+++ b/src/test/rpc/LedgerEntry_test.cpp
@@ -2917,29 +2917,32 @@ class LedgerEntry_XChain_test : public beast::unit_test::Suite,
             BEAST_EXPECT(
                 attest[json::Value::UInt(0)].isMember(sfXChainCreateAccountProofSig.jsonName));
             json::Value a[kNumAttest];
-            for (size_t i = 0; i < kNumAttest; ++i)
+            for (auto& attestation : a)
             {
-                a[i] = attest[json::Value::UInt(0)][sfXChainCreateAccountProofSig.jsonName];
+                attestation = attest[json::Value::UInt(0)][sfXChainCreateAccountProofSig.jsonName];
                 BEAST_EXPECT(
-                    a[i].isMember(jss::Amount) && a[i][jss::Amount].asInt() == 1000 * kDropPerXrp);
+                    attestation.isMember(jss::Amount) &&
+                    attestation[jss::Amount].asInt() == 1000 * kDropPerXrp);
                 BEAST_EXPECT(
-                    a[i].isMember(jss::Destination) && a[i][jss::Destination] == scCarol.human());
+                    attestation.isMember(jss::Destination) &&
+                    attestation[jss::Destination] == scCarol.human());
                 BEAST_EXPECT(
-                    a[i].isMember(sfAttestationSignerAccount.jsonName) &&
+                    attestation.isMember(sfAttestationSignerAccount.jsonName) &&
                     std::ranges::any_of(signers, [&](Signer const& s) {
-                        return a[i][sfAttestationSignerAccount.jsonName] == s.account.human();
+                        return attestation[sfAttestationSignerAccount.jsonName] ==
+                            s.account.human();
                     }));
                 BEAST_EXPECT(
-                    a[i].isMember(sfAttestationRewardAccount.jsonName) &&
+                    attestation.isMember(sfAttestationRewardAccount.jsonName) &&
                     std::ranges::any_of(payee, [&](Account const& account) {
-                        return a[i][sfAttestationRewardAccount.jsonName] == account.human();
+                        return attestation[sfAttestationRewardAccount.jsonName] == account.human();
                     }));
                 BEAST_EXPECT(
-                    a[i].isMember(sfWasLockingChainSend.jsonName) &&
-                    a[i][sfWasLockingChainSend.jsonName] == 1);
+                    attestation.isMember(sfWasLockingChainSend.jsonName) &&
+                    attestation[sfWasLockingChainSend.jsonName] == 1);
                 BEAST_EXPECT(
-                    a[i].isMember(sfSignatureReward.jsonName) &&
-                    a[i][sfSignatureReward.jsonName].asInt() == 1 * kDropPerXrp);
+                    attestation.isMember(sfSignatureReward.jsonName) &&
+                    attestation[sfSignatureReward.jsonName].asInt() == 1 * kDropPerXrp);
             }
         }
 
diff --git a/src/test/rpc/ServerDefinitions_test.cpp b/src/test/rpc/ServerDefinitions_test.cpp
index bac1b4f7a5..bf345e6fdf 100644
--- a/src/test/rpc/ServerDefinitions_test.cpp
+++ b/src/test/rpc/ServerDefinitions_test.cpp
@@ -433,7 +433,7 @@ public:
                 Env env(*this);
                 auto const firstResult = env.rpc("server_definitions");
                 auto const hash = firstResult[jss::result][jss::hash].asString();
-                auto const hashParam = std::string("{ ") + "\"hash\": \"" + hash + "\"}";
+                auto const hashParam = std::string("{ ") + R"("hash": ")" + hash + "\"}";
 
                 auto const result = env.rpc("json", "server_definitions", hashParam);
                 BEAST_EXPECT(!result[jss::result].isMember(jss::error));
@@ -456,7 +456,7 @@ public:
                 std::string const hash =
                     "54296160385A27154BFA70A239DD8E8FD4CC2DB7BA32D970BA3A5B132CF749"
                     "D1";
-                auto const hashParam = std::string("{ ") + "\"hash\": \"" + hash + "\"}";
+                auto const hashParam = std::string("{ ") + R"("hash": ")" + hash + "\"}";
 
                 auto const result = env.rpc("json", "server_definitions", hashParam);
                 BEAST_EXPECT(!result[jss::result].isMember(jss::error));
diff --git a/src/test/rpc/Version_test.cpp b/src/test/rpc/Version_test.cpp
index 20740bfe53..71830c2219 100644
--- a/src/test/rpc/Version_test.cpp
+++ b/src/test/rpc/Version_test.cpp
@@ -76,7 +76,7 @@ class Version_test : public beast::unit_test::Suite
                 "}");
         BEAST_EXPECT(badVersion(re));
 
-        re = env.rpc("json", "version", "{\"api_version\": \"a\"}");
+        re = env.rpc("json", "version", R"({"api_version": "a"})");
         BEAST_EXPECT(badVersion(re));
     }
 
diff --git a/src/test/shamap/SHAMapSync_test.cpp b/src/test/shamap/SHAMapSync_test.cpp
index 9e9a490977..bb05ec56df 100644
--- a/src/test/shamap/SHAMapSync_test.cpp
+++ b/src/test/shamap/SHAMapSync_test.cpp
@@ -18,7 +18,6 @@
 #include <boost/smart_ptr/intrusive_ptr.hpp>
 
 #include <chrono>
-#include <cstddef>
 #include <cstdint>
 #include <list>
 #include <ostream>
@@ -154,12 +153,12 @@ public:
             if (b.empty())
                 fail("", __FILE__, __LINE__);
 
-            for (std::size_t i = 0; i < b.size(); ++i)
+            for (auto& node : b)
             {
                 // Don't use BEAST_EXPECT here b/c it will be called a
                 // non-deterministic number of times and the number of tests run
                 // should be deterministic
-                if (!destination.addKnownNode(b[i].first, makeSlice(b[i].second), nullptr)
+                if (!destination.addKnownNode(node.first, makeSlice(node.second), nullptr)
                          .isUseful())
                     fail("", __FILE__, __LINE__);
             }
diff --git a/src/tests/libxrpl/json/Value.cpp b/src/tests/libxrpl/json/Value.cpp
index 03f565dffb..a1cd8160d7 100644
--- a/src/tests/libxrpl/json/Value.cpp
+++ b/src/tests/libxrpl/json/Value.cpp
@@ -838,7 +838,7 @@ TEST(json_value, compact)
 {
     json::Value j;
     json::Reader r;
-    char const* s("{\"array\":[{\"12\":23},{},null,false,0.5]}");
+    char const* s(R"({"array":[{"12":23},{},null,false,0.5]})");
 
     auto countLines = [](std::string const& str) {
         return 1 + std::count_if(str.begin(), str.end(), [](char c) { return c == '\n'; });
diff --git a/src/xrpld/app/ledger/TransactionMaster.h b/src/xrpld/app/ledger/TransactionMaster.h
index 5dcad09f51..6d81911510 100644
--- a/src/xrpld/app/ledger/TransactionMaster.h
+++ b/src/xrpld/app/ledger/TransactionMaster.h
@@ -68,7 +68,7 @@ public:
     canonicalize(std::shared_ptr<Transaction>* pTransaction);
 
     void
-    sweep(void);
+    sweep();
 
     TaggedCache<uint256, Transaction>&
     getCache();
diff --git a/src/xrpld/app/ledger/detail/TransactionMaster.cpp b/src/xrpld/app/ledger/detail/TransactionMaster.cpp
index 129681b906..ac2aa1aabe 100644
--- a/src/xrpld/app/ledger/detail/TransactionMaster.cpp
+++ b/src/xrpld/app/ledger/detail/TransactionMaster.cpp
@@ -152,7 +152,7 @@ TransactionMaster::canonicalize(std::shared_ptr<Transaction>* pTransaction)
 }
 
 void
-TransactionMaster::sweep(void)
+TransactionMaster::sweep()
 {
     cache_.sweep();
 }
diff --git a/src/xrpld/app/rdb/detail/PeerFinder.cpp b/src/xrpld/app/rdb/detail/PeerFinder.cpp
index c40e3e42c6..abdcd1c61a 100644
--- a/src/xrpld/app/rdb/detail/PeerFinder.cpp
+++ b/src/xrpld/app/rdb/detail/PeerFinder.cpp
@@ -147,10 +147,10 @@ updatePeerFinderDB(soci::session& session, int currentSchemaVersion, beast::Jour
             s.reserve(list.size());
             valence.reserve(list.size());
 
-            for (auto iter(list.cbegin()); iter != list.cend(); ++iter)
+            for (auto const& entry : list)
             {
-                s.emplace_back(to_string(iter->endpoint));
-                valence.emplace_back(iter->valence);
+                s.emplace_back(to_string(entry.endpoint));
+                valence.emplace_back(entry.valence);
             }
 
             session << "INSERT INTO PeerFinder_BootstrapCache_Next ( "
diff --git a/src/xrpld/core/detail/Config.cpp b/src/xrpld/core/detail/Config.cpp
index 07c780118a..0706163ab1 100644
--- a/src/xrpld/core/detail/Config.cpp
+++ b/src/xrpld/core/detail/Config.cpp
@@ -98,7 +98,7 @@ getMemorySize()
     std::int64_t ram = 0;
     size_t size = sizeof(ram);
 
-    if (sysctl(mib, 2, &ram, &size, NULL, 0) == 0)
+    if (sysctl(mib, 2, &ram, &size, nullptr, 0) == 0)
         return static_cast<std::uint64_t>(ram);
 
     return 0;
@@ -917,7 +917,7 @@ Config::loadFromString(std::string const& fileContents)
     if (getSingleSection(secConfig, Sections::kAmendmentMajorityTime, strTemp, j_))
     {
         using namespace std::chrono;
-        boost::regex const re("^\\s*(\\d+)\\s*(minutes|hours|days|weeks)\\s*(\\s+.*)?$");
+        boost::regex const re(R"(^\s*(\d+)\s*(minutes|hours|days|weeks)\s*(\s+.*)?$)");
         boost::smatch match;
         if (!boost::regex_match(strTemp, match, re))
         {
diff --git a/src/xrpld/peerfinder/detail/Bootcache.h b/src/xrpld/peerfinder/detail/Bootcache.h
index 5384bb356a..cee03fa322 100644
--- a/src/xrpld/peerfinder/detail/Bootcache.h
+++ b/src/xrpld/peerfinder/detail/Bootcache.h
@@ -3,7 +3,6 @@
 #include <xrpld/peerfinder/PeerfinderManager.h>
 #include <xrpld/peerfinder/detail/Store.h>
 
-#include <xrpl/basics/comparators.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/PropertyStream.h>
@@ -13,6 +12,8 @@
 #include <boost/bimap/unordered_set_of.hpp>
 #include <boost/iterator/transform_iterator.hpp>
 
+#include <functional>
+
 namespace xrpl::PeerFinder {
 
 /** Stores IP addresses useful for gaining initial connections.
@@ -62,11 +63,9 @@ private:
         int valence_;
     };
 
-    using left_t = boost::bimaps::unordered_set_of<
-        beast::IP::Endpoint,
-        boost::hash<beast::IP::Endpoint>,
-        xrpl::equal_to<beast::IP::Endpoint>>;
-    using right_t = boost::bimaps::multiset_of<Entry, xrpl::less<Entry>>;
+    using left_t = boost::bimaps::
+        unordered_set_of<beast::IP::Endpoint, boost::hash<beast::IP::Endpoint>, std::equal_to<>>;
+    using right_t = boost::bimaps::multiset_of<Entry, std::less<>>;
     using map_type = boost::bimap<left_t, right_t>;
     using value_type = map_type::value_type;
 
diff --git a/src/xrpld/peerfinder/detail/SourceStrings.cpp b/src/xrpld/peerfinder/detail/SourceStrings.cpp
index 61a3e0c021..7b28db4306 100644
--- a/src/xrpld/peerfinder/detail/SourceStrings.cpp
+++ b/src/xrpld/peerfinder/detail/SourceStrings.cpp
@@ -32,11 +32,11 @@ public:
     {
         results.addresses.resize(0);
         results.addresses.reserve(strings_.size());
-        for (int i = 0; i < strings_.size(); ++i)
+        for (auto const& str : strings_)
         {
-            beast::IP::Endpoint ep(beast::IP::Endpoint::fromString(strings_[i]));
+            beast::IP::Endpoint ep(beast::IP::Endpoint::fromString(str));
             if (isUnspecified(ep))
-                ep = beast::IP::Endpoint::fromString(strings_[i]);
+                ep = beast::IP::Endpoint::fromString(str);
             if (!isUnspecified(ep))
                 results.addresses.push_back(ep);
         }
diff --git a/src/xrpld/rpc/handlers/account/GatewayBalances.cpp b/src/xrpld/rpc/handlers/account/GatewayBalances.cpp
index bd1681172c..a6730c8e2b 100644
--- a/src/xrpld/rpc/handlers/account/GatewayBalances.cpp
+++ b/src/xrpld/rpc/handlers/account/GatewayBalances.cpp
@@ -106,8 +106,8 @@ doGatewayBalances(RPC::JsonContext& context)
         // null is treated as a valid 0-sized array of hotwallet
         if (hw.isArrayOrNull())
         {
-            for (unsigned i = 0; i < hw.size(); ++i)
-                valid &= addHotWallet(hw[i]);
+            for (auto const& wallet : hw)
+                valid &= addHotWallet(wallet);
         }
         else if (hw.isString())
         {
diff --git a/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp b/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
index c1c8712655..d2f596ed8e 100644
--- a/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
+++ b/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
@@ -40,8 +40,7 @@ namespace xrpl {
 
 using namespace boost::bimaps;
 // sorted descending by lastUpdateTime, ascending by AssetPrice
-using Prices =
-    bimap<multiset_of<std::uint32_t, std::greater<std::uint32_t>>, multiset_of<STAmount>>;
+using Prices = bimap<multiset_of<std::uint32_t, std::greater<>>, multiset_of<STAmount>>;
 
 /** Calls callback "f" on the ledger-object sle and up to three previous
  * metadata objects. Stops early if the callback returns true.

From bfde27160939aca474167ddff12308cdaa9fa370 Mon Sep 17 00:00:00 2001
From: Jingchen <a1q123456@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:22:02 +0100
Subject: [PATCH 048/100] chore: Fix unity build (#7730)

Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
---
 include/xrpl/basics/safe_cast.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/xrpl/basics/safe_cast.h b/include/xrpl/basics/safe_cast.h
index 483a783f5d..7f2b93a7eb 100644
--- a/include/xrpl/basics/safe_cast.h
+++ b/include/xrpl/basics/safe_cast.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include <xrpl/beast/utility/instrumentation.h>  // IWYU pragma: keep
+
 #include <type_traits>
 
 namespace xrpl {

From f59d5c08943b5a4c846a1abdc1383767890d32f0 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:22:11 +0100
Subject: [PATCH 049/100] chore: Enable most misc checks (#7663)

---
 .clang-tidy                             | 10 ----------
 include/xrpl/beast/core/LockFreeStack.h |  2 +-
 include/xrpl/beast/insight/Gauge.h      |  5 +++++
 include/xrpl/beast/utility/Zero.h       |  4 +---
 include/xrpl/protocol/STObject.h        |  5 +++++
 src/test/app/LedgerReplay_test.cpp      |  3 ++-
 src/test/basics/Number_test.cpp         |  1 +
 src/test/rpc/GetAggregatePrice_test.cpp |  5 +++--
 8 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index a79b565e59..5a1ba7c321 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -45,20 +45,10 @@ Checks: "-*,
   llvm-namespace-comment,
 
   misc-*,
-  -misc-anonymous-namespace-in-header,
-  -misc-confusable-identifiers,
-  -misc-coroutine-hostile-raii,
-  -misc-misleading-bidirectional,
-  -misc-misleading-identifier,
   -misc-multiple-inheritance,
-  -misc-new-delete-overloads,
   -misc-no-recursion,
-  -misc-non-copyable-objects,
   -misc-non-private-member-variables-in-classes,
   -misc-override-with-different-visibility,
-  -misc-predictable-rand,
-  -misc-unconventional-assign-operator,
-  -misc-uniqueptr-reset-release,
   -misc-unused-parameters,
   -misc-use-anonymous-namespace,
   -misc-use-internal-linkage,
diff --git a/include/xrpl/beast/core/LockFreeStack.h b/include/xrpl/beast/core/LockFreeStack.h
index 19225a4343..dd135d2d98 100644
--- a/include/xrpl/beast/core/LockFreeStack.h
+++ b/include/xrpl/beast/core/LockFreeStack.h
@@ -41,7 +41,7 @@ public:
     operator=(NodePtr node)
     {
         node_ = node;
-        return static_cast<LockFreeStackIterator&>(*this);
+        return *this;
     }
 
     LockFreeStackIterator&
diff --git a/include/xrpl/beast/insight/Gauge.h b/include/xrpl/beast/insight/Gauge.h
index b24c4366c3..9a23ea6665 100644
--- a/include/xrpl/beast/insight/Gauge.h
+++ b/include/xrpl/beast/insight/Gauge.h
@@ -49,6 +49,11 @@ public:
             impl_->set(value);
     }
 
+    // This is a write-through handle: assignment sets the value of the
+    // referenced metric.  It is const-qualified and returns Gauge const&
+    // (a non-const Gauge& would require a const_cast), so it does not follow
+    // the conventional assignment-operator signature.
+    // NOLINTNEXTLINE(misc-unconventional-assign-operator)
     Gauge const&
     operator=(value_type value) const
     {
diff --git a/include/xrpl/beast/utility/Zero.h b/include/xrpl/beast/utility/Zero.h
index f54345d437..e28589760b 100644
--- a/include/xrpl/beast/utility/Zero.h
+++ b/include/xrpl/beast/utility/Zero.h
@@ -26,9 +26,7 @@ struct Zero
     explicit Zero() = default;
 };
 
-namespace {
-constexpr Zero kZero{};
-}  // namespace
+inline constexpr Zero kZero{};
 
 /** Default implementation of signum calls the method on the class. */
 template <typename T>
diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index c96086b1d0..fe5c611648 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -555,7 +555,11 @@ public:
     ValueProxy&
     operator=(ValueProxy const&) = delete;
 
+    // Write-through proxy: assignment sets the referenced field to the given
+    // value, so it intentionally takes the assigned value rather than a
+    // ValueProxy.
     template <class U>
+    // NOLINTNEXTLINE(misc-unconventional-assign-operator)
     ValueProxy&
     operator=(U&& u)
         requires(std::is_assignable_v<T, U>);
@@ -800,6 +804,7 @@ STObject::Proxy<T>::assign(U&& u)
 
 template <class T>
 template <class U>
+// NOLINTNEXTLINE(misc-unconventional-assign-operator)
 STObject::ValueProxy<T>&
 STObject::ValueProxy<T>::operator=(U&& u)
     requires(std::is_assignable_v<T, U>)
diff --git a/src/test/app/LedgerReplay_test.cpp b/src/test/app/LedgerReplay_test.cpp
index bac1d8b61f..4cc83608d6 100644
--- a/src/test/app/LedgerReplay_test.cpp
+++ b/src/test/app/LedgerReplay_test.cpp
@@ -28,6 +28,7 @@
 
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/random.h>
 #include <xrpl/beast/net/IPAddress.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/unit_test/suite.h>
@@ -452,7 +453,7 @@ struct TestPeerSet : public PeerSet
             dropRate = 100;
         }
 
-        if (((rand() % 100) + 1) <= dropRate)
+        if (randInt(1, 100) <= dropRate)
             return;
 
         switch (type)
diff --git a/src/test/basics/Number_test.cpp b/src/test/basics/Number_test.cpp
index d704efa27a..9383fd6808 100644
--- a/src/test/basics/Number_test.cpp
+++ b/src/test/basics/Number_test.cpp
@@ -1094,6 +1094,7 @@ public:
         XRPAmount const xrp0{0};
         Number const n0 = xrp0;
         BEAST_EXPECT(n0 == Number{0});
+        // NOLINTNEXTLINE(misc-confusable-identifiers)
         XRPAmount const xrp1{n0};
         BEAST_EXPECT(xrp1 == xrp0);
     }
diff --git a/src/test/rpc/GetAggregatePrice_test.cpp b/src/test/rpc/GetAggregatePrice_test.cpp
index 22c021865d..3e0bfa1fd3 100644
--- a/src/test/rpc/GetAggregatePrice_test.cpp
+++ b/src/test/rpc/GetAggregatePrice_test.cpp
@@ -7,6 +7,7 @@
 
 #include <xrpl/basics/Number.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/random.h>
 #include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/ServiceRegistry.h>
@@ -16,7 +17,7 @@
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/jss.h>
 
-#include <cstdlib>
+#include <cstdint>
 #include <memory>
 #include <optional>
 #include <string>
@@ -173,7 +174,7 @@ public:
                 Oracle const oracle(
                     env,
                     {.owner = owner,
-                     .documentID = rand(),
+                     .documentID = randInt<std::uint32_t>(),
                      .series = {{"XRP", "USD", 740 + i, 1}, {"XRP", "EUR", 740, 1}},
                      .fee = baseFee});
                 oracles.emplace_back(owner, oracle.documentID());

From 7a153a2bcee4c41b8b20d9489ab5f17ee9419db9 Mon Sep 17 00:00:00 2001
From: Marek Foss <marek.foss@neti-soft.com>
Date: Mon, 6 Jul 2026 19:26:19 +0200
Subject: [PATCH 050/100] test: Migrate resource, shamap Beast tests to GTest
 (#7133)

Co-authored-by: Alex Kremer <akremer@ripple.com>
---
 .../scripts/levelization/results/ordering.txt |  10 +-
 src/test/resource/Logic_test.cpp              | 296 ------------
 src/test/shamap/SHAMapSync_test.cpp           | 177 --------
 src/test/shamap/SHAMap_test.cpp               | 427 ------------------
 src/tests/libxrpl/CMakeLists.txt              |   2 +
 src/tests/libxrpl/resource/Logic.cpp          | 241 ++++++++++
 src/tests/libxrpl/shamap/FetchPack.cpp        |  22 +
 src/tests/libxrpl/shamap/SHAMap.cpp           | 349 ++++++++++++++
 src/tests/libxrpl/shamap/SHAMapSync.cpp       | 170 +++++++
 src/{test => tests/libxrpl}/shamap/common.h   |  11 +-
 10 files changed, 792 insertions(+), 913 deletions(-)
 delete mode 100644 src/test/resource/Logic_test.cpp
 delete mode 100644 src/test/shamap/SHAMapSync_test.cpp
 delete mode 100644 src/test/shamap/SHAMap_test.cpp
 create mode 100644 src/tests/libxrpl/resource/Logic.cpp
 create mode 100644 src/tests/libxrpl/shamap/FetchPack.cpp
 create mode 100644 src/tests/libxrpl/shamap/SHAMap.cpp
 create mode 100644 src/tests/libxrpl/shamap/SHAMapSync.cpp
 rename src/{test => tests/libxrpl}/shamap/common.h (89%)

diff --git a/.github/scripts/levelization/results/ordering.txt b/.github/scripts/levelization/results/ordering.txt
index 5cc49dd2f5..9c9adeefe2 100644
--- a/.github/scripts/levelization/results/ordering.txt
+++ b/.github/scripts/levelization/results/ordering.txt
@@ -162,9 +162,6 @@ test.protocol > test.unit_test
 test.protocol > xrpl.basics
 test.protocol > xrpl.json
 test.protocol > xrpl.protocol
-test.resource > test.unit_test
-test.resource > xrpl.basics
-test.resource > xrpl.resource
 test.rpc > test.jtx
 test.rpc > xrpl.basics
 test.rpc > xrpl.config
@@ -188,12 +185,6 @@ test.server > xrpld.core
 test.server > xrpl.json
 test.server > xrpl.protocol
 test.server > xrpl.server
-test.shamap > test.unit_test
-test.shamap > xrpl.basics
-test.shamap > xrpl.config
-test.shamap > xrpl.nodestore
-test.shamap > xrpl.protocol
-test.shamap > xrpl.shamap
 test.unit_test > xrpl.basics
 test.unit_test > xrpl.protocol
 tests.libxrpl > xrpl.basics
@@ -205,6 +196,7 @@ tests.libxrpl > xrpl.net
 tests.libxrpl > xrpl.nodestore
 tests.libxrpl > xrpl.protocol
 tests.libxrpl > xrpl.protocol_autogen
+tests.libxrpl > xrpl.resource
 tests.libxrpl > xrpl.server
 tests.libxrpl > xrpl.shamap
 tests.libxrpl > xrpl.tx
diff --git a/src/test/resource/Logic_test.cpp b/src/test/resource/Logic_test.cpp
deleted file mode 100644
index 40a81503f1..0000000000
--- a/src/test/resource/Logic_test.cpp
+++ /dev/null
@@ -1,296 +0,0 @@
-#include <test/unit_test/SuiteJournal.h>
-
-#include <xrpl/basics/Log.h>
-#include <xrpl/basics/chrono.h>
-#include <xrpl/basics/random.h>
-#include <xrpl/beast/insight/NullCollector.h>
-#include <xrpl/beast/net/IPAddressV4.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/resource/Charge.h>
-#include <xrpl/resource/Consumer.h>
-#include <xrpl/resource/Disposition.h>
-#include <xrpl/resource/Gossip.h>
-#include <xrpl/resource/detail/Logic.h>
-#include <xrpl/resource/detail/Tuning.h>
-
-#include <boost/utility/base_from_member.hpp>
-
-#include <chrono>
-#include <cstdint>
-#include <functional>
-#include <string>
-
-namespace xrpl::Resource {
-
-class ResourceManager_test : public beast::unit_test::Suite
-{
-public:
-    class TestLogic : private boost::base_from_member<TestStopwatch>, public Logic
-
-    {
-    private:
-        using clock_type = boost::base_from_member<TestStopwatch>;
-
-    public:
-        explicit TestLogic(beast::Journal journal)
-            : Logic(beast::insight::NullCollector::make(), member, journal)
-        {
-        }
-
-        void
-        advance()
-        {
-            ++member;
-        }
-
-        TestStopwatch&
-        clock()
-        {
-            return member;
-        }
-    };
-
-    //--------------------------------------------------------------------------
-
-    static void
-    createGossip(Gossip& gossip)
-    {
-        std::uint8_t const v(10 + randInt(9));
-        std::uint8_t const n(10 + randInt(9));
-        gossip.items.reserve(n);
-        for (std::uint8_t i = 0; i < n; ++i)
-        {
-            Gossip::Item item;
-            item.balance = 100 + randInt(499);
-            beast::IP::AddressV4::bytes_type const d = {
-                {192, 0, 2, static_cast<std::uint8_t>(v + i)}};
-            item.address = beast::IP::Endpoint{beast::IP::AddressV4{d}};
-            gossip.items.push_back(item);
-        }
-    }
-
-    //--------------------------------------------------------------------------
-
-    void
-    testDrop(beast::Journal j, bool limited)
-    {
-        if (limited)
-        {
-            testcase("Limited warn/drop");
-        }
-        else
-        {
-            testcase("Unlimited warn/drop");
-        }
-
-        TestLogic logic(j);
-
-        Charge const fee(kDropThreshold + 1);
-        beast::IP::Endpoint const addr(beast::IP::Endpoint::fromString("192.0.2.2"));
-
-        std::function<Consumer(beast::IP::Endpoint)> const ep =
-            [&logic, limited](beast::IP::Endpoint const& address) {
-                return limited ? logic.newInboundEndpoint(address)
-                               : logic.newUnlimitedEndpoint(address);
-            };
-
-        {
-            Consumer c(ep(addr));
-
-            // Create load until we get a warning
-            int n = 10000;
-
-            while (--n >= 0)
-            {
-                if (n == 0)
-                {
-                    if (limited)
-                    {
-                        fail("Loop count exceeded without warning");
-                    }
-                    else
-                    {
-                        pass();
-                    }
-                    return;
-                }
-
-                if (c.charge(fee) == Disposition::Warn)
-                {
-                    if (limited)
-                    {
-                        pass();
-                    }
-                    else
-                    {
-                        fail("Should loop forever with no warning");
-                    }
-                    break;
-                }
-                ++logic.clock();
-            }
-
-            // Create load until we get dropped
-            while (--n >= 0)
-            {
-                if (n == 0)
-                {
-                    if (limited)
-                    {
-                        fail("Loop count exceeded without dropping");
-                    }
-                    else
-                    {
-                        pass();
-                    }
-                    return;
-                }
-
-                if (c.charge(fee) == Disposition::Drop)
-                {
-                    // Disconnect abusive Consumer
-                    BEAST_EXPECT(c.disconnect(j) == limited);
-                    break;
-                }
-                ++logic.clock();
-            }
-        }
-
-        // Make sure the consumer is on the blacklist for a while.
-        {
-            Consumer const c(logic.newInboundEndpoint(addr));
-            logic.periodicActivity();
-            if (c.disposition() != Disposition::Drop)
-            {
-                if (limited)
-                {
-                    fail("Dropped consumer not put on blacklist");
-                }
-                else
-                {
-                    pass();
-                }
-                return;
-            }
-        }
-
-        // Makes sure the Consumer is eventually removed from blacklist
-        bool readmitted = false;
-        {
-            using namespace std::chrono_literals;
-            // Give Consumer time to become readmitted.  Should never
-            // exceed expiration time.
-            auto n = kSecondsUntilExpiration + 1s;
-            while (--n > 0s)
-            {
-                ++logic.clock();
-                logic.periodicActivity();
-                Consumer const c(logic.newInboundEndpoint(addr));
-                if (c.disposition() != Disposition::Drop)
-                {
-                    readmitted = true;
-                    break;
-                }
-            }
-        }
-        if (!readmitted)
-        {
-            fail("Dropped Consumer left on blacklist too long");
-            return;
-        }
-        pass();
-    }
-
-    void
-    testImports(beast::Journal j)
-    {
-        testcase("Imports");
-
-        TestLogic logic(j);
-
-        Gossip g[5];
-
-        for (auto& gossip : g)
-            createGossip(gossip);
-
-        for (int i = 0; i < 5; ++i)
-            logic.importConsumers(std::to_string(i), g[i]);
-
-        pass();
-    }
-
-    void
-    testImport(beast::Journal j)
-    {
-        testcase("Import");
-
-        TestLogic logic(j);
-
-        Gossip g;
-        Gossip::Item item;
-        item.balance = 100;
-        beast::IP::AddressV4::bytes_type const d = {{192, 0, 2, 1}};
-        item.address = beast::IP::Endpoint{beast::IP::AddressV4{d}};
-        g.items.push_back(item);
-
-        logic.importConsumers("g", g);
-
-        pass();
-    }
-
-    void
-    testCharges(beast::Journal j)
-    {
-        testcase("Charge");
-
-        TestLogic logic(j);
-
-        {
-            beast::IP::Endpoint const address(beast::IP::Endpoint::fromString("192.0.2.1"));
-            Consumer c(logic.newInboundEndpoint(address));
-            Charge const fee(1000);
-            JLOG(j.info()) << "Charging " << c.toString() << " " << fee << " per second";
-            c.charge(fee);
-            for (int i = 0; i < 128; ++i)
-            {
-                JLOG(j.info()) << "Time= " << logic.clock().now().time_since_epoch().count()
-                               << ", Balance = " << c.balance();
-                logic.advance();
-            }
-        }
-
-        {
-            beast::IP::Endpoint const address(beast::IP::Endpoint::fromString("192.0.2.2"));
-            Consumer c(logic.newInboundEndpoint(address));
-            Charge const fee(1000);
-            JLOG(j.info()) << "Charging " << c.toString() << " " << fee << " per second";
-            for (int i = 0; i < 128; ++i)
-            {
-                c.charge(fee);
-                JLOG(j.info()) << "Time= " << logic.clock().now().time_since_epoch().count()
-                               << ", Balance = " << c.balance();
-                logic.advance();
-            }
-        }
-
-        pass();
-    }
-
-    void
-    run() override
-    {
-        using beast::Severity;
-        test::SuiteJournal journal("ResourceManager_test", *this);
-
-        testDrop(journal, true);
-        testDrop(journal, false);
-        testCharges(journal);
-        testImports(journal);
-        testImport(journal);
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(ResourceManager, resource, xrpl);
-
-}  // namespace xrpl::Resource
diff --git a/src/test/shamap/SHAMapSync_test.cpp b/src/test/shamap/SHAMapSync_test.cpp
deleted file mode 100644
index bb05ec56df..0000000000
--- a/src/test/shamap/SHAMapSync_test.cpp
+++ /dev/null
@@ -1,177 +0,0 @@
-#include <test/shamap/common.h>
-#include <test/unit_test/SuiteJournal.h>
-
-#include <xrpl/basics/Blob.h>
-#include <xrpl/basics/SHAMapHash.h>
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/random.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/beast/xor_shift_engine.h>
-#include <xrpl/protocol/Serializer.h>
-#include <xrpl/shamap/SHAMap.h>
-#include <xrpl/shamap/SHAMapItem.h>
-#include <xrpl/shamap/SHAMapMissingNode.h>
-#include <xrpl/shamap/SHAMapTreeNode.h>
-
-#include <boost/smart_ptr/intrusive_ptr.hpp>
-
-#include <chrono>
-#include <cstdint>
-#include <list>
-#include <ostream>
-#include <utility>
-#include <vector>
-
-namespace xrpl::tests {
-
-class SHAMapSync_test : public beast::unit_test::Suite
-{
-public:
-    beast::xor_shift_engine eng;
-
-    boost::intrusive_ptr<SHAMapItem>
-    makeRandomAS()
-    {
-        Serializer s;
-
-        for (int d = 0; d < 3; ++d)
-            s.add32(randInt<std::uint32_t>(eng));
-        return makeShamapitem(s.getSHA512Half(), s.slice());
-    }
-
-    bool
-    confuseMap(SHAMap& map, int count)
-    {
-        // add a bunch of random states to a map, then remove them
-        // map should be the same
-        SHAMapHash const beforeHash = map.getHash();
-
-        std::list<uint256> items;
-
-        for (int i = 0; i < count; ++i)
-        {
-            auto item = makeRandomAS();
-            items.push_back(item->key());
-
-            if (!map.addItem(SHAMapNodeType::TnAccountState, item))
-            {
-                log << "Unable to add item to map\n";
-                return false;
-            }
-        }
-
-        for (auto const& item : items)
-        {
-            if (!map.delItem(item))
-            {
-                log << "Unable to remove item from map\n";
-                return false;
-            }
-        }
-
-        if (beforeHash != map.getHash())
-        {
-            log << "Hashes do not match " << beforeHash << " " << map.getHash() << std::endl;
-            return false;
-        }
-
-        return true;
-    }
-
-    void
-    run() override
-    {
-        using beast::Severity;
-        test::SuiteJournal journal("SHAMapSync_test", *this);
-
-        TestNodeFamily f(journal), f2(journal);
-        SHAMap source(SHAMapType::FREE, f);
-        SHAMap destination(SHAMapType::FREE, f2);
-
-        int const items = 10000;
-        for (int i = 0; i < items; ++i)
-        {
-            source.addItem(SHAMapNodeType::TnAccountState, makeRandomAS());
-            if (i % 100 == 0)
-                source.invariants();
-        }
-
-        source.invariants();
-        BEAST_EXPECT(confuseMap(source, 500));
-        source.invariants();
-
-        source.setImmutable();
-
-        int count = 0;
-        source.visitLeaves([&count](auto const& item) { ++count; });
-        BEAST_EXPECT(count == items);
-
-        std::vector<SHAMapMissingNode> missingNodes;
-        source.walkMap(missingNodes, 2048);
-        BEAST_EXPECT(missingNodes.empty());
-
-        destination.setSynching();
-
-        {
-            std::vector<std::pair<SHAMapNodeID, Blob>> a;
-
-            BEAST_EXPECT(source.getNodeFat(SHAMapNodeID(), a, randBool(eng), randInt(eng, 2)));
-
-            unexpected(a.empty(), "NodeSize");
-
-            BEAST_EXPECT(destination.addRootNode(source.getHash(), makeSlice(a[0].second), nullptr)
-                             .isGood());
-        }
-
-        do
-        {
-            f.clock().advance(std::chrono::seconds(1));
-
-            // get the list of nodes we know we need
-            auto nodesMissing = destination.getMissingNodes(2048, nullptr);
-
-            if (nodesMissing.empty())
-                break;
-
-            // get as many nodes as possible based on this information
-            std::vector<std::pair<SHAMapNodeID, Blob>> b;
-
-            for (auto& it : nodesMissing)
-            {
-                // Don't use BEAST_EXPECT here b/c it will be called a
-                // non-deterministic number of times and the number of tests run
-                // should be deterministic
-                if (!source.getNodeFat(it.first, b, randBool(eng), randInt(eng, 2)))
-                    fail("", __FILE__, __LINE__);
-            }
-
-            // Don't use BEAST_EXPECT here b/c it will be called a
-            // non-deterministic number of times and the number of tests run
-            // should be deterministic
-            if (b.empty())
-                fail("", __FILE__, __LINE__);
-
-            for (auto& node : b)
-            {
-                // Don't use BEAST_EXPECT here b/c it will be called a
-                // non-deterministic number of times and the number of tests run
-                // should be deterministic
-                if (!destination.addKnownNode(node.first, makeSlice(node.second), nullptr)
-                         .isUseful())
-                    fail("", __FILE__, __LINE__);
-            }
-        } while (true);
-
-        destination.clearSynching();
-
-        BEAST_EXPECT(source.deepCompare(destination));
-
-        destination.invariants();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(SHAMapSync, shamap, xrpl);
-
-}  // namespace xrpl::tests
diff --git a/src/test/shamap/SHAMap_test.cpp b/src/test/shamap/SHAMap_test.cpp
deleted file mode 100644
index 5ff5ef5e05..0000000000
--- a/src/test/shamap/SHAMap_test.cpp
+++ /dev/null
@@ -1,427 +0,0 @@
-#include <test/shamap/common.h>
-#include <test/unit_test/SuiteJournal.h>
-
-#include <xrpl/basics/Blob.h>
-#include <xrpl/basics/Buffer.h>
-#include <xrpl/basics/SHAMapHash.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/beast/utility/Zero.h>
-#include <xrpl/shamap/SHAMap.h>
-#include <xrpl/shamap/SHAMapInnerNode.h>
-#include <xrpl/shamap/SHAMapItem.h>
-#include <xrpl/shamap/SHAMapLeafNode.h>
-#include <xrpl/shamap/SHAMapMissingNode.h>
-#include <xrpl/shamap/SHAMapTreeNode.h>
-
-#include <algorithm>
-#include <array>
-#include <cstdint>
-#include <memory>
-#include <type_traits>
-#include <utility>
-#include <vector>
-
-namespace xrpl::tests {
-
-#ifndef __INTELLISENSE__
-static_assert(std::is_nothrow_destructible<SHAMap>{});
-static_assert(!std::is_default_constructible<SHAMap>{});
-static_assert(!std::is_copy_constructible<SHAMap>{});
-static_assert(!std::is_copy_assignable<SHAMap>{});
-static_assert(!std::is_move_constructible<SHAMap>{});
-static_assert(!std::is_move_assignable<SHAMap>{});
-
-static_assert(std::is_nothrow_destructible<SHAMap::ConstIterator>{});
-static_assert(std::is_copy_constructible<SHAMap::ConstIterator>{});
-static_assert(std::is_copy_assignable<SHAMap::ConstIterator>{});
-static_assert(std::is_move_constructible<SHAMap::ConstIterator>{});
-static_assert(std::is_move_assignable<SHAMap::ConstIterator>{});
-
-static_assert(std::is_nothrow_destructible<SHAMapItem>{});
-static_assert(!std::is_default_constructible<SHAMapItem>{});
-static_assert(!std::is_copy_constructible<SHAMapItem>{});
-
-static_assert(std::is_nothrow_destructible<SHAMapNodeID>{});
-static_assert(std::is_default_constructible<SHAMapNodeID>{});
-static_assert(std::is_copy_constructible<SHAMapNodeID>{});
-static_assert(std::is_copy_assignable<SHAMapNodeID>{});
-static_assert(std::is_move_constructible<SHAMapNodeID>{});
-static_assert(std::is_move_assignable<SHAMapNodeID>{});
-
-static_assert(std::is_nothrow_destructible<SHAMapHash>{});
-static_assert(std::is_default_constructible<SHAMapHash>{});
-static_assert(std::is_copy_constructible<SHAMapHash>{});
-static_assert(std::is_copy_assignable<SHAMapHash>{});
-static_assert(std::is_move_constructible<SHAMapHash>{});
-static_assert(std::is_move_assignable<SHAMapHash>{});
-
-static_assert(std::is_nothrow_destructible<SHAMapTreeNode>{});
-static_assert(!std::is_default_constructible<SHAMapTreeNode>{});
-static_assert(!std::is_copy_constructible<SHAMapTreeNode>{});
-static_assert(!std::is_copy_assignable<SHAMapTreeNode>{});
-static_assert(!std::is_move_constructible<SHAMapTreeNode>{});
-static_assert(!std::is_move_assignable<SHAMapTreeNode>{});
-
-static_assert(std::is_nothrow_destructible<SHAMapInnerNode>{});
-static_assert(!std::is_default_constructible<SHAMapInnerNode>{});
-static_assert(!std::is_copy_constructible<SHAMapInnerNode>{});
-static_assert(!std::is_copy_assignable<SHAMapInnerNode>{});
-static_assert(!std::is_move_constructible<SHAMapInnerNode>{});
-static_assert(!std::is_move_assignable<SHAMapInnerNode>{});
-
-static_assert(std::is_nothrow_destructible<SHAMapLeafNode>{});
-static_assert(!std::is_default_constructible<SHAMapLeafNode>{});
-static_assert(!std::is_copy_constructible<SHAMapLeafNode>{});
-static_assert(!std::is_copy_assignable<SHAMapLeafNode>{});
-static_assert(!std::is_move_constructible<SHAMapLeafNode>{});
-static_assert(!std::is_move_assignable<SHAMapLeafNode>{});
-#endif
-
-inline bool
-operator==(SHAMapItem const& a, SHAMapItem const& b)
-{
-    return a.key() == b.key();
-}
-inline bool
-operator!=(SHAMapItem const& a, SHAMapItem const& b)
-{
-    return a.key() != b.key();
-}
-inline bool
-operator==(SHAMapItem const& a, uint256 const& b)
-{
-    return a.key() == b;
-}
-inline bool
-operator!=(SHAMapItem const& a, uint256 const& b)
-{
-    return a.key() != b;
-}
-
-class SHAMap_test : public beast::unit_test::Suite
-{
-public:
-    static Buffer
-    intToVuc(int v)
-    {
-        Buffer vuc(32);
-        std::fill_n(vuc.data(), vuc.size(), static_cast<std::uint8_t>(v));
-        return vuc;
-    }
-
-    void
-    run() override
-    {
-        using beast::Severity;
-        test::SuiteJournal journal("SHAMap_test", *this);
-
-        run(true, journal);
-        run(false, journal);
-    }
-
-    void
-    run(bool backed, beast::Journal const& journal)
-    {
-        if (backed)
-        {
-            testcase("add/traverse backed");
-        }
-        else
-        {
-            testcase("add/traverse unbacked");
-        }
-
-        tests::TestNodeFamily f(journal);
-
-        // h3 and h4 differ only in the leaf, same terminal node (level 19)
-        constexpr uint256 kH1("092891fe4ef6cee585fdc6fda0e09eb4d386363158ec3321b8123e5a772c6ca7");
-        constexpr uint256 kH2("436ccbac3347baa1f1e53baeef1f43334da88f1f6d70d963b833afd6dfa289fe");
-        constexpr uint256 kH3("b92891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8");
-        constexpr uint256 kH4("b92891fe4ef6cee585fdc6fda2e09eb4d386363158ec3321b8123e5a772c6ca8");
-        constexpr uint256 kH5("a92891fe4ef6cee585fdc6fda0e09eb4d386363158ec3321b8123e5a772c6ca7");
-
-        SHAMap sMap(SHAMapType::FREE, f);
-        sMap.invariants();
-        if (!backed)
-            sMap.setUnbacked();
-
-        auto i1 = makeShamapitem(kH1, intToVuc(1));
-        auto i2 = makeShamapitem(kH2, intToVuc(2));
-        auto i3 = makeShamapitem(kH3, intToVuc(3));
-        auto i4 = makeShamapitem(kH4, intToVuc(4));
-        auto i5 = makeShamapitem(kH5, intToVuc(5));
-
-        unexpected(!sMap.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(*i2)), "no add");
-        sMap.invariants();
-        unexpected(!sMap.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(*i1)), "no add");
-        sMap.invariants();
-
-        auto i = sMap.begin();
-        auto e = sMap.end();
-        unexpected(i == e || (*i != *i1), "bad traverse");
-        ++i;
-        unexpected(i == e || (*i != *i2), "bad traverse");
-        ++i;
-        unexpected(i != e, "bad traverse");
-        sMap.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(*i4));
-        sMap.invariants();
-        sMap.delItem(i2->key());
-        sMap.invariants();
-        sMap.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(*i3));
-        sMap.invariants();
-        i = sMap.begin();
-        e = sMap.end();
-        unexpected(i == e || (*i != *i1), "bad traverse");
-        ++i;
-        unexpected(i == e || (*i != *i3), "bad traverse");
-        ++i;
-        unexpected(i == e || (*i != *i4), "bad traverse");
-        ++i;
-        unexpected(i != e, "bad traverse");
-
-        if (backed)
-        {
-            testcase("snapshot backed");
-        }
-        else
-        {
-            testcase("snapshot unbacked");
-        }
-
-        SHAMapHash const mapHash = sMap.getHash();
-        std::shared_ptr<SHAMap> const map2 = sMap.snapShot(false);
-        map2->invariants();
-        unexpected(sMap.getHash() != mapHash, "bad snapshot");
-        unexpected(map2->getHash() != mapHash, "bad snapshot");
-
-        SHAMap::Delta delta;
-        BEAST_EXPECT(sMap.compare(*map2, delta, 100));
-        BEAST_EXPECT(delta.empty());
-
-        unexpected(!sMap.delItem(sMap.begin()->key()), "bad mod");
-        sMap.invariants();
-        unexpected(sMap.getHash() == mapHash, "bad snapshot");
-        unexpected(map2->getHash() != mapHash, "bad snapshot");
-
-        BEAST_EXPECT(sMap.compare(*map2, delta, 100));
-        BEAST_EXPECT(delta.size() == 1);
-        BEAST_EXPECT(delta.begin()->first == kH1);
-        BEAST_EXPECT(delta.begin()->second.first == nullptr);
-        BEAST_EXPECT(delta.begin()->second.second->key() == kH1);
-
-        sMap.dump();
-
-        if (backed)
-        {
-            testcase("build/tear backed");
-        }
-        else
-        {
-            testcase("build/tear unbacked");
-        }
-        {
-            static constexpr std::array keys{
-                uint256(
-                    "b92891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b92881fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b92691fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b92791fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b91891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b99891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "f22891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "292891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8")};
-
-            static constexpr std::array kHashes{
-                uint256(
-                    "B7387CFEA0465759ADC718E8C42B52D2309D179B326E239EB5075C"
-                    "64B6281F7F"),
-                uint256(
-                    "FBC195A9592A54AB44010274163CB6BA95F497EC5BA0A883184546"
-                    "7FB2ECE266"),
-                uint256(
-                    "4E7D2684B65DFD48937FFB775E20175C43AF0C94066F7D5679F51A"
-                    "E756795B75"),
-                uint256(
-                    "7A2F312EB203695FFD164E038E281839EEF06A1B99BFC263F3CECC"
-                    "6C74F93E07"),
-                uint256(
-                    "395A6691A372387A703FB0F2C6D2C405DAF307D0817F8F0E207596"
-                    "462B0E3A3E"),
-                uint256(
-                    "D044C0A696DE3169CC70AE216A1564D69DE96582865796142CE7D9"
-                    "8A84D9DDE4"),
-                uint256(
-                    "76DCC77C4027309B5A91AD164083264D70B77B5E43E08AEDA5EBF9"
-                    "4361143615"),
-                uint256(
-                    "DF4220E93ADC6F5569063A01B4DC79F8DB9553B6A3222ADE23DEA0"
-                    "2BBE7230E5")};
-
-            SHAMap map(SHAMapType::FREE, f);
-            if (!backed)
-                map.setUnbacked();
-
-            BEAST_EXPECT(map.getHash() == beast::kZero);
-            for (int k = 0; k < keys.size(); ++k)
-            {
-                BEAST_EXPECT(map.addItem(
-                    SHAMapNodeType::TnTransactionNm, makeShamapitem(keys[k], intToVuc(k))));
-                BEAST_EXPECT(map.getHash().asUInt256() == kHashes[k]);
-                map.invariants();
-            }
-            for (int k = keys.size() - 1; k >= 0; --k)
-            {
-                BEAST_EXPECT(map.getHash().asUInt256() == kHashes[k]);
-                BEAST_EXPECT(map.delItem(keys[k]));
-                map.invariants();
-            }
-            BEAST_EXPECT(map.getHash() == beast::kZero);
-        }
-
-        if (backed)
-        {
-            testcase("iterate backed");
-        }
-        else
-        {
-            testcase("iterate unbacked");
-        }
-
-        {
-            static constexpr std::array keys{
-                uint256(
-                    "f22891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b99891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b92891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b92881fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b92791fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b92691fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "b91891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8"),
-                uint256(
-                    "292891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e"
-                    "5a772c6ca8")};
-
-            tests::TestNodeFamily tf{journal};
-            SHAMap map{SHAMapType::FREE, tf};
-            if (!backed)
-                map.setUnbacked();
-            for (auto const& k : keys)
-            {
-                map.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(k, intToVuc(0)));
-                map.invariants();
-            }
-
-            int h = 7;
-            for (auto const& k : map)
-            {
-                BEAST_EXPECT(k.key() == keys[h]);
-                --h;
-            }
-        }
-    }
-};
-
-class SHAMapPathProof_test : public beast::unit_test::Suite
-{
-    void
-    run() override
-    {
-        test::SuiteJournal journal("SHAMapPathProof_test", *this);
-
-        tests::TestNodeFamily tf{journal};
-        SHAMap map{SHAMapType::FREE, tf};
-        map.setUnbacked();
-
-        uint256 key;
-        uint256 rootHash;
-        std::vector<Blob> goodPath;
-
-        for (unsigned char c = 1; c < 100; ++c)
-        {
-            uint256 k(c);
-            map.addItem(
-                SHAMapNodeType::TnAccountState, makeShamapitem(k, Slice{k.data(), k.size()}));
-            map.invariants();
-
-            auto root = map.getHash().asUInt256();
-            auto path = map.getProofPath(k);
-            BEAST_EXPECT(path);
-            if (!path)
-                break;
-            BEAST_EXPECT(map.verifyProofPath(root, k, *path));
-            if (c == 1)
-            {
-                // extra node
-                path->insert(path->begin(), path->front());
-                BEAST_EXPECT(!map.verifyProofPath(root, k, *path));
-                // wrong key
-                uint256 const wrongKey(c + 1);
-                BEAST_EXPECT(!map.getProofPath(wrongKey));
-            }
-            if (c == 99)
-            {
-                key = k;
-                rootHash = root;
-                goodPath = std::move(*path);
-            }
-        }
-
-        // still good
-        BEAST_EXPECT(map.verifyProofPath(rootHash, key, goodPath));
-        // empty path
-        std::vector<Blob> badPath;
-        BEAST_EXPECT(!map.verifyProofPath(rootHash, key, badPath));
-        // too long
-        badPath = goodPath;
-        badPath.push_back(goodPath.back());
-        BEAST_EXPECT(!map.verifyProofPath(rootHash, key, badPath));
-        // bad node
-        badPath.clear();
-        badPath.emplace_back(100, 100);
-        BEAST_EXPECT(!map.verifyProofPath(rootHash, key, badPath));
-        // bad node type
-        badPath.clear();
-        badPath.push_back(goodPath.front());
-        badPath.front().back()--;  // change node type
-        BEAST_EXPECT(!map.verifyProofPath(rootHash, key, badPath));
-        // all inner
-        badPath.clear();
-        badPath = goodPath;
-        badPath.erase(badPath.begin());
-        BEAST_EXPECT(!map.verifyProofPath(rootHash, key, badPath));
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(SHAMap, shamap, xrpl);
-BEAST_DEFINE_TESTSUITE(SHAMapPathProof, shamap, xrpl);
-}  // namespace xrpl::tests
diff --git a/src/tests/libxrpl/CMakeLists.txt b/src/tests/libxrpl/CMakeLists.txt
index df483a36d8..cafe72eff9 100644
--- a/src/tests/libxrpl/CMakeLists.txt
+++ b/src/tests/libxrpl/CMakeLists.txt
@@ -29,6 +29,8 @@ set(test_modules
     basics
     crypto
     json
+    resource
+    shamap
     tx
     protocol_autogen
 )
diff --git a/src/tests/libxrpl/resource/Logic.cpp b/src/tests/libxrpl/resource/Logic.cpp
new file mode 100644
index 0000000000..1f935ebf4b
--- /dev/null
+++ b/src/tests/libxrpl/resource/Logic.cpp
@@ -0,0 +1,241 @@
+#include <xrpl/resource/detail/Logic.h>
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/random.h>
+#include <xrpl/beast/insight/NullCollector.h>
+#include <xrpl/beast/net/IPAddressV4.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/resource/Charge.h>
+#include <xrpl/resource/Consumer.h>
+#include <xrpl/resource/Disposition.h>
+#include <xrpl/resource/Gossip.h>
+#include <xrpl/resource/detail/Tuning.h>
+
+#include <boost/utility/base_from_member.hpp>
+
+#include <gtest/gtest.h>
+#include <helpers/TestSink.h>
+
+#include <chrono>
+#include <cstdint>
+#include <string>
+
+namespace xrpl::Resource {
+
+class ResourceManagerTest : public ::testing::Test
+{
+protected:
+    beast::Journal const j_{TestSink::instance()};
+
+    class TestLogic : private boost::base_from_member<TestStopwatch>, public Logic
+    {
+    private:
+        using clock_type = boost::base_from_member<TestStopwatch>;
+
+    public:
+        explicit TestLogic(beast::Journal journal)
+            : Logic(beast::insight::NullCollector::make(), member, journal)
+        {
+        }
+
+        void
+        advance()
+        {
+            ++member;
+        }
+
+        TestStopwatch&
+        clock()
+        {
+            return member;
+        }
+    };
+
+    //--------------------------------------------------------------------------
+
+    static void
+    populateGossip(Gossip& gossip)
+    {
+        std::uint8_t const v(10 + randInt(9));
+        std::uint8_t const n(10 + randInt(9));
+        gossip.items.reserve(n);
+        for (std::uint8_t i = 0; i < n; ++i)
+        {
+            Gossip::Item item;
+            item.balance = 100 + randInt(499);
+            beast::IP::AddressV4::bytes_type const d = {{
+                192,
+                0,
+                2,
+                static_cast<std::uint8_t>(v + i),
+            }};
+            item.address = beast::IP::Endpoint{beast::IP::AddressV4{d}};
+            gossip.items.push_back(item);
+        }
+    }
+};
+
+TEST_F(ResourceManagerTest, limited_warn_drop)
+{
+    TestLogic logic{j_};
+
+    Charge const fee{kDropThreshold + 1};
+    beast::IP::Endpoint const addr{beast::IP::Endpoint::fromString("192.0.2.2")};
+
+    {
+        Consumer c{logic.newInboundEndpoint(addr)};
+
+        // Create load until we get a warning
+        int n = 10000;
+        bool warned = false;
+
+        while (--n >= 0)
+        {
+            if (c.charge(fee) == Disposition::Warn)
+            {
+                warned = true;
+                break;
+            }
+            ++logic.clock();
+        }
+
+        ASSERT_TRUE(warned) << "Loop count exceeded without warning";
+
+        // Create load until we get dropped
+        bool dropped = false;
+        while (--n >= 0)
+        {
+            if (c.charge(fee) == Disposition::Drop)
+            {
+                dropped = true;
+                // Disconnect abusive Consumer
+                EXPECT_TRUE(c.disconnect(j_));
+                break;
+            }
+            ++logic.clock();
+        }
+
+        ASSERT_TRUE(dropped) << "Loop count exceeded without dropping";
+    }
+
+    // Make sure the consumer is on the blacklist for a while.
+    {
+        Consumer const c{logic.newInboundEndpoint(addr)};
+        logic.periodicActivity();
+        EXPECT_EQ(c.disposition(), Disposition::Drop) << "Dropped consumer not put on blacklist";
+    }
+
+    // Makes sure the Consumer is eventually removed from blacklist
+    bool readmitted = false;
+    {
+        using namespace std::chrono_literals;
+        // Give Consumer time to become readmitted.  Should never
+        // exceed expiration time.
+        auto n = kSecondsUntilExpiration + 1s;
+        while (--n > 0s)
+        {
+            ++logic.clock();
+            logic.periodicActivity();
+            Consumer const c{logic.newInboundEndpoint(addr)};
+            if (c.disposition() != Disposition::Drop)
+            {
+                readmitted = true;
+                break;
+            }
+        }
+    }
+    EXPECT_TRUE(readmitted) << "Dropped Consumer left on blacklist too long";
+}
+
+TEST_F(ResourceManagerTest, unlimited_warn_drop)
+{
+    TestLogic logic{j_};
+
+    Charge const fee{kDropThreshold + 1};
+    beast::IP::Endpoint const addr{beast::IP::Endpoint::fromString("192.0.2.2")};
+    Consumer c{logic.newUnlimitedEndpoint(addr)};
+
+    // Create load until we get a warning
+    int n = 10000;
+    bool warned = false;
+
+    while (--n >= 0)
+    {
+        if (c.charge(fee) == Disposition::Warn)
+        {
+            warned = true;
+            break;
+        }
+        ++logic.clock();
+    }
+
+    EXPECT_FALSE(warned) << "Should loop forever with no warning";
+}
+
+TEST_F(ResourceManagerTest, charges)
+{
+    TestLogic logic{j_};
+
+    {
+        beast::IP::Endpoint const address{beast::IP::Endpoint::fromString("192.0.2.1")};
+        Consumer c{logic.newInboundEndpoint(address)};
+        Charge const fee{1000};
+        JLOG(j_.info()) << "Charging " << c.toString() << " " << fee << " per second";
+        c.charge(fee);
+        for (int i = 0; i < 128; ++i)
+        {
+            JLOG(j_.info()) << "Time= " << logic.clock().now().time_since_epoch().count()
+                            << ", Balance = " << c.balance();
+            logic.advance();
+        }
+    }
+
+    {
+        beast::IP::Endpoint const address{beast::IP::Endpoint::fromString("192.0.2.2")};
+        Consumer c{logic.newInboundEndpoint(address)};
+        Charge const fee{1000};
+        JLOG(j_.info()) << "Charging " << c.toString() << " " << fee << " per second";
+        for (int i = 0; i < 128; ++i)
+        {
+            c.charge(fee);
+            JLOG(j_.info()) << "Time= " << logic.clock().now().time_since_epoch().count()
+                            << ", Balance = " << c.balance();
+            logic.advance();
+        }
+    }
+}
+
+TEST_F(ResourceManagerTest, imports)
+{
+    TestLogic logic{j_};
+
+    Gossip g[5];
+
+    for (auto& i : g)
+        populateGossip(i);
+
+    for (int i = 0; i < 5; ++i)
+        logic.importConsumers(std::to_string(i), g[i]);
+}
+
+TEST_F(ResourceManagerTest, import)
+{
+    TestLogic logic{j_};
+
+    Gossip g;
+    Gossip::Item item;
+    item.balance = 100;
+    beast::IP::AddressV4::bytes_type const d = {{
+        192,
+        0,
+        2,
+        1,
+    }};
+    item.address = beast::IP::Endpoint{beast::IP::AddressV4{d}};
+    g.items.push_back(item);
+
+    logic.importConsumers("g", g);
+}
+
+}  // namespace xrpl::Resource
diff --git a/src/tests/libxrpl/shamap/FetchPack.cpp b/src/tests/libxrpl/shamap/FetchPack.cpp
new file mode 100644
index 0000000000..05854d482f
--- /dev/null
+++ b/src/tests/libxrpl/shamap/FetchPack.cpp
@@ -0,0 +1,22 @@
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/shamap/SHAMap.h>
+#include <xrpl/shamap/SHAMapMissingNode.h>
+
+#include <gtest/gtest.h>
+#include <helpers/TestSink.h>
+#include <shamap/common.h>
+
+#include <memory>
+
+namespace xrpl::tests {
+
+TEST(FetchPackTest, construct_table)
+{
+    beast::Journal const j{TestSink::instance()};
+    TestNodeFamily f{j};
+    std::shared_ptr<SHAMap> const t1{std::make_shared<SHAMap>(SHAMapType::FREE, f)};
+
+    EXPECT_NE(t1, nullptr);
+}
+
+}  // namespace xrpl::tests
diff --git a/src/tests/libxrpl/shamap/SHAMap.cpp b/src/tests/libxrpl/shamap/SHAMap.cpp
new file mode 100644
index 0000000000..238c34bf9c
--- /dev/null
+++ b/src/tests/libxrpl/shamap/SHAMap.cpp
@@ -0,0 +1,349 @@
+#include <xrpl/shamap/SHAMap.h>
+
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/Buffer.h>
+#include <xrpl/basics/SHAMapHash.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/shamap/SHAMapInnerNode.h>
+#include <xrpl/shamap/SHAMapItem.h>
+#include <xrpl/shamap/SHAMapLeafNode.h>
+#include <xrpl/shamap/SHAMapMissingNode.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <gtest/gtest.h>
+#include <helpers/TestSink.h>
+#include <shamap/common.h>
+
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+namespace xrpl::tests {
+
+#ifndef __INTELLISENSE__
+static_assert(std::is_nothrow_destructible<SHAMap>{});
+static_assert(!std::is_default_constructible<SHAMap>{});
+static_assert(!std::is_copy_constructible<SHAMap>{});
+static_assert(!std::is_copy_assignable<SHAMap>{});
+static_assert(!std::is_move_constructible<SHAMap>{});
+static_assert(!std::is_move_assignable<SHAMap>{});
+
+static_assert(std::is_nothrow_destructible<SHAMap::ConstIterator>{});
+static_assert(std::is_copy_constructible<SHAMap::ConstIterator>{});
+static_assert(std::is_copy_assignable<SHAMap::ConstIterator>{});
+static_assert(std::is_move_constructible<SHAMap::ConstIterator>{});
+static_assert(std::is_move_assignable<SHAMap::ConstIterator>{});
+
+static_assert(std::is_nothrow_destructible<SHAMapItem>{});
+static_assert(!std::is_default_constructible<SHAMapItem>{});
+static_assert(!std::is_copy_constructible<SHAMapItem>{});
+
+static_assert(std::is_nothrow_destructible<SHAMapNodeID>{});
+static_assert(std::is_default_constructible<SHAMapNodeID>{});
+static_assert(std::is_copy_constructible<SHAMapNodeID>{});
+static_assert(std::is_copy_assignable<SHAMapNodeID>{});
+static_assert(std::is_move_constructible<SHAMapNodeID>{});
+static_assert(std::is_move_assignable<SHAMapNodeID>{});
+
+static_assert(std::is_nothrow_destructible<SHAMapHash>{});
+static_assert(std::is_default_constructible<SHAMapHash>{});
+static_assert(std::is_copy_constructible<SHAMapHash>{});
+static_assert(std::is_copy_assignable<SHAMapHash>{});
+static_assert(std::is_move_constructible<SHAMapHash>{});
+static_assert(std::is_move_assignable<SHAMapHash>{});
+
+static_assert(std::is_nothrow_destructible<SHAMapTreeNode>{});
+static_assert(!std::is_default_constructible<SHAMapTreeNode>{});
+static_assert(!std::is_copy_constructible<SHAMapTreeNode>{});
+static_assert(!std::is_copy_assignable<SHAMapTreeNode>{});
+static_assert(!std::is_move_constructible<SHAMapTreeNode>{});
+static_assert(!std::is_move_assignable<SHAMapTreeNode>{});
+
+static_assert(std::is_nothrow_destructible<SHAMapInnerNode>{});
+static_assert(!std::is_default_constructible<SHAMapInnerNode>{});
+static_assert(!std::is_copy_constructible<SHAMapInnerNode>{});
+static_assert(!std::is_copy_assignable<SHAMapInnerNode>{});
+static_assert(!std::is_move_constructible<SHAMapInnerNode>{});
+static_assert(!std::is_move_assignable<SHAMapInnerNode>{});
+
+static_assert(std::is_nothrow_destructible<SHAMapLeafNode>{});
+static_assert(!std::is_default_constructible<SHAMapLeafNode>{});
+static_assert(!std::is_copy_constructible<SHAMapLeafNode>{});
+static_assert(!std::is_copy_assignable<SHAMapLeafNode>{});
+static_assert(!std::is_move_constructible<SHAMapLeafNode>{});
+static_assert(!std::is_move_assignable<SHAMapLeafNode>{});
+#endif
+
+inline bool
+operator!=(SHAMapItem const& a, SHAMapItem const& b)
+{
+    return a.key() != b.key();
+}
+
+struct SHAMapBackingMode
+{
+    bool backed;
+    std::string_view testName;
+};
+
+constexpr SHAMapBackingMode kBackedMode{.backed = true, .testName = "backed"};
+constexpr SHAMapBackingMode kUnbackedMode{.backed = false, .testName = "unbacked"};
+
+std::string
+shamapBackingModeName(::testing::TestParamInfo<SHAMapBackingMode> const& info)
+{
+    return std::string{info.param.testName};
+}
+
+class SHAMapTest : public ::testing::TestWithParam<SHAMapBackingMode>
+{
+protected:
+    beast::Journal const j_{TestSink::instance()};
+
+    static Buffer
+    intToVuc(std::uint8_t v)
+    {
+        Buffer vuc{32};
+        std::fill_n(vuc.data(), vuc.size(), v);
+        return vuc;
+    }
+};
+
+TEST_P(SHAMapTest, add_traverse_snapshot_build_tear_and_iterate)
+{
+    auto const testMode = GetParam();
+    tests::TestNodeFamily f{j_};
+
+    // kH3 and kH4 differ only in the leaf, same terminal node (level 19)
+    constexpr uint256 kH1("092891fe4ef6cee585fdc6fda0e09eb4d386363158ec3321b8123e5a772c6ca7");
+    constexpr uint256 kH2("436ccbac3347baa1f1e53baeef1f43334da88f1f6d70d963b833afd6dfa289fe");
+    constexpr uint256 kH3("b92891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8");
+    constexpr uint256 kH4("b92891fe4ef6cee585fdc6fda2e09eb4d386363158ec3321b8123e5a772c6ca8");
+
+    SHAMap sMap{SHAMapType::FREE, f};
+    sMap.invariants();
+    if (!testMode.backed)
+        sMap.setUnbacked();
+
+    auto i1 = makeShamapitem(kH1, intToVuc(1));
+    auto i2 = makeShamapitem(kH2, intToVuc(2));
+    auto i3 = makeShamapitem(kH3, intToVuc(3));
+    auto i4 = makeShamapitem(kH4, intToVuc(4));
+
+    EXPECT_TRUE(sMap.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(*i2))) << "no add";
+    sMap.invariants();
+    EXPECT_TRUE(sMap.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(*i1))) << "no add";
+    sMap.invariants();
+
+    auto i = sMap.begin();
+    auto e = sMap.end();
+    EXPECT_FALSE(i == e || (*i != *i1)) << "bad traverse";
+    ++i;
+    EXPECT_FALSE(i == e || (*i != *i2)) << "bad traverse";
+    ++i;
+    EXPECT_EQ(i, e) << "bad traverse";
+    sMap.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(*i4));
+    sMap.invariants();
+    sMap.delItem(i2->key());
+    sMap.invariants();
+    sMap.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(*i3));
+    sMap.invariants();
+    i = sMap.begin();
+    e = sMap.end();
+    EXPECT_FALSE(i == e || (*i != *i1)) << "bad traverse";
+    ++i;
+    EXPECT_FALSE(i == e || (*i != *i3)) << "bad traverse";
+    ++i;
+    EXPECT_FALSE(i == e || (*i != *i4)) << "bad traverse";
+    ++i;
+    EXPECT_EQ(i, e) << "bad traverse";
+
+    SHAMapHash const mapHash = sMap.getHash();
+    std::shared_ptr<SHAMap> const map2 = sMap.snapShot(false);
+    map2->invariants();
+    EXPECT_EQ(sMap.getHash(), mapHash) << "bad snapshot";
+    EXPECT_EQ(map2->getHash(), mapHash) << "bad snapshot";
+
+    SHAMap::Delta delta;
+    ASSERT_TRUE(sMap.compare(*map2, delta, 100));
+    EXPECT_TRUE(delta.empty());
+
+    EXPECT_TRUE(sMap.delItem(sMap.begin()->key())) << "bad mod";
+    sMap.invariants();
+    EXPECT_NE(sMap.getHash(), mapHash) << "bad snapshot";
+    EXPECT_EQ(map2->getHash(), mapHash) << "bad snapshot";
+
+    ASSERT_TRUE(sMap.compare(*map2, delta, 100));
+    ASSERT_EQ(delta.size(), 1);
+    EXPECT_EQ(delta.begin()->first, kH1);
+    EXPECT_EQ(delta.begin()->second.first, nullptr);
+    ASSERT_NE(delta.begin()->second.second, nullptr);
+    EXPECT_EQ(delta.begin()->second.second->key(), kH1);
+
+    sMap.dump();
+    {
+        constexpr std::array kKeys{
+            uint256{"b92891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b92881fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b92691fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b92791fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b91891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b99891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"f22891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"292891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+        };
+
+        constexpr std::array kHashes{
+            uint256{"B7387CFEA0465759ADC718E8C42B52D2309D179B326E239EB5075C64B6281F7F"},
+            uint256{"FBC195A9592A54AB44010274163CB6BA95F497EC5BA0A8831845467FB2ECE266"},
+            uint256{"4E7D2684B65DFD48937FFB775E20175C43AF0C94066F7D5679F51AE756795B75"},
+            uint256{"7A2F312EB203695FFD164E038E281839EEF06A1B99BFC263F3CECC6C74F93E07"},
+            uint256{"395A6691A372387A703FB0F2C6D2C405DAF307D0817F8F0E207596462B0E3A3E"},
+            uint256{"D044C0A696DE3169CC70AE216A1564D69DE96582865796142CE7D98A84D9DDE4"},
+            uint256{"76DCC77C4027309B5A91AD164083264D70B77B5E43E08AEDA5EBF94361143615"},
+            uint256{"DF4220E93ADC6F5569063A01B4DC79F8DB9553B6A3222ADE23DEA02BBE7230E5"},
+        };
+
+        SHAMap map{SHAMapType::FREE, f};
+        if (!testMode.backed)
+            map.setUnbacked();
+
+        EXPECT_EQ(map.getHash(), beast::kZero);
+        for (std::size_t k = 0; k < kKeys.size(); ++k)
+        {
+            EXPECT_TRUE(map.addItem(
+                SHAMapNodeType::TnTransactionNm,
+                makeShamapitem(kKeys[k], intToVuc(static_cast<std::uint8_t>(k)))));
+            EXPECT_EQ(map.getHash().asUInt256(), kHashes[k]);
+            map.invariants();
+        }
+        for (std::size_t k = kKeys.size(); k-- > 0;)
+        {
+            EXPECT_EQ(map.getHash().asUInt256(), kHashes[k]);
+            EXPECT_TRUE(map.delItem(kKeys[k]));
+            map.invariants();
+        }
+        EXPECT_EQ(map.getHash(), beast::kZero);
+    }
+
+    {
+        constexpr std::array kKeys{
+            uint256{"f22891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b99891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b92891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b92881fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b92791fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b92691fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"b91891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+            uint256{"292891fe4ef6cee585fdc6fda1e09eb4d386363158ec3321b8123e5a772c6ca8"},
+        };
+
+        tests::TestNodeFamily tf{j_};
+        SHAMap map{SHAMapType::FREE, tf};
+        if (!testMode.backed)
+            map.setUnbacked();
+        for (auto const& k : kKeys)
+        {
+            map.addItem(SHAMapNodeType::TnTransactionNm, makeShamapitem(k, intToVuc(0)));
+            map.invariants();
+        }
+
+        int h = 7;
+        for (auto const& k : map)
+        {
+            EXPECT_EQ(k.key(), kKeys[h]);
+            --h;
+        }
+    }
+}
+
+INSTANTIATE_TEST_SUITE_P(
+    BackingMode,
+    SHAMapTest,
+    ::testing::Values(kBackedMode, kUnbackedMode),
+    shamapBackingModeName);
+
+class SHAMapPathProof : public ::testing::Test
+{
+protected:
+    beast::Journal const j_{TestSink::instance()};
+};
+
+TEST_F(SHAMapPathProof, verify_proof_path)
+{
+    tests::TestNodeFamily tf{j_};
+    SHAMap map{SHAMapType::FREE, tf};
+    map.setUnbacked();
+
+    uint256 key;
+    uint256 rootHash;
+    std::vector<Blob> goodPath;
+
+    for (unsigned char c = 1; c < 100; ++c)
+    {
+        uint256 k(c);
+        map.addItem(SHAMapNodeType::TnAccountState, makeShamapitem(k, Slice{k.data(), k.size()}));
+        map.invariants();
+
+        auto root = map.getHash().asUInt256();
+        auto path = map.getProofPath(k);
+        if (!path)
+        {
+            ADD_FAILURE() << "Missing proof path";
+            return;
+        }
+        auto& proofPath = *path;
+
+        EXPECT_TRUE(map.verifyProofPath(root, k, proofPath));
+        if (c == 1)
+        {
+            // extra node
+            proofPath.insert(proofPath.begin(), proofPath.front());
+            EXPECT_FALSE(map.verifyProofPath(root, k, proofPath));
+            // wrong key
+            uint256 const wrongKey(c + 1);
+            EXPECT_FALSE(map.getProofPath(wrongKey));
+        }
+        if (c == 99)
+        {
+            key = k;
+            rootHash = root;
+            goodPath = std::move(proofPath);
+        }
+    }
+
+    // still good
+    EXPECT_TRUE(map.verifyProofPath(rootHash, key, goodPath));
+    // empty path
+    std::vector<Blob> badPath;
+    EXPECT_FALSE(map.verifyProofPath(rootHash, key, badPath));
+    // too long
+    badPath = goodPath;
+    badPath.push_back(goodPath.back());
+    EXPECT_FALSE(map.verifyProofPath(rootHash, key, badPath));
+    // bad node
+    badPath.clear();
+    badPath.emplace_back(100, 100);
+    EXPECT_FALSE(map.verifyProofPath(rootHash, key, badPath));
+    // bad node type
+    badPath.clear();
+    badPath.push_back(goodPath.front());
+    badPath.front().back()--;  // change node type
+    EXPECT_FALSE(map.verifyProofPath(rootHash, key, badPath));
+    // all inner
+    badPath.clear();
+    badPath = goodPath;
+    badPath.erase(badPath.begin());
+    EXPECT_FALSE(map.verifyProofPath(rootHash, key, badPath));
+}
+
+}  // namespace xrpl::tests
diff --git a/src/tests/libxrpl/shamap/SHAMapSync.cpp b/src/tests/libxrpl/shamap/SHAMapSync.cpp
new file mode 100644
index 0000000000..5cefbae8a1
--- /dev/null
+++ b/src/tests/libxrpl/shamap/SHAMapSync.cpp
@@ -0,0 +1,170 @@
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/SHAMapHash.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/random.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/xor_shift_engine.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/shamap/SHAMap.h>
+#include <xrpl/shamap/SHAMapItem.h>
+#include <xrpl/shamap/SHAMapMissingNode.h>
+#include <xrpl/shamap/SHAMapTreeNode.h>
+
+#include <boost/smart_ptr/intrusive_ptr.hpp>
+
+#include <gtest/gtest.h>
+#include <helpers/TestSink.h>
+#include <shamap/common.h>
+
+#include <chrono>
+#include <cstdint>
+#include <list>
+#include <utility>
+#include <vector>
+
+namespace xrpl::tests {
+
+class SHAMapSyncTest : public ::testing::Test
+{
+protected:
+    beast::Journal const j_{TestSink::instance()};
+    beast::xor_shift_engine eng_;
+
+    boost::intrusive_ptr<SHAMapItem>
+    makeRandomAS()
+    {
+        Serializer s;
+
+        for (int d = 0; d < 3; ++d)
+            s.add32(randInt<std::uint32_t>(eng_));
+        return makeShamapitem(s.getSHA512Half(), s.slice());
+    }
+
+    bool
+    confuseMap(SHAMap& map, int count)
+    {
+        // add a bunch of random states to a map, then remove them
+        // map should be the same
+        SHAMapHash const beforeHash = map.getHash();
+
+        std::list<uint256> items;
+
+        for (int i = 0; i < count; ++i)
+        {
+            auto item = makeRandomAS();
+            items.push_back(item->key());
+
+            if (!map.addItem(SHAMapNodeType::TnAccountState, item))
+            {
+                ADD_FAILURE() << "Unable to add item to map";
+                return false;
+            }
+        }
+
+        for (auto const& item : items)
+        {
+            if (!map.delItem(item))
+            {
+                ADD_FAILURE() << "Unable to remove item from map";
+                return false;
+            }
+        }
+
+        if (beforeHash != map.getHash())
+        {
+            ADD_FAILURE() << "Hashes do not match " << beforeHash << " " << map.getHash();
+            return false;
+        }
+
+        return true;
+    }
+};
+
+TEST_F(SHAMapSyncTest, sync)
+{
+    TestNodeFamily f{j_}, f2{j_};
+    SHAMap source{SHAMapType::FREE, f};
+    SHAMap destination{SHAMapType::FREE, f2};
+
+    int const items = 10000;
+    for (int i = 0; i < items; ++i)
+    {
+        source.addItem(SHAMapNodeType::TnAccountState, makeRandomAS());
+        if (i % 100 == 0)
+            source.invariants();
+    }
+
+    source.invariants();
+    ASSERT_TRUE(confuseMap(source, 500));
+    source.invariants();
+
+    source.setImmutable();
+
+    int count = 0;
+    source.visitLeaves([&count]([[maybe_unused]] auto const& item) { ++count; });
+    EXPECT_EQ(count, items);
+
+    std::vector<SHAMapMissingNode> missingNodes;
+    source.walkMap(missingNodes, 2048);
+    EXPECT_TRUE(missingNodes.empty());
+
+    destination.setSynching();
+
+    {
+        std::vector<std::pair<SHAMapNodeID, Blob>> a;
+
+        ASSERT_TRUE(source.getNodeFat(SHAMapNodeID(), a, randBool(eng_), randInt(eng_, 2)));
+
+        ASSERT_FALSE(a.empty()) << "NodeSize";
+
+        ASSERT_TRUE(
+            destination.addRootNode(source.getHash(), makeSlice(a[0].second), nullptr).isGood());
+    }
+
+    do
+    {
+        f.clock().advance(std::chrono::seconds(1));
+
+        // get the list of nodes we know we need
+        auto nodesMissing = destination.getMissingNodes(2048, nullptr);
+
+        if (nodesMissing.empty())
+            break;
+
+        // get as many nodes as possible based on this information
+        std::vector<std::pair<SHAMapNodeID, Blob>> b;
+
+        for (auto& it : nodesMissing)
+        {
+            // Keep failures fatal here because this loop is data-dependent.
+            // non-deterministic number of times and the number of tests run
+            // should be deterministic
+            if (!source.getNodeFat(it.first, b, randBool(eng_), randInt(eng_, 2)))
+                FAIL() << "Unable to fetch node";
+        }
+
+        // Keep failures fatal here because this loop is data-dependent.
+        // non-deterministic number of times and the number of tests run
+        // should be deterministic
+        if (b.empty())
+            FAIL() << "No nodes returned";
+
+        for (auto const& i : b)
+        {
+            // Keep failures fatal here because this loop is data-dependent.
+            // non-deterministic number of times and the number of tests run
+            // should be deterministic
+            if (!destination.addKnownNode(i.first, makeSlice(i.second), nullptr).isUseful())
+                FAIL() << "Known node was not useful";
+        }
+    } while (true);
+
+    destination.clearSynching();
+
+    EXPECT_TRUE(source.deepCompare(destination));
+
+    destination.invariants();
+}
+
+}  // namespace xrpl::tests
diff --git a/src/test/shamap/common.h b/src/tests/libxrpl/shamap/common.h
similarity index 89%
rename from src/test/shamap/common.h
rename to src/tests/libxrpl/shamap/common.h
index 9bef10d851..5b44f2b251 100644
--- a/src/test/shamap/common.h
+++ b/src/tests/libxrpl/shamap/common.h
@@ -4,7 +4,6 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/basics/contract.h>
-#include <xrpl/beast/clock/manual_clock.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/config/BasicConfig.h>
 #include <xrpl/config/Constants.h>
@@ -92,13 +91,17 @@ public:
     }
 
     void
-    missingNodeAcquireBySeq(std::uint32_t refNum, uint256 const& nodeHash) override
+    missingNodeAcquireBySeq(
+        [[maybe_unused]] std::uint32_t refNum,
+        [[maybe_unused]] uint256 const& nodeHash) override
     {
         Throw<std::runtime_error>("missing node");
     }
 
     void
-    missingNodeAcquireByHash(uint256 const& refHash, std::uint32_t refNum) override
+    missingNodeAcquireByHash(
+        [[maybe_unused]] uint256 const& refHash,
+        [[maybe_unused]] std::uint32_t refNum) override
     {
         Throw<std::runtime_error>("missing node");
     }
@@ -110,7 +113,7 @@ public:
         (*tnCache_).reset();
     }
 
-    beast::ManualClock<std::chrono::steady_clock>
+    TestStopwatch&
     clock()
     {
         return clock_;

From f5e63f8a91c8b11c594887b68252bbe8b6f0b7cc Mon Sep 17 00:00:00 2001
From: Marek Foss <marek.foss@neti-soft.com>
Date: Mon, 6 Jul 2026 21:48:36 +0200
Subject: [PATCH 051/100] test: Migrate basics Beast tests to GTest (#7136)

Co-authored-by: Alex Kremer <akremer@ripple.com>
---
 .../scripts/levelization/results/ordering.txt |    1 -
 src/test/basics/Buffer_test.cpp               |  268 ----
 src/test/basics/FileUtilities_test.cpp        |   64 -
 src/test/basics/IOUAmount_test.cpp            |  276 -----
 src/test/basics/IntrusiveShared_test.cpp      |  879 -------------
 src/test/basics/KeyCache_test.cpp             |   82 --
 src/test/basics/StringUtilities_test.cpp      |  309 -----
 src/test/basics/TaggedCache_test.cpp          |  251 ----
 src/test/basics/Units_test.cpp                |  344 ------
 src/test/basics/XRPAmount_test.cpp            |  326 -----
 src/test/basics/base58_test.cpp               |  440 -------
 src/test/basics/base_uint_test.cpp            |  376 ------
 src/test/basics/join_test.cpp                 |   83 --
 src/tests/libxrpl/basics/Buffer.cpp           |  260 ++++
 src/tests/libxrpl/basics/FileUtilities.cpp    |   94 ++
 src/tests/libxrpl/basics/IOUAmount.cpp        |  243 ++++
 src/tests/libxrpl/basics/IntrusiveShared.cpp  |  844 +++++++++++++
 src/tests/libxrpl/basics/KeyCache.cpp         |   81 ++
 .../libxrpl/basics/Number.cpp}                | 1084 +++++++++--------
 src/tests/libxrpl/basics/StringUtilities.cpp  |  293 +++++
 src/tests/libxrpl/basics/TaggedCache.cpp      |  246 ++++
 src/tests/libxrpl/basics/Units.cpp            |  328 +++++
 src/tests/libxrpl/basics/XRPAmount.cpp        |  295 +++++
 src/tests/libxrpl/basics/base58.cpp           |  438 +++++++
 src/tests/libxrpl/basics/base_uint_test.cpp   |  360 ++++++
 .../libxrpl/basics/hardened_hash.cpp}         |   57 +-
 src/tests/libxrpl/basics/join.cpp             |   80 ++
 27 files changed, 4145 insertions(+), 4257 deletions(-)
 delete mode 100644 src/test/basics/Buffer_test.cpp
 delete mode 100644 src/test/basics/FileUtilities_test.cpp
 delete mode 100644 src/test/basics/IOUAmount_test.cpp
 delete mode 100644 src/test/basics/IntrusiveShared_test.cpp
 delete mode 100644 src/test/basics/KeyCache_test.cpp
 delete mode 100644 src/test/basics/StringUtilities_test.cpp
 delete mode 100644 src/test/basics/TaggedCache_test.cpp
 delete mode 100644 src/test/basics/Units_test.cpp
 delete mode 100644 src/test/basics/XRPAmount_test.cpp
 delete mode 100644 src/test/basics/base58_test.cpp
 delete mode 100644 src/test/basics/base_uint_test.cpp
 delete mode 100644 src/test/basics/join_test.cpp
 create mode 100644 src/tests/libxrpl/basics/Buffer.cpp
 create mode 100644 src/tests/libxrpl/basics/FileUtilities.cpp
 create mode 100644 src/tests/libxrpl/basics/IOUAmount.cpp
 create mode 100644 src/tests/libxrpl/basics/IntrusiveShared.cpp
 create mode 100644 src/tests/libxrpl/basics/KeyCache.cpp
 rename src/{test/basics/Number_test.cpp => tests/libxrpl/basics/Number.cpp} (73%)
 create mode 100644 src/tests/libxrpl/basics/StringUtilities.cpp
 create mode 100644 src/tests/libxrpl/basics/TaggedCache.cpp
 create mode 100644 src/tests/libxrpl/basics/Units.cpp
 create mode 100644 src/tests/libxrpl/basics/XRPAmount.cpp
 create mode 100644 src/tests/libxrpl/basics/base58.cpp
 create mode 100644 src/tests/libxrpl/basics/base_uint_test.cpp
 rename src/{test/basics/hardened_hash_test.cpp => tests/libxrpl/basics/hardened_hash.cpp} (84%)
 create mode 100644 src/tests/libxrpl/basics/join.cpp

diff --git a/.github/scripts/levelization/results/ordering.txt b/.github/scripts/levelization/results/ordering.txt
index 9c9adeefe2..aee6f4c579 100644
--- a/.github/scripts/levelization/results/ordering.txt
+++ b/.github/scripts/levelization/results/ordering.txt
@@ -72,7 +72,6 @@ test.app > xrpl.server
 test.app > xrpl.shamap
 test.app > xrpl.tx
 test.basics > test.jtx
-test.basics > test.unit_test
 test.basics > xrpl.basics
 test.basics > xrpl.core
 test.basics > xrpld.rpc
diff --git a/src/test/basics/Buffer_test.cpp b/src/test/basics/Buffer_test.cpp
deleted file mode 100644
index c748a3f9dd..0000000000
--- a/src/test/basics/Buffer_test.cpp
+++ /dev/null
@@ -1,268 +0,0 @@
-#include <xrpl/basics/Buffer.h>
-#include <xrpl/basics/Slice.h>
-#include <xrpl/beast/unit_test/suite.h>
-
-#include <cstddef>
-#include <cstdint>
-#include <cstring>
-#include <type_traits>
-#include <utility>
-
-namespace xrpl::test {
-
-struct Buffer_test : beast::unit_test::Suite
-{
-    static bool
-    sane(Buffer const& b)
-    {
-        if (b.empty())
-            return b.data() == nullptr;
-
-        return b.data() != nullptr;
-    }
-
-    void
-    run() override
-    {
-        std::uint8_t const data[] = {0xa8, 0xa1, 0x38, 0x45, 0x23, 0xec, 0xe4, 0x23,
-                                     0x71, 0x6d, 0x2a, 0x18, 0xb4, 0x70, 0xcb, 0xf5,
-                                     0xac, 0x2d, 0x89, 0x4d, 0x19, 0x9c, 0xf0, 0x2c,
-                                     0x15, 0xd1, 0xf9, 0x9b, 0x66, 0xd2, 0x30, 0xd3};
-
-        Buffer const b0;
-        BEAST_EXPECT(sane(b0));
-        BEAST_EXPECT(b0.empty());
-
-        Buffer b1{0};
-        BEAST_EXPECT(sane(b1));
-        BEAST_EXPECT(b1.empty());
-        std::memcpy(b1.alloc(16), data, 16);
-        BEAST_EXPECT(sane(b1));
-        BEAST_EXPECT(!b1.empty());
-        BEAST_EXPECT(b1.size() == 16);
-
-        Buffer b2{b1.size()};
-        BEAST_EXPECT(sane(b2));
-        BEAST_EXPECT(!b2.empty());
-        BEAST_EXPECT(b2.size() == b1.size());
-        std::memcpy(b2.data(), data + 16, 16);
-
-        Buffer b3{data, sizeof(data)};
-        BEAST_EXPECT(sane(b3));
-        BEAST_EXPECT(!b3.empty());
-        BEAST_EXPECT(b3.size() == sizeof(data));
-        BEAST_EXPECT(std::memcmp(b3.data(), data, b3.size()) == 0);
-
-        // Check equality and inequality comparisons
-        BEAST_EXPECT(b0 == b0);
-        BEAST_EXPECT(b0 != b1);
-        BEAST_EXPECT(b1 == b1);
-        BEAST_EXPECT(b1 != b2);
-        BEAST_EXPECT(b2 != b3);
-
-        // Check copy constructors and copy assignments:
-        {
-            testcase("Copy Construction / Assignment");
-
-            Buffer x{b0};
-            BEAST_EXPECT(x == b0);
-            BEAST_EXPECT(sane(x));
-            Buffer y{b1};
-            BEAST_EXPECT(y == b1);
-            BEAST_EXPECT(sane(y));
-            x = b2;
-            BEAST_EXPECT(x == b2);
-            BEAST_EXPECT(sane(x));
-            x = y;
-            BEAST_EXPECT(x == y);
-            BEAST_EXPECT(sane(x));
-            y = b3;
-            BEAST_EXPECT(y == b3);
-            BEAST_EXPECT(sane(y));
-            x = b0;
-            BEAST_EXPECT(x == b0);
-            BEAST_EXPECT(sane(x));
-#if defined(__clang__)
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wself-assign-overloaded"
-#endif
-
-            x = x;
-            BEAST_EXPECT(x == b0);
-            BEAST_EXPECT(sane(x));
-            y = y;
-            BEAST_EXPECT(y == b3);
-            BEAST_EXPECT(sane(y));
-
-#if defined(__clang__)
-#pragma clang diagnostic pop
-#endif
-        }
-
-        // Check move constructor & move assignments:
-        {
-            testcase("Move Construction / Assignment");
-
-            static_assert(std::is_nothrow_move_constructible_v<Buffer>);
-            static_assert(std::is_nothrow_move_assignable_v<Buffer>);
-
-            {  // Move-construct from empty buf
-                Buffer x;
-                Buffer const y{std::move(x)};
-                BEAST_EXPECT(sane(x));    // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(x.empty());  // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(sane(y));
-                BEAST_EXPECT(y.empty());
-                BEAST_EXPECT(x == y);  // NOLINT(bugprone-use-after-move)
-            }
-
-            {  // Move-construct from non-empty buf
-                Buffer x{b1};
-                Buffer const y{std::move(x)};
-                BEAST_EXPECT(sane(x));    // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(x.empty());  // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(sane(y));
-                BEAST_EXPECT(y == b1);
-            }
-
-            {  // Move assign empty buf to empty buf
-                Buffer x;
-                Buffer y;
-
-                x = std::move(y);
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(x.empty());
-                BEAST_EXPECT(sane(y));    // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(y.empty());  // NOLINT(bugprone-use-after-move)
-            }
-
-            {  // Move assign non-empty buf to empty buf
-                Buffer x;
-                Buffer y{b1};
-
-                x = std::move(y);
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(x == b1);
-                BEAST_EXPECT(sane(y));    // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(y.empty());  // NOLINT(bugprone-use-after-move)
-            }
-
-            {  // Move assign empty buf to non-empty buf
-                Buffer x{b1};
-                Buffer y;
-
-                x = std::move(y);
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(x.empty());
-                BEAST_EXPECT(sane(y));    // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(y.empty());  // NOLINT(bugprone-use-after-move)
-            }
-
-            {  // Move assign non-empty buf to non-empty buf
-                Buffer x{b1};
-                Buffer y{b2};
-                Buffer z{b3};
-
-                x = std::move(y);
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(!x.empty());
-                BEAST_EXPECT(sane(y));    // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(y.empty());  // NOLINT(bugprone-use-after-move)
-
-                x = std::move(z);
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(!x.empty());
-                BEAST_EXPECT(sane(z));    // NOLINT(bugprone-use-after-move)
-                BEAST_EXPECT(z.empty());  // NOLINT(bugprone-use-after-move)
-            }
-        }
-
-        {
-            testcase("Slice Conversion / Construction / Assignment");
-
-            Buffer w{static_cast<Slice>(b0)};
-            BEAST_EXPECT(sane(w));
-            BEAST_EXPECT(w == b0);
-
-            Buffer x{static_cast<Slice>(b1)};
-            BEAST_EXPECT(sane(x));
-            BEAST_EXPECT(x == b1);
-
-            Buffer y{static_cast<Slice>(b2)};
-            BEAST_EXPECT(sane(y));
-            BEAST_EXPECT(y == b2);
-
-            Buffer z{static_cast<Slice>(b3)};
-            BEAST_EXPECT(sane(z));
-            BEAST_EXPECT(z == b3);
-
-            // Assign empty slice to empty buffer
-            w = static_cast<Slice>(b0);
-            BEAST_EXPECT(sane(w));
-            BEAST_EXPECT(w == b0);
-
-            // Assign non-empty slice to empty buffer
-            w = static_cast<Slice>(b1);
-            BEAST_EXPECT(sane(w));
-            BEAST_EXPECT(w == b1);
-
-            // Assign non-empty slice to non-empty buffer
-            x = static_cast<Slice>(b2);
-            BEAST_EXPECT(sane(x));
-            BEAST_EXPECT(x == b2);
-
-            // Assign non-empty slice to non-empty buffer
-            y = static_cast<Slice>(z);
-            BEAST_EXPECT(sane(y));
-            BEAST_EXPECT(y == z);
-
-            // Assign empty slice to non-empty buffer:
-            z = static_cast<Slice>(b0);
-            BEAST_EXPECT(sane(z));
-            BEAST_EXPECT(z == b0);
-        }
-
-        {
-            testcase("Allocation, Deallocation and Clearing");
-
-            auto test = [this](Buffer const& b, std::size_t i) {
-                Buffer x{b};
-
-                // Try to allocate some number of bytes, possibly
-                // zero (which means clear) and sanity check
-                x(i);
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(x.size() == i);
-                BEAST_EXPECT((x.data() == nullptr) == (i == 0));
-
-                // Try to allocate some more data (always non-zero)
-                x(i + 1);
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(x.size() == i + 1);
-                BEAST_EXPECT(x.data() != nullptr);
-
-                // Try to clear:
-                x.clear();
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(x.empty());
-                BEAST_EXPECT(x.data() == nullptr);
-
-                // Try to clear again:
-                x.clear();
-                BEAST_EXPECT(sane(x));
-                BEAST_EXPECT(x.empty());
-                BEAST_EXPECT(x.data() == nullptr);
-            };
-
-            for (std::size_t i = 0; i < 16; ++i)
-            {
-                test(b0, i);
-                test(b1, i);
-            }
-        }
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(Buffer, basics, xrpl);
-
-}  // namespace xrpl::test
diff --git a/src/test/basics/FileUtilities_test.cpp b/src/test/basics/FileUtilities_test.cpp
deleted file mode 100644
index 0e050b5168..0000000000
--- a/src/test/basics/FileUtilities_test.cpp
+++ /dev/null
@@ -1,64 +0,0 @@
-#include <test/unit_test/FileDirGuard.h>
-
-#include <xrpl/basics/ByteUtilities.h>
-#include <xrpl/basics/FileUtilities.h>
-#include <xrpl/beast/unit_test/suite.h>
-
-#include <boost/system/detail/errc.hpp>
-#include <boost/system/detail/error_code.hpp>
-
-namespace xrpl {
-
-class FileUtilities_test : public beast::unit_test::Suite
-{
-public:
-    void
-    testGetFileContents()
-    {
-        using namespace xrpl::detail;
-        using namespace boost::system;
-
-        static constexpr char const* kExpectedContents =
-            "This file is very short. That's all we need.";
-
-        FileDirGuard const file(
-            *this, "test_file", "test.txt", "This is temporary text that should get overwritten");
-
-        error_code ec;
-        auto const path = file.file();
-
-        writeFileContents(ec, path, kExpectedContents);
-        BEAST_EXPECT(!ec);
-
-        {
-            // Test with no max
-            auto const good = getFileContents(ec, path);
-            BEAST_EXPECT(!ec);
-            BEAST_EXPECT(good == kExpectedContents);
-        }
-
-        {
-            // Test with large max
-            auto const good = getFileContents(ec, path, kilobytes(1));
-            BEAST_EXPECT(!ec);
-            BEAST_EXPECT(good == kExpectedContents);
-        }
-
-        {
-            // Test with small max
-            auto const bad = getFileContents(ec, path, 16);
-            BEAST_EXPECT(ec && ec.value() == boost::system::errc::file_too_large);
-            BEAST_EXPECT(bad.empty());
-        }
-    }
-
-    void
-    run() override
-    {
-        testGetFileContents();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(FileUtilities, basics, xrpl);
-
-}  // namespace xrpl
diff --git a/src/test/basics/IOUAmount_test.cpp b/src/test/basics/IOUAmount_test.cpp
deleted file mode 100644
index b652d27625..0000000000
--- a/src/test/basics/IOUAmount_test.cpp
+++ /dev/null
@@ -1,276 +0,0 @@
-#include <xrpl/basics/Number.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Zero.h>
-#include <xrpl/protocol/IOUAmount.h>
-
-#include <cstdint>
-#include <limits>
-#include <sstream>
-
-namespace xrpl {
-
-class IOUAmount_test : public beast::unit_test::Suite
-{
-public:
-    void
-    testZero()
-    {
-        testcase("zero");
-
-        IOUAmount const z(0, 0);
-
-        BEAST_EXPECT(z.mantissa() == 0);
-        BEAST_EXPECT(z.exponent() == -100);
-        BEAST_EXPECT(!z);
-        BEAST_EXPECT(z.signum() == 0);
-        BEAST_EXPECT(z == beast::kZero);
-
-        BEAST_EXPECT((z + z) == z);
-        BEAST_EXPECT((z - z) == z);
-        BEAST_EXPECT(z == -z);
-
-        IOUAmount const zz(beast::kZero);
-        BEAST_EXPECT(z == zz);
-
-        // https://github.com/XRPLF/rippled/issues/5170
-        IOUAmount const zzz{};
-        BEAST_EXPECT(zzz == beast::kZero);
-        // BEAST_EXPECT(zzz == zz);
-    }
-
-    void
-    testSigNum()
-    {
-        testcase("signum");
-
-        IOUAmount const neg(-1, 0);
-        BEAST_EXPECT(neg.signum() < 0);
-
-        IOUAmount const zer(0, 0);
-        BEAST_EXPECT(zer.signum() == 0);
-
-        IOUAmount const pos(1, 0);
-        BEAST_EXPECT(pos.signum() > 0);
-    }
-
-    void
-    testBeastZero()
-    {
-        testcase("beast::Zero Comparisons");
-
-        using beast::kZero;
-
-        {
-            IOUAmount const z(kZero);
-            BEAST_EXPECT(z == kZero);
-            BEAST_EXPECT(z >= kZero);
-            BEAST_EXPECT(z <= kZero);
-            unexpected(z != kZero);
-            unexpected(z > kZero);
-            unexpected(z < kZero);
-        }
-
-        {
-            IOUAmount const neg(-2, 0);
-            BEAST_EXPECT(neg < kZero);
-            BEAST_EXPECT(neg <= kZero);
-            BEAST_EXPECT(neg != kZero);
-            unexpected(neg == kZero);
-        }
-
-        {
-            IOUAmount const pos(2, 0);
-            BEAST_EXPECT(pos > kZero);
-            BEAST_EXPECT(pos >= kZero);
-            BEAST_EXPECT(pos != kZero);
-            unexpected(pos == kZero);
-        }
-    }
-
-    void
-    testComparisons()
-    {
-        testcase("IOU Comparisons");
-
-        IOUAmount const n(-2, 0);
-        IOUAmount const z(0, 0);
-        IOUAmount const p(2, 0);
-
-        BEAST_EXPECT(z == z);
-        BEAST_EXPECT(z >= z);
-        BEAST_EXPECT(z <= z);
-        BEAST_EXPECT(z == -z);
-        // NOLINTBEGIN(misc-redundant-expression)
-        unexpected(z > z);
-        unexpected(z < z);
-        unexpected(z != z);
-        // NOLINTEND(misc-redundant-expression)
-        unexpected(z != -z);
-
-        BEAST_EXPECT(n < z);
-        BEAST_EXPECT(n <= z);
-        BEAST_EXPECT(n != z);
-        unexpected(n > z);
-        unexpected(n >= z);
-        unexpected(n == z);
-
-        BEAST_EXPECT(p > z);
-        BEAST_EXPECT(p >= z);
-        BEAST_EXPECT(p != z);
-        unexpected(p < z);
-        unexpected(p <= z);
-        unexpected(p == z);
-
-        BEAST_EXPECT(n < p);
-        BEAST_EXPECT(n <= p);
-        BEAST_EXPECT(n != p);
-        unexpected(n > p);
-        unexpected(n >= p);
-        unexpected(n == p);
-
-        BEAST_EXPECT(p > n);
-        BEAST_EXPECT(p >= n);
-        BEAST_EXPECT(p != n);
-        unexpected(p < n);
-        unexpected(p <= n);
-        unexpected(p == n);
-
-        BEAST_EXPECT(p > -p);
-        BEAST_EXPECT(p >= -p);
-        BEAST_EXPECT(p != -p);
-
-        BEAST_EXPECT(n < -n);
-        BEAST_EXPECT(n <= -n);
-        BEAST_EXPECT(n != -n);
-    }
-
-    void
-    testToString()
-    {
-        testcase("IOU strings");
-
-        auto test = [this](IOUAmount const& n, std::string const& expected) {
-            auto const result = to_string(n);
-            std::stringstream ss;
-            ss << "to_string(" << result << "). Expected: " << expected;
-            BEAST_EXPECTS(result == expected, ss.str());
-        };
-
-        for (auto const mantissaSize : MantissaRange::getAllScales())
-        {
-            NumberMantissaScaleGuard const mg(mantissaSize);
-
-            test(IOUAmount(-2, 0), "-2");
-            test(IOUAmount(0, 0), "0");
-            test(IOUAmount(2, 0), "2");
-            test(IOUAmount(25, -3), "0.025");
-            test(IOUAmount(-25, -3), "-0.025");
-            test(IOUAmount(25, 1), "250");
-            test(IOUAmount(-25, 1), "-250");
-            test(IOUAmount(2, 20), "2e20");
-            test(IOUAmount(-2, -20), "-2e-20");
-        }
-    }
-
-    void
-    testMulRatio()
-    {
-        testcase("mulRatio");
-
-        /* The range for the mantissa when normalized */
-        static constexpr std::int64_t kMinMantissa = 1000000000000000ull;
-        static constexpr std::int64_t kMaxMantissa = 9999999999999999ull;
-        // log(2,maxMantissa) ~ 53.15
-        /* The range for the exponent when normalized */
-        static constexpr int kMinExponent = -96;
-        static constexpr int kMaxExponent = 80;
-        constexpr auto kMaxUInt = std::numeric_limits<std::uint32_t>::max();
-
-        {
-            // multiply by a number that would overflow the mantissa, then
-            // divide by the same number, and check we didn't lose any value
-            IOUAmount const bigMan(kMaxMantissa, 0);
-            BEAST_EXPECT(bigMan == mulRatio(bigMan, kMaxUInt, kMaxUInt, true));
-            // rounding mode shouldn't matter as the result is exact
-            BEAST_EXPECT(bigMan == mulRatio(bigMan, kMaxUInt, kMaxUInt, false));
-        }
-        {
-            // Similar test as above, but for negative values
-            IOUAmount const bigMan(-kMaxMantissa, 0);
-            BEAST_EXPECT(bigMan == mulRatio(bigMan, kMaxUInt, kMaxUInt, true));
-            // rounding mode shouldn't matter as the result is exact
-            BEAST_EXPECT(bigMan == mulRatio(bigMan, kMaxUInt, kMaxUInt, false));
-        }
-
-        {
-            // small amounts
-            IOUAmount const tiny(kMinMantissa, kMinExponent);
-            // Round up should give the smallest allowable number
-            BEAST_EXPECT(tiny == mulRatio(tiny, 1, kMaxUInt, true));
-            BEAST_EXPECT(tiny == mulRatio(tiny, kMaxUInt - 1, kMaxUInt, true));
-            // rounding down should be zero
-            BEAST_EXPECT(beast::kZero == mulRatio(tiny, 1, kMaxUInt, false));
-            BEAST_EXPECT(beast::kZero == mulRatio(tiny, kMaxUInt - 1, kMaxUInt, false));
-
-            // tiny negative numbers
-            IOUAmount const tinyNeg(-kMinMantissa, kMinExponent);
-            // Round up should give zero
-            BEAST_EXPECT(beast::kZero == mulRatio(tinyNeg, 1, kMaxUInt, true));
-            BEAST_EXPECT(beast::kZero == mulRatio(tinyNeg, kMaxUInt - 1, kMaxUInt, true));
-            // rounding down should be tiny
-            BEAST_EXPECT(tinyNeg == mulRatio(tinyNeg, 1, kMaxUInt, false));
-            BEAST_EXPECT(tinyNeg == mulRatio(tinyNeg, kMaxUInt - 1, kMaxUInt, false));
-        }
-
-        {  // rounding
-            {
-                IOUAmount const one(1, 0);
-                auto const rup = mulRatio(one, kMaxUInt - 1, kMaxUInt, true);
-                auto const rdown = mulRatio(one, kMaxUInt - 1, kMaxUInt, false);
-                BEAST_EXPECT(rup.mantissa() - rdown.mantissa() == 1);
-            }
-            {
-                IOUAmount const big(kMaxMantissa, kMaxExponent);
-                auto const rup = mulRatio(big, kMaxUInt - 1, kMaxUInt, true);
-                auto const rdown = mulRatio(big, kMaxUInt - 1, kMaxUInt, false);
-                BEAST_EXPECT(rup.mantissa() - rdown.mantissa() == 1);
-            }
-
-            {
-                IOUAmount const negOne(-1, 0);
-                auto const rup = mulRatio(negOne, kMaxUInt - 1, kMaxUInt, true);
-                auto const rdown = mulRatio(negOne, kMaxUInt - 1, kMaxUInt, false);
-                BEAST_EXPECT(rup.mantissa() - rdown.mantissa() == 1);
-            }
-        }
-
-        {
-            // division by zero
-            IOUAmount one(1, 0);
-            except([&] { mulRatio(one, 1, 0, true); });
-        }
-
-        {
-            // overflow
-            IOUAmount big(kMaxMantissa, kMaxExponent);
-            except([&] { mulRatio(big, 2, 0, true); });
-        }
-    }  // namespace xrpl
-
-    //--------------------------------------------------------------------------
-
-    void
-    run() override
-    {
-        testZero();
-        testSigNum();
-        testBeastZero();
-        testComparisons();
-        testToString();
-        testMulRatio();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(IOUAmount, basics, xrpl);
-
-}  // namespace xrpl
diff --git a/src/test/basics/IntrusiveShared_test.cpp b/src/test/basics/IntrusiveShared_test.cpp
deleted file mode 100644
index 185b877f23..0000000000
--- a/src/test/basics/IntrusiveShared_test.cpp
+++ /dev/null
@@ -1,879 +0,0 @@
-
-#include <xrpl/basics/IntrusivePointer.h>    // IWYU pragma: keep
-#include <xrpl/basics/IntrusivePointer.ipp>  // IWYU pragma: keep
-#include <xrpl/basics/IntrusiveRefCounts.h>
-#include <xrpl/beast/unit_test/suite.h>
-
-#include <algorithm>
-#include <array>
-#include <atomic>
-#include <cassert>
-#include <chrono>  // IWYU pragma: keep
-#include <condition_variable>
-#include <cstddef>
-#include <cstdint>
-#include <functional>
-#include <latch>
-#include <mutex>
-#include <optional>
-#include <random>
-#include <string>
-#include <thread>
-#include <utility>
-#include <variant>
-#include <vector>
-
-namespace xrpl::tests {
-
-/**
-Experimentally, we discovered that using std::barrier performs extremely
-poorly (~1 hour vs ~1 minute to run the test suite) in certain macOS
-environments. To unblock our macOS CI pipeline, we replaced std::barrier with a
-custom mutex-based barrier (Barrier) that significantly improves performance
-without compromising correctness. For future reference, if we ever consider
-reintroducing std::barrier, the following configuration is known to exhibit the
-problem:
-
-    Model Name: Mac mini
-    Model Identifier: Mac14,3
-    Model Number: Z16K000R4LL/A
-    Chip: Apple M2
-    Total Number of Cores: 8 (4 performance and 4 efficiency)
-    Memory: 24 GB
-    System Firmware Version: 11881.41.5
-    OS Loader Version: 11881.1.1
-    Apple clang version 16.0.0 (clang-1600.0.26.3)
-    Target: arm64-apple-darwin24.0.0
-    Thread model: posix
-
- */
-struct Barrier
-{
-    std::mutex mtx;
-    std::condition_variable cv;
-    int count;
-    int const initial;
-
-    Barrier(int n) : count(n), initial(n)
-    {
-    }
-
-    void
-    arriveAndWait()
-    {
-        std::unique_lock lock(mtx);
-        if (--count == 0)
-        {
-            count = initial;
-            cv.notify_all();
-        }
-        else
-        {
-            cv.wait(lock, [&] { return count == initial; });
-        }
-    }
-};
-
-namespace {
-enum class TrackedState : std::uint8_t {
-    Uninitialized,
-    Alive,
-    PartiallyDeletedStarted,
-    PartiallyDeleted,
-    DeletedStarted,
-    Deleted
-};
-
-class TIBase : public IntrusiveRefCounts
-{
-public:
-    static constexpr std::size_t kMaxStates = 128;
-    static std::array<std::atomic<TrackedState>, kMaxStates> state;
-    static std::atomic<int> nextId;
-    static TrackedState
-    getState(int id)
-    {
-        assert(id < state.size());
-        return state[id].load(std::memory_order_acquire);
-    }
-    static void
-    resetStates(bool resetCallback)
-    {
-        for (int i = 0; i < kMaxStates; ++i)
-        {
-            state[i].store(TrackedState::Uninitialized, std::memory_order_release);
-        }
-        nextId.store(0, std::memory_order_release);
-        if (resetCallback)
-            TIBase::tracingCallback = [](TrackedState, std::optional<TrackedState>) {};
-    }
-
-    struct ResetStatesGuard
-    {
-        bool resetCallback{false};
-
-        ResetStatesGuard(bool resetCallback) : resetCallback{resetCallback}
-        {
-            TIBase::resetStates(resetCallback);
-        }
-        ~ResetStatesGuard()
-        {
-            TIBase::resetStates(resetCallback);
-        }
-    };
-
-    TIBase() : id{checkoutID()}
-    {
-        assert(state.size() > id);
-        state[id].store(TrackedState::Alive, std::memory_order_relaxed);
-    }
-    ~TIBase() override
-    {
-        using enum TrackedState;
-
-        assert(state.size() > id);
-        tracingCallback(state[id].load(std::memory_order_relaxed), DeletedStarted);
-
-        assert(state.size() > id);
-        // Use relaxed memory order to try to avoid atomic operations from
-        // adding additional memory synchronizations that may hide threading
-        // errors in the underlying shared pointer class.
-        state[id].store(DeletedStarted, std::memory_order_relaxed);
-
-        tracingCallback(DeletedStarted, Deleted);
-
-        assert(state.size() > id);
-        state[id].store(TrackedState::Deleted, std::memory_order_relaxed);
-
-        tracingCallback(TrackedState::Deleted, std::nullopt);
-    }
-
-    void
-    partialDestructor() const
-    {
-        using enum TrackedState;
-
-        assert(state.size() > id);
-        tracingCallback(state[id].load(std::memory_order_relaxed), PartiallyDeletedStarted);
-
-        assert(state.size() > id);
-        state[id].store(PartiallyDeletedStarted, std::memory_order_relaxed);
-
-        tracingCallback(PartiallyDeletedStarted, PartiallyDeleted);
-
-        assert(state.size() > id);
-        state[id].store(PartiallyDeleted, std::memory_order_relaxed);
-
-        tracingCallback(PartiallyDeleted, std::nullopt);
-    }
-
-    static std::function<void(TrackedState, std::optional<TrackedState>)> tracingCallback;
-
-    int id;
-
-private:
-    static int
-    checkoutID()
-    {
-        return nextId.fetch_add(1, std::memory_order_acq_rel);
-    }
-};
-
-std::array<std::atomic<TrackedState>, TIBase::kMaxStates> TIBase::state;
-std::atomic<int> TIBase::nextId{0};
-
-std::function<void(TrackedState, std::optional<TrackedState>)> TIBase::tracingCallback =
-    [](TrackedState, std::optional<TrackedState>) {};
-
-}  // namespace
-
-class IntrusiveShared_test : public beast::unit_test::Suite
-{
-public:
-    void
-    testBasics()
-    {
-        testcase("Basics");
-
-        {
-            TIBase::ResetStatesGuard const rsg{true};
-
-            TIBase const b;
-            BEAST_EXPECT(b.useCount() == 1);
-            b.addWeakRef();
-            BEAST_EXPECT(b.useCount() == 1);
-            auto s = b.releaseStrongRef();
-            BEAST_EXPECT(s == ReleaseStrongRefAction::PartialDestroy);
-            BEAST_EXPECT(b.useCount() == 0);
-            TIBase const* pb = &b;
-            partialDestructorFinished(&pb);
-            BEAST_EXPECT(!pb);
-            auto w = b.releaseWeakRef();
-            BEAST_EXPECT(w == ReleaseWeakRefAction::Destroy);
-        }
-
-        std::vector<SharedIntrusive<TIBase>> strong;
-        std::vector<WeakIntrusive<TIBase>> weak;
-        {
-            TIBase::ResetStatesGuard const rsg{true};
-
-            using enum TrackedState;
-            auto b = makeSharedIntrusive<TIBase>();
-            auto id = b->id;
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            BEAST_EXPECT(b->useCount() == 1);
-            for (int i = 0; i < 10; ++i)
-            {
-                strong.push_back(b);
-            }
-            b.reset();
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            strong.resize(strong.size() - 1);
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            strong.clear();
-            BEAST_EXPECT(TIBase::getState(id) == Deleted);
-
-            b = makeSharedIntrusive<TIBase>();
-            id = b->id;
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            BEAST_EXPECT(b->useCount() == 1);
-            for (int i = 0; i < 10; ++i)
-            {
-                weak.emplace_back(b);
-                BEAST_EXPECT(b->useCount() == 1);
-            }
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            weak.resize(weak.size() - 1);
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            b.reset();
-            BEAST_EXPECT(TIBase::getState(id) == PartiallyDeleted);
-            while (!weak.empty())
-            {
-                weak.resize(weak.size() - 1);
-                if (!weak.empty())
-                    BEAST_EXPECT(TIBase::getState(id) == PartiallyDeleted);
-            }
-            BEAST_EXPECT(TIBase::getState(id) == Deleted);
-        }
-        {
-            TIBase::ResetStatesGuard const rsg{true};
-
-            using enum TrackedState;
-            auto b = makeSharedIntrusive<TIBase>();
-            auto id = b->id;
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            WeakIntrusive<TIBase> w{b};
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            auto s = w.lock();
-            BEAST_EXPECT(s && s->useCount() == 2);
-            b.reset();
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            BEAST_EXPECT(s && s->useCount() == 1);
-            s.reset();
-            BEAST_EXPECT(TIBase::getState(id) == PartiallyDeleted);
-            BEAST_EXPECT(w.expired());
-            s = w.lock();
-            // Cannot convert a weak pointer to a strong pointer if object is
-            // already partially deleted
-            BEAST_EXPECT(!s);
-            w.reset();
-            BEAST_EXPECT(TIBase::getState(id) == Deleted);
-        }
-        {
-            TIBase::ResetStatesGuard const rsg{true};
-
-            using enum TrackedState;
-            using swu = SharedWeakUnion<TIBase>;
-            swu b = makeSharedIntrusive<TIBase>();
-            BEAST_EXPECT(b.isStrong() && b.useCount() == 1);
-            auto id = b.get()->id;
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            swu w = b;
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            BEAST_EXPECT(w.isStrong() && b.useCount() == 2);
-            w.convertToWeak();
-            BEAST_EXPECT(w.isWeak() && b.useCount() == 1);
-            swu s = w;
-            BEAST_EXPECT(s.isWeak() && b.useCount() == 1);
-            s.convertToStrong();
-            BEAST_EXPECT(s.isStrong() && b.useCount() == 2);
-            b.reset();
-            BEAST_EXPECT(TIBase::getState(id) == Alive);
-            BEAST_EXPECT(s.useCount() == 1);
-            BEAST_EXPECT(!w.expired());
-            s.reset();
-            BEAST_EXPECT(TIBase::getState(id) == PartiallyDeleted);
-            BEAST_EXPECT(w.expired());
-            w.convertToStrong();
-            // Cannot convert a weak pointer to a strong pointer if object is
-            // already partially deleted
-            BEAST_EXPECT(w.isWeak());
-            w.reset();
-            BEAST_EXPECT(TIBase::getState(id) == Deleted);
-        }
-        {
-            // Testing SharedWeakUnion assignment operator
-
-            TIBase::ResetStatesGuard const rsg{true};
-
-            auto strong1 = makeSharedIntrusive<TIBase>();
-            auto strong2 = makeSharedIntrusive<TIBase>();
-
-            auto id1 = strong1->id;
-            auto id2 = strong2->id;
-
-            BEAST_EXPECT(id1 != id2);
-
-            SharedWeakUnion<TIBase> union1 = strong1;
-            SharedWeakUnion<TIBase> union2 = strong2;
-
-            BEAST_EXPECT(union1.isStrong());
-            BEAST_EXPECT(union2.isStrong());
-            BEAST_EXPECT(union1.get() == strong1.get());
-            BEAST_EXPECT(union2.get() == strong2.get());
-
-            // 1) Normal assignment: explicitly calls SharedWeakUnion assignment
-            union1 = union2;
-            BEAST_EXPECT(union1.isStrong());
-            BEAST_EXPECT(union2.isStrong());
-            BEAST_EXPECT(union1.get() == union2.get());
-            BEAST_EXPECT(TIBase::getState(id1) == TrackedState::Alive);
-            BEAST_EXPECT(TIBase::getState(id2) == TrackedState::Alive);
-
-            // 2) Test self-assignment
-            BEAST_EXPECT(union1.isStrong());
-            BEAST_EXPECT(TIBase::getState(id1) == TrackedState::Alive);
-            int const initialRefCount = strong1->useCount();
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wself-assign-overloaded"
-            union1 = union1;  // Self-assignment
-#pragma clang diagnostic pop
-            BEAST_EXPECT(union1.isStrong());
-            BEAST_EXPECT(TIBase::getState(id1) == TrackedState::Alive);
-            BEAST_EXPECT(strong1->useCount() == initialRefCount);
-
-            // 3) Test assignment from null union pointer
-            union1 = SharedWeakUnion<TIBase>();
-            BEAST_EXPECT(union1.get() == nullptr);
-
-            // 4) Test assignment to expired union pointer
-            strong2.reset();
-            union2.reset();
-            union1 = union2;
-            BEAST_EXPECT(union1.get() == nullptr);
-            BEAST_EXPECT(TIBase::getState(id2) == TrackedState::Deleted);
-        }
-    }
-
-    void
-    testPartialDelete()
-    {
-        testcase("Partial Delete");
-
-        // This test creates two threads. One with a strong pointer and one
-        // with a weak pointer. The strong pointer is reset while the weak
-        // pointer still holds a reference, triggering a partial delete.
-        // While the partial delete function runs (a sleep is inserted) the
-        // weak pointer is reset. The destructor should wait to run until
-        // after the partial delete function has completed running.
-
-        using enum TrackedState;
-
-        TIBase::ResetStatesGuard const rsg{true};
-
-        auto strong = makeSharedIntrusive<TIBase>();
-        WeakIntrusive<TIBase> weak{strong};
-        bool destructorRan = false;
-        bool partialDeleteRan = false;
-        std::latch partialDeleteStartedSyncPoint{2};
-        strong->tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
-            using enum TrackedState;
-            if (next == DeletedStarted)
-            {
-                // strong goes out of scope while weak is still in scope
-                // This checks that partialDelete has run to completion
-                // before the destructor is called. A sleep is inserted
-                // inside the partial delete to make sure the destructor is
-                // given an opportunity to run during partial delete.
-                BEAST_EXPECT(cur == PartiallyDeleted);
-            }
-            if (next == PartiallyDeletedStarted)
-            {
-                partialDeleteStartedSyncPoint.arrive_and_wait();
-                using namespace std::chrono_literals;
-                // Sleep and let the weak pointer go out of scope,
-                // potentially triggering a destructor while partial delete
-                // is running. The test is to make sure that doesn't happen.
-                std::this_thread::sleep_for(800ms);
-            }
-            if (next == PartiallyDeleted)
-            {
-                BEAST_EXPECT(!partialDeleteRan && !destructorRan);
-                partialDeleteRan = true;
-            }
-            if (next == Deleted)
-            {
-                BEAST_EXPECT(!destructorRan);
-                destructorRan = true;
-            }
-        };
-        std::thread t1{[&] {
-            partialDeleteStartedSyncPoint.arrive_and_wait();
-            weak.reset();  // Trigger a full delete as soon as the partial
-                           // delete starts
-        }};
-        std::thread t2{[&] {
-            strong.reset();  // Trigger a partial delete
-        }};
-        t1.join();
-        t2.join();
-
-        BEAST_EXPECT(destructorRan && partialDeleteRan);
-    }
-
-    void
-    testDestructor()
-    {
-        testcase("Destructor");
-
-        // This test creates two threads. One with a strong pointer and one
-        // with a weak pointer. The weak pointer is reset while the strong
-        // pointer still holds a reference. Then the strong pointer is
-        // reset. Only the destructor should run. The partial destructor
-        // should not be called. Since the weak reset runs to completion
-        // before the strong pointer is reset, threading doesn't add much to
-        // this test, but there is no harm in keeping it.
-
-        using enum TrackedState;
-
-        TIBase::ResetStatesGuard const rsg{true};
-
-        auto strong = makeSharedIntrusive<TIBase>();
-        WeakIntrusive<TIBase> weak{strong};
-        bool destructorRan = false;
-        bool partialDeleteRan = false;
-        std::latch weakResetSyncPoint{2};
-        strong->tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
-            using enum TrackedState;
-            if (next == PartiallyDeleted)
-            {
-                BEAST_EXPECT(!partialDeleteRan && !destructorRan);
-                partialDeleteRan = true;
-            }
-            if (next == Deleted)
-            {
-                BEAST_EXPECT(!destructorRan);
-                destructorRan = true;
-            }
-        };
-        std::thread t1{[&] {
-            weak.reset();
-            weakResetSyncPoint.arrive_and_wait();
-        }};
-        std::thread t2{[&] {
-            weakResetSyncPoint.arrive_and_wait();
-            strong.reset();  // Trigger a partial delete
-        }};
-        t1.join();
-        t2.join();
-
-        BEAST_EXPECT(destructorRan && !partialDeleteRan);
-    }
-
-    void
-    testMultithreadedClearMixedVariant()
-    {
-        testcase("Multithreaded Clear Mixed Variant");
-
-        // This test creates and destroys many strong and weak pointers in a
-        // loop. There is a random mix of strong and weak pointers stored in
-        // a vector (held as a variant). Both threads clear all the pointers
-        // and check that the invariants hold.
-
-        using enum TrackedState;
-        TIBase::ResetStatesGuard const rsg{true};
-
-        std::atomic<int> destructionState{0};
-        // returns destructorRan and partialDestructorRan (in that order)
-        auto getDestructorState = [&]() -> std::pair<bool, bool> {
-            int const s = destructionState.load(std::memory_order_relaxed);
-            return {(s & 1) != 0, (s & 2) != 0};
-        };
-        auto setDestructorRan = [&]() -> void {
-            destructionState.fetch_or(1, std::memory_order_acq_rel);
-        };
-        auto setPartialDeleteRan = [&]() -> void {
-            destructionState.fetch_or(2, std::memory_order_acq_rel);
-        };
-        auto tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
-            using enum TrackedState;
-            auto [destructorRan, partialDeleteRan] = getDestructorState();
-            if (next == PartiallyDeleted)
-            {
-                BEAST_EXPECT(!partialDeleteRan && !destructorRan);
-                setPartialDeleteRan();
-            }
-            if (next == Deleted)
-            {
-                BEAST_EXPECT(!destructorRan);
-                setDestructorRan();
-            }
-        };
-        auto createVecOfPointers = [&](auto const& toClone, std::default_random_engine& eng)
-            -> std::vector<std::variant<SharedIntrusive<TIBase>, WeakIntrusive<TIBase>>> {
-            std::vector<std::variant<SharedIntrusive<TIBase>, WeakIntrusive<TIBase>>> result;
-            std::uniform_int_distribution<> toCreateDist(4, 64);
-            std::uniform_int_distribution<> isStrongDist(0, 1);
-            auto numToCreate = toCreateDist(eng);
-            result.reserve(numToCreate);
-            for (int i = 0; i < numToCreate; ++i)
-            {
-                if (isStrongDist(eng))
-                {
-                    result.emplace_back(SharedIntrusive<TIBase>(toClone));
-                }
-                else
-                {
-                    result.emplace_back(WeakIntrusive<TIBase>(toClone));
-                }
-            }
-            return result;
-        };
-        static constexpr int kLoopIters = 2 * 1024;
-        static constexpr int kNumThreads = 16;
-        std::vector<SharedIntrusive<TIBase>> toClone;
-        Barrier loopStartSyncPoint{kNumThreads};
-        Barrier postCreateToCloneSyncPoint{kNumThreads};
-        Barrier postCreateVecOfPointersSyncPoint{kNumThreads};
-        auto engines = [&]() -> std::vector<std::default_random_engine> {
-            std::random_device rd;
-            std::vector<std::default_random_engine> result;
-            result.reserve(kNumThreads);
-            for (int i = 0; i < kNumThreads; ++i)
-                result.emplace_back(rd());
-            return result;
-        }();
-
-        // cloneAndDestroy clones the strong pointer into a vector of mixed
-        // strong and weak pointers and destroys them all at once.
-        // threadId==0 is special.
-        auto cloneAndDestroy = [&](int threadId) {
-            for (int i = 0; i < kLoopIters; ++i)
-            {
-                // ------ Sync Point ------
-                loopStartSyncPoint.arriveAndWait();
-
-                // only thread 0 should reset the state
-                std::optional<TIBase::ResetStatesGuard> rsg;
-                if (threadId == 0)
-                {
-                    // Thread 0 is the genesis thread. It creates the strong
-                    // pointers to be cloned by the other threads. This
-                    // thread will also check that the destructor ran and
-                    // clear the temporary variables.
-
-                    rsg.emplace(false);
-                    auto [destructorRan, partialDeleteRan] = getDestructorState();
-                    BEAST_EXPECT(!i || destructorRan);
-                    destructionState.store(0, std::memory_order_release);
-
-                    toClone.clear();
-                    toClone.resize(kNumThreads);
-                    auto strong = makeSharedIntrusive<TIBase>();
-                    strong->tracingCallback = tracingCallback;
-                    std::ranges::fill(toClone, strong);
-                }
-
-                // ------ Sync Point ------
-                postCreateToCloneSyncPoint.arriveAndWait();
-
-                auto v = createVecOfPointers(toClone[threadId], engines[threadId]);
-                toClone[threadId].reset();
-
-                // ------ Sync Point ------
-                postCreateVecOfPointersSyncPoint.arriveAndWait();
-
-                v.clear();
-            }
-        };
-        std::vector<std::thread> threads;
-        threads.reserve(kNumThreads);
-        for (int i = 0; i < kNumThreads; ++i)
-        {
-            threads.emplace_back(cloneAndDestroy, i);
-        }
-        for (int i = 0; i < kNumThreads; ++i)
-        {
-            threads[i].join();
-        }
-    }
-
-    void
-    testMultithreadedClearMixedUnion()
-    {
-        testcase("Multithreaded Clear Mixed Union");
-
-        // This test creates and destroys many SharedWeak pointers in a
-        // loop. All the pointers start as strong and a loop randomly
-        // convert them between strong and weak pointers. Both threads clear
-        // all the pointers and check that the invariants hold.
-        //
-        // Note: This test also differs from the test above in that the pointers
-        // randomly change from strong to weak and from weak to strong in a
-        // loop. This can't be done in the variant test above because variant is
-        // not thread safe while the SharedWeakUnion is thread safe.
-
-        using enum TrackedState;
-
-        TIBase::ResetStatesGuard const rsg{true};
-
-        std::atomic<int> destructionState{0};
-        // returns destructorRan and partialDestructorRan (in that order)
-        auto getDestructorState = [&]() -> std::pair<bool, bool> {
-            int const s = destructionState.load(std::memory_order_relaxed);
-            return {(s & 1) != 0, (s & 2) != 0};
-        };
-        auto setDestructorRan = [&]() -> void {
-            destructionState.fetch_or(1, std::memory_order_acq_rel);
-        };
-        auto setPartialDeleteRan = [&]() -> void {
-            destructionState.fetch_or(2, std::memory_order_acq_rel);
-        };
-        auto tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
-            using enum TrackedState;
-            auto [destructorRan, partialDeleteRan] = getDestructorState();
-            if (next == PartiallyDeleted)
-            {
-                BEAST_EXPECT(!partialDeleteRan && !destructorRan);
-                setPartialDeleteRan();
-            }
-            if (next == Deleted)
-            {
-                BEAST_EXPECT(!destructorRan);
-                setDestructorRan();
-            }
-        };
-        auto createVecOfPointers =
-            [&](auto const& toClone,
-                std::default_random_engine& eng) -> std::vector<SharedWeakUnion<TIBase>> {
-            std::vector<SharedWeakUnion<TIBase>> result;
-            std::uniform_int_distribution<> toCreateDist(4, 64);
-            auto numToCreate = toCreateDist(eng);
-            result.reserve(numToCreate);
-            for (int i = 0; i < numToCreate; ++i)
-                result.emplace_back(SharedIntrusive<TIBase>(toClone));
-            return result;
-        };
-        static constexpr int kLoopIters = 2 * 1024;
-        static constexpr int kFlipPointersLoopIters = 256;
-        static constexpr int kNumThreads = 16;
-        std::vector<SharedIntrusive<TIBase>> toClone;
-        Barrier loopStartSyncPoint{kNumThreads};
-        Barrier postCreateToCloneSyncPoint{kNumThreads};
-        Barrier postCreateVecOfPointersSyncPoint{kNumThreads};
-        Barrier postFlipPointersLoopSyncPoint{kNumThreads};
-        auto engines = [&]() -> std::vector<std::default_random_engine> {
-            std::random_device rd;
-            std::vector<std::default_random_engine> result;
-            result.reserve(kNumThreads);
-            for (int i = 0; i < kNumThreads; ++i)
-                result.emplace_back(rd());
-            return result;
-        }();
-
-        // cloneAndDestroy clones the strong pointer into a vector of
-        // mixed strong and weak pointers, runs a loop that randomly
-        // changes strong pointers to weak pointers,  and destroys them
-        // all at once.
-        auto cloneAndDestroy = [&](int threadId) {
-            for (int i = 0; i < kLoopIters; ++i)
-            {
-                // ------ Sync Point ------
-                loopStartSyncPoint.arriveAndWait();
-
-                // only thread 0 should reset the state
-                std::optional<TIBase::ResetStatesGuard> rsg;
-                if (threadId == 0)
-                {
-                    // threadId 0 is the genesis thread. It creates the
-                    // strong point to be cloned by the other threads. This
-                    // thread will also check that the destructor ran and
-                    // clear the temporary variables.
-                    rsg.emplace(false);
-                    auto [destructorRan, partialDeleteRan] = getDestructorState();
-                    BEAST_EXPECT(!i || destructorRan);
-                    destructionState.store(0, std::memory_order_release);
-
-                    toClone.clear();
-                    toClone.resize(kNumThreads);
-                    auto strong = makeSharedIntrusive<TIBase>();
-                    strong->tracingCallback = tracingCallback;
-                    std::ranges::fill(toClone, strong);
-                }
-
-                // ------ Sync Point ------
-                postCreateToCloneSyncPoint.arriveAndWait();
-
-                auto v = createVecOfPointers(toClone[threadId], engines[threadId]);
-                toClone[threadId].reset();
-
-                // ------ Sync Point ------
-                postCreateVecOfPointersSyncPoint.arriveAndWait();
-
-                std::uniform_int_distribution<> isStrongDist(0, 1);
-                for (int f = 0; f < kFlipPointersLoopIters; ++f)
-                {
-                    for (auto& p : v)
-                    {
-                        if (isStrongDist(engines[threadId]))
-                        {
-                            p.convertToStrong();
-                        }
-                        else
-                        {
-                            p.convertToWeak();
-                        }
-                    }
-                }
-
-                // ------ Sync Point ------
-                postFlipPointersLoopSyncPoint.arriveAndWait();
-
-                v.clear();
-            }
-        };
-        std::vector<std::thread> threads;
-        threads.reserve(kNumThreads);
-        for (int i = 0; i < kNumThreads; ++i)
-        {
-            threads.emplace_back(cloneAndDestroy, i);
-        }
-        for (int i = 0; i < kNumThreads; ++i)
-        {
-            threads[i].join();
-        }
-    }
-
-    void
-    testMultithreadedLockingWeak()
-    {
-        testcase("Multithreaded Locking Weak");
-
-        // This test creates a single shared atomic pointer that multiple thread
-        // create weak pointers from. The threads then lock the weak pointers.
-        // Both threads clear all the pointers and check that the invariants
-        // hold.
-
-        using enum TrackedState;
-
-        TIBase::ResetStatesGuard const rsg{true};
-
-        std::atomic<int> destructionState{0};
-        // returns destructorRan and partialDestructorRan (in that order)
-        auto getDestructorState = [&]() -> std::pair<bool, bool> {
-            int const s = destructionState.load(std::memory_order_relaxed);
-            return {(s & 1) != 0, (s & 2) != 0};
-        };
-        auto setDestructorRan = [&]() -> void {
-            destructionState.fetch_or(1, std::memory_order_acq_rel);
-        };
-        auto setPartialDeleteRan = [&]() -> void {
-            destructionState.fetch_or(2, std::memory_order_acq_rel);
-        };
-        auto tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
-            using enum TrackedState;
-            auto [destructorRan, partialDeleteRan] = getDestructorState();
-            if (next == PartiallyDeleted)
-            {
-                BEAST_EXPECT(!partialDeleteRan && !destructorRan);
-                setPartialDeleteRan();
-            }
-            if (next == Deleted)
-            {
-                BEAST_EXPECT(!destructorRan);
-                setDestructorRan();
-            }
-        };
-
-        static constexpr int kLoopIters = 2 * 1024;
-        static constexpr int kLockWeakLoopIters = 256;
-        static constexpr int kNumThreads = 16;
-        std::vector<SharedIntrusive<TIBase>> toLock;
-        Barrier loopStartSyncPoint{kNumThreads};
-        Barrier postCreateToLockSyncPoint{kNumThreads};
-        Barrier postLockWeakLoopSyncPoint{kNumThreads};
-
-        // lockAndDestroy creates weak pointers from the strong pointer
-        // and runs a loop that locks the weak pointer. At the end of the loop
-        // all the pointers are destroyed all at once.
-        auto lockAndDestroy = [&](int threadId) {
-            for (int i = 0; i < kLoopIters; ++i)
-            {
-                // ------ Sync Point ------
-                loopStartSyncPoint.arriveAndWait();
-
-                // only thread 0 should reset the state
-                std::optional<TIBase::ResetStatesGuard> rsg;
-                if (threadId == 0)
-                {
-                    // threadId 0 is the genesis thread. It creates the
-                    // strong point to be locked by the other threads. This
-                    // thread will also check that the destructor ran and
-                    // clear the temporary variables.
-                    rsg.emplace(false);
-                    auto [destructorRan, partialDeleteRan] = getDestructorState();
-                    BEAST_EXPECT(!i || destructorRan);
-                    destructionState.store(0, std::memory_order_release);
-
-                    toLock.clear();
-                    toLock.resize(kNumThreads);
-                    auto strong = makeSharedIntrusive<TIBase>();
-                    strong->tracingCallback = tracingCallback;
-                    std::ranges::fill(toLock, strong);
-                }
-
-                // ------ Sync Point ------
-                postCreateToLockSyncPoint.arriveAndWait();
-
-                // Multiple threads all create a weak pointer from the same
-                // strong pointer
-                WeakIntrusive const weak{toLock[threadId]};
-                for (int wi = 0; wi < kLockWeakLoopIters; ++wi)
-                {
-                    BEAST_EXPECT(!weak.expired());
-                    auto strong = weak.lock();
-                    BEAST_EXPECT(strong);
-                }
-
-                // ------ Sync Point ------
-                postLockWeakLoopSyncPoint.arriveAndWait();
-
-                toLock[threadId].reset();
-            }
-        };
-        std::vector<std::thread> threads;
-        threads.reserve(kNumThreads);
-        for (int i = 0; i < kNumThreads; ++i)
-        {
-            threads.emplace_back(lockAndDestroy, i);
-        }
-        for (int i = 0; i < kNumThreads; ++i)
-        {
-            threads[i].join();
-        }
-    }
-
-    void
-    run() override
-    {
-        testBasics();
-        testPartialDelete();
-        testDestructor();
-        testMultithreadedClearMixedVariant();
-        testMultithreadedClearMixedUnion();
-        testMultithreadedLockingWeak();
-    }
-};  // namespace tests
-
-BEAST_DEFINE_TESTSUITE(IntrusiveShared, basics, xrpl);
-}  // namespace xrpl::tests
diff --git a/src/test/basics/KeyCache_test.cpp b/src/test/basics/KeyCache_test.cpp
deleted file mode 100644
index e83ae4c277..0000000000
--- a/src/test/basics/KeyCache_test.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-#include <test/unit_test/SuiteJournal.h>
-
-#include <xrpl/basics/TaggedCache.h>
-#include <xrpl/basics/TaggedCache.ipp>  // IWYU pragma: keep
-#include <xrpl/basics/chrono.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/protocol/Protocol.h>
-
-#include <string>
-
-namespace xrpl {
-
-class KeyCache_test : public beast::unit_test::Suite
-{
-public:
-    void
-    run() override
-    {
-        using namespace std::chrono_literals;
-        TestStopwatch clock;
-        clock.set(0);
-
-        using Key = std::string;
-        using Cache = TaggedCache<Key, int, true>;
-
-        test::SuiteJournal j("KeyCacheTest", *this);
-
-        // Insert an item, retrieve it, and age it so it gets purged.
-        {
-            Cache c("test", LedgerIndex(1), 2s, clock, j);
-
-            BEAST_EXPECT(c.size() == 0);
-            BEAST_EXPECT(c.insert("one"));
-            BEAST_EXPECT(!c.insert("one"));
-            BEAST_EXPECT(c.size() == 1);
-            BEAST_EXPECT(c.touchIfExists("one"));
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.size() == 1);
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.size() == 0);
-            BEAST_EXPECT(!c.touchIfExists("one"));
-        }
-
-        // Insert two items, have one expire
-        {
-            Cache c("test", LedgerIndex(2), 2s, clock, j);
-
-            BEAST_EXPECT(c.insert("one"));
-            BEAST_EXPECT(c.size() == 1);
-            BEAST_EXPECT(c.insert("two"));
-            BEAST_EXPECT(c.size() == 2);
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.size() == 2);
-            BEAST_EXPECT(c.touchIfExists("two"));
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.size() == 1);
-        }
-
-        // Insert three items (1 over limit), sweep
-        {
-            Cache c("test", LedgerIndex(2), 3s, clock, j);
-
-            BEAST_EXPECT(c.insert("one"));
-            ++clock;
-            BEAST_EXPECT(c.insert("two"));
-            ++clock;
-            BEAST_EXPECT(c.insert("three"));
-            ++clock;
-            BEAST_EXPECT(c.size() == 3);
-            c.sweep();
-            BEAST_EXPECT(c.size() < 3);
-        }
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(KeyCache, basics, xrpl);
-
-}  // namespace xrpl
diff --git a/src/test/basics/StringUtilities_test.cpp b/src/test/basics/StringUtilities_test.cpp
deleted file mode 100644
index e12bc53857..0000000000
--- a/src/test/basics/StringUtilities_test.cpp
+++ /dev/null
@@ -1,309 +0,0 @@
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/StringUtilities.h>
-#include <xrpl/basics/ToString.h>
-#include <xrpl/beast/unit_test/suite.h>
-
-#include <string>
-
-namespace xrpl {
-
-class StringUtilities_test : public beast::unit_test::Suite
-{
-public:
-    void
-    testUnHexSuccess(std::string const& strIn, std::string const& strExpected)
-    {
-        auto rv = strUnHex(strIn);
-        BEAST_EXPECT(rv);
-
-        // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
-        BEAST_EXPECT(makeSlice(*rv) == makeSlice(strExpected));
-    }
-
-    void
-    testUnHexFailure(std::string const& strIn)
-    {
-        auto rv = strUnHex(strIn);
-        BEAST_EXPECT(!rv);
-    }
-
-    void
-    testUnHex()
-    {
-        testcase("strUnHex");
-
-        testUnHexSuccess("526970706c6544", "RippleD");
-        testUnHexSuccess("A", "\n");
-        testUnHexSuccess("0A", "\n");
-        testUnHexSuccess("D0A", "\r\n");
-        testUnHexSuccess("0D0A", "\r\n");
-        testUnHexSuccess("200D0A", " \r\n");
-        testUnHexSuccess("282A2B2C2D2E2F29", "(*+,-./)");
-
-        // Check for things which contain some or only invalid characters
-        testUnHexFailure("123X");
-        testUnHexFailure("V");
-        testUnHexFailure("XRP");
-    }
-
-    void
-    testParseUrl()
-    {
-        testcase("parseUrl");
-
-        // Expected passes.
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain.empty());
-            BEAST_EXPECT(!pUrl.port);
-            // RFC 3986:
-            // > In general, a URI that uses the generic syntax for authority
-            //   with an empty path should be normalized to a path of "/".
-            // Do we want to normalize paths?
-            BEAST_EXPECT(pUrl.path.empty());
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme:///"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain.empty());
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "lower://domain"));
-            BEAST_EXPECT(pUrl.scheme == "lower");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path.empty());
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "UPPER://domain:234/"));
-            BEAST_EXPECT(pUrl.scheme == "upper");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(*pUrl.port == 234);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT(pUrl.path == "/");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "Mixed://domain/path"));
-            BEAST_EXPECT(pUrl.scheme == "mixed");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/path");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://[::1]:123/path"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "::1");
-            BEAST_EXPECT(*pUrl.port == 123);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT(pUrl.path == "/path");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://user:pass@domain:123/abc:321"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username == "user");
-            BEAST_EXPECT(pUrl.password == "pass");
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(*pUrl.port == 123);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT(pUrl.path == "/abc:321");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://user@domain:123/abc:321"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username == "user");
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(*pUrl.port == 123);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT(pUrl.path == "/abc:321");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://:pass@domain:123/abc:321"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password == "pass");
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(*pUrl.port == 123);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT(pUrl.path == "/abc:321");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://domain:123/abc:321"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(*pUrl.port == 123);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT(pUrl.path == "/abc:321");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://user:pass@domain/abc:321"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username == "user");
-            BEAST_EXPECT(pUrl.password == "pass");
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/abc:321");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://user@domain/abc:321"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username == "user");
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/abc:321");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://:pass@domain/abc:321"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password == "pass");
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/abc:321");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://domain/abc:321"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/abc:321");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme:///path/to/file"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain.empty());
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/path/to/file");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://user:pass@domain/path/with/an@sign"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username == "user");
-            BEAST_EXPECT(pUrl.password == "pass");
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/path/with/an@sign");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://domain/path/with/an@sign"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "domain");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/path/with/an@sign");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "scheme://:999/"));
-            BEAST_EXPECT(pUrl.scheme == "scheme");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == ":999");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/");
-        }
-
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(parseUrl(pUrl, "http://::1:1234/validators"));
-            BEAST_EXPECT(pUrl.scheme == "http");
-            BEAST_EXPECT(pUrl.username.empty());
-            BEAST_EXPECT(pUrl.password.empty());
-            BEAST_EXPECT(pUrl.domain == "::0.1.18.52");
-            BEAST_EXPECT(!pUrl.port);
-            BEAST_EXPECT(pUrl.path == "/validators");
-        }
-
-        // Expected fails.
-        {
-            ParsedUrl pUrl;
-            BEAST_EXPECT(!parseUrl(pUrl, ""));
-            BEAST_EXPECT(!parseUrl(pUrl, "nonsense"));
-            BEAST_EXPECT(!parseUrl(pUrl, "://"));
-            BEAST_EXPECT(!parseUrl(pUrl, ":///"));
-            BEAST_EXPECT(!parseUrl(pUrl, "scheme://user:pass@domain:65536/abc:321"));
-            BEAST_EXPECT(!parseUrl(pUrl, "UPPER://domain:23498765/"));
-            BEAST_EXPECT(!parseUrl(pUrl, "UPPER://domain:0/"));
-            BEAST_EXPECT(!parseUrl(pUrl, "UPPER://domain:+7/"));
-            BEAST_EXPECT(!parseUrl(pUrl, "UPPER://domain:-7234/"));
-            BEAST_EXPECT(!parseUrl(pUrl, "UPPER://domain:@#$56!/"));
-        }
-
-        {
-            std::string const strUrl("s://" + std::string(8192, ':'));
-            ParsedUrl pUrl;
-            BEAST_EXPECT(!parseUrl(pUrl, strUrl));
-        }
-    }
-
-    void
-    testToString()
-    {
-        testcase("toString");
-        auto result = to_string("hello");
-        BEAST_EXPECT(result == "hello");
-    }
-
-    void
-    run() override
-    {
-        testParseUrl();
-        testUnHex();
-        testToString();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(StringUtilities, basics, xrpl);
-
-}  // namespace xrpl
diff --git a/src/test/basics/TaggedCache_test.cpp b/src/test/basics/TaggedCache_test.cpp
deleted file mode 100644
index 26564a4de8..0000000000
--- a/src/test/basics/TaggedCache_test.cpp
+++ /dev/null
@@ -1,251 +0,0 @@
-#include <test/unit_test/SuiteJournal.h>
-
-#include <xrpl/basics/IntrusivePointer.h>
-#include <xrpl/basics/IntrusiveRefCounts.h>
-#include <xrpl/basics/TaggedCache.h>
-#include <xrpl/basics/TaggedCache.ipp>  // IWYU pragma: keep
-#include <xrpl/basics/chrono.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/protocol/Protocol.h>
-
-#include <memory>
-#include <utility>
-
-namespace xrpl {
-
-/*
-I guess you can put some items in, make sure they're still there. Let some
-time pass, make sure they're gone. Keep a strong pointer to one of them, make
-sure you can still find it even after time passes. Create two objects with
-the same key, canonicalize them both and make sure you get the same object.
-Put an object in but keep a strong pointer to it, advance the clock a lot,
-then canonicalize a new object with the same key, make sure you get the
-original object.
-*/
-
-class TaggedCache_test : public beast::unit_test::Suite
-{
-public:
-    void
-    run() override
-    {
-        using namespace std::chrono_literals;
-        using beast::Severity;
-        test::SuiteJournal journal("TaggedCache_test", *this);
-
-        TestStopwatch clock;
-        clock.set(0);
-
-        using Key = LedgerIndex;
-        using Value = std::string;
-        using Cache = TaggedCache<Key, Value>;
-
-        Cache c("test", 1, 1s, clock, journal);
-
-        // Insert an item, retrieve it, and age it so it gets purged.
-        {
-            BEAST_EXPECT(c.getCacheSize() == 0);
-            BEAST_EXPECT(c.getTrackSize() == 0);
-            BEAST_EXPECT(!c.insert(1, "one"));
-            BEAST_EXPECT(c.getCacheSize() == 1);
-            BEAST_EXPECT(c.getTrackSize() == 1);
-
-            {
-                std::string s;
-                BEAST_EXPECT(c.retrieve(1, s));
-                BEAST_EXPECT(s == "one");
-            }
-
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.getCacheSize() == 0);
-            BEAST_EXPECT(c.getTrackSize() == 0);
-        }
-
-        // Insert an item, maintain a strong pointer, age it, and
-        // verify that the entry still exists.
-        {
-            BEAST_EXPECT(!c.insert(2, "two"));
-            BEAST_EXPECT(c.getCacheSize() == 1);
-            BEAST_EXPECT(c.getTrackSize() == 1);
-
-            {
-                auto p = c.fetch(2);
-                BEAST_EXPECT(p != nullptr);
-                ++clock;
-                c.sweep();
-                BEAST_EXPECT(c.getCacheSize() == 0);
-                BEAST_EXPECT(c.getTrackSize() == 1);
-            }
-
-            // Make sure its gone now that our reference is gone
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.getCacheSize() == 0);
-            BEAST_EXPECT(c.getTrackSize() == 0);
-        }
-
-        // Insert the same key/value pair and make sure we get the same result
-        {
-            BEAST_EXPECT(!c.insert(3, "three"));
-
-            {
-                auto const p1 = c.fetch(3);
-                auto p2 = std::make_shared<Value>("three");
-                c.canonicalizeReplaceClient(3, p2);
-                BEAST_EXPECT(p1.get() == p2.get());
-            }
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.getCacheSize() == 0);
-            BEAST_EXPECT(c.getTrackSize() == 0);
-        }
-
-        // Put an object in but keep a strong pointer to it, advance the clock a
-        // lot, then canonicalize a new object with the same key, make sure you
-        // get the original object.
-        {
-            // Put an object in
-            BEAST_EXPECT(!c.insert(4, "four"));
-            BEAST_EXPECT(c.getCacheSize() == 1);
-            BEAST_EXPECT(c.getTrackSize() == 1);
-
-            {
-                // Keep a strong pointer to it
-                auto const p1 = c.fetch(4);
-                BEAST_EXPECT(p1 != nullptr);
-                BEAST_EXPECT(c.getCacheSize() == 1);
-                BEAST_EXPECT(c.getTrackSize() == 1);
-                // Advance the clock a lot
-                ++clock;
-                c.sweep();
-                BEAST_EXPECT(c.getCacheSize() == 0);
-                BEAST_EXPECT(c.getTrackSize() == 1);
-                // Canonicalize a new object with the same key
-                auto p2 = std::make_shared<std::string>("four");
-                BEAST_EXPECT(c.canonicalizeReplaceClient(4, p2));
-                BEAST_EXPECT(c.getCacheSize() == 1);
-                BEAST_EXPECT(c.getTrackSize() == 1);
-                // Make sure we get the original object
-                BEAST_EXPECT(p1.get() == p2.get());
-            }
-
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.getCacheSize() == 0);
-            BEAST_EXPECT(c.getTrackSize() == 0);
-        }
-        {
-            BEAST_EXPECT(!c.insert(5, "five"));
-            BEAST_EXPECT(c.getCacheSize() == 1);
-            BEAST_EXPECT(c.size() == 1);
-
-            {
-                auto const p1 = c.fetch(5);
-                BEAST_EXPECT(p1 != nullptr);
-                BEAST_EXPECT(c.getCacheSize() == 1);
-                BEAST_EXPECT(c.size() == 1);
-
-                // Advance the clock a lot
-                ++clock;
-                c.sweep();
-                BEAST_EXPECT(c.getCacheSize() == 0);
-                BEAST_EXPECT(c.size() == 1);
-
-                auto p2 = std::make_shared<std::string>("five_2");
-                BEAST_EXPECT(c.canonicalizeReplaceCache(5, p2));
-                BEAST_EXPECT(c.getCacheSize() == 1);
-                BEAST_EXPECT(c.size() == 1);
-                // Make sure the caller's original pointer is unchanged
-                BEAST_EXPECT(p1.get() != p2.get());
-                BEAST_EXPECT(*p2 == "five_2");
-
-                auto const p3 = c.fetch(5);
-                BEAST_EXPECT(p3 != nullptr);
-                BEAST_EXPECT(p3.get() == p2.get());
-                BEAST_EXPECT(p3.get() != p1.get());
-            }
-
-            ++clock;
-            c.sweep();
-            BEAST_EXPECT(c.getCacheSize() == 0);
-            BEAST_EXPECT(c.size() == 0);
-        }
-
-        {
-            testcase("intrptr");
-
-            struct MyRefCountObject : IntrusiveRefCounts
-            {
-                std::string data;
-
-                // Needed to support weak intrusive pointers
-                virtual void
-                partialDestructor() {};
-
-                MyRefCountObject() = default;
-                explicit MyRefCountObject(std::string data) : data(std::move(data))
-                {
-                }
-
-                bool
-                operator==(std::string const& other) const
-                {
-                    return data == other;
-                }
-            };
-
-            using IntrPtrCache = TaggedCache<
-                Key,
-                MyRefCountObject,
-                /*IsKeyCache*/ false,
-                intr_ptr::SharedWeakUnionPtr<MyRefCountObject>,
-                intr_ptr::SharedPtr<MyRefCountObject>>;
-
-            IntrPtrCache intrPtrCache("IntrPtrTest", 1, 1s, clock, journal);
-
-            intrPtrCache.canonicalizeReplaceCache(1, intr_ptr::makeShared<MyRefCountObject>("one"));
-            BEAST_EXPECT(intrPtrCache.getCacheSize() == 1);
-            BEAST_EXPECT(intrPtrCache.size() == 1);
-
-            {
-                {
-                    intrPtrCache.canonicalizeReplaceCache(
-                        1, intr_ptr::makeShared<MyRefCountObject>("one_replaced"));
-
-                    auto p = intrPtrCache.fetch(1);
-                    BEAST_EXPECT(*p == "one_replaced");
-
-                    // Advance the clock a lot
-                    ++clock;
-                    intrPtrCache.sweep();
-                    BEAST_EXPECT(intrPtrCache.getCacheSize() == 0);
-                    BEAST_EXPECT(intrPtrCache.size() == 1);
-
-                    intrPtrCache.canonicalizeReplaceCache(
-                        1, intr_ptr::makeShared<MyRefCountObject>("one_replaced_2"));
-
-                    auto p2 = intrPtrCache.fetch(1);
-                    BEAST_EXPECT(*p2 == "one_replaced_2");
-
-                    intrPtrCache.del(1, true);
-                }
-
-                intrPtrCache.canonicalizeReplaceCache(
-                    1, intr_ptr::makeShared<MyRefCountObject>("one_replaced_3"));
-                auto p3 = intrPtrCache.fetch(1);
-                BEAST_EXPECT(*p3 == "one_replaced_3");
-            }
-
-            ++clock;
-            intrPtrCache.sweep();
-            BEAST_EXPECT(intrPtrCache.getCacheSize() == 0);
-            BEAST_EXPECT(intrPtrCache.size() == 0);
-        }
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(TaggedCache, basics, xrpl);
-
-}  // namespace xrpl
diff --git a/src/test/basics/Units_test.cpp b/src/test/basics/Units_test.cpp
deleted file mode 100644
index dc780166c6..0000000000
--- a/src/test/basics/Units_test.cpp
+++ /dev/null
@@ -1,344 +0,0 @@
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Zero.h>
-#include <xrpl/json/json_value.h>
-#include <xrpl/protocol/SystemParameters.h>
-#include <xrpl/protocol/Units.h>
-#include <xrpl/protocol/XRPAmount.h>
-
-#include <cstdint>
-#include <limits>
-#include <type_traits>
-
-namespace xrpl::test {
-
-class units_test : public beast::unit_test::Suite
-{
-private:
-    void
-    testTypes()
-    {
-        using FeeLevel32 = FeeLevel<std::uint32_t>;
-
-        {
-            XRPAmount const x{100};
-            BEAST_EXPECT(x.drops() == 100);
-            BEAST_EXPECT((std::is_same_v<decltype(x)::unit_type, unit::dropTag>));
-            auto y = 4u * x;
-            BEAST_EXPECT(y.value() == 400);
-            BEAST_EXPECT((std::is_same_v<decltype(y)::unit_type, unit::dropTag>));
-
-            auto z = 4 * y;
-            BEAST_EXPECT(z.value() == 1600);
-            BEAST_EXPECT((std::is_same_v<decltype(z)::unit_type, unit::dropTag>));
-
-            FeeLevel32 const f{10};
-            FeeLevel32 const baseFee{100};
-
-            auto drops = mulDiv(baseFee, x, f);
-
-            BEAST_EXPECT(drops);
-            BEAST_EXPECT(drops.value() == 1000);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT((std::is_same_v<
-                          std::remove_reference_t<decltype(*drops)>::unit_type,
-                          unit::dropTag>));
-
-            BEAST_EXPECT((std::is_same_v<std::remove_reference_t<decltype(*drops)>, XRPAmount>));
-        }
-        {
-            XRPAmount const x{100};
-            BEAST_EXPECT(x.value() == 100);
-            BEAST_EXPECT((std::is_same_v<decltype(x)::unit_type, unit::dropTag>));
-            auto y = 4u * x;
-            BEAST_EXPECT(y.value() == 400);
-            BEAST_EXPECT((std::is_same_v<decltype(y)::unit_type, unit::dropTag>));
-
-            FeeLevel64 const f{10};
-            FeeLevel64 const baseFee{100};
-
-            auto drops = mulDiv(baseFee, x, f);
-
-            BEAST_EXPECT(drops);
-            BEAST_EXPECT(drops.value() == 1000);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT((std::is_same_v<
-                          std::remove_reference_t<decltype(*drops)>::unit_type,
-                          unit::dropTag>));
-            BEAST_EXPECT((std::is_same_v<std::remove_reference_t<decltype(*drops)>, XRPAmount>));
-        }
-        {
-            FeeLevel64 const x{1024};
-            BEAST_EXPECT(x.value() == 1024);
-            BEAST_EXPECT((std::is_same_v<decltype(x)::unit_type, unit::feelevelTag>));
-            std::uint64_t const m = 4;
-            auto y = m * x;
-            BEAST_EXPECT(y.value() == 4096);
-            BEAST_EXPECT((std::is_same_v<decltype(y)::unit_type, unit::feelevelTag>));
-
-            XRPAmount const basefee{10};
-            FeeLevel64 const referencefee{256};
-
-            auto drops = mulDiv(x, basefee, referencefee);
-
-            BEAST_EXPECT(drops);
-            BEAST_EXPECT(drops.value() == 40);  // NOLINT(bugprone-unchecked-optional-access)
-            BEAST_EXPECT((std::is_same_v<
-                          std::remove_reference_t<decltype(*drops)>::unit_type,
-                          unit::dropTag>));
-            BEAST_EXPECT((std::is_same_v<std::remove_reference_t<decltype(*drops)>, XRPAmount>));
-        }
-    }
-
-    void
-    testJson()
-    {
-        // Json value functionality
-        using FeeLevel32 = FeeLevel<std::uint32_t>;
-
-        {
-            FeeLevel32 const x{std::numeric_limits<std::uint32_t>::max()};
-            auto y = x.jsonClipped();
-            BEAST_EXPECT(y.type() == json::ValueType::UInt);
-            BEAST_EXPECT(y == json::Value{x.fee()});
-        }
-
-        {
-            FeeLevel32 const x{std::numeric_limits<std::uint32_t>::min()};
-            auto y = x.jsonClipped();
-            BEAST_EXPECT(y.type() == json::ValueType::UInt);
-            BEAST_EXPECT(y == json::Value{x.fee()});
-        }
-
-        {
-            FeeLevel64 const x{std::numeric_limits<std::uint64_t>::max()};
-            auto y = x.jsonClipped();
-            BEAST_EXPECT(y.type() == json::ValueType::UInt);
-            BEAST_EXPECT(y == json::Value{std::numeric_limits<std::uint32_t>::max()});
-        }
-
-        {
-            FeeLevel64 const x{std::numeric_limits<std::uint64_t>::min()};
-            auto y = x.jsonClipped();
-            BEAST_EXPECT(y.type() == json::ValueType::UInt);
-            BEAST_EXPECT(y == json::Value{0});
-        }
-
-        {
-            FeeLevelDouble const x{std::numeric_limits<double>::max()};
-            auto y = x.jsonClipped();
-            BEAST_EXPECT(y.type() == json::ValueType::Real);
-            BEAST_EXPECT(y == json::Value{std::numeric_limits<double>::max()});
-        }
-
-        {
-            FeeLevelDouble const x{std::numeric_limits<double>::min()};
-            auto y = x.jsonClipped();
-            BEAST_EXPECT(y.type() == json::ValueType::Real);
-            BEAST_EXPECT(y == json::Value{std::numeric_limits<double>::min()});
-        }
-
-        {
-            XRPAmount const x{std::numeric_limits<std::int64_t>::max()};
-            auto y = x.jsonClipped();
-            BEAST_EXPECT(y.type() == json::ValueType::Int);
-            BEAST_EXPECT(y == json::Value{std::numeric_limits<std::int32_t>::max()});
-        }
-
-        {
-            XRPAmount const x{std::numeric_limits<std::int64_t>::min()};
-            auto y = x.jsonClipped();
-            BEAST_EXPECT(y.type() == json::ValueType::Int);
-            BEAST_EXPECT(y == json::Value{std::numeric_limits<std::int32_t>::min()});
-        }
-    }
-
-    void
-    testFunctions()
-    {
-        // Explicitly test every defined function for the ValueUnit class
-        // since some of them are templated, but not used anywhere else.
-        using FeeLevel32 = FeeLevel<std::uint32_t>;
-
-        {
-            auto make = [&](auto x) -> FeeLevel64 { return x; };
-            auto explicitmake = [&](auto x) -> FeeLevel64 { return FeeLevel64{x}; };
-
-            [[maybe_unused]]
-            FeeLevel64 const defaulted{};
-            FeeLevel64 test{0};
-            BEAST_EXPECT(test.fee() == 0);
-
-            test = explicitmake(beast::kZero);
-            BEAST_EXPECT(test.fee() == 0);
-
-            test = beast::kZero;
-            BEAST_EXPECT(test.fee() == 0);
-
-            test = explicitmake(100u);
-            BEAST_EXPECT(test.fee() == 100);
-
-            FeeLevel64 const targetSame{200u};
-            FeeLevel32 const targetOther{300u};
-            test = make(targetSame);
-            BEAST_EXPECT(test.fee() == 200);
-            BEAST_EXPECT(test == targetSame);
-            BEAST_EXPECT(test < FeeLevel64{1000});
-            BEAST_EXPECT(test > FeeLevel64{100});
-            test = make(targetOther);
-            BEAST_EXPECT(test.fee() == 300);
-            BEAST_EXPECT(test == targetOther);
-
-            test = std::uint64_t(200);
-            BEAST_EXPECT(test.fee() == 200);
-            test = std::uint32_t(300);
-            BEAST_EXPECT(test.fee() == 300);
-
-            test = targetSame;
-            BEAST_EXPECT(test.fee() == 200);
-            test = targetOther.fee();
-            BEAST_EXPECT(test.fee() == 300);
-            BEAST_EXPECT(test == targetOther);
-
-            test = targetSame * 2;
-            BEAST_EXPECT(test.fee() == 400);
-            test = 3 * targetSame;
-            BEAST_EXPECT(test.fee() == 600);
-            test = targetSame / 10;
-            BEAST_EXPECT(test.fee() == 20);
-
-            test += targetSame;
-            BEAST_EXPECT(test.fee() == 220);
-
-            test -= targetSame;
-            BEAST_EXPECT(test.fee() == 20);
-
-            test++;
-            BEAST_EXPECT(test.fee() == 21);
-            ++test;
-            BEAST_EXPECT(test.fee() == 22);
-            test--;
-            BEAST_EXPECT(test.fee() == 21);
-            --test;
-            BEAST_EXPECT(test.fee() == 20);
-
-            test *= 5;
-            BEAST_EXPECT(test.fee() == 100);
-            test /= 2;
-            BEAST_EXPECT(test.fee() == 50);
-            test %= 13;
-            BEAST_EXPECT(test.fee() == 11);
-
-            /*
-            // illegal with unsigned
-            test = -test;
-            BEAST_EXPECT(test.fee() == -11);
-            BEAST_EXPECT(test.signum() == -1);
-            BEAST_EXPECT(to_string(test) == "-11");
-            */
-
-            BEAST_EXPECT(test);
-            test = 0;
-            BEAST_EXPECT(!test);
-            BEAST_EXPECT(test.signum() == 0);
-            test = targetSame;
-            BEAST_EXPECT(test.signum() == 1);
-            BEAST_EXPECT(to_string(test) == "200");
-        }
-        {
-            auto make = [&](auto x) -> FeeLevelDouble { return x; };
-            auto explicitmake = [&](auto x) -> FeeLevelDouble { return FeeLevelDouble{x}; };
-
-            [[maybe_unused]]
-            FeeLevelDouble const defaulted{};
-            FeeLevelDouble test{0};
-            BEAST_EXPECT(test.fee() == 0);
-
-            test = explicitmake(beast::kZero);
-            BEAST_EXPECT(test.fee() == 0);
-
-            test = beast::kZero;
-            BEAST_EXPECT(test.fee() == 0);
-
-            test = explicitmake(100.0);
-            BEAST_EXPECT(test.fee() == 100);
-
-            FeeLevelDouble const targetSame{200.0};
-            FeeLevel64 const targetOther{300};
-            test = make(targetSame);
-            BEAST_EXPECT(test.fee() == 200);
-            BEAST_EXPECT(test == targetSame);
-            BEAST_EXPECT(test < FeeLevelDouble{1000.0});
-            BEAST_EXPECT(test > FeeLevelDouble{100.0});
-            test = targetOther.fee();
-            BEAST_EXPECT(test.fee() == 300);
-            BEAST_EXPECT(test == targetOther);
-
-            test = 200.0;
-            BEAST_EXPECT(test.fee() == 200);
-            test = std::uint64_t(300);
-            BEAST_EXPECT(test.fee() == 300);
-
-            test = targetSame;
-            BEAST_EXPECT(test.fee() == 200);
-
-            test = targetSame * 2;
-            BEAST_EXPECT(test.fee() == 400);
-            test = 3 * targetSame;
-            BEAST_EXPECT(test.fee() == 600);
-            test = targetSame / 10;
-            BEAST_EXPECT(test.fee() == 20);
-
-            test += targetSame;
-            BEAST_EXPECT(test.fee() == 220);
-
-            test -= targetSame;
-            BEAST_EXPECT(test.fee() == 20);
-
-            test++;
-            BEAST_EXPECT(test.fee() == 21);
-            ++test;
-            BEAST_EXPECT(test.fee() == 22);
-            test--;
-            BEAST_EXPECT(test.fee() == 21);
-            --test;
-            BEAST_EXPECT(test.fee() == 20);
-
-            test *= 5;
-            BEAST_EXPECT(test.fee() == 100);
-            test /= 2;
-            BEAST_EXPECT(test.fee() == 50);
-            /* illegal with floating
-            test %= 13;
-            BEAST_EXPECT(test.fee() == 11);
-            */
-
-            // legal with signed
-            test = -test;
-            BEAST_EXPECT(test.fee() == -50);
-            BEAST_EXPECT(test.signum() == -1);
-            BEAST_EXPECT(to_string(test) == "-50.000000");
-
-            BEAST_EXPECT(test);
-            test = 0;
-            BEAST_EXPECT(!test);
-            BEAST_EXPECT(test.signum() == 0);
-            test = targetSame;
-            BEAST_EXPECT(test.signum() == 1);
-            BEAST_EXPECT(to_string(test) == "200.000000");
-        }
-    }
-
-public:
-    void
-    run() override
-    {
-        BEAST_EXPECT(kInitialXrp.drops() == 100'000'000'000'000'000);
-        BEAST_EXPECT(kInitialXrp == XRPAmount{100'000'000'000'000'000});
-
-        testTypes();
-        testJson();
-        testFunctions();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(units, basics, xrpl);
-
-}  // namespace xrpl::test
diff --git a/src/test/basics/XRPAmount_test.cpp b/src/test/basics/XRPAmount_test.cpp
deleted file mode 100644
index f393003365..0000000000
--- a/src/test/basics/XRPAmount_test.cpp
+++ /dev/null
@@ -1,326 +0,0 @@
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Zero.h>
-#include <xrpl/protocol/XRPAmount.h>
-
-#include <cstdint>
-#include <limits>
-
-namespace xrpl {
-
-class XRPAmount_test : public beast::unit_test::Suite
-{
-public:
-    void
-    testSigNum()
-    {
-        testcase("signum");
-
-        for (auto i : {-1, 0, 1})
-        {
-            XRPAmount const x(i);
-
-            if (i < 0)
-            {
-                BEAST_EXPECT(x.signum() < 0);
-            }
-            else if (i > 0)
-            {
-                BEAST_EXPECT(x.signum() > 0);
-            }
-            else
-            {
-                BEAST_EXPECT(x.signum() == 0);
-            }
-        }
-    }
-
-    void
-    testBeastZero()
-    {
-        testcase("beast::Zero Comparisons");
-
-        using beast::kZero;
-
-        for (auto i : {-1, 0, 1})
-        {
-            XRPAmount const x(i);
-
-            BEAST_EXPECT((i == 0) == (x == kZero));
-            BEAST_EXPECT((i != 0) == (x != kZero));
-            BEAST_EXPECT((i < 0) == (x < kZero));
-            BEAST_EXPECT((i > 0) == (x > kZero));
-            BEAST_EXPECT((i <= 0) == (x <= kZero));
-            BEAST_EXPECT((i >= 0) == (x >= kZero));
-
-            BEAST_EXPECT((0 == i) == (kZero == x));
-            BEAST_EXPECT((0 != i) == (kZero != x));
-            BEAST_EXPECT((0 < i) == (kZero < x));
-            BEAST_EXPECT((0 > i) == (kZero > x));
-            BEAST_EXPECT((0 <= i) == (kZero <= x));
-            BEAST_EXPECT((0 >= i) == (kZero >= x));
-        }
-    }
-
-    void
-    testComparisons()
-    {
-        testcase("XRP Comparisons");
-
-        for (auto i : {-1, 0, 1})
-        {
-            XRPAmount const x(i);
-
-            for (auto j : {-1, 0, 1})
-            {
-                XRPAmount const y(j);
-
-                BEAST_EXPECT((i == j) == (x == y));
-                BEAST_EXPECT((i != j) == (x != y));
-                BEAST_EXPECT((i < j) == (x < y));
-                BEAST_EXPECT((i > j) == (x > y));
-                BEAST_EXPECT((i <= j) == (x <= y));
-                BEAST_EXPECT((i >= j) == (x >= y));
-            }
-        }
-    }
-
-    void
-    testAddSub()
-    {
-        testcase("Addition & Subtraction");
-
-        for (auto i : {-1, 0, 1})
-        {
-            XRPAmount const x(i);
-
-            for (auto j : {-1, 0, 1})
-            {
-                XRPAmount const y(j);
-
-                BEAST_EXPECT(XRPAmount(i + j) == (x + y));
-                BEAST_EXPECT(XRPAmount(i - j) == (x - y));
-
-                BEAST_EXPECT((x + y) == (y + x));  // addition is commutative
-            }
-        }
-    }
-
-    void
-    testDecimal()
-    {
-        // Tautology
-        BEAST_EXPECT(kDropsPerXrp.decimalXRP() == 1);
-
-        XRPAmount test{1};
-        BEAST_EXPECT(test.decimalXRP() == 0.000001);
-
-        test = -test;
-        BEAST_EXPECT(test.decimalXRP() == -0.000001);
-
-        test = 100'000'000;
-        BEAST_EXPECT(test.decimalXRP() == 100);
-
-        test = -test;
-        BEAST_EXPECT(test.decimalXRP() == -100);
-    }
-
-    void
-    testFunctions()
-    {
-        // Explicitly test every defined function for the XRPAmount class
-        // since some of them are templated, but not used anywhere else.
-        auto make = [&](auto x) -> XRPAmount { return XRPAmount{x}; };
-
-        XRPAmount const defaulted{};
-        (void)defaulted;
-        XRPAmount test{0};
-        BEAST_EXPECT(test.drops() == 0);
-
-        test = make(beast::kZero);
-        BEAST_EXPECT(test.drops() == 0);
-
-        test = beast::kZero;
-        BEAST_EXPECT(test.drops() == 0);
-
-        test = make(100);
-        BEAST_EXPECT(test.drops() == 100);
-
-        test = make(100u);
-        BEAST_EXPECT(test.drops() == 100);
-
-        XRPAmount const targetSame{200u};
-        test = make(targetSame);
-        BEAST_EXPECT(test.drops() == 200);
-        BEAST_EXPECT(test == targetSame);
-        BEAST_EXPECT(test < XRPAmount{1000});
-        BEAST_EXPECT(test > XRPAmount{100});
-
-        test = std::int64_t(200);
-        BEAST_EXPECT(test.drops() == 200);
-        test = std::uint32_t(300);
-        BEAST_EXPECT(test.drops() == 300);
-
-        test = targetSame;
-        BEAST_EXPECT(test.drops() == 200);
-        auto testOther = test.dropsAs<std::uint32_t>();
-        BEAST_EXPECT(testOther);
-        BEAST_EXPECT(*testOther == 200);  // NOLINT(bugprone-unchecked-optional-access)
-        test = std::numeric_limits<std::uint64_t>::max();
-        testOther = test.dropsAs<std::uint32_t>();
-        BEAST_EXPECT(!testOther);
-        test = -1;
-        testOther = test.dropsAs<std::uint32_t>();
-        BEAST_EXPECT(!testOther);
-
-        test = targetSame * 2;
-        BEAST_EXPECT(test.drops() == 400);
-        test = 3 * targetSame;
-        BEAST_EXPECT(test.drops() == 600);
-        test = 20;
-        BEAST_EXPECT(test.drops() == 20);
-
-        test += targetSame;
-        BEAST_EXPECT(test.drops() == 220);
-
-        test -= targetSame;
-        BEAST_EXPECT(test.drops() == 20);
-
-        test *= 5;
-        BEAST_EXPECT(test.drops() == 100);
-        test = 50;
-        BEAST_EXPECT(test.drops() == 50);
-        test -= 39;
-        BEAST_EXPECT(test.drops() == 11);
-
-        // legal with signed
-        test = -test;
-        BEAST_EXPECT(test.drops() == -11);
-        BEAST_EXPECT(test.signum() == -1);
-        BEAST_EXPECT(to_string(test) == "-11");
-
-        BEAST_EXPECT(test);
-        test = 0;
-        BEAST_EXPECT(!test);
-        BEAST_EXPECT(test.signum() == 0);
-        test = targetSame;
-        BEAST_EXPECT(test.signum() == 1);
-        BEAST_EXPECT(to_string(test) == "200");
-    }
-
-    void
-    testMulRatio()
-    {
-        testcase("mulRatio");
-
-        constexpr auto kMaxUInt32 = std::numeric_limits<std::uint32_t>::max();
-        constexpr auto kMaxXrp = std::numeric_limits<XRPAmount::value_type>::max();
-        constexpr auto kMinXrp = std::numeric_limits<XRPAmount::value_type>::min();
-
-        {
-            // multiply by a number that would overflow then divide by the same
-            // number, and check we didn't lose any value
-            XRPAmount big(kMaxXrp);
-            BEAST_EXPECT(big == mulRatio(big, kMaxUInt32, kMaxUInt32, true));
-            // rounding mode shouldn't matter as the result is exact
-            BEAST_EXPECT(big == mulRatio(big, kMaxUInt32, kMaxUInt32, false));
-
-            // multiply and divide by values that would overflow if done
-            // naively, and check that it gives the correct answer
-            big -= 0xf;  // Subtract a little so it's divisible by 4
-            BEAST_EXPECT(mulRatio(big, 3, 4, false).value() == (big.value() / 4) * 3);
-            BEAST_EXPECT(mulRatio(big, 3, 4, true).value() == (big.value() / 4) * 3);
-            BEAST_EXPECT((big.value() * 3) / 4 != (big.value() / 4) * 3);
-        }
-
-        {
-            // Similar test as above, but for negative values
-            XRPAmount big(kMinXrp);  // NOLINT TODO
-            BEAST_EXPECT(big == mulRatio(big, kMaxUInt32, kMaxUInt32, true));
-            // rounding mode shouldn't matter as the result is exact
-            BEAST_EXPECT(big == mulRatio(big, kMaxUInt32, kMaxUInt32, false));
-
-            // multiply and divide by values that would overflow if done
-            // naively, and check that it gives the correct answer
-            BEAST_EXPECT(mulRatio(big, 3, 4, false).value() == (big.value() / 4) * 3);
-            BEAST_EXPECT(mulRatio(big, 3, 4, true).value() == (big.value() / 4) * 3);
-            BEAST_EXPECT((big.value() * 3) / 4 != (big.value() / 4) * 3);
-        }
-
-        {
-            // small amounts
-            XRPAmount const tiny(1);
-            // Round up should give the smallest allowable number
-            BEAST_EXPECT(tiny == mulRatio(tiny, 1, kMaxUInt32, true));
-            // rounding down should be zero
-            BEAST_EXPECT(beast::kZero == mulRatio(tiny, 1, kMaxUInt32, false));
-            BEAST_EXPECT(beast::kZero == mulRatio(tiny, kMaxUInt32 - 1, kMaxUInt32, false));
-
-            // tiny negative numbers
-            XRPAmount const tinyNeg(-1);
-            // Round up should give zero
-            BEAST_EXPECT(beast::kZero == mulRatio(tinyNeg, 1, kMaxUInt32, true));
-            BEAST_EXPECT(beast::kZero == mulRatio(tinyNeg, kMaxUInt32 - 1, kMaxUInt32, true));
-            // rounding down should be tiny
-            BEAST_EXPECT(tinyNeg == mulRatio(tinyNeg, kMaxUInt32 - 1, kMaxUInt32, false));
-        }
-
-        {  // rounding
-            {
-                XRPAmount const one(1);
-                auto const rup = mulRatio(one, kMaxUInt32 - 1, kMaxUInt32, true);
-                auto const rdown = mulRatio(one, kMaxUInt32 - 1, kMaxUInt32, false);
-                BEAST_EXPECT(rup.drops() - rdown.drops() == 1);
-            }
-
-            {
-                XRPAmount const big(kMaxXrp);
-                auto const rup = mulRatio(big, kMaxUInt32 - 1, kMaxUInt32, true);
-                auto const rdown = mulRatio(big, kMaxUInt32 - 1, kMaxUInt32, false);
-                BEAST_EXPECT(rup.drops() - rdown.drops() == 1);
-            }
-
-            {
-                XRPAmount const negOne(-1);
-                auto const rup = mulRatio(negOne, kMaxUInt32 - 1, kMaxUInt32, true);
-                auto const rdown = mulRatio(negOne, kMaxUInt32 - 1, kMaxUInt32, false);
-                BEAST_EXPECT(rup.drops() - rdown.drops() == 1);
-            }
-        }
-
-        {
-            // division by zero
-            XRPAmount one(1);
-            except([&] { mulRatio(one, 1, 0, true); });
-        }
-
-        {
-            // overflow
-            XRPAmount big(kMaxXrp);
-            except([&] { mulRatio(big, 2, 1, true); });
-        }
-
-        {
-            // underflow
-            XRPAmount const bigNegative(kMinXrp + 10);
-            BEAST_EXPECT(mulRatio(bigNegative, 2, 1, true) == kMinXrp);
-        }
-    }  // namespace xrpl
-
-    //--------------------------------------------------------------------------
-
-    void
-    run() override
-    {
-        testSigNum();
-        testBeastZero();
-        testComparisons();
-        testAddSub();
-        testDecimal();
-        testFunctions();
-        testMulRatio();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(XRPAmount, basics, xrpl);
-
-}  // namespace xrpl
diff --git a/src/test/basics/base58_test.cpp b/src/test/basics/base58_test.cpp
deleted file mode 100644
index d2c8d9eabc..0000000000
--- a/src/test/basics/base58_test.cpp
+++ /dev/null
@@ -1,440 +0,0 @@
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/protocol/detail/token_errors.h>
-
-#include <boost/multiprecision/cpp_int.hpp>  // IWYU pragma: keep
-
-#include <algorithm>
-#include <cassert>
-#include <cstdint>
-#include <cstring>
-#include <iomanip>
-#include <iostream>
-#include <limits>
-#include <ranges>
-#include <stdexcept>
-#include <string>
-#include <tuple>
-#include <vector>
-#ifndef _MSC_VER
-
-#include <xrpl/protocol/detail/b58_utils.h>
-#include <xrpl/protocol/tokens.h>
-
-#include <array>
-#include <cstddef>
-#include <random>
-#include <span>
-#include <sstream>
-
-namespace xrpl::test {
-namespace {
-
-[[nodiscard]] inline auto
-randEngine() -> std::mt19937&
-{
-    static std::mt19937 kR = [] {
-        std::random_device rd;
-        return std::mt19937{rd()};
-    }();
-    return kR;
-}
-
-constexpr int kNumTokenTypeIndexes = 9;
-
-[[nodiscard]] inline auto
-tokenTypeAndSize(int i) -> std::tuple<xrpl::TokenType, std::size_t>
-{
-    assert(i < kNumTokenTypeIndexes);
-
-    switch (i)
-    {
-        using enum xrpl::TokenType;
-        case 0:
-            return {None, 20};
-        case 1:
-            return {NodePublic, 32};
-        case 2:
-            return {NodePublic, 33};
-        case 3:
-            return {NodePrivate, 32};
-        case 4:
-            return {AccountID, 20};
-        case 5:
-            return {AccountPublic, 32};
-        case 6:
-            return {AccountPublic, 33};
-        case 7:
-            return {AccountSecret, 32};
-        case 8:
-            return {FamilySeed, 16};
-        default:
-            throw std::invalid_argument(
-                "Invalid token selection passed to tokenTypeAndSize() "
-                "in " __FILE__);
-    }
-}
-
-[[nodiscard]] inline auto
-randomTokenTypeAndSize() -> std::tuple<xrpl::TokenType, std::size_t>
-{
-    using namespace xrpl;
-    auto& rng = randEngine();
-    std::uniform_int_distribution<> d(0, 8);
-    return tokenTypeAndSize(d(rng));
-}
-
-// Return the token type and subspan of `d` to use as test data.
-[[nodiscard]] inline auto
-randomB256TestData(std::span<std::uint8_t> d)
-    -> std::tuple<xrpl::TokenType, std::span<std::uint8_t>>
-{
-    auto& rng = randEngine();
-    std::uniform_int_distribution<std::uint8_t> dist(0, 255);
-    auto [tokType, tokSize] = randomTokenTypeAndSize();
-    std::generate(d.begin(), d.begin() + tokSize, [&] { return dist(rng); });
-    return {tokType, d.subspan(0, tokSize)};
-}
-
-inline void
-printAsChar(std::span<std::uint8_t> a, std::span<std::uint8_t> b)
-{
-    auto asString = [](std::span<std::uint8_t> s) {
-        std::string r;
-        r.resize(s.size());
-        std::ranges::copy(s, r.begin());
-        return r;
-    };
-    auto sa = asString(a);
-    auto sb = asString(b);
-    std::cerr << "\n\n" << sa << "\n" << sb << "\n";
-}
-
-inline void
-printAsInt(std::span<std::uint8_t> a, std::span<std::uint8_t> b)
-{
-    auto asString = [](std::span<std::uint8_t> s) -> std::string {
-        std::stringstream sstr;
-        for (auto i : s)
-        {
-            sstr << std::setw(3) << int(i) << ',';
-        }
-        return sstr.str();
-    };
-    auto sa = asString(a);
-    auto sb = asString(b);
-    std::cerr << "\n\n" << sa << "\n" << sb << "\n";
-}
-
-}  // namespace
-
-namespace multiprecision_utils {
-
-boost::multiprecision::checked_uint512_t
-toBoostMP(std::span<std::uint64_t> in)
-{
-    boost::multiprecision::checked_uint512_t mbp = 0;
-    for (auto& word : std::views::reverse(in))
-    {
-        mbp <<= 64;
-        mbp += word;
-    }
-    return mbp;
-}
-
-std::vector<std::uint64_t>
-randomBigInt(std::uint8_t minSize = 1, std::uint8_t maxSize = 5)
-{
-    auto eng = randEngine();
-    std::uniform_int_distribution<std::uint8_t> numCoeffDist(minSize, maxSize);
-    std::uniform_int_distribution<std::uint64_t> dist;
-    auto const numCoeff = numCoeffDist(eng);
-    std::vector<std::uint64_t> coeffs;
-    coeffs.reserve(numCoeff);
-    for (int i = 0; i < numCoeff; ++i)
-    {
-        coeffs.push_back(dist(eng));
-    }
-    return coeffs;
-}
-}  // namespace multiprecision_utils
-
-class base58_test : public beast::unit_test::Suite
-{
-    void
-    testMultiprecision()
-    {
-        testcase("b58_multiprecision");
-
-        using namespace boost::multiprecision;
-
-        static constexpr std::size_t kIters = 100000;
-        auto eng = randEngine();
-        std::uniform_int_distribution<std::uint64_t> dist;
-        std::uniform_int_distribution<std::uint64_t> dist1(1);
-        for (int i = 0; i < kIters; ++i)
-        {
-            std::uint64_t const d = dist(eng);
-            if (d == 0u)
-                continue;
-            auto bigInt = multiprecision_utils::randomBigInt();
-            auto const boostBigInt = multiprecision_utils::toBoostMP(
-                std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
-
-            auto const refDiv = boostBigInt / d;
-            auto const refMod = boostBigInt % d;
-
-            auto const mod = b58_fast::detail::inplaceBigintDivRem(
-                std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
-            auto const foundDiv = multiprecision_utils::toBoostMP(bigInt);
-            BEAST_EXPECT(refMod.convert_to<std::uint64_t>() == mod);
-            BEAST_EXPECT(foundDiv == refDiv);
-        }
-        for (int i = 0; i < kIters; ++i)
-        {
-            std::uint64_t const d = dist(eng);
-            auto bigInt = multiprecision_utils::randomBigInt(/*minSize*/ 2);
-            if (bigInt[bigInt.size() - 1] == std::numeric_limits<std::uint64_t>::max())
-            {
-                bigInt[bigInt.size() - 1] -= 1;  // Prevent overflow
-            }
-            auto const boostBigInt = multiprecision_utils::toBoostMP(
-                std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
-
-            auto const refAdd = boostBigInt + d;
-
-            auto const result = b58_fast::detail::inplaceBigintAdd(
-                std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
-            BEAST_EXPECT(result == TokenCodecErrc::Success);
-            auto const foundAdd = multiprecision_utils::toBoostMP(bigInt);
-            BEAST_EXPECT(refAdd == foundAdd);
-        }
-        for (int i = 0; i < kIters; ++i)
-        {
-            std::uint64_t const d = dist1(eng);
-            // Force overflow
-            std::vector<std::uint64_t> bigInt(5, std::numeric_limits<std::uint64_t>::max());
-
-            auto const boostBigInt = multiprecision_utils::toBoostMP(
-                std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
-
-            auto const refAdd = boostBigInt + d;
-
-            auto const result = b58_fast::detail::inplaceBigintAdd(
-                std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
-            BEAST_EXPECT(result == TokenCodecErrc::OverflowAdd);
-            auto const foundAdd = multiprecision_utils::toBoostMP(bigInt);
-            BEAST_EXPECT(refAdd != foundAdd);
-        }
-        for (int i = 0; i < kIters; ++i)
-        {
-            std::uint64_t const d = dist(eng);
-            auto bigInt = multiprecision_utils::randomBigInt(/* minSize */ 2);
-            // inplace mul requires the most significant coeff to be zero to
-            // hold the result.
-            bigInt[bigInt.size() - 1] = 0;
-            auto const boostBigInt = multiprecision_utils::toBoostMP(
-                std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
-
-            auto const refMul = boostBigInt * d;
-
-            auto const result = b58_fast::detail::inplaceBigintMul(
-                std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
-            BEAST_EXPECT(result == TokenCodecErrc::Success);
-            auto const foundMul = multiprecision_utils::toBoostMP(bigInt);
-            BEAST_EXPECT(refMul == foundMul);
-        }
-        for (int i = 0; i < kIters; ++i)
-        {
-            std::uint64_t const d = dist1(eng);
-            // Force overflow
-            std::vector<std::uint64_t> bigInt(5, std::numeric_limits<std::uint64_t>::max());
-            auto const boostBigInt = multiprecision_utils::toBoostMP(
-                std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
-
-            auto const refMul = boostBigInt * d;
-
-            auto const result = b58_fast::detail::inplaceBigintMul(
-                std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
-            BEAST_EXPECT(result == TokenCodecErrc::InputTooLarge);
-            auto const foundMul = multiprecision_utils::toBoostMP(bigInt);
-            BEAST_EXPECT(refMul != foundMul);
-        }
-    }
-
-    void
-    testFastMatchesRef()
-    {
-        testcase("fast_matches_ref");
-        auto testRawEncode = [&](std::span<std::uint8_t> const& b256Data) {
-            std::array<std::uint8_t, 64> b58ResultBuf[2];
-            std::array<std::span<std::uint8_t>, 2> b58Result;
-
-            std::array<std::uint8_t, 64> b256ResultBuf[2];
-            std::array<std::span<std::uint8_t>, 2> b256Result;
-            for (int i = 0; i < 2; ++i)
-            {
-                std::span const outBuf{b58ResultBuf[i]};
-                if (i == 0)
-                {
-                    auto const r = xrpl::b58_fast::detail::b256ToB58Be(b256Data, outBuf);
-                    BEAST_EXPECT(r);
-                    b58Result[i] = r.value();
-                }
-                else
-                {
-                    std::array<std::uint8_t, 128> tmpBuf{};
-                    std::string const s = xrpl::b58_ref::detail::encodeBase58(
-                        b256Data.data(), b256Data.size(), tmpBuf.data(), tmpBuf.size());
-                    BEAST_EXPECT(s.size());
-                    b58Result[i] = outBuf.subspan(0, s.size());
-                    std::ranges::copy(s, b58Result[i].begin());
-                }
-            }
-            if (BEAST_EXPECT(b58Result[0].size() == b58Result[1].size()))
-            {
-                if (!BEAST_EXPECT(
-                        memcmp(b58Result[0].data(), b58Result[1].data(), b58Result[0].size()) == 0))
-                {
-                    printAsChar(b58Result[0], b58Result[1]);
-                }
-            }
-
-            for (int i = 0; i < 2; ++i)
-            {
-                std::span const outBuf{b256ResultBuf[i].data(), b256ResultBuf[i].size()};
-                if (i == 0)
-                {
-                    std::string const in(
-                        b58Result[i].data(), b58Result[i].data() + b58Result[i].size());
-                    auto const r = xrpl::b58_fast::detail::b58ToB256Be(in, outBuf);
-                    BEAST_EXPECT(r);
-                    b256Result[i] = r.value();
-                }
-                else
-                {
-                    std::string const st(b58Result[i].begin(), b58Result[i].end());
-                    std::string const s = xrpl::b58_ref::detail::decodeBase58(st);
-                    BEAST_EXPECT(s.size());
-                    b256Result[i] = outBuf.subspan(0, s.size());
-                    std::ranges::copy(s, b256Result[i].begin());
-                }
-            }
-
-            if (BEAST_EXPECT(b256Result[0].size() == b256Result[1].size()))
-            {
-                if (!BEAST_EXPECT(
-                        memcmp(b256Result[0].data(), b256Result[1].data(), b256Result[0].size()) ==
-                        0))
-                {
-                    printAsInt(b256Result[0], b256Result[1]);
-                }
-            }
-        };
-
-        auto testTokenEncode = [&](xrpl::TokenType const tokType,
-                                   std::span<std::uint8_t> const& b256Data) {
-            std::array<std::uint8_t, 64> b58ResultBuf[2];
-            std::array<std::span<std::uint8_t>, 2> b58Result;
-
-            std::array<std::uint8_t, 64> b256ResultBuf[2];
-            std::array<std::span<std::uint8_t>, 2> b256Result;
-            for (int i = 0; i < 2; ++i)
-            {
-                std::span const outBuf{b58ResultBuf[i].data(), b58ResultBuf[i].size()};
-                if (i == 0)
-                {
-                    auto const r = xrpl::b58_fast::encodeBase58Token(tokType, b256Data, outBuf);
-                    BEAST_EXPECT(r);
-                    b58Result[i] = r.value();
-                }
-                else
-                {
-                    std::string const s =
-                        xrpl::b58_ref::encodeBase58Token(tokType, b256Data.data(), b256Data.size());
-                    BEAST_EXPECT(s.size());
-                    b58Result[i] = outBuf.subspan(0, s.size());
-                    std::ranges::copy(s, b58Result[i].begin());
-                }
-            }
-            if (BEAST_EXPECT(b58Result[0].size() == b58Result[1].size()))
-            {
-                if (!BEAST_EXPECT(
-                        memcmp(b58Result[0].data(), b58Result[1].data(), b58Result[0].size()) == 0))
-                {
-                    printAsChar(b58Result[0], b58Result[1]);
-                }
-            }
-
-            for (int i = 0; i < 2; ++i)
-            {
-                std::span const outBuf{b256ResultBuf[i].data(), b256ResultBuf[i].size()};
-                if (i == 0)
-                {
-                    std::string const in(
-                        b58Result[i].data(), b58Result[i].data() + b58Result[i].size());
-                    auto const r = xrpl::b58_fast::decodeBase58Token(tokType, in, outBuf);
-                    BEAST_EXPECT(r);
-                    b256Result[i] = r.value();
-                }
-                else
-                {
-                    std::string const st(b58Result[i].begin(), b58Result[i].end());
-                    std::string const s = xrpl::b58_ref::decodeBase58Token(st, tokType);
-                    BEAST_EXPECT(s.size());
-                    b256Result[i] = outBuf.subspan(0, s.size());
-                    std::ranges::copy(s, b256Result[i].begin());
-                }
-            }
-
-            if (BEAST_EXPECT(b256Result[0].size() == b256Result[1].size()))
-            {
-                if (!BEAST_EXPECT(
-                        memcmp(b256Result[0].data(), b256Result[1].data(), b256Result[0].size()) ==
-                        0))
-                {
-                    printAsInt(b256Result[0], b256Result[1]);
-                }
-            }
-        };
-
-        auto testIt = [&](xrpl::TokenType const tokType, std::span<std::uint8_t> const& b256Data) {
-            testRawEncode(b256Data);
-            testTokenEncode(tokType, b256Data);
-        };
-
-        // test every token type with data where every byte is the same and the
-        // bytes range from 0-255
-        for (int i = 0; i < kNumTokenTypeIndexes; ++i)
-        {
-            std::array<std::uint8_t, 128> b256DataBuf{};
-            auto const [tokType, tokSize] = tokenTypeAndSize(i);
-            for (int d = 0; d <= 255; ++d)
-            {
-                memset(b256DataBuf.data(), d, tokSize);
-                testIt(tokType, std::span(b256DataBuf.data(), tokSize));
-            }
-        }
-
-        // test with random data
-        static constexpr std::size_t kIters = 100000;
-        for (int i = 0; i < kIters; ++i)
-        {
-            std::array<std::uint8_t, 128> b256DataBuf{};
-            auto const [tokType, b256Data] = randomB256TestData(b256DataBuf);
-            testIt(tokType, b256Data);
-        }
-    }
-
-    void
-    run() override
-    {
-        testMultiprecision();
-        testFastMatchesRef();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(base58, basics, xrpl);
-
-}  // namespace xrpl::test
-
-#endif  // _MSC_VER
diff --git a/src/test/basics/base_uint_test.cpp b/src/test/basics/base_uint_test.cpp
deleted file mode 100644
index c6572a0028..0000000000
--- a/src/test/basics/base_uint_test.cpp
+++ /dev/null
@@ -1,376 +0,0 @@
-#include <xrpl/basics/Blob.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/hardened_hash.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/utility/Zero.h>
-
-#include <boost/endian/detail/order.hpp>
-
-#include <array>
-#include <cassert>
-#include <complex>
-#include <cstddef>
-#include <cstdint>
-#include <iterator>
-#include <stdexcept>
-#include <string_view>
-#include <type_traits>
-#include <unordered_set>
-#include <utility>
-#include <vector>
-
-namespace xrpl::test {
-
-// a non-hashing Hasher that just copies the bytes.
-// Used to test hash_append in base_uint
-template <std::size_t Bits>
-struct Nonhash
-{
-    static constexpr auto kEndian = boost::endian::order::big;
-    static constexpr std::size_t kWidth = Bits / 8;
-
-    std::array<std::uint8_t, kWidth> data;
-
-    Nonhash() = default;
-
-    void
-    operator()(void const* key, std::size_t len) noexcept
-    {
-        assert(len == kWidth);
-        memcpy(data.data(), key, len);
-    }
-
-    explicit
-    operator std::size_t() noexcept
-    {
-        return kWidth;
-    }
-};
-
-struct base_uint_test : beast::unit_test::Suite
-{
-    using test96 = BaseUInt<96>;
-    static_assert(std::is_copy_constructible_v<test96>);
-    static_assert(std::is_copy_assignable_v<test96>);
-
-    void
-    testComparisons()
-    {
-        {
-            static constexpr std::array<std::pair<std::string_view, std::string_view>, 6> kTestArgs{
-                {{"0000000000000000", "0000000000000001"},
-                 {"0000000000000000", "ffffffffffffffff"},
-                 {"1234567812345678", "2345678923456789"},
-                 {"8000000000000000", "8000000000000001"},
-                 {"aaaaaaaaaaaaaaa9", "aaaaaaaaaaaaaaaa"},
-                 {"fffffffffffffffe", "ffffffffffffffff"}}};
-
-            for (auto const& arg : kTestArgs)
-            {
-                xrpl::BaseUInt<64> const u{arg.first}, v{arg.second};
-                BEAST_EXPECT(u < v);
-                BEAST_EXPECT(u <= v);
-                BEAST_EXPECT(u != v);
-                BEAST_EXPECT(!(u == v));
-                BEAST_EXPECT(!(u > v));
-                BEAST_EXPECT(!(u >= v));
-                BEAST_EXPECT(!(v < u));
-                BEAST_EXPECT(!(v <= u));
-                BEAST_EXPECT(v != u);
-                BEAST_EXPECT(!(v == u));
-                BEAST_EXPECT(v > u);
-                BEAST_EXPECT(v >= u);
-                BEAST_EXPECT(u == u);
-                BEAST_EXPECT(v == v);
-            }
-        }
-
-        {
-            static constexpr std::array<std::pair<std::string_view, std::string_view>, 6> kTestArgs{
-                {
-                    {"000000000000000000000000", "000000000000000000000001"},
-                    {"000000000000000000000000", "ffffffffffffffffffffffff"},
-                    {"0123456789ab0123456789ab", "123456789abc123456789abc"},
-                    {"555555555555555555555555", "55555555555a555555555555"},
-                    {"aaaaaaaaaaaaaaa9aaaaaaaa", "aaaaaaaaaaaaaaaaaaaaaaaa"},
-                    {"fffffffffffffffffffffffe", "ffffffffffffffffffffffff"},
-                }};
-
-            for (auto const& arg : kTestArgs)
-            {
-                xrpl::BaseUInt<96> const u{arg.first}, v{arg.second};
-                BEAST_EXPECT(u < v);
-                BEAST_EXPECT(u <= v);
-                BEAST_EXPECT(u != v);
-                BEAST_EXPECT(!(u == v));
-                BEAST_EXPECT(!(u > v));
-                BEAST_EXPECT(!(u >= v));
-                BEAST_EXPECT(!(v < u));
-                BEAST_EXPECT(!(v <= u));
-                BEAST_EXPECT(v != u);
-                BEAST_EXPECT(!(v == u));
-                BEAST_EXPECT(v > u);
-                BEAST_EXPECT(v >= u);
-                BEAST_EXPECT(u == u);
-                BEAST_EXPECT(v == v);
-            }
-        }
-    }
-
-    void
-    testFromRawSizeMismatch()
-    {
-        testcase("base_uint: fromRaw size mismatch");
-
-        // Container larger than the base_uint (16 bytes vs 12 bytes for test96).
-        // Only the first 12 bytes are copied; the extra bytes are ignored.
-        {
-            Blob const tooBig{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
-            test96 const result = test96::fromRaw(tooBig);
-            BEAST_EXPECT(to_string(result) == "0102030405060708090A0B0C");
-        }
-    }
-
-    void
-    run() override
-    {
-        testcase("base_uint: general purpose tests");
-
-#ifdef NDEBUG
-        testFromRawSizeMismatch();
-#endif
-
-        static_assert(!std::is_constructible_v<test96, std::complex<double>>);
-        static_assert(!std::is_assignable_v<test96&, std::complex<double>>);
-
-        testComparisons();
-
-        // used to verify set insertion (hashing required)
-        std::unordered_set<test96, HardenedHash<>> uset;
-
-        Blob const raw{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12};
-        BEAST_EXPECT(test96::kBytes == raw.size());
-
-        test96 u = test96::fromRaw(raw);
-        uset.insert(u);
-        BEAST_EXPECT(raw.size() == u.size());
-        BEAST_EXPECT(to_string(u) == "0102030405060708090A0B0C");
-        BEAST_EXPECT(toShortString(u) == "01020304...");
-        BEAST_EXPECT(*u.data() == 1);
-        BEAST_EXPECT(u.signum() == 1);
-        BEAST_EXPECT(!!u);
-        BEAST_EXPECT(!u.isZero());
-        BEAST_EXPECT(u.isNonZero());
-        unsigned char t = 0;
-        for (auto& d : u)
-        {
-            BEAST_EXPECT(d == ++t);
-        }
-
-        // Test hash_append by "hashing" with a no-op hasher (h)
-        // and then extracting the bytes that were written during hashing
-        // back into another base_uint (w) for comparison with the original
-        Nonhash<96> h{};
-        hash_append(h, u);
-        test96 const w = test96::fromRaw(std::vector<std::uint8_t>(h.data.begin(), h.data.end()));
-        BEAST_EXPECT(w == u);
-
-        test96 v{~u};
-        uset.insert(v);
-        BEAST_EXPECT(to_string(v) == "FEFDFCFBFAF9F8F7F6F5F4F3");
-        BEAST_EXPECT(toShortString(v) == "FEFDFCFB...");
-        BEAST_EXPECT(*v.data() == 0xfe);
-        BEAST_EXPECT(v.signum() == 1);
-        BEAST_EXPECT(!!v);
-        BEAST_EXPECT(!v.isZero());
-        BEAST_EXPECT(v.isNonZero());
-        t = 0xff;
-        for (auto& d : v)
-        {
-            BEAST_EXPECT(d == --t);
-        }
-
-        BEAST_EXPECT(u < v);
-        BEAST_EXPECT(v > u);
-
-        v = u;
-        BEAST_EXPECT(v == u);
-
-        test96 z{beast::kZero};
-        uset.insert(z);
-        BEAST_EXPECT(to_string(z) == "000000000000000000000000");
-        BEAST_EXPECT(toShortString(z) == "00000000...");
-        BEAST_EXPECT(*z.data() == 0);
-        BEAST_EXPECT(*z.begin() == 0);
-        BEAST_EXPECT(*std::prev(z.end(), 1) == 0);
-        BEAST_EXPECT(z.signum() == 0);
-        BEAST_EXPECT(!z);
-        BEAST_EXPECT(z.isZero());
-        BEAST_EXPECT(!z.isNonZero());
-        for (auto& d : z)
-        {
-            BEAST_EXPECT(d == 0);
-        }
-
-        test96 n{z};
-        n++;
-        BEAST_EXPECT(n == test96(1));
-        n--;
-        BEAST_EXPECT(n == beast::kZero);
-        BEAST_EXPECT(n == z);
-        n--;
-        BEAST_EXPECT(to_string(n) == "FFFFFFFFFFFFFFFFFFFFFFFF");
-        BEAST_EXPECT(toShortString(n) == "FFFFFFFF...");
-        n = beast::kZero;
-        BEAST_EXPECT(n == z);
-
-        test96 zp1{z};
-        zp1++;
-        test96 zm1{z};
-        zm1--;
-        test96 const x{zm1 ^ zp1};
-        uset.insert(x);
-        BEAST_EXPECTS(to_string(x) == "FFFFFFFFFFFFFFFFFFFFFFFE", to_string(x));
-        BEAST_EXPECTS(toShortString(x) == "FFFFFFFF...", toShortString(x));
-
-        BEAST_EXPECT(uset.size() == 4);
-
-        test96 tmp;
-        BEAST_EXPECT(tmp.parseHex(to_string(u)));
-        BEAST_EXPECT(tmp == u);
-        tmp = z;
-
-        // fails with extra char
-        BEAST_EXPECT(!tmp.parseHex("A" + to_string(u)));
-        tmp = z;
-
-        // fails with extra char at end
-        BEAST_EXPECT(!tmp.parseHex(to_string(u) + "A"));
-
-        // fails with a non-hex character at some point in the string:
-        tmp = z;
-
-        for (std::size_t i = 0; i != 24; ++i)
-        {
-            std::string x = to_string(z);
-            x[i] = ('G' + (i % 10));
-            BEAST_EXPECT(!tmp.parseHex(x));
-        }
-
-        // Walking 1s:
-        for (std::size_t i = 0; i != 24; ++i)
-        {
-            std::string s1 = "000000000000000000000000";
-            s1[i] = '1';
-
-            BEAST_EXPECT(tmp.parseHex(s1));
-            BEAST_EXPECT(to_string(tmp) == s1);
-        }
-
-        // Walking 0s:
-        for (std::size_t i = 0; i != 24; ++i)
-        {
-            std::string s1 = "111111111111111111111111";
-            s1[i] = '0';
-
-            BEAST_EXPECT(tmp.parseHex(s1));
-            BEAST_EXPECT(to_string(tmp) == s1);
-        }
-
-        // Constexpr constructors
-        {
-            static_assert(test96{}.signum() == 0);
-            static_assert(test96("0").signum() == 0);
-            static_assert(test96("000000000000000000000000").signum() == 0);
-            static_assert(test96("000000000000000000000001").signum() == 1);
-            static_assert(test96("800000000000000000000000").signum() == 1);
-
-// Everything within the #if should fail during compilation.
-#if 0
-            // Too few characters
-            static_assert(test96("00000000000000000000000").signum() == 0);
-
-            // Too many characters
-            static_assert(test96("0000000000000000000000000").signum() == 0);
-
-            // Non-hex characters
-            static_assert(test96("00000000000000000000000 ").signum() == 1);
-            static_assert(test96("00000000000000000000000/").signum() == 1);
-            static_assert(test96("00000000000000000000000:").signum() == 1);
-            static_assert(test96("00000000000000000000000@").signum() == 1);
-            static_assert(test96("00000000000000000000000G").signum() == 1);
-            static_assert(test96("00000000000000000000000`").signum() == 1);
-            static_assert(test96("00000000000000000000000g").signum() == 1);
-            static_assert(test96("00000000000000000000000~").signum() == 1);
-#endif  // 0
-
-            // Using the constexpr constructor in a non-constexpr context
-            // with an error in the parsing throws an exception.
-            {
-                // Invalid length for string.
-                bool caught = false;
-                try
-                {
-                    // Try to prevent constant evaluation.
-                    std::vector<char> str(23, '7');
-                    std::string_view const sView(str.data(), str.size());
-                    [[maybe_unused]] test96 const t96(sView);
-                }
-                catch (std::invalid_argument const& e)
-                {
-                    BEAST_EXPECT(e.what() == std::string("invalid length for hex string"));
-                    caught = true;
-                }
-                BEAST_EXPECT(caught);
-            }
-            {
-                // Invalid character in string.
-                bool caught = false;
-                try
-                {
-                    // Try to prevent constant evaluation.
-                    std::vector<char> str(23, '7');
-                    str.push_back('G');
-                    std::string_view const sView(str.data(), str.size());
-                    [[maybe_unused]] test96 const t96(sView);
-                }
-                catch (std::range_error const& e)
-                {
-                    BEAST_EXPECT(e.what() == std::string("invalid hex character"));
-                    caught = true;
-                }
-                BEAST_EXPECT(caught);
-            }
-
-            // Verify that constexpr base_uints interpret a string the same
-            // way parseHex() does.
-            struct StrBaseUInt
-            {
-                char const* const str;
-                test96 tst;
-
-                constexpr StrBaseUInt(char const* s) : str(s), tst(s)
-                {
-                }
-            };
-            static constexpr StrBaseUInt kTestCases[] = {
-                "000000000000000000000000",
-                "000000000000000000000001",
-                "fedcba9876543210ABCDEF91",
-                "19FEDCBA0123456789abcdef",
-                "800000000000000000000000",
-                "fFfFfFfFfFfFfFfFfFfFfFfF"};
-
-            for (StrBaseUInt const& t : kTestCases)
-            {
-                test96 t96;
-                BEAST_EXPECT(t96.parseHex(t.str));
-                BEAST_EXPECT(t96 == t.tst);
-            }
-        }
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(base_uint, basics, xrpl);
-
-}  // namespace xrpl::test
diff --git a/src/test/basics/join_test.cpp b/src/test/basics/join_test.cpp
deleted file mode 100644
index 1ee81f786a..0000000000
--- a/src/test/basics/join_test.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-#include <test/jtx/Account.h>
-
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/join.h>
-#include <xrpl/beast/unit_test/suite.h>
-
-#include <array>
-#include <cstddef>
-#include <initializer_list>
-#include <sstream>
-#include <string>
-#include <vector>
-
-namespace xrpl::test {
-
-struct join_test : beast::unit_test::Suite
-{
-    void
-    run() override
-    {
-        auto test = [this](auto collectionanddelimiter, std::string expected) {
-            std::stringstream ss;
-            // Put something else in the buffer before and after to ensure that
-            // the << operator returns the stream correctly.
-            ss << "(" << collectionanddelimiter << ")";
-            auto const str = ss.str();
-            BEAST_EXPECT(str.substr(1, str.length() - 2) == expected);
-            BEAST_EXPECT(str.front() == '(');
-            BEAST_EXPECT(str.back() == ')');
-        };
-
-        // C++ array
-        test(CollectionAndDelimiter(std::array<int, 4>{2, -1, 5, 10}, "/"), "2/-1/5/10");
-        // One item C++ array edge case
-        test(CollectionAndDelimiter(std::array<std::string, 1>{"test"}, " & "), "test");
-        // Empty C++ array edge case
-        test(CollectionAndDelimiter(std::array<int, 0>{}, ","), "");
-        {
-            // C-style array
-            char letters[4]{'w', 'a', 's', 'd'};
-            test(CollectionAndDelimiter(letters, std::to_string(0)), "w0a0s0d");
-        }
-        {
-            // Auto sized C-style array
-            std::string words[]{"one", "two", "three", "four"};
-            test(CollectionAndDelimiter(words, "\n"), "one\ntwo\nthree\nfour");
-        }
-        {
-            // One item C-style array edge case
-            std::string words[]{"thing"};
-            test(CollectionAndDelimiter(words, "\n"), "thing");
-        }
-        // Initializer list
-        test(CollectionAndDelimiter(std::initializer_list<size_t>{19, 25}, "+"), "19+25");
-        // vector
-        test(CollectionAndDelimiter(std::vector<int>{0, 42}, std::to_string(99)), "09942");
-        {
-            // vector with one item edge case
-            using namespace jtx;
-            test(
-                CollectionAndDelimiter(std::vector<Account>{Account::kMaster}, "xxx"),
-                Account::kMaster.human());
-        }
-        // empty vector edge case
-        test(CollectionAndDelimiter(std::vector<uint256>{}, ","), "");
-        // C-style string
-        test(CollectionAndDelimiter("string", " "), "s t r i n g");
-        // Empty C-style string edge case
-        test(CollectionAndDelimiter("", "*"), "");
-        // Single char C-style string edge case
-        test(CollectionAndDelimiter("x", "*"), "x");
-        // std::string
-        test(CollectionAndDelimiter(std::string{"string"}, "-"), "s-t-r-i-n-g");
-        // Empty std::string edge case
-        test(CollectionAndDelimiter(std::string{""}, "*"), "");
-        // Single char std::string edge case
-        test(CollectionAndDelimiter(std::string{"y"}, "*"), "y");
-    }
-};  // namespace test
-
-BEAST_DEFINE_TESTSUITE(join, basics, xrpl);
-
-}  // namespace xrpl::test
diff --git a/src/tests/libxrpl/basics/Buffer.cpp b/src/tests/libxrpl/basics/Buffer.cpp
new file mode 100644
index 0000000000..5b34585fcf
--- /dev/null
+++ b/src/tests/libxrpl/basics/Buffer.cpp
@@ -0,0 +1,260 @@
+#include <xrpl/basics/Buffer.h>
+
+#include <xrpl/basics/Slice.h>
+
+#include <gtest/gtest.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <type_traits>
+#include <utility>
+
+namespace xrpl::test {
+
+struct BufferTest : public ::testing::Test
+{
+    static bool
+    sane(Buffer const& b)
+    {
+        if (b.empty())
+            return b.data() == nullptr;
+
+        return b.data() != nullptr;
+    }
+};
+
+TEST_F(BufferTest, buffer)
+{
+    std::uint8_t const data[] = {0xa8, 0xa1, 0x38, 0x45, 0x23, 0xec, 0xe4, 0x23, 0x71, 0x6d, 0x2a,
+                                 0x18, 0xb4, 0x70, 0xcb, 0xf5, 0xac, 0x2d, 0x89, 0x4d, 0x19, 0x9c,
+                                 0xf0, 0x2c, 0x15, 0xd1, 0xf9, 0x9b, 0x66, 0xd2, 0x30, 0xd3};
+
+    Buffer const b0;
+    EXPECT_TRUE(sane(b0));
+    EXPECT_TRUE(b0.empty());
+
+    Buffer b1{0};
+    EXPECT_TRUE(sane(b1));
+    EXPECT_TRUE(b1.empty());
+    std::memcpy(b1.alloc(16), data, 16);
+    EXPECT_TRUE(sane(b1));
+    EXPECT_FALSE(b1.empty());
+    EXPECT_EQ(b1.size(), 16);
+
+    Buffer b2{b1.size()};
+    EXPECT_TRUE(sane(b2));
+    EXPECT_FALSE(b2.empty());
+    EXPECT_EQ(b2.size(), b1.size());
+    std::memcpy(b2.data(), data + 16, 16);
+
+    Buffer b3{data, sizeof(data)};
+    EXPECT_TRUE(sane(b3));
+    EXPECT_FALSE(b3.empty());
+    EXPECT_EQ(b3.size(), sizeof(data));
+    EXPECT_EQ(std::memcmp(b3.data(), data, b3.size()), 0);
+
+    // Check equality and inequality comparisons.
+    // For code readability, we want to use general
+    // EXPECT_TRUE instead of specific EXPECT_EQ etc.
+    EXPECT_TRUE(b0 == b0);
+    EXPECT_TRUE(b0 != b1);
+    EXPECT_TRUE(b1 == b1);
+    EXPECT_TRUE(b1 != b2);
+    EXPECT_TRUE(b2 != b3);
+
+    // Check copy constructors and copy assignments:
+    {
+        Buffer x{b0};
+        EXPECT_EQ(x, b0);
+        EXPECT_TRUE(sane(x));
+        Buffer y{b1};
+        EXPECT_EQ(y, b1);
+        EXPECT_TRUE(sane(y));
+        x = b2;
+        EXPECT_EQ(x, b2);
+        EXPECT_TRUE(sane(x));
+        x = y;
+        EXPECT_EQ(x, y);
+        EXPECT_TRUE(sane(x));
+        y = b3;
+        EXPECT_EQ(y, b3);
+        EXPECT_TRUE(sane(y));
+        x = b0;
+        EXPECT_EQ(x, b0);
+        EXPECT_TRUE(sane(x));
+#if defined(__clang__)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wself-assign-overloaded"
+#endif
+
+        x = x;
+        EXPECT_EQ(x, b0);
+        EXPECT_TRUE(sane(x));
+        y = y;
+        EXPECT_EQ(y, b3);
+        EXPECT_TRUE(sane(y));
+
+#if defined(__clang__)
+#pragma clang diagnostic pop
+#endif
+    }
+
+    // Check move constructor & move assignments:
+    {
+        static_assert(std::is_nothrow_move_constructible_v<Buffer>);
+        static_assert(std::is_nothrow_move_assignable_v<Buffer>);
+
+        {  // Move-construct from empty buf
+            Buffer x;
+            Buffer const y{std::move(x)};
+            EXPECT_TRUE(sane(x));    // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(x.empty());  // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(sane(y));
+            EXPECT_TRUE(y.empty());
+            EXPECT_EQ(x, y);  // NOLINT(bugprone-use-after-move)
+        }
+
+        {  // Move-construct from non-empty buf
+            Buffer x{b1};
+            Buffer const y{std::move(x)};
+            EXPECT_TRUE(sane(x));    // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(x.empty());  // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(sane(y));
+            EXPECT_EQ(y, b1);
+        }
+
+        {  // Move assign empty buf to empty buf
+            Buffer x;
+            Buffer y;
+
+            x = std::move(y);
+            EXPECT_TRUE(sane(x));
+            EXPECT_TRUE(x.empty());
+            EXPECT_TRUE(sane(y));    // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(y.empty());  // NOLINT(bugprone-use-after-move)
+        }
+
+        {  // Move assign non-empty buf to empty buf
+            Buffer x;
+            Buffer y{b1};
+
+            x = std::move(y);
+            EXPECT_TRUE(sane(x));
+            EXPECT_EQ(x, b1);
+            EXPECT_TRUE(sane(y));    // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(y.empty());  // NOLINT(bugprone-use-after-move)
+        }
+
+        {  // Move assign empty buf to non-empty buf
+            Buffer x{b1};
+            Buffer y;
+
+            x = std::move(y);
+            EXPECT_TRUE(sane(x));
+            EXPECT_TRUE(x.empty());
+            EXPECT_TRUE(sane(y));    // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(y.empty());  // NOLINT(bugprone-use-after-move)
+        }
+
+        {  // Move assign non-empty buf to non-empty buf
+            Buffer x{b1};
+            Buffer y{b2};
+            Buffer z{b3};
+
+            x = std::move(y);
+            EXPECT_TRUE(sane(x));
+            EXPECT_FALSE(x.empty());
+            EXPECT_TRUE(sane(y));    // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(y.empty());  // NOLINT(bugprone-use-after-move)
+
+            x = std::move(z);
+            EXPECT_TRUE(sane(x));
+            EXPECT_FALSE(x.empty());
+            EXPECT_TRUE(sane(z));    // NOLINT(bugprone-use-after-move)
+            EXPECT_TRUE(z.empty());  // NOLINT(bugprone-use-after-move)
+        }
+    }
+
+    {
+        Buffer w{static_cast<Slice>(b0)};
+        EXPECT_TRUE(sane(w));
+        EXPECT_EQ(w, b0);
+
+        Buffer x{static_cast<Slice>(b1)};
+        EXPECT_TRUE(sane(x));
+        EXPECT_EQ(x, b1);
+
+        Buffer y{static_cast<Slice>(b2)};
+        EXPECT_TRUE(sane(y));
+        EXPECT_EQ(y, b2);
+
+        Buffer z{static_cast<Slice>(b3)};
+        EXPECT_TRUE(sane(z));
+        EXPECT_EQ(z, b3);
+
+        // Assign empty slice to empty buffer
+        w = static_cast<Slice>(b0);
+        EXPECT_TRUE(sane(w));
+        EXPECT_EQ(w, b0);
+
+        // Assign non-empty slice to empty buffer
+        w = static_cast<Slice>(b1);
+        EXPECT_TRUE(sane(w));
+        EXPECT_EQ(w, b1);
+
+        // Assign non-empty slice to non-empty buffer
+        x = static_cast<Slice>(b2);
+        EXPECT_TRUE(sane(x));
+        EXPECT_EQ(x, b2);
+
+        // Assign non-empty slice to non-empty buffer
+        y = static_cast<Slice>(z);
+        EXPECT_TRUE(sane(y));
+        EXPECT_EQ(y, z);
+
+        // Assign empty slice to non-empty buffer:
+        z = static_cast<Slice>(b0);
+        EXPECT_TRUE(sane(z));
+        EXPECT_EQ(z, b0);
+    }
+
+    {
+        auto test = [](Buffer const& b, std::size_t i) {
+            Buffer x{b};
+
+            // Try to allocate some number of bytes, possibly
+            // zero (which means clear) and sanity check
+            x(i);
+            EXPECT_TRUE(sane(x));
+            EXPECT_EQ(x.size(), i);
+            EXPECT_EQ((x.data() == nullptr), (i == 0));
+
+            // Try to allocate some more data (always non-zero)
+            x(i + 1);
+            EXPECT_TRUE(sane(x));
+            EXPECT_EQ(x.size(), i + 1);
+            EXPECT_NE(x.data(), nullptr);
+
+            // Try to clear:
+            x.clear();
+            EXPECT_TRUE(sane(x));
+            EXPECT_TRUE(x.empty());
+            EXPECT_EQ(x.data(), nullptr);
+
+            // Try to clear again:
+            x.clear();
+            EXPECT_TRUE(sane(x));
+            EXPECT_TRUE(x.empty());
+            EXPECT_EQ(x.data(), nullptr);
+        };
+
+        for (std::size_t i = 0; i < 16; ++i)
+        {
+            test(b0, i);
+            test(b1, i);
+        }
+    }
+}
+
+}  // namespace xrpl::test
diff --git a/src/tests/libxrpl/basics/FileUtilities.cpp b/src/tests/libxrpl/basics/FileUtilities.cpp
new file mode 100644
index 0000000000..cd24abd696
--- /dev/null
+++ b/src/tests/libxrpl/basics/FileUtilities.cpp
@@ -0,0 +1,94 @@
+#include <xrpl/basics/FileUtilities.h>
+
+#include <xrpl/basics/ByteUtilities.h>
+
+#include <boost/filesystem/operations.hpp>
+#include <boost/filesystem/path.hpp>
+#include <boost/system/detail/errc.hpp>
+#include <boost/system/detail/error_code.hpp>
+
+#include <gtest/gtest.h>
+
+#include <fstream>
+#include <stdexcept>
+#include <string>
+
+namespace xrpl {
+
+namespace {
+
+class TempFile
+{
+public:
+    explicit TempFile(boost::filesystem::path file, std::string const& contents)
+        : dir_(
+              boost::filesystem::temp_directory_path() /
+              boost::filesystem::unique_path("xrpl-file-utilities-%%%%-%%%%-%%%%"))
+        , file_(dir_ / file)
+    {
+        boost::filesystem::create_directory(dir_);
+
+        std::ofstream output(file_.string());
+        if (!output)
+            throw std::runtime_error("Unable to create temporary test file");
+
+        output << contents;
+    }
+
+    ~TempFile()
+    {
+        boost::system::error_code ec;
+        boost::filesystem::remove(file_, ec);
+        boost::filesystem::remove(dir_, ec);
+    }
+
+    [[nodiscard]] boost::filesystem::path const&
+    file() const
+    {
+        return file_;
+    }
+
+private:
+    boost::filesystem::path dir_;
+    boost::filesystem::path file_;
+};
+
+}  // namespace
+
+TEST(FileUtilitiesTest, get_file_contents)
+{
+    using namespace boost::system;
+
+    constexpr char const* kExpectedContents = "This file is very short. That's all we need.";
+
+    TempFile const file("test_file", "This is temporary text that should get overwritten");
+
+    error_code ec;
+    auto const path = file.file();
+
+    writeFileContents(ec, path, kExpectedContents);
+    EXPECT_FALSE(ec);
+
+    {
+        // Test with no max
+        auto const good = getFileContents(ec, path);
+        EXPECT_FALSE(ec);
+        EXPECT_EQ(good, kExpectedContents);
+    }
+
+    {
+        // Test with large max
+        auto const good = getFileContents(ec, path, kilobytes(1));
+        EXPECT_FALSE(ec);
+        EXPECT_EQ(good, kExpectedContents);
+    }
+
+    {
+        // Test with small max
+        auto const bad = getFileContents(ec, path, 16);
+        EXPECT_TRUE(ec && ec.value() == boost::system::errc::file_too_large);
+        EXPECT_TRUE(bad.empty());
+    }
+}
+
+}  // namespace xrpl
diff --git a/src/tests/libxrpl/basics/IOUAmount.cpp b/src/tests/libxrpl/basics/IOUAmount.cpp
new file mode 100644
index 0000000000..46d6d7c5e1
--- /dev/null
+++ b/src/tests/libxrpl/basics/IOUAmount.cpp
@@ -0,0 +1,243 @@
+#include <xrpl/protocol/IOUAmount.h>
+
+#include <xrpl/basics/Number.h>
+#include <xrpl/beast/utility/Zero.h>
+
+#include <gtest/gtest.h>
+
+#include <cstdint>
+#include <limits>
+#include <sstream>
+#include <string>
+
+namespace xrpl {
+
+TEST(IOUAmountTest, zero)
+{
+    IOUAmount const z(0, 0);
+
+    EXPECT_EQ(z.mantissa(), 0);
+    EXPECT_EQ(z.exponent(), -100);
+    EXPECT_FALSE(z);
+    EXPECT_EQ(z.signum(), 0);
+    EXPECT_EQ(z, beast::kZero);
+
+    EXPECT_EQ((z + z), z);
+    EXPECT_EQ((z - z), z);
+    EXPECT_EQ(z, -z);
+
+    IOUAmount const zz(beast::kZero);
+    EXPECT_EQ(z, zz);
+
+    // https://github.com/XRPLF/rippled/issues/5170
+    IOUAmount const zzz{};
+    EXPECT_EQ(zzz, beast::kZero);
+    // EXPECT_EQ(zzz, zz);
+}
+
+TEST(IOUAmountTest, sig_num)
+{
+    IOUAmount const neg(-1, 0);
+    EXPECT_LT(neg.signum(), 0);
+
+    IOUAmount const zer(0, 0);
+    EXPECT_EQ(zer.signum(), 0);
+
+    IOUAmount const pos(1, 0);
+    EXPECT_GT(pos.signum(), 0);
+}
+
+TEST(IOUAmountTest, beast_zero)
+{
+    using beast::kZero;
+
+    {
+        IOUAmount const z(kZero);
+        EXPECT_TRUE(z == kZero);
+        EXPECT_TRUE(z >= kZero);
+        EXPECT_TRUE(z <= kZero);
+        EXPECT_FALSE(z != kZero);
+        EXPECT_FALSE(z > kZero);
+        EXPECT_FALSE(z < kZero);
+    }
+
+    {
+        IOUAmount const neg(-2, 0);
+        EXPECT_TRUE(neg < kZero);
+        EXPECT_TRUE(neg <= kZero);
+        EXPECT_TRUE(neg != kZero);
+        EXPECT_FALSE(neg == kZero);
+    }
+
+    {
+        IOUAmount const pos(2, 0);
+        EXPECT_TRUE(pos > kZero);
+        EXPECT_TRUE(pos >= kZero);
+        EXPECT_TRUE(pos != kZero);
+        EXPECT_FALSE(pos == kZero);
+    }
+}
+
+TEST(IOUAmountTest, comparisons)
+{
+    IOUAmount const n(-2, 0);
+    IOUAmount const z(0, 0);
+    IOUAmount const p(2, 0);
+    // For code readability, we want to use general
+    // EXPECT_TRUE instead of specific EXPECT_EQ etc.
+    EXPECT_TRUE(z == z);
+    EXPECT_TRUE(z >= z);
+    EXPECT_TRUE(z <= z);
+    EXPECT_TRUE(z == -z);
+    // NOLINTBEGIN(misc-redundant-expression)
+    EXPECT_FALSE(z > z);
+    EXPECT_FALSE(z < z);
+    EXPECT_FALSE(z != z);
+    // NOLINTEND(misc-redundant-expression)
+    EXPECT_FALSE(z != -z);
+
+    EXPECT_TRUE(n < z);
+    EXPECT_TRUE(n <= z);
+    EXPECT_TRUE(n != z);
+    EXPECT_FALSE(n > z);
+    EXPECT_FALSE(n >= z);
+    EXPECT_FALSE(n == z);
+
+    EXPECT_TRUE(p > z);
+    EXPECT_TRUE(p >= z);
+    EXPECT_TRUE(p != z);
+    EXPECT_FALSE(p < z);
+    EXPECT_FALSE(p <= z);
+    EXPECT_FALSE(p == z);
+
+    EXPECT_TRUE(n < p);
+    EXPECT_TRUE(n <= p);
+    EXPECT_TRUE(n != p);
+    EXPECT_FALSE(n > p);
+    EXPECT_FALSE(n >= p);
+    EXPECT_FALSE(n == p);
+
+    EXPECT_TRUE(p > n);
+    EXPECT_TRUE(p >= n);
+    EXPECT_TRUE(p != n);
+    EXPECT_FALSE(p < n);
+    EXPECT_FALSE(p <= n);
+    EXPECT_FALSE(p == n);
+
+    EXPECT_TRUE(p > -p);
+    EXPECT_TRUE(p >= -p);
+    EXPECT_TRUE(p != -p);
+
+    EXPECT_TRUE(n < -n);
+    EXPECT_TRUE(n <= -n);
+    EXPECT_TRUE(n != -n);
+}
+
+TEST(IOUAmountTest, to_string)
+{
+    auto test = [](IOUAmount const& n, std::string const& expected) {
+        auto const result = to_string(n);
+        std::stringstream ss;
+        ss << "to_string(" << result << "). Expected: " << expected;
+        EXPECT_EQ(result, expected) << ss.str();
+    };
+
+    for (auto const mantissaSize : MantissaRange::getAllScales())
+    {
+        NumberMantissaScaleGuard const mg(mantissaSize);
+
+        test(IOUAmount(-2, 0), "-2");
+        test(IOUAmount(0, 0), "0");
+        test(IOUAmount(2, 0), "2");
+        test(IOUAmount(25, -3), "0.025");
+        test(IOUAmount(-25, -3), "-0.025");
+        test(IOUAmount(25, 1), "250");
+        test(IOUAmount(-25, 1), "-250");
+        test(IOUAmount(2, 20), "2e20");
+        test(IOUAmount(-2, -20), "-2e-20");
+    }
+}
+
+TEST(IOUAmountTest, mul_ratio)
+{
+    /* The range for the mantissa when normalized */
+    constexpr std::int64_t kMinMantissa = 1000000000000000ull;
+    constexpr std::int64_t kMaxMantissa = 9999999999999999ull;
+    // log(2,maxMantissa) ~ 53.15
+    /* The range for the exponent when normalized */
+    constexpr int kMinExponent = -96;
+    constexpr int kMaxExponent = 80;
+    constexpr auto kMaxUInt = std::numeric_limits<std::uint32_t>::max();
+
+    {
+        // multiply by a number that would overflow the mantissa, then
+        // divide by the same number, and check we didn't lose any value
+        IOUAmount const bigMan(kMaxMantissa, 0);
+        EXPECT_EQ(bigMan, mulRatio(bigMan, kMaxUInt, kMaxUInt, true));
+        // rounding mode shouldn't matter as the result is exact
+        EXPECT_EQ(bigMan, mulRatio(bigMan, kMaxUInt, kMaxUInt, false));
+    }
+    {
+        // Similar test as above, but for negative values
+        IOUAmount const bigMan(-kMaxMantissa, 0);
+        EXPECT_EQ(bigMan, mulRatio(bigMan, kMaxUInt, kMaxUInt, true));
+        // rounding mode shouldn't matter as the result is exact
+        EXPECT_EQ(bigMan, mulRatio(bigMan, kMaxUInt, kMaxUInt, false));
+    }
+
+    {
+        // small amounts
+        IOUAmount const tiny(kMinMantissa, kMinExponent);
+        // Round up should give the smallest allowable number
+        EXPECT_EQ(tiny, mulRatio(tiny, 1, kMaxUInt, true));
+        EXPECT_EQ(tiny, mulRatio(tiny, kMaxUInt - 1, kMaxUInt, true));
+        // rounding down should be zero
+        EXPECT_EQ(beast::kZero, mulRatio(tiny, 1, kMaxUInt, false));
+        EXPECT_EQ(beast::kZero, mulRatio(tiny, kMaxUInt - 1, kMaxUInt, false));
+
+        // tiny negative numbers
+        IOUAmount const tinyNeg(-kMinMantissa, kMinExponent);
+        // Round up should give zero
+        EXPECT_EQ(beast::kZero, mulRatio(tinyNeg, 1, kMaxUInt, true));
+        EXPECT_EQ(beast::kZero, mulRatio(tinyNeg, kMaxUInt - 1, kMaxUInt, true));
+        // rounding down should be tiny
+        EXPECT_EQ(tinyNeg, mulRatio(tinyNeg, 1, kMaxUInt, false));
+        EXPECT_EQ(tinyNeg, mulRatio(tinyNeg, kMaxUInt - 1, kMaxUInt, false));
+    }
+
+    {  // rounding
+        {
+            IOUAmount const one(1, 0);
+            auto const rup = mulRatio(one, kMaxUInt - 1, kMaxUInt, true);
+            auto const rdown = mulRatio(one, kMaxUInt - 1, kMaxUInt, false);
+            EXPECT_EQ(rup.mantissa() - rdown.mantissa(), 1);
+        }
+        {
+            IOUAmount const big(kMaxMantissa, kMaxExponent);
+            auto const rup = mulRatio(big, kMaxUInt - 1, kMaxUInt, true);
+            auto const rdown = mulRatio(big, kMaxUInt - 1, kMaxUInt, false);
+            EXPECT_EQ(rup.mantissa() - rdown.mantissa(), 1);
+        }
+
+        {
+            IOUAmount const negOne(-1, 0);
+            auto const rup = mulRatio(negOne, kMaxUInt - 1, kMaxUInt, true);
+            auto const rdown = mulRatio(negOne, kMaxUInt - 1, kMaxUInt, false);
+            EXPECT_EQ(rup.mantissa() - rdown.mantissa(), 1);
+        }
+    }
+
+    {
+        // division by zero
+        IOUAmount const one(1, 0);
+        EXPECT_ANY_THROW({ mulRatio(one, 1, 0, true); });
+    }
+
+    {
+        // overflow
+        IOUAmount const big(kMaxMantissa, kMaxExponent);
+        EXPECT_ANY_THROW({ mulRatio(big, 2, 0, true); });
+    }
+}
+
+}  // namespace xrpl
diff --git a/src/tests/libxrpl/basics/IntrusiveShared.cpp b/src/tests/libxrpl/basics/IntrusiveShared.cpp
new file mode 100644
index 0000000000..e798cd1ccc
--- /dev/null
+++ b/src/tests/libxrpl/basics/IntrusiveShared.cpp
@@ -0,0 +1,844 @@
+#include <xrpl/basics/IntrusivePointer.h>    // IWYU pragma: keep
+#include <xrpl/basics/IntrusivePointer.ipp>  // IWYU pragma: keep
+#include <xrpl/basics/IntrusiveRefCounts.h>
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>  // IWYU pragma: keep
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <latch>
+#include <mutex>
+#include <optional>
+#include <random>
+#include <stdexcept>
+#include <thread>
+#include <utility>
+#include <variant>
+#include <vector>
+
+namespace xrpl::tests {
+
+/*
+ * Experimentally, we discovered that using std::barrier performs extremely
+ * poorly (~1 hour vs ~1 minute to run the test suite) in certain macOS
+ * environments. To unblock our macOS CI pipeline, we replaced std::barrier with a
+ * custom mutex-based barrier (Barrier) that significantly improves performance
+ * without compromising correctness. For future reference, if we ever consider
+ * reintroducing std::barrier, the following configuration is known to exhibit the
+ * problem:
+ *
+ *     Model Name: Mac mini
+ *     Model Identifier: Mac14,3
+ *     Model Number: Z16K000R4LL/A
+ *     Chip: Apple M2
+ *     Total Number of Cores: 8 (4 performance and 4 efficiency)
+ *     Memory: 24 GB
+ *     System Firmware Version: 11881.41.5
+ *     OS Loader Version: 11881.1.1
+ *     Apple clang version 16.0.0 (clang-1600.0.26.3)
+ *     Target: arm64-apple-darwin24.0.0
+ *     Thread model: posix
+ *
+ */
+struct Barrier
+{
+    std::mutex mtx;
+    std::condition_variable cv;
+    int count;
+    int const initial;
+    std::size_t generation{0};
+
+    explicit Barrier(int n) : count(n), initial(n)
+    {
+    }
+
+    void
+    arriveAndWait()
+    {
+        std::unique_lock lock(mtx);
+        auto const currentGeneration = generation;
+        if (--count == 0)
+        {
+            ++generation;
+            count = initial;
+            cv.notify_all();
+        }
+        else
+        {
+            cv.wait(lock, [&] { return generation != currentGeneration; });
+        }
+    }
+};
+
+namespace {
+enum class TrackedState : std::uint8_t {
+    Uninitialized,
+    Alive,
+    PartiallyDeletedStarted,
+    PartiallyDeleted,
+    DeletedStarted,
+    Deleted
+};
+
+class TIBase : public IntrusiveRefCounts
+{
+public:
+    static constexpr std::size_t kMaxStates = 128;
+    static std::array<std::atomic<TrackedState>, kMaxStates> state;
+    static std::atomic<std::size_t> nextId;
+    static TrackedState
+    getState(std::size_t id)
+    {
+        if (id >= state.size())
+            throw std::out_of_range("TIBase state id out of range");
+
+        return state[id].load(std::memory_order_acquire);
+    }
+    static void
+    resetStates(bool resetCallback)
+    {
+        for (std::size_t i = 0; i < kMaxStates; ++i)
+        {
+            state[i].store(TrackedState::Uninitialized, std::memory_order_release);
+        }
+        nextId.store(0, std::memory_order_release);
+        if (resetCallback)
+            TIBase::tracingCallback = [](TrackedState, std::optional<TrackedState>) {};
+    }
+
+    struct ResetStatesGuard
+    {
+        bool resetCallback{false};
+
+        ResetStatesGuard(bool resetCallback) : resetCallback{resetCallback}
+        {
+            TIBase::resetStates(resetCallback);
+        }
+        ~ResetStatesGuard()
+        {
+            TIBase::resetStates(resetCallback);
+        }
+    };
+
+    TIBase() : id{checkoutID()}
+    {
+        state[id].store(TrackedState::Alive, std::memory_order_relaxed);
+    }
+    ~TIBase() override
+    {
+        using enum TrackedState;
+
+        tracingCallback(state[id].load(std::memory_order_relaxed), DeletedStarted);
+
+        // Use relaxed memory order to try to avoid atomic operations from
+        // adding additional memory synchronizations that may hide threading
+        // errors in the underlying shared pointer class.
+        state[id].store(DeletedStarted, std::memory_order_relaxed);
+
+        tracingCallback(DeletedStarted, Deleted);
+
+        state[id].store(TrackedState::Deleted, std::memory_order_relaxed);
+
+        tracingCallback(TrackedState::Deleted, std::nullopt);
+    }
+
+    void
+    partialDestructor() const
+    {
+        using enum TrackedState;
+
+        tracingCallback(state[id].load(std::memory_order_relaxed), PartiallyDeletedStarted);
+
+        state[id].store(PartiallyDeletedStarted, std::memory_order_relaxed);
+
+        tracingCallback(PartiallyDeletedStarted, PartiallyDeleted);
+
+        state[id].store(PartiallyDeleted, std::memory_order_relaxed);
+
+        tracingCallback(PartiallyDeleted, std::nullopt);
+    }
+
+    static std::function<void(TrackedState, std::optional<TrackedState>)> tracingCallback;
+
+    std::size_t const id;
+
+private:
+    static std::size_t
+    checkoutID()
+    {
+        auto const id = nextId.fetch_add(1, std::memory_order_acq_rel);
+        if (id >= state.size())
+            throw std::out_of_range("TIBase state capacity exceeded");
+
+        return id;
+    }
+};
+
+std::array<std::atomic<TrackedState>, TIBase::kMaxStates> TIBase::state;
+std::atomic<std::size_t> TIBase::nextId{0};
+
+std::function<void(TrackedState, std::optional<TrackedState>)> TIBase::tracingCallback =
+    [](TrackedState, std::optional<TrackedState>) {};
+
+}  // namespace
+
+TEST(IntrusiveSharedTest, basics)
+{
+    {
+        TIBase::ResetStatesGuard const rsg{true};
+
+        TIBase const b;
+        EXPECT_EQ(b.useCount(), 1);
+        b.addWeakRef();
+        EXPECT_EQ(b.useCount(), 1);
+        auto s = b.releaseStrongRef();
+        EXPECT_EQ(s, ReleaseStrongRefAction::PartialDestroy);
+        EXPECT_EQ(b.useCount(), 0);
+        TIBase const* pb = &b;
+        partialDestructorFinished(&pb);
+        EXPECT_FALSE(pb);
+        auto w = b.releaseWeakRef();
+        EXPECT_EQ(w, ReleaseWeakRefAction::Destroy);
+    }
+
+    std::vector<SharedIntrusive<TIBase>> strong;
+    std::vector<WeakIntrusive<TIBase>> weak;
+    {
+        TIBase::ResetStatesGuard const rsg{true};
+
+        using enum TrackedState;
+        auto b = makeSharedIntrusive<TIBase>();
+        auto id = b->id;
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        EXPECT_EQ(b->useCount(), 1);
+        for (int i = 0; i < 10; ++i)
+        {
+            strong.push_back(b);
+        }
+        b.reset();
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        strong.resize(strong.size() - 1);
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        strong.clear();
+        EXPECT_EQ(TIBase::getState(id), Deleted);
+
+        b = makeSharedIntrusive<TIBase>();
+        id = b->id;
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        EXPECT_EQ(b->useCount(), 1);
+        for (int i = 0; i < 10; ++i)
+        {
+            weak.emplace_back(b);
+            EXPECT_EQ(b->useCount(), 1);
+        }
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        weak.resize(weak.size() - 1);
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        b.reset();
+        EXPECT_EQ(TIBase::getState(id), PartiallyDeleted);
+        while (!weak.empty())
+        {
+            weak.resize(weak.size() - 1);
+            if (!weak.empty())
+            {
+                EXPECT_EQ(TIBase::getState(id), PartiallyDeleted);
+            }
+        }
+        EXPECT_EQ(TIBase::getState(id), Deleted);
+    }
+    {
+        TIBase::ResetStatesGuard const rsg{true};
+
+        using enum TrackedState;
+        auto b = makeSharedIntrusive<TIBase>();
+        auto id = b->id;
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        WeakIntrusive<TIBase> w{b};
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        auto s = w.lock();
+        EXPECT_TRUE(s && s->useCount() == 2);
+        b.reset();
+        EXPECT_TRUE(TIBase::getState(id) == Alive);
+        EXPECT_TRUE(s && s->useCount() == 1);
+        s.reset();
+        EXPECT_EQ(TIBase::getState(id), PartiallyDeleted);
+        EXPECT_TRUE(w.expired());
+        s = w.lock();
+        // Cannot convert a weak pointer to a strong pointer if object is
+        // already partially deleted
+        EXPECT_FALSE(s);
+        w.reset();
+        EXPECT_EQ(TIBase::getState(id), Deleted);
+    }
+    {
+        TIBase::ResetStatesGuard const rsg{true};
+
+        using enum TrackedState;
+        using swu = SharedWeakUnion<TIBase>;
+        swu b = makeSharedIntrusive<TIBase>();
+        EXPECT_TRUE(b.isStrong() && b.useCount() == 1);
+        auto id = b.get()->id;
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        swu w = b;
+        EXPECT_TRUE(TIBase::getState(id) == Alive);
+        EXPECT_TRUE(w.isStrong() && b.useCount() == 2);
+        w.convertToWeak();
+        EXPECT_TRUE(w.isWeak() && b.useCount() == 1);
+        swu s = w;
+        EXPECT_TRUE(s.isWeak() && b.useCount() == 1);
+        s.convertToStrong();
+        EXPECT_TRUE(s.isStrong() && b.useCount() == 2);
+        b.reset();
+        EXPECT_EQ(TIBase::getState(id), Alive);
+        EXPECT_EQ(s.useCount(), 1);
+        EXPECT_FALSE(w.expired());
+        s.reset();
+        EXPECT_EQ(TIBase::getState(id), PartiallyDeleted);
+        EXPECT_TRUE(w.expired());
+        w.convertToStrong();
+        // Cannot convert a weak pointer to a strong pointer if object is
+        // already partially deleted
+        EXPECT_TRUE(w.isWeak());
+        w.reset();
+        EXPECT_EQ(TIBase::getState(id), Deleted);
+    }
+    {
+        // Testing SharedWeakUnion assignment operator
+
+        TIBase::ResetStatesGuard const rsg{true};
+
+        auto strong1 = makeSharedIntrusive<TIBase>();
+        auto strong2 = makeSharedIntrusive<TIBase>();
+
+        auto id1 = strong1->id;
+        auto id2 = strong2->id;
+
+        EXPECT_NE(id1, id2);
+
+        SharedWeakUnion<TIBase> union1 = strong1;
+        SharedWeakUnion<TIBase> union2 = strong2;
+
+        EXPECT_TRUE(union1.isStrong());
+        EXPECT_TRUE(union2.isStrong());
+        EXPECT_EQ(union1.get(), strong1.get());
+        EXPECT_EQ(union2.get(), strong2.get());
+
+        // 1) Normal assignment: explicitly calls SharedWeakUnion assignment
+        union1 = union2;
+        EXPECT_TRUE(union1.isStrong());
+        EXPECT_TRUE(union2.isStrong());
+        EXPECT_EQ(union1.get(), union2.get());
+        EXPECT_EQ(TIBase::getState(id1), TrackedState::Alive);
+        EXPECT_EQ(TIBase::getState(id2), TrackedState::Alive);
+
+        // 2) Test self-assignment
+        EXPECT_TRUE(union1.isStrong());
+        EXPECT_EQ(TIBase::getState(id1), TrackedState::Alive);
+        int const initialRefCount = strong1->useCount();
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wself-assign-overloaded"
+        union1 = union1;  // Self-assignment
+#pragma clang diagnostic pop
+        EXPECT_TRUE(union1.isStrong());
+        EXPECT_EQ(TIBase::getState(id1), TrackedState::Alive);
+        EXPECT_EQ(strong1->useCount(), initialRefCount);
+
+        // 3) Test assignment from null union pointer
+        union1 = SharedWeakUnion<TIBase>();
+        EXPECT_EQ(union1.get(), nullptr);
+
+        // 4) Test assignment to expired union pointer
+        strong2.reset();
+        union2.reset();
+        union1 = union2;
+        EXPECT_EQ(union1.get(), nullptr);
+        EXPECT_EQ(TIBase::getState(id2), TrackedState::Deleted);
+    }
+}
+
+TEST(IntrusiveSharedTest, partial_delete)
+{
+    // This test creates two threads. One with a strong pointer and one
+    // with a weak pointer. The strong pointer is reset while the weak
+    // pointer still holds a reference, triggering a partial delete.
+    // While the partial delete function runs (a sleep is inserted) the
+    // weak pointer is reset. The destructor should wait to run until
+    // after the partial delete function has completed running.
+
+    using enum TrackedState;
+
+    TIBase::ResetStatesGuard const rsg{true};
+
+    auto strong = makeSharedIntrusive<TIBase>();
+    WeakIntrusive<TIBase> weak{strong};
+    std::atomic<bool> destructorRan{false};
+    std::atomic<bool> partialDeleteRan{false};
+    std::latch partialDeleteStartedSyncPoint{2};
+    strong->tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
+        using enum TrackedState;
+        if (next == DeletedStarted)
+        {
+            // strong goes out of scope while weak is still in scope
+            // This checks that partialDelete has run to completion
+            // before the destructor is called. A sleep is inserted
+            // inside the partial delete to make sure the destructor is
+            // given an opportunity to run during partial delete.
+            EXPECT_EQ(cur, PartiallyDeleted);
+        }
+        if (next == PartiallyDeletedStarted)
+        {
+            partialDeleteStartedSyncPoint.arrive_and_wait();
+            using namespace std::chrono_literals;
+            // Sleep and let the weak pointer go out of scope,
+            // potentially triggering a destructor while partial delete
+            // is running. The test is to make sure that doesn't happen.
+            std::this_thread::sleep_for(800ms);
+        }
+        if (next == PartiallyDeleted)
+        {
+            EXPECT_FALSE(partialDeleteRan.exchange(true) || destructorRan.load());
+        }
+        if (next == Deleted)
+        {
+            EXPECT_FALSE(destructorRan.exchange(true));
+        }
+    };
+    std::thread t1{[&] {
+        partialDeleteStartedSyncPoint.arrive_and_wait();
+        weak.reset();  // Trigger a full delete as soon as the partial
+                       // delete starts
+    }};
+    std::thread t2{[&] {
+        strong.reset();  // Trigger a partial delete
+    }};
+    t1.join();
+    t2.join();
+
+    EXPECT_TRUE(destructorRan.load() && partialDeleteRan.load());
+}
+
+TEST(IntrusiveSharedTest, destructor)
+{
+    // This test creates two threads. One with a strong pointer and one
+    // with a weak pointer. The weak pointer is reset while the strong
+    // pointer still holds a reference. Then the strong pointer is
+    // reset. Only the destructor should run. The partial destructor
+    // should not be called. Since the weak reset runs to completion
+    // before the strong pointer is reset, threading doesn't add much to
+    // this test, but there is no harm in keeping it.
+
+    using enum TrackedState;
+
+    TIBase::ResetStatesGuard const rsg{true};
+
+    auto strong = makeSharedIntrusive<TIBase>();
+    WeakIntrusive<TIBase> weak{strong};
+    std::atomic<bool> destructorRan{false};
+    std::atomic<bool> partialDeleteRan{false};
+    std::latch weakResetSyncPoint{2};
+    strong->tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
+        using enum TrackedState;
+        if (next == PartiallyDeleted)
+        {
+            EXPECT_FALSE(partialDeleteRan.exchange(true) || destructorRan.load());
+        }
+        if (next == Deleted)
+        {
+            EXPECT_FALSE(destructorRan.exchange(true));
+        }
+    };
+    std::thread t1{[&] {
+        weak.reset();
+        weakResetSyncPoint.arrive_and_wait();
+    }};
+    std::thread t2{[&] {
+        weakResetSyncPoint.arrive_and_wait();
+        strong.reset();  // Trigger a partial delete
+    }};
+    t1.join();
+    t2.join();
+
+    EXPECT_TRUE(destructorRan.load() && !partialDeleteRan.load());
+}
+
+TEST(IntrusiveSharedTest, multithreaded_clear_mixed_variant)
+{
+    // This test creates and destroys many strong and weak pointers in a
+    // loop. There is a random mix of strong and weak pointers stored in
+    // a vector (held as a variant). Both threads clear all the pointers
+    // and check that the invariants hold.
+
+    using enum TrackedState;
+    TIBase::ResetStatesGuard const rsg{true};
+
+    std::atomic<int> destructionState{0};
+    // returns destructorRan and partialDestructorRan (in that order)
+    auto getDestructorState = [&]() -> std::pair<bool, bool> {
+        int const s = destructionState.load(std::memory_order_relaxed);
+        return {(s & 1) != 0, (s & 2) != 0};
+    };
+    auto setDestructorRan = [&]() -> void {
+        destructionState.fetch_or(1, std::memory_order_acq_rel);
+    };
+    auto setPartialDeleteRan = [&]() -> void {
+        destructionState.fetch_or(2, std::memory_order_acq_rel);
+    };
+    auto tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
+        using enum TrackedState;
+        auto [destructorRan, partialDeleteRan] = getDestructorState();
+        if (next == PartiallyDeleted)
+        {
+            EXPECT_FALSE(partialDeleteRan || destructorRan);
+            setPartialDeleteRan();
+        }
+        if (next == Deleted)
+        {
+            EXPECT_FALSE(destructorRan);
+            setDestructorRan();
+        }
+    };
+    auto createVecOfPointers = [&](auto const& toClone, std::default_random_engine& eng)
+        -> std::vector<std::variant<SharedIntrusive<TIBase>, WeakIntrusive<TIBase>>> {
+        std::vector<std::variant<SharedIntrusive<TIBase>, WeakIntrusive<TIBase>>> result;
+        std::uniform_int_distribution<> toCreateDist(4, 64);
+        std::uniform_int_distribution<> isStrongDist(0, 1);
+        auto numToCreate = toCreateDist(eng);
+        result.reserve(numToCreate);
+        for (int i = 0; i < numToCreate; ++i)
+        {
+            if (isStrongDist(eng))
+            {
+                result.emplace_back(SharedIntrusive<TIBase>(toClone));
+            }
+            else
+            {
+                result.emplace_back(WeakIntrusive<TIBase>(toClone));
+            }
+        }
+        return result;
+    };
+    constexpr int kLoopIters = 2 * 1024;
+    constexpr int kNumThreads = 16;
+    std::vector<SharedIntrusive<TIBase>> toClone;
+    Barrier loopStartSyncPoint{kNumThreads};
+    Barrier postCreateToCloneSyncPoint{kNumThreads};
+    Barrier postCreateVecOfPointersSyncPoint{kNumThreads};
+    auto engines = [&]() -> std::vector<std::default_random_engine> {
+        std::random_device rd;
+        std::vector<std::default_random_engine> result;
+        result.reserve(kNumThreads);
+        for (int i = 0; i < kNumThreads; ++i)
+            result.emplace_back(rd());
+        return result;
+    }();
+
+    // cloneAndDestroy clones the strong pointer into a vector of mixed
+    // strong and weak pointers and destroys them all at once.
+    // threadId==0 is special.
+    auto cloneAndDestroy = [&](int threadId) {
+        for (int i = 0; i < kLoopIters; ++i)
+        {
+            // ------ Sync Point ------
+            loopStartSyncPoint.arriveAndWait();
+
+            // only thread 0 should reset the state
+            std::optional<TIBase::ResetStatesGuard> rsg;
+            if (threadId == 0)
+            {
+                // Thread 0 is the genesis thread. It creates the strong
+                // pointers to be cloned by the other threads. This
+                // thread will also check that the destructor ran and
+                // clear the temporary variables.
+
+                rsg.emplace(false);
+                auto [destructorRan, partialDeleteRan] = getDestructorState();
+                EXPECT_TRUE(i == 0 || destructorRan);
+                destructionState.store(0, std::memory_order_release);
+
+                toClone.clear();
+                toClone.resize(kNumThreads);
+                auto strong = makeSharedIntrusive<TIBase>();
+                strong->tracingCallback = tracingCallback;
+                std::ranges::fill(toClone, strong);
+            }
+
+            // ------ Sync Point ------
+            postCreateToCloneSyncPoint.arriveAndWait();
+
+            auto v = createVecOfPointers(toClone[threadId], engines[threadId]);
+            toClone[threadId].reset();
+
+            // ------ Sync Point ------
+            postCreateVecOfPointersSyncPoint.arriveAndWait();
+
+            v.clear();
+        }
+    };
+    std::vector<std::thread> threads;
+    threads.reserve(kNumThreads);
+    for (int i = 0; i < kNumThreads; ++i)
+    {
+        threads.emplace_back(cloneAndDestroy, i);
+    }
+    for (int i = 0; i < kNumThreads; ++i)
+    {
+        threads[i].join();
+    }
+}
+
+TEST(IntrusiveSharedTest, multithreaded_clear_mixed_union)
+{
+    // This test creates and destroys many SharedWeak pointers in a
+    // loop. All the pointers start as strong and a loop randomly
+    // convert them between strong and weak pointers. Both threads clear
+    // all the pointers and check that the invariants hold.
+    //
+    // Note: This test also differs from the test above in that the pointers
+    // randomly change from strong to weak and from weak to strong in a
+    // loop. This can't be done in the variant test above because variant is
+    // not thread safe while the SharedWeakUnion is thread safe.
+
+    using enum TrackedState;
+
+    TIBase::ResetStatesGuard const rsg{true};
+
+    std::atomic<int> destructionState{0};
+    // returns destructorRan and partialDestructorRan (in that order)
+    auto getDestructorState = [&]() -> std::pair<bool, bool> {
+        int const s = destructionState.load(std::memory_order_relaxed);
+        return {(s & 1) != 0, (s & 2) != 0};
+    };
+    auto setDestructorRan = [&]() -> void {
+        destructionState.fetch_or(1, std::memory_order_acq_rel);
+    };
+    auto setPartialDeleteRan = [&]() -> void {
+        destructionState.fetch_or(2, std::memory_order_acq_rel);
+    };
+    auto tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
+        using enum TrackedState;
+        auto [destructorRan, partialDeleteRan] = getDestructorState();
+        if (next == PartiallyDeleted)
+        {
+            EXPECT_FALSE(partialDeleteRan || destructorRan);
+            setPartialDeleteRan();
+        }
+        if (next == Deleted)
+        {
+            EXPECT_FALSE(destructorRan);
+            setDestructorRan();
+        }
+    };
+    auto createVecOfPointers =
+        [&](auto const& toClone,
+            std::default_random_engine& eng) -> std::vector<SharedWeakUnion<TIBase>> {
+        std::vector<SharedWeakUnion<TIBase>> result;
+        std::uniform_int_distribution<> toCreateDist(4, 64);
+        auto numToCreate = toCreateDist(eng);
+        result.reserve(numToCreate);
+        for (int i = 0; i < numToCreate; ++i)
+            result.emplace_back(SharedIntrusive<TIBase>(toClone));
+        return result;
+    };
+    constexpr int kLoopIters = 2 * 1024;
+    constexpr int kFlipPointersLoopIters = 256;
+    constexpr int kNumThreads = 16;
+    std::vector<SharedIntrusive<TIBase>> toClone;
+    Barrier loopStartSyncPoint{kNumThreads};
+    Barrier postCreateToCloneSyncPoint{kNumThreads};
+    Barrier postCreateVecOfPointersSyncPoint{kNumThreads};
+    Barrier postFlipPointersLoopSyncPoint{kNumThreads};
+    auto engines = [&]() -> std::vector<std::default_random_engine> {
+        std::random_device rd;
+        std::vector<std::default_random_engine> result;
+        result.reserve(kNumThreads);
+        for (int i = 0; i < kNumThreads; ++i)
+            result.emplace_back(rd());
+        return result;
+    }();
+
+    // cloneAndDestroy clones the strong pointer into a vector of
+    // mixed strong and weak pointers, runs a loop that randomly
+    // changes strong pointers to weak pointers,  and destroys them
+    // all at once.
+    auto cloneAndDestroy = [&](int threadId) {
+        for (int i = 0; i < kLoopIters; ++i)
+        {
+            // ------ Sync Point ------
+            loopStartSyncPoint.arriveAndWait();
+
+            // only thread 0 should reset the state
+            std::optional<TIBase::ResetStatesGuard> rsg;
+            if (threadId == 0)
+            {
+                // threadId 0 is the genesis thread. It creates the
+                // strong point to be cloned by the other threads. This
+                // thread will also check that the destructor ran and
+                // clear the temporary variables.
+                rsg.emplace(false);
+                auto [destructorRan, partialDeleteRan] = getDestructorState();
+                EXPECT_TRUE(i == 0 || destructorRan);
+                destructionState.store(0, std::memory_order_release);
+
+                toClone.clear();
+                toClone.resize(kNumThreads);
+                auto strong = makeSharedIntrusive<TIBase>();
+                strong->tracingCallback = tracingCallback;
+                std::ranges::fill(toClone, strong);
+            }
+
+            // ------ Sync Point ------
+            postCreateToCloneSyncPoint.arriveAndWait();
+
+            auto v = createVecOfPointers(toClone[threadId], engines[threadId]);
+            toClone[threadId].reset();
+
+            // ------ Sync Point ------
+            postCreateVecOfPointersSyncPoint.arriveAndWait();
+
+            std::uniform_int_distribution<> isStrongDist(0, 1);
+            for (int f = 0; f < kFlipPointersLoopIters; ++f)
+            {
+                for (auto& p : v)
+                {
+                    if (isStrongDist(engines[threadId]))
+                    {
+                        p.convertToStrong();
+                    }
+                    else
+                    {
+                        p.convertToWeak();
+                    }
+                }
+            }
+
+            // ------ Sync Point ------
+            postFlipPointersLoopSyncPoint.arriveAndWait();
+
+            v.clear();
+        }
+    };
+    std::vector<std::thread> threads;
+    threads.reserve(kNumThreads);
+    for (int i = 0; i < kNumThreads; ++i)
+    {
+        threads.emplace_back(cloneAndDestroy, i);
+    }
+    for (int i = 0; i < kNumThreads; ++i)
+    {
+        threads[i].join();
+    }
+}
+
+TEST(IntrusiveSharedTest, multithreaded_locking_weak)
+{
+    // This test creates a single shared atomic pointer that multiple thread
+    // create weak pointers from. The threads then lock the weak pointers.
+    // Both threads clear all the pointers and check that the invariants
+    // hold.
+
+    using enum TrackedState;
+
+    TIBase::ResetStatesGuard const rsg{true};
+
+    std::atomic<int> destructionState{0};
+    // returns destructorRan and partialDestructorRan (in that order)
+    auto getDestructorState = [&]() -> std::pair<bool, bool> {
+        int const s = destructionState.load(std::memory_order_relaxed);
+        return {(s & 1) != 0, (s & 2) != 0};
+    };
+    auto setDestructorRan = [&]() -> void {
+        destructionState.fetch_or(1, std::memory_order_acq_rel);
+    };
+    auto setPartialDeleteRan = [&]() -> void {
+        destructionState.fetch_or(2, std::memory_order_acq_rel);
+    };
+    auto tracingCallback = [&](TrackedState cur, std::optional<TrackedState> next) {
+        using enum TrackedState;
+        auto [destructorRan, partialDeleteRan] = getDestructorState();
+        if (next == PartiallyDeleted)
+        {
+            EXPECT_FALSE(partialDeleteRan || destructorRan);
+            setPartialDeleteRan();
+        }
+        if (next == Deleted)
+        {
+            EXPECT_FALSE(destructorRan);
+            setDestructorRan();
+        }
+    };
+
+    constexpr int kLoopIters = 2 * 1024;
+    constexpr int kLockWeakLoopIters = 256;
+    constexpr int kNumThreads = 16;
+    std::vector<SharedIntrusive<TIBase>> toLock;
+    Barrier loopStartSyncPoint{kNumThreads};
+    Barrier postCreateToLockSyncPoint{kNumThreads};
+    Barrier postLockWeakLoopSyncPoint{kNumThreads};
+
+    // lockAndDestroy creates weak pointers from the strong pointer
+    // and runs a loop that locks the weak pointer. At the end of the loop
+    // all the pointers are destroyed all at once.
+    auto lockAndDestroy = [&](int threadId) {
+        for (int i = 0; i < kLoopIters; ++i)
+        {
+            // ------ Sync Point ------
+            loopStartSyncPoint.arriveAndWait();
+
+            // only thread 0 should reset the state
+            std::optional<TIBase::ResetStatesGuard> rsg;
+            if (threadId == 0)
+            {
+                // threadId 0 is the genesis thread. It creates the
+                // strong point to be locked by the other threads. This
+                // thread will also check that the destructor ran and
+                // clear the temporary variables.
+                rsg.emplace(false);
+                auto [destructorRan, partialDeleteRan] = getDestructorState();
+                EXPECT_TRUE(i == 0 || destructorRan);
+                destructionState.store(0, std::memory_order_release);
+
+                toLock.clear();
+                toLock.resize(kNumThreads);
+                auto strong = makeSharedIntrusive<TIBase>();
+                strong->tracingCallback = tracingCallback;
+                std::ranges::fill(toLock, strong);
+            }
+
+            // ------ Sync Point ------
+            postCreateToLockSyncPoint.arriveAndWait();
+
+            // Multiple threads all create a weak pointer from the same
+            // strong pointer
+            WeakIntrusive const weak{toLock[threadId]};
+            for (int wi = 0; wi < kLockWeakLoopIters; ++wi)
+            {
+                EXPECT_FALSE(weak.expired());
+                auto strong = weak.lock();
+                EXPECT_TRUE(strong);
+            }
+
+            // ------ Sync Point ------
+            postLockWeakLoopSyncPoint.arriveAndWait();
+
+            toLock[threadId].reset();
+        }
+    };
+    std::vector<std::thread> threads;
+    threads.reserve(kNumThreads);
+    for (int i = 0; i < kNumThreads; ++i)
+    {
+        threads.emplace_back(lockAndDestroy, i);
+    }
+    for (int i = 0; i < kNumThreads; ++i)
+    {
+        threads[i].join();
+    }
+}
+
+}  // namespace xrpl::tests
diff --git a/src/tests/libxrpl/basics/KeyCache.cpp b/src/tests/libxrpl/basics/KeyCache.cpp
new file mode 100644
index 0000000000..061264b11d
--- /dev/null
+++ b/src/tests/libxrpl/basics/KeyCache.cpp
@@ -0,0 +1,81 @@
+#include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/TaggedCache.ipp>  // IWYU pragma: keep
+#include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/Protocol.h>
+
+#include <gtest/gtest.h>
+#include <helpers/TestSink.h>
+
+#include <string>
+
+namespace xrpl {
+
+class KeyCacheTest : public ::testing::Test
+{
+public:
+};
+
+TEST_F(KeyCacheTest, key_cache)
+{
+    using namespace std::chrono_literals;
+    TestStopwatch clock;
+    clock.set(0);
+
+    using Key = std::string;
+    using Cache = TaggedCache<Key, int, true>;
+
+    beast::Journal const j{TestSink::instance()};
+
+    // Insert an item, retrieve it, and age it so it gets purged.
+    {
+        Cache c("test", LedgerIndex(1), 2s, clock, j);
+
+        EXPECT_EQ(c.size(), 0);
+        EXPECT_TRUE(c.insert("one"));
+        EXPECT_FALSE(c.insert("one"));
+        EXPECT_EQ(c.size(), 1);
+        EXPECT_TRUE(c.touchIfExists("one"));
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.size(), 1);
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.size(), 0);
+        EXPECT_FALSE(c.touchIfExists("one"));
+    }
+
+    // Insert two items, have one expire
+    {
+        Cache c("test", LedgerIndex(2), 2s, clock, j);
+
+        EXPECT_TRUE(c.insert("one"));
+        EXPECT_EQ(c.size(), 1);
+        EXPECT_TRUE(c.insert("two"));
+        EXPECT_EQ(c.size(), 2);
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.size(), 2);
+        EXPECT_TRUE(c.touchIfExists("two"));
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.size(), 1);
+    }
+
+    // Insert three items (1 over limit), sweep
+    {
+        Cache c("test", LedgerIndex(2), 3s, clock, j);
+
+        EXPECT_TRUE(c.insert("one"));
+        ++clock;
+        EXPECT_TRUE(c.insert("two"));
+        ++clock;
+        EXPECT_TRUE(c.insert("three"));
+        ++clock;
+        EXPECT_EQ(c.size(), 3);
+        c.sweep();
+        EXPECT_LT(c.size(), 3);
+    }
+}
+
+}  // namespace xrpl
diff --git a/src/test/basics/Number_test.cpp b/src/tests/libxrpl/basics/Number.cpp
similarity index 73%
rename from src/test/basics/Number_test.cpp
rename to src/tests/libxrpl/basics/Number.cpp
index 9383fd6808..e8c4e4209f 100644
--- a/src/test/basics/Number_test.cpp
+++ b/src/tests/libxrpl/basics/Number.cpp
@@ -1,5 +1,5 @@
 #include <xrpl/basics/Number.h>
-#include <xrpl/beast/unit_test/suite.h>
+
 #include <xrpl/protocol/IOUAmount.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/STAmount.h>
@@ -10,6 +10,8 @@
 #include <boost/multiprecision/cpp_dec_float.hpp>
 #include <boost/multiprecision/number.hpp>
 
+#include <gtest/gtest.h>
+
 #include <algorithm>
 #include <array>
 #include <cctype>
@@ -27,82 +29,81 @@
 
 namespace xrpl {
 
-class Number_test : public beast::unit_test::Suite
+using BigInt = boost::multiprecision::cpp_int;
+using Dec = boost::multiprecision::cpp_dec_float_50;
+
+static std::string
+fmt(BigInt const& value)
 {
-    using BigInt = boost::multiprecision::cpp_int;
-
-    static std::string
-    fmt(BigInt const& value)
+    auto s = to_string(value);
+    std::string out;
+    int count = 0;
+    for (char const& ch : std::views::reverse(s))
     {
-        auto s = to_string(value);
-        std::string out;
-        int count = 0;
-        for (char const& ch : std::views::reverse(s))
-        {
-            if (count != 0 && count % 3 == 0 && (isdigit(ch) != 0))
-                out.insert(out.begin(), '_');
-            out.insert(out.begin(), ch);
-            ++count;
-        }
-        return out;
+        if (count != 0 && count % 3 == 0 && (isdigit(ch) != 0))
+            out.insert(out.begin(), '_');
+        out.insert(out.begin(), ch);
+        ++count;
+    }
+    return out;
+}
+
+template <class T = Dec>
+static T
+pow10(int n)
+{
+    if (n == 0)
+        return 1;
+    if (n == 1)
+        return 10;
+
+    if (n > 1)
+    {
+        auto r = pow10<T>(n / 2);
+        r *= r;
+        if (n % 2 != 0)
+            r *= 10;
+        return r;
     }
 
-    using dec = boost::multiprecision::cpp_dec_float_50;
+    T p = 1;
+    p /= pow10<T>(-n);
+    return p;
+}
 
-    template <class T = dec>
-    static T
-    pow10(int n)
+static std::string
+fmt(Dec const& value)
+{
+    std::ostringstream os;
+    os << std::setprecision(40) << value;
+    return os.str();
+}
+
+TEST(NumberTest, zero)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        if (n == 0)
-            return 1;
-        if (n == 1)
-            return 10;
-
-        if (n > 1)
-        {
-            auto r = pow10<T>(n / 2);
-            r *= r;
-            if (n % 2 != 0)
-                r *= 10;
-            return r;
-        }
-
-        // n < 0
-        T p = 1;
-        p /= pow10<T>(-n);
-        return p;
-    }
-
-    static std::string
-    fmt(dec const& v)
-    {
-        std::ostringstream os;
-        os << std::setprecision(40) << v;
-        return os.str();
-    }
-
-public:
-    void
-    testZero()
-    {
-        testcase << "zero " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
 
         for (Number const& z : {Number{0, 0}, Number{0}})
         {
-            BEAST_EXPECT(z.mantissa() == 0);
-            BEAST_EXPECT(z.exponent() == Number{}.exponent());
+            EXPECT_EQ(z.mantissa(), 0);
+            EXPECT_EQ(z.exponent(), Number{}.exponent());
 
-            BEAST_EXPECT((z + z) == z);
-            BEAST_EXPECT((z - z) == z);
-            BEAST_EXPECT(z == -z);
+            EXPECT_EQ((z + z), z);
+            EXPECT_EQ((z - z), z);
+            EXPECT_EQ(z, -z);
         }
     }
+}
 
-    void
-    testLimits()
+TEST(NumberTest, limits)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         auto const scale = Number::getMantissaScale();
-        testcase << "test_limits " << to_string(scale);
         bool caught = false;
         auto const minMantissa = Number::minMantissa();
         try
@@ -114,13 +115,13 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
 
-        auto test = [this](auto const& x, auto const& y, int line) {
+        auto test = [](auto const& x, auto const& y, int line) {
             auto const result = x == y;
             std::stringstream ss;
             ss << x << " == " << y << " -> " << (result ? "true" : "false");
-            expect(result, ss.str(), __FILE__, line);
+            EXPECT_TRUE(result) << ss.str() << " (" << __FILE__ << ":" << line << ")";
         };
 
         test(
@@ -164,14 +165,17 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
     }
+}
 
-    void
-    testAdd()
+TEST(NumberTest, add)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         auto const scale = Number::getMantissaScale();
-        testcase << "test_add " << to_string(scale);
 
         using Case = std::tuple<Number, Number, Number>;
         auto const cSmall = std::to_array<Case>(
@@ -250,11 +254,11 @@ public:
                     Number{2, 19},
                 },
                 {
-                    // Does not round. Mantissas are going to be > kMaxRep, so if
+                    // Does not round. Mantissas are going to be > maxRep, so if
                     // added together as uint64_t's, the result will overflow.
                     // With addition using uint128_t, there's no problem. After
                     // normalizing, the resulting mantissa ends up less than
-                    // kMaxRep.
+                    // maxRep.
                     Number{false, 9'999'999'999'999'999'990ULL, 0, Number::Normalized{}},
                     Number{false, 9'999'999'999'999'999'990ULL, 0, Number::Normalized{}},
                     Number{false, 1'999'999'999'999'999'998ULL, 1, Number::Normalized{}},
@@ -266,13 +270,13 @@ public:
         auto const cLargeCorrected = std::to_array<Case>({
             {Number{Number::kMaxRep}, Number{6, -1}, Number{(Number::kMaxRep / 10) + 1, 1}},
         });
-        auto test = [this](auto const& c) {
+        auto test = [](auto const& c) {
             for (auto const& [x, y, z] : c)
             {
                 auto const result = x + y;
                 std::stringstream ss;
                 ss << x << " + " << y << " = " << result << ". Expected: " << z;
-                BEAST_EXPECTS(result == z, ss.str());
+                EXPECT_EQ(result, z) << ss.str();
             }
         };
         if (scale == MantissaRange::MantissaScale::Small)
@@ -302,15 +306,18 @@ public:
             {
                 caught = true;
             }
-            BEAST_EXPECT(caught);
+            EXPECT_TRUE(caught);
         }
     }
+}
 
-    void
-    testSub()
+TEST(NumberTest, sub)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         auto const scale = Number::getMantissaScale();
-        testcase << "test_sub " << to_string(scale);
 
         using Case = std::tuple<Number, Number, Number>;
         auto const cSmall = std::to_array<Case>(
@@ -370,13 +377,13 @@ public:
                  Number{Number::kMaxRep}},
                 {power(2, 63), Number{3, 0}, Number{Number::kMaxRep}},
             });
-        auto test = [this](auto const& c) {
+        auto test = [](auto const& c) {
             for (auto const& [x, y, z] : c)
             {
                 auto const result = x - y;
                 std::stringstream ss;
                 ss << x << " - " << y << " = " << result << ". Expected: " << z;
-                BEAST_EXPECTS(result == z, ss.str());
+                EXPECT_EQ(result, z) << ss.str();
             }
         };
         if (scale == MantissaRange::MantissaScale::Small)
@@ -388,21 +395,24 @@ public:
             test(cLarge);
         }
     }
+}
 
-    void
-    testMul()
+TEST(NumberTest, mul)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         auto const scale = Number::getMantissaScale();
-        testcase << "test_mul " << to_string(scale);
 
         using Case = std::tuple<Number, Number, Number>;
-        auto test = [this](auto const& c) {
+        auto test = [](auto const& c) {
             for (auto const& [x, y, z] : c)
             {
                 auto const result = x * y;
                 std::stringstream ss;
                 ss << x << " * " << y << " = " << result << ". Expected: " << z;
-                BEAST_EXPECTS(result == z, ss.str());
+                EXPECT_EQ(result, z) << ss.str();
             }
         };
         auto tests = [&](auto const& cSmall, auto const& cLarge) {
@@ -484,7 +494,6 @@ public:
             tests(cSmall, cLarge);
         }
         Number::setround(Number::RoundingMode::TowardsZero);
-        testcase << "test_mul " << to_string(Number::getMantissaScale()) << " towards_zero";
         {
             auto const cSmall = std::to_array<Case>(
                 {{Number{7}, Number{8}, Number{56}},
@@ -551,7 +560,6 @@ public:
             tests(cSmall, cLarge);
         }
         Number::setround(Number::RoundingMode::Downward);
-        testcase << "test_mul " << to_string(Number::getMantissaScale()) << " downward";
         {
             auto const cSmall = std::to_array<Case>(
                 {{Number{7}, Number{8}, Number{56}},
@@ -618,7 +626,6 @@ public:
             tests(cSmall, cLarge);
         }
         Number::setround(Number::RoundingMode::Upward);
-        testcase << "test_mul " << to_string(Number::getMantissaScale()) << " upward";
         {
             auto const cSmall = std::to_array<Case>(
                 {{Number{7}, Number{8}, Number{56}},
@@ -684,7 +691,6 @@ public:
                 });
             tests(cSmall, cLarge);
         }
-        testcase << "test_mul " << to_string(Number::getMantissaScale()) << " overflow";
         {
             bool caught = false;
             try
@@ -696,24 +702,27 @@ public:
             {
                 caught = true;
             }
-            BEAST_EXPECT(caught);
+            EXPECT_TRUE(caught);
         }
     }
+}
 
-    void
-    testDiv()
+TEST(NumberTest, div)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         auto const scale = Number::getMantissaScale();
-        testcase << "test_div " << to_string(scale);
 
         using Case = std::tuple<Number, Number, Number>;
-        auto test = [this](auto const& c) {
+        auto test = [](auto const& c) {
             for (auto const& [x, y, z] : c)
             {
                 auto const result = x / y;
                 std::stringstream ss;
                 ss << x << " / " << y << " = " << result << ". Expected: " << z;
-                BEAST_EXPECTS(result == z, ss.str());
+                EXPECT_EQ(result, z) << ss.str();
             }
         };
         auto const maxMantissa = Number::maxMantissa();
@@ -764,7 +773,6 @@ public:
                   Number{false, maxMantissa, -18, Number::Normalized{}}}});
             tests(cSmall, cLarge);
         }
-        testcase << "test_div " << to_string(Number::getMantissaScale()) << " towards_zero";
         Number::setround(Number::RoundingMode::TowardsZero);
         {
             auto const cSmall = std::to_array<Case>(
@@ -802,7 +810,6 @@ public:
                   Number{false, maxMantissa, -18, Number::Normalized{}}}});
             tests(cSmall, cLarge);
         }
-        testcase << "test_div " << to_string(Number::getMantissaScale()) << " downward";
         Number::setround(Number::RoundingMode::Downward);
         {
             auto const cSmall = std::to_array<Case>(
@@ -840,7 +847,6 @@ public:
                   Number{false, maxMantissa, -18, Number::Normalized{}}}});
             tests(cSmall, cLarge);
         }
-        testcase << "test_div " << to_string(Number::getMantissaScale()) << " upward";
         Number::setround(Number::RoundingMode::Upward);
         {
             auto const cSmall = std::to_array<Case>(
@@ -878,7 +884,6 @@ public:
                   Number{false, maxMantissa, -18, Number::Normalized{}}}});
             tests(cSmall, cLarge);
         }
-        testcase << "test_div " << to_string(Number::getMantissaScale()) << " overflow";
         bool caught = false;
         try
         {
@@ -888,29 +893,30 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
     }
+}
 
-    void
-    testRoot()
+TEST(NumberTest, root)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        auto const scale = Number::getMantissaScale();
-        testcase << "test_root " << to_string(scale);
+        NumberMantissaScaleGuard const sg(mantissaScale);
 
         using Case = std::tuple<Number, unsigned, Number>;
-        auto test = [this](auto const& c) {
+        auto test = [](auto const& c) {
             for (auto const& [x, y, z] : c)
             {
                 auto const result = root(x, y);
                 std::stringstream ss;
                 ss << "root(" << x << ", " << y << ") = " << result << ". Expected: " << z;
-                BEAST_EXPECTS(result == z, ss.str());
+                EXPECT_EQ(result, z) << ss.str();
             }
         };
         /*
         auto tests = [&](auto const& cSmall, auto const& cLarge) {
             test(cSmall);
-            if (scale != MantissaRange::MantissaScale::Small)
+            if (scale != MantissaRange::mantissa_scale::small)
                 test(cLarge);
         };
         */
@@ -954,7 +960,7 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
         caught = false;
         try
         {
@@ -964,23 +970,24 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
     }
+}
 
-    void
-    testRoot2()
+TEST(NumberTest, root2)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        auto const scale = Number::getMantissaScale();
-        testcase << "test_root2 " << to_string(scale);
+        NumberMantissaScaleGuard const sg(mantissaScale);
 
-        auto test = [this](auto const& c) {
+        auto test = [](auto const& c) {
             for (auto const& x : c)
             {
                 auto const expected = root(x, 2);
                 auto const result = root2(x);
                 std::stringstream ss;
                 ss << "root2(" << x << ") = " << result << ". Expected: " << expected;
-                BEAST_EXPECTS(result == expected, ss.str());
+                EXPECT_EQ(result, expected) << ss.str();
             }
         };
 
@@ -1005,13 +1012,16 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
     }
+}
 
-    void
-    testPower1()
+TEST(NumberTest, power1)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        testcase << "test_power1 " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         using Case = std::tuple<Number, unsigned, Number>;
         Case const c[]{
             {Number{64}, 0, Number{1}},
@@ -1023,13 +1033,16 @@ public:
             {Number{64}, 11, Number{false, 7378697629483820646ULL, 1, Number::Normalized{}}},
             {Number{-64}, 11, Number{true, 7378697629483820646ULL, 1, Number::Normalized{}}}};
         for (auto const& [x, y, z] : c)
-            BEAST_EXPECT((power(x, y) == z));
+            EXPECT_EQ(power(x, y), z);
     }
+}
 
-    void
-    testPower2()
+TEST(NumberTest, power2)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        testcase << "test_power2 " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         using Case = std::tuple<Number, unsigned, unsigned, Number>;
         Case const c[]{
             {Number{1}, 3, 7, Number{1}},
@@ -1039,7 +1052,7 @@ public:
             {Number{34}, 3, 3, Number{34}},
             {Number{4}, 3, 2, Number{8}}};
         for (auto const& [x, n, d, z] : c)
-            BEAST_EXPECT((power(x, n, d) == z));
+            EXPECT_EQ(power(x, n, d), z);
         bool caught = false;
         try
         {
@@ -1049,7 +1062,7 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
         caught = false;
         try
         {
@@ -1059,7 +1072,7 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
         caught = false;
         try
         {
@@ -1069,40 +1082,44 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
     }
+}
 
-    void
-    testConversions()
+TEST(NumberTest, conversions)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        testcase << "testConversions " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
 
         IOUAmount const x{5, 6};
         Number const y = x;
-        BEAST_EXPECT((y == Number{5, 6}));
+        EXPECT_EQ(y, (Number{5, 6}));
         IOUAmount const z{y};
-        BEAST_EXPECT(x == z);
+        EXPECT_EQ(x, z);
         XRPAmount const xrp{500};
         STAmount const st = xrp;
         Number const n = st;
-        BEAST_EXPECT(XRPAmount{n} == xrp);
+        EXPECT_EQ(XRPAmount{n}, xrp);
         IOUAmount const x0{0, 0};
         Number const y0 = x0;
-        BEAST_EXPECT((y0 == Number{0}));
+        EXPECT_EQ(y0, Number{0});
         IOUAmount const z0{y0};
-        BEAST_EXPECT(x0 == z0);
+        EXPECT_EQ(x0, z0);
         XRPAmount const xrp0{0};
         Number const n0 = xrp0;
-        BEAST_EXPECT(n0 == Number{0});
-        // NOLINTNEXTLINE(misc-confusable-identifiers)
-        XRPAmount const xrp1{n0};
-        BEAST_EXPECT(xrp1 == xrp0);
+        EXPECT_EQ(n0, Number{0});
+        XRPAmount const xrp1{n0};  // NOLINT misc-confusable-identifiers
+        EXPECT_EQ(xrp1, xrp0);
     }
+}
 
-    void
-    testToInteger()
+TEST(NumberTest, to_integer)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        testcase << "test_to_integer " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         using Case = std::tuple<Number, std::int64_t>;
         SaveNumberRoundMode const save{Number::setround(Number::RoundingMode::ToNearest)};
         {
@@ -1138,11 +1155,11 @@ public:
             for (auto const& [x, y] : c)
             {
                 auto j = static_cast<std::int64_t>(x);
-                BEAST_EXPECT(j == y);
+                EXPECT_EQ(j, y);
             }
         }
         auto prevMode = Number::setround(Number::RoundingMode::TowardsZero);
-        BEAST_EXPECT(prevMode == Number::RoundingMode::ToNearest);
+        EXPECT_EQ(prevMode, Number::RoundingMode::ToNearest);
         {
             Case const c[]{
                 {Number{0}, 0},
@@ -1176,11 +1193,11 @@ public:
             for (auto const& [x, y] : c)
             {
                 auto j = static_cast<std::int64_t>(x);
-                BEAST_EXPECT(j == y);
+                EXPECT_EQ(j, y);
             }
         }
         prevMode = Number::setround(Number::RoundingMode::Downward);
-        BEAST_EXPECT(prevMode == Number::RoundingMode::TowardsZero);
+        EXPECT_EQ(prevMode, Number::RoundingMode::TowardsZero);
         {
             Case const c[]{
                 {Number{0}, 0},
@@ -1214,11 +1231,11 @@ public:
             for (auto const& [x, y] : c)
             {
                 auto j = static_cast<std::int64_t>(x);
-                BEAST_EXPECT(j == y);
+                EXPECT_EQ(j, y);
             }
         }
         prevMode = Number::setround(Number::RoundingMode::Upward);
-        BEAST_EXPECT(prevMode == Number::RoundingMode::Downward);
+        EXPECT_EQ(prevMode, Number::RoundingMode::Downward);
         {
             Case const c[]{
                 {Number{0}, 0},
@@ -1252,7 +1269,7 @@ public:
             for (auto const& [x, y] : c)
             {
                 auto j = static_cast<std::int64_t>(x);
-                BEAST_EXPECT(j == y);
+                EXPECT_EQ(j, y);
             }
         }
         bool caught = false;
@@ -1264,33 +1281,39 @@ public:
         {
             caught = true;
         }
-        BEAST_EXPECT(caught);
+        EXPECT_TRUE(caught);
     }
+}
 
-    void
-    testSquelch()
+TEST(NumberTest, squelch)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        testcase << "test_squelch " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         Number const limit{1, -6};
-        BEAST_EXPECT((squelch(Number{2, -6}, limit) == Number{2, -6}));
-        BEAST_EXPECT((squelch(Number{1, -6}, limit) == Number{1, -6}));
-        BEAST_EXPECT((squelch(Number{9, -7}, limit) == Number{0}));
-        BEAST_EXPECT((squelch(Number{-2, -6}, limit) == Number{-2, -6}));
-        BEAST_EXPECT((squelch(Number{-1, -6}, limit) == Number{-1, -6}));
-        BEAST_EXPECT((squelch(Number{-9, -7}, limit) == Number{0}));
+        EXPECT_EQ(squelch(Number{2, -6}, limit), (Number{2, -6}));
+        EXPECT_EQ(squelch(Number{1, -6}, limit), (Number{1, -6}));
+        EXPECT_EQ(squelch(Number{9, -7}, limit), Number{0});
+        EXPECT_EQ(squelch(Number{-2, -6}, limit), (Number{-2, -6}));
+        EXPECT_EQ(squelch(Number{-1, -6}, limit), (Number{-1, -6}));
+        EXPECT_EQ(squelch(Number{-9, -7}, limit), Number{0});
     }
+}
 
-    void
-    testToString()
+TEST(NumberTest, to_string)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        auto const scale = Number::getMantissaScale();
-        testcase << "testToString " << to_string(scale);
+        NumberMantissaScaleGuard const sg(mantissaScale);
 
-        auto test = [this](Number const& n, std::string const& expected) {
+        auto const scale = Number::getMantissaScale();
+
+        auto test = [](Number const& n, std::string const& expected) {
             auto const result = to_string(n);
             std::stringstream ss;
             ss << "to_string(" << result << "). Expected: " << expected;
-            BEAST_EXPECTS(result == expected, ss.str());
+            EXPECT_EQ(result, expected) << ss.str();
         };
 
         test(Number(-2, 0), "-2");
@@ -1322,7 +1345,7 @@ public:
                     NumberRoundModeGuard const mg(Number::RoundingMode::TowardsZero);
 
                     auto const maxMantissa = Number::maxMantissa();
-                    BEAST_EXPECT(maxMantissa == 9'999'999'999'999'999);
+                    EXPECT_EQ(maxMantissa, (9'999'999'999'999'999));
                     test(
                         Number{false, (maxMantissa * 1000) + 999, -3, Number::Normalized()},
                         "9999999999999999");
@@ -1353,7 +1376,7 @@ public:
                     NumberRoundModeGuard const mg(Number::RoundingMode::TowardsZero);
 
                     auto const maxMantissa = Number::maxMantissa();
-                    BEAST_EXPECT(maxMantissa == 9'999'999'999'999'999'999ULL);
+                    EXPECT_EQ((maxMantissa), (9'999'999'999'999'999'999ULL));
                     test(
                         Number{false, maxMantissa, 0, Number::Normalized{}}, "9999999999999999990");
                     test(
@@ -1383,18 +1406,20 @@ public:
                     "-9223372036854775810");
                 break;
             default:
-                BEAST_EXPECT(false);
+                EXPECT_TRUE(false);
         }
     }
+}
 
-    void
-    testRelationals()
+TEST(NumberTest, relationals)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        testcase << "test_relationals " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
 
         {
-            auto test = [this](auto const& nums) {
-                BEAST_EXPECT(std::ranges::is_sorted(nums));
+            auto test = [](auto const& nums) {
+                EXPECT_TRUE(std::ranges::is_sorted(nums));
 
                 for (auto iter1 = nums.begin(); iter1 != nums.end(); ++iter1)
                 {
@@ -1410,32 +1435,32 @@ public:
                         // The ==/!= operators use a completely different code path than <, etc.
                         // This helps detect a breakage in one but not the other. It also helps
                         // verify that the values are being ordered correctly.
-                        BEAST_EXPECTS(smaller != larger, str + " (!=)");
-                        BEAST_EXPECTS(!(smaller == larger), str + " (==)");
+                        EXPECT_TRUE(smaller != larger) << str << " (!=)";
+                        EXPECT_FALSE(smaller == larger) << str << " (==)";
 
                         // true results using operator< and derived operators
-                        BEAST_EXPECTS(smaller < larger, str + " (<)");
-                        BEAST_EXPECTS(larger > smaller, str + " (>)");
-                        BEAST_EXPECTS(larger >= smaller, str + " (>=)");
-                        BEAST_EXPECTS(smaller <= larger, str + " (<=)");
+                        EXPECT_TRUE(smaller < larger) << str << " (<)";
+                        EXPECT_TRUE(larger > smaller) << str << " (>)";
+                        EXPECT_TRUE(larger >= smaller) << str << " (>=)";
+                        EXPECT_TRUE(smaller <= larger) << str << " (<=)";
 
                         // false results using operator< and derived operators
-                        BEAST_EXPECTS(!(larger < smaller), str + " (! <)");
-                        BEAST_EXPECTS(!(smaller > larger), str + " (! >)");
-                        BEAST_EXPECTS(!(smaller >= larger), str + " (! >=)");
-                        BEAST_EXPECTS(!(larger <= smaller), str + " (! <=)");
+                        EXPECT_FALSE(larger < smaller) << str << " (! <)";
+                        EXPECT_FALSE(smaller > larger) << str << " (! >)";
+                        EXPECT_FALSE(smaller >= larger) << str << " (! >=)";
+                        EXPECT_FALSE(larger <= smaller) << str << " (! <=)";
                     }
                 }
             };
 
-            auto const intNums = [this]() {
+            auto const intNums = []() {
                 // Inequality test cases are built from a list of sorted integers
                 auto const values =
                     std::to_array<int>({-100, -50, -20, -10, -1, 0, 1, 10, 20, 50, 100});
                 // Check this list is sorted before converting it to Numbers.
                 // That way if any of the other tests fail, we know it's because of code and not the
                 // source data.
-                BEAST_EXPECT(std::ranges::is_sorted(values));
+                EXPECT_TRUE(std::ranges::is_sorted(values));
 
                 std::vector<Number> result;
                 result.reserve(values.size());
@@ -1475,95 +1500,114 @@ public:
             for (auto const& [n, line] : c)
             {
                 auto const str = to_string(n);
+                auto const location =
+                    std::string{" ("} + __FILE__ + ":" + std::to_string(line) + ")";
 
                 // NOLINTBEGIN(misc-redundant-expression) Explicitly testing operators with
                 // equivalent values
-                expect(n == n, str + " ==", __FILE__, line);
-                expect(!(n != n), str + " !=", __FILE__, line);
+                EXPECT_TRUE(n == n) << str << " ==" << location;
+                EXPECT_FALSE(n != n) << str << " !=" << location;
 
-                expect(!(n < n), str + " < ", __FILE__, line);
-                expect(!(n > n), str + " >", __FILE__, line);
-                expect(n >= n, str + " >=", __FILE__, line);
-                expect(n <= n, str + " <=", __FILE__, line);
+                EXPECT_FALSE(n < n) << str << " <" << location;
+                EXPECT_FALSE(n > n) << str << " >" << location;
+                EXPECT_TRUE(n >= n) << str << " >=" << location;
+                EXPECT_TRUE(n <= n) << str << " <=" << location;
                 // NOLINTEND(misc-redundant-expression)
             }
         }
     }
+}
 
-    void
-    testStream()
+TEST(NumberTest, stream)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        testcase << "test_stream " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         Number const x{100};
         std::ostringstream os;
         os << x;
-        BEAST_EXPECT(os.str() == to_string(x));
+        EXPECT_EQ((os.str()), (to_string(x)));
     }
+}
 
-    void
-    testIncDec()
+TEST(NumberTest, inc_dec)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        testcase << "test_inc_dec " << to_string(Number::getMantissaScale());
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         Number x{100};
         Number const y = +x;
-        BEAST_EXPECT(x == y);
-        BEAST_EXPECT(x++ == y);
-        BEAST_EXPECT(x == Number{101});
-        BEAST_EXPECT(x-- == Number{101});
-        BEAST_EXPECT(x == y);
+        EXPECT_EQ((x), (y));
+        EXPECT_EQ((x++), (y));
+        EXPECT_EQ((x), (Number{101}));
+        EXPECT_EQ((x--), (Number{101}));
+        EXPECT_EQ((x), (y));
     }
+}
 
-    void
-    testToStAmount()
+TEST(NumberTest, to_st_amount)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         Issue const issue;
         Number const n{7'518'783'80596, -5};
         SaveNumberRoundMode const save{Number::setround(Number::RoundingMode::ToNearest)};
         auto res2 = STAmount{issue, n};
-        BEAST_EXPECT(res2 == STAmount{7518784});
+        EXPECT_EQ((res2), (STAmount{7518784}));
 
         Number::setround(Number::RoundingMode::TowardsZero);
         res2 = STAmount{issue, n};
-        BEAST_EXPECT(res2 == STAmount{7518783});
+        EXPECT_EQ((res2), (STAmount{7518783}));
 
         Number::setround(Number::RoundingMode::Downward);
         res2 = STAmount{issue, n};
-        BEAST_EXPECT(res2 == STAmount{7518783});
+        EXPECT_EQ((res2), (STAmount{7518783}));
 
         Number::setround(Number::RoundingMode::Upward);
         res2 = STAmount{issue, n};
-        BEAST_EXPECT(res2 == STAmount{7518784});
+        EXPECT_EQ((res2), (STAmount{7518784}));
     }
+}
 
-    void
-    testTruncate()
+TEST(NumberTest, truncate)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        BEAST_EXPECT(Number(25, +1).truncate() == Number(250, 0));
-        BEAST_EXPECT(Number(25, 0).truncate() == Number(25, 0));
-        BEAST_EXPECT(Number(25, -1).truncate() == Number(2, 0));
-        BEAST_EXPECT(Number(25, -2).truncate() == Number(0, 0));
-        BEAST_EXPECT(Number(99, -2).truncate() == Number(0, 0));
+        NumberMantissaScaleGuard const sg(mantissaScale);
 
-        BEAST_EXPECT(Number(-25, +1).truncate() == Number(-250, 0));
-        BEAST_EXPECT(Number(-25, 0).truncate() == Number(-25, 0));
-        BEAST_EXPECT(Number(-25, -1).truncate() == Number(-2, 0));
-        BEAST_EXPECT(Number(-25, -2).truncate() == Number(0, 0));
-        BEAST_EXPECT(Number(-99, -2).truncate() == Number(0, 0));
+        EXPECT_EQ((Number(25, +1).truncate()), (Number(250, 0)));
+        EXPECT_EQ((Number(25, 0).truncate()), (Number(25, 0)));
+        EXPECT_EQ((Number(25, -1).truncate()), (Number(2, 0)));
+        EXPECT_EQ((Number(25, -2).truncate()), (Number(0, 0)));
+        EXPECT_EQ((Number(99, -2).truncate()), (Number(0, 0)));
 
-        BEAST_EXPECT(Number(0, 0).truncate() == Number(0, 0));
-        BEAST_EXPECT(Number(0, 30000).truncate() == Number(0, 0));
-        BEAST_EXPECT(Number(0, -30000).truncate() == Number(0, 0));
-        BEAST_EXPECT(Number(100, -30000).truncate() == Number(0, 0));
-        BEAST_EXPECT(Number(100, -30000).truncate() == Number(0, 0));
-        BEAST_EXPECT(Number(-100, -30000).truncate() == Number(0, 0));
-        BEAST_EXPECT(Number(-100, -30000).truncate() == Number(0, 0));
+        EXPECT_EQ((Number(-25, +1).truncate()), (Number(-250, 0)));
+        EXPECT_EQ((Number(-25, 0).truncate()), (Number(-25, 0)));
+        EXPECT_EQ((Number(-25, -1).truncate()), (Number(-2, 0)));
+        EXPECT_EQ((Number(-25, -2).truncate()), (Number(0, 0)));
+        EXPECT_EQ((Number(-99, -2).truncate()), (Number(0, 0)));
+
+        EXPECT_EQ((Number(0, 0).truncate()), (Number(0, 0)));
+        EXPECT_EQ((Number(0, 30000).truncate()), (Number(0, 0)));
+        EXPECT_EQ((Number(0, -30000).truncate()), (Number(0, 0)));
+        EXPECT_EQ((Number(100, -30000).truncate()), (Number(0, 0)));
+        EXPECT_EQ((Number(100, -30000).truncate()), (Number(0, 0)));
+        EXPECT_EQ((Number(-100, -30000).truncate()), (Number(0, 0)));
+        EXPECT_EQ((Number(-100, -30000).truncate()), (Number(0, 0)));
     }
+}
 
-    void
-    testRounding()
+TEST(NumberTest, rounding)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         // Test that rounding works as expected.
-        testcase("Rounding");
 
         using NumberRoundings = std::map<Number::RoundingMode, std::int64_t>;
 
@@ -1659,348 +1703,340 @@ public:
             {
                 NumberRoundModeGuard const g{mode};
                 auto const res = static_cast<std::int64_t>(num);
-                BEAST_EXPECTS(
-                    res == val,
-                    to_string(num) + " with mode " + std::to_string(static_cast<int>(mode)) +
-                        " expected " + std::to_string(val) + " got " + std::to_string(res));
+                EXPECT_EQ((res), (val)) << to_string(num) + " with mode " +
+                        std::to_string(static_cast<int>(mode)) + " expected " +
+                        std::to_string(val) + " got " + std::to_string(res);
             }
         }
     }
+}
 
-    void
-    testInt64()
+TEST(NumberTest, int64)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const sg(mantissaScale);
+
         auto const scale = Number::getMantissaScale();
-        testcase << "std::int64_t " << to_string(scale);
 
         // Control case
-        BEAST_EXPECT(Number::maxMantissa() > 10);
+        EXPECT_GT((Number::maxMantissa()), (10));
         Number const ten{10};
-        BEAST_EXPECT(ten.exponent() <= 0);
+        EXPECT_LE((ten.exponent()), (0));
 
         if (scale == MantissaRange::MantissaScale::Small)
         {
-            BEAST_EXPECT(std::numeric_limits<std::int64_t>::max() > kInitialXrp.drops());
-            BEAST_EXPECT(Number::maxMantissa() < kInitialXrp.drops());
+            EXPECT_GT((std::numeric_limits<std::int64_t>::max()), (kInitialXrp.drops()));
+            EXPECT_LT((Number::maxMantissa()), (kInitialXrp.drops()));
             Number const initalXrp{kInitialXrp};
-            BEAST_EXPECT(initalXrp.exponent() > 0);
+            EXPECT_GT((initalXrp.exponent()), (0));
 
             Number const maxInt64{Number::kMaxRep};
-            BEAST_EXPECT(maxInt64.exponent() > 0);
+            EXPECT_GT((maxInt64.exponent()), (0));
             // 85'070'591'730'234'615'865'843'651'857'942'052'864 - 38 digits
-            BEAST_EXPECT((power(maxInt64, 2) == Number{85'070'591'730'234'62, 22}));
+            EXPECT_EQ((power(maxInt64, 2)), (Number{85'070'591'730'234'62, 22}));
 
             Number const max = Number{false, Number::maxMantissa(), 0, Number::Normalized{}};
-            BEAST_EXPECT(max.exponent() <= 0);
+            EXPECT_LE(max.exponent(), 0);
             // 99'999'999'999'999'980'000'000'000'000'001 - 32 digits
-            BEAST_EXPECT((power(max, 2) == Number{99'999'999'999'999'98, 16}));
+            EXPECT_EQ(power(max, 2), (Number{99'999'999'999'999'98, 16}));
         }
         else
         {
-            BEAST_EXPECT(std::numeric_limits<std::int64_t>::max() > kInitialXrp.drops());
-            BEAST_EXPECT(Number::maxMantissa() > kInitialXrp.drops());
+            EXPECT_GT((std::numeric_limits<std::int64_t>::max()), (kInitialXrp.drops()));
+            EXPECT_GT((Number::maxMantissa()), (kInitialXrp.drops()));
             Number const initalXrp{kInitialXrp};
-            BEAST_EXPECT(initalXrp.exponent() <= 0);
+            EXPECT_LE((initalXrp.exponent()), (0));
 
             Number const maxInt64{Number::kMaxRep};
-            BEAST_EXPECT(maxInt64.exponent() <= 0);
+            EXPECT_LE((maxInt64.exponent()), (0));
             // 85'070'591'730'234'615'847'396'907'784'232'501'249 - 38 digits
-            BEAST_EXPECT((power(maxInt64, 2) == Number{85'070'591'730'234'615'85, 19}));
+            EXPECT_EQ((power(maxInt64, 2)), (Number{85'070'591'730'234'615'85, 19}));
 
             NumberRoundModeGuard const mg(Number::RoundingMode::TowardsZero);
 
             auto const maxMantissa = Number::maxMantissa();
             Number const max = Number{false, maxMantissa, 0, Number::Normalized{}};
-            BEAST_EXPECT(max.mantissa() == maxMantissa / 10);
-            BEAST_EXPECT(max.exponent() == 1);
+            EXPECT_EQ((max.mantissa()), (maxMantissa / 10));
+            EXPECT_EQ((max.exponent()), (1));
             // 99'999'999'999'999'999'800'000'000'000'000'000'100 - also 38
             // digits
-            BEAST_EXPECT(
-                (power(max, 2) == Number{false, (maxMantissa / 10) - 1, 20, Number::Normalized{}}));
+            EXPECT_EQ(
+                (power(max, 2)), (Number{false, (maxMantissa / 10) - 1, 20, Number::Normalized{}}));
         }
     }
+}
 
-    void
-    testUpwardRoundsDown()
+TEST(NumberTest, upward_rounding_produces_value_not_below_exact_at_k_max_rep_cusp)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
+        NumberMantissaScaleGuard const mg{mantissaScale};
+        NumberRoundModeGuard const rg{Number::RoundingMode::Upward};
+
         auto const scale = Number::getMantissaScale();
+
+        constexpr std::int64_t kAValue = 1'000'000'000'000'049'863LL;
+        constexpr std::int64_t kBValue = 9'223'372'036'854'315'903LL;
+
+        Number const a = kAValue;
+        Number const b = kBValue;
+        Number const product = a * b;
+
+        // Exact reference in BigInt.
+        BigInt const exactProduct = BigInt(kAValue) * BigInt(kBValue);
+
+        // What Number actually stored.
+        BigInt storedValue = BigInt(product.mantissa());
+        for (int i = 0; i < product.exponent(); ++i)
+            storedValue *= 10;
+
+        BigInt const signedDifference = storedValue - exactProduct;
+
+        auto const message = [&] {
+            std::ostringstream os;
+            os << "\n"
+               << "  a              = " << fmt(BigInt(kAValue)) << "\n"
+               << "  b              = " << fmt(BigInt(kBValue)) << "\n"
+               << "  exact a*b      = " << fmt(exactProduct) << "\n"
+               << "  stored         = " << fmt(storedValue) << "\n"
+               << "  stored - exact = " << fmt(signedDifference) << "\n"
+               << "  upward         = " << (signedDifference >= 0 ? "held" : "VIOLATED") << "\n"
+               << " stored.mantissa = " << product.mantissa() << "\n"
+               << " stored.exponent = " << product.exponent() << "\n";
+            return os.str();
+        };
+
+        switch (scale)
         {
-            testcase << "upward rounding produces a value below exact at kMaxRep cusp "
-                     << to_string(scale);
+            case MantissaRange::MantissaScale::Large:
+                EXPECT_TRUE(signedDifference >= 0) << message();
+                EXPECT_TRUE(signedDifference < pow10<BigInt>(product.exponent())) << message();
+                EXPECT_EQ(product.mantissa(), (std::numeric_limits<std::int64_t>::max() / 10) + 1);
+                EXPECT_EQ(product.exponent(), 19);
+                break;
 
-            NumberRoundModeGuard const rg{Number::RoundingMode::Upward};
+            case MantissaRange::MantissaScale::LargeLegacy:
+                EXPECT_TRUE(signedDifference < 0) << message();
+                EXPECT_EQ(
+                    product.mantissa(), (std::numeric_limits<std::int64_t>::max() / 100) * 100);
+                EXPECT_EQ(product.exponent(), 18);
+                break;
 
-            constexpr std::int64_t kAValue = 1'000'000'000'000'049'863LL;
-            constexpr std::int64_t kBValue = 9'223'372'036'854'315'903LL;
-
-            Number const a = kAValue;
-            Number const b = kBValue;
-            Number const product = a * b;
-
-            // Exact reference in BigInt.
-            BigInt const exactProduct = BigInt(kAValue) * BigInt(kBValue);
-
-            // What Number actually stored.
-            BigInt storedValue = BigInt(product.mantissa());
-            for (int i = 0; i < product.exponent(); ++i)
-                storedValue *= 10;
-
-            BigInt const signedDifference = storedValue - exactProduct;
-
-            log << "\n"
-                << "  a              = " << fmt(BigInt(kAValue)) << "\n"
-                << "  b              = " << fmt(BigInt(kBValue)) << "\n"
-                << "  exact a*b      = " << fmt(exactProduct) << "\n"
-                << "  stored         = " << fmt(storedValue) << "\n"
-                << "  stored - exact = " << fmt(signedDifference) << "\n"
-                << "  upward         = " << (signedDifference >= 0 ? "held" : "VIOLATED") << "\n"
-                << " stored.mantissa = " << product.mantissa() << "\n"
-                << " stored.exponent = " << product.exponent() << "\n";
-            log.flush();
-
-            switch (scale)
-            {
-                case MantissaRange::MantissaScale::Large:
-                    BEAST_EXPECT(signedDifference >= 0);
-                    BEAST_EXPECT(signedDifference < pow10<BigInt>(product.exponent()));
-                    BEAST_EXPECT(
-                        product.mantissa() == (std::numeric_limits<std::int64_t>::max() / 10) + 1);
-                    BEAST_EXPECT(product.exponent() == 19);
-                    break;
-
-                case MantissaRange::MantissaScale::LargeLegacy:
-                    BEAST_EXPECT(signedDifference < 0);
-                    BEAST_EXPECT(
-                        product.mantissa() ==
-                        (std::numeric_limits<std::int64_t>::max() / 100) * 100);
-                    BEAST_EXPECT(product.exponent() == 18);
-                    break;
-
-                case MantissaRange::MantissaScale::Small:
-                    // The seemingly weird rounding here is because
-                    // a & b are both normalized, and both round up when
-                    // being converted to Number, so you're really
-                    // getting 1_000_000_000_000_050 * 9_223_372_036_854_316
-                    BEAST_EXPECT(signedDifference >= 0);
-                    BEAST_EXPECT(
-                        product.mantissa() ==
-                        (std::numeric_limits<std::int64_t>::max() / 1000) + 3);
-                    BEAST_EXPECT(product.exponent() == 21);
-                    break;
-            }
-        }
-
-        {
-            /* Companion regression for the kMaxRep cusp behavior, but for
-             * `operator/=` on the cusp-fix-ENABLED `Large` scale.
-             *
-             * Before the dropped-remainder fix, `operator/=` with Upward
-             * rounding could return a value STRICTLY LESS than the exact quotient,
-             * violating Upward's directional invariant.
-             *
-             * Mechanism (fix-enabled path):
-             *   1. `operator/=` computes `numerator = nm * 10^17` and
-             *      `zm = numerator / dm` (integer division, truncates remainder).
-             *   2. If `remainder != 0`, the correction block runs:
-             *        zm *= 100000
-             *        correction = (remainder * 100000) / dm  // also truncates
-             *        zm += correction
-             *        ze -= 5
-             *      The truncation in `correction` discards a sub-1/100000 residual.
-             *   3. `normalize`'s shift loop reduces zm to fit, but the discarded
-             *      residual is BELOW the Guard's visibility, so the Guard sees fraction = 0.
-             *   4. Under Upward + positive, `round()` returns -1 (no round-up), and
-             *      the algorithm returns the truncated zm
-             */
-            testcase << "operator/= Upward on Large returns value < truth " << to_string(scale);
-
-            NumberRoundModeGuard const roundGuard{Number::RoundingMode::Upward};
-
-            constexpr std::int64_t aValue = 2LL;
-            constexpr std::int64_t bValue = 1'000'000'000'000'000'007LL;
-            // bValue = 10^18 + 7 (prime, in [minMantissa, kMaxRep]).
-
-            Number const a{aValue, 0};
-            Number const b{bValue, 0};
-            Number const quotient = a / b;
-
-            dec const exact = dec(aValue) / dec(bValue);
-            dec const stored = dec(quotient.mantissa()) * pow10(quotient.exponent());
-            dec const diff = stored - exact;
-
-            log << "\n"
-                << "  a                 = " << aValue << "\n"
-                << "  b                 = " << bValue << "\n"
-                << "  exact a/b         = " << fmt(exact) << "\n"
-                << "  stored a/b        = " << fmt(stored) << "\n"
-                << "  stored - exact    = " << fmt(diff)
-                << "    (negative => Upward gave value BELOW truth)\n"
-                << "  quotient.mantissa = " << quotient.mantissa() << "\n"
-                << "  quotient.exponent = " << quotient.exponent() << "\n";
-            log.flush();
-
-            // Upward invariant: stored >= exact. Bug: stored < exact.
-            switch (scale)
-            {
-                case MantissaRange::MantissaScale::Large:
-                    BEAST_EXPECT(stored >= exact);
-                    BEAST_EXPECT(diff < pow10(quotient.exponent()));
-                    break;
-
-                case MantissaRange::MantissaScale::LargeLegacy:
-                    BEAST_EXPECT(stored < exact);
-                    BEAST_EXPECT(diff >= -pow10(quotient.exponent()));
-                    break;
-
-                case MantissaRange::MantissaScale::Small:
-                    // Small mantissa doesn't have the correction for
-                    // dropped remainders
-                    BEAST_EXPECT(stored < exact);
-                    break;
-            }
-        }
-        {
-            /* Companion test case for Upward positive operator/=: Downward negative
-             */
-            testcase << "operator/= Downward on Large returns value < truth " << to_string(scale);
-
-            NumberRoundModeGuard const roundGuard{Number::RoundingMode::Downward};
-
-            constexpr std::int64_t aValue = -2LL;
-            constexpr std::int64_t bValue = 1'000'000'000'000'000'007LL;
-            // bValue = 10^18 + 7 (prime, in [minMantissa, kMaxRep]).
-
-            Number const a{aValue, 0};
-            Number const b{bValue, 0};
-            Number const quotient = a / b;
-
-            dec const exact = dec(aValue) / dec(bValue);
-            dec const stored = dec(quotient.mantissa()) * pow10(quotient.exponent());
-            dec const diff = stored - exact;
-
-            log << "\n"
-                << "  a                 = " << aValue << "\n"
-                << "  b                 = " << bValue << "\n"
-                << "  exact a/b         = " << fmt(exact) << "\n"
-                << "  stored a/b        = " << fmt(stored) << "\n"
-                << "  stored - exact    = " << fmt(diff)
-                << "    (positive => Downward gave value ABOVE truth)\n"
-                << "  quotient.mantissa = " << quotient.mantissa() << "\n"
-                << "  quotient.exponent = " << quotient.exponent() << "\n";
-            log.flush();
-
-            // invariant: stored <= exact. Bug: stored > exact.
-            switch (scale)
-            {
-                case MantissaRange::MantissaScale::Large:
-                    BEAST_EXPECT(stored <= exact);
-                    BEAST_EXPECT(diff > -pow10(quotient.exponent()));
-                    break;
-
-                case MantissaRange::MantissaScale::LargeLegacy:
-                    BEAST_EXPECT(stored > exact);
-                    BEAST_EXPECT(diff <= pow10(quotient.exponent()));
-                    break;
-
-                case MantissaRange::MantissaScale::Small:
-                    // Small mantissa doesn't have the correction for
-                    // dropped remainders
-                    BEAST_EXPECT(stored < exact);
-                    break;
-            }
-        }
-        {
-            /* Companion test case for Upward positive operator/=: ToNearest
-             *
-             * With ToNearest, if the dropped digits are exactly "5", then the mantissa will be
-             * rounded to even. The numbers below result in a value where the unrounded mantissa
-             * ends in an even digit, and "infinite precision" would drop
-             * "500000000000000000145...", but doNormalize only sees "5". Without the rounding fix,
-             * doNormalize rounds down to the even value. With the rounding fix, doNormalize knows
-             * there are more digits beyond "5", and so rounds _up_ to the odd value.
-             */
-            testcase << "operator/= ToNearest on Large returns value < truth " << to_string(scale);
-
-            NumberRoundModeGuard const roundGuard{Number::RoundingMode::ToNearest};
-
-            constexpr std::int64_t aValue = 1'269'917'268'816'087'809LL;
-            constexpr std::int64_t bValue = 3'458'525'013'821'685'511LL;
-            // bValue = 10^18 + 7 (prime, in [minMantissa, kMaxRep]).
-
-            Number const a{aValue, 0};
-            Number const b{bValue, 0};
-            Number const quotient = a / b;
-
-            dec const exact = dec(aValue) / dec(bValue);
-            dec const stored = dec(quotient.mantissa()) * pow10(quotient.exponent());
-            dec const diff = stored - exact;
-
-            log << "\n"
-                << "  a                 = " << aValue << "\n"
-                << "  b                 = " << bValue << "\n"
-                << "  exact a/b         = " << fmt(exact) << "\n"
-                << "  stored a/b        = " << fmt(stored) << "\n"
-                << "  stored - exact    = " << fmt(diff)
-                << "    (negative => ToNearest gave value BELOW truth)\n"
-                << "  quotient.mantissa = " << quotient.mantissa() << "\n"
-                << "  quotient.exponent = " << quotient.exponent() << "\n";
-            log.flush();
-
-            // invariant: stored >= exact. Bug: stored < exact.
-            switch (scale)
-            {
-                case MantissaRange::MantissaScale::Large:
-                    BEAST_EXPECT(stored >= exact);
-                    BEAST_EXPECT(diff < pow10(quotient.exponent()));
-                    break;
-
-                case MantissaRange::MantissaScale::LargeLegacy:
-                    BEAST_EXPECT(stored < exact);
-                    BEAST_EXPECT(diff >= -pow10(quotient.exponent()));
-                    break;
-
-                case MantissaRange::MantissaScale::Small:
-                    // Small mantissa doesn't have the correction for
-                    // dropped remainders
-                    BEAST_EXPECT(stored < exact);
-                    break;
-            }
+            case MantissaRange::MantissaScale::Small:
+                // The seemingly weird rounding here is because a & b are both
+                // normalized, and both round up when being converted to Number,
+                // so you're really getting
+                // 1_000_000_000_000_050 * 9_223_372_036_854_316.
+                EXPECT_TRUE(signedDifference >= 0) << message();
+                EXPECT_EQ(
+                    product.mantissa(), (std::numeric_limits<std::int64_t>::max() / 1000) + 3);
+                EXPECT_EQ(product.exponent(), 21);
+                break;
         }
     }
+}
 
-    void
-    run() override
+/*
+ * Companion regression for the kMaxRep cusp behavior, but for `operator/=` on
+ * the cusp-fix-ENABLED `Large` scale.
+ *
+ * Before the dropped-remainder fix, `operator/=` with Upward rounding could
+ * return a value STRICTLY LESS than the exact quotient, violating Upward's
+ * directional invariant.
+ *
+ * Mechanism (fix-enabled path):
+ *   1. `operator/=` computes `numerator = nm * 10^17` and
+ *      `zm = numerator / dm` (integer division, truncates remainder).
+ *   2. If `remainder != 0`, the correction block runs:
+ *        zm *= 100000
+ *        correction = (remainder * 100000) / dm  // also truncates
+ *        zm += correction
+ *        ze -= 5
+ *      The truncation in `correction` discards a sub-1/100000 residual.
+ *   3. `normalize`'s shift loop reduces zm to fit, but the discarded residual
+ *      is BELOW the Guard's visibility, so the Guard sees fraction = 0.
+ *   4. Under Upward + positive, `round()` returns -1 (no round-up), and the
+ *      algorithm returns the truncated zm.
+ */
+TEST(NumberTest, upward_division_returns_value_not_below_exact_on_large_scale)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
     {
-        for (auto const scale : MantissaRange::getAllScales())
-        {
-            NumberMantissaScaleGuard const sg(scale);
-            testZero();
-            testLimits();
-            testToString();
-            testAdd();
-            testSub();
-            testMul();
-            testDiv();
-            testRoot();
-            testRoot2();
-            testPower1();
-            testPower2();
-            testConversions();
-            testToInteger();
-            testSquelch();
-            testRelationals();
-            testStream();
-            testIncDec();
-            testToStAmount();
-            testTruncate();
-            testRounding();
-            testInt64();
+        NumberMantissaScaleGuard const mg{mantissaScale};
+        NumberRoundModeGuard const rg{Number::RoundingMode::Upward};
 
-            testUpwardRoundsDown();
+        auto const scale = Number::getMantissaScale();
+
+        constexpr std::int64_t kAValue = 2LL;
+        constexpr std::int64_t kBValue = 1'000'000'000'000'000'007LL;
+        // kBValue = 10^18 + 7 (prime, in [minMantissa, kMaxRep]).
+
+        Number const a{kAValue, 0};
+        Number const b{kBValue, 0};
+        Number const quotient = a / b;
+
+        Dec const exact = Dec(kAValue) / Dec(kBValue);
+        Dec const stored = Dec(quotient.mantissa()) * pow10(quotient.exponent());
+        Dec const diff = stored - exact;
+
+        auto const message = [&] {
+            std::ostringstream os;
+            os << "\n"
+               << "  a                 = " << kAValue << "\n"
+               << "  b                 = " << kBValue << "\n"
+               << "  exact a/b         = " << fmt(exact) << "\n"
+               << "  stored a/b        = " << fmt(stored) << "\n"
+               << "  stored - exact    = " << fmt(diff)
+               << "    (negative => Upward gave value BELOW truth)\n"
+               << "  quotient.mantissa = " << quotient.mantissa() << "\n"
+               << "  quotient.exponent = " << quotient.exponent() << "\n";
+            return os.str();
+        };
+
+        // Upward invariant: stored >= exact. Bug: stored < exact.
+        switch (scale)
+        {
+            case MantissaRange::MantissaScale::Large:
+                EXPECT_TRUE(stored >= exact) << message();
+                EXPECT_TRUE(diff < pow10(quotient.exponent())) << message();
+                break;
+
+            case MantissaRange::MantissaScale::LargeLegacy:
+                EXPECT_TRUE(stored < exact) << message();
+                EXPECT_TRUE(diff >= -pow10(quotient.exponent())) << message();
+                break;
+
+            case MantissaRange::MantissaScale::Small:
+                // Small mantissa doesn't have the correction for dropped remainders.
+                EXPECT_TRUE(stored < exact) << message();
+                break;
         }
     }
-};
+}
 
-BEAST_DEFINE_TESTSUITE(Number, basics, xrpl);
+// Companion test case for Upward positive operator/=: Downward negative.
+TEST(NumberTest, downward_division_returns_value_not_above_exact_on_large_scale)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
+    {
+        NumberMantissaScaleGuard const mg{mantissaScale};
+        NumberRoundModeGuard const rg{Number::RoundingMode::Downward};
+
+        auto const scale = Number::getMantissaScale();
+
+        constexpr std::int64_t kAValue = -2LL;
+        constexpr std::int64_t kBValue = 1'000'000'000'000'000'007LL;
+        // kBValue = 10^18 + 7 (prime, in [minMantissa, kMaxRep]).
+
+        Number const a{kAValue, 0};
+        Number const b{kBValue, 0};
+        Number const quotient = a / b;
+
+        Dec const exact = Dec(kAValue) / Dec(kBValue);
+        Dec const stored = Dec(quotient.mantissa()) * pow10(quotient.exponent());
+        Dec const diff = stored - exact;
+
+        auto const message = [&] {
+            std::ostringstream os;
+            os << "\n"
+               << "  a                 = " << kAValue << "\n"
+               << "  b                 = " << kBValue << "\n"
+               << "  exact a/b         = " << fmt(exact) << "\n"
+               << "  stored a/b        = " << fmt(stored) << "\n"
+               << "  stored - exact    = " << fmt(diff)
+               << "    (positive => Downward gave value ABOVE truth)\n"
+               << "  quotient.mantissa = " << quotient.mantissa() << "\n"
+               << "  quotient.exponent = " << quotient.exponent() << "\n";
+            return os.str();
+        };
+
+        // Downward invariant: stored <= exact. Bug: stored > exact.
+        switch (scale)
+        {
+            case MantissaRange::MantissaScale::Large:
+                EXPECT_TRUE(stored <= exact) << message();
+                EXPECT_TRUE(diff > -pow10(quotient.exponent())) << message();
+                break;
+
+            case MantissaRange::MantissaScale::LargeLegacy:
+                EXPECT_TRUE(stored > exact) << message();
+                EXPECT_TRUE(diff <= pow10(quotient.exponent())) << message();
+                break;
+
+            case MantissaRange::MantissaScale::Small:
+                // Small mantissa doesn't have the correction for dropped remainders.
+                EXPECT_TRUE(stored < exact) << message();
+                break;
+        }
+    }
+}
+
+/*
+ * Companion test case for Upward positive operator/=: ToNearest.
+ *
+ * With ToNearest, if the dropped digits are exactly "5", then the mantissa will
+ * be rounded to even. The numbers below result in a value where the unrounded
+ * mantissa ends in an even digit, and "infinite precision" would drop
+ * "500000000000000000145...", but doNormalize only sees "5". Without the
+ * rounding fix, doNormalize rounds down to the even value. With the rounding
+ * fix, doNormalize knows there are more digits beyond "5", and so rounds _up_
+ * to the odd value.
+ */
+TEST(NumberTest, to_nearest_division_uses_dropped_digits_on_large_scale)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
+    {
+        NumberMantissaScaleGuard const mg{mantissaScale};
+        NumberRoundModeGuard const rg{Number::RoundingMode::ToNearest};
+
+        auto const scale = Number::getMantissaScale();
+
+        constexpr std::int64_t kAValue = 1'269'917'268'816'087'809LL;
+        constexpr std::int64_t kBValue = 3'458'525'013'821'685'511LL;
+        // kBValue is prime and in [minMantissa, kMaxRep].
+
+        Number const a{kAValue, 0};
+        Number const b{kBValue, 0};
+        Number const quotient = a / b;
+
+        Dec const exact = Dec(kAValue) / Dec(kBValue);
+        Dec const stored = Dec(quotient.mantissa()) * pow10(quotient.exponent());
+        Dec const diff = stored - exact;
+
+        auto const message = [&] {
+            std::ostringstream os;
+            os << "\n"
+               << "  a                 = " << kAValue << "\n"
+               << "  b                 = " << kBValue << "\n"
+               << "  exact a/b         = " << fmt(exact) << "\n"
+               << "  stored a/b        = " << fmt(stored) << "\n"
+               << "  stored - exact    = " << fmt(diff)
+               << "    (negative => ToNearest gave value BELOW truth)\n"
+               << "  quotient.mantissa = " << quotient.mantissa() << "\n"
+               << "  quotient.exponent = " << quotient.exponent() << "\n";
+            return os.str();
+        };
+
+        // ToNearest should account for dropped digits beyond the visible "5".
+        switch (scale)
+        {
+            case MantissaRange::MantissaScale::Large:
+                EXPECT_TRUE(stored >= exact) << message();
+                EXPECT_TRUE(diff < pow10(quotient.exponent())) << message();
+                break;
+
+            case MantissaRange::MantissaScale::LargeLegacy:
+                EXPECT_TRUE(stored < exact) << message();
+                EXPECT_TRUE(diff >= -pow10(quotient.exponent())) << message();
+                break;
+
+            case MantissaRange::MantissaScale::Small:
+                // Small mantissa doesn't have the correction for dropped remainders.
+                EXPECT_TRUE(stored < exact) << message();
+                break;
+        }
+    }
+}
 
 }  // namespace xrpl
diff --git a/src/tests/libxrpl/basics/StringUtilities.cpp b/src/tests/libxrpl/basics/StringUtilities.cpp
new file mode 100644
index 0000000000..a10711abdb
--- /dev/null
+++ b/src/tests/libxrpl/basics/StringUtilities.cpp
@@ -0,0 +1,293 @@
+#include <xrpl/basics/StringUtilities.h>
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/ToString.h>
+
+#include <gtest/gtest.h>
+
+#include <string>
+
+namespace xrpl {
+
+class StringUtilitiesTest : public ::testing::Test
+{
+public:
+    static void
+    testUnHexSuccess(std::string const& strIn, std::string const& strExpected)
+    {
+        auto rv = strUnHex(strIn);
+        EXPECT_TRUE(rv);
+
+        // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
+        EXPECT_EQ(makeSlice(*rv), makeSlice(strExpected));
+    }
+
+    static void
+    testUnHexFailure(std::string const& strIn)
+    {
+        auto rv = strUnHex(strIn);
+        EXPECT_FALSE(rv);
+    }
+};
+
+TEST_F(StringUtilitiesTest, un_hex)
+{
+    testUnHexSuccess("526970706c6544", "RippleD");
+    testUnHexSuccess("A", "\n");
+    testUnHexSuccess("0A", "\n");
+    testUnHexSuccess("D0A", "\r\n");
+    testUnHexSuccess("0D0A", "\r\n");
+    testUnHexSuccess("200D0A", " \r\n");
+    testUnHexSuccess("282A2B2C2D2E2F29", "(*+,-./)");
+
+    // Check for things which contain some or only invalid characters
+    testUnHexFailure("123X");
+    testUnHexFailure("V");
+    testUnHexFailure("XRP");
+}
+
+TEST_F(StringUtilitiesTest, parse_url)
+{
+    // Expected passes.
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_TRUE(pUrl.domain.empty());
+        EXPECT_FALSE(pUrl.port);
+        // RFC 3986:
+        // > In general, a URI that uses the generic syntax for authority
+        //   with an empty path should be normalized to a path of "/".
+        // Do we want to normalize paths?
+        EXPECT_TRUE(pUrl.path.empty());
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme:///"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_TRUE(pUrl.domain.empty());
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "lower://domain"));
+        EXPECT_EQ(pUrl.scheme, "lower");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_TRUE(pUrl.path.empty());
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "UPPER://domain:234/"));
+        EXPECT_EQ(pUrl.scheme, "upper");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_EQ(*pUrl.port, 234);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_EQ(pUrl.path, "/");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "Mixed://domain/path"));
+        EXPECT_EQ(pUrl.scheme, "mixed");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/path");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://[::1]:123/path"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "::1");
+        EXPECT_EQ(*pUrl.port, 123);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_EQ(pUrl.path, "/path");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://user:pass@domain:123/abc:321"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_EQ(pUrl.username, "user");
+        EXPECT_EQ(pUrl.password, "pass");
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_EQ(*pUrl.port, 123);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_EQ(pUrl.path, "/abc:321");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://user@domain:123/abc:321"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_EQ(pUrl.username, "user");
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_EQ(*pUrl.port, 123);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_EQ(pUrl.path, "/abc:321");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://:pass@domain:123/abc:321"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_EQ(pUrl.password, "pass");
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_EQ(*pUrl.port, 123);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_EQ(pUrl.path, "/abc:321");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://domain:123/abc:321"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_EQ(*pUrl.port, 123);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_EQ(pUrl.path, "/abc:321");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://user:pass@domain/abc:321"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_EQ(pUrl.username, "user");
+        EXPECT_EQ(pUrl.password, "pass");
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/abc:321");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://user@domain/abc:321"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_EQ(pUrl.username, "user");
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/abc:321");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://:pass@domain/abc:321"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_EQ(pUrl.password, "pass");
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/abc:321");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://domain/abc:321"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/abc:321");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme:///path/to/file"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_TRUE(pUrl.domain.empty());
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/path/to/file");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://user:pass@domain/path/with/an@sign"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_EQ(pUrl.username, "user");
+        EXPECT_EQ(pUrl.password, "pass");
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/path/with/an@sign");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://domain/path/with/an@sign"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "domain");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/path/with/an@sign");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "scheme://:999/"));
+        EXPECT_EQ(pUrl.scheme, "scheme");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, ":999");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/");
+    }
+
+    {
+        ParsedUrl pUrl;
+        EXPECT_TRUE(parseUrl(pUrl, "http://::1:1234/validators"));
+        EXPECT_EQ(pUrl.scheme, "http");
+        EXPECT_TRUE(pUrl.username.empty());
+        EXPECT_TRUE(pUrl.password.empty());
+        EXPECT_EQ(pUrl.domain, "::0.1.18.52");
+        EXPECT_FALSE(pUrl.port);
+        EXPECT_EQ(pUrl.path, "/validators");
+    }
+
+    // Expected fails.
+    {
+        ParsedUrl pUrl;
+        EXPECT_FALSE(parseUrl(pUrl, ""));
+        EXPECT_FALSE(parseUrl(pUrl, "nonsense"));
+        EXPECT_FALSE(parseUrl(pUrl, "://"));
+        EXPECT_FALSE(parseUrl(pUrl, ":///"));
+        EXPECT_FALSE(parseUrl(pUrl, "scheme://user:pass@domain:65536/abc:321"));
+        EXPECT_FALSE(parseUrl(pUrl, "UPPER://domain:23498765/"));
+        EXPECT_FALSE(parseUrl(pUrl, "UPPER://domain:0/"));
+        EXPECT_FALSE(parseUrl(pUrl, "UPPER://domain:+7/"));
+        EXPECT_FALSE(parseUrl(pUrl, "UPPER://domain:-7234/"));
+        EXPECT_FALSE(parseUrl(pUrl, "UPPER://domain:@#$56!/"));
+    }
+
+    {
+        std::string const strUrl("s://" + std::string(8192, ':'));
+        ParsedUrl pUrl;
+        EXPECT_FALSE(parseUrl(pUrl, strUrl));
+    }
+}
+
+TEST_F(StringUtilitiesTest, to_string)
+{
+    auto result = to_string("hello");
+    EXPECT_EQ(result, "hello");
+}
+
+}  // namespace xrpl
diff --git a/src/tests/libxrpl/basics/TaggedCache.cpp b/src/tests/libxrpl/basics/TaggedCache.cpp
new file mode 100644
index 0000000000..c8ccc415ad
--- /dev/null
+++ b/src/tests/libxrpl/basics/TaggedCache.cpp
@@ -0,0 +1,246 @@
+#include <xrpl/basics/TaggedCache.h>
+
+#include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/IntrusiveRefCounts.h>
+#include <xrpl/basics/TaggedCache.ipp>  // IWYU pragma: keep
+#include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/Protocol.h>
+
+#include <gtest/gtest.h>
+#include <helpers/TestSink.h>
+
+#include <memory>
+#include <string>
+#include <utility>
+
+namespace xrpl {
+
+/*
+I guess you can put some items in, make sure they're still there. Let some
+time pass, make sure they're gone. Keep a strong pointer to one of them, make
+sure you can still find it even after time passes. Create two objects with
+the same key, canonicalize them both and make sure you get the same object.
+Put an object in but keep a strong pointer to it, advance the clock a lot,
+then canonicalize a new object with the same key, make sure you get the
+original object.
+*/
+
+TEST(TaggedCacheTest, tagged_cache)
+{
+    using namespace std::chrono_literals;
+    beast::Journal const journal{TestSink::instance()};
+
+    TestStopwatch clock;
+    clock.set(0);
+
+    using Key = LedgerIndex;
+    using Value = std::string;
+    using Cache = TaggedCache<Key, Value>;
+
+    Cache c("test", 1, 1s, clock, journal);
+
+    // Insert an item, retrieve it, and age it so it gets purged.
+    {
+        EXPECT_EQ(c.getCacheSize(), 0);
+        EXPECT_EQ(c.getTrackSize(), 0);
+        EXPECT_FALSE(c.insert(1, "one"));
+        EXPECT_EQ(c.getCacheSize(), 1);
+        EXPECT_EQ(c.getTrackSize(), 1);
+
+        {
+            std::string s;
+            EXPECT_TRUE(c.retrieve(1, s));
+            EXPECT_EQ(s, "one");
+        }
+
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.getCacheSize(), 0);
+        EXPECT_EQ(c.getTrackSize(), 0);
+    }
+
+    // Insert an item, maintain a strong pointer, age it, and
+    // verify that the entry still exists.
+    {
+        EXPECT_FALSE(c.insert(2, "two"));
+        EXPECT_EQ(c.getCacheSize(), 1);
+        EXPECT_EQ(c.getTrackSize(), 1);
+
+        {
+            auto p = c.fetch(2);
+            EXPECT_NE(p, nullptr);
+            ++clock;
+            c.sweep();
+            EXPECT_EQ(c.getCacheSize(), 0);
+            EXPECT_EQ(c.getTrackSize(), 1);
+        }
+
+        // Make sure its gone now that our reference is gone
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.getCacheSize(), 0);
+        EXPECT_EQ(c.getTrackSize(), 0);
+    }
+
+    // Insert the same key/value pair and make sure we get the same result
+    {
+        EXPECT_FALSE(c.insert(3, "three"));
+
+        {
+            auto const p1 = c.fetch(3);
+            auto p2 = std::make_shared<Value>("three");
+            c.canonicalizeReplaceClient(3, p2);
+            EXPECT_EQ(p1.get(), p2.get());
+        }
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.getCacheSize(), 0);
+        EXPECT_EQ(c.getTrackSize(), 0);
+    }
+
+    // Put an object in but keep a strong pointer to it, advance the clock a
+    // lot, then canonicalize a new object with the same key, make sure you
+    // get the original object.
+    {
+        // Put an object in
+        EXPECT_FALSE(c.insert(4, "four"));
+        EXPECT_EQ(c.getCacheSize(), 1);
+        EXPECT_EQ(c.getTrackSize(), 1);
+
+        {
+            // Keep a strong pointer to it
+            auto const p1 = c.fetch(4);
+            EXPECT_NE(p1, nullptr);
+            EXPECT_EQ(c.getCacheSize(), 1);
+            EXPECT_EQ(c.getTrackSize(), 1);
+            // Advance the clock a lot
+            ++clock;
+            c.sweep();
+            EXPECT_EQ(c.getCacheSize(), 0);
+            EXPECT_EQ(c.getTrackSize(), 1);
+            // Canonicalize a new object with the same key
+            auto p2 = std::make_shared<std::string>("four");
+            EXPECT_TRUE(c.canonicalizeReplaceClient(4, p2));
+            EXPECT_EQ(c.getCacheSize(), 1);
+            EXPECT_EQ(c.getTrackSize(), 1);
+            // Make sure we get the original object
+            EXPECT_EQ(p1.get(), p2.get());
+        }
+
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.getCacheSize(), 0);
+        EXPECT_EQ(c.getTrackSize(), 0);
+    }
+
+    {
+        EXPECT_FALSE(c.insert(5, "five"));
+        EXPECT_EQ(c.getCacheSize(), 1);
+        EXPECT_EQ(c.size(), 1);
+
+        {
+            auto const p1 = c.fetch(5);
+            EXPECT_NE(p1, nullptr);
+            EXPECT_EQ(c.getCacheSize(), 1);
+            EXPECT_EQ(c.size(), 1);
+
+            // Advance the clock a lot
+            ++clock;
+            c.sweep();
+            EXPECT_EQ(c.getCacheSize(), 0);
+            EXPECT_EQ(c.size(), 1);
+
+            auto p2 = std::make_shared<std::string>("five_2");
+            EXPECT_TRUE(c.canonicalizeReplaceCache(5, p2));
+            EXPECT_EQ(c.getCacheSize(), 1);
+            EXPECT_EQ(c.size(), 1);
+            // Make sure the caller's original pointer is unchanged
+            EXPECT_NE(p1.get(), p2.get());
+            EXPECT_EQ(*p2, "five_2");
+
+            auto const p3 = c.fetch(5);
+            EXPECT_NE(p3, nullptr);
+            EXPECT_EQ(p3.get(), p2.get());
+            EXPECT_NE(p3.get(), p1.get());
+        }
+
+        ++clock;
+        c.sweep();
+        EXPECT_EQ(c.getCacheSize(), 0);
+        EXPECT_EQ(c.size(), 0);
+    }
+
+    {
+        struct MyRefCountObject : IntrusiveRefCounts
+        {
+            std::string data;
+
+            // Needed to support weak intrusive pointers
+            virtual void
+            partialDestructor()
+            {
+            }
+
+            MyRefCountObject() = default;
+            explicit MyRefCountObject(std::string data) : data(std::move(data))
+            {
+            }
+
+            bool
+            operator==(std::string const& other) const
+            {
+                return data == other;
+            }
+        };
+
+        using IntrPtrCache = TaggedCache<
+            Key,
+            MyRefCountObject,
+            /*IsKeyCache*/ false,
+            intr_ptr::SharedWeakUnionPtr<MyRefCountObject>,
+            intr_ptr::SharedPtr<MyRefCountObject>>;
+
+        IntrPtrCache intrPtrCache("IntrPtrTest", 1, 1s, clock, journal);
+
+        intrPtrCache.canonicalizeReplaceCache(1, intr_ptr::makeShared<MyRefCountObject>("one"));
+        EXPECT_EQ(intrPtrCache.getCacheSize(), 1);
+        EXPECT_EQ(intrPtrCache.size(), 1);
+
+        {
+            {
+                intrPtrCache.canonicalizeReplaceCache(
+                    1, intr_ptr::makeShared<MyRefCountObject>("one_replaced"));
+
+                auto p = intrPtrCache.fetch(1);
+                EXPECT_EQ(*p, "one_replaced");
+
+                // Advance the clock a lot
+                ++clock;
+                intrPtrCache.sweep();
+                EXPECT_EQ(intrPtrCache.getCacheSize(), 0);
+                EXPECT_EQ(intrPtrCache.size(), 1);
+
+                intrPtrCache.canonicalizeReplaceCache(
+                    1, intr_ptr::makeShared<MyRefCountObject>("one_replaced_2"));
+
+                auto p2 = intrPtrCache.fetch(1);
+                EXPECT_EQ(*p2, "one_replaced_2");
+
+                intrPtrCache.del(1, true);
+            }
+
+            intrPtrCache.canonicalizeReplaceCache(
+                1, intr_ptr::makeShared<MyRefCountObject>("one_replaced_3"));
+            auto p3 = intrPtrCache.fetch(1);
+            EXPECT_EQ(*p3, "one_replaced_3");
+        }
+
+        ++clock;
+        intrPtrCache.sweep();
+        EXPECT_EQ(intrPtrCache.getCacheSize(), 0);
+        EXPECT_EQ(intrPtrCache.size(), 0);
+    }
+}
+
+}  // namespace xrpl
diff --git a/src/tests/libxrpl/basics/Units.cpp b/src/tests/libxrpl/basics/Units.cpp
new file mode 100644
index 0000000000..1cf7024fe0
--- /dev/null
+++ b/src/tests/libxrpl/basics/Units.cpp
@@ -0,0 +1,328 @@
+#include <xrpl/protocol/Units.h>
+
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SystemParameters.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <gtest/gtest.h>
+
+#include <cstdint>
+#include <limits>
+#include <type_traits>
+
+namespace xrpl::test {
+
+TEST(UnitsTest, types)
+{
+    using FeeLevel32 = FeeLevel<std::uint32_t>;
+
+    {
+        XRPAmount const x{100};
+        EXPECT_EQ(x.drops(), 100);
+        EXPECT_TRUE((std::is_same_v<decltype(x)::unit_type, unit::dropTag>));
+        auto y = 4u * x;
+        EXPECT_EQ(y.value(), 400);
+        EXPECT_TRUE((std::is_same_v<decltype(y)::unit_type, unit::dropTag>));
+
+        auto z = 4 * y;
+        EXPECT_EQ(z.value(), 1600);
+        EXPECT_TRUE((std::is_same_v<decltype(z)::unit_type, unit::dropTag>));
+
+        FeeLevel32 const f{10};
+        FeeLevel32 const baseFee{100};
+
+        auto drops = mulDiv(baseFee, x, f);
+
+        EXPECT_TRUE(drops);
+        EXPECT_EQ(drops.value(), 1000);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_TRUE(
+            (std::is_same_v<std::remove_reference_t<decltype(*drops)>::unit_type, unit::dropTag>));
+
+        EXPECT_TRUE((std::is_same_v<std::remove_reference_t<decltype(*drops)>, XRPAmount>));
+    }
+    {
+        XRPAmount const x{100};
+        EXPECT_EQ(x.value(), 100);
+        EXPECT_TRUE((std::is_same_v<decltype(x)::unit_type, unit::dropTag>));
+        auto y = 4u * x;
+        EXPECT_EQ(y.value(), 400);
+        EXPECT_TRUE((std::is_same_v<decltype(y)::unit_type, unit::dropTag>));
+
+        FeeLevel64 const f{10};
+        FeeLevel64 const baseFee{100};
+
+        auto drops = mulDiv(baseFee, x, f);
+
+        EXPECT_TRUE(drops);
+        EXPECT_EQ(drops.value(), 1000);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_TRUE(
+            (std::is_same_v<std::remove_reference_t<decltype(*drops)>::unit_type, unit::dropTag>));
+        EXPECT_TRUE((std::is_same_v<std::remove_reference_t<decltype(*drops)>, XRPAmount>));
+    }
+    {
+        FeeLevel64 const x{1024};
+        EXPECT_EQ(x.value(), 1024);
+        EXPECT_TRUE((std::is_same_v<decltype(x)::unit_type, unit::feelevelTag>));
+        std::uint64_t const m = 4;
+        auto y = m * x;
+        EXPECT_EQ(y.value(), 4096);
+        EXPECT_TRUE((std::is_same_v<decltype(y)::unit_type, unit::feelevelTag>));
+
+        XRPAmount const basefee{10};
+        FeeLevel64 const referencefee{256};
+
+        auto drops = mulDiv(x, basefee, referencefee);
+
+        EXPECT_TRUE(drops);
+        EXPECT_EQ(drops.value(), 40);  // NOLINT(bugprone-unchecked-optional-access)
+        EXPECT_TRUE(
+            (std::is_same_v<std::remove_reference_t<decltype(*drops)>::unit_type, unit::dropTag>));
+        EXPECT_TRUE((std::is_same_v<std::remove_reference_t<decltype(*drops)>, XRPAmount>));
+    }
+}
+
+TEST(UnitsTest, json)
+{
+    // Json value functionality
+    using FeeLevel32 = FeeLevel<std::uint32_t>;
+
+    {
+        FeeLevel32 const x{std::numeric_limits<std::uint32_t>::max()};
+        auto y = x.jsonClipped();
+        EXPECT_EQ(y.type(), json::ValueType::UInt);
+        EXPECT_EQ(y, json::Value{x.fee()});
+    }
+
+    {
+        FeeLevel32 const x{std::numeric_limits<std::uint32_t>::min()};
+        auto y = x.jsonClipped();
+        EXPECT_EQ(y.type(), json::ValueType::UInt);
+        EXPECT_EQ(y, json::Value{x.fee()});
+    }
+
+    {
+        FeeLevel64 const x{std::numeric_limits<std::uint64_t>::max()};
+        auto y = x.jsonClipped();
+        EXPECT_EQ(y.type(), json::ValueType::UInt);
+        EXPECT_EQ(y, json::Value{std::numeric_limits<std::uint32_t>::max()});
+    }
+
+    {
+        FeeLevel64 const x{std::numeric_limits<std::uint64_t>::min()};
+        auto y = x.jsonClipped();
+        EXPECT_EQ(y.type(), json::ValueType::UInt);
+        EXPECT_EQ(y, json::Value{0});
+    }
+
+    {
+        FeeLevelDouble const x{std::numeric_limits<double>::max()};
+        auto y = x.jsonClipped();
+        EXPECT_EQ(y.type(), json::ValueType::Real);
+        EXPECT_EQ(y, json::Value{std::numeric_limits<double>::max()});
+    }
+
+    {
+        FeeLevelDouble const x{std::numeric_limits<double>::min()};
+        auto y = x.jsonClipped();
+        EXPECT_EQ(y.type(), json::ValueType::Real);
+        EXPECT_EQ(y, json::Value{std::numeric_limits<double>::min()});
+    }
+
+    {
+        XRPAmount const x{std::numeric_limits<std::int64_t>::max()};
+        auto y = x.jsonClipped();
+        EXPECT_EQ(y.type(), json::ValueType::Int);
+        EXPECT_EQ(y, json::Value{std::numeric_limits<std::int32_t>::max()});
+    }
+
+    {
+        XRPAmount const x{std::numeric_limits<std::int64_t>::min()};
+        auto y = x.jsonClipped();
+        EXPECT_EQ(y.type(), json::ValueType::Int);
+        EXPECT_EQ(y, json::Value{std::numeric_limits<std::int32_t>::min()});
+    }
+}
+
+TEST(UnitsTest, functions)
+{
+    // Explicitly test every defined function for the ValueUnit class
+    // since some of them are templated, but not used anywhere else.
+    using FeeLevel32 = FeeLevel<std::uint32_t>;
+
+    {
+        auto make = [&](auto x) -> FeeLevel64 { return x; };
+        auto explicitmake = [&](auto x) -> FeeLevel64 { return FeeLevel64{x}; };
+
+        [[maybe_unused]]
+        FeeLevel64 const defaulted{};
+        FeeLevel64 test{0};
+        EXPECT_EQ(test.fee(), 0);
+
+        test = explicitmake(beast::kZero);
+        EXPECT_EQ(test.fee(), 0);
+
+        test = beast::kZero;
+        EXPECT_EQ(test.fee(), 0);
+
+        test = explicitmake(100u);
+        EXPECT_EQ(test.fee(), 100);
+
+        FeeLevel64 const targetSame{200u};
+        FeeLevel32 const targetOther{300u};
+        test = make(targetSame);
+        EXPECT_EQ(test.fee(), 200);
+        EXPECT_EQ(test, targetSame);
+        EXPECT_TRUE(test < FeeLevel64{1000});
+        EXPECT_TRUE(test > FeeLevel64{100});
+        test = make(targetOther);
+        EXPECT_EQ(test.fee(), 300);
+        EXPECT_EQ(test, targetOther);
+
+        test = std::uint64_t(200);
+        EXPECT_EQ(test.fee(), 200);
+        test = std::uint32_t(300);
+        EXPECT_EQ(test.fee(), 300);
+
+        test = targetSame;
+        EXPECT_EQ(test.fee(), 200);
+        test = targetOther.fee();
+        EXPECT_EQ(test.fee(), 300);
+        EXPECT_EQ(test, targetOther);
+
+        test = targetSame * 2;
+        EXPECT_EQ(test.fee(), 400);
+        test = 3 * targetSame;
+        EXPECT_EQ(test.fee(), 600);
+        test = targetSame / 10;
+        EXPECT_EQ(test.fee(), 20);
+
+        test += targetSame;
+        EXPECT_EQ(test.fee(), 220);
+
+        test -= targetSame;
+        EXPECT_EQ(test.fee(), 20);
+
+        test++;
+        EXPECT_EQ(test.fee(), 21);
+        ++test;
+        EXPECT_EQ(test.fee(), 22);
+        test--;
+        EXPECT_EQ(test.fee(), 21);
+        --test;
+        EXPECT_EQ(test.fee(), 20);
+
+        test *= 5;
+        EXPECT_EQ(test.fee(), 100);
+        test /= 2;
+        EXPECT_EQ(test.fee(), 50);
+        test %= 13;
+        EXPECT_EQ(test.fee(), 11);
+
+        /*
+        // illegal with unsigned
+        test = -test;
+        EXPECT_EQ(test.fee(), -11);
+        EXPECT_EQ(test.signum(), -1);
+        EXPECT_EQ(to_string(test), "-11");
+        */
+
+        EXPECT_TRUE(test);
+        test = 0;
+        EXPECT_FALSE(test);
+        EXPECT_EQ(test.signum(), 0);
+        test = targetSame;
+        EXPECT_EQ(test.signum(), 1);
+        EXPECT_EQ(to_string(test), "200");
+    }
+    {
+        auto make = [&](auto x) -> FeeLevelDouble { return x; };
+        auto explicitmake = [&](auto x) -> FeeLevelDouble { return FeeLevelDouble{x}; };
+
+        [[maybe_unused]]
+        FeeLevelDouble const defaulted{};
+        FeeLevelDouble test{0};
+        EXPECT_EQ(test.fee(), 0);
+
+        test = explicitmake(beast::kZero);
+        EXPECT_EQ(test.fee(), 0);
+
+        test = beast::kZero;
+        EXPECT_EQ(test.fee(), 0);
+
+        test = explicitmake(100.0);
+        EXPECT_EQ(test.fee(), 100);
+
+        FeeLevelDouble const targetSame{200.0};
+        FeeLevel64 const targetOther{300};
+        test = make(targetSame);
+        EXPECT_EQ(test.fee(), 200);
+        EXPECT_EQ(test, targetSame);
+        EXPECT_TRUE(test < FeeLevelDouble{1000.0});
+        EXPECT_TRUE(test > FeeLevelDouble{100.0});
+        test = targetOther.fee();
+        EXPECT_EQ(test.fee(), 300);
+        EXPECT_EQ(test, targetOther);
+
+        test = 200.0;
+        EXPECT_EQ(test.fee(), 200);
+        test = std::uint64_t(300);
+        EXPECT_EQ(test.fee(), 300);
+
+        test = targetSame;
+        EXPECT_EQ(test.fee(), 200);
+
+        test = targetSame * 2;
+        EXPECT_EQ(test.fee(), 400);
+        test = 3 * targetSame;
+        EXPECT_EQ(test.fee(), 600);
+        test = targetSame / 10;
+        EXPECT_EQ(test.fee(), 20);
+
+        test += targetSame;
+        EXPECT_EQ(test.fee(), 220);
+
+        test -= targetSame;
+        EXPECT_EQ(test.fee(), 20);
+
+        test++;
+        EXPECT_EQ(test.fee(), 21);
+        ++test;
+        EXPECT_EQ(test.fee(), 22);
+        test--;
+        EXPECT_EQ(test.fee(), 21);
+        --test;
+        EXPECT_EQ(test.fee(), 20);
+
+        test *= 5;
+        EXPECT_EQ(test.fee(), 100);
+        test /= 2;
+        EXPECT_EQ(test.fee(), 50);
+        /* illegal with floating
+        test %= 13;
+        EXPECT_EQ(test.fee(), 11);
+        */
+
+        // legal with signed
+        test = -test;
+        EXPECT_EQ(test.fee(), -50);
+        EXPECT_EQ(test.signum(), -1);
+        EXPECT_EQ(to_string(test), "-50.000000");
+
+        EXPECT_TRUE(test);
+        test = 0;
+        EXPECT_FALSE(test);
+        EXPECT_EQ(test.signum(), 0);
+        test = targetSame;
+        EXPECT_EQ(test.signum(), 1);
+        EXPECT_EQ(to_string(test), "200.000000");
+    }
+}
+
+TEST(UnitsTest, initial_xrp)
+{
+    EXPECT_EQ(kInitialXrp.drops(), 100'000'000'000'000'000);
+    EXPECT_EQ(kInitialXrp, XRPAmount{100'000'000'000'000'000});
+}
+
+}  // namespace xrpl::test
diff --git a/src/tests/libxrpl/basics/XRPAmount.cpp b/src/tests/libxrpl/basics/XRPAmount.cpp
new file mode 100644
index 0000000000..243afbd1a0
--- /dev/null
+++ b/src/tests/libxrpl/basics/XRPAmount.cpp
@@ -0,0 +1,295 @@
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <xrpl/beast/utility/Zero.h>
+
+#include <gtest/gtest.h>
+
+#include <cstdint>
+#include <limits>
+
+namespace xrpl {
+
+TEST(XRPAmountTest, sig_num)
+{
+    for (auto i : {-1, 0, 1})
+    {
+        XRPAmount const x(i);
+
+        if (i < 0)
+        {
+            EXPECT_TRUE(x.signum() < 0);
+        }
+        else if (i > 0)
+        {
+            EXPECT_TRUE(x.signum() > 0);
+        }
+        else
+        {
+            EXPECT_EQ(x.signum(), 0);
+        }
+    }
+}
+
+TEST(XRPAmountTest, beast_zero)
+{
+    using beast::kZero;
+
+    for (auto i : {-1, 0, 1})
+    {
+        XRPAmount const x(i);
+
+        EXPECT_TRUE((i == 0) == (x == kZero));
+        EXPECT_TRUE((i != 0) == (x != kZero));
+        EXPECT_TRUE((i < 0) == (x < kZero));
+        EXPECT_TRUE((i > 0) == (x > kZero));
+        EXPECT_TRUE((i <= 0) == (x <= kZero));
+        EXPECT_TRUE((i >= 0) == (x >= kZero));
+
+        EXPECT_TRUE((0 == i) == (kZero == x));
+        EXPECT_TRUE((0 != i) == (kZero != x));
+        EXPECT_TRUE((0 < i) == (kZero < x));
+        EXPECT_TRUE((0 > i) == (kZero > x));
+        EXPECT_TRUE((0 <= i) == (kZero <= x));
+        EXPECT_TRUE((0 >= i) == (kZero >= x));
+    }
+}
+
+TEST(XRPAmountTest, comparisons)
+{
+    for (auto i : {-1, 0, 1})
+    {
+        XRPAmount const x(i);
+
+        for (auto j : {-1, 0, 1})
+        {
+            XRPAmount const y(j);
+
+            EXPECT_EQ((i == j), (x == y));
+            EXPECT_EQ((i != j), (x != y));
+            EXPECT_EQ((i < j), (x < y));
+            EXPECT_EQ((i > j), (x > y));
+            EXPECT_EQ((i <= j), (x <= y));
+            EXPECT_EQ((i >= j), (x >= y));
+        }
+    }
+}
+
+TEST(XRPAmountTest, add_sub)
+{
+    for (auto i : {-1, 0, 1})
+    {
+        XRPAmount const x(i);
+
+        for (auto j : {-1, 0, 1})
+        {
+            XRPAmount const y(j);
+
+            EXPECT_EQ(XRPAmount(i + j), (x + y));
+            EXPECT_EQ(XRPAmount(i - j), (x - y));
+
+            EXPECT_EQ((x + y), (y + x));  // addition is commutative
+        }
+    }
+}
+
+TEST(XRPAmountTest, decimal)
+{
+    // Tautology
+    EXPECT_EQ(kDropsPerXrp.decimalXRP(), 1);
+
+    XRPAmount test{1};
+    EXPECT_EQ(test.decimalXRP(), 0.000001);
+
+    test = -test;
+    EXPECT_EQ(test.decimalXRP(), -0.000001);
+
+    test = 100'000'000;
+    EXPECT_EQ(test.decimalXRP(), 100);
+
+    test = -test;
+    EXPECT_EQ(test.decimalXRP(), -100);
+}
+
+TEST(XRPAmountTest, functions)
+{
+    // Explicitly test every defined function for the XRPAmount class
+    // since some of them are templated, but not used anywhere else.
+    auto make = [&](auto x) -> XRPAmount { return XRPAmount{x}; };
+
+    XRPAmount const defaulted{};
+    (void)defaulted;
+    XRPAmount test{0};
+    EXPECT_EQ(test.drops(), 0);
+
+    test = make(beast::kZero);
+    EXPECT_EQ(test.drops(), 0);
+
+    test = beast::kZero;
+    EXPECT_EQ(test.drops(), 0);
+
+    test = make(100);
+    EXPECT_EQ(test.drops(), 100);
+
+    test = make(100u);
+    EXPECT_EQ(test.drops(), 100);
+
+    XRPAmount const targetSame{200u};
+    test = make(targetSame);
+    EXPECT_EQ(test.drops(), 200);
+    EXPECT_EQ(test, targetSame);
+    EXPECT_TRUE(test < XRPAmount{1000});
+    EXPECT_TRUE(test > XRPAmount{100});
+
+    test = std::int64_t(200);
+    EXPECT_EQ(test.drops(), 200);
+    test = std::uint32_t(300);
+    EXPECT_EQ(test.drops(), 300);
+
+    test = targetSame;
+    EXPECT_EQ(test.drops(), 200);
+    auto testOther = test.dropsAs<std::uint32_t>();
+    EXPECT_TRUE(testOther);
+    EXPECT_EQ(*testOther, 200);  // NOLINT(bugprone-unchecked-optional-access)
+    test = std::numeric_limits<std::uint64_t>::max();
+    testOther = test.dropsAs<std::uint32_t>();
+    EXPECT_FALSE(testOther);
+    test = -1;
+    testOther = test.dropsAs<std::uint32_t>();
+    EXPECT_FALSE(testOther);
+
+    test = targetSame * 2;
+    EXPECT_EQ(test.drops(), 400);
+    test = 3 * targetSame;
+    EXPECT_EQ(test.drops(), 600);
+    test = 20;
+    EXPECT_EQ(test.drops(), 20);
+
+    test += targetSame;
+    EXPECT_EQ(test.drops(), 220);
+
+    test -= targetSame;
+    EXPECT_EQ(test.drops(), 20);
+
+    test *= 5;
+    EXPECT_EQ(test.drops(), 100);
+    test = 50;
+    EXPECT_EQ(test.drops(), 50);
+    test -= 39;
+    EXPECT_EQ(test.drops(), 11);
+
+    // legal with signed
+    test = -test;
+    EXPECT_EQ(test.drops(), -11);
+    EXPECT_EQ(test.signum(), -1);
+    EXPECT_EQ(to_string(test), "-11");
+
+    EXPECT_TRUE(test);
+    test = 0;
+    EXPECT_FALSE(test);
+    EXPECT_EQ(test.signum(), 0);
+    test = targetSame;
+    EXPECT_EQ(test.signum(), 1);
+    EXPECT_EQ(to_string(test), "200");
+}
+
+TEST(XRPAmountTest, mul_ratio)
+{
+    constexpr auto kMaxUInt32 = std::numeric_limits<std::uint32_t>::max();
+    constexpr auto kMaxXrp = std::numeric_limits<XRPAmount::value_type>::max();
+    constexpr auto kMinXrp = std::numeric_limits<XRPAmount::value_type>::min();
+
+    {
+        // multiply by a number that would overflow then divide by the same
+        // number, and check we didn't lose any value
+        XRPAmount big(kMaxXrp);
+        EXPECT_EQ(big, mulRatio(big, kMaxUInt32, kMaxUInt32, true));
+        // rounding mode shouldn't matter as the result is exact
+        EXPECT_EQ(big, mulRatio(big, kMaxUInt32, kMaxUInt32, false));
+
+        // multiply and divide by values that would overflow if done
+        // naively, and check that it gives the correct answer
+        big -= 0xf;  // Subtract a little so it's divisible by 4
+        EXPECT_EQ(mulRatio(big, 3, 4, false).value(), (big.value() / 4) * 3);
+        EXPECT_EQ(mulRatio(big, 3, 4, true).value(), (big.value() / 4) * 3);
+        EXPECT_EQ(big.value() % 4, 0);
+        EXPECT_GT(big.value(), kMaxXrp / 3);
+        EXPECT_LE(big.value() / 4, kMaxXrp / 3);
+    }
+
+    {
+        // Similar test as above, but for negative values
+        XRPAmount big(kMinXrp);  // NOLINT TODO
+        EXPECT_EQ(big, mulRatio(big, kMaxUInt32, kMaxUInt32, true));
+        // rounding mode shouldn't matter as the result is exact
+        EXPECT_EQ(big, mulRatio(big, kMaxUInt32, kMaxUInt32, false));
+
+        // multiply and divide by values that would overflow if done
+        // naively, and check that it gives the correct answer
+        EXPECT_EQ(mulRatio(big, 3, 4, false).value(), (big.value() / 4) * 3);
+        EXPECT_EQ(mulRatio(big, 3, 4, true).value(), (big.value() / 4) * 3);
+        EXPECT_EQ(big.value() % 4, 0);
+        EXPECT_LT(big.value(), kMinXrp / 3);
+        EXPECT_GE(big.value() / 4, kMinXrp / 3);
+    }
+
+    {
+        // small amounts
+        XRPAmount const tiny(1);
+        // Round up should give the smallest allowable number
+        EXPECT_EQ(tiny, mulRatio(tiny, 1, kMaxUInt32, true));
+        // rounding down should be zero
+        EXPECT_EQ(beast::kZero, mulRatio(tiny, 1, kMaxUInt32, false));
+        EXPECT_EQ(beast::kZero, mulRatio(tiny, kMaxUInt32 - 1, kMaxUInt32, false));
+
+        // tiny negative numbers
+        XRPAmount const tinyNeg(-1);
+        // Round up should give zero
+        EXPECT_EQ(beast::kZero, mulRatio(tinyNeg, 1, kMaxUInt32, true));
+        EXPECT_EQ(beast::kZero, mulRatio(tinyNeg, kMaxUInt32 - 1, kMaxUInt32, true));
+        // rounding down should be tiny
+        EXPECT_EQ(tinyNeg, mulRatio(tinyNeg, kMaxUInt32 - 1, kMaxUInt32, false));
+    }
+
+    {  // rounding
+        {
+            XRPAmount const one(1);
+            auto const rup = mulRatio(one, kMaxUInt32 - 1, kMaxUInt32, true);
+            auto const rdown = mulRatio(one, kMaxUInt32 - 1, kMaxUInt32, false);
+            EXPECT_EQ(rup.drops() - rdown.drops(), 1);
+        }
+
+        {
+            XRPAmount const big(kMaxXrp);
+            auto const rup = mulRatio(big, kMaxUInt32 - 1, kMaxUInt32, true);
+            auto const rdown = mulRatio(big, kMaxUInt32 - 1, kMaxUInt32, false);
+            EXPECT_EQ(rup.drops() - rdown.drops(), 1);
+        }
+
+        {
+            XRPAmount const negOne(-1);
+            auto const rup = mulRatio(negOne, kMaxUInt32 - 1, kMaxUInt32, true);
+            auto const rdown = mulRatio(negOne, kMaxUInt32 - 1, kMaxUInt32, false);
+            EXPECT_EQ(rup.drops() - rdown.drops(), 1);
+        }
+    }
+
+    {
+        // division by zero
+        XRPAmount const one(1);
+        EXPECT_ANY_THROW({ mulRatio(one, 1, 0, true); });
+    }
+
+    {
+        // overflow
+        XRPAmount const big(kMaxXrp);
+        EXPECT_ANY_THROW({ mulRatio(big, 2, 1, true); });
+    }
+
+    {
+        // underflow
+        XRPAmount const bigNegative(kMinXrp + 10);
+        EXPECT_EQ(mulRatio(bigNegative, 2, 1, true), kMinXrp);
+    }
+}
+
+}  // namespace xrpl
diff --git a/src/tests/libxrpl/basics/base58.cpp b/src/tests/libxrpl/basics/base58.cpp
new file mode 100644
index 0000000000..d452453f76
--- /dev/null
+++ b/src/tests/libxrpl/basics/base58.cpp
@@ -0,0 +1,438 @@
+#include <xrpl/protocol/detail/token_errors.h>
+
+#include <boost/multiprecision/cpp_int.hpp>  // IWYU pragma: keep
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cassert>
+#include <cstdint>
+#include <cstring>
+#include <iomanip>
+#include <iostream>
+#include <limits>
+#include <ranges>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <vector>
+#ifndef _MSC_VER
+
+#include <xrpl/protocol/detail/b58_utils.h>
+#include <xrpl/protocol/tokens.h>
+
+#include <array>
+#include <cstddef>
+#include <random>
+#include <span>
+#include <sstream>
+
+namespace xrpl::test {
+namespace {
+
+[[nodiscard]] inline auto
+randEngine() -> std::mt19937&
+{
+    static std::mt19937 kR = [] {
+        std::random_device rd;
+        return std::mt19937{rd()};
+    }();
+    return kR;
+}
+
+constexpr int kNumTokenTypeIndexes = 9;
+
+[[nodiscard]] inline auto
+tokenTypeAndSize(int i) -> std::tuple<xrpl::TokenType, std::size_t>
+{
+    assert(i < kNumTokenTypeIndexes);
+
+    switch (i)
+    {
+        using enum xrpl::TokenType;
+        case 0:
+            return {None, 20};
+        case 1:
+            return {NodePublic, 32};
+        case 2:
+            return {NodePublic, 33};
+        case 3:
+            return {NodePrivate, 32};
+        case 4:
+            return {AccountID, 20};
+        case 5:
+            return {AccountPublic, 32};
+        case 6:
+            return {AccountPublic, 33};
+        case 7:
+            return {AccountSecret, 32};
+        case 8:
+            return {FamilySeed, 16};
+        default:
+            throw std::invalid_argument(
+                "Invalid token selection passed to tokenTypeAndSize() "
+                "in " __FILE__);
+    }
+}
+
+[[nodiscard]] inline auto
+randomTokenTypeAndSize() -> std::tuple<xrpl::TokenType, std::size_t>
+{
+    using namespace xrpl;
+    auto& rng = randEngine();
+    std::uniform_int_distribution<> d(0, 8);
+    return tokenTypeAndSize(d(rng));
+}
+
+// Return the token type and subspan of `d` to use as test data.
+[[nodiscard]] inline auto
+randomB256TestData(std::span<std::uint8_t> d)
+    -> std::tuple<xrpl::TokenType, std::span<std::uint8_t>>
+{
+    auto& rng = randEngine();
+    std::uniform_int_distribution<std::uint8_t> dist(0, 255);
+    auto [tokType, tokSize] = randomTokenTypeAndSize();
+    std::generate(d.begin(), d.begin() + tokSize, [&] { return dist(rng); });
+    return {tokType, d.subspan(0, tokSize)};
+}
+
+inline void
+printAsChar(std::span<std::uint8_t> a, std::span<std::uint8_t> b)
+{
+    auto asString = [](std::span<std::uint8_t> s) {
+        std::string r;
+        r.resize(s.size());
+        std::ranges::copy(s, r.begin());
+        return r;
+    };
+    auto sa = asString(a);
+    auto sb = asString(b);
+    std::cerr << "\n\n" << sa << "\n" << sb << "\n";
+}
+
+inline void
+printAsInt(std::span<std::uint8_t> a, std::span<std::uint8_t> b)
+{
+    auto asString = [](std::span<std::uint8_t> s) -> std::string {
+        std::stringstream sstr;
+        for (auto i : s)
+        {
+            sstr << std::setw(3) << int(i) << ',';
+        }
+        return sstr.str();
+    };
+    auto sa = asString(a);
+    auto sb = asString(b);
+    std::cerr << "\n\n" << sa << "\n" << sb << "\n";
+}
+
+}  // namespace
+
+namespace multiprecision_utils {
+
+boost::multiprecision::checked_uint512_t
+toBoostMP(std::span<std::uint64_t> in)
+{
+    boost::multiprecision::checked_uint512_t mbp = 0;
+    for (auto const& i : std::views::reverse(in))
+    {
+        mbp <<= 64;
+        mbp += i;
+    }
+    return mbp;
+}
+
+std::vector<std::uint64_t>
+randomBigInt(std::uint8_t minSize = 1, std::uint8_t maxSize = 5)
+{
+    auto eng = randEngine();
+    std::uniform_int_distribution<std::uint8_t> numCoeffDist(minSize, maxSize);
+    std::uniform_int_distribution<std::uint64_t> dist;
+    auto const numCoeff = numCoeffDist(eng);
+    std::vector<std::uint64_t> coeffs;
+    coeffs.reserve(numCoeff);
+    for (int i = 0; i < numCoeff; ++i)
+    {
+        coeffs.push_back(dist(eng));
+    }
+    return coeffs;
+}
+}  // namespace multiprecision_utils
+
+TEST(Base58Test, multiprecision)
+{
+    using namespace boost::multiprecision;
+
+    constexpr std::size_t kIters = 100000;
+    auto eng = randEngine();
+    std::uniform_int_distribution<std::uint64_t> dist;
+    std::uniform_int_distribution<std::uint64_t> dist1(1);
+    for (int i = 0; i < kIters; ++i)
+    {
+        std::uint64_t const d = dist(eng);
+        if (d == 0u)
+            continue;
+        auto bigInt = multiprecision_utils::randomBigInt();
+        auto const boostBigInt =
+            multiprecision_utils::toBoostMP(std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
+
+        auto const refDiv = boostBigInt / d;
+        auto const refMod = boostBigInt % d;
+
+        auto const mod = b58_fast::detail::inplaceBigintDivRem(
+            std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
+        auto const foundDiv = multiprecision_utils::toBoostMP(bigInt);
+        EXPECT_EQ(refMod.convert_to<std::uint64_t>(), mod);
+        EXPECT_EQ(foundDiv, refDiv);
+    }
+    for (int i = 0; i < kIters; ++i)
+    {
+        std::uint64_t const d = dist(eng);
+        auto bigInt = multiprecision_utils::randomBigInt(/*minSize*/ 2);
+        if (bigInt[bigInt.size() - 1] == std::numeric_limits<std::uint64_t>::max())
+        {
+            bigInt[bigInt.size() - 1] -= 1;  // Prevent overflow
+        }
+        auto const boostBigInt =
+            multiprecision_utils::toBoostMP(std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
+
+        auto const refAdd = boostBigInt + d;
+
+        auto const result = b58_fast::detail::inplaceBigintAdd(
+            std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
+        EXPECT_EQ(result, TokenCodecErrc::Success);
+        auto const foundAdd = multiprecision_utils::toBoostMP(bigInt);
+        EXPECT_EQ(refAdd, foundAdd);
+    }
+    for (int i = 0; i < kIters; ++i)
+    {
+        std::uint64_t const d = dist1(eng);
+        // Force overflow
+        std::vector<std::uint64_t> bigInt(5, std::numeric_limits<std::uint64_t>::max());
+
+        auto const boostBigInt =
+            multiprecision_utils::toBoostMP(std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
+
+        auto const refAdd = boostBigInt + d;
+
+        auto const result = b58_fast::detail::inplaceBigintAdd(
+            std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
+        EXPECT_EQ(result, TokenCodecErrc::OverflowAdd);
+        auto const foundAdd = multiprecision_utils::toBoostMP(bigInt);
+        EXPECT_NE(refAdd, foundAdd);
+    }
+    for (int i = 0; i < kIters; ++i)
+    {
+        std::uint64_t const d = dist(eng);
+        auto bigInt = multiprecision_utils::randomBigInt(/* minSize */ 2);
+        // inplace mul requires the most significant coeff to be zero to
+        // hold the result.
+        bigInt[bigInt.size() - 1] = 0;
+        auto const boostBigInt =
+            multiprecision_utils::toBoostMP(std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
+
+        auto const refMul = boostBigInt * d;
+
+        auto const result = b58_fast::detail::inplaceBigintMul(
+            std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
+        EXPECT_EQ(result, TokenCodecErrc::Success);
+        auto const foundMul = multiprecision_utils::toBoostMP(bigInt);
+        EXPECT_EQ(refMul, foundMul);
+    }
+    for (int i = 0; i < kIters; ++i)
+    {
+        std::uint64_t const d = dist1(eng);
+        // Force overflow
+        std::vector<std::uint64_t> bigInt(5, std::numeric_limits<std::uint64_t>::max());
+        auto const boostBigInt =
+            multiprecision_utils::toBoostMP(std::span<std::uint64_t>(bigInt.data(), bigInt.size()));
+
+        auto const refMul = boostBigInt * d;
+
+        auto const result = b58_fast::detail::inplaceBigintMul(
+            std::span<uint64_t>(bigInt.data(), bigInt.size()), d);
+        EXPECT_EQ(result, TokenCodecErrc::InputTooLarge);
+        auto const foundMul = multiprecision_utils::toBoostMP(bigInt);
+        EXPECT_NE(refMul, foundMul);
+    }
+}
+
+TEST(Base58Test, fast_matches_ref)
+{
+    auto testRawEncode = [&](std::span<std::uint8_t> const& b256Data) {
+        std::array<std::uint8_t, 64> b58ResultBuf[2];
+        std::array<std::span<std::uint8_t>, 2> b58Result;
+
+        std::array<std::uint8_t, 64> b256ResultBuf[2];
+        std::array<std::span<std::uint8_t>, 2> b256Result;
+        for (int i = 0; i < 2; ++i)
+        {
+            std::span const outBuf{b58ResultBuf[i]};
+            if (i == 0)
+            {
+                auto const r = xrpl::b58_fast::detail::b256ToB58Be(b256Data, outBuf);
+                EXPECT_TRUE(r);
+                b58Result[i] = r.value();
+            }
+            else
+            {
+                std::array<std::uint8_t, 128> tmpBuf{};
+                std::string const s = xrpl::b58_ref::detail::encodeBase58(
+                    b256Data.data(), b256Data.size(), tmpBuf.data(), tmpBuf.size());
+                EXPECT_TRUE(s.size());
+                b58Result[i] = outBuf.subspan(0, s.size());
+                std::ranges::copy(s, b58Result[i].begin());
+            }
+        }
+        auto const rawB58SameSize = b58Result[0].size() == b58Result[1].size();
+        EXPECT_TRUE(rawB58SameSize);
+        if (rawB58SameSize)
+        {
+            auto const rawB58SameData =
+                memcmp(b58Result[0].data(), b58Result[1].data(), b58Result[0].size()) == 0;
+            EXPECT_TRUE(rawB58SameData);
+            if (!rawB58SameData)
+            {
+                printAsChar(b58Result[0], b58Result[1]);
+            }
+        }
+
+        for (int i = 0; i < 2; ++i)
+        {
+            std::span const outBuf{b256ResultBuf[i].data(), b256ResultBuf[i].size()};
+            if (i == 0)
+            {
+                std::string const in(
+                    b58Result[i].data(), b58Result[i].data() + b58Result[i].size());
+                auto const r = xrpl::b58_fast::detail::b58ToB256Be(in, outBuf);
+                EXPECT_TRUE(r);
+                b256Result[i] = r.value();
+            }
+            else
+            {
+                std::string const st(b58Result[i].begin(), b58Result[i].end());
+                std::string const s = xrpl::b58_ref::detail::decodeBase58(st);
+                EXPECT_TRUE(s.size());
+                b256Result[i] = outBuf.subspan(0, s.size());
+                std::ranges::copy(s, b256Result[i].begin());
+            }
+        }
+
+        auto const rawB256SameSize = b256Result[0].size() == b256Result[1].size();
+        EXPECT_TRUE(rawB256SameSize);
+        if (rawB256SameSize)
+        {
+            auto const rawB256SameData =
+                memcmp(b256Result[0].data(), b256Result[1].data(), b256Result[0].size()) == 0;
+            EXPECT_TRUE(rawB256SameData);
+            if (!rawB256SameData)
+            {
+                printAsInt(b256Result[0], b256Result[1]);
+            }
+        }
+    };
+
+    auto testTokenEncode = [&](xrpl::TokenType const tokType,
+                               std::span<std::uint8_t> const& b256Data) {
+        std::array<std::uint8_t, 64> b58ResultBuf[2];
+        std::array<std::span<std::uint8_t>, 2> b58Result;
+
+        std::array<std::uint8_t, 64> b256ResultBuf[2];
+        std::array<std::span<std::uint8_t>, 2> b256Result;
+        for (int i = 0; i < 2; ++i)
+        {
+            std::span const outBuf{b58ResultBuf[i].data(), b58ResultBuf[i].size()};
+            if (i == 0)
+            {
+                auto const r = xrpl::b58_fast::encodeBase58Token(tokType, b256Data, outBuf);
+                EXPECT_TRUE(r);
+                b58Result[i] = r.value();
+            }
+            else
+            {
+                std::string const s =
+                    xrpl::b58_ref::encodeBase58Token(tokType, b256Data.data(), b256Data.size());
+                EXPECT_TRUE(s.size());
+                b58Result[i] = outBuf.subspan(0, s.size());
+                std::ranges::copy(s, b58Result[i].begin());
+            }
+        }
+        auto const tokenB58SameSize = b58Result[0].size() == b58Result[1].size();
+        EXPECT_TRUE(tokenB58SameSize);
+        if (tokenB58SameSize)
+        {
+            auto const tokenB58SameData =
+                memcmp(b58Result[0].data(), b58Result[1].data(), b58Result[0].size()) == 0;
+            EXPECT_TRUE(tokenB58SameData);
+            if (!tokenB58SameData)
+            {
+                printAsChar(b58Result[0], b58Result[1]);
+            }
+        }
+
+        for (int i = 0; i < 2; ++i)
+        {
+            std::span const outBuf{b256ResultBuf[i].data(), b256ResultBuf[i].size()};
+            if (i == 0)
+            {
+                std::string const in(
+                    b58Result[i].data(), b58Result[i].data() + b58Result[i].size());
+                auto const r = xrpl::b58_fast::decodeBase58Token(tokType, in, outBuf);
+                EXPECT_TRUE(r);
+                b256Result[i] = r.value();
+            }
+            else
+            {
+                std::string const st(b58Result[i].begin(), b58Result[i].end());
+                std::string const s = xrpl::b58_ref::decodeBase58Token(st, tokType);
+                EXPECT_TRUE(s.size());
+                b256Result[i] = outBuf.subspan(0, s.size());
+                std::ranges::copy(s, b256Result[i].begin());
+            }
+        }
+
+        auto const tokenB256SameSize = b256Result[0].size() == b256Result[1].size();
+        EXPECT_TRUE(tokenB256SameSize);
+        if (tokenB256SameSize)
+        {
+            auto const tokenB256SameData =
+                memcmp(b256Result[0].data(), b256Result[1].data(), b256Result[0].size()) == 0;
+            EXPECT_TRUE(tokenB256SameData);
+            if (!tokenB256SameData)
+            {
+                printAsInt(b256Result[0], b256Result[1]);
+            }
+        }
+    };
+
+    auto testIt = [&](xrpl::TokenType const tokType, std::span<std::uint8_t> const& b256Data) {
+        testRawEncode(b256Data);
+        testTokenEncode(tokType, b256Data);
+    };
+
+    // test every token type with data where every byte is the same and the
+    // bytes range from 0-255
+    for (int i = 0; i < kNumTokenTypeIndexes; ++i)
+    {
+        std::array<std::uint8_t, 128> b256DataBuf{};
+        auto const [tokType, tokSize] = tokenTypeAndSize(i);
+        for (int d = 0; d <= 255; ++d)
+        {
+            memset(b256DataBuf.data(), d, tokSize);
+            testIt(tokType, std::span(b256DataBuf.data(), tokSize));
+        }
+    }
+
+    // test with random data
+    constexpr std::size_t kIters = 100000;
+    for (int i = 0; i < kIters; ++i)
+    {
+        std::array<std::uint8_t, 128> b256DataBuf{};
+        auto const [tokType, b256Data] = randomB256TestData(b256DataBuf);
+        testIt(tokType, b256Data);
+    }
+}
+
+}  // namespace xrpl::test
+
+#endif  // _MSC_VER
diff --git a/src/tests/libxrpl/basics/base_uint_test.cpp b/src/tests/libxrpl/basics/base_uint_test.cpp
new file mode 100644
index 0000000000..365b43930c
--- /dev/null
+++ b/src/tests/libxrpl/basics/base_uint_test.cpp
@@ -0,0 +1,360 @@
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/hardened_hash.h>
+#include <xrpl/beast/utility/Zero.h>
+
+#include <boost/endian/detail/order.hpp>
+
+#include <gtest/gtest.h>
+
+#include <array>
+#include <cassert>
+#include <complex>
+#include <cstddef>
+#include <cstdint>
+#include <iterator>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <type_traits>
+#include <unordered_set>
+#include <utility>
+#include <vector>
+
+namespace xrpl::test {
+
+// a non-hashing Hasher that just copies the bytes.
+// Used to test hash_append in base_uint
+template <std::size_t Bits>
+struct Nonhash
+{
+    static constexpr auto const kEndian = boost::endian::order::big;
+    static constexpr std::size_t kWidth = Bits / 8;
+
+    std::array<std::uint8_t, kWidth> data;
+
+    Nonhash() = default;
+
+    void
+    operator()(void const* key, std::size_t len) noexcept
+    {
+        assert(len == kWidth);
+        memcpy(data.data(), key, len);
+    }
+
+    explicit
+    operator std::size_t() noexcept
+    {
+        return kWidth;
+    }
+};
+
+struct BaseUintTest : public ::testing::Test
+{
+    using BaseUInt96 = BaseUInt<96>;
+    static_assert(std::is_copy_constructible_v<BaseUInt96>);
+    static_assert(std::is_copy_assignable_v<BaseUInt96>);
+
+    static void
+    testComparisons()
+    {
+        {
+            static constexpr std::array<std::pair<std::string_view, std::string_view>, 6> kTestArgs{
+                {{"0000000000000000", "0000000000000001"},
+                 {"0000000000000000", "ffffffffffffffff"},
+                 {"1234567812345678", "2345678923456789"},
+                 {"8000000000000000", "8000000000000001"},
+                 {"aaaaaaaaaaaaaaa9", "aaaaaaaaaaaaaaaa"},
+                 {"fffffffffffffffe", "ffffffffffffffff"}}};
+
+            for (auto const& arg : kTestArgs)
+            {
+                xrpl::BaseUInt<64> const u{arg.first}, v{arg.second};
+                // For code readability, we want to use general boolean
+                // expectations instead of specific EXPECT_LT etc.
+                EXPECT_TRUE(u < v);
+                EXPECT_TRUE(u <= v);
+                EXPECT_TRUE(u != v);
+                EXPECT_FALSE(u == v);
+                EXPECT_FALSE(u > v);
+                EXPECT_FALSE(u >= v);
+                EXPECT_FALSE(v < u);
+                EXPECT_FALSE(v <= u);
+                EXPECT_TRUE(v != u);
+                EXPECT_FALSE(v == u);
+                EXPECT_TRUE(v > u);
+                EXPECT_TRUE(v >= u);
+                EXPECT_TRUE(u == u);
+                EXPECT_TRUE(v == v);
+            }
+        }
+
+        {
+            static constexpr std::array<std::pair<std::string_view, std::string_view>, 6> kTestArgs{
+                {
+                    {"000000000000000000000000", "000000000000000000000001"},
+                    {"000000000000000000000000", "ffffffffffffffffffffffff"},
+                    {"0123456789ab0123456789ab", "123456789abc123456789abc"},
+                    {"555555555555555555555555", "55555555555a555555555555"},
+                    {"aaaaaaaaaaaaaaa9aaaaaaaa", "aaaaaaaaaaaaaaaaaaaaaaaa"},
+                    {"fffffffffffffffffffffffe", "ffffffffffffffffffffffff"},
+                }};
+
+            for (auto const& arg : kTestArgs)
+            {
+                xrpl::BaseUInt<96> const u{arg.first}, v{arg.second};
+                EXPECT_TRUE(u < v);
+                EXPECT_TRUE(u <= v);
+                EXPECT_TRUE(u != v);
+                EXPECT_FALSE(u == v);
+                EXPECT_FALSE(u > v);
+                EXPECT_FALSE(u >= v);
+                EXPECT_FALSE(v < u);
+                EXPECT_FALSE(v <= u);
+                EXPECT_TRUE(v != u);
+                EXPECT_FALSE(v == u);
+                EXPECT_TRUE(v > u);
+                EXPECT_TRUE(v >= u);
+                EXPECT_TRUE(u == u);
+                EXPECT_TRUE(v == v);
+            }
+        }
+    }
+};
+
+TEST_F(BaseUintTest, base_uint)
+{
+    static_assert(!std::is_constructible_v<BaseUInt96, std::complex<double>>);
+    static_assert(!std::is_assignable_v<BaseUInt96&, std::complex<double>>);
+
+    testComparisons();
+
+    // used to verify set insertion (hashing required)
+    std::unordered_set<BaseUInt96, HardenedHash<>> uset;
+
+    Blob const raw{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12};
+    EXPECT_EQ(BaseUInt96::kBytes, raw.size());
+
+    BaseUInt96 u = BaseUInt96::fromRaw(raw);
+    uset.insert(u);
+    EXPECT_EQ(raw.size(), u.size());
+    EXPECT_EQ(to_string(u), "0102030405060708090A0B0C");
+    EXPECT_EQ(toShortString(u), "01020304...");
+    EXPECT_EQ(*u.data(), 1);
+    EXPECT_EQ(u.signum(), 1);
+    EXPECT_FALSE(!u);
+    EXPECT_FALSE(u.isZero());
+    EXPECT_TRUE(u.isNonZero());
+    unsigned char t = 0;
+    for (auto& d : u)
+    {
+        EXPECT_EQ(d, ++t);
+    }
+
+    // Test hash_append by "hashing" with a no-op hasher (h)
+    // and then extracting the bytes that were written during hashing
+    // back into another base_uint (w) for comparison with the original
+    Nonhash<96> h{};
+    hash_append(h, u);
+    BaseUInt96 const w =
+        BaseUInt96::fromRaw(std::vector<std::uint8_t>(h.data.begin(), h.data.end()));
+    EXPECT_EQ(w, u);
+
+    BaseUInt96 v{~u};
+    uset.insert(v);
+    EXPECT_EQ(to_string(v), "FEFDFCFBFAF9F8F7F6F5F4F3");
+    EXPECT_EQ(toShortString(v), "FEFDFCFB...");
+    EXPECT_EQ(*v.data(), 0xfe);
+    EXPECT_EQ(v.signum(), 1);
+    EXPECT_FALSE(!v);
+    EXPECT_FALSE(v.isZero());
+    EXPECT_TRUE(v.isNonZero());
+
+    t = 0xff;
+    for (auto& d : v)
+    {
+        EXPECT_EQ(d, --t);
+    }
+
+    EXPECT_LT(u, v);
+    EXPECT_GT(v, u);
+
+    v = u;
+    EXPECT_EQ(v, u);
+
+    BaseUInt96 z{beast::kZero};
+    uset.insert(z);
+    EXPECT_EQ(to_string(z), "000000000000000000000000");
+    EXPECT_EQ(toShortString(z), "00000000...");
+    EXPECT_EQ(*z.data(), 0);
+    EXPECT_EQ(*z.begin(), 0);
+    EXPECT_EQ(*std::prev(z.end(), 1), 0);
+    EXPECT_EQ(z.signum(), 0);
+    EXPECT_TRUE(!z);
+    EXPECT_TRUE(z.isZero());
+    EXPECT_FALSE(z.isNonZero());
+    for (auto& d : z)
+    {
+        EXPECT_EQ(d, 0);
+    }
+
+    BaseUInt96 n{z};
+    n++;
+    EXPECT_EQ(n, BaseUInt96(1));
+    n--;
+    EXPECT_EQ(n, beast::kZero);
+    EXPECT_EQ(n, z);
+    n--;
+    EXPECT_EQ(to_string(n), "FFFFFFFFFFFFFFFFFFFFFFFF");
+    EXPECT_EQ(toShortString(n), "FFFFFFFF...");
+    n = beast::kZero;
+    EXPECT_EQ(n, z);
+
+    BaseUInt96 zp1{z};
+    zp1++;
+    BaseUInt96 zm1{z};
+    zm1--;
+    BaseUInt96 const x{zm1 ^ zp1};
+    uset.insert(x);
+    EXPECT_EQ(to_string(x), "FFFFFFFFFFFFFFFFFFFFFFFE") << to_string(x);
+    EXPECT_EQ(toShortString(x), "FFFFFFFF...") << toShortString(x);
+
+    EXPECT_EQ(uset.size(), 4);
+
+    BaseUInt96 tmp;
+    EXPECT_TRUE(tmp.parseHex(to_string(u)));
+    EXPECT_EQ(tmp, u);
+    tmp = z;
+
+    // fails with extra char
+    EXPECT_FALSE(tmp.parseHex("A" + to_string(u)));
+    tmp = z;
+
+    // fails with extra char at end
+    EXPECT_FALSE(tmp.parseHex(to_string(u) + "A"));
+
+    // fails with a non-hex character at some point in the string:
+    tmp = z;
+
+    for (std::size_t i = 0; i != 24; ++i)
+    {
+        std::string x = to_string(z);
+        x[i] = ('G' + (i % 10));
+        EXPECT_FALSE(tmp.parseHex(x));
+    }
+
+    // Walking 1s:
+    for (std::size_t i = 0; i != 24; ++i)
+    {
+        std::string s1 = "000000000000000000000000";
+        s1[i] = '1';
+
+        EXPECT_TRUE(tmp.parseHex(s1));
+        EXPECT_EQ(to_string(tmp), s1);
+    }
+
+    // Walking 0s:
+    for (std::size_t i = 0; i != 24; ++i)
+    {
+        std::string s1 = "111111111111111111111111";
+        s1[i] = '0';
+
+        EXPECT_TRUE(tmp.parseHex(s1));
+        EXPECT_EQ(to_string(tmp), s1);
+    }
+
+    // Constexpr constructors
+    {
+        static_assert(BaseUInt96{}.signum() == 0);
+        static_assert(BaseUInt96("0").signum() == 0);
+        static_assert(BaseUInt96("000000000000000000000000").signum() == 0);
+        static_assert(BaseUInt96("000000000000000000000001").signum() == 1);
+        static_assert(BaseUInt96("800000000000000000000000").signum() == 1);
+
+// Everything within the #if should fail during compilation.
+#if 0
+            // Too few characters
+            static_assert(BaseUInt96("00000000000000000000000").signum() == 0);
+
+            // Too many characters
+            static_assert(BaseUInt96("0000000000000000000000000").signum() == 0);
+
+            // Non-hex characters
+            static_assert(BaseUInt96("00000000000000000000000 ").signum() == 1);
+            static_assert(BaseUInt96("00000000000000000000000/").signum() == 1);
+            static_assert(BaseUInt96("00000000000000000000000:").signum() == 1);
+            static_assert(BaseUInt96("00000000000000000000000@").signum() == 1);
+            static_assert(BaseUInt96("00000000000000000000000G").signum() == 1);
+            static_assert(BaseUInt96("00000000000000000000000`").signum() == 1);
+            static_assert(BaseUInt96("00000000000000000000000g").signum() == 1);
+            static_assert(BaseUInt96("00000000000000000000000~").signum() == 1);
+#endif  // 0
+
+        // Using the constexpr constructor in a non-constexpr context
+        // with an error in the parsing throws an exception.
+        {
+            // Invalid length for string.
+            bool caught = false;
+            try
+            {
+                // Try to prevent constant evaluation.
+                std::vector<char> str(23, '7');
+                std::string_view const sView(str.data(), str.size());
+                [[maybe_unused]] BaseUInt96 const t96(sView);
+            }
+            catch (std::invalid_argument const& e)
+            {
+                EXPECT_EQ(e.what(), std::string("invalid length for hex string"));
+                caught = true;
+            }
+            EXPECT_TRUE(caught);
+        }
+        {
+            // Invalid character in string.
+            bool caught = false;
+            try
+            {
+                // Try to prevent constant evaluation.
+                std::vector<char> str(23, '7');
+                str.push_back('G');
+                std::string_view const sView(str.data(), str.size());
+                [[maybe_unused]] BaseUInt96 const t96(sView);
+            }
+            catch (std::range_error const& e)
+            {
+                EXPECT_EQ(e.what(), std::string("invalid hex character"));
+                caught = true;
+            }
+            EXPECT_TRUE(caught);
+        }
+
+        // Verify that constexpr base_uints interpret a string the same
+        // way parseHex() does.
+        struct StrBaseUInt
+        {
+            char const* const str;
+            BaseUInt96 tst;
+
+            constexpr StrBaseUInt(char const* s) : str(s), tst(s)
+            {
+            }
+        };
+        constexpr StrBaseUInt kTestCases[] = {
+            "000000000000000000000000",
+            "000000000000000000000001",
+            "fedcba9876543210ABCDEF91",
+            "19FEDCBA0123456789abcdef",
+            "800000000000000000000000",
+            "fFfFfFfFfFfFfFfFfFfFfFfF",
+        };
+
+        for (StrBaseUInt const& t : kTestCases)
+        {
+            BaseUInt96 t96;
+            EXPECT_TRUE(t96.parseHex(t.str));
+            EXPECT_EQ(t96, t.tst);
+        }
+    }
+}
+
+}  // namespace xrpl::test
diff --git a/src/test/basics/hardened_hash_test.cpp b/src/tests/libxrpl/basics/hardened_hash.cpp
similarity index 84%
rename from src/test/basics/hardened_hash_test.cpp
rename to src/tests/libxrpl/basics/hardened_hash.cpp
index 8b10967932..4f51ce4305 100644
--- a/src/test/basics/hardened_hash_test.cpp
+++ b/src/tests/libxrpl/basics/hardened_hash.cpp
@@ -1,6 +1,8 @@
 #include <xrpl/basics/hardened_hash.h>
+
 #include <xrpl/beast/hash/hash_append.h>
-#include <xrpl/beast/unit_test/suite.h>
+
+#include <gtest/gtest.h>
 
 #include <array>
 #include <cstddef>
@@ -153,20 +155,20 @@ static_assert(sha256_t::kBits == 256, "sha256_t must have 256 bits");
 
 namespace xrpl {
 
-class hardened_hash_test : public beast::unit_test::Suite
+class HardenedHashTest : public ::testing::Test
 {
 public:
     template <class T>
-    void
+    static void
     check()
     {
         T t{};
         HardenedHash<>()(t);
-        pass();
+        SUCCEED();
     }
 
     template <template <class T> class U>
-    void
+    static void
     checkUserType()
     {
         check<U<bool>>();
@@ -191,48 +193,35 @@ public:
     }
 
     template <template <class T> class C>
-    void
+    static void
     checkContainer()
     {
         {
             C<detail::TestUserTypeMember<std::string>> const c;
         }
 
-        pass();
+        SUCCEED();
 
         {
             C<detail::TestUserTypeFree<std::string>> const c;
         }
 
-        pass();
-    }
-
-    void
-    testUserTypes()
-    {
-        testcase("user types");
-        checkUserType<detail::TestUserTypeMember>();
-        checkUserType<detail::TestUserTypeFree>();
-    }
-
-    void
-    testContainers()
-    {
-        testcase("containers");
-        checkContainer<detail::test_hardened_unordered_set>();
-        checkContainer<detail::test_hardened_unordered_map>();
-        checkContainer<detail::test_hardened_unordered_multiset>();
-        checkContainer<detail::test_hardened_unordered_multimap>();
-    }
-
-    void
-    run() override
-    {
-        testUserTypes();
-        testContainers();
+        SUCCEED();
     }
 };
 
-BEAST_DEFINE_TESTSUITE(hardened_hash, basics, xrpl);
+TEST_F(HardenedHashTest, user_types)
+{
+    checkUserType<detail::TestUserTypeMember>();
+    checkUserType<detail::TestUserTypeFree>();
+}
+
+TEST_F(HardenedHashTest, containers)
+{
+    checkContainer<detail::test_hardened_unordered_set>();
+    checkContainer<detail::test_hardened_unordered_map>();
+    checkContainer<detail::test_hardened_unordered_multiset>();
+    checkContainer<detail::test_hardened_unordered_multimap>();
+}
 
 }  // namespace xrpl
diff --git a/src/tests/libxrpl/basics/join.cpp b/src/tests/libxrpl/basics/join.cpp
new file mode 100644
index 0000000000..66c832678b
--- /dev/null
+++ b/src/tests/libxrpl/basics/join.cpp
@@ -0,0 +1,80 @@
+#include <xrpl/basics/join.h>
+
+#include <xrpl/basics/base_uint.h>
+
+#include <gtest/gtest.h>
+
+#include <array>
+#include <cstddef>
+#include <initializer_list>
+#include <sstream>
+#include <string>
+#include <vector>
+
+namespace xrpl::test {
+
+struct JoinTest : public ::testing::Test
+{
+};
+
+TEST_F(JoinTest, join)
+{
+    auto test = [](auto collectionanddelimiter, std::string expected) {
+        std::stringstream ss;
+        // Put something else in the buffer before and after to ensure that
+        // the << operator returns the stream correctly.
+        ss << "(" << collectionanddelimiter << ")";
+        auto const str = ss.str();
+        EXPECT_EQ(str.substr(1, str.length() - 2), expected);
+        EXPECT_EQ(str.front(), '(');
+        EXPECT_EQ(str.back(), ')');
+    };
+
+    // C++ array
+    test(CollectionAndDelimiter(std::array<int, 4>{2, -1, 5, 10}, "/"), "2/-1/5/10");
+    // One item C++ array edge case
+    test(CollectionAndDelimiter(std::array<std::string, 1>{"test"}, " & "), "test");
+    // Empty C++ array edge case
+    test(CollectionAndDelimiter(std::array<int, 0>{}, ","), "");
+    {
+        // C-style array
+        char letters[4]{'w', 'a', 's', 'd'};
+        test(CollectionAndDelimiter(letters, std::to_string(0)), "w0a0s0d");
+    }
+    {
+        // Auto sized C-style array
+        std::string words[]{"one", "two", "three", "four"};
+        test(CollectionAndDelimiter(words, "\n"), "one\ntwo\nthree\nfour");
+    }
+    {
+        // One item C-style array edge case
+        std::string words[]{"thing"};
+        test(CollectionAndDelimiter(words, "\n"), "thing");
+    }
+    // Initializer list
+    test(CollectionAndDelimiter(std::initializer_list<size_t>{19, 25}, "+"), "19+25");
+    // vector
+    test(CollectionAndDelimiter(std::vector<int>{0, 42}, std::to_string(99)), "09942");
+    // vector with one item edge case
+    test(CollectionAndDelimiter(std::vector<std::string>{"master"}, "xxx"), "master");
+    // vector with one non-trivial streamable item edge case
+    test(
+        CollectionAndDelimiter(std::vector<uint256>{uint256{1}}, "xxx"),
+        "0000000000000000000000000000000000000000000000000000000000000001");
+    // empty vector edge case
+    test(CollectionAndDelimiter(std::vector<uint256>{}, ","), "");
+    // C-style string
+    test(CollectionAndDelimiter("string", " "), "s t r i n g");
+    // Empty C-style string edge case
+    test(CollectionAndDelimiter("", "*"), "");
+    // Single char C-style string edge case
+    test(CollectionAndDelimiter("x", "*"), "x");
+    // std::string
+    test(CollectionAndDelimiter(std::string{"string"}, "-"), "s-t-r-i-n-g");
+    // Empty std::string edge case
+    test(CollectionAndDelimiter(std::string{""}, "*"), "");
+    // Single char std::string edge case
+    test(CollectionAndDelimiter(std::string{"y"}, "*"), "y");
+}
+
+}  // namespace xrpl::test

From c5a6de6ef751e99ed26d8b8cebf92cef0de7b129 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 7 Jul 2026 14:12:52 +0100
Subject: [PATCH 052/100] chore: Enable most cppcoreguidelines checks (#7660)

---
 .clang-tidy                                   | 13 ------------
 .../xrpl/basics/partitioned_unordered_map.h   | 11 ++++------
 .../container/detail/aged_ordered_container.h |  1 +
 .../detail/aged_unordered_container.h         |  1 +
 include/xrpl/beast/type_name.h                |  1 +
 include/xrpl/nodestore/detail/DecodedBlob.h   |  6 +++---
 include/xrpl/protocol/STPathSet.h             |  6 ++++++
 include/xrpl/protocol/detail/STVar.h          |  7 +++----
 include/xrpl/shamap/SHAMapItem.h              |  1 +
 include/xrpl/tx/paths/OfferStream.h           |  1 +
 src/libxrpl/json/Writer.cpp                   |  3 +--
 src/libxrpl/json/json_reader.cpp              |  2 ++
 src/libxrpl/json/json_value.cpp               |  8 ++++++++
 src/libxrpl/json/json_writer.cpp              |  1 +
 src/libxrpl/nodestore/DecodedBlob.cpp         |  6 +-----
 src/libxrpl/protocol/Indexes.cpp              | 14 ++++++++++---
 src/libxrpl/protocol/SOTemplate.cpp           |  5 +++--
 src/libxrpl/protocol/STTx.cpp                 |  7 +++++--
 src/libxrpl/protocol/Serializer.cpp           |  2 +-
 src/libxrpl/protocol/TxMeta.cpp               | 18 ++++++++---------
 src/libxrpl/shamap/SHAMap.cpp                 |  1 +
 .../tx/transactors/bridge/XChainBridge.cpp    |  6 +++++-
 src/test/app/PayStrand_test.cpp               | 20 +++++++------------
 src/test/app/XChain_test.cpp                  |  4 ++--
 src/test/csf/random.h                         |  3 +--
 src/test/overlay/reduce_relay_test.cpp        |  6 ++----
 src/test/protocol/STTx_test.cpp               |  1 +
 src/tests/libxrpl/helpers/TxTest.cpp          |  4 +++-
 src/xrpld/app/misc/detail/AmendmentTable.cpp  |  1 +
 29 files changed, 86 insertions(+), 74 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index 5a1ba7c321..c13ca78ac2 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -9,37 +9,24 @@ Checks: "-*,
 
   cppcoreguidelines-*,
   -cppcoreguidelines-avoid-c-arrays,
-  -cppcoreguidelines-avoid-capturing-lambda-coroutines,
   -cppcoreguidelines-avoid-const-or-ref-data-members,
   -cppcoreguidelines-avoid-do-while,
-  -cppcoreguidelines-avoid-goto,
   -cppcoreguidelines-avoid-magic-numbers,
   -cppcoreguidelines-avoid-non-const-global-variables,
-  -cppcoreguidelines-avoid-reference-coroutine-parameters,
   -cppcoreguidelines-c-copy-assignment-signature,
-  -cppcoreguidelines-explicit-virtual-functions,
   -cppcoreguidelines-interfaces-global-init,
-  -cppcoreguidelines-macro-to-enum,
   -cppcoreguidelines-macro-usage,
   -cppcoreguidelines-missing-std-forward,
   -cppcoreguidelines-narrowing-conversions,
-  -cppcoreguidelines-no-malloc,
-  -cppcoreguidelines-noexcept-destructor,
   -cppcoreguidelines-noexcept-move-operations,
-  -cppcoreguidelines-noexcept-swap,
   -cppcoreguidelines-non-private-member-variables-in-classes,
   -cppcoreguidelines-owning-memory,
-  -cppcoreguidelines-prefer-member-initializer,
   -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
   -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
   -cppcoreguidelines-pro-bounds-constant-array-index,
   -cppcoreguidelines-pro-bounds-pointer-arithmetic,
-  -cppcoreguidelines-pro-type-const-cast,
-  -cppcoreguidelines-pro-type-cstyle-cast,
   -cppcoreguidelines-pro-type-reinterpret-cast,
   -cppcoreguidelines-pro-type-union-access,
-  -cppcoreguidelines-pro-type-vararg,
-  -cppcoreguidelines-slicing,
   -cppcoreguidelines-special-member-functions,
 
   llvm-namespace-comment,
diff --git a/include/xrpl/basics/partitioned_unordered_map.h b/include/xrpl/basics/partitioned_unordered_map.h
index c2750a5769..e78043e252 100644
--- a/include/xrpl/basics/partitioned_unordered_map.h
+++ b/include/xrpl/basics/partitioned_unordered_map.h
@@ -138,11 +138,8 @@ public:
         {
         }
 
-        ConstIterator(Iterator const& orig)
+        ConstIterator(Iterator const& orig) : map(orig.map), ait(orig.ait), mit(orig.mit)
         {
-            map = orig.map;
-            ait = orig.ait;
-            mit = orig.mit;
         }
 
         const_reference
@@ -231,11 +228,11 @@ private:
 
 public:
     PartitionedUnorderedMap(std::optional<std::size_t> partitions = std::nullopt)
-    {
         // Set partitions to the number of hardware threads if the parameter
         // is either empty or set to 0.
-        partitions_ =
-            partitions && (*partitions != 0u) ? *partitions : std::thread::hardware_concurrency();
+        : partitions_(
+              partitions && (*partitions != 0u) ? *partitions : std::thread::hardware_concurrency())
+    {
         map_.resize(partitions_);
         XRPL_ASSERT(
             partitions_,
diff --git a/include/xrpl/beast/container/detail/aged_ordered_container.h b/include/xrpl/beast/container/detail/aged_ordered_container.h
index f739f05d2c..c98f16022f 100644
--- a/include/xrpl/beast/container/detail/aged_ordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_ordered_container.h
@@ -359,6 +359,7 @@ private:
     deleteElement(Element const* p)
     {
         ElementAllocatorTraits::destroy(config_.alloc(), p);
+        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
         ElementAllocatorTraits::deallocate(config_.alloc(), const_cast<Element*>(p), 1);
     }
 
diff --git a/include/xrpl/beast/container/detail/aged_unordered_container.h b/include/xrpl/beast/container/detail/aged_unordered_container.h
index ea24141bfb..9be9e96ba2 100644
--- a/include/xrpl/beast/container/detail/aged_unordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_unordered_container.h
@@ -528,6 +528,7 @@ private:
     deleteElement(Element const* p)
     {
         ElementAllocatorTraits::destroy(config_.alloc(), p);
+        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
         ElementAllocatorTraits::deallocate(config_.alloc(), const_cast<Element*>(p), 1);
     }
 
diff --git a/include/xrpl/beast/type_name.h b/include/xrpl/beast/type_name.h
index ae7b681af9..85fd9ae6a2 100644
--- a/include/xrpl/beast/type_name.h
+++ b/include/xrpl/beast/type_name.h
@@ -23,6 +23,7 @@ typeName()
     if (auto s = abi::__cxa_demangle(name.c_str(), nullptr, nullptr, nullptr))
     {
         name = s;
+        // NOLINTNEXTLINE(cppcoreguidelines-no-malloc)
         std::free(s);
     }
 #endif
diff --git a/include/xrpl/nodestore/detail/DecodedBlob.h b/include/xrpl/nodestore/detail/DecodedBlob.h
index b2d5fc9c26..02ccd5787a 100644
--- a/include/xrpl/nodestore/detail/DecodedBlob.h
+++ b/include/xrpl/nodestore/detail/DecodedBlob.h
@@ -34,11 +34,11 @@ public:
     createObject();
 
 private:
-    bool success_;
+    bool success_{false};
 
     void const* key_;
-    NodeObjectType objectType_;
-    unsigned char const* objectData_;
+    NodeObjectType objectType_{NodeObjectType::Unknown};
+    unsigned char const* objectData_{nullptr};
     int dataBytes_;
 };
 
diff --git a/include/xrpl/protocol/STPathSet.h b/include/xrpl/protocol/STPathSet.h
index f6b0fde7da..23f4e653c4 100644
--- a/include/xrpl/protocol/STPathSet.h
+++ b/include/xrpl/protocol/STPathSet.h
@@ -240,6 +240,9 @@ private:
 
 inline STPathElement::STPathElement() : type_(TypeNone), isOffer_(true)
 {
+    // hashValue_ is derived from the whole object, so it is computed in the body
+    // once every other member is initialized (as in the other constructors).
+    // NOLINTNEXTLINE(cppcoreguidelines-prefer-member-initializer)
     hashValue_ = getHash(*this);
 }
 
@@ -315,6 +318,9 @@ inline STPathElement::STPathElement(
     assetID_.visit(
         [&](Currency const&) { type_ = type_ & (~Type::TypeMpt); },
         [&](MPTID const&) { type_ = type_ & (~Type::TypeCurrency); });
+    // hashValue_ must be computed after type_ is adjusted above, so this cannot
+    // be a member initializer.
+    // NOLINTNEXTLINE(cppcoreguidelines-prefer-member-initializer)
     hashValue_ = getHash(*this);
 }
 
diff --git a/include/xrpl/protocol/detail/STVar.h b/include/xrpl/protocol/detail/STVar.h
index 6853166174..e95461c253 100644
--- a/include/xrpl/protocol/detail/STVar.h
+++ b/include/xrpl/protocol/detail/STVar.h
@@ -50,14 +50,13 @@ public:
     STVar&
     operator=(STVar&& rhs);
 
-    STVar(STBase&& t)  // NOLINT(cppcoreguidelines-rvalue-reference-param-not-moved)
+    // NOLINTNEXTLINE(cppcoreguidelines-rvalue-reference-param-not-moved)
+    STVar(STBase&& t) : p_(t.move(kMaxSize, &d_))
     {
-        p_ = t.move(kMaxSize, &d_);
     }
 
-    STVar(STBase const& t)
+    STVar(STBase const& t) : p_(t.copy(kMaxSize, &d_))
     {
-        p_ = t.copy(kMaxSize, &d_);
     }
 
     STVar(DefaultObjectT, SField const& name);
diff --git a/include/xrpl/shamap/SHAMapItem.h b/include/xrpl/shamap/SHAMapItem.h
index 846f0bab4e..d45d75a942 100644
--- a/include/xrpl/shamap/SHAMapItem.h
+++ b/include/xrpl/shamap/SHAMapItem.h
@@ -138,6 +138,7 @@ intrusive_ptr_release(SHAMapItem const* x)
 
         // If the slabber doesn't claim this pointer, it was allocated
         // manually, so we free it manually.
+        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
         if (!detail::gSlabber.deallocate(const_cast<std::uint8_t*>(p)))
             delete[] p;
     }
diff --git a/include/xrpl/tx/paths/OfferStream.h b/include/xrpl/tx/paths/OfferStream.h
index 98c58876c9..8ecd495d1a 100644
--- a/include/xrpl/tx/paths/OfferStream.h
+++ b/include/xrpl/tx/paths/OfferStream.h
@@ -92,6 +92,7 @@ public:
     [[nodiscard]] TOffer<TIn, TOut>&
     tip() const
     {
+        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
         return const_cast<TOfferStreamBase*>(this)->offer_;
     }
 
diff --git a/src/libxrpl/json/Writer.cpp b/src/libxrpl/json/Writer.cpp
index c5c4b3cd31..b21013cda7 100644
--- a/src/libxrpl/json/Writer.cpp
+++ b/src/libxrpl/json/Writer.cpp
@@ -230,9 +230,8 @@ Writer::~Writer()
         impl_->finishAll();
 }
 
-Writer::Writer(Writer&& w) noexcept
+Writer::Writer(Writer&& w) noexcept : impl_(std::move(w.impl_))
 {
-    impl_ = std::move(w.impl_);
 }
 
 Writer&
diff --git a/src/libxrpl/json/json_reader.cpp b/src/libxrpl/json/json_reader.cpp
index a12ec7b565..f37cca506b 100644
--- a/src/libxrpl/json/json_reader.cpp
+++ b/src/libxrpl/json/json_reader.cpp
@@ -624,11 +624,13 @@ Reader::decodeDouble(Token& token)
         Char buffer[bufferSize + 1];
         memcpy(buffer, token.start, length);
         buffer[length] = 0;
+        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-vararg)
         count = sscanf(buffer, format, &value);
     }
     else
     {
         std::string const buffer(token.start, token.end);
+        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-vararg)
         count = sscanf(buffer.c_str(), format, &value);
     }
     if (count != 1)
diff --git a/src/libxrpl/json/json_value.cpp b/src/libxrpl/json/json_value.cpp
index c679e30e16..ce208418de 100644
--- a/src/libxrpl/json/json_value.cpp
+++ b/src/libxrpl/json/json_value.cpp
@@ -48,6 +48,7 @@ public:
         if (length == kUnknown)
             length = (value != nullptr) ? (unsigned int)strlen(value) : 0;
 
+        // NOLINTNEXTLINE(cppcoreguidelines-no-malloc)
         char* newString = static_cast<char*>(malloc(length + 1));
         if (value != nullptr)
             memcpy(newString, value, length);
@@ -59,7 +60,10 @@ public:
     releaseStringValue(char* value) override
     {
         if (value != nullptr)
+        {
+            // NOLINTNEXTLINE(cppcoreguidelines-no-malloc)
             free(value);
+        }
     }
 };
 
@@ -120,7 +124,10 @@ Value::CZString::CZString(CZString const& other)
 Value::CZString::~CZString()
 {
     if ((cstr_ != nullptr) && index_ == static_cast<int>(DuplicationPolicy::Duplicate))
+    {
+        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
         valueAllocator()->releaseMemberName(const_cast<char*>(cstr_));
+    }
 }
 
 bool
@@ -241,6 +248,7 @@ Value::Value(std::string const& value) : type_(ValueType::String), allocated_(tr
 
 Value::Value(StaticString const& value) : type_(ValueType::String)
 {
+    // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
     value_.stringVal = const_cast<char*>(value.cStr());
 }
 
diff --git a/src/libxrpl/json/json_writer.cpp b/src/libxrpl/json/json_writer.cpp
index c9f8cb688b..853dd9a5ac 100644
--- a/src/libxrpl/json/json_writer.cpp
+++ b/src/libxrpl/json/json_writer.cpp
@@ -86,6 +86,7 @@ valueToString(double value)
                                                        // to avoid warning.
     sprintf_s(buffer, sizeof(buffer), "%.16g", value);
 #else
+    // NOLINTNEXTLINE(cppcoreguidelines-pro-type-vararg)
     snprintf(buffer, sizeof(buffer), "%.16g", value);
 #endif
     return buffer;
diff --git a/src/libxrpl/nodestore/DecodedBlob.cpp b/src/libxrpl/nodestore/DecodedBlob.cpp
index fe07252f23..9740462ae8 100644
--- a/src/libxrpl/nodestore/DecodedBlob.cpp
+++ b/src/libxrpl/nodestore/DecodedBlob.cpp
@@ -12,7 +12,7 @@
 
 namespace xrpl::NodeStore {
 
-DecodedBlob::DecodedBlob(void const* key, void const* value, int valueBytes)
+DecodedBlob::DecodedBlob(void const* key, void const* value, int valueBytes) : key_(key)
 {
     /*  Data format:
 
@@ -23,10 +23,6 @@ DecodedBlob::DecodedBlob(void const* key, void const* value, int valueBytes)
         9...end                     The body of the object data
     */
 
-    success_ = false;
-    key_ = key;
-    objectType_ = NodeObjectType::Unknown;
-    objectData_ = nullptr;
     dataBytes_ = std::max(0, valueBytes - 9);
 
     // VFALCO NOTE What about bytes 4 through 7 inclusive?
diff --git a/src/libxrpl/protocol/Indexes.cpp b/src/libxrpl/protocol/Indexes.cpp
index a49f7b85ee..76ff868f9e 100644
--- a/src/libxrpl/protocol/Indexes.cpp
+++ b/src/libxrpl/protocol/Indexes.cpp
@@ -152,7 +152,12 @@ std::uint64_t
 getQuality(uint256 const& uBase)
 {
     // VFALCO [base_uint] This assumes a certain storage format
-    return boost::endian::big_to_native(((std::uint64_t*)uBase.end())[-1]);
+    //
+    // Load the final 8 bytes as a big-endian integer.  load_big_u64 reads
+    // through unaligned byte storage (via memcpy) and applies the endian
+    // conversion, avoiding the alignment/strict-aliasing UB of casting the
+    // unsigned char* returned by end() to a std::uint64_t*.
+    return boost::endian::load_big_u64(uBase.end() - 8);
 }
 
 uint256
@@ -278,8 +283,11 @@ quality(Keylet const& k, std::uint64_t q) noexcept
     // for indexes.
     uint256 x = k.key;
 
-    // FIXME This is ugly and we can and should do better...
-    ((std::uint64_t*)x.end())[-1] = boost::endian::native_to_big(q);
+    // Store the quality as a big-endian integer in the final 8 bytes.
+    // store_big_u64 writes through unaligned byte storage (via memcpy) and
+    // applies the endian conversion, avoiding the alignment/strict-aliasing UB
+    // of casting the unsigned char* returned by end() to a std::uint64_t*.
+    boost::endian::store_big_u64(x.end() - 8, q);
 
     return {ltDIR_NODE, x};
 }
diff --git a/src/libxrpl/protocol/SOTemplate.cpp b/src/libxrpl/protocol/SOTemplate.cpp
index 708fd465e2..171f96e1ed 100644
--- a/src/libxrpl/protocol/SOTemplate.cpp
+++ b/src/libxrpl/protocol/SOTemplate.cpp
@@ -21,11 +21,12 @@ SOTemplate::SOTemplate(
 }
 
 SOTemplate::SOTemplate(std::vector<SOElement> uniqueFields, std::vector<SOElement> commonFields)
-    : indices_(SField::getNumFields() + 1, -1)  // Unmapped indices == -1
+    : elements_(std::move(uniqueFields))
+    , indices_(SField::getNumFields() + 1, -1)  // Unmapped indices == -1
 {
     // Add all SOElements.
     //
-    elements_ = std::move(uniqueFields);
+
     std::ranges::move(commonFields, std::back_inserter(elements_));
 
     // Validate and index elements_.
diff --git a/src/libxrpl/protocol/STTx.cpp b/src/libxrpl/protocol/STTx.cpp
index 9f3c6738ae..8438d3498b 100644
--- a/src/libxrpl/protocol/STTx.cpp
+++ b/src/libxrpl/protocol/STTx.cpp
@@ -66,9 +66,9 @@ getTxFormat(TxType type)
     return format;
 }
 
-STTx::STTx(STObject&& object) : STObject(std::move(object))
+STTx::STTx(STObject&& object)
+    : STObject(std::move(object)), txType_(safeCast<TxType>(getFieldU16(sfTransactionType)))
 {
-    txType_ = safeCast<TxType>(getFieldU16(sfTransactionType));
     applyTemplate(getTxFormat(txType_)->getSOTemplate());  //  may throw
     tid_ = getHash(HashPrefix::TransactionId);
     buildBatchTxnIds();
@@ -100,6 +100,9 @@ STTx::STTx(TxType type, std::function<void(STObject&)> assembler) : STObject(sfT
 
     assembler(*this);
 
+    // txType_ must be read after the object is assembled, so this cannot be a
+    // member initializer.
+    // NOLINTNEXTLINE(cppcoreguidelines-prefer-member-initializer)
     txType_ = safeCast<TxType>(getFieldU16(sfTransactionType));
 
     if (txType_ != type)
diff --git a/src/libxrpl/protocol/Serializer.cpp b/src/libxrpl/protocol/Serializer.cpp
index 1eda04705f..80ecdee6c8 100644
--- a/src/libxrpl/protocol/Serializer.cpp
+++ b/src/libxrpl/protocol/Serializer.cpp
@@ -99,7 +99,7 @@ int
 Serializer::addRaw(void const* ptr, int len)
 {
     int const ret = data_.size();
-    data_.insert(data_.end(), (char const*)ptr, ((char const*)ptr) + len);
+    data_.insert(data_.end(), static_cast<char const*>(ptr), static_cast<char const*>(ptr) + len);
     return ret;
 }
 
diff --git a/src/libxrpl/protocol/TxMeta.cpp b/src/libxrpl/protocol/TxMeta.cpp
index 0373706e84..b743598a76 100644
--- a/src/libxrpl/protocol/TxMeta.cpp
+++ b/src/libxrpl/protocol/TxMeta.cpp
@@ -23,16 +23,16 @@
 namespace xrpl {
 
 TxMeta::TxMeta(uint256 const& txid, std::uint32_t ledger, STObject const& obj)
-    : transactionID_(txid), ledgerSeq_(ledger), nodes_(obj.getFieldArray(sfAffectedNodes))
+    : transactionID_(txid)
+    , ledgerSeq_(ledger)
+    , index_(obj.getFieldU32(sfTransactionIndex))
+    , result_(obj.getFieldU8(sfTransactionResult))
+    , nodes_([&obj] {
+        auto const affectedNodes = dynamic_cast<STArray const*>(obj.peekAtPField(sfAffectedNodes));
+        XRPL_ASSERT(affectedNodes, "xrpl::TxMeta::TxMeta(STObject) : type cast succeeded");
+        return affectedNodes != nullptr ? *affectedNodes : obj.getFieldArray(sfAffectedNodes);
+    }())
 {
-    result_ = obj.getFieldU8(sfTransactionResult);
-    index_ = obj.getFieldU32(sfTransactionIndex);
-
-    auto affectedNodes = dynamic_cast<STArray const*>(obj.peekAtPField(sfAffectedNodes));
-    XRPL_ASSERT(affectedNodes, "xrpl::TxMeta::TxMeta(STObject) : type cast succeeded");
-    if (affectedNodes != nullptr)
-        nodes_ = *affectedNodes;
-
     setAdditionalFields(obj);
 }
 
diff --git a/src/libxrpl/shamap/SHAMap.cpp b/src/libxrpl/shamap/SHAMap.cpp
index 8a521f6a47..0df0430a5f 100644
--- a/src/libxrpl/shamap/SHAMap.cpp
+++ b/src/libxrpl/shamap/SHAMap.cpp
@@ -838,6 +838,7 @@ SHAMap::getHash() const
     auto hash = root_->getHash();
     if (hash.isZero())
     {
+        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
         const_cast<SHAMap&>(*this).unshare();
         hash = root_->getHash();
     }
diff --git a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
index 9092ae4140..f3ea97a341 100644
--- a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
+++ b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
@@ -1157,7 +1157,11 @@ toClaim(STTx const& tx)
 
     try
     {
-        STObject o{tx};
+        // Copy just the field bag out of the transaction (explicitly, via the
+        // STObject base) so it can be reinterpreted as a cross-chain attestation
+        // below, with sfAccount replaced by sfOtherChainSource. STTx-specific
+        // state (txType_, tid_) is intentionally not needed here.
+        STObject o{static_cast<STObject const&>(tx)};
         o.setAccountID(sfAccount, o[sfOtherChainSource]);
         return TAttestation(o);
     }
diff --git a/src/test/app/PayStrand_test.cpp b/src/test/app/PayStrand_test.cpp
index ddbcfe8b70..967f84f275 100644
--- a/src/test/app/PayStrand_test.cpp
+++ b/src/test/app/PayStrand_test.cpp
@@ -40,7 +40,6 @@
 #include <cassert>
 #include <cstddef>
 #include <cstdint>
-#include <cstdio>
 #include <initializer_list>
 #include <optional>
 #include <stdexcept>
@@ -309,31 +308,26 @@ struct ExistingElementPool
         currencyNames.clear();
         currencyNames.reserve(numCur);
 
-        static constexpr size_t kBufSize = 32;
-        char buf[kBufSize];
-
         for (size_t id = 0; id < numAct; ++id)
-        {
-            snprintf(buf, kBufSize, "A%zu", id);
-            accounts.emplace_back(buf);
-        }
+            accounts.emplace_back("A" + std::to_string(id));
 
         for (size_t id = 0; id < numCur; ++id)
         {
+            std::string name;
             if (id < 10)
             {
-                snprintf(buf, kBufSize, "CC%zu", id);
+                name = "CC" + std::to_string(id);
             }
             else if (id < 100)
             {
-                snprintf(buf, kBufSize, "C%zu", id);
+                name = "C" + std::to_string(id);
             }
             else
             {
-                snprintf(buf, kBufSize, "%zu", id);
+                name = std::to_string(id);
             }
-            currencies.emplace_back(toCurrency(buf));
-            currencyNames.emplace_back(buf);
+            currencies.emplace_back(toCurrency(name));
+            currencyNames.emplace_back(name);
         }
 
         for (auto const& a : accounts)
diff --git a/src/test/app/XChain_test.cpp b/src/test/app/XChain_test.cpp
index 437c329e02..6c8377d8e3 100644
--- a/src/test/app/XChain_test.cpp
+++ b/src/test/app/XChain_test.cpp
@@ -245,9 +245,9 @@ struct Balance
     T& env;
     STAmount startAmount;
 
-    Balance(T& env, jtx::Account const& account) : account(account), env(env)
+    Balance(T& env, jtx::Account const& account)
+        : account(account), env(env), startAmount(env.balance(account))
     {
-        startAmount = env.balance(account);
     }
 
     [[nodiscard]] STAmount
diff --git a/src/test/csf/random.h b/src/test/csf/random.h
index 9fc51f1217..aa20c73a10 100644
--- a/src/test/csf/random.h
+++ b/src/test/csf/random.h
@@ -135,9 +135,8 @@ class PowerLawDistribution
 public:
     using result_type = double;
 
-    PowerLawDistribution(double xmin, double a) : xmin_{xmin}, a_{a}
+    PowerLawDistribution(double xmin, double a) : xmin_{xmin}, a_{a}, inv_(1.0 / (1.0 - a_))
     {
-        inv_ = 1.0 / (1.0 - a_);
     }
 
     template <class Generator>
diff --git a/src/test/overlay/reduce_relay_test.cpp b/src/test/overlay/reduce_relay_test.cpp
index 1c9bf1f9c1..433595522d 100644
--- a/src/test/overlay/reduce_relay_test.cpp
+++ b/src/test/overlay/reduce_relay_test.cpp
@@ -323,12 +323,11 @@ class Validator
     using Links = std::unordered_map<Peer::id_t, LinkSPtr>;
 
 public:
-    Validator() : pkey_(std::get<0>(randomKeyPair(KeyType::Ed25519)))
+    Validator() : pkey_(std::get<0>(randomKeyPair(KeyType::Ed25519))), id_(sid++)
     {
         protocol::TMValidation v;
         v.set_validation("validation");
         message_ = std::make_shared<Message>(v, protocol::mtVALIDATION, pkey_);
-        id_ = sid++;
     }
     Validator(Validator const&) = default;
     Validator(Validator&&) = default;
@@ -457,7 +456,6 @@ public:
     using id_t = Peer::id_t;
     PeerSim(Overlay& overlay, beast::Journal journal) : overlay_(overlay), squelch_(journal)
     {
-        id_ = sid++;
     }
 
     ~PeerSim() override = default;
@@ -512,7 +510,7 @@ public:
 private:
     inline static id_t sid = 0;
     std::string fingerprint_;
-    id_t id_;
+    id_t id_{sid++};
     Overlay& overlay_;
     reduce_relay::Squelch<ManualClock> squelch_;
 };
diff --git a/src/test/protocol/STTx_test.cpp b/src/test/protocol/STTx_test.cpp
index 21518d1406..45bd2729c4 100644
--- a/src/test/protocol/STTx_test.cpp
+++ b/src/test/protocol/STTx_test.cpp
@@ -1366,6 +1366,7 @@ public:
         {
             fail("Unable to build object from json");
         }
+        // NOLINTNEXTLINE(cppcoreguidelines-slicing)
         else if (STObject(j) != parsed.object)
         {
             log << "ORIG: " << j.getJson(JsonOptions::Values::None) << '\n'
diff --git a/src/tests/libxrpl/helpers/TxTest.cpp b/src/tests/libxrpl/helpers/TxTest.cpp
index 86e36b8abf..4b4f407eeb 100644
--- a/src/tests/libxrpl/helpers/TxTest.cpp
+++ b/src/tests/libxrpl/helpers/TxTest.cpp
@@ -80,7 +80,9 @@ TxTest::TxTest(std::optional<FeatureBitset> features)
         std::vector<uint256>{featureSet_.begin(), featureSet_.end()},
         registry_.getNodeFamily());
 
-    // Initialize time from the genesis ledger
+    // Initialize time from the genesis ledger.  closedLedger_ is created above
+    // in the body, so this cannot be a member initializer.
+    // NOLINTNEXTLINE(cppcoreguidelines-prefer-member-initializer)
     now_ = closedLedger_->header().closeTime;
 
     // Create an open view on top of the genesis ledger
diff --git a/src/xrpld/app/misc/detail/AmendmentTable.cpp b/src/xrpld/app/misc/detail/AmendmentTable.cpp
index 4f331b0781..694268752e 100644
--- a/src/xrpld/app/misc/detail/AmendmentTable.cpp
+++ b/src/xrpld/app/misc/detail/AmendmentTable.cpp
@@ -643,6 +643,7 @@ AmendmentState*
 AmendmentTableImpl::get(uint256 const& amendmentHash, std::scoped_lock<std::mutex> const& lock)
 {
     // Forward to the const version of get.
+    // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
     return const_cast<AmendmentState*>(std::as_const(*this).get(amendmentHash, lock));
 }
 

From 2ebc96a4a67e88399a14310fc371198d55793088 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:02:39 +0100
Subject: [PATCH 053/100] perf: Use std::from/to_chars for JSON double
 parsing/formating (#7735)

---
 src/libxrpl/json/json_reader.cpp | 42 ++++++++------------------
 src/libxrpl/json/json_writer.cpp | 27 ++++++++---------
 src/tests/libxrpl/json/Value.cpp | 52 ++++++++++++++++++++++++++++++++
 3 files changed, 77 insertions(+), 44 deletions(-)

diff --git a/src/libxrpl/json/json_reader.cpp b/src/libxrpl/json/json_reader.cpp
index f37cca506b..f9134e6629 100644
--- a/src/libxrpl/json/json_reader.cpp
+++ b/src/libxrpl/json/json_reader.cpp
@@ -5,12 +5,13 @@
 
 #include <algorithm>
 #include <cctype>
+#include <charconv>
 #include <cstdint>
 #include <cstdio>
-#include <cstring>
 #include <istream>
 #include <stdexcept>
 #include <string>
+#include <system_error>
 
 namespace json {
 // Implementation of class Reader
@@ -605,36 +606,17 @@ bool
 Reader::decodeDouble(Token& token)
 {
     double value = 0;
-    int const bufferSize = 32;
-    int count = 0;
-    int const length = int(token.end - token.start);
-    // Sanity check to avoid buffer overflow exploits.
-    if (length < 0)
-    {
-        return addError("Unable to parse token length", token);
-    }
-    // Avoid using a string constant for the format control string given to
-    // sscanf, as this can cause hard to debug crashes on OS X. See here for
-    // more info:
-    //
-    // http://developer.apple.com/library/mac/#DOCUMENTATION/DeveloperTools/gcc-4.0.1/gcc/Incompatibilities.html
-    char format[] = "%lf";
-    if (length <= bufferSize)
-    {
-        Char buffer[bufferSize + 1];
-        memcpy(buffer, token.start, length);
-        buffer[length] = 0;
-        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-vararg)
-        count = sscanf(buffer, format, &value);
-    }
-    else
-    {
-        std::string const buffer(token.start, token.end);
-        // NOLINTNEXTLINE(cppcoreguidelines-pro-type-vararg)
-        count = sscanf(buffer.c_str(), format, &value);
-    }
-    if (count != 1)
+    auto const [ptr, ec] = std::from_chars(token.start, token.end, value);
+
+    // Reject anything from_chars could not turn into a finite double:
+    //   - ec != std::errc{}: no valid conversion, or an out-of-range magnitude
+    //     (e.g. 1e400).
+    //   - ptr != token.end: readNumber() is permissive about which characters
+    //     it collects into a token (it will, for example, keep a '+' mid-token),
+    //     but from_chars() will stop at the first character it cannot parse.
+    if (ec != std::errc{} || ptr != token.end)
         return addError("'" + std::string(token.start, token.end) + "' is not a number.", token);
+
     currentValue() = value;
     return true;
 }
diff --git a/src/libxrpl/json/json_writer.cpp b/src/libxrpl/json/json_writer.cpp
index 853dd9a5ac..fdfa5d3cf0 100644
--- a/src/libxrpl/json/json_writer.cpp
+++ b/src/libxrpl/json/json_writer.cpp
@@ -4,13 +4,14 @@
 #include <xrpl/json/json_forwards.h>
 #include <xrpl/json/json_value.h>
 
-#include <cstdio>
+#include <charconv>
 #include <cstring>
 #include <iomanip>
 #include <ios>
 #include <ostream>
 #include <sstream>
 #include <string>
+#include <system_error>
 #include <utility>
 
 namespace json {
@@ -76,20 +77,18 @@ valueToString(UInt value)
 std::string
 valueToString(double value)
 {
-    // Allocate a buffer that is more than large enough to store the 16 digits
-    // of precision requested below.
+    // Format with 16 significant digits.
+    // We need not request the alternative representation that always has a
+    // decimal point because JSON doesn't distinguish the concepts of reals and integers.
+    // A double never needs more than 32 characters in this form,
+    // so to_chars cannot actually run out of room here.
     char buffer[32];
-    // Print into the buffer. We need not request the alternative representation
-    // that always has a decimal point because JSON doesn't distinguish the
-    // concepts of reals and integers.
-#if defined(_MSC_VER) && defined(__STDC_SECURE_LIB__)  // Use secure version with visual studio 2005
-                                                       // to avoid warning.
-    sprintf_s(buffer, sizeof(buffer), "%.16g", value);
-#else
-    // NOLINTNEXTLINE(cppcoreguidelines-pro-type-vararg)
-    snprintf(buffer, sizeof(buffer), "%.16g", value);
-#endif
-    return buffer;
+    auto const [ptr, ec] =
+        std::to_chars(buffer, buffer + sizeof(buffer), value, std::chars_format::general, 16);
+    XRPL_ASSERT(ec == std::errc{}, "json::valueToString(double) : conversion fits buffer");
+    if (ec != std::errc{})
+        return {};
+    return std::string(buffer, ptr);
 }
 
 std::string
diff --git a/src/tests/libxrpl/json/Value.cpp b/src/tests/libxrpl/json/Value.cpp
index a1cd8160d7..a58a5df9fd 100644
--- a/src/tests/libxrpl/json/Value.cpp
+++ b/src/tests/libxrpl/json/Value.cpp
@@ -13,6 +13,7 @@
 #include <exception>
 #include <limits>
 #include <numbers>
+#include <optional>
 #include <regex>
 #include <sstream>
 #include <string>
@@ -592,6 +593,57 @@ TEST(json_value, bad_json)
     EXPECT_TRUE(r.parse(s, j));
 }
 
+namespace {
+
+std::optional<json::Value>
+parseValue(std::string const& doc)
+{
+    json::Value j;
+    json::Reader r;
+    if (!r.parse("{\"v\":" + doc + "}", j))
+        return std::nullopt;
+    return j["v"];
+}
+
+}  // namespace
+
+TEST(json_value, parse_double_valid)
+{
+    // 1e300 is large but still representable, so it parses (unlike the out-of-range cases below).
+    for (auto const& [text, expected] :
+         {std::pair{"2.5", 2.5},
+          std::pair{"-3.25e2", -325.0},
+          std::pair{"0.0", 0.0},
+          std::pair{"1E3", 1000.0},
+          std::pair{"-0.5e-1", -0.05},
+          std::pair{"1e300", 1e300}})
+    {
+        auto const v = parseValue(text);
+        ASSERT_TRUE(v.has_value()) << text;
+        // NOLINTBEGIN(bugprone-unchecked-optional-access)
+        EXPECT_TRUE(v->isDouble()) << text;
+        EXPECT_EQ(v->asDouble(), expected) << text;
+        // NOLINTEND(bugprone-unchecked-optional-access)
+    }
+}
+
+TEST(json_value, parse_double_out_of_range)
+{
+    // Magnitudes with no finite double representation are rejected.
+    for (char const* oor : {"1e400", "-1e400", "0.001e500", "1e-400", "-1e-400", "123e-500"})
+        EXPECT_FALSE(parseValue(oor).has_value()) << oor;
+}
+
+TEST(json_value, parse_double_malformed)
+{
+    // readNumber() collects any run of digits and '.eE+-' into a single Double
+    // token, so these malformed tokens reach decodeDouble. Each has a valid
+    // leading prefix that from_chars would accept on its own; requiring the
+    // entire token be consumed rejects them instead of silently truncating.
+    for (char const* bad : {"1+2", "1-2", "1.2.3", "1e5e6", "1..2", "++5", "1e", "1e+", ".", "-"})
+        EXPECT_FALSE(parseValue(bad).has_value()) << bad;
+}
+
 TEST(json_value, edge_cases)
 {
     std::uint32_t const maxUInt = std::numeric_limits<std::uint32_t>::max();

From e372c4583642ad42b7c4b3abac396a68c9918177 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:03:56 +0100
Subject: [PATCH 054/100] chore: Enable most performance checks (#7727)

---
 .clang-tidy                                  |  6 ------
 include/xrpl/basics/IntrusivePointer.ipp     |  3 +++
 include/xrpl/shamap/detail/TaggedPointer.ipp |  6 ++++++
 src/libxrpl/protocol/STParsedJSON.cpp        | 21 +++++++++++++++-----
 src/libxrpl/rdb/SociDB.cpp                   |  6 ++++++
 src/test/core/Config_test.cpp                |  1 +
 6 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index c13ca78ac2..88dd6f4e57 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -50,13 +50,7 @@ Checks: "-*,
   performance-*,
   -performance-avoid-endl,
   -performance-enum-size,
-  -performance-inefficient-algorithm,
-  -performance-inefficient-string-concatenation,
-  -performance-no-int-to-ptr,
-  -performance-noexcept-destructor,
   -performance-noexcept-move-constructor,
-  -performance-noexcept-swap,
-  -performance-type-promotion-in-math-fn,
   -performance-unnecessary-copy-initialization,
   -performance-unnecessary-value-param,
 
diff --git a/include/xrpl/basics/IntrusivePointer.ipp b/include/xrpl/basics/IntrusivePointer.ipp
index 8344a3e613..67d43b05d6 100644
--- a/include/xrpl/basics/IntrusivePointer.ipp
+++ b/include/xrpl/basics/IntrusivePointer.ipp
@@ -641,6 +641,9 @@ template <class T>
 T*
 SharedWeakUnion<T>::unsafeGetRawPtr() const
 {
+    // tp_ packs a raw pointer together with a strength bit; recovering the
+    // pointer inherently requires an integer-to-pointer cast.
+    // NOLINTNEXTLINE(performance-no-int-to-ptr)
     return reinterpret_cast<T*>(tp_ & kPtrMask);
 }
 
diff --git a/include/xrpl/shamap/detail/TaggedPointer.ipp b/include/xrpl/shamap/detail/TaggedPointer.ipp
index 6606c49a6b..9275f3d15a 100644
--- a/include/xrpl/shamap/detail/TaggedPointer.ipp
+++ b/include/xrpl/shamap/detail/TaggedPointer.ipp
@@ -507,6 +507,9 @@ TaggedPointer::operator=(TaggedPointer&& other)
 [[nodiscard]] inline std::pair<std::uint8_t, void*>
 TaggedPointer::decode() const
 {
+    // tp_ packs a raw pointer together with the tag bits; recovering the
+    // pointer inherently requires an integer-to-pointer cast.
+    // NOLINTNEXTLINE(performance-no-int-to-ptr)
     return {tp_ & kTagMask, reinterpret_cast<void*>(tp_ & kPtrMask)};
 }
 
@@ -535,6 +538,9 @@ TaggedPointer::getHashesAndChildren() const
 [[nodiscard]] inline SHAMapHash*
 TaggedPointer::getHashes() const
 {
+    // tp_ packs a raw pointer together with the tag bits; recovering the
+    // pointer inherently requires an integer-to-pointer cast.
+    // NOLINTNEXTLINE(performance-no-int-to-ptr)
     return reinterpret_cast<SHAMapHash*>(tp_ & kPtrMask);
 };
 
diff --git a/src/libxrpl/protocol/STParsedJSON.cpp b/src/libxrpl/protocol/STParsedJSON.cpp
index d3342ef728..33ca5424d1 100644
--- a/src/libxrpl/protocol/STParsedJSON.cpp
+++ b/src/libxrpl/protocol/STParsedJSON.cpp
@@ -69,6 +69,17 @@ toUnsigned(U2 value)
     return static_cast<U1>(value);
 }
 
+static std::string
+joinName(std::string const& jsonName, std::string const& fieldName)
+{
+    std::string result;
+    result.reserve(jsonName.size() + 1 + fieldName.size());
+    result += jsonName;
+    result += '.';
+    result += fieldName;
+    return result;
+}
+
 // LCOV_EXCL_START
 static inline std::string
 makeName(std::string const& object, std::string const& field)
@@ -76,7 +87,7 @@ makeName(std::string const& object, std::string const& field)
     if (field.empty())
         return object;
 
-    return object + "." + field;
+    return joinName(object, field);
 }
 
 static inline json::Value
@@ -1036,8 +1047,8 @@ parseObject(
 
                     try
                     {
-                        auto ret =
-                            parseObject(jsonName + "." + fieldName, value, field, depth + 1, error);
+                        auto ret = parseObject(
+                            joinName(jsonName, fieldName), value, field, depth + 1, error);
                         if (!ret)
                             return std::nullopt;
                         data.emplaceBack(std::move(*ret));
@@ -1054,8 +1065,8 @@ parseObject(
                 case STI_ARRAY:
                     try
                     {
-                        auto array =
-                            parseArray(jsonName + "." + fieldName, value, field, depth + 1, error);
+                        auto array = parseArray(
+                            joinName(jsonName, fieldName), value, field, depth + 1, error);
                         if (!array.has_value())
                             return std::nullopt;
                         data.emplaceBack(std::move(*array));
diff --git a/src/libxrpl/rdb/SociDB.cpp b/src/libxrpl/rdb/SociDB.cpp
index 06e58d373f..08c826b210 100644
--- a/src/libxrpl/rdb/SociDB.cpp
+++ b/src/libxrpl/rdb/SociDB.cpp
@@ -213,6 +213,12 @@ public:
         if (auto [conn, keepAlive] = getConnection(); conn)
         {
             (void)keepAlive;
+            // The checkpointer is identified to the C callback by an integer id
+            // (resolved via checkpointerFromId) rather than a raw `this`, so it
+            // cannot dangle if the checkpointer is destroyed. Passing the id
+            // through sqlite's void* user-data requires an integer-to-pointer
+            // cast.
+            // NOLINTNEXTLINE(performance-no-int-to-ptr)
             sqlite_api::sqlite3_wal_hook(conn, &sqliteWALHook, reinterpret_cast<void*>(id_));
         }
     }
diff --git a/src/test/core/Config_test.cpp b/src/test/core/Config_test.cpp
index 38c14b8ac5..17c48b1ccc 100644
--- a/src/test/core/Config_test.cpp
+++ b/src/test/core/Config_test.cpp
@@ -1475,6 +1475,7 @@ r.ripple.com:51235
             std::string toLoad(R"xrpldConfig(
 [amendment_majority_time]
 )xrpldConfig");
+            // NOLINTNEXTLINE(performance-inefficient-string-concatenation)
             toLoad += std::to_string(val) + space + unit;
             space = space.empty() ? " " : "";
 

From 58af1e6f188549074e5cd82c38d06bcf7e8d334d Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:40:24 +0100
Subject: [PATCH 055/100] release: Bump version to 3.3.0-b1 (#7755)

---
 src/libxrpl/protocol/BuildInfo.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libxrpl/protocol/BuildInfo.cpp b/src/libxrpl/protocol/BuildInfo.cpp
index 820936a22d..793ddb18d2 100644
--- a/src/libxrpl/protocol/BuildInfo.cpp
+++ b/src/libxrpl/protocol/BuildInfo.cpp
@@ -23,7 +23,7 @@ namespace {
 //------------------------------------------------------------------------------
 // clang-format off
 // NOLINTNEXTLINE(readability-identifier-naming)
-char const* const versionString = "3.3.0-b0"
+char const* const versionString = "3.3.0-b1"
     // clang-format on
     ;
 

From 71ee0f400b5d712ca121a639c859d18847098859 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 8 Jul 2026 15:51:39 +0100
Subject: [PATCH 056/100] chore: Use same compiler in Nix devshell as in CI
 (#7751)

---
 docs/build/environment.md |  15 ++--
 docs/build/nix.md         |  30 ++++----
 nix/ci-env.nix            |  18 +++--
 nix/devshell.nix          | 150 ++++++++++----------------------------
 nix/packages.nix          |  21 +++++-
 5 files changed, 93 insertions(+), 141 deletions(-)

diff --git a/docs/build/environment.md b/docs/build/environment.md
index 2cca608567..e639ed2d5f 100644
--- a/docs/build/environment.md
+++ b/docs/build/environment.md
@@ -33,9 +33,10 @@ with a single command and without installing anything system-wide:
 nix --experimental-features 'nix-command flakes' develop
 ```
 
-On **Linux**, Nix also provides the compiler (GCC). On **macOS**, the shell uses
-your **system-wide Apple Clang** as the compiler, so you still need to manage
-its version (see below).
+On **Linux**, Nix also provides the compiler (GCC); on **macOS**, it provides
+Clang. If you instead opt to use your system-wide Apple Clang (via
+`nix develop .#apple-clang`), you need to manage its version yourself (see
+below).
 
 See [Using the Nix development shell](./nix.md) for installation and usage
 details, including how to select a different compiler.
@@ -48,10 +49,10 @@ details, including how to select a different compiler.
 
 ### macOS: managing the Apple Clang version
 
-Because the Nix shell uses the system-wide Apple Clang on macOS, the compiler
-version is whatever your installed Xcode (or Command Line Tools) provides. The
-following command should return a version greater than or equal to the
-[minimum required](#tested-compiler-versions):
+If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
+the compiler version is whatever your installed Xcode (or Command Line Tools)
+provides. The following command should return a version greater than or equal to
+the [minimum required](#tested-compiler-versions):
 
 ```bash
 clang --version
diff --git a/docs/build/nix.md b/docs/build/nix.md
index 2ae483aefe..32592e037a 100644
--- a/docs/build/nix.md
+++ b/docs/build/nix.md
@@ -9,7 +9,7 @@ This guide explains how to use Nix to set up a reproducible development environm
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
 - **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
-- **Multiple compiler versions**: Easily switch between different GCC and Clang versions
+- **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
 - **Works on Linux and macOS**: Consistent experience across platforms
 
@@ -31,8 +31,8 @@ This will:
 
 - Download and set up all required development tools (CMake, Ninja, Conan, etc.)
 - Configure the appropriate compiler for your platform:
-  - **Linux**: GCC 15.2 (provided by Nix)
-  - **macOS**: Apple Clang (your system compiler)
+  - **Linux**: GCC (provided by Nix)
+  - **macOS**: Clang (provided by Nix)
 
 The first time you run this command, it will take a few minutes to download and build the environment. Subsequent runs will be much faster.
 
@@ -40,12 +40,12 @@ The first time you run this command, it will take a few minutes to download and
 
 - **Linux**: `nix develop` gives you a shell with all the tooling necessary to
   develop xrpld and with GCC 15.2 (also provided by Nix). There are no caveats.
-- **macOS**: `nix develop` gives you a full environment too. The compiler is
-  your system-wide Apple Clang, while every other tool — including Conan — is
-  provided by Nix. Conan has no binary in the Nix cache for macOS, so it is
-  built from source the first time you enter the shell, which makes the initial
-  setup slower (this is handled automatically; see
-  [`nix/devshell.nix`](../../nix/devshell.nix)).
+- **macOS**: `nix develop` gives you a full environment too, with Clang (and
+  every other tool, including Conan) provided by Nix. To use your system-wide
+  Apple Clang instead, enter `nix develop .#apple-clang`. Conan has no binary in
+  the Nix cache for macOS, so it is built from source the first time you enter
+  the shell, which makes the initial setup slower (this is handled
+  automatically; see [`nix/devshell.nix`](../../nix/devshell.nix)).
 
 > [!TIP]
 > To avoid typing `--experimental-features 'nix-command flakes'` every time, you can permanently enable flakes by creating `~/.config/nix/nix.conf`:
@@ -62,7 +62,9 @@ The first time you run this command, it will take a few minutes to download and
 
 ### Choosing a different compiler
 
-A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix develop .#gcc15`.
+A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix develop .#clang`.
+The `.#gcc` and `.#clang` shells provide the same GCC and Clang versions used in CI
+(pinned in [`nix/packages.nix`](../../nix/packages.nix)).
 Use `nix flake show` to see all the available development shells.
 
 Use `nix develop .#no-compiler` to use the compiler from your system.
@@ -70,11 +72,11 @@ Use `nix develop .#no-compiler` to use the compiler from your system.
 ### Example Usage
 
 ```bash
-# Use GCC 14
-nix develop .#gcc14
+# Use GCC (same version as CI)
+nix develop .#gcc
 
-# Use Clang 19
-nix develop .#clang19
+# Use Clang (same version as CI)
+nix develop .#clang
 
 # Use default for your platform
 nix develop
diff --git a/nix/ci-env.nix b/nix/ci-env.nix
index f823f71de0..9b754af97d 100644
--- a/nix/ci-env.nix
+++ b/nix/ci-env.nix
@@ -4,14 +4,16 @@
   ...
 }:
 let
-  inherit (import ./packages.nix { inherit pkgs; }) commonPackages;
-  inherit (pkgs) lib;
+  inherit (import ./packages.nix { inherit pkgs; })
+    commonPackages
+    gccPackage
+    llvmPackages
+    llvmVersion
+    ;
 
-  # Underlying compiler toolchains to wrap. Bump these in one place to
-  # roll the whole environment forward.
-  customGccPackage = pkgs.gcc15;
-  customLlvmPackages = pkgs.llvmPackages_22;
-  customClangMajor = lib.versions.major (lib.getVersion customLlvmPackages.clang-unwrapped);
+  # Underlying compiler toolchains to wrap (versions pinned in packages.nix).
+  customGccPackage = gccPackage;
+  customLlvmPackages = llvmPackages;
 
   # binutils wrapped to emit binaries that reference the custom glibc
   # (dynamic linker path, library search path, RPATH).
@@ -90,7 +92,7 @@ let
     extraBuildCommands = ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
-      ln -s "${customLlvmPackages.clang-unwrapped.lib}/lib/clang/${customClangMajor}/include" "$rsrc/include"
+      ln -s "${customLlvmPackages.clang-unwrapped.lib}/lib/clang/${toString llvmVersion}/include" "$rsrc/include"
       ln -s "${customCompilerRt.out}/lib" "$rsrc/lib"
       ln -s "${customCompilerRt.out}/share" "$rsrc/share" || true
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
diff --git a/nix/devshell.nix b/nix/devshell.nix
index 1bd7ea4c0c..34f173ef08 100644
--- a/nix/devshell.nix
+++ b/nix/devshell.nix
@@ -1,127 +1,57 @@
 { pkgs, ... }:
 let
-  inherit (import ./packages.nix { inherit pkgs; }) commonPackages;
+  inherit (import ./packages.nix { inherit pkgs; })
+    commonPackages
+    gccVersion
+    llvmPackages
+    ;
 
-  # Supported compiler versions
-  gccVersion = pkgs.lib.range 13 15;
-  clangVersions = pkgs.lib.range 18 21;
+  # Plain nixpkgs stdenvs — no custom glibc, unlike ci-env.nix.
+  gccStdenv = pkgs."gcc${toString gccVersion}Stdenv";
+  clangStdenv = llvmPackages.stdenv;
 
-  defaultCompiler = if pkgs.stdenv.isDarwin then "apple-clang" else "gcc";
-  defaultGccVersion = pkgs.lib.last gccVersion;
-  defaultClangVersion = pkgs.lib.last clangVersions;
-
-  strToCompilerEnv =
-    compiler: version:
-    (
-      if compiler == "gcc" then
-        let
-          gccPkg = pkgs."gcc${toString version}Stdenv" or null;
-        in
-        if gccPkg != null && builtins.elem version gccVersion then
-          gccPkg
-        else
-          throw "Invalid GCC version: ${toString version}. Must be one of: ${toString gccVersion}"
-      else if compiler == "clang" then
-        let
-          clangPkg = pkgs."llvmPackages_${toString version}".stdenv or null;
-        in
-        if clangPkg != null && builtins.elem version clangVersions then
-          clangPkg
-        else
-          throw "Invalid Clang version: ${toString version}. Must be one of: ${toString clangVersions}"
-      else if compiler == "apple-clang" || compiler == "none" then
-        pkgs.stdenvNoCC
-      else
-        throw "Invalid compiler: ${compiler}. Must be one of: gcc, clang, apple-clang, none"
-    );
-
-  # Helper function to create a shell with a specific compiler
+  # compilerName is the command used to print the version, or null for none.
   makeShell =
     {
-      compiler ? defaultCompiler,
-      version ? (
-        if compiler == "gcc" then
-          defaultGccVersion
-        else if compiler == "clang" then
-          defaultClangVersion
-        else
-          null
-      ),
+      stdenv,
+      compilerName,
     }:
     let
-      compilerStdEnv = strToCompilerEnv compiler version;
-
-      compilerName =
-        if compiler == "apple-clang" then
-          "clang"
-        else if compiler == "none" then
-          null
-        else
-          compiler;
-
-      gccOnMacWarning =
-        if pkgs.stdenv.isDarwin && compiler == "gcc" then
-          ''
-            echo "WARNING: Using GCC on macOS with Conan may not work."
-            echo "         Consider using 'nix develop .#clang' or the default shell instead."
-            echo ""
-          ''
-        else
-          "";
-
       compilerVersion =
-        if compilerName != null then
+        if compilerName == null then
+          ''echo "No compiler specified - using system compiler"''
+        else
           ''
             echo "Compiler: "
             ${compilerName} --version
-          ''
-        else
-          ''
-            echo "No compiler specified - using system compiler"
           '';
-
-      shellAttrs = {
-        packages = commonPackages;
-
-        shellHook = ''
-          echo "Welcome to xrpld development shell";
-          ${gccOnMacWarning}${compilerVersion}
-        '';
-      };
     in
-    pkgs.mkShell.override { stdenv = compilerStdEnv; } shellAttrs;
-
-  # Generate shells for each compiler version
-  gccShells = builtins.listToAttrs (
-    map (version: {
-      name = "gcc${toString version}";
-      value = makeShell {
-        compiler = "gcc";
-        version = version;
-      };
-    }) gccVersion
-  );
-
-  clangShells = builtins.listToAttrs (
-    map (version: {
-      name = "clang${toString version}";
-      value = makeShell {
-        compiler = "clang";
-        version = version;
-      };
-    }) clangVersions
-  );
-
+    (pkgs.mkShell.override { inherit stdenv; }) {
+      packages = commonPackages;
+      shellHook = ''
+        echo "Welcome to xrpld development shell";
+        ${compilerVersion}
+      '';
+    };
 in
-gccShells
-// clangShells
-// {
-  # Default shells
-  default = makeShell { };
-  gcc = makeShell { compiler = "gcc"; };
-  clang = makeShell { compiler = "clang"; };
+rec {
+  # macOS: Nix Clang. Linux: Nix GCC.
+  default = if pkgs.stdenv.isDarwin then clang else gcc;
 
-  # No compiler
-  no-compiler = makeShell { compiler = "none"; };
-  apple-clang = makeShell { compiler = "apple-clang"; };
+  gcc = makeShell {
+    stdenv = gccStdenv;
+    compilerName = "gcc";
+  };
+
+  clang = makeShell {
+    stdenv = clangStdenv;
+    compilerName = "clang";
+  };
+
+  # Nix provides no compiler; use the one from your system (e.g. Apple Clang).
+  no-compiler = makeShell {
+    stdenv = pkgs.stdenvNoCC;
+    compilerName = null;
+  };
+  apple-clang = no-compiler;
 }
diff --git a/nix/packages.nix b/nix/packages.nix
index bcadfe7456..bf10ee3712 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -1,15 +1,33 @@
 { pkgs }:
 let
+  # Compiler versions used across the dev shell and the CI environment.
+  gccVersion = 15;
+  llvmVersion = 22;
+
+  gccPackage = pkgs."gcc${toString gccVersion}";
+  llvmPackages = pkgs."llvmPackages_${toString llvmVersion}";
+
+  # Bound explicitly so it tracks llvmPackages above, not the `with pkgs` default.
+  clangTools = llvmPackages.clang-tools;
+
   # In LLVM 22, run-clang-tidy.py moved from share/clang/ to bin/, so nixpkgs
   # clang-tools no longer links it. Wrap it manually.
   runClangTidy = pkgs.writeShellScriptBin "run-clang-tidy" ''
-    exec ${pkgs.python3}/bin/python3 ${pkgs.llvmPackages_22.clang-unwrapped}/bin/run-clang-tidy "$@"
+    exec ${pkgs.python3}/bin/python3 ${llvmPackages.clang-unwrapped}/bin/run-clang-tidy "$@"
   '';
 in
 {
+  inherit
+    gccVersion
+    llvmVersion
+    gccPackage
+    llvmPackages
+    ;
+
   commonPackages = with pkgs; [
     ccache
     clangbuildanalyzer
+    clangTools
     cmake
     conan
     curlMinimal # needed for codecov/codecov-action
@@ -23,7 +41,6 @@ in
     gnumake
     gnupg # needed for signing commits & codecov/codecov-action
     graphviz
-    llvmPackages_22.clang-tools
     less # needed for git diff
     mold
     nettools # provides netstat, used to debug failures in CI

From c7adb215ed6b77b2f93e643a7e21aab7bbb26122 Mon Sep 17 00:00:00 2001
From: Sergey Kuznetsov <skuznetsov@ripple.com>
Date: Wed, 8 Jul 2026 18:28:48 +0100
Subject: [PATCH 057/100] chore: Add .envrc for automatic devshell switch by
 direnv (#7756)

---
 .envrc            |  1 +
 docs/build/nix.md | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 .envrc

diff --git a/.envrc b/.envrc
new file mode 100644
index 0000000000..3550a30f2d
--- /dev/null
+++ b/.envrc
@@ -0,0 +1 @@
+use flake
diff --git a/docs/build/nix.md b/docs/build/nix.md
index 32592e037a..d6e53a254a 100644
--- a/docs/build/nix.md
+++ b/docs/build/nix.md
@@ -114,7 +114,15 @@ Once inside the Nix development shell, follow the standard [build instructions](
 
 [direnv](https://direnv.net/) or [nix-direnv](https://github.com/nix-community/nix-direnv) can automatically activate the Nix development shell when you enter the repository directory.
 
-This is also the most robust way to use the environment from **any shell** (bash, zsh, fish, …): direnv stays in your current shell and loads the environment _after_ your shell's startup files have run, so the Nix-provided tools take precedence over anything your shell configuration adds to `$PATH`. To use it, install direnv for your shell, then add an `.envrc` containing `use flake` at the repository root and run `direnv allow`.
+This is also the most robust way to use the environment from **any shell** (bash, zsh, fish, …): direnv stays in your current shell and loads the environment _after_ your shell's startup files have run, so the Nix-provided tools take precedence over anything your shell configuration adds to `$PATH`.
+
+The repository already ships an `.envrc` at its root that activates the Nix flake development shell, so you don't need to create one. To use it:
+
+1. [Install direnv](https://direnv.net/docs/installation.html) and [hook it into your shell](https://direnv.net/docs/hook.html) (bash, zsh, fish, …). Installing [nix-direnv](https://github.com/nix-community/nix-direnv) as well is recommended: it caches the shell so that activation is near-instant after the first run.
+2. Run `direnv allow` once in the repository root. direnv will then load (and reload) the Nix development shell automatically whenever you enter the directory.
+
+> [!NOTE]
+> direnv only caches the `.direnv` directory (already listed in `.gitignore`); no other repository files are affected.
 
 ## Conan and Prebuilt Packages
 

From fd2cc6dcb308fb811960380eba7bf4309934d05d Mon Sep 17 00:00:00 2001
From: Olek <115580134+oleks-rip@users.noreply.github.com>
Date: Fri, 10 Jul 2026 17:58:19 -0400
Subject: [PATCH 058/100] feat: XLS-68: Sponsor, #5887 continuation  (#7350)

Co-authored-by: tequ <git@tequ.dev>
Co-authored-by: yinyiqian1 <yqian@ripple.com>
Co-authored-by: Mayukha Vadari <mvadari@ripple.com>
Co-authored-by: Mayukha Vadari <mvadari@gmail.com>
Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>
Co-authored-by: Peter Chen <34582813+PeterChen13579@users.noreply.github.com>
Co-authored-by: Zhiyuan Wang <96991820+Kassaking7@users.noreply.github.com>
Co-authored-by: Ayaz Salikhov <asalikhov@ripple.com>
Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Co-authored-by: Zhiyuan Wang <1830604455@qq.com>
---
 .cspell.config.yaml                           |    3 +
 include/xrpl/basics/base_uint.h               |    2 +-
 include/xrpl/ledger/ApplyView.h               |   21 +-
 include/xrpl/ledger/OwnerCounts.h             |   70 +
 include/xrpl/ledger/PaymentSandbox.h          |   14 +-
 include/xrpl/ledger/ReadView.h                |    6 +-
 include/xrpl/ledger/View.h                    |    3 +-
 .../xrpl/ledger/helpers/AccountRootHelpers.h  |  295 +-
 include/xrpl/ledger/helpers/EscrowHelpers.h   |   77 +-
 include/xrpl/ledger/helpers/MPTokenHelpers.h  |   10 +-
 include/xrpl/ledger/helpers/OracleHelpers.h   |   31 +
 .../xrpl/ledger/helpers/RippleStateHelpers.h  |    6 +-
 include/xrpl/ledger/helpers/SponsorHelpers.h  |  184 +
 include/xrpl/ledger/helpers/TokenHelpers.h    |    6 +-
 include/xrpl/protocol/Book.h                  |    4 +-
 include/xrpl/protocol/Fees.h                  |    9 +-
 include/xrpl/protocol/Indexes.h               |    4 +
 include/xrpl/protocol/Issue.h                 |    2 +-
 include/xrpl/protocol/LedgerFormats.h         |    6 +-
 include/xrpl/protocol/STObject.h              |    4 +-
 include/xrpl/protocol/STTx.h                  |    3 +
 include/xrpl/protocol/TER.h                   |    2 +
 include/xrpl/protocol/TxFlags.h               |   25 +-
 include/xrpl/protocol/detail/features.macro   |    1 +
 .../xrpl/protocol/detail/ledger_entries.macro |   66 +-
 include/xrpl/protocol/detail/sfields.macro    |   15 +
 .../xrpl/protocol/detail/transactions.macro   |   29 +
 include/xrpl/protocol/jss.h                   |    3 +
 .../ledger_entries/AccountRoot.h              |  105 +
 .../ledger_entries/RippleState.h              |   70 +
 .../ledger_entries/Sponsorship.h              |  344 +
 .../transactions/SponsorshipSet.h             |  290 +
 .../transactions/SponsorshipTransfer.h        |  179 +
 include/xrpl/tx/ApplyContext.h                |    9 +
 include/xrpl/tx/Transactor.h                  |   24 +
 include/xrpl/tx/invariants/InvariantCheck.h   |    5 +-
 .../xrpl/tx/invariants/SponsorshipInvariant.h |   61 +
 include/xrpl/tx/paths/AMMOffer.h              |    6 +-
 include/xrpl/tx/paths/Offer.h                 |    3 +-
 .../tx/transactors/sponsor/SponsorshipSet.h   |   52 +
 .../transactors/sponsor/SponsorshipTransfer.h |   49 +
 .../transactors/token/MPTokenIssuanceCreate.h |    2 +-
 src/libxrpl/ledger/PaymentSandbox.cpp         |   15 +-
 src/libxrpl/ledger/View.cpp                   |   24 +-
 .../ledger/helpers/AccountRootHelpers.cpp     |  409 +-
 .../ledger/helpers/CredentialHelpers.cpp      |    2 +-
 src/libxrpl/ledger/helpers/MPTokenHelpers.cpp |   91 +-
 src/libxrpl/ledger/helpers/NFTokenHelpers.cpp |   43 +-
 src/libxrpl/ledger/helpers/OfferHelpers.cpp   |    2 +-
 .../ledger/helpers/PaymentChannelHelpers.cpp  |    2 +-
 .../ledger/helpers/RippleStateHelpers.cpp     |   83 +-
 src/libxrpl/ledger/helpers/SponsorHelpers.cpp |  345 ++
 src/libxrpl/ledger/helpers/TokenHelpers.cpp   |   44 +-
 src/libxrpl/protocol/Indexes.cpp              |    7 +
 src/libxrpl/protocol/InnerObjectFormats.cpp   |    8 +
 src/libxrpl/protocol/LedgerFormats.cpp        |    1 +
 src/libxrpl/protocol/STObject.cpp             |    6 +-
 src/libxrpl/protocol/STTx.cpp                 |   19 +-
 src/libxrpl/protocol/TER.cpp                  |    2 +
 src/libxrpl/protocol/TxFormats.cpp            |    3 +
 src/libxrpl/tx/Transactor.cpp                 |  337 +-
 src/libxrpl/tx/applySteps.cpp                 |    3 +
 src/libxrpl/tx/invariants/InvariantCheck.cpp  |   42 +-
 .../tx/invariants/SponsorshipInvariant.cpp    |  158 +
 src/libxrpl/tx/invariants/VaultInvariant.cpp  |    9 +-
 src/libxrpl/tx/paths/BookStep.cpp             |    2 +-
 src/libxrpl/tx/paths/MPTEndpointStep.cpp      |    3 +-
 .../tx/transactors/account/AccountDelete.cpp  |   39 +-
 .../tx/transactors/account/SignerListSet.cpp  |   34 +-
 .../tx/transactors/bridge/XChainBridge.cpp    |   19 +-
 .../tx/transactors/check/CheckCancel.cpp      |    3 +-
 .../tx/transactors/check/CheckCash.cpp        |   37 +-
 .../tx/transactors/check/CheckCreate.cpp      |   16 +-
 .../credentials/CredentialAccept.cpp          |   33 +-
 .../credentials/CredentialCreate.cpp          |   15 +-
 .../tx/transactors/delegate/DelegateSet.cpp   |   20 +-
 src/libxrpl/tx/transactors/dex/AMMCreate.cpp  |   19 +-
 src/libxrpl/tx/transactors/dex/AMMDeposit.cpp |    9 +-
 .../tx/transactors/dex/AMMWithdraw.cpp        |   17 +-
 .../tx/transactors/dex/OfferCreate.cpp        |    6 +-
 src/libxrpl/tx/transactors/did/DIDDelete.cpp  |    3 +-
 src/libxrpl/tx/transactors/did/DIDSet.cpp     |    5 +-
 .../tx/transactors/escrow/EscrowCancel.cpp    |    5 +-
 .../tx/transactors/escrow/EscrowCreate.cpp    |   33 +-
 .../tx/transactors/escrow/EscrowFinish.cpp    |   19 +-
 .../lending/LoanBrokerCoverClawback.cpp       |    2 +-
 .../lending/LoanBrokerCoverDeposit.cpp        |    2 +-
 .../lending/LoanBrokerCoverWithdraw.cpp       |    9 +-
 .../transactors/lending/LoanBrokerDelete.cpp  |   10 +-
 .../tx/transactors/lending/LoanBrokerSet.cpp  |    8 +-
 .../tx/transactors/lending/LoanDelete.cpp     |    7 +-
 .../tx/transactors/lending/LoanManage.cpp     |    1 +
 .../tx/transactors/lending/LoanPay.cpp        |    6 +-
 .../tx/transactors/lending/LoanSet.cpp        |   26 +-
 .../tx/transactors/nft/NFTokenAcceptOffer.cpp |    4 +-
 .../tx/transactors/nft/NFTokenMint.cpp        |   11 +-
 .../tx/transactors/oracle/OracleDelete.cpp    |    9 +-
 .../tx/transactors/oracle/OracleSet.cpp       |   40 +-
 .../tx/transactors/payment/DepositPreauth.cpp |   34 +-
 .../tx/transactors/payment/Payment.cpp        |   77 +-
 .../payment_channel/PaymentChannelCreate.cpp  |   37 +-
 .../payment_channel/PaymentChannelFund.cpp    |   18 +-
 .../PermissionedDomainDelete.cpp              |    2 +-
 .../PermissionedDomainSet.cpp                 |    5 +-
 .../tx/transactors/sponsor/SponsorshipSet.cpp |  420 ++
 .../sponsor/SponsorshipTransfer.cpp           |  542 ++
 src/libxrpl/tx/transactors/system/Batch.cpp   |   29 +-
 .../tx/transactors/system/TicketCreate.cpp    |   16 +-
 .../tx/transactors/token/MPTokenAuthorize.cpp |    2 +-
 .../token/MPTokenIssuanceCreate.cpp           |   36 +-
 .../token/MPTokenIssuanceDestroy.cpp          |    3 +-
 src/libxrpl/tx/transactors/token/TrustSet.cpp |  170 +-
 .../tx/transactors/vault/VaultClawback.cpp    |    9 +-
 .../tx/transactors/vault/VaultCreate.cpp      |   23 +-
 .../tx/transactors/vault/VaultDelete.cpp      |   11 +-
 .../tx/transactors/vault/VaultDeposit.cpp     |   18 +-
 .../tx/transactors/vault/VaultWithdraw.cpp    |    9 +-
 src/test/app/AMMExtendedMPT_test.cpp          |    2 +-
 src/test/app/AMMExtended_test.cpp             |    2 +-
 src/test/app/AMMMPT_test.cpp                  |    2 +-
 src/test/app/AccountSet_test.cpp              |    3 +-
 src/test/app/CheckMPT_test.cpp                |    2 +-
 src/test/app/Check_test.cpp                   |    2 +-
 src/test/app/Credentials_test.cpp             |    4 +-
 src/test/app/Delegate_test.cpp                |   22 +-
 src/test/app/DepositAuth_test.cpp             |    4 +-
 src/test/app/EscrowToken_test.cpp             |    2 +-
 src/test/app/FlowMPT_test.cpp                 |    2 +-
 src/test/app/Flow_test.cpp                    |    2 +-
 src/test/app/Invariants_test.cpp              |  190 +-
 src/test/app/LoanBroker_test.cpp              |    3 +-
 src/test/app/Loan_test.cpp                    |   41 +-
 src/test/app/MPToken_test.cpp                 |   11 +-
 src/test/app/NFToken_test.cpp                 |    2 +-
 src/test/app/OfferMPT_test.cpp                |   18 +-
 src/test/app/Offer_test.cpp                   |   18 +-
 src/test/app/Oracle_test.cpp                  |    6 +-
 src/test/app/Sponsor_test.cpp                 | 5511 +++++++++++++++++
 src/test/app/Ticket_test.cpp                  |   10 +-
 src/test/app/TrustSet_test.cpp                |    2 +-
 src/test/app/TxQ_test.cpp                     |   40 +
 src/test/app/Vault_test.cpp                   |    8 +-
 src/test/app/XChain_test.cpp                  |    4 +-
 src/test/jtx/Env.h                            |   18 +
 src/test/jtx/JTx.h                            |    2 +-
 src/test/jtx/TestHelpers.h                    |   12 +
 src/test/jtx/impl/AMMTest.cpp                 |    2 +-
 src/test/jtx/impl/Env.cpp                     |   27 +
 src/test/jtx/impl/TestHelpers.cpp             |   18 +
 src/test/jtx/impl/multisign.cpp               |    3 +-
 src/test/jtx/impl/owners.cpp                  |   18 +
 src/test/jtx/impl/sig.cpp                     |    2 +-
 src/test/jtx/impl/sponsor.cpp                 |   98 +
 src/test/jtx/owners.h                         |   54 +
 src/test/jtx/sponsor.h                        |  105 +
 src/test/ledger/PaymentSandbox_test.cpp       |  228 +-
 src/test/rpc/AccountObjects_test.cpp          |  269 +-
 src/test/rpc/AccountTx_test.cpp               |   80 +-
 src/test/rpc/LedgerEntry_test.cpp             |   59 +-
 src/test/rpc/Simulate_test.cpp                |  153 +
 .../ledger_entries/AccountRootTests.cpp       |   81 +
 .../ledger_entries/RippleStateTests.cpp       |   54 +
 .../ledger_entries/SponsorshipTests.cpp       |  329 +
 .../transactions/SponsorshipSetTests.cpp      |  261 +
 .../transactions/SponsorshipTransferTests.cpp |  198 +
 src/xrpld/app/misc/detail/TxQ.cpp             |    4 +
 src/xrpld/rpc/detail/TransactionSign.cpp      |    6 +-
 .../rpc/handlers/account/AccountObjects.cpp   |   55 +-
 src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp |   22 +
 .../rpc/handlers/transaction/Simulate.cpp     |   52 +-
 170 files changed, 13151 insertions(+), 660 deletions(-)
 create mode 100644 include/xrpl/ledger/OwnerCounts.h
 create mode 100644 include/xrpl/ledger/helpers/OracleHelpers.h
 create mode 100644 include/xrpl/ledger/helpers/SponsorHelpers.h
 create mode 100644 include/xrpl/protocol_autogen/ledger_entries/Sponsorship.h
 create mode 100644 include/xrpl/protocol_autogen/transactions/SponsorshipSet.h
 create mode 100644 include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h
 create mode 100644 include/xrpl/tx/invariants/SponsorshipInvariant.h
 create mode 100644 include/xrpl/tx/transactors/sponsor/SponsorshipSet.h
 create mode 100644 include/xrpl/tx/transactors/sponsor/SponsorshipTransfer.h
 create mode 100644 src/libxrpl/ledger/helpers/SponsorHelpers.cpp
 create mode 100644 src/libxrpl/tx/invariants/SponsorshipInvariant.cpp
 create mode 100644 src/libxrpl/tx/transactors/sponsor/SponsorshipSet.cpp
 create mode 100644 src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp
 create mode 100644 src/test/app/Sponsor_test.cpp
 create mode 100644 src/test/jtx/impl/sponsor.cpp
 create mode 100644 src/test/jtx/sponsor.h
 create mode 100644 src/tests/libxrpl/protocol_autogen/ledger_entries/SponsorshipTests.cpp
 create mode 100644 src/tests/libxrpl/protocol_autogen/transactions/SponsorshipSetTests.cpp
 create mode 100644 src/tests/libxrpl/protocol_autogen/transactions/SponsorshipTransferTests.cpp

diff --git a/.cspell.config.yaml b/.cspell.config.yaml
index c558fc0984..dc24bf833b 100644
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -279,6 +279,8 @@ words:
   - sles
   - soci
   - socidb
+  - sponsee
+  - sponsees
   - SRPMS
   - sslws
   - statsd
@@ -327,6 +329,7 @@ words:
   - unserviced
   - unshareable
   - unshares
+  - unsponsored
   - unsquelch
   - unsquelched
   - unsquelching
diff --git a/include/xrpl/basics/base_uint.h b/include/xrpl/basics/base_uint.h
index 481a7dbd77..f75100f862 100644
--- a/include/xrpl/basics/base_uint.h
+++ b/include/xrpl/basics/base_uint.h
@@ -595,7 +595,7 @@ template <std::size_t Bits, typename Tag>
 [[nodiscard]] constexpr bool
 operator==(BaseUInt<Bits, Tag> const& lhs, BaseUInt<Bits, Tag> const& rhs)
 {
-    return (lhs <=> rhs) == 0;
+    return (lhs <=> rhs) == 0;  // NOLINT(modernize-use-nullptr)
 }
 
 //------------------------------------------------------------------------------
diff --git a/include/xrpl/ledger/ApplyView.h b/include/xrpl/ledger/ApplyView.h
index e519013d9a..afe6b291b2 100644
--- a/include/xrpl/ledger/ApplyView.h
+++ b/include/xrpl/ledger/ApplyView.h
@@ -3,6 +3,7 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Issue.h>  // IWYU pragma: keep
@@ -11,6 +12,7 @@
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/STVector256.h>
 
 #include <cstdint>
@@ -288,7 +290,7 @@ public:
     // Called when the owner count changes
     // This is required to support PaymentSandbox
     virtual void
-    adjustOwnerCountHook(AccountID const& account, std::uint32_t cur, std::uint32_t next)
+    adjustOwnerCountHook(AccountID const& account, OwnerCounts const& cur, OwnerCounts const& next)
     {
     }
 
@@ -411,6 +413,23 @@ public:
     emptyDirDelete(Keylet const& directory);
 };
 
+/** Bundles the mutable ledger view and the transaction being applied.
+
+    Passed together to avoid threading two separate parameters through every
+    helper that needs both the view (for state reads/writes) and the
+    transaction (for field inspection and metadata).
+
+    Both members are non-owning references; the caller is responsible for
+    ensuring that the referenced objects outlive the ApplyViewContext.
+
+    TODO: replace with ApplyContext after it's untangled with xrpl/tx
+*/
+struct ApplyViewContext
+{
+    ApplyView& view;
+    STTx const& tx;
+};
+
 namespace directory {
 /** Helper functions for managing low-level directory operations.
     These are not part of the ApplyView interface.
diff --git a/include/xrpl/ledger/OwnerCounts.h b/include/xrpl/ledger/OwnerCounts.h
new file mode 100644
index 0000000000..74d60014b5
--- /dev/null
+++ b/include/xrpl/ledger/OwnerCounts.h
@@ -0,0 +1,70 @@
+#pragma once
+
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STInteger.h>  // IWYU pragma: keep
+#include <xrpl/protocol/STLedgerEntry.h>
+
+#include <cstdint>
+#include <limits>
+
+namespace xrpl {
+
+struct OwnerCounts
+{
+    std::uint32_t owner = 0;
+    std::uint32_t sponsored = 0;
+    std::uint32_t sponsoring = 0;
+
+    OwnerCounts() = default;
+    OwnerCounts(SLE::const_ref sle)
+        : owner(sle->at(sfOwnerCount))
+        , sponsored(sle->at(sfSponsoredOwnerCount))
+        , sponsoring(sle->at(sfSponsoringOwnerCount))
+    {
+        XRPL_ASSERT(
+            owner >= sponsored,
+            "xrpl::OwnerCounts : OwnerCount must be greater than or equal to "
+            "SponsoredOwnerCount");
+        XRPL_ASSERT(sle->getType() == ltACCOUNT_ROOT, "xrpl::OwnerCounts : sle is AccountRoot");
+    }
+
+    [[nodiscard]] std::uint32_t
+    count() const
+    {
+        std::int64_t const x = static_cast<std::int64_t>(owner) - sponsored + sponsoring;
+        if (x < 0)
+        {
+            // LCOV_EXCL_START
+            UNREACHABLE("xrpl::OwnerCounts::count : count less than zero");
+            return 0;
+            // LCOV_EXCL_STOP
+        }
+
+        if (x > std::numeric_limits<std::uint32_t>::max())
+            return std::numeric_limits<std::uint32_t>::max();  // LCOV_EXCL_LINE
+        return static_cast<std::uint32_t>(x);
+    }
+
+    auto
+    operator<=>(OwnerCounts const& o) const
+    {
+        if (auto cmp = count() <=> o.count(); cmp != 0)  // NOLINT(modernize-use-nullptr)
+            return cmp;
+        if (auto cmp = owner <=> o.owner; cmp != 0)  // NOLINT(modernize-use-nullptr)
+            return cmp;
+        if (auto cmp = sponsored <=> o.sponsored; cmp != 0)  // NOLINT(modernize-use-nullptr)
+            return cmp;
+        return sponsoring <=> o.sponsoring;
+    }
+
+    bool
+    operator==(OwnerCounts const& o) const
+    {
+        return this == &o ||
+            (owner == o.owner && sponsored == o.sponsored && sponsoring == o.sponsoring);
+    }
+};
+
+}  // namespace xrpl
diff --git a/include/xrpl/ledger/PaymentSandbox.h b/include/xrpl/ledger/PaymentSandbox.h
index 0117a962ff..8afe21b397 100644
--- a/include/xrpl/ledger/PaymentSandbox.h
+++ b/include/xrpl/ledger/PaymentSandbox.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/RawView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/detail/ApplyViewBase.h>
@@ -107,12 +108,12 @@ public:
     issuerSelfDebitMPT(MPTIssue const& issue, std::uint64_t amount, std::int64_t origBalance);
 
     void
-    ownerCount(AccountID const& id, std::uint32_t cur, std::uint32_t next);
+    ownerCount(AccountID const& id, OwnerCounts const& cur, OwnerCounts const& next);
 
     // Get the adjusted owner count. Since DeferredCredits is meant to be used
     // in payments, and payments only decrease owner counts, return the max
     // remembered owner count.
-    [[nodiscard]] std::optional<std::uint32_t>
+    [[nodiscard]] std::optional<OwnerCounts>
     ownerCount(AccountID const& id) const;
 
     void
@@ -124,7 +125,7 @@ private:
 
     std::map<KeyIOU, ValueIOU> creditsIOU_;
     std::map<MPTID, IssuerValueMPT> creditsMPT_;
-    std::map<AccountID, std::uint32_t> ownerCounts_;
+    std::map<AccountID, OwnerCounts> ownerCounts_;
 };
 
 }  // namespace detail
@@ -218,10 +219,11 @@ public:
         override;
 
     void
-    adjustOwnerCountHook(AccountID const& account, std::uint32_t cur, std::uint32_t next) override;
+    adjustOwnerCountHook(AccountID const& account, OwnerCounts const& cur, OwnerCounts const& next)
+        override;
 
-    [[nodiscard]] std::uint32_t
-    ownerCountHook(AccountID const& account, std::uint32_t count) const override;
+    [[nodiscard]] OwnerCounts
+    ownerCountHook(AccountID const& account, OwnerCounts const& count) const override;
 
     /** Apply changes to base view.
 
diff --git a/include/xrpl/ledger/ReadView.h b/include/xrpl/ledger/ReadView.h
index 724533039b..da92e0b510 100644
--- a/include/xrpl/ledger/ReadView.h
+++ b/include/xrpl/ledger/ReadView.h
@@ -4,6 +4,7 @@
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/detail/ReadViewFwdRange.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Fees.h>
@@ -13,6 +14,7 @@
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
@@ -189,8 +191,8 @@ public:
     // changes that accounts make during a payment. `ownerCountHook` adjusts the
     // ownerCount so it returns the max value of the ownerCount so far.
     // This is required to support PaymentSandbox.
-    [[nodiscard]] virtual std::uint32_t
-    ownerCountHook(AccountID const& account, std::uint32_t count) const
+    [[nodiscard]] virtual OwnerCounts
+    ownerCountHook(AccountID const& account, OwnerCounts const& count) const
     {
         return count;
     }
diff --git a/include/xrpl/ledger/View.h b/include/xrpl/ledger/View.h
index c89764df1d..7fad61d407 100644
--- a/include/xrpl/ledger/View.h
+++ b/include/xrpl/ledger/View.h
@@ -210,8 +210,7 @@ canWithdraw(ReadView const& view, STTx const& tx);
 
 [[nodiscard]] TER
 doWithdraw(
-    ApplyView& view,
-    STTx const& tx,
+    ApplyViewContext ctx,
     AccountID const& senderAcct,
     AccountID const& dstAcct,
     AccountID const& sourceAcct,
diff --git a/include/xrpl/ledger/helpers/AccountRootHelpers.h b/include/xrpl/ledger/helpers/AccountRootHelpers.h
index d0cfc175a3..ae8cf53f2f 100644
--- a/include/xrpl/ledger/helpers/AccountRootHelpers.h
+++ b/include/xrpl/ledger/helpers/AccountRootHelpers.h
@@ -14,6 +14,7 @@
 
 #include <cstdint>
 #include <expected>
+#include <optional>
 #include <set>
 #include <vector>
 
@@ -26,21 +27,293 @@ namespace xrpl {
 [[nodiscard]] bool
 isGlobalFrozen(ReadView const& view, AccountID const& issuer);
 
-// Calculate liquid XRP balance for an account.
-// This function may be used to calculate the amount of XRP that
-// the holder is able to freely spend. It subtracts reserve requirements.
-//
-// ownerCountAdj adjusts the owner count in case the caller calculates
-// before ledger entries are added or removed. Positive to add, negative
-// to subtract.
-//
-// @param ownerCountAdj positive to add to count, negative to reduce count.
+/** Calculate liquid XRP balance for an account.
+ *
+ *  This function may be used to calculate the amount of XRP that
+ *  the holder is able to freely spend. It subtracts reserve requirements.
+ *
+ *  ownerCountAdj adjusts the owner count in case the caller calculates
+ *  before ledger entries are added or removed. Positive to add, negative
+ *  to subtract.
+ *
+ *  @param view The ledger view to read from
+ *  @param id The account ID to check
+ *  @param ownerCountAdj Positive to add to count, negative to reduce count
+ *  @param j Journal for logging
+ *  @return The liquid XRP amount available to the account
+ */
 [[nodiscard]] XRPAmount
 xrpLiquid(ReadView const& view, AccountID const& id, std::int32_t ownerCountAdj, beast::Journal j);
 
-/** Adjust the owner count up or down. */
+struct Adjustment
+{
+    std::int32_t ownerCountDelta = 0;
+    std::int32_t accountCountDelta = 0;
+};
+
+/** Returns the account reserve, in drops.
+ *
+ *  Actual owner count can be adjusted by delta in ownerCountAdj
+ *  Actual reserve count can be adjusted by delta in accountCountAdj
+ *  The reserve is calculated as:
+ *  (ownerCount + "sponsoring object count" - "sponsored object count" + additionalOwnerCount) *
+ *  increment + (1 if not sponsored account + sponsoringAccountCount) * "reserve base"
+ *
+ *  @param view The ledger view to read from
+ *  @param sle The ledger entry for the account
+ *  @param j Journal for logging
+ *  @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
+ * subtract.
+ *  @return The account reserve amount in drops
+ */
+[[nodiscard]] XRPAmount
+accountReserve(ReadView const& view, SLE::const_ref sle, beast::Journal j, Adjustment adj = {});
+
+/** Convenience overload that accepts AccountID instead of SLE.
+ *
+ *  @param view The ledger view to read from
+ *  @param id The account ID
+ *  @param j Journal for logging
+ *  @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
+ * subtract.
+ *  @return The account reserve amount in drops
+ */
+[[nodiscard]] inline XRPAmount
+accountReserve(ReadView const& view, AccountID const& id, beast::Journal j, Adjustment adj = {})
+{
+    return accountReserve(view, view.read(keylet::account(id)), j, adj);
+}
+
+/** Check if an account has sufficient reserve.
+ *
+ *  @param view The ledger view to read from
+ *  @param tx The transaction being processed
+ *  @param accSle The account's ledger entry
+ *  @param accBalance The account's balance
+ *  @param sponsorSle The sponsor's ledger entry (if applicable)
+ *  @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
+ * subtract.
+ *  @param j Journal for logging (default: null sink)
+ *  @param insufReserveCode The transaction result code to return if the reserve is insufficient
+ *  (default: tecINSUFFICIENT_RESERVE).
+ *  @return Transaction result code
+ */
+[[nodiscard]] TER
+checkReserve(
+    ApplyViewContext ctx,
+    SLE::const_ref accSle,
+    XRPAmount accBalance,
+    SLE::const_ref sponsorSle,
+    Adjustment adj,
+    beast::Journal j,
+    TER insufReserveCode = tecINSUFFICIENT_RESERVE);
+
+/** Check if an account has sufficient reserve, deriving the sponsor internally.
+ *
+ *  Equivalent to the overload above, but resolves the sponsor via
+ *  getEffectiveTxReserveSponsor(ctx, accSle) instead of taking it explicitly. Use this
+ *  in the common case where the sponsor is simply the transaction's reserve
+ *  sponsor for accSle. Callers that must force the account's-own-reserve branch
+ *  (passing a null sponsor) or supply a different sponsor should use the
+ *  explicit overload above.
+ *
+ *  @param ctx The apply-view context (view + tx)
+ *  @param accSle The account's ledger entry
+ *  @param accBalance The account's balance
+ *  @param adj Reserve adjustments (owner/account count deltas)
+ *  @param j Journal for logging (default: null sink)
+ *  @return Transaction result code
+ */
+[[nodiscard]] TER
+checkReserve(
+    ApplyViewContext ctx,
+    SLE::const_ref accSle,
+    XRPAmount accBalance,
+    Adjustment adj,
+    beast::Journal j = beast::Journal{beast::Journal::getNullSink()});
+
+/** Return number of the objects which reserve is covered by the account(sle) (so called "owner
+ *  count"). Actual owner count can be adjusted by delta in ownerCountAdj.
+ *
+ *  @param sle The account's ledger entry
+ *  @param j Journal for logging
+ *  @param ownerCountAdj Adjustment to the owner count (default: 0)
+ *  @return The adjusted owner count
+ */
+std::uint32_t
+ownerCount(SLE::const_ref sle, beast::Journal j, std::int32_t ownerCountAdj = 0);
+
+/** Increase owner-count fields when the caller supplies the sponsor.
+ *
+ *  This helper does not create a ledger object. It updates reserve accounting
+ *  after the caller has created/updated an object.
+ *  If sponsorSle is provided, this also adjusts the account's sponsored count
+ *  and the sponsor's sponsoring count.
+ *
+ *  @param view The apply view for making changes
+ *  @param accountSle The account's ledger entry
+ *  @param sponsorSle The sponsor's ledger entry (if applicable)
+ *  @param count Amount to add to the owner count
+ *  @param j Journal for logging
+ */
 void
-adjustOwnerCount(ApplyView& view, SLE::ref sle, std::int32_t amount, beast::Journal j);
+increaseOwnerCount(
+    ApplyView& view,
+    SLE::ref accountSle,
+    SLE::ref sponsorSle,
+    std::uint32_t count,
+    beast::Journal j);
+
+/** Increase owner-count fields, deriving the tx reserve sponsor internally.
+ *
+ *  Equivalent to the overload above, but resolves the sponsor via
+ *  getEffectiveTxReserveSponsor(ctx, accountSle) instead of taking it explicitly. Use
+ *  this when the sponsor is the transaction's reserve sponsor for accountSle
+ *  (the common create path). Deletion paths, which derive the sponsor from an
+ *  object's sfSponsor field, should keep using the explicit overload.
+ *
+ *  @param ctx The apply-view context (view + tx)
+ *  @param accountSle The account's ledger entry
+ *  @param count Amount to add to the owner count
+ *  @param j Journal for logging
+ */
+void
+increaseOwnerCount(
+    ApplyViewContext ctx,
+    SLE::ref accountSle,
+    std::uint32_t count,
+    beast::Journal j);
+
+/** Convenience overload that accepts AccountID instead of SLE references.
+ *
+ *  @param view The apply view for making changes
+ *  @param account The account ID
+ *  @param sponsor The optional sponsor account ID
+ *  @param count Amount to add to the owner count
+ *  @param j Journal for logging
+ */
+inline void
+increaseOwnerCount(
+    ApplyView& view,
+    AccountID const& account,
+    std::optional<AccountID> const& sponsor,
+    std::uint32_t count,
+    beast::Journal j)
+{
+    increaseOwnerCount(
+        view,
+        view.peek(keylet::account(account)),
+        sponsor ? view.peek(keylet::account(*sponsor)) : SLE::pointer(),
+        count,
+        j);
+}
+
+/** Decrease owner-count fields when the caller supplies the sponsor.
+ *
+ *  This helper does not delete a ledger object. It updates reserve accounting
+ *  after the caller has removed an owner-counted reserve, or for special
+ *  owner-count changes whose sponsor cannot be derived from an object's
+ *  sfSponsor field.
+ *
+ *  @param view The apply view for making changes
+ *  @param accountSle The account's ledger entry
+ *  @param sponsorSle The sponsor's ledger entry (if applicable)
+ *  @param count Amount to remove from the owner count
+ *  @param j Journal for logging
+ */
+void
+decreaseOwnerCount(
+    ApplyView& view,
+    SLE::ref accountSle,
+    SLE::ref sponsorSle,
+    std::uint32_t count,
+    beast::Journal j);
+
+/** Convenience overload that accepts AccountID instead of SLE references.
+ *
+ *  @param view The apply view for making changes
+ *  @param account The account ID
+ *  @param sponsor The optional sponsor account ID
+ *  @param count Amount to remove from the owner count
+ *  @param j Journal for logging
+ */
+inline void
+decreaseOwnerCount(
+    ApplyView& view,
+    AccountID const& account,
+    std::optional<AccountID> const& sponsor,
+    std::uint32_t count,
+    beast::Journal j)
+{
+    decreaseOwnerCount(
+        view,
+        view.peek(keylet::account(account)),
+        sponsor ? view.peek(keylet::account(*sponsor)) : SLE::pointer(),
+        count,
+        j);
+}
+
+/** Decrease owner-count fields for an existing ledger object.
+ *
+ *  This helper derives the reserve sponsor from objectSle's sfSponsor field,
+ *  then updates the same owner-count fields as decreaseOwnerCount. Use this
+ *  when removing an existing object whose reserve sponsor is stored on that
+ *  object.
+ *
+ *  @param view The apply view for making changes
+ *  @param accountSle The account's ledger entry
+ *  @param objectSle The object's ledger entry
+ *  @param count Amount to remove from the owner count
+ *  @param j Journal for logging
+ */
+void
+decreaseOwnerCountForObject(
+    ApplyView& view,
+    SLE::ref accountSle,
+    SLE::ref objectSle,
+    std::uint32_t count,
+    beast::Journal j);
+
+/** Convenience overload that accepts AccountID instead of account SLE reference.
+ *
+ *  @param view The apply view for making changes
+ *  @param account The account ID
+ *  @param objectSle The object's ledger entry
+ *  @param count Amount to remove from the owner count
+ *  @param j Journal for logging
+ */
+inline void
+decreaseOwnerCountForObject(
+    ApplyView& view,
+    AccountID const& account,
+    SLE::ref objectSle,
+    std::uint32_t count,
+    beast::Journal j)
+{
+    SLE::ref accountSle = view.peek(keylet::account(account));
+    decreaseOwnerCountForObject(view, accountSle, objectSle, count, j);
+}
+
+/** Adjust a LoanBroker's owner count.
+ *
+ *  A LoanBroker's sfOwnerCount tracks the number of outstanding loans on
+ *  that broker; it is not a reserve-backed owner count and is distinct
+ *  from the broker's pseudo-account's owner count. Loans can never carry a
+ *  reserve sponsor (LoanSet rejects reserve sponsorship at preflight), so
+ *  this never involves sponsor accounting and never invokes the
+ *  ownerCountHook used for ACCOUNT_ROOT reserve tracking.
+ *
+ *  @param view The apply view for making changes
+ *  @param brokerSle The LoanBroker's ledger entry
+ *  @param delta Amount to add (positive) or remove (negative) from the count
+ *  @param j Journal for logging
+ */
+void
+adjustLoanBrokerOwnerCount(
+    ApplyView& view,
+    SLE::ref brokerSle,
+    std::int32_t delta,
+    beast::Journal j);
 
 /** Returns IOU issuer transfer fee as Rate. Rate specifies
  * the fee as fractions of 1 billion. For example, 1% transfer rate
diff --git a/include/xrpl/ledger/helpers/EscrowHelpers.h b/include/xrpl/ledger/helpers/EscrowHelpers.h
index d173c33c56..9f54e53769 100644
--- a/include/xrpl/ledger/helpers/EscrowHelpers.h
+++ b/include/xrpl/ledger/helpers/EscrowHelpers.h
@@ -6,6 +6,7 @@
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
@@ -22,17 +23,15 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
 
-#include <cstdint>
-
 namespace xrpl {
 
 template <ValidIssueType T>
 TER
 escrowUnlockApplyHelper(
-    ApplyView& view,
+    ApplyViewContext ctx,
     Rate lockedRate,
     SLE::ref sleDest,
-    STAmount const& xrpBalance,
+    XRPAmount xrpBalance,
     STAmount const& amount,
     AccountID const& issuer,
     AccountID const& sender,
@@ -43,10 +42,10 @@ escrowUnlockApplyHelper(
 template <>
 inline TER
 escrowUnlockApplyHelper<Issue>(
-    ApplyView& view,
+    ApplyViewContext ctx,
     Rate lockedRate,
     SLE::ref sleDest,
-    STAmount const& xrpBalance,
+    XRPAmount xrpBalance,
     STAmount const& amount,
     AccountID const& issuer,
     AccountID const& sender,
@@ -66,16 +65,26 @@ escrowUnlockApplyHelper<Issue>(
     if (receiverIssuer)
         return tesSUCCESS;
 
-    if (!view.exists(trustLineKey) && createAsset)
+    if (!ctx.view.exists(trustLineKey) && createAsset)
     {
         // Can the account cover the trust line's reserve?
-        if (std::uint32_t const ownerCount = {sleDest->at(sfOwnerCount)};
-            xrpBalance < view.fees().accountReserve(ownerCount + 1))
+        auto const sponsorSle = getEffectiveTxReserveSponsor(ctx, sleDest);
+        if (!sponsorSle)
+            return sponsorSle.error();  // LCOV_EXCL_LINE
+
+        if (auto const ret = checkReserve(
+                ctx,
+                sleDest,
+                xrpBalance,
+                *sponsorSle,
+                {.ownerCountDelta = 1},
+                journal,
+                tecNO_LINE_INSUF_RESERVE);
+            !isTesSuccess(ret))
         {
             JLOG(journal.trace()) << "Trust line does not exist. "
                                      "Insufficient reserve to create line.";
-
-            return tecNO_LINE_INSUF_RESERVE;
+            return ret;
         }
 
         Currency const currency = issue.currency;
@@ -83,7 +92,7 @@ escrowUnlockApplyHelper<Issue>(
         initialBalance.get<Issue>().account = noAccount();
 
         if (TER const ter = trustCreate(
-                view,                                // payment sandbox
+                ctx.view,                            // payment sandbox
                 recvLow,                             // is dest low?
                 issuer,                              // source
                 receiver,                            // destination
@@ -97,19 +106,20 @@ escrowUnlockApplyHelper<Issue>(
                 Issue(currency, receiver),           // limit of zero
                 0,                                   // quality in
                 0,                                   // quality out
+                *sponsorSle,                         // sponsor
                 journal);                            // journal
             !isTesSuccess(ter))
         {
             return ter;  // LCOV_EXCL_LINE
         }
 
-        view.update(sleDest);
+        ctx.view.update(sleDest);
     }
 
-    if (!view.exists(trustLineKey) && !receiverIssuer)
+    if (!ctx.view.exists(trustLineKey) && !receiverIssuer)
         return tecNO_LINE;
 
-    auto const xferRate = transferRate(view, amount);
+    auto const xferRate = transferRate(ctx.view, amount);
     // update if issuer rate is less than locked rate
     if (xferRate < lockedRate)
         lockedRate = xferRate;
@@ -137,7 +147,7 @@ escrowUnlockApplyHelper<Issue>(
     // of the funds
     if (!createAsset)
     {
-        auto const sleRippleState = view.peek(trustLineKey);
+        auto const sleRippleState = ctx.view.peek(trustLineKey);
         if (!sleRippleState)
             return tecINTERNAL;  // LCOV_EXCL_LINE
 
@@ -163,7 +173,7 @@ escrowUnlockApplyHelper<Issue>(
     // if destination is not the issuer then transfer funds
     if (!receiverIssuer)
     {
-        auto const ter = directSendNoFee(view, issuer, receiver, finalAmt, true, journal);
+        auto const ter = directSendNoFee(ctx.view, issuer, receiver, finalAmt, true, journal);
         if (!isTesSuccess(ter))
             return ter;  // LCOV_EXCL_LINE
     }
@@ -173,10 +183,10 @@ escrowUnlockApplyHelper<Issue>(
 template <>
 inline TER
 escrowUnlockApplyHelper<MPTIssue>(
-    ApplyView& view,
+    ApplyViewContext ctx,
     Rate lockedRate,
     SLE::ref sleDest,
-    STAmount const& xrpBalance,
+    XRPAmount xrpBalance,
     STAmount const& amount,
     AccountID const& issuer,
     AccountID const& sender,
@@ -189,27 +199,32 @@ escrowUnlockApplyHelper<MPTIssue>(
 
     auto const mptID = amount.get<MPTIssue>().getMptID();
     auto const issuanceKey = keylet::mptokenIssuance(mptID);
-    if (!view.exists(keylet::mptoken(issuanceKey.key, receiver)) && createAsset && !receiverIssuer)
+    auto const mptKeylet = keylet::mptoken(issuanceKey.key, receiver);
+    if (!ctx.view.exists(mptKeylet) && createAsset && !receiverIssuer)
     {
-        if (std::uint32_t const ownerCount = {sleDest->at(sfOwnerCount)};
-            xrpBalance < view.fees().accountReserve(ownerCount + 1))
-        {
-            return tecINSUFFICIENT_RESERVE;
-        }
+        auto const sponsorSle = getEffectiveTxReserveSponsor(ctx, sleDest);
+        if (!sponsorSle)
+            return sponsorSle.error();  // LCOV_EXCL_LINE
 
-        if (auto const ter = createMPToken(view, mptID, receiver, 0); !isTesSuccess(ter))
+        if (auto const ret = checkReserve(
+                ctx, sleDest, xrpBalance, *sponsorSle, {.ownerCountDelta = 1}, journal);
+            !isTesSuccess(ret))
+            return ret;
+
+        if (auto const ter = createMPToken(ctx.view, mptID, receiver, *sponsorSle, 0);
+            !isTesSuccess(ter))
         {
             return ter;  // LCOV_EXCL_LINE
         }
 
         // update owner count.
-        adjustOwnerCount(view, sleDest, 1, journal);
+        increaseOwnerCount(ctx.view, sleDest, *sponsorSle, 1, journal);
     }
 
-    if (!view.exists(keylet::mptoken(issuanceKey.key, receiver)) && !receiverIssuer)
+    if (!ctx.view.exists(mptKeylet) && !receiverIssuer)
         return tecNO_PERMISSION;
 
-    auto const xferRate = transferRate(view, amount);
+    auto const xferRate = transferRate(ctx.view, amount);
     // update if issuer rate is less than locked rate
     if (xferRate < lockedRate)
         lockedRate = xferRate;
@@ -232,11 +247,11 @@ escrowUnlockApplyHelper<MPTIssue>(
         finalAmt = amount.value() - xferFee;
     }
     return unlockEscrowMPT(
-        view,
+        ctx.view,
         sender,
         receiver,
         finalAmt,
-        view.rules().enabled(fixTokenEscrowV1) ? amount : finalAmt,
+        ctx.view.rules().enabled(fixTokenEscrowV1) ? amount : finalAmt,
         journal);
 }
 
diff --git a/include/xrpl/ledger/helpers/MPTokenHelpers.h b/include/xrpl/ledger/helpers/MPTokenHelpers.h
index a725871231..8a2a4a5b84 100644
--- a/include/xrpl/ledger/helpers/MPTokenHelpers.h
+++ b/include/xrpl/ledger/helpers/MPTokenHelpers.h
@@ -86,7 +86,7 @@ canAddHolding(ReadView const& view, MPTIssue const& mptIssue);
 
 [[nodiscard]] TER
 authorizeMPToken(
-    ApplyView& view,
+    ApplyViewContext ctx,
     XRPAmount const& priorBalance,
     MPTID const& mptIssuanceID,
     AccountID const& account,
@@ -117,7 +117,7 @@ requireAuth(
  */
 [[nodiscard]] TER
 enforceMPTokenAuthorization(
-    ApplyView& view,
+    ApplyViewContext ctx,
     MPTID const& mptIssuanceID,
     AccountID const& account,
     XRPAmount const& priorBalance,
@@ -203,7 +203,7 @@ canMPTTradeAndTransfer(
 
 [[nodiscard]] TER
 addEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     XRPAmount priorBalance,
     MPTIssue const& mptIssue,
@@ -211,7 +211,7 @@ addEmptyHolding(
 
 [[nodiscard]] TER
 removeEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     MPTIssue const& mptIssue,
     beast::Journal journal);
@@ -243,6 +243,7 @@ createMPToken(
     ApplyView& view,
     MPTID const& mptIssuanceID,
     AccountID const& account,
+    SLE::ref sponsorSle,
     std::uint32_t const flags);
 
 TER
@@ -250,6 +251,7 @@ checkCreateMPT(
     xrpl::ApplyView& view,
     xrpl::MPTIssue const& mptIssue,
     xrpl::AccountID const& holder,
+    SLE::ref sponsorSle,
     beast::Journal j);
 
 //------------------------------------------------------------------------------
diff --git a/include/xrpl/ledger/helpers/OracleHelpers.h b/include/xrpl/ledger/helpers/OracleHelpers.h
new file mode 100644
index 0000000000..da04618e46
--- /dev/null
+++ b/include/xrpl/ledger/helpers/OracleHelpers.h
@@ -0,0 +1,31 @@
+#pragma once
+
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STArray.h>  // IWYU pragma: keep
+#include <xrpl/protocol/STLedgerEntry.h>
+
+#include <cstddef>
+#include <cstdint>
+
+namespace xrpl {
+
+constexpr std::uint32_t kMinOracleReserveCount = 1;
+constexpr std::uint32_t kMaxOracleReserveCount = 2;
+constexpr std::size_t kOracleReserveCountThreshold = 5;
+
+template <typename T>
+    requires requires(T const& t) { t.size(); }
+inline std::uint32_t
+calculateOracleReserve(T const& priceDataSeries)
+{
+    return priceDataSeries.size() > kOracleReserveCountThreshold ? kMaxOracleReserveCount
+                                                                 : kMinOracleReserveCount;
+}
+
+inline std::uint32_t
+calculateOracleReserve(SLE::const_ref oracleSle)
+{
+    return calculateOracleReserve(oracleSle->getFieldArray(sfPriceDataSeries));
+}
+
+}  // namespace xrpl
diff --git a/include/xrpl/ledger/helpers/RippleStateHelpers.h b/include/xrpl/ledger/helpers/RippleStateHelpers.h
index ab09b931cc..398ec86bb7 100644
--- a/include/xrpl/ledger/helpers/RippleStateHelpers.h
+++ b/include/xrpl/ledger/helpers/RippleStateHelpers.h
@@ -156,6 +156,7 @@ trustCreate(
                                 // Issuer should be the account being set.
     std::uint32_t uQualityIn,
     std::uint32_t uQualityOut,
+    SLE::ref sponsorSle,
     beast::Journal j);
 
 [[nodiscard]] TER
@@ -178,6 +179,7 @@ issueIOU(
     AccountID const& account,
     STAmount const& amount,
     Issue const& issue,
+    SLE::ref sponsorSle,
     beast::Journal j);
 
 [[nodiscard]] TER
@@ -235,7 +237,7 @@ canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, Acc
 /// canAddHolding() in preflight with the same View and Asset
 [[nodiscard]] TER
 addEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     XRPAmount priorBalance,
     Issue const& issue,
@@ -243,7 +245,7 @@ addEmptyHolding(
 
 [[nodiscard]] TER
 removeEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     Issue const& issue,
     beast::Journal journal);
diff --git a/include/xrpl/ledger/helpers/SponsorHelpers.h b/include/xrpl/ledger/helpers/SponsorHelpers.h
new file mode 100644
index 0000000000..fd2315b024
--- /dev/null
+++ b/include/xrpl/ledger/helpers/SponsorHelpers.h
@@ -0,0 +1,184 @@
+#pragma once
+
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/TxFormats.h>
+
+#include <cstdint>
+#include <expected>
+#include <optional>
+
+namespace xrpl {
+
+/** Whether the given transaction type may use reserve sponsorship (v1).
+ *
+ *  Reserve sponsorship is restricted to an explicit allow-list of transaction
+ *  types; all others reject spfSponsorReserve at preflight.
+ */
+bool
+isReserveSponsorAllowed(TxType txType);
+
+/** Whether the transaction's fee is sponsored (sfSponsor present + spfSponsorFee set). */
+inline bool
+isFeeSponsored(STTx const& tx)
+{
+    return tx.isFieldPresent(sfSponsor) && ((tx.getFieldU32(sfSponsorFlags) & spfSponsorFee) != 0u);
+}
+
+/** Whether the transaction's reserve is sponsored (sfSponsor present + spfSponsorReserve set). */
+inline bool
+isReserveSponsored(STTx const& tx)
+{
+    return tx.isFieldPresent(sfSponsor) &&
+        ((tx.getFieldU32(sfSponsorFlags) & spfSponsorReserve) != 0u);
+}
+
+/** Return the AccountID of the transaction's reserve sponsor, or nullopt if unsponsored. */
+std::optional<AccountID>
+getTxReserveSponsorID(STTx const& tx);
+
+/** Return a mutable SLE for the transaction's reserve sponsor account.
+ *
+ *  @param ctx The apply-view context (view + tx)
+ *  @return The sponsor account SLE, a null pointer if the tx is not
+ *          reserve-sponsored, or tecINTERNAL if the sponsor account cannot
+ *          be loaded (an already-checked invariant).
+ */
+std::expected<SLE::pointer, TER>
+getTxReserveSponsor(ApplyViewContext ctx);
+
+/** Return a read-only SLE for the transaction's reserve sponsor account.
+ *
+ *  @param view The ledger read view
+ *  @param tx   The transaction to inspect
+ *  @return The sponsor account SLE, a null pointer if the tx is not
+ *          reserve-sponsored, or tecINTERNAL if the sponsor account cannot
+ *          be loaded (an already-checked invariant).
+ */
+std::expected<SLE::const_pointer, TER>
+getTxReserveSponsor(ReadView const& view, STTx const& tx);
+
+/** The transaction's reserve sponsor for the given account, if applicable.
+ *
+ *  A reserve sponsor only covers the transaction submitter's own objects, so
+ *  this returns the tx reserve sponsor SLE only when accountSle is the tx's own
+ *  (non-pseudo) account; otherwise it returns a null sponsor pointer. This is
+ *  the single source of truth for the "sponsor applies to tx.Account only" rule
+ *  that the sponsor-deriving helper overloads in AccountRootHelpers rely on.
+ *
+ *  @param ctx The apply-view context (view + tx)
+ *  @param accountSle The account whose sponsor is being resolved
+ *  @return The sponsor SLE (nullptr if unsponsored), or tecINTERNAL if the
+ *          sponsor account cannot be loaded (an already-checked invariant)
+ */
+[[nodiscard]] std::expected<SLE::pointer, TER>
+getEffectiveTxReserveSponsor(ApplyViewContext ctx, SLE::const_ref accountSle);
+
+/** Return the AccountID stored in the given sponsor field of a ledger entry, or nullopt if absent.
+ */
+std::optional<AccountID>
+getLedgerEntryReserveSponsorID(SLE::const_ref sle, SF_ACCOUNT const& field = sfSponsor);
+
+/** Return a mutable SLE for the reserve sponsor recorded on a ledger entry.
+ *
+ *  Reads the sponsor AccountID from @p field on @p sle and peeks the
+ *  corresponding account root in @p view.
+ *
+ *  @param view  The mutable apply view
+ *  @param sle   The ledger entry whose sponsor field is inspected
+ *  @param field The field that holds the sponsor AccountID (defaults to sfSponsor)
+ *  @return The sponsor account SLE, or a null pointer if the entry is unsponsored.
+ */
+SLE::pointer
+getLedgerEntryReserveSponsor(
+    ApplyView& view,
+    SLE::const_ref sle,
+    SF_ACCOUNT const& field = sfSponsor);
+
+/** Stamp a reserve sponsor onto a ledger entry using an explicit sponsor SLE.
+ *
+ *  Sets @p field on @p sle to the AccountID from @p sponsorSle. A no-op when
+ *  @p sponsorSle is null (unsponsored). For RippleState entries the field must
+ *  be sfHighSponsor or sfLowSponsor; for all other entry types it must be
+ *  sfSponsor.
+ *
+ *  @param sle       The ledger entry to stamp
+ *  @param sponsorSle The sponsor's account root SLE (null → no-op)
+ *  @param field     The sponsor field to set (defaults to sfSponsor)
+ */
+void
+addSponsorToLedgerEntry(
+    SLE::ref sle,
+    SLE::const_ref sponsorSle,
+    SF_ACCOUNT const& field = sfSponsor);
+
+/** Stamp the transaction's reserve sponsor onto a newly-created ledger entry.
+ *
+ *  Equivalent to the overload above, but resolves the sponsor via
+ *  getTxReserveSponsor(ctx) instead of taking it explicitly. A no-op when the
+ *  transaction is not reserve-sponsored. The entry is assumed to be owned by
+ *  the transaction submitter, which is the only account a tx reserve sponsor
+ *  can cover.
+ */
+void
+addSponsorToLedgerEntry(ApplyViewContext ctx, SLE::ref sle, SF_ACCOUNT const& field = sfSponsor);
+
+/** Remove the reserve sponsor field from a ledger entry.
+ *
+ *  A no-op when @p field is not present on @p sle. For RippleState entries
+ *  the field must be sfHighSponsor or sfLowSponsor; for all other entry types
+ *  it must be sfSponsor.
+ *
+ *  @param sle   The ledger entry to modify
+ *  @param field The sponsor field to clear (defaults to sfSponsor)
+ */
+void
+removeSponsorFromLedgerEntry(SLE::ref sle, SF_ACCOUNT const& field = sfSponsor);
+
+/** Whether @p account is the owner of a ledger entry for sponsorship purposes.
+ *
+ *  Ownership rules vary by entry type. For RippleState entries the owner is
+ *  whichever side of the trust line holds the reserve. For credentials, the
+ *  owner is the subject once accepted and the issuer before acceptance.
+ *
+ *  @param view    The ledger read view (used for SignerList lookup)
+ *  @param sle     The ledger entry whose owner is checked
+ *  @param account The candidate account to match against
+ *  @return true if @p account owns @p sle, false otherwise.
+ */
+bool
+isLedgerEntryOwner(ReadView const& view, SLE const& sle, AccountID const& account);
+
+/** Whether this ledger entry type can have a reserve sponsor attached to it. */
+bool
+isLedgerEntrySupportedBySponsorship(SLE const& sle);
+
+/** Return the number of owner-count units the ledger entry consumes.
+ *
+ *  Most entries cost 1. Exceptions: Oracles scale with their price-data series
+ *  size, Vaults cost 2 (vault + pseudo-account), and legacy SignerList entries
+ *  (pre-MultiSignReserve) cost 2 + signer count.
+ */
+std::uint32_t
+getLedgerEntryOwnerCount(SLE const& sle);
+
+/** Return the SField used to store the reserve sponsor for @p owner on @p sle.
+ *
+ *  For most entry types this is sfSponsor. RippleState entries use
+ *  sfHighSponsor or sfLowSponsor depending on which side of the trust line
+ *  @p owner holds.
+ *
+ *  @param sle   The ledger entry
+ *  @param owner The account whose sponsor field is needed
+ *  @return sfHighSponsor, sfLowSponsor, or sfSponsor as appropriate.
+ */
+SF_ACCOUNT const&
+getLedgerEntrySponsorField(SLE const& sle, AccountID const& owner);
+
+}  // namespace xrpl
diff --git a/include/xrpl/ledger/helpers/TokenHelpers.h b/include/xrpl/ledger/helpers/TokenHelpers.h
index 32f785a0d6..33d9761d84 100644
--- a/include/xrpl/ledger/helpers/TokenHelpers.h
+++ b/include/xrpl/ledger/helpers/TokenHelpers.h
@@ -10,6 +10,7 @@
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/XRPAmount.h>
@@ -302,7 +303,7 @@ canAddHolding(ReadView const& view, Asset const& asset);
 
 [[nodiscard]] TER
 addEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     XRPAmount priorBalance,
     Asset const& asset,
@@ -310,7 +311,7 @@ addEmptyHolding(
 
 [[nodiscard]] TER
 removeEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     Asset const& asset,
     beast::Journal journal);
@@ -371,6 +372,7 @@ accountSend(
     AccountID const& to,
     STAmount const& saAmount,
     beast::Journal j,
+    SLE::ref sponsorSle = {},
     WaiveTransferFee waiveFee = WaiveTransferFee::No,
     AllowMPTOverflow allowOverflow = AllowMPTOverflow::No);
 
diff --git a/include/xrpl/protocol/Book.h b/include/xrpl/protocol/Book.h
index 476bdba35a..92d1353929 100644
--- a/include/xrpl/protocol/Book.h
+++ b/include/xrpl/protocol/Book.h
@@ -74,9 +74,9 @@ operator==(Book const& lhs, Book const& rhs)
 [[nodiscard]] constexpr std::weak_ordering
 operator<=>(Book const& lhs, Book const& rhs)
 {
-    if (auto const c{lhs.in <=> rhs.in}; c != 0)
+    if (auto const c{lhs.in <=> rhs.in}; c != 0)  // NOLINT(modernize-use-nullptr)
         return c;
-    if (auto const c{lhs.out <=> rhs.out}; c != 0)
+    if (auto const c{lhs.out <=> rhs.out}; c != 0)  // NOLINT(modernize-use-nullptr)
         return c;
 
     // Manually compare optionals
diff --git a/include/xrpl/protocol/Fees.h b/include/xrpl/protocol/Fees.h
index 4e79204f4c..2f9159cd9b 100644
--- a/include/xrpl/protocol/Fees.h
+++ b/include/xrpl/protocol/Fees.h
@@ -2,7 +2,6 @@
 
 #include <xrpl/protocol/XRPAmount.h>
 
-#include <cstddef>
 #include <cstdint>
 
 namespace xrpl {
@@ -39,13 +38,13 @@ struct Fees
 
     /** Returns the account reserve given the owner count, in drops.
 
-        The reserve is calculated as the reserve base plus
-        the reserve increment times the number of increments.
+        The reserve is calculated as the reserve base times the number of accounts plus the reserve
+        increment times the number of increments.
     */
     [[nodiscard]] XRPAmount
-    accountReserve(std::size_t ownerCount) const
+    accountReserve(std::uint32_t ownerCount, std::uint32_t accountCount) const
     {
-        return reserve + ownerCount * increment;
+        return (reserve * accountCount) + (increment * ownerCount);
     }
 };
 
diff --git a/include/xrpl/protocol/Indexes.h b/include/xrpl/protocol/Indexes.h
index 053a66787f..79ecd05ad5 100644
--- a/include/xrpl/protocol/Indexes.h
+++ b/include/xrpl/protocol/Indexes.h
@@ -142,6 +142,10 @@ ticket(uint256 const& key)
 Keylet
 signerList(AccountID const& account) noexcept;
 
+/** A Sponsorship */
+Keylet
+sponsorship(AccountID const& sponsor, AccountID const& sponsee) noexcept;
+
 /** A Check */
 /** @{ */
 Keylet
diff --git a/include/xrpl/protocol/Issue.h b/include/xrpl/protocol/Issue.h
index 3d556e83eb..a4980404cd 100644
--- a/include/xrpl/protocol/Issue.h
+++ b/include/xrpl/protocol/Issue.h
@@ -84,7 +84,7 @@ operator==(Issue const& lhs, Issue const& rhs)
 [[nodiscard]] constexpr std::weak_ordering
 operator<=>(Issue const& lhs, Issue const& rhs)
 {
-    if (auto const c{lhs.currency <=> rhs.currency}; c != 0)
+    if (auto const c{lhs.currency <=> rhs.currency}; c != 0)  // NOLINT(modernize-use-nullptr)
         return c;
 
     if (isXRP(lhs.currency))
diff --git a/include/xrpl/protocol/LedgerFormats.h b/include/xrpl/protocol/LedgerFormats.h
index 5b8a8cc2c5..142e5763be 100644
--- a/include/xrpl/protocol/LedgerFormats.h
+++ b/include/xrpl/protocol/LedgerFormats.h
@@ -208,7 +208,11 @@ enum LedgerEntryType : std::uint16_t {
     LEDGER_OBJECT(Loan,                                                                                                            \
         LSF_FLAG(lsfLoanDefault, 0x00010000)                                                                                       \
         LSF_FLAG(lsfLoanImpaired, 0x00020000)                                                                                      \
-        LSF_FLAG(lsfLoanOverpayment, 0x00040000))               /* True, loan allows overpayments */
+        LSF_FLAG(lsfLoanOverpayment, 0x00040000))               /* True, loan allows overpayments */                               \
+                                                                                                                                   \
+    LEDGER_OBJECT(Sponsorship,                                                                                                     \
+        LSF_FLAG(lsfSponsorshipRequireSignForFee, 0x00010000)                                                                      \
+        LSF_FLAG(lsfSponsorshipRequireSignForReserve, 0x00020000))
 
 // clang-format on
 
diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index fe5c611648..9abf56e91b 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -229,10 +229,10 @@ public:
     [[nodiscard]] AccountID
     getAccountID(SField const& field) const;
 
-    /** The account responsible for the fee and authorization: the delegate when
+    /** The account responsible for the authorization: the delegate when
         sfDelegate is present, otherwise the account. */
     [[nodiscard]] AccountID
-    getFeePayer() const;
+    getInitiator() const;
 
     [[nodiscard]] Blob
     getFieldVL(SField const& field) const;
diff --git a/include/xrpl/protocol/STTx.h b/include/xrpl/protocol/STTx.h
index b36207bf61..5d5424e623 100644
--- a/include/xrpl/protocol/STTx.h
+++ b/include/xrpl/protocol/STTx.h
@@ -141,6 +141,9 @@ public:
     [[nodiscard]] std::vector<uint256> const&
     getBatchTransactionIDs() const;
 
+    [[nodiscard]] AccountID
+    getFeePayerID() const;
+
 private:
     /** Check the signature.
         @param rules The current ledger rules.
diff --git a/include/xrpl/protocol/TER.h b/include/xrpl/protocol/TER.h
index 54b081f358..730d021254 100644
--- a/include/xrpl/protocol/TER.h
+++ b/include/xrpl/protocol/TER.h
@@ -225,6 +225,7 @@ enum TERcodes : TERUnderlyingType {
                                 // create a pseudo-account
     terNO_DELEGATE_PERMISSION,  // Delegate does not have permission
     terLOCKED,                  // MPT is locked
+    terNO_PERMISSION,           // No permission but retry
 };
 
 //------------------------------------------------------------------------------
@@ -368,6 +369,7 @@ enum TECcodes : TERUnderlyingType {
     // reclaimed after those networks reset.
     tecNO_DELEGATE_PERMISSION = 198,
     tecBAD_PROOF = 199,
+    tecNO_SPONSOR_PERMISSION = 200,
 };
 
 //------------------------------------------------------------------------------
diff --git a/include/xrpl/protocol/TxFlags.h b/include/xrpl/protocol/TxFlags.h
index 461afd24e7..1d4f33a39d 100644
--- a/include/xrpl/protocol/TxFlags.h
+++ b/include/xrpl/protocol/TxFlags.h
@@ -102,7 +102,8 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
     TRANSACTION(Payment,                                                                                                                                       \
         TF_FLAG(tfNoRippleDirect, 0x00010000)                                                                                                                  \
         TF_FLAG(tfPartialPayment, 0x00020000)                                                                                                                  \
-        TF_FLAG(tfLimitQuality, 0x00040000),                                                                                                                   \
+        TF_FLAG(tfLimitQuality, 0x00040000)                                                                                                                    \
+        TF_FLAG(tfSponsorCreatedAccount, 0x00080000),                                                                                                          \
         MASK_ADJ(0))                                                                                                                                           \
                                                                                                                                                                \
     TRANSACTION(TrustSet,                                                                                                                                      \
@@ -141,7 +142,7 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
         TF_FLAG(tfMPTCanTrade, lsfMPTCanTrade)                                                                                                                 \
         TF_FLAG(tfMPTCanTransfer, lsfMPTCanTransfer)                                                                                                           \
         TF_FLAG(tfMPTCanClawback, lsfMPTCanClawback)                                                                                                           \
-        TF_FLAG(tfMPTCanHoldConfidentialBalance, lsfMPTCanHoldConfidentialBalance),                                                                                                            \
+        TF_FLAG(tfMPTCanHoldConfidentialBalance, lsfMPTCanHoldConfidentialBalance),                                                                            \
         MASK_ADJ(0))                                                                                                                                           \
                                                                                                                                                                \
     TRANSACTION(MPTokenAuthorize,                                                                                                                              \
@@ -215,6 +216,20 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
         TF_FLAG(tfLoanDefault, 0x00010000)                                                                                                                     \
         TF_FLAG(tfLoanImpair, 0x00020000)                                                                                                                      \
         TF_FLAG(tfLoanUnimpair, 0x00040000),                                                                                                                   \
+        MASK_ADJ(0))                                                                                                                                           \
+                                                                                                                                                               \
+    TRANSACTION(SponsorshipSet,                                                                                                                                \
+        TF_FLAG(tfSponsorshipSetRequireSignForFee, 0x00010000)                                                                                                 \
+        TF_FLAG(tfSponsorshipClearRequireSignForFee, 0x00020000)                                                                                               \
+        TF_FLAG(tfSponsorshipSetRequireSignForReserve, 0x00040000)                                                                                             \
+        TF_FLAG(tfSponsorshipClearRequireSignForReserve, 0x00080000)                                                                                           \
+        TF_FLAG(tfDeleteObject, 0x00100000),                                                                                                                   \
+        MASK_ADJ(0))                                                                                                                                           \
+                                                                                                                                                               \
+    TRANSACTION(SponsorshipTransfer,                                                                                                                           \
+        TF_FLAG(tfSponsorshipEnd, 0x00010000)                                                                                                                  \
+        TF_FLAG(tfSponsorshipCreate, 0x00020000)                                                                                                               \
+        TF_FLAG(tfSponsorshipReassign, 0x00040000),                                                                                                            \
         MASK_ADJ(0))
 
 // clang-format on
@@ -444,6 +459,12 @@ getAsfFlagMap()
 #pragma pop_macro("ACCOUNTSET_FLAG_TO_MAP")
 #pragma pop_macro("ACCOUNTSET_FLAGS")
 
+// Sponsor flags (spf)
+
+inline constexpr FlagValue spfSponsorFee = 1;
+inline constexpr FlagValue spfSponsorReserve = 2;
+inline constexpr FlagValue spfSponsorFlagMask = ~(spfSponsorFee | spfSponsorReserve);
+
 }  // namespace xrpl
 
 // NOLINTEND(readability-identifier-naming)
diff --git a/include/xrpl/protocol/detail/features.macro b/include/xrpl/protocol/detail/features.macro
index 3f078561a3..bfe03a6303 100644
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -15,6 +15,7 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
 
+XRPL_FEATURE(Sponsor,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(LendingProtocolV1_1,         Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(ConfidentialTransfer,        Supported::Yes, VoteBehavior::DefaultNo)
diff --git a/include/xrpl/protocol/detail/ledger_entries.macro b/include/xrpl/protocol/detail/ledger_entries.macro
index 2f403708c3..90810e06d2 100644
--- a/include/xrpl/protocol/detail/ledger_entries.macro
+++ b/include/xrpl/protocol/detail/ledger_entries.macro
@@ -127,29 +127,32 @@ LEDGER_ENTRY(ltTICKET, 0x0054, Ticket, ticket, ({
     \sa keylet::account
  */
 LEDGER_ENTRY(ltACCOUNT_ROOT, 0x0061, AccountRoot, account, ({
-    {sfAccount,              SoeRequired},
-    {sfSequence,             SoeRequired},
-    {sfBalance,              SoeRequired},
-    {sfOwnerCount,           SoeRequired},
-    {sfPreviousTxnID,        SoeRequired},
-    {sfPreviousTxnLgrSeq,    SoeRequired},
-    {sfAccountTxnID,         SoeOptional},
-    {sfRegularKey,           SoeOptional},
-    {sfEmailHash,            SoeOptional},
-    {sfWalletLocator,        SoeOptional},
-    {sfWalletSize,           SoeOptional},
-    {sfMessageKey,           SoeOptional},
-    {sfTransferRate,         SoeOptional},
-    {sfDomain,               SoeOptional},
-    {sfTickSize,             SoeOptional},
-    {sfTicketCount,          SoeOptional},
-    {sfNFTokenMinter,        SoeOptional},
-    {sfMintedNFTokens,       SoeDefault},
-    {sfBurnedNFTokens,       SoeDefault},
-    {sfFirstNFTokenSequence, SoeOptional},
-    {sfAMMID,                SoeOptional}, // pseudo-account designator
-    {sfVaultID,              SoeOptional}, // pseudo-account designator
-    {sfLoanBrokerID,         SoeOptional}, // pseudo-account designator
+    {sfAccount,                SoeRequired},
+    {sfSequence,               SoeRequired},
+    {sfBalance,                SoeRequired},
+    {sfOwnerCount,             SoeRequired},
+    {sfPreviousTxnID,          SoeRequired},
+    {sfPreviousTxnLgrSeq,      SoeRequired},
+    {sfAccountTxnID,           SoeOptional},
+    {sfRegularKey,             SoeOptional},
+    {sfEmailHash,              SoeOptional},
+    {sfWalletLocator,          SoeOptional},
+    {sfWalletSize,             SoeOptional},
+    {sfMessageKey,             SoeOptional},
+    {sfTransferRate,           SoeOptional},
+    {sfDomain,                 SoeOptional},
+    {sfTickSize,               SoeOptional},
+    {sfTicketCount,            SoeOptional},
+    {sfNFTokenMinter,          SoeOptional},
+    {sfMintedNFTokens,         SoeDefault},
+    {sfBurnedNFTokens,         SoeDefault},
+    {sfFirstNFTokenSequence,   SoeOptional},
+    {sfSponsoredOwnerCount,    SoeDefault},
+    {sfSponsoringOwnerCount,   SoeDefault},
+    {sfSponsoringAccountCount, SoeDefault},
+    {sfAMMID,                  SoeOptional}, // pseudo-account designator
+    {sfVaultID,                SoeOptional}, // pseudo-account designator
+    {sfLoanBrokerID,           SoeOptional}, // pseudo-account designator
 }))
 
 /** A ledger object which contains a list of object identifiers.
@@ -286,6 +289,8 @@ LEDGER_ENTRY(ltRIPPLE_STATE, 0x0072, RippleState, state, ({
     {sfHighNode,             SoeOptional},
     {sfHighQualityIn,        SoeOptional},
     {sfHighQualityOut,       SoeOptional},
+    {sfHighSponsor,          SoeOptional},
+    {sfLowSponsor,           SoeOptional},
 }))
 
 /** The ledger object which lists the network's fee settings.
@@ -616,5 +621,20 @@ LEDGER_ENTRY(ltLOAN, 0x0089, Loan, loan, ({
     {sfLoanScale,                SoeDefault},
 }))
 
+/** A ledger object representing a sponsorship.
+    \sa keylet::sponsorship
+ */
+LEDGER_ENTRY(ltSPONSORSHIP, 0x0090, Sponsorship, sponsorship, ({
+    {sfPreviousTxnID,        SoeRequired},
+    {sfPreviousTxnLgrSeq,    SoeRequired},
+    {sfOwner,                SoeRequired},
+    {sfSponsee,              SoeRequired},
+    {sfFeeAmount,            SoeOptional},
+    {sfMaxFee,               SoeOptional},
+    {sfRemainingOwnerCount,  SoeDefault},
+    {sfOwnerNode,            SoeRequired},
+    {sfSponseeNode,          SoeRequired},
+}))
+
 #undef EXPAND
 #undef LEDGER_ENTRY_DUPLICATE
diff --git a/include/xrpl/protocol/detail/sfields.macro b/include/xrpl/protocol/detail/sfields.macro
index 0d453eea11..4ef76c8b75 100644
--- a/include/xrpl/protocol/detail/sfields.macro
+++ b/include/xrpl/protocol/detail/sfields.macro
@@ -114,6 +114,11 @@ TYPED_SFIELD(sfLateInterestRate,         UINT32,    66) // 1/10 basis points (bi
 TYPED_SFIELD(sfCloseInterestRate,        UINT32,    67) // 1/10 basis points (bips)
 TYPED_SFIELD(sfOverpaymentInterestRate,  UINT32,    68) // 1/10 basis points (bips)
 TYPED_SFIELD(sfConfidentialBalanceVersion, UINT32,  69)
+TYPED_SFIELD(sfSponsoredOwnerCount,      UINT32,    70)
+TYPED_SFIELD(sfSponsoringOwnerCount,     UINT32,    71)
+TYPED_SFIELD(sfSponsoringAccountCount,   UINT32,    72)
+TYPED_SFIELD(sfRemainingOwnerCount,      UINT32,    73)
+TYPED_SFIELD(sfSponsorFlags,             UINT32,    74)
 
 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)
@@ -148,6 +153,7 @@ TYPED_SFIELD(sfLockedAmount,             UINT64,    29, SField::kSmdBaseTen|SFie
 TYPED_SFIELD(sfVaultNode,                UINT64,    30)
 TYPED_SFIELD(sfLoanBrokerNode,           UINT64,    31)
 TYPED_SFIELD(sfConfidentialOutstandingAmount, UINT64, 32, SField::kSmdBaseTen|SField::kSmdDefault)
+TYPED_SFIELD(sfSponseeNode,              UINT64,    33)
 
 // 128-bit
 TYPED_SFIELD(sfEmailHash,                UINT128,    1)
@@ -209,6 +215,7 @@ TYPED_SFIELD(sfLoanBrokerID,             UINT256,   37,
 TYPED_SFIELD(sfLoanID,                   UINT256,   38)
 TYPED_SFIELD(sfReferenceHolding,         UINT256,   39)
 TYPED_SFIELD(sfBlindingFactor,           UINT256,   40)
+TYPED_SFIELD(sfObjectID,                 UINT256,   41)
 
 // number (common)
 TYPED_SFIELD(sfNumber,                   NUMBER,     1)
@@ -268,6 +275,8 @@ TYPED_SFIELD(sfPrice,                    AMOUNT,    28)
 TYPED_SFIELD(sfSignatureReward,          AMOUNT,    29)
 TYPED_SFIELD(sfMinAccountCreateAmount,   AMOUNT,    30)
 TYPED_SFIELD(sfLPTokenBalance,           AMOUNT,    31)
+TYPED_SFIELD(sfFeeAmount,                AMOUNT,    32)
+TYPED_SFIELD(sfMaxFee,                   AMOUNT,    33)
 
 // variable length (common)
 TYPED_SFIELD(sfPublicKey,                VL,         1)
@@ -343,6 +352,11 @@ TYPED_SFIELD(sfIssuingChainDoor,         ACCOUNT,   23)
 TYPED_SFIELD(sfSubject,                  ACCOUNT,   24)
 TYPED_SFIELD(sfBorrower,                 ACCOUNT,   25)
 TYPED_SFIELD(sfCounterparty,             ACCOUNT,   26)
+TYPED_SFIELD(sfSponsor,                  ACCOUNT,   27)
+TYPED_SFIELD(sfHighSponsor,              ACCOUNT,   28)
+TYPED_SFIELD(sfLowSponsor,               ACCOUNT,   29)
+TYPED_SFIELD(sfCounterpartySponsor,      ACCOUNT,   30)
+TYPED_SFIELD(sfSponsee,                  ACCOUNT,   31)
 
 // vector of 256-bit
 TYPED_SFIELD(sfIndexes,                  VECTOR256,  1, SField::kSmdNever)
@@ -407,6 +421,7 @@ UNTYPED_SFIELD(sfRawTransaction,         OBJECT,    34)
 UNTYPED_SFIELD(sfBatchSigner,            OBJECT,    35)
 UNTYPED_SFIELD(sfBook,                   OBJECT,    36)
 UNTYPED_SFIELD(sfCounterpartySignature,  OBJECT,    37, SField::kSmdDefault, SField::kNotSigning)
+UNTYPED_SFIELD(sfSponsorSignature,       OBJECT,    38, SField::kSmdDefault, SField::kNotSigning)
 
 // array of objects (common)
 // ARRAY/1 is reserved for end of array
diff --git a/include/xrpl/protocol/detail/transactions.macro b/include/xrpl/protocol/detail/transactions.macro
index b0c4f66bae..e805596c00 100644
--- a/include/xrpl/protocol/detail/transactions.macro
+++ b/include/xrpl/protocol/detail/transactions.macro
@@ -1165,6 +1165,35 @@ TRANSACTION(ttCONFIDENTIAL_MPT_CLAWBACK, 89, ConfidentialMPTClawback,
     {sfZKProof, SoeRequired},
 }))
 
+/** This transaction transfers sponsorship on an object/account. */
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/sponsor/SponsorshipTransfer.h>
+#endif
+TRANSACTION(ttSPONSORSHIP_TRANSFER, 90, SponsorshipTransfer,
+    Delegation::NotDelegable,
+    featureSponsor,
+    NoPriv,
+    ({
+    {sfObjectID, SoeOptional},
+    {sfSponsee, SoeOptional},
+}))
+
+/** This transaction creates a Sponsorship object. */
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/sponsor/SponsorshipSet.h>
+#endif
+TRANSACTION(ttSPONSORSHIP_SET, 91, SponsorshipSet,
+    Delegation::Delegable,
+    featureSponsor,
+    NoPriv,
+    ({
+    {sfCounterpartySponsor, SoeOptional},
+    {sfSponsee, SoeOptional},
+    {sfFeeAmount, SoeOptional},
+    {sfMaxFee, SoeOptional},
+    {sfRemainingOwnerCount, SoeOptional},
+}))
+
 /** This system-generated transaction type is used to update the status of the various amendments.
 
     For details, see: https://xrpl.org/amendments.html
diff --git a/include/xrpl/protocol/jss.h b/include/xrpl/protocol/jss.h
index 191ed385f3..b20b71661a 100644
--- a/include/xrpl/protocol/jss.h
+++ b/include/xrpl/protocol/jss.h
@@ -558,6 +558,9 @@ JSS(source_account);              // in: PathRequest, RipplePathFind
 JSS(source_amount);               // in: PathRequest, RipplePathFind
 JSS(source_currencies);           // in: PathRequest, RipplePathFind
 JSS(source_tag);                  // out: AccountChannels
+JSS(sponsee);                     // in: LedgerEntry
+JSS(sponsor);                     // in: LedgerEntry
+JSS(sponsored);                   // in: AccountObjects
 JSS(stand_alone);                 // out: NetworkOPs
 JSS(standard_deviation);          // out: get_aggregate_price
 JSS(start);                       // in: TxHistory
diff --git a/include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h b/include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h
index f9a12a027f..725f46437e 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h
@@ -447,6 +447,78 @@ public:
         return this->sle_->isFieldPresent(sfFirstNFTokenSequence);
     }
 
+    /**
+     * @brief Get sfSponsoredOwnerCount (SoeDefault)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getSponsoredOwnerCount() const
+    {
+        if (hasSponsoredOwnerCount())
+            return this->sle_->at(sfSponsoredOwnerCount);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfSponsoredOwnerCount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasSponsoredOwnerCount() const
+    {
+        return this->sle_->isFieldPresent(sfSponsoredOwnerCount);
+    }
+
+    /**
+     * @brief Get sfSponsoringOwnerCount (SoeDefault)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getSponsoringOwnerCount() const
+    {
+        if (hasSponsoringOwnerCount())
+            return this->sle_->at(sfSponsoringOwnerCount);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfSponsoringOwnerCount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasSponsoringOwnerCount() const
+    {
+        return this->sle_->isFieldPresent(sfSponsoringOwnerCount);
+    }
+
+    /**
+     * @brief Get sfSponsoringAccountCount (SoeDefault)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getSponsoringAccountCount() const
+    {
+        if (hasSponsoringAccountCount())
+            return this->sle_->at(sfSponsoringAccountCount);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfSponsoringAccountCount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasSponsoringAccountCount() const
+    {
+        return this->sle_->isFieldPresent(sfSponsoringAccountCount);
+    }
+
     /**
      * @brief Get sfAMMID (SoeOptional)
      * @return The field value, or std::nullopt if not present.
@@ -786,6 +858,39 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfSponsoredOwnerCount (SoeDefault)
+     * @return Reference to this builder for method chaining.
+     */
+    AccountRootBuilder&
+    setSponsoredOwnerCount(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfSponsoredOwnerCount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfSponsoringOwnerCount (SoeDefault)
+     * @return Reference to this builder for method chaining.
+     */
+    AccountRootBuilder&
+    setSponsoringOwnerCount(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfSponsoringOwnerCount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfSponsoringAccountCount (SoeDefault)
+     * @return Reference to this builder for method chaining.
+     */
+    AccountRootBuilder&
+    setSponsoringAccountCount(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfSponsoringAccountCount] = value;
+        return *this;
+    }
+
     /**
      * @brief Set sfAMMID (SoeOptional)
      * @return Reference to this builder for method chaining.
diff --git a/include/xrpl/protocol_autogen/ledger_entries/RippleState.h b/include/xrpl/protocol_autogen/ledger_entries/RippleState.h
index e8debfe792..388a062ec1 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/RippleState.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/RippleState.h
@@ -243,6 +243,54 @@ public:
     {
         return this->sle_->isFieldPresent(sfHighQualityOut);
     }
+
+    /**
+     * @brief Get sfHighSponsor (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_ACCOUNT::type::value_type>
+    getHighSponsor() const
+    {
+        if (hasHighSponsor())
+            return this->sle_->at(sfHighSponsor);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfHighSponsor is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasHighSponsor() const
+    {
+        return this->sle_->isFieldPresent(sfHighSponsor);
+    }
+
+    /**
+     * @brief Get sfLowSponsor (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_ACCOUNT::type::value_type>
+    getLowSponsor() const
+    {
+        if (hasLowSponsor())
+            return this->sle_->at(sfLowSponsor);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfLowSponsor is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasLowSponsor() const
+    {
+        return this->sle_->isFieldPresent(sfLowSponsor);
+    }
 };
 
 /**
@@ -410,6 +458,28 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfHighSponsor (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    RippleStateBuilder&
+    setHighSponsor(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfHighSponsor] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfLowSponsor (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    RippleStateBuilder&
+    setLowSponsor(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfLowSponsor] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the completed RippleState wrapper.
      * @param index The ledger entry index.
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Sponsorship.h b/include/xrpl/protocol_autogen/ledger_entries/Sponsorship.h
new file mode 100644
index 0000000000..c309a38aef
--- /dev/null
+++ b/include/xrpl/protocol_autogen/ledger_entries/Sponsorship.h
@@ -0,0 +1,344 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/LedgerEntryBase.h>
+#include <xrpl/protocol_autogen/LedgerEntryBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::ledger_entries {
+
+class SponsorshipBuilder;
+
+/**
+ * @brief Ledger Entry: Sponsorship
+ *
+ * Type: ltSPONSORSHIP (0x0090)
+ * RPC Name: sponsorship
+ *
+ * Immutable wrapper around SLE providing type-safe field access.
+ * Use SponsorshipBuilder to construct new ledger entries.
+ */
+class Sponsorship : public LedgerEntryBase
+{
+public:
+    static constexpr LedgerEntryType entryType = ltSPONSORSHIP;
+
+    /**
+     * @brief Construct a Sponsorship ledger entry wrapper from an existing SLE object.
+     * @throws std::runtime_error if the ledger entry type doesn't match.
+     */
+    explicit Sponsorship(SLE::const_pointer sle)
+        : LedgerEntryBase(std::move(sle))
+    {
+        // Verify ledger entry type
+        if (sle_->getType() != entryType)
+        {
+            throw std::runtime_error("Invalid ledger entry type for Sponsorship");
+        }
+    }
+
+    // Ledger entry-specific field getters
+
+    /**
+     * @brief Get sfPreviousTxnID (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT256::type::value_type
+    getPreviousTxnID() const
+    {
+        return this->sle_->at(sfPreviousTxnID);
+    }
+
+    /**
+     * @brief Get sfPreviousTxnLgrSeq (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT32::type::value_type
+    getPreviousTxnLgrSeq() const
+    {
+        return this->sle_->at(sfPreviousTxnLgrSeq);
+    }
+
+    /**
+     * @brief Get sfOwner (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_ACCOUNT::type::value_type
+    getOwner() const
+    {
+        return this->sle_->at(sfOwner);
+    }
+
+    /**
+     * @brief Get sfSponsee (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_ACCOUNT::type::value_type
+    getSponsee() const
+    {
+        return this->sle_->at(sfSponsee);
+    }
+
+    /**
+     * @brief Get sfFeeAmount (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_AMOUNT::type::value_type>
+    getFeeAmount() const
+    {
+        if (hasFeeAmount())
+            return this->sle_->at(sfFeeAmount);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfFeeAmount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasFeeAmount() const
+    {
+        return this->sle_->isFieldPresent(sfFeeAmount);
+    }
+
+    /**
+     * @brief Get sfMaxFee (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_AMOUNT::type::value_type>
+    getMaxFee() const
+    {
+        if (hasMaxFee())
+            return this->sle_->at(sfMaxFee);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfMaxFee is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasMaxFee() const
+    {
+        return this->sle_->isFieldPresent(sfMaxFee);
+    }
+
+    /**
+     * @brief Get sfRemainingOwnerCount (SoeDefault)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getRemainingOwnerCount() const
+    {
+        if (hasRemainingOwnerCount())
+            return this->sle_->at(sfRemainingOwnerCount);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfRemainingOwnerCount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasRemainingOwnerCount() const
+    {
+        return this->sle_->isFieldPresent(sfRemainingOwnerCount);
+    }
+
+    /**
+     * @brief Get sfOwnerNode (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT64::type::value_type
+    getOwnerNode() const
+    {
+        return this->sle_->at(sfOwnerNode);
+    }
+
+    /**
+     * @brief Get sfSponseeNode (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT64::type::value_type
+    getSponseeNode() const
+    {
+        return this->sle_->at(sfSponseeNode);
+    }
+};
+
+/**
+ * @brief Builder for Sponsorship ledger entries.
+ *
+ * Provides a fluent interface for constructing ledger entries with method chaining.
+ * Uses STObject internally for flexible ledger entry construction.
+ * Inherits common field setters from LedgerEntryBuilderBase.
+ */
+class SponsorshipBuilder : public LedgerEntryBuilderBase<SponsorshipBuilder>
+{
+public:
+    /**
+     * @brief Construct a new SponsorshipBuilder with required fields.
+     * @param previousTxnID The sfPreviousTxnID field value.
+     * @param previousTxnLgrSeq The sfPreviousTxnLgrSeq field value.
+     * @param owner The sfOwner field value.
+     * @param sponsee The sfSponsee field value.
+     * @param ownerNode The sfOwnerNode field value.
+     * @param sponseeNode The sfSponseeNode field value.
+     */
+    SponsorshipBuilder(std::decay_t<typename SF_UINT256::type::value_type> const& previousTxnID,std::decay_t<typename SF_UINT32::type::value_type> const& previousTxnLgrSeq,std::decay_t<typename SF_ACCOUNT::type::value_type> const& owner,std::decay_t<typename SF_ACCOUNT::type::value_type> const& sponsee,std::decay_t<typename SF_UINT64::type::value_type> const& ownerNode,std::decay_t<typename SF_UINT64::type::value_type> const& sponseeNode)
+        : LedgerEntryBuilderBase<SponsorshipBuilder>(ltSPONSORSHIP)
+    {
+        setPreviousTxnID(previousTxnID);
+        setPreviousTxnLgrSeq(previousTxnLgrSeq);
+        setOwner(owner);
+        setSponsee(sponsee);
+        setOwnerNode(ownerNode);
+        setSponseeNode(sponseeNode);
+    }
+
+    /**
+     * @brief Construct a SponsorshipBuilder from an existing SLE object.
+     * @param sle The existing ledger entry to copy from.
+     * @throws std::runtime_error if the ledger entry type doesn't match.
+     */
+    SponsorshipBuilder(SLE::const_pointer sle)
+    {
+        if (sle->at(sfLedgerEntryType) != ltSPONSORSHIP)
+        {
+            throw std::runtime_error("Invalid ledger entry type for Sponsorship");
+        }
+        object_ = *sle;
+    }
+
+    /** @brief Ledger entry-specific field setters */
+
+    /**
+     * @brief Set sfPreviousTxnID (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setPreviousTxnID(std::decay_t<typename SF_UINT256::type::value_type> const& value)
+    {
+        object_[sfPreviousTxnID] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfPreviousTxnLgrSeq (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setPreviousTxnLgrSeq(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfPreviousTxnLgrSeq] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfOwner (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setOwner(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfOwner] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfSponsee (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setSponsee(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfSponsee] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfFeeAmount (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setFeeAmount(std::decay_t<typename SF_AMOUNT::type::value_type> const& value)
+    {
+        object_[sfFeeAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfMaxFee (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setMaxFee(std::decay_t<typename SF_AMOUNT::type::value_type> const& value)
+    {
+        object_[sfMaxFee] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfRemainingOwnerCount (SoeDefault)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setRemainingOwnerCount(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfRemainingOwnerCount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfOwnerNode (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setOwnerNode(std::decay_t<typename SF_UINT64::type::value_type> const& value)
+    {
+        object_[sfOwnerNode] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfSponseeNode (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipBuilder&
+    setSponseeNode(std::decay_t<typename SF_UINT64::type::value_type> const& value)
+    {
+        object_[sfSponseeNode] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the completed Sponsorship wrapper.
+     * @param index The ledger entry index.
+     * @return The constructed ledger entry wrapper.
+     */
+    Sponsorship
+    build(uint256 const& index)
+    {
+        return Sponsorship{std::make_shared<SLE>(std::move(object_), index)};
+    }
+};
+
+}  // namespace xrpl::ledger_entries
diff --git a/include/xrpl/protocol_autogen/transactions/SponsorshipSet.h b/include/xrpl/protocol_autogen/transactions/SponsorshipSet.h
new file mode 100644
index 0000000000..2831c8a077
--- /dev/null
+++ b/include/xrpl/protocol_autogen/transactions/SponsorshipSet.h
@@ -0,0 +1,290 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/TransactionBase.h>
+#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::transactions {
+
+class SponsorshipSetBuilder;
+
+/**
+ * @brief Transaction: SponsorshipSet
+ *
+ * Type: ttSPONSORSHIP_SET (91)
+ * Delegable: Delegation::Delegable
+ * Amendment: featureSponsor
+ * Privileges: NoPriv
+ *
+ * Immutable wrapper around STTx providing type-safe field access.
+ * Use SponsorshipSetBuilder to construct new transactions.
+ */
+class SponsorshipSet : public TransactionBase
+{
+public:
+    static constexpr xrpl::TxType txType = ttSPONSORSHIP_SET;
+
+    /**
+     * @brief Construct a SponsorshipSet transaction wrapper from an existing STTx object.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    explicit SponsorshipSet(std::shared_ptr<STTx const> tx)
+        : TransactionBase(std::move(tx))
+    {
+        // Verify transaction type
+        if (tx_->getTxnType() != txType)
+        {
+            throw std::runtime_error("Invalid transaction type for SponsorshipSet");
+        }
+    }
+
+    // Transaction-specific field getters
+
+    /**
+     * @brief Get sfCounterpartySponsor (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_ACCOUNT::type::value_type>
+    getCounterpartySponsor() const
+    {
+        if (hasCounterpartySponsor())
+        {
+            return this->tx_->at(sfCounterpartySponsor);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfCounterpartySponsor is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasCounterpartySponsor() const
+    {
+        return this->tx_->isFieldPresent(sfCounterpartySponsor);
+    }
+
+    /**
+     * @brief Get sfSponsee (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_ACCOUNT::type::value_type>
+    getSponsee() const
+    {
+        if (hasSponsee())
+        {
+            return this->tx_->at(sfSponsee);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfSponsee is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasSponsee() const
+    {
+        return this->tx_->isFieldPresent(sfSponsee);
+    }
+
+    /**
+     * @brief Get sfFeeAmount (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_AMOUNT::type::value_type>
+    getFeeAmount() const
+    {
+        if (hasFeeAmount())
+        {
+            return this->tx_->at(sfFeeAmount);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfFeeAmount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasFeeAmount() const
+    {
+        return this->tx_->isFieldPresent(sfFeeAmount);
+    }
+
+    /**
+     * @brief Get sfMaxFee (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_AMOUNT::type::value_type>
+    getMaxFee() const
+    {
+        if (hasMaxFee())
+        {
+            return this->tx_->at(sfMaxFee);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfMaxFee is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasMaxFee() const
+    {
+        return this->tx_->isFieldPresent(sfMaxFee);
+    }
+
+    /**
+     * @brief Get sfRemainingOwnerCount (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getRemainingOwnerCount() const
+    {
+        if (hasRemainingOwnerCount())
+        {
+            return this->tx_->at(sfRemainingOwnerCount);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfRemainingOwnerCount is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasRemainingOwnerCount() const
+    {
+        return this->tx_->isFieldPresent(sfRemainingOwnerCount);
+    }
+};
+
+/**
+ * @brief Builder for SponsorshipSet transactions.
+ *
+ * Provides a fluent interface for constructing transactions with method chaining.
+ * Uses STObject internally for flexible transaction construction.
+ * Inherits common field setters from TransactionBuilderBase.
+ */
+class SponsorshipSetBuilder : public TransactionBuilderBase<SponsorshipSetBuilder>
+{
+public:
+    /**
+     * @brief Construct a new SponsorshipSetBuilder with required fields.
+     * @param account The account initiating the transaction.
+     * @param sequence Optional sequence number for the transaction.
+     * @param fee Optional fee for the transaction.
+     */
+    SponsorshipSetBuilder(SF_ACCOUNT::type::value_type account,
+                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
+                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
+)
+        : TransactionBuilderBase<SponsorshipSetBuilder>(ttSPONSORSHIP_SET, account, sequence, fee)
+    {
+    }
+
+    /**
+     * @brief Construct a SponsorshipSetBuilder from an existing STTx object.
+     * @param tx The existing transaction to copy from.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    SponsorshipSetBuilder(std::shared_ptr<STTx const> tx)
+    {
+        if (tx->getTxnType() != ttSPONSORSHIP_SET)
+        {
+            throw std::runtime_error("Invalid transaction type for SponsorshipSetBuilder");
+        }
+        object_ = *tx;
+    }
+
+    /** @brief Transaction-specific field setters */
+
+    /**
+     * @brief Set sfCounterpartySponsor (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipSetBuilder&
+    setCounterpartySponsor(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfCounterpartySponsor] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfSponsee (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipSetBuilder&
+    setSponsee(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfSponsee] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfFeeAmount (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipSetBuilder&
+    setFeeAmount(std::decay_t<typename SF_AMOUNT::type::value_type> const& value)
+    {
+        object_[sfFeeAmount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfMaxFee (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipSetBuilder&
+    setMaxFee(std::decay_t<typename SF_AMOUNT::type::value_type> const& value)
+    {
+        object_[sfMaxFee] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfRemainingOwnerCount (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipSetBuilder&
+    setRemainingOwnerCount(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfRemainingOwnerCount] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the SponsorshipSet wrapper.
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @return The constructed transaction wrapper.
+     */
+    SponsorshipSet
+    build(PublicKey const& publicKey, SecretKey const& secretKey)
+    {
+        sign(publicKey, secretKey);
+        return SponsorshipSet{std::make_shared<STTx>(std::move(object_))};
+    }
+};
+
+}  // namespace xrpl::transactions
diff --git a/include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h b/include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h
new file mode 100644
index 0000000000..bc27f1603b
--- /dev/null
+++ b/include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h
@@ -0,0 +1,179 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/TransactionBase.h>
+#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::transactions {
+
+class SponsorshipTransferBuilder;
+
+/**
+ * @brief Transaction: SponsorshipTransfer
+ *
+ * Type: ttSPONSORSHIP_TRANSFER (90)
+ * Delegable: Delegation::NotDelegable
+ * Amendment: featureSponsor
+ * Privileges: NoPriv
+ *
+ * Immutable wrapper around STTx providing type-safe field access.
+ * Use SponsorshipTransferBuilder to construct new transactions.
+ */
+class SponsorshipTransfer : public TransactionBase
+{
+public:
+    static constexpr xrpl::TxType txType = ttSPONSORSHIP_TRANSFER;
+
+    /**
+     * @brief Construct a SponsorshipTransfer transaction wrapper from an existing STTx object.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    explicit SponsorshipTransfer(std::shared_ptr<STTx const> tx)
+        : TransactionBase(std::move(tx))
+    {
+        // Verify transaction type
+        if (tx_->getTxnType() != txType)
+        {
+            throw std::runtime_error("Invalid transaction type for SponsorshipTransfer");
+        }
+    }
+
+    // Transaction-specific field getters
+
+    /**
+     * @brief Get sfObjectID (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT256::type::value_type>
+    getObjectID() const
+    {
+        if (hasObjectID())
+        {
+            return this->tx_->at(sfObjectID);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfObjectID is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasObjectID() const
+    {
+        return this->tx_->isFieldPresent(sfObjectID);
+    }
+
+    /**
+     * @brief Get sfSponsee (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_ACCOUNT::type::value_type>
+    getSponsee() const
+    {
+        if (hasSponsee())
+        {
+            return this->tx_->at(sfSponsee);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfSponsee is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasSponsee() const
+    {
+        return this->tx_->isFieldPresent(sfSponsee);
+    }
+};
+
+/**
+ * @brief Builder for SponsorshipTransfer transactions.
+ *
+ * Provides a fluent interface for constructing transactions with method chaining.
+ * Uses STObject internally for flexible transaction construction.
+ * Inherits common field setters from TransactionBuilderBase.
+ */
+class SponsorshipTransferBuilder : public TransactionBuilderBase<SponsorshipTransferBuilder>
+{
+public:
+    /**
+     * @brief Construct a new SponsorshipTransferBuilder with required fields.
+     * @param account The account initiating the transaction.
+     * @param sequence Optional sequence number for the transaction.
+     * @param fee Optional fee for the transaction.
+     */
+    SponsorshipTransferBuilder(SF_ACCOUNT::type::value_type account,
+                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
+                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
+)
+        : TransactionBuilderBase<SponsorshipTransferBuilder>(ttSPONSORSHIP_TRANSFER, account, sequence, fee)
+    {
+    }
+
+    /**
+     * @brief Construct a SponsorshipTransferBuilder from an existing STTx object.
+     * @param tx The existing transaction to copy from.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    SponsorshipTransferBuilder(std::shared_ptr<STTx const> tx)
+    {
+        if (tx->getTxnType() != ttSPONSORSHIP_TRANSFER)
+        {
+            throw std::runtime_error("Invalid transaction type for SponsorshipTransferBuilder");
+        }
+        object_ = *tx;
+    }
+
+    /** @brief Transaction-specific field setters */
+
+    /**
+     * @brief Set sfObjectID (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipTransferBuilder&
+    setObjectID(std::decay_t<typename SF_UINT256::type::value_type> const& value)
+    {
+        object_[sfObjectID] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfSponsee (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SponsorshipTransferBuilder&
+    setSponsee(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
+    {
+        object_[sfSponsee] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the SponsorshipTransfer wrapper.
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @return The constructed transaction wrapper.
+     */
+    SponsorshipTransfer
+    build(PublicKey const& publicKey, SecretKey const& secretKey)
+    {
+        sign(publicKey, secretKey);
+        return SponsorshipTransfer{std::make_shared<STTx>(std::move(object_))};
+    }
+};
+
+}  // namespace xrpl::transactions
diff --git a/include/xrpl/tx/ApplyContext.h b/include/xrpl/tx/ApplyContext.h
index ca778387cd..f64957dd35 100644
--- a/include/xrpl/tx/ApplyContext.h
+++ b/include/xrpl/tx/ApplyContext.h
@@ -127,6 +127,15 @@ public:
     TER
     checkInvariants(TER const result, XRPAmount const fee);
 
+    ApplyViewContext
+    getApplyViewContext()
+    {
+        XRPL_ASSERT(
+            view_.has_value(),
+            "xrpl::ApplyContext::getApplyViewContext : view_ emplaced in constructor");
+        return {.view = *view_, .tx = tx};
+    }
+
 private:
     static TER
     failInvariantCheck(TER const result);
diff --git a/include/xrpl/tx/Transactor.h b/include/xrpl/tx/Transactor.h
index bc5e8c80e7..bdb51b06ec 100644
--- a/include/xrpl/tx/Transactor.h
+++ b/include/xrpl/tx/Transactor.h
@@ -10,8 +10,10 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Fees.h>
+#include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/Permissions.h>
 #include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/Units.h>
@@ -126,6 +128,21 @@ struct PreflightResult;
 // Needed for preflight specialization
 class Change;
 
+enum class FeePayerType {
+    Account,
+    Delegate,
+    SponsorCoSigned,
+    SponsorPreFunded,
+};
+
+struct FeePayer
+{
+    AccountID id;
+    Keylet keylet;
+    SF_AMOUNT const& balanceField;
+    FeePayerType type{FeePayerType::Account};
+};
+
 class Transactor
 {
 protected:
@@ -298,6 +315,10 @@ public:
 
         return T::checkGranularSemantics(view, tx, heldGranularPermissions);
     }
+
+    static NotTEC
+    checkSponsor(ReadView const& view, STTx const& tx);
+
     /////////////////////////////////////////////////////
 
     // Interface used by AccountDelete
@@ -459,6 +480,9 @@ private:
     std::pair<TER, XRPAmount>
     reset(XRPAmount fee);
 
+    static FeePayer
+    getFeePayer(ReadView const& view, STTx const& tx);
+
     TER
     consumeSeqProxy(SLE::pointer const& sleAccount);
     TER
diff --git a/include/xrpl/tx/invariants/InvariantCheck.h b/include/xrpl/tx/invariants/InvariantCheck.h
index d19f34635d..0e6b2a361d 100644
--- a/include/xrpl/tx/invariants/InvariantCheck.h
+++ b/include/xrpl/tx/invariants/InvariantCheck.h
@@ -15,6 +15,7 @@
 #include <xrpl/tx/invariants/NFTInvariant.h>
 #include <xrpl/tx/invariants/PermissionedDEXInvariant.h>
 #include <xrpl/tx/invariants/PermissionedDomainInvariant.h>
+#include <xrpl/tx/invariants/SponsorshipInvariant.h>
 #include <xrpl/tx/invariants/VaultInvariant.h>
 
 #include <cstdint>
@@ -441,7 +442,9 @@ using InvariantChecks = std::tuple<
     ValidMPTPayment,
     ValidAmounts,
     ValidMPTTransfer,
-    ObjectHasPseudoAccount>;
+    ObjectHasPseudoAccount,
+    SponsorshipOwnerCountsMatch,
+    SponsorshipAccountCountMatchesField>;
 
 /**
  * @brief get a tuple of all invariant checks
diff --git a/include/xrpl/tx/invariants/SponsorshipInvariant.h b/include/xrpl/tx/invariants/SponsorshipInvariant.h
new file mode 100644
index 0000000000..e664685c16
--- /dev/null
+++ b/include/xrpl/tx/invariants/SponsorshipInvariant.h
@@ -0,0 +1,61 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+/**
+ * @brief Invariant: Sponsored owner counts are balanced.
+ *
+ * The following checks are made for every transaction:
+ *  - The sum of all per-account deltas of `sfSponsoredOwnerCount` equals
+ *    the sum of all per-account deltas of `sfSponsoringOwnerCount`.
+ *  - Account OwnerCount must be greater than or equal to SponsoredOwnerCount.
+ *  - The net delta of sponsored object owner counts (the owner-count
+ *    magnitude of sponsored ledger entries) equals the net delta of
+ *    `sfSponsoredOwnerCount`.
+ */
+class SponsorshipOwnerCountsMatch
+{
+    std::int64_t deltaSponsoredOwnerCount_ = 0;
+    std::int64_t deltaSponsoringOwnerCount_ = 0;
+    std::int64_t deltaSponsoredObjectOwnerCount_ = 0;
+    std::uint64_t ownerCountBelowSponsored_ = 0;
+
+public:
+    void
+    visitEntry(bool, SLE::const_ref, SLE::const_ref);
+
+    [[nodiscard]] bool
+    finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&) const;
+};
+
+/**
+ * @brief Invariant: Sponsoring account relationships tracked consistently.
+ *
+ * The following check is made for every transaction:
+ *  - The net delta of `sfSponsoringAccountCount` across all accounts equals
+ *    the net delta of the count of ltACCOUNT_ROOT entries having
+ *    `sfSponsor` present (presence transitions only: add/remove).
+ */
+class SponsorshipAccountCountMatchesField
+{
+    std::int64_t deltaSponsoringAccountCount_ = 0;
+    std::int64_t deltaSponsorFieldPresence_ = 0;
+
+public:
+    void
+    visitEntry(bool, SLE::const_ref, SLE::const_ref);
+
+    [[nodiscard]] bool
+    finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&) const;
+};
+
+}  // namespace xrpl
diff --git a/include/xrpl/tx/paths/AMMOffer.h b/include/xrpl/tx/paths/AMMOffer.h
index 40a9cf40b3..6e7a5ceca5 100644
--- a/include/xrpl/tx/paths/AMMOffer.h
+++ b/include/xrpl/tx/paths/AMMOffer.h
@@ -7,6 +7,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Quality.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>
 
 #include <cstdint>
@@ -110,7 +111,10 @@ public:
     send(Args&&... args)
     {
         return accountSend(
-            std::forward<Args>(args)..., WaiveTransferFee::Yes, AllowMPTOverflow::Yes);
+            std::forward<Args>(args)...,
+            SLE::pointer(),
+            WaiveTransferFee::Yes,
+            AllowMPTOverflow::Yes);
     }
 
     [[nodiscard]] bool
diff --git a/include/xrpl/tx/paths/Offer.h b/include/xrpl/tx/paths/Offer.h
index 164a933ba1..d7daa30cab 100644
--- a/include/xrpl/tx/paths/Offer.h
+++ b/include/xrpl/tx/paths/Offer.h
@@ -234,7 +234,8 @@ template <typename... Args>
 TER
 TOffer<TIn, TOut>::send(Args&&... args)
 {
-    return accountSend(std::forward<Args>(args)..., WaiveTransferFee::No, AllowMPTOverflow::Yes);
+    return accountSend(
+        std::forward<Args>(args)..., SLE::pointer(), WaiveTransferFee::No, AllowMPTOverflow::Yes);
 }
 
 template <StepAmount TIn, StepAmount TOut>
diff --git a/include/xrpl/tx/transactors/sponsor/SponsorshipSet.h b/include/xrpl/tx/transactors/sponsor/SponsorshipSet.h
new file mode 100644
index 0000000000..3310c995ae
--- /dev/null
+++ b/include/xrpl/tx/transactors/sponsor/SponsorshipSet.h
@@ -0,0 +1,52 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+class SponsorshipSet : public Transactor
+{
+public:
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
+
+    explicit SponsorshipSet(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static TxConsequences
+    makeTxConsequences(PreflightContext const& ctx);
+
+    static std::uint32_t
+    getFlagsMask(PreflightContext const& ctx);
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+
+    void
+    visitInvariantEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after) override;
+
+    [[nodiscard]] bool
+    finalizeInvariants(
+        STTx const& tx,
+        TER result,
+        XRPAmount fee,
+        ReadView const& view,
+        beast::Journal const& j) override;
+};
+
+}  // namespace xrpl
diff --git a/include/xrpl/tx/transactors/sponsor/SponsorshipTransfer.h b/include/xrpl/tx/transactors/sponsor/SponsorshipTransfer.h
new file mode 100644
index 0000000000..cf0022ab72
--- /dev/null
+++ b/include/xrpl/tx/transactors/sponsor/SponsorshipTransfer.h
@@ -0,0 +1,49 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+class SponsorshipTransfer : public Transactor
+{
+public:
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
+
+    explicit SponsorshipTransfer(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static std::uint32_t
+    getFlagsMask(PreflightContext const& ctx);
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+
+    void
+    visitInvariantEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after) override;
+
+    [[nodiscard]] bool
+    finalizeInvariants(
+        STTx const& tx,
+        TER result,
+        XRPAmount fee,
+        ReadView const& view,
+        beast::Journal const& j) override;
+};
+
+}  // namespace xrpl
diff --git a/include/xrpl/tx/transactors/token/MPTokenIssuanceCreate.h b/include/xrpl/tx/transactors/token/MPTokenIssuanceCreate.h
index 045911c7ae..5d35f65f44 100644
--- a/include/xrpl/tx/transactors/token/MPTokenIssuanceCreate.h
+++ b/include/xrpl/tx/transactors/token/MPTokenIssuanceCreate.h
@@ -76,7 +76,7 @@ public:
         beast::Journal const& j) override;
 
     static std::expected<MPTID, TER>
-    create(ApplyView& view, beast::Journal journal, MPTCreateArgs const& args);
+    create(ApplyViewContext ctx, beast::Journal journal, MPTCreateArgs const& args);
 };
 
 }  // namespace xrpl
diff --git a/src/libxrpl/ledger/PaymentSandbox.cpp b/src/libxrpl/ledger/PaymentSandbox.cpp
index 97e3e53cbf..a7a8962095 100644
--- a/src/libxrpl/ledger/PaymentSandbox.cpp
+++ b/src/libxrpl/ledger/PaymentSandbox.cpp
@@ -3,6 +3,7 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/RawView.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Issue.h>
@@ -170,7 +171,7 @@ DeferredCredits::issuerSelfDebitMPT(
 }
 
 void
-DeferredCredits::ownerCount(AccountID const& id, std::uint32_t cur, std::uint32_t next)
+DeferredCredits::ownerCount(AccountID const& id, OwnerCounts const& cur, OwnerCounts const& next)
 {
     auto const v = std::max(cur, next);
     auto r = ownerCounts_.emplace(id, v);
@@ -181,7 +182,7 @@ DeferredCredits::ownerCount(AccountID const& id, std::uint32_t cur, std::uint32_
     }
 }
 
-std::optional<std::uint32_t>
+std::optional<OwnerCounts>
 DeferredCredits::ownerCount(AccountID const& id) const
 {
     auto i = ownerCounts_.find(id);
@@ -391,10 +392,10 @@ PaymentSandbox::balanceHookSelfIssueMPT(xrpl::MPTIssue const& issue, std::int64_
     return STAmount{issue};
 }
 
-std::uint32_t
-PaymentSandbox::ownerCountHook(AccountID const& account, std::uint32_t count) const
+OwnerCounts
+PaymentSandbox::ownerCountHook(AccountID const& account, OwnerCounts const& count) const
 {
-    std::uint32_t result = count;
+    OwnerCounts result = count;
     for (auto curSB = this; curSB != nullptr; curSB = curSB->ps_)
     {
         if (auto adj = curSB->tab_.ownerCount(account))
@@ -442,8 +443,8 @@ PaymentSandbox::issuerSelfDebitHookMPT(
 void
 PaymentSandbox::adjustOwnerCountHook(
     AccountID const& account,
-    std::uint32_t cur,
-    std::uint32_t next)
+    OwnerCounts const& cur,
+    OwnerCounts const& next)
 {
     tab_.ownerCount(account, cur, next);
 }
diff --git a/src/libxrpl/ledger/View.cpp b/src/libxrpl/ledger/View.cpp
index ebac76a754..8116f4f641 100644
--- a/src/libxrpl/ledger/View.cpp
+++ b/src/libxrpl/ledger/View.cpp
@@ -14,6 +14,7 @@
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
@@ -431,8 +432,7 @@ canWithdraw(ReadView const& view, STTx const& tx)
 
 TER
 doWithdraw(
-    ApplyView& view,
-    STTx const& tx,
+    ApplyViewContext ctx,
     AccountID const& senderAcct,
     AccountID const& dstAcct,
     AccountID const& sourceAcct,
@@ -440,23 +440,24 @@ doWithdraw(
     STAmount const& amount,
     beast::Journal j)
 {
+    auto const dstSle = ctx.view.read(keylet::account(dstAcct));
+
     // Create trust line or MPToken for the receiving account
     if (dstAcct == senderAcct)
     {
-        if (auto const ter = addEmptyHolding(view, senderAcct, priorBalance, amount.asset(), j);
+        if (auto const ter = addEmptyHolding(ctx, senderAcct, priorBalance, amount.asset(), j);
             !isTesSuccess(ter) && ter != tecDUPLICATE)
             return ter;
     }
     else
     {
-        auto dstSle = view.read(keylet::account(dstAcct));
-        if (auto err = verifyDepositPreauth(tx, view, senderAcct, dstAcct, dstSle, j))
+        if (auto err = verifyDepositPreauth(ctx.tx, ctx.view, senderAcct, dstAcct, dstSle, j))
             return err;
     }
 
     // Sanity check
     if (accountHolds(
-            view,
+            ctx.view,
             sourceAcct,
             amount.asset(),
             FreezeHandling::IgnoreFreeze,
@@ -469,9 +470,18 @@ doWithdraw(
         // LCOV_EXCL_STOP
     }
 
+    // A reserve sponsor only covers tx.Account's own objects, so resolve the
+    // sponsor against the destination. accountSend can auto-create a holding
+    // for dstAcct; keying on the destination ensures a third-party destination's
+    // holding is never stamped with the tx's reserve sponsor.
+    auto const sponsorSle = getEffectiveTxReserveSponsor(ctx, dstSle);
+    if (!sponsorSle)
+        return sponsorSle.error();  // LCOV_EXCL_LINE
+
     // Move the funds directly from the broker's pseudo-account to the
     // dstAcct
-    return accountSend(view, sourceAcct, dstAcct, amount, j, WaiveTransferFee::Yes);
+    return accountSend(
+        ctx.view, sourceAcct, dstAcct, amount, j, *sponsorSle, WaiveTransferFee::Yes);
 }
 
 TER
diff --git a/src/libxrpl/ledger/helpers/AccountRootHelpers.cpp b/src/libxrpl/ledger/helpers/AccountRootHelpers.cpp
index 1c4acc7bc4..faca4ebfb6 100644
--- a/src/libxrpl/ledger/helpers/AccountRootHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/AccountRootHelpers.cpp
@@ -7,7 +7,9 @@
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
@@ -15,6 +17,7 @@
 #include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol/digest.h>
@@ -41,46 +44,226 @@ isGlobalFrozen(ReadView const& view, AccountID const& issuer)
     return false;
 }
 
+namespace {
+
 // An owner count cannot be negative. If adjustment would cause a negative
 // owner count, clamp the owner count at 0. Similarly for overflow. This
 // adjustment allows the ownerCount to be adjusted up or down in multiple steps.
 // If id != std::nullopt, then do error reporting.
 //
 // Returns adjusted owner count.
-static std::uint32_t
+std::uint32_t
 confineOwnerCount(
-    std::uint32_t current,
-    std::int32_t adjustment,
+    std::uint32_t currentOwnerCount,
+    std::int32_t ownerCountAdj,
     std::optional<AccountID> const& id = std::nullopt,
     beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
 {
-    std::uint32_t adjusted{current + adjustment};
-    if (adjustment > 0)
+    std::uint32_t totalOwnerCount{currentOwnerCount + ownerCountAdj};
+    if (ownerCountAdj > 0)
     {
         // Overflow is well defined on unsigned
-        if (adjusted < current)
+        if (totalOwnerCount < currentOwnerCount)
         {
+            // LCOV_EXCL_START
             if (id)
             {
                 JLOG(j.fatal()) << "Account " << *id << " owner count exceeds max!";
             }
-            adjusted = std::numeric_limits<std::uint32_t>::max();
+            totalOwnerCount = std::numeric_limits<std::uint32_t>::max();
+            // LCOV_EXCL_STOP
         }
     }
     else
     {
         // Underflow is well defined on unsigned
-        if (adjusted > current)
+        if (totalOwnerCount > currentOwnerCount)
         {
+            // LCOV_EXCL_START
             if (id)
             {
                 JLOG(j.fatal()) << "Account " << *id << " owner count set below 0!";
             }
-            adjusted = 0;
+            totalOwnerCount = 0;
             XRPL_ASSERT(!id, "xrpl::confineOwnerCount : id is not set");
+            // LCOV_EXCL_STOP
         }
     }
-    return adjusted;
+    return totalOwnerCount;
+}
+
+// Returns the number of account reserves funded by this account: 1 for itself (0 if sponsored by
+// another account) plus the count of accounts it sponsors.
+std::uint32_t
+accountCountImpl(SLE::const_ref sle, std::int32_t accountCountAdj, beast::Journal j)
+{
+    bool const isSponsored = sle->isFieldPresent(sfSponsor);
+    std::int64_t const sponsoringAccountCount = sle->getFieldU32(sfSponsoringAccountCount);
+    std::int64_t const currentAccountCount = (isSponsored ? 0 : 1) + sponsoringAccountCount;
+
+    std::int64_t totalAccountCount{currentAccountCount + accountCountAdj};
+    if (totalAccountCount > std::numeric_limits<std::uint32_t>::max())
+    {
+        // LCOV_EXCL_START
+        JLOG(j.fatal()) << "Reserve count exceeds max!";
+        totalAccountCount = std::numeric_limits<std::uint32_t>::max();
+        // LCOV_EXCL_STOP
+    }
+    else if (totalAccountCount < 0)
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::accountCountImpl : Reserve count set below 0");
+        JLOG(j.fatal()) << "Reserve count set below 0";
+        totalAccountCount = 0;
+        // LCOV_EXCL_STOP
+    }
+
+    return totalAccountCount;
+}
+
+std::uint32_t
+adjustOwnerCountImpl(
+    ApplyView& view,
+    SLE::ref sle,
+    SF_UINT32 const& sfield,
+    AccountID const& accID,
+    std::int32_t ownerCountAdj,
+    beast::Journal j)
+{
+    std::uint32_t const currentOwnerCount = sle->at(sfield);
+    std::uint32_t const totalOwnerCount =
+        confineOwnerCount(currentOwnerCount, ownerCountAdj, accID, j);
+    sle->at(sfield) = totalOwnerCount;
+    view.update(sle);
+    return totalOwnerCount;
+}
+
+void
+adjustOwnerCountSigned(
+    ApplyView& view,
+    SLE::ref accountSle,
+    SLE::ref sponsorSle,
+    std::int32_t adjustment,
+    beast::Journal j)
+{
+    if (view.rules().enabled(featureSponsor))
+    {
+        XRPL_ASSERT(accountSle, "xrpl::adjustOwnerCountSigned : valid account sle");
+        if (!accountSle)
+            return;  // LCOV_EXCL_LINE
+
+        auto const accountID = accountSle->getAccountID(sfAccount);
+        bool const validType = accountSle->getType() == ltACCOUNT_ROOT;
+        XRPL_ASSERT(validType, "xrpl::adjustOwnerCountSigned : valid account sle type");
+        if (!validType)
+            return;  // LCOV_EXCL_LINE
+
+        XRPL_ASSERT(adjustment, "xrpl::adjustOwnerCountSigned : nonzero adjustment input");
+
+        OwnerCounts const currentOwnerCount(accountSle);
+        OwnerCounts totalOwnerCount(currentOwnerCount);
+
+        if (sponsorSle)
+        {
+            bool const validSponsorType = sponsorSle->getType() == ltACCOUNT_ROOT;
+            XRPL_ASSERT(validSponsorType, "xrpl::adjustOwnerCountSigned : valid sponsor sle type");
+            if (!validSponsorType)
+                return;  // LCOV_EXCL_LINE
+            auto const sponsorID = sponsorSle->getAccountID(sfAccount);
+
+            totalOwnerCount.sponsored = adjustOwnerCountImpl(
+                view, accountSle, sfSponsoredOwnerCount, accountID, adjustment, j);
+
+            {
+                OwnerCounts const sponsorCurrent(sponsorSle);
+                OwnerCounts sponsorAdjustment(sponsorCurrent);
+                sponsorAdjustment.sponsoring = adjustOwnerCountImpl(
+                    view, sponsorSle, sfSponsoringOwnerCount, sponsorID, adjustment, j);
+                view.adjustOwnerCountHook(sponsorID, sponsorCurrent, sponsorAdjustment);
+            }
+
+            auto sponsorshipSle = view.peek(keylet::sponsorship(sponsorID, accountID));
+            if (sponsorshipSle && adjustment > 0)
+            {
+                // Only decrease the pre-funded ReserveCount on Sponsorship if we assign new
+                // objects. Removing/reassigning ownership of the object doesn't increase
+                // RemainingOwnerCount back. Don't call hook because this counter is not something
+                // that requires reserve (like other sf...OwnerCounts do).
+                adjustOwnerCountImpl(
+                    view, sponsorshipSle, sfRemainingOwnerCount, sponsorID, -adjustment, j);
+            }
+        }
+
+        totalOwnerCount.owner =
+            adjustOwnerCountImpl(view, accountSle, sfOwnerCount, accountID, adjustment, j);
+        view.adjustOwnerCountHook(accountID, currentOwnerCount, totalOwnerCount);
+    }
+    else
+    {
+        XRPL_ASSERT(accountSle, "xrpl::adjustOwnerCountSigned : valid account sle");
+        if (!accountSle)
+            return;
+        // the remaining are only asserts to preserve existing behavior
+        XRPL_ASSERT(sponsorSle == nullptr, "xrpl::adjustOwnerCountSigned : sponsor not enabled");
+        XRPL_ASSERT(
+            accountSle->getType() == ltACCOUNT_ROOT,
+            "xrpl::adjustOwnerCountSigned : valid account sle type");
+        XRPL_ASSERT(adjustment, "xrpl::adjustOwnerCount : nonzero adjustment input");
+        std::uint32_t const current{accountSle->getFieldU32(sfOwnerCount)};
+        AccountID const id = (*accountSle)[sfAccount];
+        std::uint32_t const adjusted = confineOwnerCount(current, adjustment, id, j);
+
+        OwnerCounts const currentOwnerCount(accountSle);
+        OwnerCounts finalOwnerCount(currentOwnerCount);
+        finalOwnerCount.owner = adjusted;
+
+        view.adjustOwnerCountHook(id, currentOwnerCount, finalOwnerCount);
+        accountSle->at(sfOwnerCount) = adjusted;
+        view.update(accountSle);
+    }
+}
+
+}  // namespace
+
+std::uint32_t
+ownerCount(SLE::const_ref sle, beast::Journal j, std::int32_t ownerCountAdj)
+{
+    XRPL_ASSERT(sle && sle->getType() == ltACCOUNT_ROOT, "xrpl::ownerCount : sle is account root");
+
+    AccountID const id = sle->getAccountID(sfAccount);
+    std::uint32_t const currentOwnerCount = sle->at(sfOwnerCount);
+    std::uint32_t const sponsoredOwnerCount = sle->at(sfSponsoredOwnerCount);
+    std::uint32_t const sponsoringOwnerCount = sle->at(sfSponsoringOwnerCount);
+
+    XRPL_ASSERT(
+        currentOwnerCount >= sponsoredOwnerCount,
+        "xrpl::ownerCount : OwnerCount must be greater than or equal to SponsoredOwnerCount");
+
+    std::int64_t deltaCount =
+        static_cast<std::int64_t>(ownerCountAdj) - sponsoredOwnerCount + sponsoringOwnerCount;
+
+    if (deltaCount > std::numeric_limits<std::int32_t>::max())
+    {
+        // LCOV_EXCL_START
+        deltaCount = std::numeric_limits<std::int32_t>::max();
+        JLOG(j.fatal()) << "Account " << id << " delta count exceeds max, "
+                        << "adjustment: " << ownerCountAdj
+                        << ", sponsoredCount: " << sponsoredOwnerCount
+                        << ", sponsoringOwnerCount: " << sponsoringOwnerCount;
+        // LCOV_EXCL_STOP
+    }
+    else if (deltaCount < std::numeric_limits<std::int32_t>::min())
+    {
+        // LCOV_EXCL_START
+        deltaCount = std::numeric_limits<std::int32_t>::min();
+        JLOG(j.fatal()) << "Account " << id << " delta count is below min, "
+                        << "adjustment: " << ownerCountAdj
+                        << ", sponsoredCount: " << sponsoredOwnerCount
+                        << ", sponsoringCount: " << sponsoringOwnerCount;
+        // LCOV_EXCL_STOP
+    }
+
+    return confineOwnerCount(currentOwnerCount, deltaCount);
 }
 
 XRPAmount
@@ -91,12 +274,14 @@ xrpLiquid(ReadView const& view, AccountID const& id, std::int32_t ownerCountAdj,
         return beast::kZero;
 
     // Return balance minus reserve
-    std::uint32_t const ownerCount =
-        confineOwnerCount(view.ownerCountHook(id, sle->getFieldU32(sfOwnerCount)), ownerCountAdj);
+    std::uint32_t const currentOwnerCount =
+        confineOwnerCount(view.ownerCountHook(id, OwnerCounts(sle)).count(), ownerCountAdj);
+    std::uint32_t const currentAccountCount = accountCountImpl(sle, 0, j);
 
     // Pseudo-accounts have no reserve requirement
-    auto const reserve =
-        isPseudoAccount(sle) ? XRPAmount{0} : view.fees().accountReserve(ownerCount);
+    auto const reserve = isPseudoAccount(sle)
+        ? XRPAmount{0}
+        : view.fees().accountReserve(currentOwnerCount, currentAccountCount);
 
     auto const fullBalance = sle->getFieldAmount(sfBalance);
 
@@ -108,7 +293,7 @@ xrpLiquid(ReadView const& view, AccountID const& id, std::int32_t ownerCountAdj,
                     << " amount=" << amount.getFullText()
                     << " fullBalance=" << fullBalance.getFullText()
                     << " balance=" << balance.getFullText() << " reserve=" << reserve
-                    << " ownerCount=" << ownerCount << " ownerCountAdj=" << ownerCountAdj;
+                    << " ownerCount=" << currentOwnerCount << " ownerCountAdj=" << ownerCountAdj;
 
     return amount.xrp();
 }
@@ -125,19 +310,193 @@ transferRate(ReadView const& view, AccountID const& issuer)
 }
 
 void
-adjustOwnerCount(ApplyView& view, SLE::ref sle, std::int32_t amount, beast::Journal j)
+increaseOwnerCount(
+    ApplyView& view,
+    SLE::ref accountSle,
+    SLE::ref sponsorSle,
+    std::uint32_t count,
+    beast::Journal j)
 {
-    if (!sle)
-        return;
-    XRPL_ASSERT(amount, "xrpl::adjustOwnerCount : nonzero amount input");
-    std::uint32_t const current{sle->getFieldU32(sfOwnerCount)};
-    AccountID const id = (*sle)[sfAccount];
-    std::uint32_t const adjusted = confineOwnerCount(current, amount, id, j);
-    view.adjustOwnerCountHook(id, current, adjusted);
-    sle->at(sfOwnerCount) = adjusted;
-    view.update(sle);
+    XRPL_ASSERT(
+        count != 0 && count <= std::numeric_limits<std::int32_t>::max(),
+        "xrpl::increaseOwnerCount : count in signed delta range");
+    if (count == 0 || count > std::numeric_limits<std::int32_t>::max())
+        return;  // LCOV_EXCL_LINE
+
+    adjustOwnerCountSigned(view, accountSle, sponsorSle, static_cast<std::int32_t>(count), j);
 }
 
+void
+increaseOwnerCount(ApplyViewContext ctx, SLE::ref accountSle, std::uint32_t count, beast::Journal j)
+{
+    auto const sponsorExp = getEffectiveTxReserveSponsor(ctx, accountSle);
+
+    // The sponsor's existence is validated by checkReserve/checkSponsor before
+    // any owner-count mutation, so loading it here cannot fail.
+    XRPL_ASSERT(
+        sponsorExp.has_value(), "xrpl::increaseOwnerCount : sponsor validated before mutation");
+
+    increaseOwnerCount(ctx.view, accountSle, sponsorExp ? *sponsorExp : SLE::pointer(), count, j);
+}
+
+void
+decreaseOwnerCount(
+    ApplyView& view,
+    SLE::ref accountSle,
+    SLE::ref sponsorSle,
+    std::uint32_t count,
+    beast::Journal j)
+{
+    XRPL_ASSERT(
+        count != 0 && count <= std::numeric_limits<std::int32_t>::max(),
+        "xrpl::decreaseOwnerCount : count in signed delta range");
+    if (count == 0 || count > std::numeric_limits<std::int32_t>::max())
+        return;  // LCOV_EXCL_LINE
+
+    adjustOwnerCountSigned(view, accountSle, sponsorSle, -static_cast<std::int32_t>(count), j);
+}
+
+void
+decreaseOwnerCountForObject(
+    ApplyView& view,
+    SLE::ref accountSle,
+    SLE::ref objectSle,
+    std::uint32_t count,
+    beast::Journal j)
+{
+    XRPL_ASSERT(objectSle, "xrpl::decreaseOwnerCountForObject : valid object sle");
+    if (!objectSle)
+        return;  // LCOV_EXCL_LINE
+
+    bool const validObjectType = objectSle->getType() != ltACCOUNT_ROOT;
+    XRPL_ASSERT(validObjectType, "xrpl::decreaseOwnerCountForObject : valid object sle type");
+    if (!validObjectType)
+        return;  // LCOV_EXCL_LINE
+
+    SLE::ref sponsorSle = getLedgerEntryReserveSponsor(view, objectSle);
+    decreaseOwnerCount(view, accountSle, sponsorSle, count, j);
+}
+
+void
+adjustLoanBrokerOwnerCount(
+    ApplyView& view,
+    SLE::ref brokerSle,
+    std::int32_t delta,
+    beast::Journal j)
+{
+    XRPL_ASSERT(
+        brokerSle && brokerSle->getType() == ltLOAN_BROKER,
+        "xrpl::adjustLoanBrokerOwnerCount : valid loan broker sle");
+    if (!brokerSle || brokerSle->getType() != ltLOAN_BROKER)
+        return;  // LCOV_EXCL_LINE
+
+    XRPL_ASSERT(delta != 0, "xrpl::adjustLoanBrokerOwnerCount : nonzero delta input");
+    if (delta == 0)
+        return;  // LCOV_EXCL_LINE
+
+    adjustOwnerCountImpl(
+        view, brokerSle, sfOwnerCount, brokerSle->getAccountID(sfAccount), delta, j);
+}
+
+XRPAmount
+accountReserve(ReadView const& view, SLE::const_ref sle, beast::Journal j, Adjustment adj)
+{
+    XRPL_ASSERT(sle && sle->getType() == ltACCOUNT_ROOT, "xrpl::accountReserve : valid sle");
+
+    if (!view.rules().enabled(featureSponsor))
+    {
+        XRPL_ASSERT(adj.accountCountDelta == 0, "xrpl::accountReserve : no account count delta");
+        return view.fees().accountReserve(sle->getFieldU32(sfOwnerCount) + adj.ownerCountDelta, 1);
+    }
+    std::uint32_t const currentOwnerCount = ownerCount(sle, j, adj.ownerCountDelta);
+    std::uint32_t const currentAccountCount = accountCountImpl(sle, adj.accountCountDelta, j);
+
+    return view.fees().accountReserve(currentOwnerCount, currentAccountCount);
+}
+
+TER
+checkReserve(
+    ApplyViewContext ctx,
+    SLE::const_ref accSle,
+    XRPAmount accBalance,
+    SLE::const_ref sponsorSle,
+    Adjustment adj,
+    beast::Journal j,
+    TER insufReserveCode)
+{
+    // TODO: swap to assert after fixCleanup3_2_0 is retired
+    if (!accSle || accSle->getType() != ltACCOUNT_ROOT)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+    XRPL_ASSERT(
+        !isTesSuccess(insufReserveCode), "xrpl::checkReserve : insufReserveCode is not tesSUCCESS");
+    if (ctx.view.rules().enabled(featureSponsor))
+    {
+        if (sponsorSle)
+        {
+            if (sponsorSle->getType() != ltACCOUNT_ROOT)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+
+            auto const sle = ctx.view.read(
+                keylet::sponsorship(
+                    sponsorSle->getAccountID(sfAccount), accSle->getAccountID(sfAccount)));
+
+            // A reserve-sponsored tx must carry a sponsor signature
+            // (cosigning path) and/or have a pre-existing sponsorship SLE
+            // (prefunded path). Absence of both is an internal invariant break.
+            if (isReserveSponsored(ctx.tx) && !sle && !ctx.tx.isFieldPresent(sfSponsorSignature))
+                return tecINTERNAL;  // LCOV_EXCL_LINE
+
+            if (sle)
+            {
+                auto const ownerCountAllowed = sle->getFieldU32(sfRemainingOwnerCount);
+                if (adj.ownerCountDelta > 0 &&
+                    ownerCountAllowed < static_cast<std::uint32_t>(adj.ownerCountDelta))
+                    return insufReserveCode;
+            }
+
+            auto const sponsorBalance = sponsorSle->getFieldAmount(sfBalance).xrp();
+            XRPAmount const sponsorReserve = accountReserve(ctx.view, sponsorSle, j, adj);
+
+            if (sponsorBalance < sponsorReserve)
+                return insufReserveCode;
+        }
+        else
+        {
+            XRPAmount const reserve = accountReserve(ctx.view, accSle, j, adj);
+            if (accBalance < reserve)
+                return insufReserveCode;
+        }
+    }
+    else
+    {
+        XRPL_ASSERT(
+            !sponsorSle,
+            "xrpl::checkReserve : featureSponsor disabled and sponsorSle not provided");
+        XRPL_ASSERT(adj.accountCountDelta == 0, "xrpl::checkReserve : accountCountDelta is 0");
+        auto const reserve = ctx.view.fees().accountReserve(
+            accSle->getFieldU32(sfOwnerCount) + adj.ownerCountDelta, 1);
+        if (accBalance < reserve)
+            return insufReserveCode;
+    }
+    return tesSUCCESS;
+}
+
+TER
+checkReserve(
+    ApplyViewContext ctx,
+    SLE::const_ref accSle,
+    XRPAmount accBalance,
+    Adjustment adj,
+    beast::Journal j)
+{
+    auto const sponsorExp = getEffectiveTxReserveSponsor(ctx, accSle);
+    if (!sponsorExp)
+        return sponsorExp.error();  // LCOV_EXCL_LINE
+    return checkReserve(ctx, accSle, accBalance, *sponsorExp, adj, j);
+}
+
+// ----------------------------------------------------
+
 AccountID
 pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey)
 {
diff --git a/src/libxrpl/ledger/helpers/CredentialHelpers.cpp b/src/libxrpl/ledger/helpers/CredentialHelpers.cpp
index 6fc2faf03e..226ea100e9 100644
--- a/src/libxrpl/ledger/helpers/CredentialHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/CredentialHelpers.cpp
@@ -97,7 +97,7 @@ deleteSLE(ApplyView& view, SLE::ref sleCredential, beast::Journal j)
         }
 
         if (isOwner)
-            adjustOwnerCount(view, sleAccount, -1, j);
+            decreaseOwnerCountForObject(view, sleAccount, sleCredential, 1, j);
 
         return tesSUCCESS;
     };
diff --git a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
index 3c4e55a16e..ac14c3b66d 100644
--- a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
@@ -3,7 +3,6 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
@@ -11,6 +10,7 @@
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/CredentialHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
@@ -125,29 +125,29 @@ canAddHolding(ReadView const& view, MPTIssue const& mptIssue)
 
 [[nodiscard]] TER
 addEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     XRPAmount priorBalance,
     MPTIssue const& mptIssue,
     beast::Journal journal)
 {
     auto const& mptID = mptIssue.getMptID();
-    auto const mpt = view.peek(keylet::mptokenIssuance(mptID));
+    auto const mpt = ctx.view.peek(keylet::mptokenIssuance(mptID));
     if (!mpt)
         return tefINTERNAL;  // LCOV_EXCL_LINE
     if (mpt->isFlag(lsfMPTLocked))
         return tefINTERNAL;  // LCOV_EXCL_LINE
-    if (view.peek(keylet::mptoken(mptID, accountID)))
+    if (ctx.view.peek(keylet::mptoken(mptID, accountID)))
         return tecDUPLICATE;
     if (accountID == mptIssue.getIssuer())
         return tesSUCCESS;
 
-    return authorizeMPToken(view, priorBalance, mptID, accountID, journal);
+    return authorizeMPToken(ctx, priorBalance, mptID, accountID, journal);
 }
 
 [[nodiscard]] TER
 authorizeMPToken(
-    ApplyView& view,
+    ApplyViewContext ctx,
     XRPAmount const& priorBalance,
     MPTID const& mptIssuanceID,
     AccountID const& account,
@@ -155,7 +155,7 @@ authorizeMPToken(
     std::uint32_t flags,
     std::optional<AccountID> holderID)
 {
-    auto const sleAcct = view.peek(keylet::account(account));
+    auto const sleAcct = ctx.view.peek(keylet::account(account));
     if (!sleAcct)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
@@ -170,19 +170,19 @@ authorizeMPToken(
         if ((flags & tfMPTUnauthorize) != 0u)
         {
             auto const mptokenKey = keylet::mptoken(mptIssuanceID, account);
-            auto const sleMpt = view.peek(mptokenKey);
+            auto const sleMpt = ctx.view.peek(mptokenKey);
             if (!sleMpt || (*sleMpt)[sfMPTAmount] != 0 ||
-                (view.rules().enabled(fixCleanup3_1_3) &&
+                (ctx.view.rules().enabled(fixCleanup3_1_3) &&
                  (*sleMpt)[~sfLockedAmount].valueOr(0) != 0))
                 return tecINTERNAL;  // LCOV_EXCL_LINE
 
-            if (!view.dirRemove(
+            if (!ctx.view.dirRemove(
                     keylet::ownerDir(account), (*sleMpt)[sfOwnerNode], sleMpt->key(), false))
                 return tecINTERNAL;  // LCOV_EXCL_LINE
 
-            adjustOwnerCount(view, sleAcct, -1, journal);
+            decreaseOwnerCountForObject(ctx.view, sleAcct, sleMpt, 1, journal);
 
-            view.erase(sleMpt);
+            ctx.view.erase(sleMpt);
             return tesSUCCESS;
         }
 
@@ -190,47 +190,57 @@ authorizeMPToken(
         //      - add the new mptokenKey to the owner directory
         //      - create the MPToken object for the holder
 
+        // A reserve sponsor only covers tx.Account's own objects.
+        auto const sponsorExp = getEffectiveTxReserveSponsor(ctx, sleAcct);
+        if (!sponsorExp)
+            return sponsorExp.error();  // LCOV_EXCL_LINE
+        auto const sponsorSle = *sponsorExp;
+
         // The reserve that is required to create the MPToken. Note
         // that although the reserve increases with every item
         // an account owns, in the case of MPTokens we only
         // *enforce* a reserve if the user owns more than two
         // items. This is similar to the reserve requirements of trust lines.
-        std::uint32_t const uOwnerCount = sleAcct->getFieldU32(sfOwnerCount);
-        XRPAmount const reserveCreate(
-            (uOwnerCount < 2) ? XRPAmount(beast::kZero)
-                              : view.fees().accountReserve(uOwnerCount + 1));
-
-        if (priorBalance < reserveCreate)
-            return tecINSUFFICIENT_RESERVE;
+        // The "free-tier" shortcut (ownerCount < 2) does not apply once a sponsor is on
+        // the tx — the sponsor must always cover the reserve (via balance or prefunded
+        // budget), so this check always runs for sponsored transactions.
+        if (sponsorSle || ownerCount(sleAcct, journal) >= 2)
+        {
+            if (auto const ret = checkReserve(
+                    ctx, sleAcct, priorBalance, sponsorSle, {.ownerCountDelta = 1}, journal);
+                !isTesSuccess(ret))
+                return ret;
+        }
 
         // Defensive check before we attempt to create MPToken for the issuer
-        auto const mpt = view.read(keylet::mptokenIssuance(mptIssuanceID));
+        auto const mpt = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
         if (!mpt || mpt->getAccountID(sfIssuer) == account)
         {
             // LCOV_EXCL_START
             UNREACHABLE("xrpl::authorizeMPToken : invalid issuance or issuers token");
-            if (view.rules().enabled(featureLendingProtocol))
+            if (ctx.view.rules().enabled(featureLendingProtocol))
                 return tecINTERNAL;
             // LCOV_EXCL_STOP
         }
 
         auto const mptokenKey = keylet::mptoken(mptIssuanceID, account);
         auto mptoken = std::make_shared<SLE>(mptokenKey);
-        if (auto ter = dirLink(view, account, mptoken))
+        if (auto ter = dirLink(ctx.view, account, mptoken))
             return ter;  // LCOV_EXCL_LINE
 
         (*mptoken)[sfAccount] = account;
         (*mptoken)[sfMPTokenIssuanceID] = mptIssuanceID;
         (*mptoken)[sfFlags] = 0;
-        view.insert(mptoken);
+        ctx.view.insert(mptoken);
 
         // Update owner count.
-        adjustOwnerCount(view, sleAcct, 1, journal);
+        increaseOwnerCount(ctx.view, sleAcct, sponsorSle, 1, journal);
+        addSponsorToLedgerEntry(mptoken, sponsorSle);
 
         return tesSUCCESS;
     }
 
-    auto const sleMptIssuance = view.read(keylet::mptokenIssuance(mptIssuanceID));
+    auto const sleMptIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleMptIssuance)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
@@ -240,7 +250,7 @@ authorizeMPToken(
     if (account != (*sleMptIssuance)[sfIssuer])
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
-    auto const sleMpt = view.peek(keylet::mptoken(mptIssuanceID, *holderID));
+    auto const sleMpt = ctx.view.peek(keylet::mptoken(mptIssuanceID, *holderID));
     if (!sleMpt)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
@@ -263,13 +273,13 @@ authorizeMPToken(
     if (flagsIn != flagsOut)
         sleMpt->setFieldU32(sfFlags, flagsOut);
 
-    view.update(sleMpt);
+    ctx.view.update(sleMpt);
     return tesSUCCESS;
 }
 
 [[nodiscard]] TER
 removeEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     MPTIssue const& mptIssue,
     beast::Journal journal)
@@ -279,7 +289,7 @@ removeEmptyHolding(
     // a token does exist, it will get deleted. If not, return success.
     bool const accountIsIssuer = accountID == mptIssue.getIssuer();
     auto const& mptID = mptIssue.getMptID();
-    auto const mptoken = view.peek(keylet::mptoken(mptID, accountID));
+    auto const mptoken = ctx.view.peek(keylet::mptoken(mptID, accountID));
     if (!mptoken)
         return accountIsIssuer ? (TER)tesSUCCESS : (TER)tecOBJECT_NOT_FOUND;
     // Unlike a trust line, if the account is the issuer, and the token has a
@@ -287,7 +297,7 @@ removeEmptyHolding(
     // accounting out of balance, so fail. Since this should be impossible
     // anyway, I'm not going to put any effort into it.
     if (mptoken->at(sfMPTAmount) != 0 ||
-        (view.rules().enabled(fixCleanup3_1_3) && (*mptoken)[~sfLockedAmount].valueOr(0) != 0))
+        (ctx.view.rules().enabled(fixCleanup3_1_3) && (*mptoken)[~sfLockedAmount].valueOr(0) != 0))
         return tecHAS_OBLIGATIONS;
 
     // Don't delete if the token still has confidential balances
@@ -300,7 +310,7 @@ removeEmptyHolding(
     }
 
     return authorizeMPToken(
-        view,
+        ctx,
         {},  // priorBalance
         mptID,
         accountID,
@@ -419,13 +429,13 @@ requireAuth(
 
 [[nodiscard]] TER
 enforceMPTokenAuthorization(
-    ApplyView& view,
+    ApplyViewContext ctx,
     MPTID const& mptIssuanceID,
     AccountID const& account,
     XRPAmount const& priorBalance,  // for MPToken authorization
     beast::Journal j)
 {
-    auto const sleIssuance = view.read(keylet::mptokenIssuance(mptIssuanceID));
+    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
     if (!sleIssuance)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
@@ -437,7 +447,7 @@ enforceMPTokenAuthorization(
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
     auto const keylet = keylet::mptoken(mptIssuanceID, account);
-    auto const sleToken = view.read(keylet);  //  NOTE: might be null
+    auto const sleToken = ctx.view.read(keylet);  //  NOTE: might be null
     auto const maybeDomainID = sleIssuance->at(~sfDomainID);
     bool expired = false;
     bool const authorizedByDomain = [&]() -> bool {
@@ -445,7 +455,7 @@ enforceMPTokenAuthorization(
         if (!maybeDomainID.has_value())
             return false;  // LCOV_EXCL_LINE
 
-        auto const ter = verifyValidDomain(view, account, *maybeDomainID, j);
+        auto const ter = verifyValidDomain(ctx.view, account, *maybeDomainID, j);
         if (isTesSuccess(ter))
             return true;
         if (ter == tecEXPIRED)
@@ -500,7 +510,7 @@ enforceMPTokenAuthorization(
             maybeDomainID.has_value() && sleToken == nullptr,
             "xrpl::enforceMPTokenAuthorization : new MPToken for domain");
         if (auto const err = authorizeMPToken(
-                view,
+                ctx,
                 priorBalance,   // priorBalance
                 mptIssuanceID,  // mptIssuanceID
                 account,        // account
@@ -915,6 +925,7 @@ createMPToken(
     ApplyView& view,
     MPTID const& mptIssuanceID,
     AccountID const& account,
+    SLE::ref sponsorSle,
     std::uint32_t const flags)
 {
     auto const mptokenKey = keylet::mptoken(mptIssuanceID, account);
@@ -931,6 +942,8 @@ createMPToken(
     (*mptoken)[sfFlags] = flags;
     (*mptoken)[sfOwnerNode] = *ownerNode;
 
+    addSponsorToLedgerEntry(mptoken, sponsorSle);
+
     view.insert(mptoken);
 
     return tesSUCCESS;
@@ -941,6 +954,7 @@ checkCreateMPT(
     xrpl::ApplyView& view,
     xrpl::MPTIssue const& mptIssue,
     xrpl::AccountID const& holder,
+    SLE::ref sponsorSle,
     beast::Journal j)
 {
     if (mptIssue.getIssuer() == holder)
@@ -950,7 +964,7 @@ checkCreateMPT(
     auto const mptokenID = keylet::mptoken(mptIssuanceID.key, holder);
     if (!view.exists(mptokenID))
     {
-        if (auto const err = createMPToken(view, mptIssue.getMptID(), holder, 0);
+        if (auto const err = createMPToken(view, mptIssue.getMptID(), holder, sponsorSle, 0);
             !isTesSuccess(err))
         {
             return err;
@@ -960,7 +974,8 @@ checkCreateMPT(
         {
             return tecINTERNAL;
         }
-        adjustOwnerCount(view, sleAcct, 1, j);
+
+        increaseOwnerCount(view, sleAcct, sponsorSle, 1, j);
     }
     return tesSUCCESS;
 }
diff --git a/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp b/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
index 6dca715a8c..c67ab6775d 100644
--- a/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
@@ -269,11 +269,7 @@ insertToken(ApplyView& view, AccountID owner, STObject&& nft)
     // the NFT.
     SLE::pointer const page =
         getPageForToken(view, owner, nft[sfNFTokenID], [](ApplyView& view, AccountID const& owner) {
-            adjustOwnerCount(
-                view,
-                view.peek(keylet::account(owner)),
-                1,
-                beast::Journal{beast::Journal::getNullSink()});
+            increaseOwnerCount(view, owner, {}, 1, beast::Journal{beast::Journal::getNullSink()});
         });
 
     if (!page)
@@ -411,21 +407,17 @@ removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID, S
         curr->setFieldArray(sfNFTokens, arr);
         view.update(curr);
 
-        int cnt = 0;
+        std::uint32_t cnt = 0;
 
         if (prev && mergePages(view, prev, curr))
-            cnt--;
+            ++cnt;
 
         if (next && mergePages(view, curr, next))
-            cnt--;
+            ++cnt;
 
         if (cnt != 0)
         {
-            adjustOwnerCount(
-                view,
-                view.peek(keylet::account(owner)),
-                cnt,
-                beast::Journal{beast::Journal::getNullSink()});
+            decreaseOwnerCount(view, owner, {}, cnt, beast::Journal{beast::Journal::getNullSink()});
         }
 
         return tesSUCCESS;
@@ -460,11 +452,7 @@ removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID, S
                 curr->makeFieldAbsent(sfPreviousPageMin);
             }
 
-            adjustOwnerCount(
-                view,
-                view.peek(keylet::account(owner)),
-                -1,
-                beast::Journal{beast::Journal::getNullSink()});
+            decreaseOwnerCount(view, owner, {}, 1, beast::Journal{beast::Journal::getNullSink()});
 
             view.update(curr);
             view.erase(prev);
@@ -502,7 +490,7 @@ removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID, S
 
     view.erase(curr);
 
-    int cnt = 1;
+    uint32_t cnt = 1;
 
     // Since we're here, try to consolidate the previous and current pages
     // of the page we removed (if any) into one.  mergePages() _should_
@@ -519,11 +507,7 @@ removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID, S
             view.peek(Keylet(ltNFTOKEN_PAGE, next->key()))))
         cnt++;
 
-    adjustOwnerCount(
-        view,
-        view.peek(keylet::account(owner)),
-        -1 * cnt,
-        beast::Journal{beast::Journal::getNullSink()});
+    decreaseOwnerCount(view, owner, {}, cnt, beast::Journal{beast::Journal::getNullSink()});
 
     return tesSUCCESS;
 }
@@ -639,8 +623,7 @@ deleteTokenOffer(ApplyView& view, SLE::ref offer)
             false))
         return false;
 
-    adjustOwnerCount(
-        view, view.peek(keylet::account(owner)), -1, beast::Journal{beast::Journal::getNullSink()});
+    decreaseOwnerCount(view, owner, {}, 1, beast::Journal{beast::Journal::getNullSink()});
 
     view.erase(offer);
     return true;
@@ -743,9 +726,11 @@ repairNFTokenDirectoryLinks(ApplyView& view, AccountID const& owner)
             auto const newPrev = view.peek(Keylet(ltNFTOKEN_PAGE, *prevLink));
             if (!newPrev)
             {
+                // LCOV_EXCL_START
                 Throw<std::runtime_error>(
                     "NFTokenPage directory for " + to_string(owner) +
-                    " cannot be repaired.  Unexpected link problem.");
+                    " cannot be repaired. Unexpected link problem.");
+                // LCOV_EXCL_STOP
             }
             newPrev->at(sfNextPageMin) = nextPage->key();
             view.update(newPrev);
@@ -931,7 +916,7 @@ tokenOfferCreateApply(
 {
     Keylet const acctKeylet = keylet::account(acctID);
     if (auto const acct = view.read(acctKeylet);
-        priorBalance < view.fees().accountReserve((*acct)[sfOwnerCount] + 1))
+        priorBalance < accountReserve(view, acct, j, {.ownerCountDelta = 1}))
         return tecINSUFFICIENT_RESERVE;
 
     auto const offerID = keylet::nftokenOffer(acctID, seqProxy.value());
@@ -983,7 +968,7 @@ tokenOfferCreateApply(
     }
 
     // Update owner count.
-    adjustOwnerCount(view, view.peek(acctKeylet), 1, j);
+    increaseOwnerCount(view, acctID, {}, 1, j);
 
     return tesSUCCESS;
 }
diff --git a/src/libxrpl/ledger/helpers/OfferHelpers.cpp b/src/libxrpl/ledger/helpers/OfferHelpers.cpp
index 6e72b71564..caa6ffb8ae 100644
--- a/src/libxrpl/ledger/helpers/OfferHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/OfferHelpers.cpp
@@ -55,7 +55,7 @@ offerDelete(ApplyView& view, SLE::ref sle, beast::Journal j)
         }
     }
 
-    adjustOwnerCount(view, view.peek(keylet::account(owner)), -1, j);
+    decreaseOwnerCountForObject(view, owner, sle, 1, j);
 
     view.erase(sle);
 
diff --git a/src/libxrpl/ledger/helpers/PaymentChannelHelpers.cpp b/src/libxrpl/ledger/helpers/PaymentChannelHelpers.cpp
index 03b68e8860..d5a0b25681 100644
--- a/src/libxrpl/ledger/helpers/PaymentChannelHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/PaymentChannelHelpers.cpp
@@ -58,7 +58,7 @@ closeChannel(SLE::ref slep, ApplyView& view, uint256 const& key, beast::Journal
     XRPL_ASSERT(
         (*slep)[sfAmount] >= (*slep)[sfBalance], "xrpl::closeChannel : minimum channel amount");
     (*sle)[sfBalance] = (*sle)[sfBalance] + (*slep)[sfAmount] - (*slep)[sfBalance];
-    adjustOwnerCount(view, sle, -1, j);
+    decreaseOwnerCountForObject(view, sle, slep, 1, j);
     view.update(sle);
 
     // Remove PayChan from ledger
diff --git a/src/libxrpl/ledger/helpers/RippleStateHelpers.cpp b/src/libxrpl/ledger/helpers/RippleStateHelpers.cpp
index 5a2995c030..868c9fb26d 100644
--- a/src/libxrpl/ledger/helpers/RippleStateHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/RippleStateHelpers.cpp
@@ -9,6 +9,7 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/AmountConversions.h>
@@ -195,6 +196,7 @@ trustCreate(
                                 // Issuer should be the account being set.
     std::uint32_t uQualityIn,
     std::uint32_t uQualityOut,
+    SLE::ref sponsorSle,
     beast::Journal j)
 {
     JLOG(j.trace()) << "trustCreate: " << to_string(uSrcAccountID) << ", "
@@ -281,7 +283,9 @@ trustCreate(
     }
 
     sleRippleState->setFieldU32(sfFlags, uFlags);
-    adjustOwnerCount(view, sleAccount, 1, j);
+    increaseOwnerCount(view, sleAccount, sponsorSle, 1, j);
+
+    addSponsorToLedgerEntry(sleRippleState, sponsorSle, bSetHigh ? sfHighSponsor : sfLowSponsor);
 
     // ONLY: Create ripple balance.
     sleRippleState->setFieldAmount(sfBalance, bSetHigh ? -saBalance : saBalance);
@@ -317,6 +321,9 @@ trustDelete(
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
     }
 
+    removeSponsorFromLedgerEntry(sleRippleState, sfHighSponsor);
+    removeSponsorFromLedgerEntry(sleRippleState, sfLowSponsor);
+
     JLOG(j.trace()) << "trustDelete: Deleting ripple line: state";
     view.erase(sleRippleState);
 
@@ -369,11 +376,15 @@ updateTrustLine(
     {
         // VFALCO Where is the line being deleted?
         // Clear the reserve of the sender, possibly delete the line!
-        adjustOwnerCount(view, sle, -1, j);
+        auto const currentSponsor =
+            getLedgerEntryReserveSponsor(view, state, bSenderHigh ? sfHighSponsor : sfLowSponsor);
+        decreaseOwnerCount(view, sle, currentSponsor, 1, j);
 
         // Clear reserve flag.
         state->clearFlag(senderReserveFlag);
 
+        removeSponsorFromLedgerEntry(state, !bSenderHigh ? sfLowSponsor : sfHighSponsor);
+
         // Balance is zero, receiver reserve is clear.
         if (!after && !state->isFlag(receiverReserveFlag))
             return true;
@@ -381,12 +392,14 @@ updateTrustLine(
     return false;
 }
 
+// Only used in tests
 TER
 issueIOU(
     ApplyView& view,
     AccountID const& account,
     STAmount const& amount,
     Issue const& issue,
+    SLE::ref sponsorSle,
     beast::Journal j)
 {
     XRPL_ASSERT(
@@ -472,6 +485,7 @@ issueIOU(
         limit,
         0,
         0,
+        sponsorSle,
         j);
 }
 
@@ -620,7 +634,7 @@ canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, Acc
 
 TER
 addEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     XRPAmount priorBalance,
     Issue const& issue,
@@ -632,30 +646,45 @@ addEmptyHolding(
 
     auto const& issuerId = issue.getIssuer();
     auto const& currency = issue.currency;
-    if (isGlobalFrozen(view, issuerId))
+    if (isGlobalFrozen(ctx.view, issuerId))
         return tecFROZEN;  // LCOV_EXCL_LINE
 
     auto const& srcId = issuerId;
     auto const& dstId = accountID;
     auto const high = srcId > dstId;
     auto const index = keylet::trustLine(srcId, dstId, currency);
-    auto const sleSrc = view.peek(keylet::account(srcId));
-    auto const sleDst = view.peek(keylet::account(dstId));
+    auto const sleSrc = ctx.view.peek(keylet::account(srcId));
+    auto const sleDst = ctx.view.peek(keylet::account(dstId));
     if (!sleDst || !sleSrc)
         return tefINTERNAL;  // LCOV_EXCL_LINE
     if (!sleSrc->isFlag(lsfDefaultRipple))
         return tecINTERNAL;  // LCOV_EXCL_LINE
     // If the line already exists, don't create it again.
-    if (view.read(index))
+    if (ctx.view.read(index))
         return tecDUPLICATE;
 
+    // A reserve sponsor only covers tx.Account's own objects.
+    auto const sponsorExp = getEffectiveTxReserveSponsor(ctx, sleDst);
+    if (!sponsorExp)
+        return sponsorExp.error();  // LCOV_EXCL_LINE
+    auto const sponsorSle = *sponsorExp;
+
     // Can the account cover the trust line reserve ?
-    std::uint32_t const ownerCount = sleDst->at(sfOwnerCount);
-    if (priorBalance < view.fees().accountReserve(ownerCount + 1))
-        return tecNO_LINE_INSUF_RESERVE;
+    if (auto const ret = checkReserve(
+            ctx,
+            sleDst,
+            priorBalance,
+            sponsorSle,
+            {.ownerCountDelta = 1},
+            journal,
+            tecNO_LINE_INSUF_RESERVE);
+        !isTesSuccess(ret))
+    {
+        return ret;
+    }
 
     return trustCreate(
-        view,
+        ctx.view,
         high,
         srcId,
         dstId,
@@ -669,19 +698,20 @@ addEmptyHolding(
         /*saLimit=*/STAmount{Issue{currency, dstId}},
         /*uQualityIn=*/0,
         /*uQualityOut=*/0,
+        sponsorSle,
         journal);
 }
 
 TER
 removeEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     Issue const& issue,
     beast::Journal journal)
 {
     if (issue.native())
     {
-        auto const sle = view.read(keylet::account(accountID));
+        auto const sle = ctx.view.read(keylet::account(accountID));
         if (!sle)
             return tecINTERNAL;  // LCOV_EXCL_LINE
 
@@ -696,7 +726,7 @@ removeEmptyHolding(
     // If the account is the issuer, then no line should exist. Check anyway.
     // If a line does exist, it will get deleted. If not, return success.
     bool const accountIsIssuer = accountID == issue.account;
-    auto const line = view.peek(keylet::trustLine(accountID, issue));
+    auto const line = ctx.view.peek(keylet::trustLine(accountID, issue));
     if (!line)
         return accountIsIssuer ? (TER)tesSUCCESS : (TER)tecOBJECT_NOT_FOUND;
     if (!accountIsIssuer && line->at(sfBalance)->iou() != beast::kZero)
@@ -706,33 +736,43 @@ removeEmptyHolding(
     if (line->isFlag(lsfLowReserve))
     {
         // Clear reserve for low account.
-        auto sleLowAccount = view.peek(keylet::account(line->at(sfLowLimit)->getIssuer()));
+        auto sleLowAccount = ctx.view.peek(keylet::account(line->at(sfLowLimit)->getIssuer()));
         if (!sleLowAccount)
             return tecINTERNAL;  // LCOV_EXCL_LINE
 
-        adjustOwnerCount(view, sleLowAccount, -1, journal);
+        auto const currentLowSponsor = getLedgerEntryReserveSponsor(ctx.view, line, sfLowSponsor);
+
+        decreaseOwnerCount(ctx.view, sleLowAccount, currentLowSponsor, 1, journal);
         // It's not really necessary to clear the reserve flag, since the line
         // is about to be deleted, but this will make the metadata reflect an
         // accurate state at the time of deletion.
         line->clearFlag(lsfLowReserve);
+        removeSponsorFromLedgerEntry(line, sfLowSponsor);
     }
 
     if (line->isFlag(lsfHighReserve))
     {
         // Clear reserve for high account.
-        auto sleHighAccount = view.peek(keylet::account(line->at(sfHighLimit)->getIssuer()));
+        auto sleHighAccount = ctx.view.peek(keylet::account(line->at(sfHighLimit)->getIssuer()));
         if (!sleHighAccount)
             return tecINTERNAL;  // LCOV_EXCL_LINE
 
-        adjustOwnerCount(view, sleHighAccount, -1, journal);
+        auto const currentHighSponsor = getLedgerEntryReserveSponsor(ctx.view, line, sfHighSponsor);
+
+        decreaseOwnerCount(ctx.view, sleHighAccount, currentHighSponsor, 1, journal);
         // It's not really necessary to clear the reserve flag, since the line
         // is about to be deleted, but this will make the metadata reflect an
         // accurate state at the time of deletion.
         line->clearFlag(lsfHighReserve);
+        removeSponsorFromLedgerEntry(line, sfHighSponsor);
     }
 
     return trustDelete(
-        view, line, line->at(sfLowLimit)->getIssuer(), line->at(sfHighLimit)->getIssuer(), journal);
+        ctx.view,
+        line,
+        line->at(sfLowLimit)->getIssuer(),
+        line->at(sfHighLimit)->getIssuer(),
+        journal);
 }
 
 TER
@@ -768,6 +808,9 @@ deleteAMMTrustLine(
     if (ammAccountID && (low != *ammAccountID && high != *ammAccountID))
         return terNO_AMM;
 
+    auto const sponsorSle =
+        getLedgerEntryReserveSponsor(view, sleState, !ammLow ? sfLowSponsor : sfHighSponsor);
+
     if (auto const ter = trustDelete(view, sleState, low, high, j); !isTesSuccess(ter))
     {
         JLOG(j.error()) << "deleteAMMTrustLine: failed to delete the trustline.";
@@ -778,7 +821,7 @@ deleteAMMTrustLine(
     if (!sleState->isFlag(uFlags))
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
-    adjustOwnerCount(view, !ammLow ? sleLow : sleHigh, -1, j);
+    decreaseOwnerCount(view, !ammLow ? sleLow : sleHigh, sponsorSle, 1, j);
 
     return tesSUCCESS;
 }
diff --git a/src/libxrpl/ledger/helpers/SponsorHelpers.cpp b/src/libxrpl/ledger/helpers/SponsorHelpers.cpp
new file mode 100644
index 0000000000..7e0c041854
--- /dev/null
+++ b/src/libxrpl/ledger/helpers/SponsorHelpers.cpp
@@ -0,0 +1,345 @@
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
+
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/ledger/helpers/OracleHelpers.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
+
+#include <cstdint>
+#include <expected>
+#include <optional>
+#include <unordered_set>
+
+namespace xrpl {
+
+bool
+isReserveSponsorAllowed(TxType txType)
+{
+    // Transaction types explicitly allow-listed for reserve sponsorship, for
+    // v1. Lazily-initialized function-local static: constructed once on first
+    // use, with no startup cost paid by clients that never call this.
+    static std::unordered_set<TxType> const kReserveSponsorAllowed = {
+        ttDELEGATE_SET,
+        ttDEPOSIT_PREAUTH,
+        ttPAYMENT,
+        ttSIGNER_LIST_SET,
+        ttCHECK_CANCEL,
+        ttCHECK_CASH,
+        ttCHECK_CREATE,
+        ttESCROW_CANCEL,
+        ttESCROW_CREATE,
+        ttESCROW_FINISH,
+        ttPAYCHAN_CLAIM,
+        ttPAYCHAN_CREATE,
+        ttPAYCHAN_FUND,
+        ttCLAWBACK,
+        ttMPTOKEN_AUTHORIZE,
+        ttMPTOKEN_ISSUANCE_CREATE,
+        ttMPTOKEN_ISSUANCE_DESTROY,
+        ttMPTOKEN_ISSUANCE_SET,
+        ttTRUST_SET,
+        ttCREDENTIAL_ACCEPT,
+        ttCREDENTIAL_CREATE,
+        ttCREDENTIAL_DELETE,
+        ttACCOUNT_SET,
+        ttREGULAR_KEY_SET,
+        ttSPONSORSHIP_TRANSFER,
+    };
+    return kReserveSponsorAllowed.contains(txType);
+}
+
+std::optional<AccountID>
+getTxReserveSponsorID(STTx const& tx)
+{
+    if (tx.isFieldPresent(sfSponsor) && isReserveSponsored(tx))
+    {
+        XRPL_ASSERT(
+            getCurrentTransactionRules()->enabled(  // NOLINT(bugprone-unchecked-optional-access)
+                featureSponsor),
+            "xrpl::getTxReserveSponsorID : sponsor exists + Sponsor enabled");
+        return tx.getAccountID(sfSponsor);
+    }
+    return {};
+}
+
+std::expected<SLE::pointer, TER>
+getTxReserveSponsor(ApplyViewContext ctx)
+{
+    auto const sponsorID = getTxReserveSponsorID(ctx.tx);
+    if (sponsorID)
+    {
+        XRPL_ASSERT(
+            ctx.view.rules().enabled(featureSponsor),
+            "xrpl::getTxReserveSponsor : sponsor exists + Sponsor enabled");
+        auto sle = ctx.view.peek(keylet::account(*sponsorID));
+
+        // already checked in Transactor::checkSponsor
+        if (!sle)
+            return std::unexpected(tecINTERNAL);  // LCOV_EXCL_LINE
+        return sle;
+    }
+    return SLE::pointer();
+}
+
+std::expected<SLE::const_pointer, TER>
+getTxReserveSponsor(ReadView const& view, STTx const& tx)
+{
+    auto const sponsorID = getTxReserveSponsorID(tx);
+    if (sponsorID)
+    {
+        XRPL_ASSERT(
+            view.rules().enabled(featureSponsor),
+            "xrpl::getTxReserveSponsor : sponsor exists + Sponsor enabled");
+        auto sle = view.read(keylet::account(*sponsorID));
+
+        // already checked in Transactor::checkSponsor
+        if (!sle)
+            return std::unexpected(tecINTERNAL);  // LCOV_EXCL_LINE
+        return sle;
+    }
+    return SLE::pointer();
+}
+
+std::expected<SLE::pointer, TER>
+getEffectiveTxReserveSponsor(ApplyViewContext ctx, SLE::const_ref accountSle)
+{
+    // A reserve sponsor only covers tx.Account's own objects.
+    if (ctx.view.rules().enabled(fixCleanup3_2_0))
+    {
+        XRPL_ASSERT(
+            accountSle && accountSle->getType() == ltACCOUNT_ROOT,
+            "xrpl::getEffectiveTxReserveSponsor : accountSle exists and is account type");
+    }
+    else
+    {
+        XRPL_ASSERT(
+            accountSle &&
+                ((accountSle->getType() == ltACCOUNT_ROOT) || (accountSle->getType() == ltESCROW)),
+            "xrpl::getEffectiveTxReserveSponsor : accountSle exists and is account type");
+    }
+
+    if (isPseudoAccount(accountSle) || accountSle->getAccountID(sfAccount) != ctx.tx[sfAccount])
+        return SLE::pointer();
+    return getTxReserveSponsor(ctx);
+}
+
+std::optional<AccountID>
+getLedgerEntryReserveSponsorID(SLE::const_ref sle, SF_ACCOUNT const& field)
+{
+    XRPL_ASSERT(
+        (sle &&
+         ((sle->getType() == ltRIPPLE_STATE && (field == sfHighSponsor || field == sfLowSponsor)) ||
+          (sle->getType() != ltRIPPLE_STATE && field == sfSponsor))),
+        "xrpl::getLedgerEntryReserveSponsorID : correct sfield");
+
+    if (sle->isFieldPresent(field))
+        return sle->getAccountID(field);
+    return {};
+}
+
+SLE::pointer
+getLedgerEntryReserveSponsor(ApplyView& view, SLE::const_ref sle, SF_ACCOUNT const& field)
+{
+    auto const sponsorID = getLedgerEntryReserveSponsorID(sle, field);
+    if (sponsorID)
+    {
+        XRPL_ASSERT(
+            view.rules().enabled(featureSponsor),
+            "xrpl::getLedgerEntryReserveSponsor : sponsor exists + Sponsor enabled");
+        return view.peek(keylet::account(*sponsorID));
+    }
+    return {};
+}
+
+void
+addSponsorToLedgerEntry(SLE::ref sle, SLE::const_ref sponsorSle, SF_ACCOUNT const& field)
+{
+    XRPL_ASSERT(
+        (sle->getType() == ltRIPPLE_STATE && (field == sfHighSponsor || field == sfLowSponsor)) ||
+            (sle->getType() != ltRIPPLE_STATE && field == sfSponsor),
+        "addSponsorToLedgerEntry : Invalid field to the LedgerEntry");
+    if (sponsorSle)
+    {
+        XRPL_ASSERT(
+            getCurrentTransactionRules()->enabled(  // NOLINT(bugprone-unchecked-optional-access)
+                featureSponsor),
+            "xrpl::addSponsorToLedgerEntry : sponsor exists + Sponsor enabled");
+        sle->setAccountID(field, sponsorSle->getAccountID(sfAccount));
+    }
+}
+
+void
+addSponsorToLedgerEntry(ApplyViewContext ctx, SLE::ref sle, SF_ACCOUNT const& field)
+{
+    // getTxReserveSponsor yields a null pointer when the tx is not
+    // reserve-sponsored, so addSponsorToLedgerEntry becomes a no-op then. The
+    // error case (tecINTERNAL) is an already-checked invariant; skip stamping.
+    auto const sponsorSle = getTxReserveSponsor(ctx);
+    if (sponsorSle && *sponsorSle)
+    {
+        XRPL_ASSERT(
+            ctx.view.rules().enabled(featureSponsor),
+            "xrpl::addSponsorToLedgerEntry : sponsor exists + Sponsor enabled");
+        addSponsorToLedgerEntry(sle, *sponsorSle, field);
+    }
+}
+
+void
+removeSponsorFromLedgerEntry(SLE::ref sle, SF_ACCOUNT const& field)
+{
+    XRPL_ASSERT(
+        (sle->getType() == ltRIPPLE_STATE && (field == sfHighSponsor || field == sfLowSponsor)) ||
+            (sle->getType() != ltRIPPLE_STATE && field == sfSponsor),
+        "removeSponsorFromLedgerEntry : Invalid field to the LedgerEntry");
+    if (sle->isFieldPresent(field))
+    {
+        XRPL_ASSERT(
+            getCurrentTransactionRules()->enabled(  // NOLINT(bugprone-unchecked-optional-access)
+                featureSponsor),
+            "xrpl::removeSponsorFromLedgerEntry : sponsor exists + Sponsor enabled");
+        sle->makeFieldAbsent(field);
+    }
+}
+
+bool
+isLedgerEntryOwner(ReadView const& view, SLE const& sle, AccountID const& account)
+{
+    switch (sle.getType())
+    {
+        case ltCHECK:
+        case ltESCROW:
+        case ltPAYCHAN:
+        case ltMPTOKEN:
+        case ltDELEGATE:
+        case ltDEPOSIT_PREAUTH:
+            return sle.getAccountID(sfAccount) == account;
+        case ltMPTOKEN_ISSUANCE:
+            return sle.getAccountID(sfIssuer) == account;
+        case ltSIGNER_LIST: {
+            auto const signerList = view.read(keylet::signerList(account));
+            if (!signerList)
+                return false;
+            return signerList->key() == sle.key();
+        }
+        case ltCREDENTIAL: {
+            auto const& ownerField = sle.isFlag(lsfAccepted) ? sfSubject : sfIssuer;
+            return sle.getAccountID(ownerField) == account;
+        }
+        case ltRIPPLE_STATE: {
+            if (sle.isFlag(lsfHighReserve))
+            {
+                auto const highAccount = sle.getFieldAmount(sfHighLimit).getIssuer();
+                if (highAccount == account)
+                    return true;
+            }
+            if (sle.isFlag(lsfLowReserve))
+            {
+                auto const lowAccount = sle.getFieldAmount(sfLowLimit).getIssuer();
+                if (lowAccount == account)
+                    return true;
+            }
+            // Reachable: the sponsee may be a third party or the side of the
+            // line that holds no reserve (e.g. the issuer). Callers map this
+            // to tecNO_PERMISSION.
+            return false;
+        }
+        default:
+            // LCOV_EXCL_START
+            UNREACHABLE("xrpl::isLedgerEntryOwner : object is not supported by sponsorship.");
+            return false;
+            // LCOV_EXCL_STOP
+    };
+}
+
+bool
+isLedgerEntrySupportedBySponsorship(SLE const& sle)
+{
+    switch (sle.getType())
+    {
+        case ltCHECK:
+        case ltESCROW:
+        case ltPAYCHAN:
+        case ltMPTOKEN:
+        case ltDELEGATE:
+        case ltDEPOSIT_PREAUTH:
+        case ltMPTOKEN_ISSUANCE:
+        case ltSIGNER_LIST:
+        case ltCREDENTIAL:
+        case ltRIPPLE_STATE:
+            return true;
+        default:
+            return false;
+    };
+}
+
+std::uint32_t
+getLedgerEntryOwnerCount(SLE const& sle)
+{
+    switch (sle.getType())
+    {
+        case ltORACLE: {
+            return calculateOracleReserve(sle.getFieldArray(sfPriceDataSeries));
+        }
+        // Vaults require 2 owner counts (the vault and a pseudo-account)
+        case ltVAULT:
+            return 2;
+        case ltSIGNER_LIST: {
+            // Mirror SignerListSet's owner-count accounting so that create and
+            // delete agree. Modern lists (post-MultiSignReserve) carry the
+            // lsfOneOwnerCount flag and cost a single owner count. Legacy
+            // pre-MultiSignReserve lists cost 2 + signer_count owner counts
+            if (sle.isFlag(lsfOneOwnerCount))
+                return 1;
+            return 2 + static_cast<std::uint32_t>(sle.getFieldArray(sfSignerEntries).size());
+        }
+        case ltACCOUNT_ROOT:
+            // LCOV_EXCL_START
+            UNREACHABLE("AccountRoots are not supported by object sponsorship.");
+            return 0;
+            // LCOV_EXCL_STOP
+        default:
+            return 1;
+    }
+}
+
+SF_ACCOUNT const&
+getLedgerEntrySponsorField(SLE const& sle, AccountID const& owner)
+{
+    switch (sle.getType())
+    {
+        case ltRIPPLE_STATE: {
+            if (sle.isFlag(lsfHighReserve))
+            {
+                auto const highAccount = sle.getFieldAmount(sfHighLimit).getIssuer();
+                if (highAccount == owner)
+                    return sfHighSponsor;
+            }
+            if (sle.isFlag(lsfLowReserve))
+            {
+                auto const lowAccount = sle.getFieldAmount(sfLowLimit).getIssuer();
+                if (lowAccount == owner)
+                    return sfLowSponsor;
+            }
+            // LCOV_EXCL_START
+            UNREACHABLE("xrpl::getLedgerEntrySponsorField : unknown owner for RippleState");
+            return sfSponsor;
+            // LCOV_EXCL_STOP
+        }
+        default:
+            return sfSponsor;
+    }
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/ledger/helpers/TokenHelpers.cpp b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
index 0ab97a4b60..06e366847d 100644
--- a/src/libxrpl/ledger/helpers/TokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
@@ -10,6 +10,7 @@
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Concepts.h>
@@ -571,7 +572,7 @@ canAddHolding(ReadView const& view, Asset const& asset)
 
 TER
 addEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     XRPAmount priorBalance,
     Asset const& asset,
@@ -579,21 +580,21 @@ addEmptyHolding(
 {
     return std::visit(
         [&]<ValidIssueType TIss>(TIss const& issue) -> TER {
-            return addEmptyHolding(view, accountID, priorBalance, issue, journal);
+            return addEmptyHolding(ctx, accountID, priorBalance, issue, journal);
         },
         asset.value());
 }
 
 TER
 removeEmptyHolding(
-    ApplyView& view,
+    ApplyViewContext ctx,
     AccountID const& accountID,
     Asset const& asset,
     beast::Journal journal)
 {
     return std::visit(
         [&]<ValidIssueType TIss>(TIss const& issue) -> TER {
-            return removeEmptyHolding(view, accountID, issue, journal);
+            return removeEmptyHolding(ctx, accountID, issue, journal);
         },
         asset.value());
 }
@@ -647,6 +648,7 @@ directSendNoFeeIOU(
     AccountID const& uReceiverID,
     STAmount const& saAmount,
     bool bCheckIssuer,
+    SLE::ref sponsorSle,
     beast::Journal j)
 {
     AccountID const& issuer = saAmount.getIssuer();
@@ -717,7 +719,12 @@ directSendNoFeeIOU(
         // Sender quality out is 0.
         {
             // Clear the reserve of the sender, possibly delete the line!
-            adjustOwnerCount(view, view.peek(keylet::account(uSenderID)), -1, j);
+            auto const currentSponsor = getLedgerEntryReserveSponsor(
+                view, sleRippleState, !bSenderHigh ? sfLowSponsor : sfHighSponsor);
+            decreaseOwnerCount(view, view.peek(keylet::account(uSenderID)), currentSponsor, 1, j);
+
+            removeSponsorFromLedgerEntry(
+                sleRippleState, !bSenderHigh ? sfLowSponsor : sfHighSponsor);
 
             // Clear reserve flag.
             sleRippleState->clearFlag(senderReserveFlag);
@@ -780,6 +787,7 @@ directSendNoFeeIOU(
         saReceiverLimit,
         0,
         0,
+        sponsorSle,
         j);
 }
 
@@ -794,6 +802,7 @@ directSendNoLimitIOU(
     STAmount const& saAmount,
     STAmount& saActual,
     beast::Journal j,
+    SLE::ref sponsorSle,
     WaiveTransferFee waiveFee)
 {
     auto const& issuer = saAmount.getIssuer();
@@ -806,7 +815,8 @@ directSendNoLimitIOU(
     if (uSenderID == issuer || uReceiverID == issuer || issuer == noAccount())
     {
         // Direct send: redeeming IOUs and/or sending own IOUs.
-        auto const ter = directSendNoFeeIOU(view, uSenderID, uReceiverID, saAmount, false, j);
+        auto const ter =
+            directSendNoFeeIOU(view, uSenderID, uReceiverID, saAmount, false, sponsorSle, j);
         if (!isTesSuccess(ter))
             return ter;
         saActual = saAmount;
@@ -824,10 +834,12 @@ directSendNoLimitIOU(
                     << to_string(uReceiverID) << " : deliver=" << saAmount.getFullText()
                     << " cost=" << saActual.getFullText();
 
-    TER terResult = directSendNoFeeIOU(view, issuer, uReceiverID, saAmount, true, j);
+    TER terResult = directSendNoFeeIOU(view, issuer, uReceiverID, saAmount, true, sponsorSle, j);
 
     if (tesSUCCESS == terResult)
-        terResult = directSendNoFeeIOU(view, uSenderID, issuer, saActual, true, j);
+    {
+        terResult = directSendNoFeeIOU(view, uSenderID, issuer, saActual, true, sponsorSle, j);
+    }
 
     return terResult;
 }
@@ -870,7 +882,8 @@ directSendNoLimitMultiIOU(
         if (senderID == issuer || receiverID == issuer || issuer == noAccount())
         {
             // Direct send: redeeming IOUs and/or sending own IOUs.
-            if (auto const ter = directSendNoFeeIOU(view, senderID, receiverID, amount, false, j);
+            if (auto const ter =
+                    directSendNoFeeIOU(view, senderID, receiverID, amount, false, {}, j);
                 !isTesSuccess(ter))
                 return ter;
             actual += amount;
@@ -894,14 +907,14 @@ directSendNoLimitMultiIOU(
                         << to_string(receiverID) << " : deliver=" << amount.getFullText()
                         << " cost=" << actual.getFullText();
 
-        if (TER const terResult = directSendNoFeeIOU(view, issuer, receiverID, amount, true, j))
+        if (TER const terResult = directSendNoFeeIOU(view, issuer, receiverID, amount, true, {}, j))
             return terResult;
     }
 
     if (senderID != issuer && takeFromSender)
     {
         if (TER const terResult =
-                directSendNoFeeIOU(view, senderID, issuer, takeFromSender, true, j))
+                directSendNoFeeIOU(view, senderID, issuer, takeFromSender, true, {}, j))
             return terResult;
     }
 
@@ -915,6 +928,7 @@ accountSendIOU(
     AccountID const& uReceiverID,
     STAmount const& saAmount,
     beast::Journal j,
+    SLE::ref sponsorSle,
     WaiveTransferFee waiveFee)
 {
     if (view.rules().enabled(fixAMMv1_1))
@@ -946,7 +960,8 @@ accountSendIOU(
         JLOG(j.trace()) << "accountSendIOU: " << to_string(uSenderID) << " -> "
                         << to_string(uReceiverID) << " : " << saAmount.getFullText();
 
-        return directSendNoLimitIOU(view, uSenderID, uReceiverID, saAmount, saActual, j, waiveFee);
+        return directSendNoLimitIOU(
+            view, uSenderID, uReceiverID, saAmount, saActual, j, sponsorSle, waiveFee);
     }
 
     /* XRP send which does not check reserve and can do pure adjustment.
@@ -1475,7 +1490,7 @@ directSendNoFee(
 {
     return saAmount.asset().visit(
         [&](Issue const&) {
-            return directSendNoFeeIOU(view, uSenderID, uReceiverID, saAmount, bCheckIssuer, j);
+            return directSendNoFeeIOU(view, uSenderID, uReceiverID, saAmount, bCheckIssuer, {}, j);
         },
         [&](MPTIssue const&) {
             XRPL_ASSERT(!bCheckIssuer, "xrpl::directSendNoFee : not checking issuer");
@@ -1490,12 +1505,13 @@ accountSend(
     AccountID const& uReceiverID,
     STAmount const& saAmount,
     beast::Journal j,
+    SLE::ref sponsorSle,
     WaiveTransferFee waiveFee,
     AllowMPTOverflow allowOverflow)
 {
     return saAmount.asset().visit(
         [&](Issue const&) {
-            return accountSendIOU(view, uSenderID, uReceiverID, saAmount, j, waiveFee);
+            return accountSendIOU(view, uSenderID, uReceiverID, saAmount, j, sponsorSle, waiveFee);
         },
         [&](MPTIssue const&) {
             return accountSendMPT(
diff --git a/src/libxrpl/protocol/Indexes.cpp b/src/libxrpl/protocol/Indexes.cpp
index 76ff868f9e..ced18d4db6 100644
--- a/src/libxrpl/protocol/Indexes.cpp
+++ b/src/libxrpl/protocol/Indexes.cpp
@@ -84,6 +84,7 @@ enum class LedgerNameSpace : std::uint16_t {
     Vault = 'V',
     LoanBroker = 'l',  // lower-case L
     Loan = 'L',
+    Sponsorship = '>',
 
     // No longer used or supported. Left here to reserve the space to avoid accidental reuse.
     Contract [[deprecated]] = 'c',
@@ -326,6 +327,12 @@ signerList(AccountID const& account) noexcept
     return signerList(account, 0);
 }
 
+Keylet
+sponsorship(AccountID const& sponsor, AccountID const& sponsee) noexcept
+{
+    return {ltSPONSORSHIP, indexHash(LedgerNameSpace::Sponsorship, sponsor, sponsee)};
+}
+
 Keylet
 check(AccountID const& id, std::uint32_t seq) noexcept
 {
diff --git a/src/libxrpl/protocol/InnerObjectFormats.cpp b/src/libxrpl/protocol/InnerObjectFormats.cpp
index 66b2822a42..0bdb217771 100644
--- a/src/libxrpl/protocol/InnerObjectFormats.cpp
+++ b/src/libxrpl/protocol/InnerObjectFormats.cpp
@@ -160,6 +160,14 @@ InnerObjectFormats::InnerObjectFormats()
             {sfTxnSignature, SoeOptional},
             {sfSigners, SoeOptional},
         });
+
+    add(sfSponsorSignature.jsonName.cStr(),
+        sfSponsorSignature.getCode(),
+        {
+            {sfSigningPubKey, SoeOptional},
+            {sfTxnSignature, SoeOptional},
+            {sfSigners, SoeOptional},
+        });
 }
 
 InnerObjectFormats const&
diff --git a/src/libxrpl/protocol/LedgerFormats.cpp b/src/libxrpl/protocol/LedgerFormats.cpp
index 8b91bb7930..a29ea49266 100644
--- a/src/libxrpl/protocol/LedgerFormats.cpp
+++ b/src/libxrpl/protocol/LedgerFormats.cpp
@@ -15,6 +15,7 @@ LedgerFormats::getCommonFields()
         {sfLedgerIndex, SoeOptional},
         {sfLedgerEntryType, SoeRequired},
         {sfFlags, SoeRequired},
+        {sfSponsor, SoeOptional},
     };
     return kCommonFields;
 }
diff --git a/src/libxrpl/protocol/STObject.cpp b/src/libxrpl/protocol/STObject.cpp
index 869700baed..e86b3fb6e6 100644
--- a/src/libxrpl/protocol/STObject.cpp
+++ b/src/libxrpl/protocol/STObject.cpp
@@ -634,16 +634,16 @@ STObject::getAccountID(SField const& field) const
 }
 
 AccountID
-STObject::getFeePayer() const
+STObject::getInitiator() const
 {
-    // If sfDelegate is present, the delegate account is the payer
+    // If sfDelegate is present, the delegate account is the initiator
     // note: if a delegate is specified, its authorization to act on behalf of the account is
     // enforced in `Transactor::invokeCheckPermission`
     // cryptographic signature validity is checked separately (e.g., in `Transactor::checkSign`)
     if (isFieldPresent(sfDelegate))
         return getAccountID(sfDelegate);
 
-    // Default payer
+    // Default initiator
     return getAccountID(sfAccount);
 }
 
diff --git a/src/libxrpl/protocol/STTx.cpp b/src/libxrpl/protocol/STTx.cpp
index 8438d3498b..be4ba2e8e5 100644
--- a/src/libxrpl/protocol/STTx.cpp
+++ b/src/libxrpl/protocol/STTx.cpp
@@ -28,6 +28,7 @@
 #include <xrpl/protocol/SeqProxy.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/Sign.h>
+#include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/TxFormats.h>
 #include <xrpl/protocol/jss.h>
 
@@ -271,6 +272,13 @@ STTx::checkSign(Rules const& rules) const
             return std::unexpected("Counterparty: " + ret.error());
     }
 
+    if (isFieldPresent(sfSponsorSignature))
+    {
+        auto const sponsorSignatureObj = getFieldObject(sfSponsorSignature);
+        if (auto const ret = checkSign(rules, sponsorSignatureObj); !ret)
+            return std::unexpected("Sponsor: " + ret.error());
+    }
+
     // Verify the batch signer signatures here too, so they are cached with the
     // rest of signature checking (checkValidity / SF_SIGGOOD) and stay out of
     // the transaction engine. Gated on a batch (batchTxnIds_ seated) that
@@ -551,7 +559,7 @@ STTx::checkMultiSign(Rules const& rules, STObject const& sigObject) const
     // For delegated transactions sfDelegate is the account whose signer list is checked,
     // the delegate account itself can not be among the signers.
     auto const txnAccountID =
-        &sigObject != this ? std::nullopt : std::optional<AccountID>(getFeePayer());
+        &sigObject != this ? std::nullopt : std::optional<AccountID>(getInitiator());
 
     // We can ease the computational load inside the loop a bit by
     // pre-constructing part of the data that we hash.  Fill a Serializer
@@ -603,6 +611,15 @@ STTx::getBatchTransactionIDs() const
     return *batchTxnIds_;
 }
 
+AccountID
+STTx::getFeePayerID() const
+{
+    if (isFieldPresent(sfSponsor) && ((getFieldU32(sfSponsorFlags) & spfSponsorFee) != 0u))
+        return at(sfSponsor);
+
+    return getInitiator();
+}
+
 //------------------------------------------------------------------------------
 
 static bool
diff --git a/src/libxrpl/protocol/TER.cpp b/src/libxrpl/protocol/TER.cpp
index a6f8192a2f..c2167d58ce 100644
--- a/src/libxrpl/protocol/TER.cpp
+++ b/src/libxrpl/protocol/TER.cpp
@@ -107,6 +107,7 @@ transResults()
         MAKE_ERROR(tecPSEUDO_ACCOUNT,                "This operation is not allowed against a pseudo-account."),
         MAKE_ERROR(tecPRECISION_LOSS,                "The amounts used by the transaction cannot interact."),
         MAKE_ERROR(tecBAD_PROOF,                     "Proof cannot be verified"),
+        MAKE_ERROR(tecNO_SPONSOR_PERMISSION,         "Sponsor has not authorized this transaction."),
 
         MAKE_ERROR(tefALREADY,                     "The exact transaction was already in this ledger."),
         MAKE_ERROR(tefBAD_ADD_AUTH,                "Not authorized to add account."),
@@ -220,6 +221,7 @@ transResults()
         MAKE_ERROR(terADDRESS_COLLISION,      "Failed to allocate an unique account address."),
         MAKE_ERROR(terNO_DELEGATE_PERMISSION, "Delegated account lacks permission to perform this transaction."),
         MAKE_ERROR(terLOCKED,                 "Fund is locked."),
+        MAKE_ERROR(terNO_PERMISSION,          "No permission to perform requested operation."),
 
         MAKE_ERROR(tesSUCCESS,                "The transaction was applied. Only final in a validated ledger."),
     };
diff --git a/src/libxrpl/protocol/TxFormats.cpp b/src/libxrpl/protocol/TxFormats.cpp
index b926bdf0e5..e4d4c4b03c 100644
--- a/src/libxrpl/protocol/TxFormats.cpp
+++ b/src/libxrpl/protocol/TxFormats.cpp
@@ -30,6 +30,9 @@ TxFormats::getCommonFields()
         {sfSigners, SoeOptional},  // submit_multisigned
         {sfNetworkID, SoeOptional},
         {sfDelegate, SoeOptional},
+        {sfSponsor, SoeOptional},
+        {sfSponsorFlags, SoeOptional},
+        {sfSponsorSignature, SoeOptional},
     };
     return kCommonFields;
 }
diff --git a/src/libxrpl/tx/Transactor.cpp b/src/libxrpl/tx/Transactor.cpp
index 0f6988543e..065dead1fd 100644
--- a/src/libxrpl/tx/Transactor.cpp
+++ b/src/libxrpl/tx/Transactor.cpp
@@ -17,6 +17,7 @@
 #include <xrpl/ledger/helpers/NFTokenHelpers.h>
 #include <xrpl/ledger/helpers/OfferHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
@@ -41,6 +42,7 @@
 #include <xrpl/tx/apply.h>
 #include <xrpl/tx/applySteps.h>
 
+#include <algorithm>
 #include <cstddef>
 #include <cstdint>
 #include <exception>
@@ -167,6 +169,58 @@ preflightCheckSimulateKeys(ApplyFlags flags, STObject const& sigObject, beast::J
 
 }  // namespace detail
 
+static NotTEC
+preflight1Sponsor(PreflightContext const& ctx)
+{
+    bool const hasSponsor = ctx.tx.isFieldPresent(sfSponsor);
+    bool const hasSponsorFlags = ctx.tx.isFieldPresent(sfSponsorFlags);
+    bool const hasSponsorSig = ctx.tx.isFieldPresent(sfSponsorSignature);
+
+    if ((hasSponsor || hasSponsorFlags || hasSponsorSig) && !ctx.rules.enabled(featureSponsor))
+        return temDISABLED;
+
+    if (hasSponsor != hasSponsorFlags)
+    {
+        JLOG(ctx.j.debug()) << "preflight1: sponsor and sponsor flags mismatch";
+        return temINVALID_FLAG;
+    }
+    if (hasSponsorSig && (!hasSponsor || !hasSponsorFlags))
+    {
+        JLOG(ctx.j.debug()) << "preflight1: sponsor signature without sponsor definition";
+        return temMALFORMED;
+    }
+
+    if (hasSponsorFlags)
+    {
+        auto const sponsorFlags = ctx.tx.getFieldU32(sfSponsorFlags);
+        if (((sponsorFlags & spfSponsorFlagMask) != 0u) || sponsorFlags == 0)
+        {
+            JLOG(ctx.j.debug()) << "preflight1: invalid sponsor flags";
+            return temINVALID_FLAG;
+        }
+
+        // Reserve sponsorship is only permitted for an explicit allow-list of
+        // transaction types, for v1. All other tx types reject spfSponsorReserve here.
+        if (isReserveSponsored(ctx.tx))
+        {
+            if (!isReserveSponsorAllowed(ctx.tx.getTxnType()))
+            {
+                JLOG(ctx.j.debug())
+                    << "preflight1: spfSponsorReserve not allowed for this transaction type";
+                return temINVALID_FLAG;
+            }
+        }
+    }
+
+    if (hasSponsor && ctx.tx.getAccountID(sfSponsor) == ctx.tx.getAccountID(sfAccount))
+    {
+        JLOG(ctx.j.debug()) << "preflight1: Sponsor account cannot be the same as the account";
+        return temMALFORMED;
+    }
+
+    return tesSUCCESS;
+}
+
 /** Performs early sanity checks on the account and fee fields */
 NotTEC
 Transactor::preflight1(PreflightContext const& ctx, std::uint32_t flagMask)
@@ -230,6 +284,9 @@ Transactor::preflight1(PreflightContext const& ctx, std::uint32_t flagMask)
     if (ctx.tx.isFlag(tfInnerBatchTxn) != ctx.parentBatchId.has_value())
         return temINVALID_INNER_BATCH;
 
+    if (auto const ter = preflight1Sponsor(ctx); !isTesSuccess(ter))
+        return ter;
+
     return tesSUCCESS;
 }
 
@@ -343,6 +400,44 @@ Transactor::checkPermission(
     return tesSUCCESS;
 }
 
+NotTEC
+Transactor::checkSponsor(ReadView const& view, STTx const& tx)
+{
+    if (!tx.isFieldPresent(sfSponsor))
+        return tesSUCCESS;
+
+    // Reserve sponsorship with permissioned delegation is disallowed.
+    if (tx.isFieldPresent(sfDelegate) && isReserveSponsored(tx))
+        return temINVALID;
+
+    if (!view.exists(keylet::account(tx.getAccountID(sfSponsor))))
+        return terNO_ACCOUNT;
+
+    // Skip Sponsorship existence checks if the sponsor has signed the transaction - this
+    // transaction is valid regardless of the Sponsorship object.
+    // The use of the Sponsorship object is properly handled in
+    // getFeePayer/checkReserve/increaseOwnerCount/decreaseOwnerCount.
+    if (tx.isFieldPresent(sfSponsorSignature))
+        return tesSUCCESS;
+
+    // If the transaction contains sfDelegate, the Sponsorship object should be
+    // between the sponsor and the delegate.
+    auto const sponsorshipSle =
+        view.read(keylet::sponsorship(tx.getAccountID(sfSponsor), tx.getInitiator()));
+
+    // sponsorship object missing for pre-funded (no co-signing) tx
+    if (!sponsorshipSle)
+        return terNO_PERMISSION;
+
+    if (isFeeSponsored(tx) && sponsorshipSle->isFlag(lsfSponsorshipRequireSignForFee))
+        return terNO_PERMISSION;
+
+    if (isReserveSponsored(tx) && sponsorshipSle->isFlag(lsfSponsorshipRequireSignForReserve))
+        return terNO_PERMISSION;
+
+    return tesSUCCESS;
+}
+
 XRPAmount
 Transactor::calculateBaseFee(ReadView const& view, STTx const& tx)
 {
@@ -351,6 +446,7 @@ Transactor::calculateBaseFee(ReadView const& view, STTx const& tx)
     // The computation has two parts:
     //  * The base fee, which is the same for most transactions.
     //  * The additional cost of each multisignature on the transaction.
+    //  * The additional cost of each multisignature on the sponsor.
     XRPAmount const baseFee = view.fees().base;
 
     // Each signer adds one more baseFee to the minimum required fee
@@ -358,7 +454,15 @@ Transactor::calculateBaseFee(ReadView const& view, STTx const& tx)
     std::size_t const signerCount =
         tx.isFieldPresent(sfSigners) ? tx.getFieldArray(sfSigners).size() : 0;
 
-    return baseFee + (signerCount * baseFee);
+    std::size_t sponsorSignerCount = 0;
+    if (tx.isFieldPresent(sfSponsorSignature))
+    {
+        auto const sponsorObj = tx.getFieldObject(sfSponsorSignature);
+        if (sponsorObj.isFieldPresent(sfSigners))
+            sponsorSignerCount += sponsorObj.getFieldArray(sfSigners).size();
+    }
+
+    return baseFee + ((signerCount + sponsorSignerCount) * baseFee);
 }
 
 XRPAmount
@@ -437,12 +541,51 @@ Transactor::checkFee(PreclaimContext const& ctx, XRPAmount baseFee)
     if (feePaid == beast::kZero)
         return tesSUCCESS;
 
-    auto const id = ctx.tx.getFeePayer();
-    auto const sle = ctx.view.read(keylet::account(id));
-    if (!sle)
-        return terNO_ACCOUNT;
+    auto const feePayer = getFeePayer(ctx.view, ctx.tx);
+    auto const payerSle = ctx.view.read(feePayer.keylet);
 
-    auto const balance = (*sle)[sfBalance].xrp();
+    if (!payerSle)
+    {
+        if (feePayer.type == FeePayerType::SponsorPreFunded)
+        {
+            // Sanity check: already checked in checkSponsor
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+        }
+
+        return terNO_ACCOUNT;
+    }
+
+    XRPAmount maxSpendable = beast::kZero;
+
+    if (feePayer.type == FeePayerType::SponsorPreFunded)
+    {
+        if (payerSle->getType() != ltSPONSORSHIP)
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+
+        if (payerSle->isFieldPresent(feePayer.balanceField))
+            maxSpendable = payerSle->getFieldAmount(feePayer.balanceField).xrp();
+
+        if (payerSle->isFieldPresent(sfMaxFee))
+        {
+            auto const cap = payerSle->getFieldAmount(sfMaxFee).xrp();
+            maxSpendable = std::min(maxSpendable, cap);
+        }
+    }
+    else
+    {
+        if (payerSle->getType() != ltACCOUNT_ROOT)
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+
+        if (feePayer.type == FeePayerType::SponsorCoSigned)
+        {
+            auto const sponsorReserve = accountReserve(ctx.view, payerSle, ctx.j);
+            maxSpendable = payerSle->getFieldAmount(sfBalance).xrp() - sponsorReserve;
+        }
+        else
+        {
+            maxSpendable = payerSle->getFieldAmount(feePayer.balanceField).xrp();
+        }
+    }
 
     // NOTE: Because preclaim evaluates against a static readview, it
     // does not reflect fee deductions from other transactions paid by
@@ -451,12 +594,12 @@ Transactor::checkFee(PreclaimContext const& ctx, XRPAmount baseFee)
     // transactions, this check may pass optimistically.
     // The fee shortfall will be handled by the Transactor::reset mechanism,
     // which caps the fee to the remaining actual balance.
-    if (balance < feePaid)
+    if (maxSpendable < feePaid)
     {
-        JLOG(ctx.j.trace()) << "Insufficient balance:" << " balance=" << to_string(balance)
+        JLOG(ctx.j.trace()) << "Insufficient balance:" << " balance=" << to_string(maxSpendable)
                             << " paid=" << to_string(feePaid);
 
-        if ((balance > beast::kZero) && !ctx.view.open())
+        if ((maxSpendable > beast::kZero) && !ctx.view.open())
         {
             // Closed ledger, non-zero balance, less than fee
             return tecINSUFF_FEE;
@@ -473,16 +616,72 @@ Transactor::payFee()
 {
     auto const feePaid = ctx_.tx[sfFee].xrp();
 
-    auto const feePayer = ctx_.tx.getFeePayer();
-    auto const sle = view().peek(keylet::account(feePayer));
+    auto const feePayer = getFeePayer(view(), ctx_.tx);
+    auto const sle = view().peek(feePayer.keylet);
+
+    JLOG(j_.trace()) << "Fee payer: " + to_string(feePayer.id);
+
     if (!sle)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
-    // Deduct the fee, so it's not available during the transaction.
-    // Will only write the account back if the transaction succeeds.
-    sle->setFieldAmount(sfBalance, sle->getFieldAmount(sfBalance) - feePaid);
-    if (feePayer != accountID_)
-        view().update(sle);  // done in `apply()` for the account
+    if (feePaid == beast::kZero)
+        return tesSUCCESS;
+
+    XRPAmount balance = beast::kZero;
+    if (sle->isFieldPresent(feePayer.balanceField))
+    {
+        balance = sle->getFieldAmount(feePayer.balanceField).xrp();
+    }
+    else if (feePayer.balanceField != sfFeeAmount)
+    {
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    // A co-signed sponsor pays the fee out of its own account balance, but must
+    // never be charged into its account reserve, and a pre-funded sponsorship's
+    // fee is capped by sfMaxFee. Mirror the spendable amount computed in
+    // checkFee() so both limits are enforced on the apply path too.
+    XRPAmount spendable = balance;
+    if (feePayer.type == FeePayerType::SponsorCoSigned)
+    {
+        auto const sponsorReserve = accountReserve(view(), sle, j_);
+        // max(balance - reserve, 0) with overflow handling
+        spendable = balance > sponsorReserve ? balance - sponsorReserve : beast::kZero;
+    }
+    else if (feePayer.type == FeePayerType::SponsorPreFunded && sle->isFieldPresent(sfMaxFee))
+    {
+        auto const cap = sle->getFieldAmount(sfMaxFee).xrp();
+        spendable = std::min(spendable, cap);
+    }
+
+    // Only sponsor fee-payers reject here on insufficient funds. For an
+    // ordinary account, the fee falls through and is capped by reset(), which
+    // caps to the account's balance. That capping is wrong for sponsors: a
+    // co-signed sponsor would be charged into its own reserve, and a prefunded
+    // sponsorship's fee amount should be rejected rather than partially spent.
+    if (feePaid > spendable &&
+        (feePayer.type == FeePayerType::SponsorPreFunded ||
+         feePayer.type == FeePayerType::SponsorCoSigned))
+    {
+        if ((spendable > beast::kZero) && !view().open())
+            return tecINSUFF_FEE;
+
+        return terINSUF_FEE_B;
+    }
+
+    auto const feeAmountAfter = balance - feePaid;
+
+    if (feeAmountAfter == beast::kZero && feePayer.balanceField == sfFeeAmount)
+    {
+        // Because ltSponsorship.sfFeeAmount is soeOptional
+        sle->makeFieldAbsent(feePayer.balanceField);
+    }
+    else
+    {
+        sle->setFieldAmount(feePayer.balanceField, feeAmountAfter);
+    }
+
+    view().update(sle);
 
     // VFALCO Should we call view().rawDestroyXRP() here as well?
     return tesSUCCESS;
@@ -656,7 +855,7 @@ Transactor::ticketDelete(
     }
 
     // Update the Ticket owner's reserve.
-    adjustOwnerCount(view, sleAccount, -1, j);
+    decreaseOwnerCountForObject(view, sleAccount, sleTicket, 1, j);
 
     // Remove Ticket from ledger.
     view.erase(sleTicket);
@@ -750,6 +949,21 @@ Transactor::checkSign(
         return tesSUCCESS;
     }
 
+    if (sigObject.isFieldPresent(sfSponsorSignature))
+    {
+        // Co-signed sponsorship
+
+        // Sanity check: already checked in preflight1
+        if (!sigObject.isFieldPresent(sfSponsor))
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const sponsorID = sigObject.getAccountID(sfSponsor);
+        auto const sponsorSignature = sigObject.getFieldObject(sfSponsorSignature);
+        if (auto const ret = checkSign(view, flags, std::nullopt, sponsorID, sponsorSignature, j);
+            !isTesSuccess(ret))
+            return ret;
+    }
+
     // If the pk is empty and not simulate or simulate and signers,
     // then we must be multi-signing.
     if (sigObject.isFieldPresent(sfSigners))
@@ -1079,11 +1293,38 @@ Transactor::reset(XRPAmount fee)
     if (!txnAcct)
         return {tefINTERNAL, beast::kZero};
 
-    auto const payerSle = view().peek(keylet::account(ctx_.tx.getFeePayer()));
+    auto const feePayer = getFeePayer(view(), ctx_.tx);
+    auto const payerSle = view().peek(feePayer.keylet);
+
     if (!payerSle)
         return {tefINTERNAL, beast::kZero};  // LCOV_EXCL_LINE
 
-    auto const balance = payerSle->getFieldAmount(sfBalance).xrp();
+    XRPAmount balance = beast::kZero;
+    if (payerSle->isFieldPresent(feePayer.balanceField))
+    {
+        balance = payerSle->getFieldAmount(feePayer.balanceField).xrp();
+    }
+    else if (feePayer.balanceField != sfFeeAmount)
+    {
+        return {tefINTERNAL, beast::kZero};  // LCOV_EXCL_LINE
+    }
+
+    if (feePayer.type == FeePayerType::SponsorPreFunded && payerSle->isFieldPresent(sfMaxFee))
+    {
+        auto const cap = payerSle->getFieldAmount(sfMaxFee).xrp();
+        fee = std::min(fee, cap);
+    }
+
+    // A co-signed sponsor must never be charged into its own account reserve,
+    // so the fee is capped to the balance above the reserve rather than to the
+    // full balance.
+    XRPAmount spendable = balance;
+    if (feePayer.type == FeePayerType::SponsorCoSigned)
+    {
+        auto const sponsorReserve = accountReserve(view(), payerSle, j_);
+        // max(balance - reserve, 0) with overflow handling
+        spendable = balance > sponsorReserve ? balance - sponsorReserve : beast::kZero;
+    }
 
     // balance should have already been checked in checkFee / preFlight.
     XRPL_ASSERT(
@@ -1093,8 +1334,8 @@ Transactor::reset(XRPAmount fee)
     // We retry/reject the transaction if the account balance is zero or
     // we're applying against an open ledger and the balance is less than
     // the fee
-    if (fee > balance)
-        fee = balance;
+    if (fee > spendable)
+        fee = spendable;
 
     // Since we reset the context, we need to charge the fee and update
     // the account's sequence number (or consume the Ticket) again.
@@ -1102,7 +1343,17 @@ Transactor::reset(XRPAmount fee)
     // If for some reason we are unable to consume the ticket or sequence
     // then the ledger is corrupted.  Rather than make things worse we
     // reject the transaction.
-    payerSle->setFieldAmount(sfBalance, balance - fee);
+    auto const feeAmountAfter = balance - fee;
+    if (feeAmountAfter == beast::kZero && feePayer.balanceField == sfFeeAmount)
+    {
+        // Because ltSponsorship.sfFeeAmount is soeOptional
+        payerSle->makeFieldAbsent(feePayer.balanceField);
+    }
+    else
+    {
+        payerSle->setFieldAmount(feePayer.balanceField, feeAmountAfter);
+    }
+
     TER const ter{consumeSeqProxy(txnAcct)};
     XRPL_ASSERT(isTesSuccess(ter), "xrpl::Transactor::reset : result is tesSUCCESS");
 
@@ -1116,6 +1367,48 @@ Transactor::reset(XRPAmount fee)
     return {ter, fee};
 }
 
+FeePayer
+Transactor::getFeePayer(ReadView const& view, STTx const& tx)
+{
+    if (tx.isFieldPresent(sfSponsor) && isFeeSponsored(tx))
+    {
+        auto const sponsorID = tx.getAccountID(sfSponsor);
+        auto const sponseeID = tx.getInitiator();
+        auto const sponsorshipKeylet = keylet::sponsorship(sponsorID, sponseeID);
+
+        // if pre-funded sponsorship exists, prefer it
+        if (view.exists(sponsorshipKeylet))
+        {
+            // pre funded
+            return FeePayer{
+                .id = sponsorID,
+                .keylet = sponsorshipKeylet,
+                .balanceField = sfFeeAmount,
+                .type = FeePayerType::SponsorPreFunded};
+        }
+
+        // Checked in Transactor::checkSponsor
+        XRPL_ASSERT(
+            tx.isFieldPresent(sfSponsorSignature),
+            "xrpl::getFeePayer has sponsor signature without a sponsorship object");
+
+        // co-signed
+        return FeePayer{
+            .id = sponsorID,
+            .keylet = keylet::account(sponsorID),
+            .balanceField = sfBalance,
+            .type = FeePayerType::SponsorCoSigned};
+    }
+
+    AccountID const payerID = tx.getInitiator();
+    auto const payerAccountKeylet = keylet::account(payerID);
+    auto const payerType =
+        tx.isFieldPresent(sfDelegate) ? FeePayerType::Delegate : FeePayerType::Account;
+
+    return FeePayer{
+        .id = payerID, .keylet = payerAccountKeylet, .balanceField = sfBalance, .type = payerType};
+}
+
 // The sole purpose of this function is to provide a convenient, named
 // location to set a breakpoint, to be used when replaying transactions.
 void
diff --git a/src/libxrpl/tx/applySteps.cpp b/src/libxrpl/tx/applySteps.cpp
index caaacfd010..5af4f621a7 100644
--- a/src/libxrpl/tx/applySteps.cpp
+++ b/src/libxrpl/tx/applySteps.cpp
@@ -181,6 +181,9 @@ invokePreclaim(PreclaimContext const& ctx)
                         if (NotTEC const result = T::checkPriorTxAndLastLedger(ctx))
                             return result;
 
+                        if (NotTEC const result = T::checkSponsor(ctx.view, ctx.tx))
+                            return result;
+
                         if (NotTEC const result =
                                 Transactor::invokeCheckPermission<T>(ctx.view, ctx.tx))
                             return result;
diff --git a/src/libxrpl/tx/invariants/InvariantCheck.cpp b/src/libxrpl/tx/invariants/InvariantCheck.cpp
index 32df44a96b..220a7a8e41 100644
--- a/src/libxrpl/tx/invariants/InvariantCheck.cpp
+++ b/src/libxrpl/tx/invariants/InvariantCheck.cpp
@@ -148,6 +148,15 @@ XRPNotCreated::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref a
                 if (isXRP((*before)[sfAmount]))
                     drops_ -= (*before)[sfAmount].xrp().drops();
                 break;
+            case ltSPONSORSHIP:
+                if (before->isFieldPresent(sfFeeAmount))
+                {
+                    XRPL_ASSERT(
+                        isXRP((*before)[sfFeeAmount]),
+                        "XRPNotCreated::visitEntry : Sponsorship.FeeAmount is XRP");
+                    drops_ -= (*before)[sfFeeAmount].xrp().drops();
+                }
+                break;
             default:
                 break;
         }
@@ -168,6 +177,15 @@ XRPNotCreated::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref a
                 if (!isDelete && isXRP((*after)[sfAmount]))
                     drops_ += (*after)[sfAmount].xrp().drops();
                 break;
+            case ltSPONSORSHIP:
+                if (!isDelete && after->isFieldPresent(sfFeeAmount))
+                {
+                    XRPL_ASSERT(
+                        isXRP((*after)[sfFeeAmount]),
+                        "XRPNotCreated::visitEntry : Sponsorship.FeeAmount is XRP");
+                    drops_ += (*after)[sfFeeAmount].xrp().drops();
+                }
+                break;
             default:
                 break;
         }
@@ -515,6 +533,20 @@ AccountRootsDeletedClean::finalize(
             if (enforce)
                 return false;
         }
+        // An account should not be deleted with sponsorship fields
+        if (after->isFieldPresent(sfSponsoredOwnerCount) ||
+            after->isFieldPresent(sfSponsoringOwnerCount) ||
+            after->isFieldPresent(sfSponsoringAccountCount) || after->isFieldPresent(sfSponsor))
+        {
+            JLOG(j.fatal()) << "Invariant failed: account deletion left "
+                               "behind a sponsorship field";
+            XRPL_ASSERT(
+                enforce,
+                "xrpl::AccountRootsDeletedClean::finalize : "
+                "deleted account has no sponsorship fields");
+            if (enforce)
+                return false;
+        }
         // Simple types
         for (auto const& [keyletfunc, _1, _2] : kDirectAccountKeylets)
         {
@@ -881,8 +913,10 @@ ValidPseudoAccounts::visitEntry(bool isDelete, SLE::const_ref before, SLE::const
             // 1. Exactly one of the pseudo-account fields is set.
             // 2. The sequence number is not changed.
             // 3. The lsfDisableMaster, lsfDefaultRipple, and lsfDepositAuth
-            // flags are set.
+            //    flags are set.
             // 4. The RegularKey is not set.
+            // 5. The SponsoredOwnerCount, SponsoringOwnerCount, SponsoringAccountCount, Sponsor
+            //    fields are not set.
             {
                 std::vector<SField const*> const& fields = getPseudoAccountFields();
 
@@ -908,6 +942,12 @@ ValidPseudoAccounts::visitEntry(bool isDelete, SLE::const_ref before, SLE::const
             {
                 errors_.emplace_back("pseudo-account has a regular key");
             }
+            if (after->isFieldPresent(sfSponsoredOwnerCount) ||
+                after->isFieldPresent(sfSponsoringOwnerCount) || after->isFieldPresent(sfSponsor) ||
+                after->isFieldPresent(sfSponsoringAccountCount))
+            {
+                errors_.emplace_back("pseudo-account has a sponsorship field");
+            }
         }
     }
 }
diff --git a/src/libxrpl/tx/invariants/SponsorshipInvariant.cpp b/src/libxrpl/tx/invariants/SponsorshipInvariant.cpp
new file mode 100644
index 0000000000..bdf37492f3
--- /dev/null
+++ b/src/libxrpl/tx/invariants/SponsorshipInvariant.cpp
@@ -0,0 +1,158 @@
+#include <xrpl/tx/invariants/SponsorshipInvariant.h>
+//
+#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+// Add new sponsorship-related invariants implementations
+void
+SponsorshipOwnerCountsMatch::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after)
+{
+    auto getSponsored = [](SLE::const_ref sle) -> std::uint32_t {
+        if (sle && sle->getType() == ltACCOUNT_ROOT)
+            return sle->getFieldU32(sfSponsoredOwnerCount);
+        return 0;
+    };
+    auto getSponsoring = [](SLE::const_ref sle) -> std::uint32_t {
+        if (sle && sle->getType() == ltACCOUNT_ROOT)
+            return sle->getFieldU32(sfSponsoringOwnerCount);
+        return 0;
+    };
+
+    auto getOwnerCount = [](SLE::const_ref sle) -> std::uint32_t {
+        if (sle && sle->getType() == ltACCOUNT_ROOT)
+            return sle->getFieldU32(sfOwnerCount);
+        return 0;
+    };
+
+    auto getSponsoredObjectOwnerCount = [&](SLE::const_ref sle) -> std::uint32_t {
+        if (!sle)
+            return 0;
+        switch (sle->getType())
+        {
+            case ltACCOUNT_ROOT:
+                return 0;
+            case ltRIPPLE_STATE: {
+                // A trust line can be reserve-sponsored independently on each
+                // side, so it may contribute up to two sponsored owner counts.
+                uint32_t ownerCount = 0;
+                if (sle->isFieldPresent(sfHighSponsor))
+                    ownerCount++;
+                if (sle->isFieldPresent(sfLowSponsor))
+                    ownerCount++;
+                return ownerCount;
+            }
+            default:
+                // Every other supported type carries a single sfSponsor field
+                // and contributes its full owner-count magnitude only when it is
+                // sponsored.
+                if (!sle->isFieldPresent(sfSponsor))
+                    return 0;
+                return getLedgerEntryOwnerCount(*sle);
+        }
+    };
+
+    // The values are implicitly casted to std::int64_t to calculate deltas.
+    std::int64_t const beforeSponsored = getSponsored(before);
+    std::int64_t const afterSponsored = getSponsored(after);
+    std::int64_t const beforeSponsoring = getSponsoring(before);
+    std::int64_t const afterSponsoring = getSponsoring(after);
+
+    std::int64_t const beforeSponsoredObjectOwnerCount = getSponsoredObjectOwnerCount(before);
+    std::int64_t const afterSponsoredObjectOwnerCount =
+        isDelete ? 0 : getSponsoredObjectOwnerCount(after);
+
+    deltaSponsoredOwnerCount_ += (afterSponsored - beforeSponsored);
+    deltaSponsoringOwnerCount_ += (afterSponsoring - beforeSponsoring);
+
+    deltaSponsoredObjectOwnerCount_ +=
+        (afterSponsoredObjectOwnerCount - beforeSponsoredObjectOwnerCount);
+
+    if (getOwnerCount(after) < getSponsored(after))
+        ownerCountBelowSponsored_ += 1;
+}
+
+bool
+SponsorshipOwnerCountsMatch::finalize(
+    STTx const&,
+    TER const,
+    XRPAmount const,
+    ReadView const&,
+    beast::Journal const& j) const
+{
+    if (deltaSponsoredOwnerCount_ != deltaSponsoringOwnerCount_)
+    {
+        JLOG(j.fatal()) << "Invariant failed: SponsoredOwnerCount does not "
+                           "equal SponsoringOwnerCount delta.";
+        return false;
+    }
+
+    if (ownerCountBelowSponsored_ > 0)
+    {
+        JLOG(j.fatal())
+            << "Invariant failed: OwnerCount must be greater than or equal to SponsoredOwnerCount.";
+        return false;
+    }
+
+    if (deltaSponsoredObjectOwnerCount_ != deltaSponsoredOwnerCount_)
+    {
+        JLOG(j.fatal()) << "Invariant failed: SponsoredObjectOwnerCount does not "
+                           "equal SponsoredOwnerCount delta.";
+        return false;
+    }
+
+    return true;
+}
+
+void
+SponsorshipAccountCountMatchesField::visitEntry(bool, SLE::const_ref before, SLE::const_ref after)
+{
+    auto getSponsoringAccountCount = [](SLE::const_ref sle) -> std::uint32_t {
+        if (sle && sle->getType() == ltACCOUNT_ROOT)
+            return sle->getFieldU32(sfSponsoringAccountCount);
+        return 0;
+    };
+
+    auto hasSponsorField = [](SLE::const_ref sle) -> bool {
+        return sle && sle->getType() == ltACCOUNT_ROOT && sle->isFieldPresent(sfSponsor);
+    };
+
+    std::int64_t const beforeCount = getSponsoringAccountCount(before);
+    std::int64_t const afterCount = getSponsoringAccountCount(after);
+    deltaSponsoringAccountCount_ += (afterCount - beforeCount);
+
+    int const beforePresent = hasSponsorField(before) ? 1 : 0;
+    int const afterPresent = hasSponsorField(after) ? 1 : 0;
+    deltaSponsorFieldPresence_ += (afterPresent - beforePresent);
+}
+
+bool
+SponsorshipAccountCountMatchesField::finalize(
+    STTx const&,
+    TER const,
+    XRPAmount const,
+    ReadView const&,
+    beast::Journal const& j) const
+{
+    if (deltaSponsoringAccountCount_ != deltaSponsorFieldPresence_)
+    {
+        JLOG(j.fatal()) << "Invariant failed: Net delta of SponsoringAccountCount does not "
+                           "match net delta of sfSponsor presence.";
+        return false;
+    }
+
+    return true;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/tx/invariants/VaultInvariant.cpp b/src/libxrpl/tx/invariants/VaultInvariant.cpp
index 84814977db..a9ba0ec874 100644
--- a/src/libxrpl/tx/invariants/VaultInvariant.cpp
+++ b/src/libxrpl/tx/invariants/VaultInvariant.cpp
@@ -222,7 +222,10 @@ ValidVault::deltaAssetsTxAccount(STTx const& tx, XRPAmount fee) const
     if (!ret.has_value() || !vaultAsset.native())
         return ret;
 
-    if (auto const delegate = tx[~sfDelegate]; delegate.has_value() && *delegate != tx[sfAccount])
+    // Only add the fee back if tx[sfAccount] actually paid it. When the fee is
+    // paid by someone else (a delegate or a fee sponsor), the
+    // account's XRP balance moved only by the vault amount.
+    if (tx.getFeePayerID() != tx[sfAccount])
         return ret;
 
     ret->delta += fee.drops();
@@ -1044,10 +1047,8 @@ ValidVault::finalize(
 
             case ttLOAN_SET:
             case ttLOAN_MANAGE:
-            case ttLOAN_PAY: {
-                // TBD
+            case ttLOAN_PAY:
                 return true;
-            }
 
             default:
                 // LCOV_EXCL_START
diff --git a/src/libxrpl/tx/paths/BookStep.cpp b/src/libxrpl/tx/paths/BookStep.cpp
index adb73f126e..bf24c66ee1 100644
--- a/src/libxrpl/tx/paths/BookStep.cpp
+++ b/src/libxrpl/tx/paths/BookStep.cpp
@@ -731,7 +731,7 @@ BookStep<TIn, TOut, TDerived>::forEachOffer(
             // Create MPToken for the offer's owner. No need to check
             // for the reserve since the offer is removed if it is consumed.
             // Therefore, the owner count remains the same.
-            if (auto const err = checkCreateMPT(sb, assetIn.get<MPTIssue>(), owner, j_);
+            if (auto const err = checkCreateMPT(sb, assetIn.get<MPTIssue>(), owner, {}, j_);
                 !isTesSuccess(err))
             {
                 return true;
diff --git a/src/libxrpl/tx/paths/MPTEndpointStep.cpp b/src/libxrpl/tx/paths/MPTEndpointStep.cpp
index a47cfa15a5..0a0f6a9f27 100644
--- a/src/libxrpl/tx/paths/MPTEndpointStep.cpp
+++ b/src/libxrpl/tx/paths/MPTEndpointStep.cpp
@@ -410,7 +410,8 @@ MPTEndpointOfferCrossingStep::checkCreateMPT(ApplyView& view, xrpl::DebtDirectio
         // for the reserve since the offer doesn't go on the books
         // if crossed. Insufficient reserve is allowed if the offer
         // crossed. See CreateOffer::applyGuts() for reserve check.
-        if (auto const err = xrpl::checkCreateMPT(view, mptIssue_, dst_, j_); !isTesSuccess(err))
+        if (auto const err = xrpl::checkCreateMPT(view, mptIssue_, dst_, {}, j_);
+            !isTesSuccess(err))
         {
             JLOG(j_.trace()) << "MPTEndpointStep::checkCreateMPT: failed create MPT";
             resetCache(srcDebtDir);
diff --git a/src/libxrpl/tx/transactors/account/AccountDelete.cpp b/src/libxrpl/tx/transactors/account/AccountDelete.cpp
index 254733a618..0055fce403 100644
--- a/src/libxrpl/tx/transactors/account/AccountDelete.cpp
+++ b/src/libxrpl/tx/transactors/account/AccountDelete.cpp
@@ -35,7 +35,6 @@
 #include <utility>
 
 namespace xrpl {
-
 bool
 AccountDelete::checkExtraFeatures(PreflightContext const& ctx)
 {
@@ -268,6 +267,15 @@ AccountDelete::preclaim(PreclaimContext const& ctx)
     if (cp)
         return tecHAS_OBLIGATIONS;
 
+    if (sleAccount->isFieldPresent(sfSponsor))
+    {
+        if (dst != sleAccount->getAccountID(sfSponsor))
+            return tecNO_SPONSOR_PERMISSION;
+    }
+    if (sleAccount->isFieldPresent(sfSponsoringOwnerCount) ||
+        sleAccount->isFieldPresent(sfSponsoringAccountCount))
+        return tecHAS_OBLIGATIONS;
+
     // We don't allow an account to be deleted if its sequence number
     // is within 256 of the current ledger.  This prevents replay of old
     // transactions if this account is resurrected after it is deleted.
@@ -394,6 +402,35 @@ AccountDelete::doApply()
     (*src)[sfBalance] = (*src)[sfBalance] - remainingBalance;
     ctx_.deliver(remainingBalance);
 
+    if (src->isFieldPresent(sfSponsor))
+    {
+        auto const sponsorID = src->getAccountID(sfSponsor);
+        auto sponsorSle = view().peek(keylet::account(sponsorID));
+
+        if (!sponsorSle)
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const sponsoringAccountCount = sponsorSle->getFieldU32(sfSponsoringAccountCount);
+
+        XRPL_ASSERT(
+            sponsoringAccountCount != 0,
+            "xrpl::AccountDelete::doApply : sponsoring account count is present");
+        if (sponsoringAccountCount == 0)
+        {
+            // sanity check
+            // Since sfSponsoringAccountCount is set to soeDEFAULT, the field will not be
+            // present with a value of 0.
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+        }
+        sponsorSle->at(sfSponsoringAccountCount) = sponsoringAccountCount - 1;
+        view().update(sponsorSle);
+
+        // Following line might look redundant, but without it, sfSponsor
+        // would end up remaining in after-ltAccountRoot during the
+        // InvariantCheck.
+        src->makeFieldAbsent(sfSponsor);
+    }
+
     XRPL_ASSERT(
         (*src)[sfBalance] == XRPAmount(0), "xrpl::AccountDelete::doApply : source balance is zero");
 
diff --git a/src/libxrpl/tx/transactors/account/SignerListSet.cpp b/src/libxrpl/tx/transactors/account/SignerListSet.cpp
index 2f95d32664..799c292bfc 100644
--- a/src/libxrpl/tx/transactors/account/SignerListSet.cpp
+++ b/src/libxrpl/tx/transactors/account/SignerListSet.cpp
@@ -8,6 +8,7 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
@@ -147,9 +148,7 @@ SignerListSet::preCompute()
     Transactor::preCompute();
 }
 
-// The return type is signed so it is compatible with the 3rd argument
-// of adjustOwnerCount() (which must be signed).
-static int
+static std::uint32_t
 signerCountBasedOwnerCountDelta(std::size_t entryCount, Rules const& rules)
 {
     // We always compute the full change in OwnerCount, taking into account:
@@ -165,7 +164,7 @@ signerCountBasedOwnerCountDelta(std::size_t entryCount, Rules const& rules)
     // units.  A SignerList with 8 entries would cost 10 OwnerCount units.
     //
     // The static_cast should always be safe since entryCount should always
-    // be in the range from 1 to 32.
+    // be in the range from 1 to 32, so the result is always positive.
     // We've got a lot of room to grow.
     XRPL_ASSERT(
         entryCount >= STTx::kMinMultiSigners,
@@ -196,12 +195,11 @@ removeSignersFromLedger(
     // There are two different ways that the OwnerCount could be managed.
     // If the lsfOneOwnerCount bit is set then remove just one owner count.
     // Otherwise use the pre-MultiSignReserve amendment calculation.
-    int removeFromOwnerCount = -1;
+    std::uint32_t removeFromOwnerCount = 1;
     if (!signers->isFlag(lsfOneOwnerCount))
     {
         STArray const& actualList = signers->getFieldArray(sfSignerEntries);
-        removeFromOwnerCount =
-            signerCountBasedOwnerCountDelta(actualList.size(), view.rules()) * -1;
+        removeFromOwnerCount = signerCountBasedOwnerCountDelta(actualList.size(), view.rules());
     }
 
     // Remove the node from the account directory.
@@ -215,8 +213,8 @@ removeSignersFromLedger(
         // LCOV_EXCL_STOP
     }
 
-    adjustOwnerCount(
-        view, view.peek(accountKeylet), removeFromOwnerCount, registry.getJournal("View"));
+    decreaseOwnerCountForObject(
+        view, view.peek(accountKeylet), signers, removeFromOwnerCount, registry.getJournal("View"));
 
     view.erase(signers);
 
@@ -315,19 +313,20 @@ SignerListSet::replaceSignerList()
     if (!sle)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
-    // Compute new reserve.  Verify the account has funds to meet the reserve.
-    std::uint32_t const oldOwnerCount{(*sle)[sfOwnerCount]};
-
     static constexpr int kAddedOwnerCount = 1;
     std::uint32_t const flags{lsfOneOwnerCount};
 
-    XRPAmount const newReserve{view().fees().accountReserve(oldOwnerCount + kAddedOwnerCount)};
-
     // We check the reserve against the starting balance because we want to
     // allow dipping into the reserve to pay fees.  This behavior is consistent
     // with TicketCreate.
-    if (preFeeBalance_ < newReserve)
-        return tecINSUFFICIENT_RESERVE;
+    if (auto const ret = checkReserve(
+            ctx_.getApplyViewContext(),
+            sle,
+            preFeeBalance_,
+            {.ownerCountDelta = kAddedOwnerCount},
+            ctx_.journal);
+        !isTesSuccess(ret))
+        return ret;
 
     // Everything's ducky.  Add the ltSIGNER_LIST to the ledger.
     auto signerList = std::make_shared<SLE>(signerListKeylet);
@@ -349,7 +348,8 @@ SignerListSet::replaceSignerList()
 
     // If we succeeded, the new entry counts against the
     // creator's reserve.
-    adjustOwnerCount(view(), sle, kAddedOwnerCount, viewJ);
+    increaseOwnerCount(ctx_.getApplyViewContext(), sle, kAddedOwnerCount, viewJ);
+    addSponsorToLedgerEntry(ctx_.getApplyViewContext(), signerList);
     return tesSUCCESS;
 }
 
diff --git a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
index f3ea97a341..92a8dccdb9 100644
--- a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
+++ b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
@@ -435,8 +435,7 @@ transferHelper(
             return tecINTERNAL;  // LCOV_EXCL_LINE
 
         {
-            auto const ownerCount = sleSrc->getFieldU32(sfOwnerCount);
-            auto const reserve = psb.fees().accountReserve(ownerCount);
+            auto const reserve = accountReserve(psb, sleSrc, j);
 
             auto const availableBalance = [&]() -> STAmount {
                 STAmount curBal = (*sleSrc)[sfBalance];
@@ -726,9 +725,8 @@ finalizeClaimHelper(
             }
 
             // Remove the claim id from the ledger
+            decreaseOwnerCountForObject(outerSb, sleOwner, sleClaimID, 1, j);
             outerSb.erase(sleClaimID);
-
-            adjustOwnerCount(outerSb, sleOwner, -1, j);
         }
     }
 
@@ -1028,7 +1026,7 @@ applyCreateAccountAttestations(
 
             // Check reserve
             auto const balance = (*sleDoor)[sfBalance];
-            auto const reserve = psb.fees().accountReserve((*sleDoor)[sfOwnerCount] + 1);
+            auto const reserve = accountReserve(psb, sleDoor, j, {.ownerCountDelta = 1});
 
             if (balance < reserve)
                 return std::unexpected(tecINSUFFICIENT_RESERVE);
@@ -1137,7 +1135,7 @@ applyCreateAccountAttestations(
             return tecINTERNAL;  // LCOV_EXCL_LINE
 
         // Reserve was already checked
-        adjustOwnerCount(psb, sleDoor, 1, j);
+        increaseOwnerCount(psb, sleDoor, {}, 1, j);
         psb.insert(createdSleClaimID);
         psb.update(sleDoor);
     }
@@ -1439,7 +1437,7 @@ XChainCreateBridge::preclaim(PreclaimContext const& ctx)
             return terNO_ACCOUNT;
 
         auto const balance = (*sleAcc)[sfBalance];
-        auto const reserve = ctx.view.fees().accountReserve((*sleAcc)[sfOwnerCount] + 1);
+        auto const reserve = accountReserve(ctx.view, sleAcc, ctx.j, {.ownerCountDelta = 1});
 
         if (balance < reserve)
             return tecINSUFFICIENT_RESERVE;
@@ -1484,7 +1482,7 @@ XChainCreateBridge::doApply()
         (*sleBridge)[sfOwnerNode] = *page;
     }
 
-    adjustOwnerCount(ctx_.view(), sleAcct, 1, ctx_.journal);
+    increaseOwnerCount(ctx_.view(), sleAcct, {}, 1, ctx_.journal);
 
     ctx_.view().insert(sleBridge);
     ctx_.view().update(sleAcct);
@@ -1987,8 +1985,7 @@ XChainCreateClaimID::preclaim(PreclaimContext const& ctx)
             return terNO_ACCOUNT;
 
         auto const balance = (*sleAcc)[sfBalance];
-        auto const reserve = ctx.view.fees().accountReserve((*sleAcc)[sfOwnerCount] + 1);
-
+        auto const reserve = accountReserve(ctx.view, sleAcc, ctx.j, {.ownerCountDelta = 1});
         if (balance < reserve)
             return tecINSUFFICIENT_RESERVE;
     }
@@ -2046,7 +2043,7 @@ XChainCreateClaimID::doApply()
         (*sleClaimID)[sfOwnerNode] = *page;
     }
 
-    adjustOwnerCount(ctx_.view(), sleAcct, 1, ctx_.journal);
+    increaseOwnerCount(ctx_.view(), sleAcct, {}, 1, ctx_.journal);
 
     ctx_.view().insert(sleClaimID);
     ctx_.view().update(sleBridge);
diff --git a/src/libxrpl/tx/transactors/check/CheckCancel.cpp b/src/libxrpl/tx/transactors/check/CheckCancel.cpp
index d966772191..ed60817224 100644
--- a/src/libxrpl/tx/transactors/check/CheckCancel.cpp
+++ b/src/libxrpl/tx/transactors/check/CheckCancel.cpp
@@ -91,8 +91,7 @@ CheckCancel::doApply()
     }
 
     // If we succeeded, update the check owner's reserve.
-    auto const sleSrc = view().peek(keylet::account(srcId));
-    adjustOwnerCount(view(), sleSrc, -1, viewJ);
+    decreaseOwnerCountForObject(view(), srcId, sleCheck, 1, viewJ);
 
     // Remove check from ledger.
     view().erase(sleCheck);
diff --git a/src/libxrpl/tx/transactors/check/CheckCash.cpp b/src/libxrpl/tx/transactors/check/CheckCash.cpp
index 80ef742f52..4e810d94cf 100644
--- a/src/libxrpl/tx/transactors/check/CheckCash.cpp
+++ b/src/libxrpl/tx/transactors/check/CheckCash.cpp
@@ -3,11 +3,13 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/scope.h>
 #include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/PaymentSandbox.h>
 #include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
@@ -30,7 +32,7 @@
 #include <xrpl/tx/paths/detail/Steps.h>
 
 #include <algorithm>
-#include <cstdint>
+#include <memory>
 #include <optional>
 
 namespace xrpl {
@@ -175,7 +177,7 @@ CheckCash::preclaim(PreclaimContext const& ctx)
             // once the check is cashed, since the check's reserve will no
             // longer be required.  So, if we're dealing in XRP, we add one
             // reserve's worth to the available funds.
-            if (value.native())
+            if (value.native() && !sleCheck->isFieldPresent(sfSponsor))
                 availableFunds += XRPAmount{ctx.view.fees().increment};
 
             if (value > availableFunds)
@@ -307,6 +309,8 @@ CheckCash::doApply()
         // LCOV_EXCL_STOP
     }
 
+    auto const sponsorCheckSle = getLedgerEntryReserveSponsor(psb, sleCheck);
+
     // Preclaim already checked that source has at least the requested
     // funds.
     //
@@ -335,7 +339,7 @@ CheckCash::doApply()
             // from src's directory, we allow them to send that additional
             // incremental reserve amount in the transfer.  Hence the -1
             // argument.
-            STAmount const srcLiquid{xrpLiquid(psb, srcId, -1, viewJ)};
+            STAmount const srcLiquid{xrpLiquid(psb, srcId, sponsorCheckSle ? 0 : -1, viewJ)};
 
             // Now, how much do they need in order to be successful?
             STAmount const xrpDeliver{
@@ -385,14 +389,25 @@ CheckCash::doApply()
             STAmount const flowDeliver{
                 optDeliverMin ? maxDeliverMin() : ctx_.tx.getFieldAmount(sfAmount)};
 
+            auto applyViewContext = ApplyViewContext({.view = psb, .tx = ctx_.tx});
+            auto const sponsorSle = getTxReserveSponsor(applyViewContext);
+            if (!sponsorSle)
+                return sponsorSle.error();  // LCOV_EXCL_LINE
+
             // Check reserve. Return destination account SLE if enough reserve,
             // otherwise return nullptr.
-            auto checkReserve = [&]() -> SLE::pointer {
+            auto checkDstReserve = [&]() -> SLE::pointer {
                 auto sleDst = psb.peek(keylet::account(accountID_));
 
                 // Can the account cover the trust line's or MPT reserve?
-                if (std::uint32_t const ownerCount = {sleDst->at(sfOwnerCount)};
-                    preFeeBalance_ < psb.fees().accountReserve(ownerCount + 1))
+                if (auto const ret = checkReserve(
+                        applyViewContext,
+                        sleDst,
+                        preFeeBalance_,
+                        *sponsorSle,
+                        {.ownerCountDelta = 1},
+                        j_);
+                    !isTesSuccess(ret))
                 {
                     JLOG(j_.trace()) << "Trust line does not exist. "
                                         "Insufficient reserve to create line.";
@@ -426,7 +441,7 @@ CheckCash::doApply()
                         //     a. this (destination) account and
                         //     b. issuing account (not sending account).
 
-                        auto const sleDst = checkReserve();
+                        auto const sleDst = checkDstReserve();
                         if (sleDst == nullptr)
                             return tecNO_LINE_INSUF_RESERVE;
 
@@ -449,6 +464,7 @@ CheckCash::doApply()
                                 Issue(currency, accountID_),        // limit of zero
                                 0,                                  // quality in
                                 0,                                  // quality out
+                                *sponsorSle,                        // sponsor
                                 viewJ);                             // journal
                             !isTesSuccess(ter))
                         {
@@ -491,11 +507,12 @@ CheckCash::doApply()
                         auto const mptokenKey = keylet::mptoken(mptID, accountID_);
                         if (!psb.exists(mptokenKey))
                         {
-                            auto sleDst = checkReserve();
+                            auto sleDst = checkDstReserve();
                             if (sleDst == nullptr)
                                 return tecINSUFFICIENT_RESERVE;
 
-                            if (auto const err = checkCreateMPT(psb, mptID, accountID_, j_);
+                            if (auto const err =
+                                    checkCreateMPT(psb, mptID, accountID_, *sponsorSle, j_);
                                 !isTesSuccess(err))
                             {
                                 return err;
@@ -581,7 +598,7 @@ CheckCash::doApply()
     }
 
     // If we succeeded, update the check owner's reserve.
-    adjustOwnerCount(psb, psb.peek(keylet::account(srcId)), -1, viewJ);
+    decreaseOwnerCountForObject(psb, srcId, sleCheck, 1, viewJ);
 
     // Remove check from ledger.
     psb.erase(sleCheck);
diff --git a/src/libxrpl/tx/transactors/check/CheckCreate.cpp b/src/libxrpl/tx/transactors/check/CheckCreate.cpp
index 595bcc4ab1..cb1d81ba4a 100644
--- a/src/libxrpl/tx/transactors/check/CheckCreate.cpp
+++ b/src/libxrpl/tx/transactors/check/CheckCreate.cpp
@@ -7,6 +7,7 @@
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
@@ -194,13 +195,10 @@ CheckCreate::doApply()
     // A check counts against the reserve of the issuing account, but we
     // check the starting balance because we want to allow dipping into the
     // reserve to pay fees.
-    {
-        STAmount const reserve{view().fees().accountReserve(sle->getFieldU32(sfOwnerCount) + 1)};
-
-        if (preFeeBalance_ < reserve)
-            return tecINSUFFICIENT_RESERVE;
-    }
-
+    if (auto const ret = checkReserve(
+            ctx_.getApplyViewContext(), sle, preFeeBalance_, {.ownerCountDelta = 1}, ctx_.journal);
+        !isTesSuccess(ret))
+        return ret;
     // Note that we use the value from the sequence or ticket as the
     // Check sequence.  For more explanation see comments in SeqProxy.h.
     std::uint32_t const seq = ctx_.tx.getSeqValue();
@@ -253,7 +251,9 @@ CheckCreate::doApply()
         sleCheck->setFieldU64(sfOwnerNode, *page);
     }
     // If we succeeded, the new entry counts against the creator's reserve.
-    adjustOwnerCount(view(), sle, 1, viewJ);
+
+    increaseOwnerCount(ctx_.getApplyViewContext(), sle, 1, viewJ);
+    addSponsorToLedgerEntry(ctx_.getApplyViewContext(), sleCheck);
     return tesSUCCESS;
 }
 
diff --git a/src/libxrpl/tx/transactors/credentials/CredentialAccept.cpp b/src/libxrpl/tx/transactors/credentials/CredentialAccept.cpp
index e0ebdd893a..c0ef7ea9e8 100644
--- a/src/libxrpl/tx/transactors/credentials/CredentialAccept.cpp
+++ b/src/libxrpl/tx/transactors/credentials/CredentialAccept.cpp
@@ -4,6 +4,7 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/CredentialHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
@@ -11,7 +12,6 @@
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
@@ -93,12 +93,19 @@ CredentialAccept::doApply()
     if (!sleSubject || !sleIssuer)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
-    {
-        STAmount const reserve{
-            view().fees().accountReserve(sleSubject->getFieldU32(sfOwnerCount) + 1)};
-        if (preFeeBalance_ < reserve)
-            return tecINSUFFICIENT_RESERVE;
-    }
+    auto txSponsorSle = getTxReserveSponsor(ctx_.getApplyViewContext());
+    if (!txSponsorSle)
+        return txSponsorSle.error();  // LCOV_EXCL_LINE
+
+    if (auto const ret = checkReserve(
+            ctx_.getApplyViewContext(),
+            sleSubject,
+            preFeeBalance_,
+            *txSponsorSle,
+            {.ownerCountDelta = 1},
+            j_);
+        !isTesSuccess(ret))
+        return ret;
 
     auto const credType(ctx_.tx[sfCredentialType]);
     Keylet const credentialKey = keylet::credential(accountID_, issuer, credType);
@@ -115,10 +122,16 @@ CredentialAccept::doApply()
     }
 
     sleCred->setFieldU32(sfFlags, lsfAccepted);
-    view().update(sleCred);
 
-    adjustOwnerCount(view(), sleIssuer, -1, j_);
-    adjustOwnerCount(view(), sleSubject, 1, j_);
+    // Release the original creation sponsor from the credential (it covered
+    // the issuer's reserve), then assign the accept tx's sponsor (if any) so
+    // the credential reflects whoever is now covering the subject's reserve.
+    decreaseOwnerCountForObject(view(), sleIssuer, sleCred, 1, j_);
+    removeSponsorFromLedgerEntry(sleCred);
+
+    addSponsorToLedgerEntry(ctx_.getApplyViewContext(), sleCred);
+    increaseOwnerCount(ctx_.getApplyViewContext(), sleSubject, 1, j_);
+    view().update(sleCred);
 
     return tesSUCCESS;
 }
diff --git a/src/libxrpl/tx/transactors/credentials/CredentialCreate.cpp b/src/libxrpl/tx/transactors/credentials/CredentialCreate.cpp
index acca408a95..e902ee73a6 100644
--- a/src/libxrpl/tx/transactors/credentials/CredentialCreate.cpp
+++ b/src/libxrpl/tx/transactors/credentials/CredentialCreate.cpp
@@ -7,13 +7,13 @@
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/CredentialHelpers.h>  // IWYU pragma: keep
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
@@ -130,12 +130,10 @@ CredentialCreate::doApply()
     if (!sleIssuer)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
-    {
-        STAmount const reserve{
-            view().fees().accountReserve(sleIssuer->getFieldU32(sfOwnerCount) + 1)};
-        if (preFeeBalance_ < reserve)
-            return tecINSUFFICIENT_RESERVE;
-    }
+    if (auto const ret = checkReserve(
+            ctx_.getApplyViewContext(), sleIssuer, preFeeBalance_, {.ownerCountDelta = 1}, j_);
+        !isTesSuccess(ret))
+        return ret;
 
     sleCred->setAccountID(sfSubject, subject);
     sleCred->setAccountID(sfIssuer, accountID_);
@@ -153,7 +151,8 @@ CredentialCreate::doApply()
             return tecDIR_FULL;
         sleCred->setFieldU64(sfIssuerNode, *page);
 
-        adjustOwnerCount(view(), sleIssuer, 1, j_);
+        increaseOwnerCount(ctx_.getApplyViewContext(), sleIssuer, 1, j_);
+        addSponsorToLedgerEntry(ctx_.getApplyViewContext(), sleCred);
     }
 
     if (subject == accountID_)
diff --git a/src/libxrpl/tx/transactors/delegate/DelegateSet.cpp b/src/libxrpl/tx/transactors/delegate/DelegateSet.cpp
index 32a51555b1..96e6c9e443 100644
--- a/src/libxrpl/tx/transactors/delegate/DelegateSet.cpp
+++ b/src/libxrpl/tx/transactors/delegate/DelegateSet.cpp
@@ -5,10 +5,10 @@
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
@@ -98,11 +98,14 @@ DelegateSet::doApply()
     if (permissions.empty())
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
-    STAmount const reserve{
-        ctx_.view().fees().accountReserve(sleOwner->getFieldU32(sfOwnerCount) + 1)};
-
-    if (preFeeBalance_ < reserve)
-        return tecINSUFFICIENT_RESERVE;
+    if (auto const ret = checkReserve(
+            ctx_.getApplyViewContext(),
+            sleOwner,
+            preFeeBalance_,
+            {.ownerCountDelta = 1},
+            ctx_.journal);
+        !isTesSuccess(ret))
+        return ret;
 
     sle = std::make_shared<SLE>(delegateKey);
     sle->setAccountID(sfAccount, accountID_);
@@ -130,7 +133,8 @@ DelegateSet::doApply()
     (*sle)[sfDestinationNode] = *destPage;
 
     ctx_.view().insert(sle);
-    adjustOwnerCount(ctx_.view(), sleOwner, 1, ctx_.journal);
+    increaseOwnerCount(ctx_.getApplyViewContext(), sleOwner, 1, ctx_.journal);
+    addSponsorToLedgerEntry(ctx_.getApplyViewContext(), sle);
 
     return tesSUCCESS;
 }
@@ -170,7 +174,7 @@ DelegateSet::deleteDelegate(ApplyView& view, SLE::ref sle, beast::Journal j)
     if (!sleOwner)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
-    adjustOwnerCount(view, sleOwner, -1, j);
+    decreaseOwnerCountForObject(view, sleOwner, sle, 1, j);
 
     view.erase(sle);
 
diff --git a/src/libxrpl/tx/transactors/dex/AMMCreate.cpp b/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
index 66d059c54d..7c7d35497a 100644
--- a/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMCreate.cpp
@@ -332,17 +332,30 @@ applyCreate(ApplyContext& ctx, Sandbox& sb, AccountID const& account, beast::Jou
                     return err;
                 }
 
-                if (auto const err = createMPToken(sb, mptID, accountId, flags); !isTesSuccess(err))
+                if (auto const err = createMPToken(sb, mptID, accountId, {}, flags);
+                    !isTesSuccess(err))
                     return err;
                 // Don't adjust AMM owner count.
                 // It's irrelevant for pseudo-account like AMM.
                 return accountSend(
-                    sb, account, accountId, amount, ctx.journal, WaiveTransferFee::Yes);
+                    sb,
+                    account,
+                    accountId,
+                    amount,
+                    ctx.journal,
+                    {},  // don't sponsor for AMM Trustline
+                    WaiveTransferFee::Yes);
             },
             // Set AMM flag on AMM trustline
             [&](Issue const& issue) -> TER {
                 if (auto const res = accountSend(
-                        sb, account, accountId, amount, ctx.journal, WaiveTransferFee::Yes))
+                        sb,
+                        account,
+                        accountId,
+                        amount,
+                        ctx.journal,
+                        {},  // don't sponsor for AMM Trustline
+                        WaiveTransferFee::Yes))
                     return res;
                 // Set AMM flag on AMM trustline
                 if (!isXRP(amount))
diff --git a/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp b/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
index ff7fec019a..6a9600d060 100644
--- a/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
@@ -618,7 +618,13 @@ AMMDeposit::deposit(
     }
 
     auto res = accountSend(
-        view, accountID_, ammAccount, amountDepositActual, ctx_.journal, WaiveTransferFee::Yes);
+        view,
+        accountID_,
+        ammAccount,
+        amountDepositActual,
+        ctx_.journal,
+        {},  // don't sponsor for AMM Trustline
+        WaiveTransferFee::Yes);
     if (!isTesSuccess(res))
     {
         JLOG(ctx_.journal.debug()) << "AMM Deposit: failed to deposit " << amountDepositActual;
@@ -642,6 +648,7 @@ AMMDeposit::deposit(
             ammAccount,
             *amount2DepositActual,
             ctx_.journal,
+            {},  // don't sponsor for AMM Trustline
             WaiveTransferFee::Yes);
         if (!isTesSuccess(res))
         {
diff --git a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
index 14ed5a4646..ff27a58ad7 100644
--- a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
@@ -7,6 +7,7 @@
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/Sandbox.h>
 #include <xrpl/ledger/helpers/AMMHelpers.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
@@ -658,15 +659,15 @@ AMMWithdraw::withdraw(
             auto sleAccount = view.peek(keylet::account(account));
             if (!sleAccount)
                 return tecINTERNAL;  // LCOV_EXCL_LINE
-            STAmount const balance = (*sleAccount)[sfBalance];
-            std::uint32_t const ownerCount = sleAccount->at(sfOwnerCount);
 
+            auto const balance = (*sleAccount)[sfBalance]->xrp();
             // See also TrustSet::doApply() and MPTokenAuthorize::authorize()
             XRPAmount const reserve(
-                (ownerCount < 2) ? XRPAmount(beast::kZero)
-                                 : view.fees().accountReserve(ownerCount + 1));
+                (ownerCount(sleAccount, journal) < 2)
+                    ? XRPAmount(beast::kZero)
+                    : accountReserve(view, sleAccount, journal, {.ownerCountDelta = 1}));
 
-            auto const balanceAdj = isIssue ? std::max(priorBalance, balance.xrp()) : priorBalance;
+            auto const balanceAdj = isIssue ? std::max(priorBalance, balance) : priorBalance;
             if (balanceAdj < reserve)
                 return tecINSUFFICIENT_RESERVE;
         }
@@ -683,7 +684,7 @@ AMMWithdraw::withdraw(
                 !isTesSuccess(err))
                 return err;
 
-            if (auto const err = checkCreateMPT(view, mptIssue, account, journal);
+            if (auto const err = checkCreateMPT(view, mptIssue, account, {}, journal);
                 !isTesSuccess(err))
             {
                 return err;
@@ -700,7 +701,7 @@ AMMWithdraw::withdraw(
 
     // Withdraw amountWithdraw
     auto res = accountSend(
-        view, ammAccount, account, amountWithdrawActual, journal, WaiveTransferFee::Yes);
+        view, ammAccount, account, amountWithdrawActual, journal, {}, WaiveTransferFee::Yes);
     if (!isTesSuccess(res))
     {
         // LCOV_EXCL_START
@@ -719,7 +720,7 @@ AMMWithdraw::withdraw(
             return {res, STAmount{}, STAmount{}, STAmount{}};
 
         res = accountSend(
-            view, ammAccount, account, *amount2WithdrawActual, journal, WaiveTransferFee::Yes);
+            view, ammAccount, account, *amount2WithdrawActual, journal, {}, WaiveTransferFee::Yes);
         if (!isTesSuccess(res))
         {
             // LCOV_EXCL_START
diff --git a/src/libxrpl/tx/transactors/dex/OfferCreate.cpp b/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
index a915bb60d1..fb47cf0f97 100644
--- a/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
+++ b/src/libxrpl/tx/transactors/dex/OfferCreate.cpp
@@ -833,9 +833,7 @@ OfferCreate::applyGuts(Sandbox& sb, Sandbox& sbCancel)
         return {tefINTERNAL, false};
 
     {
-        XRPAmount const reserve =
-            sb.fees().accountReserve(sleCreator->getFieldU32(sfOwnerCount) + 1);
-
+        XRPAmount const reserve = accountReserve(sb, sleCreator, viewJ, {.ownerCountDelta = 1});
         if (preFeeBalance_ < reserve)
         {
             // If we are here, the signing account had an insufficient reserve
@@ -869,7 +867,7 @@ OfferCreate::applyGuts(Sandbox& sb, Sandbox& sbCancel)
     }
 
     // Update owner count.
-    adjustOwnerCount(sb, sleCreator, 1, viewJ);
+    increaseOwnerCount(sb, sleCreator, {}, 1, viewJ);
 
     JLOG(j_.trace()) << "adding to book: " << to_string(saTakerPays.asset()) << " : "
                      << to_string(saTakerGets.asset())
diff --git a/src/libxrpl/tx/transactors/did/DIDDelete.cpp b/src/libxrpl/tx/transactors/did/DIDDelete.cpp
index 90aa21d8a1..a2af4c1100 100644
--- a/src/libxrpl/tx/transactors/did/DIDDelete.cpp
+++ b/src/libxrpl/tx/transactors/did/DIDDelete.cpp
@@ -50,8 +50,7 @@ DIDDelete::deleteSLE(ApplyView& view, SLE::pointer sle, AccountID const owner, b
     if (!sleOwner)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
-    adjustOwnerCount(view, sleOwner, -1, j);
-    view.update(sleOwner);
+    decreaseOwnerCountForObject(view, sleOwner, sle, 1, j);
 
     // Remove object from ledger
     view.erase(sle);
diff --git a/src/libxrpl/tx/transactors/did/DIDSet.cpp b/src/libxrpl/tx/transactors/did/DIDSet.cpp
index 1392581bb0..2659460b8d 100644
--- a/src/libxrpl/tx/transactors/did/DIDSet.cpp
+++ b/src/libxrpl/tx/transactors/did/DIDSet.cpp
@@ -72,7 +72,8 @@ addSLE(ApplyContext& ctx, SLE::ref sle, AccountID const& owner)
     // Check reserve availability for new object creation
     {
         auto const balance = STAmount((*sleAccount)[sfBalance]).xrp();
-        auto const reserve = ctx.view().fees().accountReserve((*sleAccount)[sfOwnerCount] + 1);
+        auto const reserve =
+            accountReserve(ctx.view(), sleAccount, ctx.journal, {.ownerCountDelta = 1});
 
         if (balance < reserve)
             return tecINSUFFICIENT_RESERVE;
@@ -89,7 +90,7 @@ addSLE(ApplyContext& ctx, SLE::ref sle, AccountID const& owner)
             return tecDIR_FULL;  // LCOV_EXCL_LINE
         (*sle)[sfOwnerNode] = *page;
     }
-    adjustOwnerCount(ctx.view(), sleAccount, 1, ctx.journal);
+    increaseOwnerCount(ctx.view(), sleAccount, {}, 1, ctx.journal);
     ctx.view().update(sleAccount);
 
     return tesSUCCESS;
diff --git a/src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp b/src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp
index 55a9133e1e..feed43d410 100644
--- a/src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp
+++ b/src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp
@@ -181,7 +181,7 @@ EscrowCancel::doApply()
         if (auto const ret = std::visit(
                 [&]<typename T>(T const&) {
                     return escrowUnlockApplyHelper<T>(
-                        ctx_.view(),
+                        ctx_.getApplyViewContext(),
                         kParityRate,
                         ctx_.view().rules().enabled(fixCleanup3_2_0) ? sle : slep,
                         preFeeBalance_,
@@ -209,8 +209,7 @@ EscrowCancel::doApply()
         }
     }
 
-    adjustOwnerCount(ctx_.view(), sle, -1, ctx_.journal);
-    ctx_.view().update(sle);
+    decreaseOwnerCountForObject(ctx_.view(), sle, slep, 1, ctx_.journal);
 
     // Remove escrow from ledger
     ctx_.view().erase(slep);
diff --git a/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp b/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
index 531098bd1c..50f2e8b859 100644
--- a/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
+++ b/src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp
@@ -11,6 +11,7 @@
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
@@ -434,16 +435,33 @@ EscrowCreate::doApply()
     // Check reserve and funds availability
     STAmount const amount{ctx_.tx[sfAmount]};
 
-    auto const reserve = ctx_.view().fees().accountReserve((*sle)[sfOwnerCount] + 1);
-
     auto const balance = sle->getFieldAmount(sfBalance).xrp();
-    if (balance < reserve)
-        return tecINSUFFICIENT_RESERVE;
+    // First check: whoever is on the hook for the new owner increment
+    // can cover it. When sponsored this hits the sponsor branch and
+    // validates the sponsor's reserve + remaining credit. When
+    // unsponsored this hits the source branch and validates the
+    // source's pre-lock balance against base + (currentOC+1)*increment.
+    if (auto const ret =
+            checkReserve(ctx_.getApplyViewContext(), sle, balance, {.ownerCountDelta = 1}, j_);
+        !isTesSuccess(ret))
+        return ret;
 
-    // Check reserve and funds availability
     if (isXRP(amount))
     {
-        if (balance < reserve + STAmount(amount).xrp())
+        // Second check (XRP escrow only): after locking the escrowed
+        // amount, the source must still meet its own reserve floor. This is
+        // always the source's own balance against the source's own reserve —
+        // the sponsor's reserve was already validated above, and a sponsor
+        // never covers the locked funds. We compare directly (rather than via
+        // checkReserve) because that helper diverts to the sponsor's balance
+        // when a sponsor is present and would ignore the source's post-lock
+        // balance entirely. ownerCountDelta differs by case:
+        // - sponsored:   0  — sponsor covers the new owner increment, so the
+        //                source only owes reserve for its current owners.
+        // - unsponsored: 1  — source owes reserve including the new increment.
+        auto const sourceReserve = accountReserve(
+            ctx_.view(), sle, j_, {.ownerCountDelta = getTxReserveSponsorID(ctx_.tx) ? 0 : 1});
+        if (balance - STAmount(amount).xrp() < sourceReserve)
             return tecUNFUNDED;
     }
 
@@ -535,7 +553,8 @@ EscrowCreate::doApply()
     }
 
     // increment owner count
-    adjustOwnerCount(ctx_.view(), sle, 1, ctx_.journal);
+    increaseOwnerCount(ctx_.getApplyViewContext(), sle, 1, ctx_.journal);
+    addSponsorToLedgerEntry(ctx_.getApplyViewContext(), slep);
     ctx_.view().update(sle);
     return tesSUCCESS;
 }
diff --git a/src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp b/src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp
index 7f1f9ec078..8bc98c7aa8 100644
--- a/src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp
+++ b/src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp
@@ -340,6 +340,16 @@ EscrowFinish::doApply()
         }
     }
 
+    // With the Sponsor amendment, release the escrow reserve before delivery.
+    // Token delivery can auto-create a destination holding, and the same
+    // sponsor (or the same account, for a self-escrow) may cover both the
+    // escrow being removed and the holding being created. Without the
+    // amendment, keep the legacy order: releasing early changes the reserve
+    // arithmetic for self-escrows and would break consensus if not gated.
+    bool const sponsorEnabled = ctx_.view().rules().enabled(featureSponsor);
+    if (sponsorEnabled)
+        decreaseOwnerCountForObject(ctx_.view(), account, slep, 1, ctx_.journal);
+
     STAmount const amount = slep->getFieldAmount(sfAmount);
     // Transfer amount to destination
     if (isXRP(amount))
@@ -359,7 +369,7 @@ EscrowFinish::doApply()
         if (auto const ret = std::visit(
                 [&]<typename T>(T const&) {
                     return escrowUnlockApplyHelper<T>(
-                        ctx_.view(),
+                        ctx_.getApplyViewContext(),
                         lockedRate,
                         sled,
                         preFeeBalance_,
@@ -389,10 +399,9 @@ EscrowFinish::doApply()
 
     ctx_.view().update(sled);
 
-    // Adjust source owner count
-    auto const sle = ctx_.view().peek(keylet::account(account));
-    adjustOwnerCount(ctx_.view(), sle, -1, ctx_.journal);
-    ctx_.view().update(sle);
+    // Adjust source owner count (legacy position, pre-Sponsor)
+    if (!sponsorEnabled)
+        decreaseOwnerCountForObject(ctx_.view(), account, slep, 1, ctx_.journal);
 
     // Remove escrow from ledger
     ctx_.view().erase(slep);
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverClawback.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverClawback.cpp
index 9bb84e878e..b914f3cf24 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverClawback.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverClawback.cpp
@@ -372,7 +372,7 @@ LoanBrokerCoverClawback::doApply()
     associateAsset(*sleBroker, vaultAsset);
 
     // Transfer assets from pseudo-account to depositor.
-    return accountSend(view(), brokerPseudoID, account, clawAmount, j_, WaiveTransferFee::Yes);
+    return accountSend(view(), brokerPseudoID, account, clawAmount, j_, {}, WaiveTransferFee::Yes);
 }
 
 void
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
index 69b28b57af..09ab03347a 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverDeposit.cpp
@@ -176,7 +176,7 @@ LoanBrokerCoverDeposit::doApply()
 
     // Transfer assets from depositor to pseudo-account.
     if (auto ter =
-            accountSend(view(), accountID_, brokerPseudoID, amount, j_, WaiveTransferFee::Yes))
+            accountSend(view(), accountID_, brokerPseudoID, amount, j_, {}, WaiveTransferFee::Yes))
         return ter;
 
     // Increase the LoanBroker's CoverAvailable by Amount
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
index 008857a4ad..498f3c99eb 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerCoverWithdraw.cpp
@@ -211,7 +211,14 @@ LoanBrokerCoverWithdraw::doApply()
 
     associateAsset(*broker, vaultAsset);
 
-    return doWithdraw(view(), tx, accountID_, dstAcct, brokerPseudoID, preFeeBalance_, amount, j_);
+    return doWithdraw(
+        ctx_.getApplyViewContext(),
+        accountID_,
+        dstAcct,
+        brokerPseudoID,
+        preFeeBalance_,
+        amount,
+        j_);
 }
 
 void
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerDelete.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerDelete.cpp
index 141cc2cf56..b36977d225 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerDelete.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerDelete.cpp
@@ -155,11 +155,11 @@ LoanBrokerDelete::doApply()
     {
         auto const coverAvailable = STAmount{vaultAsset, broker->at(sfCoverAvailable)};
         if (auto const ter = accountSend(
-                view(), brokerPseudoID, accountID_, coverAvailable, j_, WaiveTransferFee::Yes))
+                view(), brokerPseudoID, accountID_, coverAvailable, j_, {}, WaiveTransferFee::Yes))
             return ter;
     }
 
-    if (auto ter = removeEmptyHolding(view(), brokerPseudoID, vaultAsset, j_))
+    if (auto ter = removeEmptyHolding(ctx_.getApplyViewContext(), brokerPseudoID, vaultAsset, j_))
         return ter;
 
     auto brokerPseudoSLE = view().peek(keylet::account(brokerPseudoID));
@@ -186,8 +186,6 @@ LoanBrokerDelete::doApply()
 
     view().erase(brokerPseudoSLE);
 
-    view().erase(broker);
-
     {
         auto owner = view().peek(keylet::account(accountID_));
         if (!owner)
@@ -195,9 +193,11 @@ LoanBrokerDelete::doApply()
 
         // Decreases the owner count by two: one for the LoanBroker object, and
         // one for the pseudo-account.
-        adjustOwnerCount(view(), owner, -2, j_);
+        decreaseOwnerCountForObject(view(), owner, broker, 2, j_);
     }
 
+    view().erase(broker);
+
     associateAsset(*broker, vaultAsset);
 
     return tesSUCCESS;
diff --git a/src/libxrpl/tx/transactors/lending/LoanBrokerSet.cpp b/src/libxrpl/tx/transactors/lending/LoanBrokerSet.cpp
index ab1c8f22dc..e9c153404c 100644
--- a/src/libxrpl/tx/transactors/lending/LoanBrokerSet.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanBrokerSet.cpp
@@ -238,9 +238,8 @@ LoanBrokerSet::doApply()
 
         // Increases the owner count by two: one for the LoanBroker object, and
         // one for the pseudo-account.
-        adjustOwnerCount(view, owner, 2, j_);
-        auto const ownerCount = owner->at(sfOwnerCount);
-        if (preFeeBalance_ < view.fees().accountReserve(ownerCount))
+        increaseOwnerCount(view, owner, {}, 2, j_);
+        if (preFeeBalance_ < accountReserve(view, owner, j_))
             return tecINSUFFICIENT_RESERVE;
 
         auto maybePseudo = createPseudoAccount(view, broker->key(), sfLoanBrokerID);
@@ -249,7 +248,8 @@ LoanBrokerSet::doApply()
         auto& pseudo = *maybePseudo;
         auto pseudoId = pseudo->at(sfAccount);
 
-        if (auto ter = addEmptyHolding(view, pseudoId, preFeeBalance_, sleVault->at(sfAsset), j_))
+        if (auto ter = addEmptyHolding(
+                ctx_.getApplyViewContext(), pseudoId, preFeeBalance_, sleVault->at(sfAsset), j_))
             return ter;
 
         // Initialize data fields:
diff --git a/src/libxrpl/tx/transactors/lending/LoanDelete.cpp b/src/libxrpl/tx/transactors/lending/LoanDelete.cpp
index 3459119379..1a77489b4b 100644
--- a/src/libxrpl/tx/transactors/lending/LoanDelete.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanDelete.cpp
@@ -107,9 +107,8 @@ LoanDelete::doApply()
     view.erase(loanSle);
 
     // Decrement the LoanBroker's owner count.
-    // The broker's owner count is solely for the number of outstanding loans,
-    // and is distinct from the broker's pseudo-account's owner count
-    adjustOwnerCount(view, brokerSle, -1, j_);
+    adjustLoanBrokerOwnerCount(view, brokerSle, -1, j_);
+
     // If there are no loans left, then any remaining debt must be forgiven,
     // because there is no other way to pay it back.
     if (brokerSle->at(sfOwnerCount) == 0)
@@ -129,7 +128,7 @@ LoanDelete::doApply()
         }
     }
     // Decrement the borrower's owner count
-    adjustOwnerCount(view, borrowerSle, -1, j_);
+    decreaseOwnerCountForObject(view, borrowerSle, loanSle, 1, j_);
 
     // These associations shouldn't do anything, but do them just to be safe
     associateAsset(*loanSle, vaultAsset);
diff --git a/src/libxrpl/tx/transactors/lending/LoanManage.cpp b/src/libxrpl/tx/transactors/lending/LoanManage.cpp
index 830eb30272..a0aa948876 100644
--- a/src/libxrpl/tx/transactors/lending/LoanManage.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanManage.cpp
@@ -292,6 +292,7 @@ LoanManage::defaultLoan(
         vaultSle->at(sfAccount),
         STAmount{vaultAsset, defaultCovered},
         j,
+        {},
         WaiveTransferFee::Yes);
 }
 
diff --git a/src/libxrpl/tx/transactors/lending/LoanPay.cpp b/src/libxrpl/tx/transactors/lending/LoanPay.cpp
index fcda2a9fff..54ee85b186 100644
--- a/src/libxrpl/tx/transactors/lending/LoanPay.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanPay.cpp
@@ -625,7 +625,11 @@ LoanPay::doApply()
         {
             // The broker may have deleted their holding. Recreate it if needed
             if (auto const ter = addEmptyHolding(
-                    view, brokerPayee, brokerPayeeSle->at(sfBalance).value().xrp(), asset, j_);
+                    ctx_.getApplyViewContext(),
+                    brokerPayee,
+                    brokerPayeeSle->at(sfBalance).value().xrp(),
+                    asset,
+                    j_);
                 ter && ter != tecDUPLICATE)
             {
                 // ignore tecDUPLICATE. That means the holding already exists,
diff --git a/src/libxrpl/tx/transactors/lending/LoanSet.cpp b/src/libxrpl/tx/transactors/lending/LoanSet.cpp
index 1ac387d1b1..694d01c69f 100644
--- a/src/libxrpl/tx/transactors/lending/LoanSet.cpp
+++ b/src/libxrpl/tx/transactors/lending/LoanSet.cpp
@@ -8,6 +8,7 @@
 #include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/LendingHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
@@ -56,6 +57,12 @@ LoanSet::preflight(PreflightContext const& ctx)
 
     auto const& tx = ctx.tx;
 
+    if (tx.isFieldPresent(sfSponsorFlags) && isReserveSponsored(tx))
+    {
+        JLOG(ctx.j.debug()) << "LoanSet: reserve sponsorship is not allowed.";
+        return temINVALID_FLAG;
+    }
+
     // Special case for Batch inner transactions
     if (tx.isFlag(tfInnerBatchTxn) && ctx.rules.enabled(featureBatchV1_1) &&
         !tx.isFieldPresent(sfCounterparty))
@@ -512,12 +519,12 @@ LoanSet::doApply()
         }
     }
 
-    adjustOwnerCount(view, borrowerSle, 1, j_);
+    increaseOwnerCount(view, borrowerSle, {}, 1, j_);
+
     {
-        auto const ownerCount = borrowerSle->at(sfOwnerCount);
         auto const balance =
             accountID_ == borrower ? preFeeBalance_ : borrowerSle->at(sfBalance).value().xrp();
-        if (balance < view.fees().accountReserve(ownerCount))
+        if (balance < accountReserve(view, borrowerSle, j_))
             return tecINSUFFICIENT_RESERVE;
     }
 
@@ -531,8 +538,9 @@ LoanSet::doApply()
         borrower == accountID_ || borrower == counterparty,
         "xrpl::LoanSet::doApply",
         "borrower signed transaction");
+    auto applyViewContext = ctx_.getApplyViewContext();
     if (auto const ter = addEmptyHolding(
-            view, borrower, borrowerSle->at(sfBalance).value().xrp(), vaultAsset, j_);
+            applyViewContext, borrower, borrowerSle->at(sfBalance).value().xrp(), vaultAsset, j_);
         ter && ter != tecDUPLICATE)
     {
         // ignore tecDUPLICATE. That means the holding already exists, and
@@ -555,7 +563,11 @@ LoanSet::doApply()
             "broker owner signed transaction");
 
         if (auto const ter = addEmptyHolding(
-                view, brokerOwner, brokerOwnerSle->at(sfBalance).value().xrp(), vaultAsset, j_);
+                applyViewContext,
+                brokerOwner,
+                brokerOwnerSle->at(sfBalance).value().xrp(),
+                vaultAsset,
+                j_);
             ter && ter != tecDUPLICATE)
         {
             // ignore tecDUPLICATE. That means the holding already exists,
@@ -631,9 +643,7 @@ LoanSet::doApply()
 
     // Update the balances in the loan broker
     adjustImpreciseNumber(brokerSle->at(sfDebtTotal), newDebtDelta, vaultAsset, vaultScale);
-    // The broker's owner count is solely for the number of outstanding loans,
-    // and is distinct from the broker's pseudo-account's owner count
-    adjustOwnerCount(view, brokerSle, 1, j_);
+    adjustLoanBrokerOwnerCount(view, brokerSle, 1, j_);
     loanSequenceProxy += 1;
     // The sequence should be extremely unlikely to roll over, but fail if it
     // does
diff --git a/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp b/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
index 14bf3646c0..41bb051768 100644
--- a/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
+++ b/src/libxrpl/tx/transactors/nft/NFTokenAcceptOffer.cpp
@@ -5,6 +5,7 @@
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/NFTokenHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/Feature.h>
@@ -387,8 +388,7 @@ NFTokenAcceptOffer::transferNFToken(
     auto const buyerOwnerCountAfter = sleBuyer->getFieldU32(sfOwnerCount);
     if (buyerOwnerCountAfter > buyerOwnerCountBefore)
     {
-        if (auto const reserve = view().fees().accountReserve(buyerOwnerCountAfter);
-            buyerBalance < reserve)
+        if (buyerBalance < accountReserve(view(), sleBuyer, j_))
             return tecINSUFFICIENT_RESERVE;
     }
 
diff --git a/src/libxrpl/tx/transactors/nft/NFTokenMint.cpp b/src/libxrpl/tx/transactors/nft/NFTokenMint.cpp
index d8e5a7b235..5490c2de3a 100644
--- a/src/libxrpl/tx/transactors/nft/NFTokenMint.cpp
+++ b/src/libxrpl/tx/transactors/nft/NFTokenMint.cpp
@@ -3,6 +3,7 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/NFTokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
@@ -331,12 +332,14 @@ NFTokenMint::doApply()
     // allows NFTs to be added to the page (and burn fees) without
     // requiring the reserve to be met each time.  The reserve is
     // only managed when a new NFT page or sell offer is added.
-    if (auto const ownerCountAfter =
-            view().read(keylet::account(accountID_))->getFieldU32(sfOwnerCount);
+    auto const sleAccount = view().read(keylet::account(accountID_));
+    if (!sleAccount)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    if (auto const ownerCountAfter = sleAccount->getFieldU32(sfOwnerCount);
         ownerCountAfter > ownerCountBefore)
     {
-        if (auto const reserve = view().fees().accountReserve(ownerCountAfter);
-            preFeeBalance_ < reserve)
+        if (preFeeBalance_ < accountReserve(view(), sleAccount, j_))
             return tecINSUFFICIENT_RESERVE;
     }
     return tesSUCCESS;
diff --git a/src/libxrpl/tx/transactors/oracle/OracleDelete.cpp b/src/libxrpl/tx/transactors/oracle/OracleDelete.cpp
index 9a26816155..b4c12b9514 100644
--- a/src/libxrpl/tx/transactors/oracle/OracleDelete.cpp
+++ b/src/libxrpl/tx/transactors/oracle/OracleDelete.cpp
@@ -4,6 +4,7 @@
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/ledger/helpers/OracleHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/SField.h>
@@ -13,6 +14,8 @@
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 NotTEC
@@ -68,10 +71,8 @@ OracleDelete::deleteOracle(
     if (!sleOwner)
         return tecINTERNAL;  // LCOV_EXCL_LINE
 
-    auto const count = sle->getFieldArray(sfPriceDataSeries).size() > 5 ? -2 : -1;
-
-    adjustOwnerCount(view, sleOwner, count, j);
-
+    std::uint32_t const count = calculateOracleReserve(sle);
+    decreaseOwnerCountForObject(view, sleOwner, sle, count, j);
     view.erase(sle);
 
     return tesSUCCESS;
diff --git a/src/libxrpl/tx/transactors/oracle/OracleSet.cpp b/src/libxrpl/tx/transactors/oracle/OracleSet.cpp
index 12d826e54d..ead26824e5 100644
--- a/src/libxrpl/tx/transactors/oracle/OracleSet.cpp
+++ b/src/libxrpl/tx/transactors/oracle/OracleSet.cpp
@@ -1,9 +1,11 @@
 #include <xrpl/tx/transactors/oracle/OracleSet.h>
 
 #include <xrpl/basics/chrono.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/OracleHelpers.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/InnerObjectFormats.h>
@@ -22,6 +24,7 @@
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
+#include <cstdlib>
 #include <map>
 #include <memory>
 #include <set>
@@ -150,8 +153,9 @@ OracleSet::preclaim(PreclaimContext const& ctx)
         if (!pairsDel.empty())
             return tecTOKEN_PAIR_NOT_FOUND;
 
-        auto const oldCount = sle->getFieldArray(sfPriceDataSeries).size() > 5 ? 2 : 1;
-        auto const newCount = pairs.size() > 5 ? 2 : 1;
+        auto const oldCount = calculateOracleReserve(sle);
+        auto const newCount = calculateOracleReserve(pairs);
+
         adjustReserve = newCount - oldCount;
     }
     else
@@ -160,7 +164,7 @@ OracleSet::preclaim(PreclaimContext const& ctx)
 
         if (!ctx.tx.isFieldPresent(sfProvider) || !ctx.tx.isFieldPresent(sfAssetClass))
             return temMALFORMED;
-        adjustReserve = pairs.size() > 5 ? 2 : 1;
+        adjustReserve = calculateOracleReserve(pairs);
     }
 
     if (pairs.empty())
@@ -169,7 +173,7 @@ OracleSet::preclaim(PreclaimContext const& ctx)
         return tecARRAY_TOO_LARGE;
 
     auto const reserve =
-        ctx.view.fees().accountReserve(sleSetter->getFieldU32(sfOwnerCount) + adjustReserve);
+        accountReserve(ctx.view, sleSetter, ctx.j, {.ownerCountDelta = adjustReserve});
     auto const& balance = sleSetter->getFieldAmount(sfBalance);
 
     if (balance < reserve)
@@ -179,11 +183,22 @@ OracleSet::preclaim(PreclaimContext const& ctx)
 }
 
 static bool
-adjustOwnerCount(ApplyContext& ctx, int count)
+adjustOracleOwnerCount(ApplyContext& ctx, int count)
 {
+    XRPL_ASSERT(std::abs(count) <= 2, "xrpl::adjustOracleOwnerCount abs(counter) <= 2");
+
     if (auto const sleAccount = ctx.view().peek(keylet::account(ctx.tx[sfAccount])))
     {
-        adjustOwnerCount(ctx.view(), sleAccount, count, ctx.journal);
+        if (count > 0)
+        {
+            increaseOwnerCount(
+                ctx.view(), sleAccount, {}, static_cast<std::uint32_t>(count), ctx.journal);
+        }
+        else if (count < 0)
+        {
+            decreaseOwnerCount(
+                ctx.view(), sleAccount, {}, static_cast<std::uint32_t>(-count), ctx.journal);
+        }
         return true;
     }
 
@@ -228,7 +243,7 @@ OracleSet::doApply()
             priceData.setFieldCurrency(sfQuoteAsset, entry.getFieldCurrency(sfQuoteAsset));
             pairs.emplace(tokenPairKey(entry), std::move(priceData));
         }
-        auto const oldCount = pairs.size() > 5 ? 2 : 1;
+        auto const oldCount = calculateOracleReserve(pairs);
         // update/add/delete pairs
         for (auto const& entry : ctx_.tx.getFieldArray(sfPriceDataSeries))
         {
@@ -266,9 +281,10 @@ OracleSet::doApply()
             (*sle)[sfOracleDocumentID] = ctx_.tx[sfOracleDocumentID];
         }
 
-        auto const newCount = pairs.size() > 5 ? 2 : 1;
-        auto const adjust = newCount - oldCount;
-        if (adjust != 0 && !adjustOwnerCount(ctx_, adjust))
+        auto const newCount = calculateOracleReserve(pairs);
+        int32_t const adjust = newCount - oldCount;
+
+        if (adjust != 0 && !adjustOracleOwnerCount(ctx_, adjust))
             return tefINTERNAL;  // LCOV_EXCL_LINE
 
         ctx_.view().update(sle);
@@ -317,8 +333,8 @@ OracleSet::doApply()
 
         (*sle)[sfOwnerNode] = *page;
 
-        auto const count = series.size() > 5 ? 2 : 1;
-        if (!adjustOwnerCount(ctx_, count))
+        auto const count = calculateOracleReserve(series);
+        if (!adjustOracleOwnerCount(ctx_, count))
             return tefINTERNAL;  // LCOV_EXCL_LINE
 
         ctx_.view().insert(sle);
diff --git a/src/libxrpl/tx/transactors/payment/DepositPreauth.cpp b/src/libxrpl/tx/transactors/payment/DepositPreauth.cpp
index 7e950dc743..d3e2af86ef 100644
--- a/src/libxrpl/tx/transactors/payment/DepositPreauth.cpp
+++ b/src/libxrpl/tx/transactors/payment/DepositPreauth.cpp
@@ -7,13 +7,13 @@
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/CredentialHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
@@ -151,6 +151,7 @@ DepositPreauth::preclaim(PreclaimContext const& ctx)
 TER
 DepositPreauth::doApply()
 {
+    auto applyViewContext = ctx_.getApplyViewContext();
     if (ctx_.tx.isFieldPresent(sfAuthorize))
     {
         auto const sleOwner = view().peek(keylet::account(accountID_));
@@ -160,13 +161,10 @@ DepositPreauth::doApply()
         // A preauth counts against the reserve of the issuing account, but we
         // check the starting balance because we want to allow dipping into the
         // reserve to pay fees.
-        {
-            STAmount const reserve{
-                view().fees().accountReserve(sleOwner->getFieldU32(sfOwnerCount) + 1)};
-
-            if (preFeeBalance_ < reserve)
-                return tecINSUFFICIENT_RESERVE;
-        }
+        if (auto const ret = checkReserve(
+                applyViewContext, sleOwner, preFeeBalance_, {.ownerCountDelta = 1}, j_);
+            !isTesSuccess(ret))
+            return ret;
 
         // Preclaim already verified that the Preauth entry does not yet exist.
         // Create and populate the Preauth entry.
@@ -190,7 +188,8 @@ DepositPreauth::doApply()
         slePreauth->setFieldU64(sfOwnerNode, *page);
 
         // If we succeeded, the new entry counts against the creator's reserve.
-        adjustOwnerCount(view(), sleOwner, 1, j_);
+        increaseOwnerCount(applyViewContext, sleOwner, 1, j_);
+        addSponsorToLedgerEntry(applyViewContext, slePreauth);
     }
     else if (ctx_.tx.isFieldPresent(sfUnauthorize))
     {
@@ -207,13 +206,10 @@ DepositPreauth::doApply()
         // A preauth counts against the reserve of the issuing account, but we
         // check the starting balance because we want to allow dipping into the
         // reserve to pay fees.
-        {
-            STAmount const reserve{
-                view().fees().accountReserve(sleOwner->getFieldU32(sfOwnerCount) + 1)};
-
-            if (preFeeBalance_ < reserve)
-                return tecINSUFFICIENT_RESERVE;
-        }
+        if (auto const ret = checkReserve(
+                applyViewContext, sleOwner, preFeeBalance_, {.ownerCountDelta = 1}, j_);
+            !isTesSuccess(ret))
+            return ret;
 
         // Preclaim already verified that the Preauth entry does not yet exist.
         // Create and populate the Preauth entry.
@@ -251,7 +247,8 @@ DepositPreauth::doApply()
         slePreauth->setFieldU64(sfOwnerNode, *page);
 
         // If we succeeded, the new entry counts against the creator's reserve.
-        adjustOwnerCount(view(), sleOwner, 1, j_);
+        increaseOwnerCount(applyViewContext, sleOwner, 1, j_);
+        addSponsorToLedgerEntry(applyViewContext, slePreauth);
     }
     else if (ctx_.tx.isFieldPresent(sfUnauthorizeCredentials))
     {
@@ -289,8 +286,7 @@ DepositPreauth::removeFromLedger(ApplyView& view, uint256 const& preauthIndex, b
     if (!sleOwner)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
-    adjustOwnerCount(view, sleOwner, -1, j);
-
+    decreaseOwnerCountForObject(view, sleOwner, slePreauth, 1, j);
     // Remove DepositPreauth from ledger.
     view.erase(slePreauth);
 
diff --git a/src/libxrpl/tx/transactors/payment/Payment.cpp b/src/libxrpl/tx/transactors/payment/Payment.cpp
index 6e3883572a..17c96a1919 100644
--- a/src/libxrpl/tx/transactors/payment/Payment.cpp
+++ b/src/libxrpl/tx/transactors/payment/Payment.cpp
@@ -10,6 +10,7 @@
 #include <xrpl/ledger/helpers/CredentialHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/PermissionedDEXHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
@@ -37,6 +38,7 @@
 
 #include <algorithm>
 #include <cstdint>
+#include <limits>
 #include <memory>
 #include <optional>
 #include <unordered_set>
@@ -120,6 +122,21 @@ Payment::preflight(PreflightContext const& ctx)
     if (!ctx.rules.enabled(featureMPTokensV1) && isDstMPT)
         return temDISABLED;
 
+    if (tx.isFlag(tfSponsorCreatedAccount))
+    {
+        if (!ctx.rules.enabled(featureSponsor))
+            return temDISABLED;
+
+        if (tx.isFlag(tfNoRippleDirect) || tx.isFlag(tfPartialPayment) || tx.isFlag(tfLimitQuality))
+            return temINVALID_FLAG;
+
+        if (tx.isFieldPresent(sfSendMax) || tx.isFieldPresent(sfPaths))
+            return temINVALID;
+
+        if (!dstAmount.native())
+            return temBAD_AMOUNT;
+    }
+
     if (!mpTokensV2 && isDstMPT && ctx.tx.isFieldPresent(sfPaths))
         return temMALFORMED;
 
@@ -383,15 +400,28 @@ Payment::preclaim(PreclaimContext const& ctx)
         {
             // accountReserve is the minimum amount that an account can have.
             // Reserve is not scaled by load.
-            JLOG(ctx.j.trace()) << "Delay transaction: Destination account does not exist. "
-                                << "Insufficent payment to create account.";
+            if (!ctx.tx.isFlag(tfSponsorCreatedAccount))
+            {
+                // The minimum amount when creating a Sponsored Account is 1 drop.
+                // Since the reserve is covered by the sponsor, you don't need to hold the
+                // 1-increment reserve yourself.
+                JLOG(ctx.j.trace()) << "Delay transaction: Destination account does not exist. "
+                                    << "Insufficient payment to create account.";
 
-            // TODO: de-dupe
-            // Another transaction could create the account and then this
-            // transaction would succeed.
-            return tecNO_DST_INSUF_XRP;
+                // TODO: de-dupe
+                // Another transaction could create the account and then this
+                // transaction would succeed.
+                return tecNO_DST_INSUF_XRP;
+            }
         }
     }
+    else if (ctx.tx.isFlag(tfSponsorCreatedAccount))
+    {
+        // The tfSponsorCreatedAccount flag is specific to account creation via
+        // sponsorship. If the destination account already exists, applying this
+        // flag is invalid.
+        return tecNO_SPONSOR_PERMISSION;
+    }
     else if (sleDst->isFlag(lsfRequireDestTag) && !ctx.tx.isFieldPresent(sfDestinationTag))
     {
         // The tag is basically account-specific information we don't
@@ -470,6 +500,27 @@ Payment::doApply()
         sleDst->setFieldU32(sfSequence, view().seq());
         sleDst->setFieldAmount(sfBalance, XRPAmount(beast::kZero));
 
+        if (ctx_.tx.isFlag(tfSponsorCreatedAccount))
+        {
+            auto const sponsor = view().peek(keylet::account(accountID_));
+            if (!sponsor)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+            auto const currentSponsoringAccountCount =
+                sponsor->getFieldU32(sfSponsoringAccountCount);
+            if (currentSponsoringAccountCount == std::numeric_limits<std::uint32_t>::max())
+            {
+                // LCOV_EXCL_START
+                JLOG(j_.fatal()) << "Sponsoring account count overflow for account "
+                                 << to_string(accountID_);
+                return tecINTERNAL;
+                // LCOV_EXCL_STOP
+            }
+            sponsor->setFieldU32(sfSponsoringAccountCount, currentSponsoringAccountCount + 1);
+
+            addSponsorToLedgerEntry(sleDst, sponsor);
+            view().update(sponsor);
+        }
+
         view().insert(sleDst);
     }
     else
@@ -636,16 +687,12 @@ Payment::doApply()
     if (!sleSrc)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
-    // ownerCount is the number of entries in this ledger for this
-    // account that require a reserve.
-    auto const ownerCount = sleSrc->getFieldU32(sfOwnerCount);
+    // the number of reserves in this ledger for this account that require a
+    // reserve.
+    auto const reserve = accountReserve(view(), sleSrc, j_);
 
-    // This is the total reserve in drops.
-    auto const reserve = view().fees().accountReserve(ownerCount);
-
-    // In a delegated payment, the fee payer is the delegated account,
-    // not the source account (accountID_).
-    bool const accountIsPayer = (ctx_.tx.getFeePayer() == accountID_);
+    // In a delegated / fee sponsored payment, the fee payer is not the source account (accountID_).
+    bool const accountIsPayer = ctx_.tx.getFeePayerID() == accountID_;
 
     // preFeeBalance_ is the balance on the source account (accountID_) BEFORE the fees
     // were charged. If source account is the fee payer, it must also cover the fee.
diff --git a/src/libxrpl/tx/transactors/payment_channel/PaymentChannelCreate.cpp b/src/libxrpl/tx/transactors/payment_channel/PaymentChannelCreate.cpp
index 977da56861..b17430948a 100644
--- a/src/libxrpl/tx/transactors/payment_channel/PaymentChannelCreate.cpp
+++ b/src/libxrpl/tx/transactors/payment_channel/PaymentChannelCreate.cpp
@@ -7,6 +7,7 @@
 #include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Keylet.h>
@@ -77,9 +78,10 @@ PaymentChannelCreate::preclaim(PreclaimContext const& ctx)
         return terNO_ACCOUNT;
 
     // Check reserve and funds availability
+    if (!ctx.view.rules().enabled(featureSponsor))
     {
         auto const balance = (*sle)[sfBalance];
-        auto const reserve = ctx.view.fees().accountReserve((*sle)[sfOwnerCount] + 1);
+        auto const reserve = ctx.view.fees().accountReserve((*sle)[sfOwnerCount] + 1, 1);
 
         if (balance < reserve)
             return tecINSUFFICIENT_RESERVE;
@@ -131,6 +133,36 @@ PaymentChannelCreate::doApply()
             return tecEXPIRED;
     }
 
+    if (ctx_.view().rules().enabled(featureSponsor))
+    {
+        // First check: whoever is on the hook for the new owner increment
+        // can cover it. When sponsored this hits the sponsor branch and
+        // validates the sponsor's reserve + remaining credit. When
+        // unsponsored this hits the source branch and validates the
+        // source's pre-lock balance against base + (currentOC+1)*increment.
+        if (auto const ret = checkReserve(
+                ctx_.getApplyViewContext(), sle, preFeeBalance_, {.ownerCountDelta = 1}, j_);
+            !isTesSuccess(ret))
+            return ret;
+
+        // Second check: after locking sfAmount in the channel, the source
+        // must still meet its own reserve floor. This is always the
+        // source's own balance against the source's own reserve — the
+        // sponsor's reserve was already validated above, and a sponsor
+        // never covers the locked funds. We compare directly (rather than
+        // via checkReserve) because that helper diverts to the
+        // sponsor's balance when a sponsor is present and would ignore the
+        // source's post-lock balance entirely. ownerCountDelta differs by
+        // case:
+        // - sponsored:   0  — sponsor covers the new owner increment, so
+        //                the source only owes reserve for its current owners.
+        // - unsponsored: 1  — source owes reserve including the new increment.
+        auto const sourceReserve = accountReserve(
+            ctx_.view(), sle, j_, {.ownerCountDelta = getTxReserveSponsorID(ctx_.tx) ? 0 : 1});
+        if (preFeeBalance_ - ctx_.tx[sfAmount].xrp() < sourceReserve)
+            return tecUNFUNDED;
+    }
+
     auto const dst = ctx_.tx[sfDestination];
 
     // Create PayChan in ledger.
@@ -178,7 +210,8 @@ PaymentChannelCreate::doApply()
 
     // Deduct owner's balance, increment owner count
     (*sle)[sfBalance] = (*sle)[sfBalance] - ctx_.tx[sfAmount];
-    adjustOwnerCount(ctx_.view(), sle, 1, ctx_.journal);
+    increaseOwnerCount(ctx_.getApplyViewContext(), sle, 1, ctx_.journal);
+    addSponsorToLedgerEntry(ctx_.getApplyViewContext(), slep);
     ctx_.view().update(sle);
 
     return tesSUCCESS;
diff --git a/src/libxrpl/tx/transactors/payment_channel/PaymentChannelFund.cpp b/src/libxrpl/tx/transactors/payment_channel/PaymentChannelFund.cpp
index 4e3c5dd638..1d1cf07e25 100644
--- a/src/libxrpl/tx/transactors/payment_channel/PaymentChannelFund.cpp
+++ b/src/libxrpl/tx/transactors/payment_channel/PaymentChannelFund.cpp
@@ -4,6 +4,7 @@
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/PaymentChannelHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
@@ -87,13 +88,18 @@ PaymentChannelFund::doApply()
 
     {
         // Check reserve and funds availability
-        auto const balance = (*sle)[sfBalance];
-        auto const reserve = ctx_.view().fees().accountReserve((*sle)[sfOwnerCount]);
+        STAmount const balance = (*sle)[sfBalance];
+        if (auto const ret = checkReserve(ctx_.getApplyViewContext(), sle, balance.xrp(), {}, j_);
+            !isTesSuccess(ret))
+            return ret;
 
-        if (balance < reserve)
-            return tecINSUFFICIENT_RESERVE;
-
-        if (balance < reserve + ctx_.tx[sfAmount])
+        // After locking sfAmount in the channel, the source must still meet
+        // its own reserve floor. We compare directly (rather than via
+        // checkReserve) because that helper diverts to the sponsor's balance
+        // when a sponsor is present and would ignore the source's post-lock
+        // balance entirely. Funding an existing channel adds no owned object,
+        // so there is no owner-count delta.
+        if (balance < accountReserve(ctx_.view(), sle, j_) + ctx_.tx[sfAmount])
             return tecUNFUNDED;
     }
 
diff --git a/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.cpp b/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.cpp
index 7eb3f282b9..9978d3e260 100644
--- a/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.cpp
+++ b/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.cpp
@@ -65,7 +65,7 @@ PermissionedDomainDelete::doApply()
     XRPL_ASSERT(
         ownerSle && ownerSle->getFieldU32(sfOwnerCount) > 0,
         "xrpl::PermissionedDomainDelete::doApply : nonzero owner count");
-    adjustOwnerCount(view(), ownerSle, -1, ctx_.journal);
+    decreaseOwnerCountForObject(view(), ownerSle, slePd, 1, ctx_.journal);
     view().erase(slePd);
 
     return tesSUCCESS;
diff --git a/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.cpp b/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.cpp
index 0e71ceada1..c2df114e48 100644
--- a/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.cpp
+++ b/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.cpp
@@ -106,7 +106,8 @@ PermissionedDomainSet::doApply()
         // Create new permissioned domain.
         // Check reserve availability for new object creation
         auto const balance = STAmount((*ownerSle)[sfBalance]).xrp();
-        auto const reserve = ctx_.view().fees().accountReserve((*ownerSle)[sfOwnerCount] + 1);
+        auto const reserve =
+            accountReserve(ctx_.view(), ownerSle, ctx_.journal, {.ownerCountDelta = 1});
         if (balance < reserve)
             return tecINSUFFICIENT_RESERVE;
 
@@ -125,7 +126,7 @@ PermissionedDomainSet::doApply()
 
         slePd->setFieldU64(sfOwnerNode, *page);
         // If we succeeded, the new entry counts against the creator's reserve.
-        adjustOwnerCount(view(), ownerSle, 1, ctx_.journal);
+        increaseOwnerCount(view(), ownerSle, {}, 1, ctx_.journal);
         view().insert(slePd);
     }
 
diff --git a/src/libxrpl/tx/transactors/sponsor/SponsorshipSet.cpp b/src/libxrpl/tx/transactors/sponsor/SponsorshipSet.cpp
new file mode 100644
index 0000000000..2b6ab8cf15
--- /dev/null
+++ b/src/libxrpl/tx/transactors/sponsor/SponsorshipSet.cpp
@@ -0,0 +1,420 @@
+#include <xrpl/tx/transactors/sponsor/SponsorshipSet.h>
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <cstdint>
+#include <memory>
+#include <optional>
+
+namespace xrpl {
+
+static bool
+hasSponsorshipBudget(
+    SLE::const_ref sponsorshipSle,
+    std::optional<STAmount> const& feeAmount,
+    std::optional<std::uint32_t> const& remainingOwnerCount)
+{
+    // A field the transaction omits keeps whatever the existing object holds,
+    // so fall back to the current SLE value when the tx does not set it.
+    bool const hasFeeAmount = feeAmount
+        ? *feeAmount > beast::kZero
+        : sponsorshipSle && (*sponsorshipSle)[~sfFeeAmount].value_or(STAmount{0}) > beast::kZero;
+
+    bool const hasRemainingOwnerCount = remainingOwnerCount
+        ? *remainingOwnerCount > 0
+        : sponsorshipSle && (*sponsorshipSle)[~sfRemainingOwnerCount].value_or(0) > 0;
+
+    return hasFeeAmount || hasRemainingOwnerCount;
+}
+
+TxConsequences
+SponsorshipSet::makeTxConsequences(PreflightContext const& ctx)
+{
+    auto const feeAmount = ctx.tx[~sfFeeAmount];
+    return TxConsequences{ctx.tx, feeAmount.has_value() ? feeAmount->xrp() : beast::kZero};
+}
+
+std::uint32_t
+SponsorshipSet::getFlagsMask(PreflightContext const& ctx)
+{
+    return tfSponsorshipSetMask;
+}
+
+NotTEC
+SponsorshipSet::preflight(PreflightContext const& ctx)
+{
+    if (ctx.tx.isFlag(tfSponsorshipSetRequireSignForFee) &&
+        ctx.tx.isFlag(tfSponsorshipClearRequireSignForFee))
+        return temINVALID_FLAG;
+    if (ctx.tx.isFlag(tfSponsorshipSetRequireSignForReserve) &&
+        ctx.tx.isFlag(tfSponsorshipClearRequireSignForReserve))
+        return temINVALID_FLAG;
+
+    auto const account = ctx.tx.getAccountID(sfAccount);
+    bool const hasSponsor = ctx.tx.isFieldPresent(sfCounterpartySponsor);
+    bool const hasSponsee = ctx.tx.isFieldPresent(sfSponsee);
+
+    // The transaction must specify either Sponsor or Sponsee, but not both.
+    if (hasSponsor == hasSponsee)
+        return temMALFORMED;
+
+    auto const sponsorID = ctx.tx[~sfCounterpartySponsor].value_or(account);
+    auto const sponseeID = ctx.tx[~sfSponsee].value_or(account);
+
+    if (sponsorID == sponseeID)
+        return temMALFORMED;
+
+    if (ctx.tx.isFlag(tfDeleteObject))
+    {
+        // Transactions deleting `Sponsorship` cannot set modification flags.
+        constexpr std::uint32_t kModifyFlags = tfSponsorshipSetRequireSignForFee |
+            tfSponsorshipSetRequireSignForReserve | tfSponsorshipClearRequireSignForFee |
+            tfSponsorshipClearRequireSignForReserve;
+
+        if ((ctx.tx.getFlags() & kModifyFlags) != 0u)
+            return temINVALID_FLAG;
+
+        // Transactions deleting `Sponsorship` cannot include modification fields.
+        if (ctx.tx.isFieldPresent(sfFeeAmount) || ctx.tx.isFieldPresent(sfRemainingOwnerCount) ||
+            ctx.tx.isFieldPresent(sfMaxFee))
+            return temMALFORMED;
+    }
+    else
+    {
+        // Both sponsor and sponsee can delete a Sponsorship object, but only
+        // the sponsor can create or update one.
+        if (account != sponsorID)
+            return temMALFORMED;
+
+        // FeeAmount and MaxFee must be non-negative XRP amounts when present.
+        auto const checkOptionalAmountField = [&](SField const& field) -> NotTEC {
+            if (!ctx.tx.isFieldPresent(field))
+                return tesSUCCESS;
+
+            auto const amount = ctx.tx.getFieldAmount(field);
+
+            if (!isXRP(amount))
+                return temBAD_AMOUNT;
+
+            if (amount.xrp() < beast::kZero)
+                return temBAD_AMOUNT;
+
+            return tesSUCCESS;
+        };
+
+        if (auto const ret = checkOptionalAmountField(sfFeeAmount); !isTesSuccess(ret))
+            return ret;
+
+        if (auto const ret = checkOptionalAmountField(sfMaxFee); !isTesSuccess(ret))
+            return ret;
+    }
+
+    return tesSUCCESS;
+}
+
+TER
+SponsorshipSet::preclaim(PreclaimContext const& ctx)
+{
+    auto const sponsorID = ctx.tx[~sfCounterpartySponsor].value_or(ctx.tx[sfAccount]);
+    auto const sponseeID = ctx.tx[~sfSponsee].value_or(ctx.tx[sfAccount]);
+
+    if (sponseeID == sponsorID)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sponsorAccSle = ctx.view.read(keylet::account(sponsorID));
+    if (!sponsorAccSle)
+        return tecNO_DST;
+
+    auto const sponseeSle = ctx.view.read(keylet::account(sponseeID));
+    if (!sponseeSle)
+        return tecNO_DST;
+
+    // Pseudo-accounts cannot participate in sponsorship.
+    if (isPseudoAccount(sponsorAccSle) || isPseudoAccount(sponseeSle))
+        return tecNO_PERMISSION;
+
+    auto const sponsorshipSle = ctx.view.read(keylet::sponsorship(sponsorID, sponseeID));
+
+    // Deleting a Sponsorship object requires the object to already exist.
+    if (ctx.tx.isFlag(tfDeleteObject) && !sponsorshipSle)
+        return tecNO_ENTRY;
+
+    // Reject creating or updating a Sponsorship that would be left with no
+    // budget (neither a positive FeeAmount nor a positive RemainingOwnerCount).
+    // Such an object is unusable yet still consumes the sponsor's reserve.
+    if (!ctx.tx.isFlag(tfDeleteObject) &&
+        !hasSponsorshipBudget(sponsorshipSle, ctx.tx[~sfFeeAmount], ctx.tx[~sfRemainingOwnerCount]))
+        return tecNO_PERMISSION;
+
+    return tesSUCCESS;
+}
+
+static TER
+deleteSponsorship(ApplyView& view, SLE::ref sle, beast::Journal j)
+{
+    if (!sle)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sponsorID = (*sle)[sfOwner];
+    auto const sponseeID = (*sle)[sfSponsee];
+
+    // The sponsor owns the Sponsorship object, so deletion releases the
+    // sponsor's owner reserve.
+    auto sponsorAccSle = view.peek(keylet::account(sponsorID));
+    if (!sponsorAccSle)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    if (!view.dirRemove(keylet::ownerDir(sponsorID), (*sle)[sfOwnerNode], sle->key(), false))
+    {
+        // LCOV_EXCL_START
+        JLOG(j.fatal()) << "Unable to delete Sponsorship from sponsor.";
+        return tefBAD_LEDGER;
+        // LCOV_EXCL_STOP
+    }
+    if (!view.dirRemove(keylet::ownerDir(sponseeID), (*sle)[sfSponseeNode], sle->key(), false))
+    {
+        // LCOV_EXCL_START
+        JLOG(j.fatal()) << "Unable to delete Sponsorship from sponsee.";
+        return tefBAD_LEDGER;
+        // LCOV_EXCL_STOP
+    }
+
+    decreaseOwnerCountForObject(view, sponsorAccSle, sle, 1, j);
+
+    // Return any prefunded fee amount to the sponsor before erasing the object.
+    if (sle->isFieldPresent(sfFeeAmount))
+    {
+        (*sponsorAccSle)[sfBalance] += sle->getFieldAmount(sfFeeAmount);
+        view.update(sponsorAccSle);
+    }
+
+    view.erase(sle);
+
+    return tesSUCCESS;
+}
+
+TER
+SponsorshipSet::doApply()
+{
+    auto const sponsorID = ctx_.tx[~sfCounterpartySponsor].value_or(accountID_);
+    auto const sponseeID = ctx_.tx[~sfSponsee].value_or(accountID_);
+
+    if (sponseeID == sponsorID)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sponsorAccSle = ctx_.view().peek(keylet::account(sponsorID));
+    if (!sponsorAccSle)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    if (!ctx_.view().exists(keylet::account(sponseeID)))
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sponsorKeylet = keylet::sponsorship(sponsorID, sponseeID);
+    auto const sponsorshipSle = ctx_.view().peek(sponsorKeylet);
+
+    if (ctx_.tx.isFlag(tfDeleteObject))
+    {
+        if (!sponsorshipSle)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        return deleteSponsorship(ctx_.view(), sponsorshipSle, ctx_.journal);
+    }
+
+    auto const feeAmount = ctx_.tx[~sfFeeAmount];
+    auto const maxFee = ctx_.tx[~sfMaxFee];
+    auto const remainingOwnerCount = ctx_.tx[~sfRemainingOwnerCount];
+
+    bool const hasPositiveFeeAmount = feeAmount.has_value() && *feeAmount > beast::kZero;
+
+    auto reserveSponsorAccSle = getTxReserveSponsor(ctx_.getApplyViewContext());
+    if (!reserveSponsorAccSle)
+        return reserveSponsorAccSle.error();  // LCOV_EXCL_LINE
+
+    if (!sponsorshipSle)
+    {
+        // Create a new Sponsorship object between the sponsor and sponsee.
+        auto newSle = std::make_shared<SLE>(sponsorKeylet);
+
+        (*newSle)[sfOwner] = sponsorID;
+        (*newSle)[sfSponsee] = sponseeID;
+        if (feeAmount && (*feeAmount).xrp() > (*sponsorAccSle)[sfBalance])
+            return tecUNFUNDED;
+
+        STAmount sponsorBalanceAfterFee = (*sponsorAccSle)[sfBalance];
+        if (hasPositiveFeeAmount)
+            sponsorBalanceAfterFee -= *feeAmount;
+
+        if (auto const ret = checkReserve(
+                ctx_.getApplyViewContext(),
+                sponsorAccSle,
+                sponsorBalanceAfterFee.xrp(),
+                *reserveSponsorAccSle,
+                {.ownerCountDelta = 1},
+                ctx_.journal,
+                tecUNFUNDED);
+            !isTesSuccess(ret))
+        {
+            return ret;
+        }
+
+        if (hasPositiveFeeAmount)
+        {
+            // New object: FeeAmount starts absent, so deduct and record the full amount
+            (*newSle)[sfFeeAmount] = *feeAmount;
+            (*sponsorAccSle)[sfBalance] -= *feeAmount;
+        }
+
+        if (maxFee && *maxFee > beast::kZero)
+            (*newSle)[sfMaxFee] = *maxFee;
+        if (remainingOwnerCount && *remainingOwnerCount > 0)
+            (*newSle)[sfRemainingOwnerCount] = *remainingOwnerCount;
+
+        std::uint32_t flags = 0;
+        if (ctx_.tx.isFlag(tfSponsorshipSetRequireSignForFee))
+            flags |= lsfSponsorshipRequireSignForFee;
+
+        if (ctx_.tx.isFlag(tfSponsorshipSetRequireSignForReserve))
+            flags |= lsfSponsorshipRequireSignForReserve;
+
+        (*newSle)[sfFlags] = flags;
+
+        auto const sponsorPage = view().dirInsert(
+            keylet::ownerDir(sponsorID), sponsorKeylet, describeOwnerDir(sponsorID));
+        if (!sponsorPage)
+            return tecDIR_FULL;  // LCOV_EXCL_LINE
+        (*newSle)[sfOwnerNode] = *sponsorPage;
+
+        auto const sponseePage = view().dirInsert(
+            keylet::ownerDir(sponseeID), sponsorKeylet, describeOwnerDir(sponseeID));
+        if (!sponseePage)
+            return tecDIR_FULL;  // LCOV_EXCL_LINE
+        (*newSle)[sfSponseeNode] = *sponseePage;
+
+        // NOLINTNEXTLINE(readability-suspicious-call-argument)
+        increaseOwnerCount(view(), sponsorAccSle, *reserveSponsorAccSle, 1, ctx_.journal);
+        addSponsorToLedgerEntry(newSle, *reserveSponsorAccSle);
+
+        ctx_.view().insert(newSle);
+        return tesSUCCESS;
+    }
+
+    // Update the existing Sponsorship object.
+    if (feeAmount)
+    {
+        auto const currentFeeAmount = (*sponsorshipSle)[~sfFeeAmount].valueOr(XRPAmount{0});
+        auto const feeAmountDelta = XRPAmount(*feeAmount - currentFeeAmount);
+
+        if (feeAmountDelta > beast::kZero && feeAmountDelta > (*sponsorAccSle)[sfBalance])
+            return tecUNFUNDED;
+
+        // Move the FeeAmount delta between the sponsor balance and Sponsorship
+        // object.
+        if (feeAmountDelta != beast::kZero)
+        {
+            STAmount sponsorBalanceAfterFee = (*sponsorAccSle)[sfBalance];
+            sponsorBalanceAfterFee -= feeAmountDelta;
+
+            if (auto const ret = checkReserve(
+                    ctx_.getApplyViewContext(),
+                    sponsorAccSle,
+                    sponsorBalanceAfterFee.xrp(),
+                    *reserveSponsorAccSle,
+                    {},
+                    ctx_.journal,
+                    tecUNFUNDED);
+                !isTesSuccess(ret))
+            {
+                return ret;
+            }
+
+            (*sponsorAccSle)[sfBalance] -= feeAmountDelta;
+            if (*feeAmount == beast::kZero)
+            {
+                (*sponsorshipSle).makeFieldAbsent(sfFeeAmount);
+            }
+            else
+            {
+                (*sponsorshipSle).setFieldAmount(sfFeeAmount, *feeAmount);
+            }
+            ctx_.view().update(sponsorAccSle);
+        }
+    }
+
+    if (maxFee)
+    {
+        if (*maxFee == beast::kZero)
+        {
+            (*sponsorshipSle).makeFieldAbsent(sfMaxFee);
+        }
+        else
+        {
+            (*sponsorshipSle)[sfMaxFee] = *maxFee;
+        }
+    }
+
+    if (remainingOwnerCount)
+    {
+        if (*remainingOwnerCount == 0)
+        {
+            sponsorshipSle->makeFieldAbsent(sfRemainingOwnerCount);
+        }
+        else
+        {
+            sponsorshipSle->at(sfRemainingOwnerCount) = *remainingOwnerCount;
+        }
+    }
+
+    // Apply requested flag changes.
+    auto flags = sponsorshipSle->getFieldU32(sfFlags);
+    if (ctx_.tx.isFlag(tfSponsorshipSetRequireSignForFee))
+        flags |= lsfSponsorshipRequireSignForFee;
+
+    if (ctx_.tx.isFlag(tfSponsorshipClearRequireSignForFee))
+        flags &= ~lsfSponsorshipRequireSignForFee;
+
+    if (ctx_.tx.isFlag(tfSponsorshipSetRequireSignForReserve))
+        flags |= lsfSponsorshipRequireSignForReserve;
+
+    if (ctx_.tx.isFlag(tfSponsorshipClearRequireSignForReserve))
+        flags &= ~lsfSponsorshipRequireSignForReserve;
+
+    if (flags != (*sponsorshipSle)[sfFlags])
+        (*sponsorshipSle)[sfFlags] = flags;
+
+    view().update(sponsorshipSle);
+
+    return tesSUCCESS;
+}
+
+void
+SponsorshipSet::visitInvariantEntry(bool, SLE::const_ref, SLE::const_ref)
+{
+}
+
+bool
+SponsorshipSet::finalizeInvariants(
+    STTx const&,
+    TER,
+    XRPAmount,
+    ReadView const&,
+    beast::Journal const&)
+{
+    return true;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp b/src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp
new file mode 100644
index 0000000000..0e036649fd
--- /dev/null
+++ b/src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp
@@ -0,0 +1,542 @@
+#include <xrpl/tx/transactors/sponsor/SponsorshipTransfer.h>
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <bit>
+#include <cstdint>
+#include <limits>
+#include <memory>
+
+namespace xrpl {
+
+// Increment an uint32 sponsor count field and update the SLE.
+static TER
+incrementSponsorCount(
+    ApplyView& view,
+    SLE::ref sle,
+    SF_UINT32 const& field,
+    std::uint32_t const delta)
+{
+    auto const currentValue = sle->getFieldU32(field);
+    if (std::numeric_limits<std::uint32_t>::max() - currentValue < delta)
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::incrementSponsorCount : sponsor field overflow");
+        return tecINTERNAL;
+        // LCOV_EXCL_STOP
+    }
+
+    sle->at(field) = currentValue + delta;
+    view.update(sle);
+    return tesSUCCESS;
+}
+
+// Decrement an uint32 sponsor count field and update the SLE.
+static TER
+decrementSponsorCount(
+    ApplyView& view,
+    SLE::ref sle,
+    SF_UINT32 const& field,
+    std::uint32_t const delta)
+{
+    auto const currentValue = sle->getFieldU32(field);
+    if (currentValue < delta)
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::decrementSponsorCount : sponsor field underflow");
+        return tecINTERNAL;
+        // LCOV_EXCL_STOP
+    }
+
+    sle->at(field) = currentValue - delta;
+    view.update(sle);
+    return tesSUCCESS;
+}
+
+// Consume the sponsor's pre-funded reserve budget and lowers the Sponsorship
+// object's RemainingOwnerCount.
+static TER
+decrementPrefundedReserveCount(ApplyView& view, SLE::ref sponsorshipSle, std::uint32_t const delta)
+{
+    if (delta == 0)
+        return tesSUCCESS;  // LCOV_EXCL_LINE
+
+    auto const currentReserveCount = sponsorshipSle->getFieldU32(sfRemainingOwnerCount);
+    if (currentReserveCount < delta)
+    {
+        // LCOV_EXCL_START
+        // Already verified by checkReserve (sufficient RemainingOwnerCount)
+        UNREACHABLE("xrpl::decrementPrefundedReserveCount : invalid reserve count");
+        return tefINTERNAL;
+        // LCOV_EXCL_STOP
+    }
+
+    sponsorshipSle->at(sfRemainingOwnerCount) = currentReserveCount - delta;
+    view.update(sponsorshipSle);
+    return tesSUCCESS;
+}
+
+std::uint32_t
+SponsorshipTransfer::getFlagsMask(PreflightContext const& ctx)
+{
+    return tfSponsorshipTransferMask;
+}
+
+NotTEC
+SponsorshipTransfer::preflight(PreflightContext const& ctx)
+{
+    static constexpr auto transferFlags =
+        tfSponsorshipCreate | tfSponsorshipReassign | tfSponsorshipEnd;
+    if (std::popcount(ctx.tx.getFlags() & transferFlags) != 1)
+    {
+        JLOG(ctx.j.debug()) << "preflight: Only one SponsorshipTransfer flag can be set per tx.";
+        return temINVALID_FLAG;
+    }
+
+    if (ctx.tx.isFlag(tfSponsorshipCreate))
+    {
+        // Creating sponsorship transfers an unsponsored target from the sponsee
+        // to a reserve sponsor identified by sfSponsor + spfSponsorReserve.
+        if (!ctx.tx.isFieldPresent(sfSponsor))
+        {
+            JLOG(ctx.j.debug()) << "preflight: sfSponsor must be present when creating sponsorship";
+            return temMALFORMED;
+        }
+
+        if (!isReserveSponsored(ctx.tx))
+        {
+            JLOG(ctx.j.debug())
+                << "preflight: spfSponsorReserve must be set when creating sponsorship";
+            return temINVALID_FLAG;
+        }
+
+        if (ctx.tx.isFieldPresent(sfSponsee))
+        {
+            JLOG(ctx.j.debug())
+                << "preflight: sfSponsee must not be present when creating sponsorship";
+            return temMALFORMED;
+        }
+    }
+
+    if (ctx.tx.isFlag(tfSponsorshipReassign))
+    {
+        // Reassigning sponsorship transfers an already sponsored target from its
+        // current reserve sponsor to the new sponsor identified by sfSponsor +
+        // spfSponsorReserve.
+        if (!ctx.tx.isFieldPresent(sfSponsor))
+        {
+            JLOG(ctx.j.debug())
+                << "preflight: sfSponsor must be present when reassigning sponsorship";
+            return temMALFORMED;
+        }
+
+        if (!isReserveSponsored(ctx.tx))
+        {
+            JLOG(ctx.j.debug())
+                << "preflight: spfSponsorReserve must be set when reassigning sponsorship";
+            return temINVALID_FLAG;
+        }
+        if (ctx.tx.isFieldPresent(sfSponsee))
+        {
+            JLOG(ctx.j.debug())
+                << "preflight: sfSponsee must not be present when reassigning sponsorship";
+            return temMALFORMED;
+        }
+    }
+
+    if (ctx.tx.isFlag(tfSponsorshipEnd))
+    {
+        // Ending sponsorship removes reserve sponsorship from a sponsored target.
+        // The target is sfSponsee when provided; otherwise it is sfAccount.
+        if (ctx.tx.isFieldPresent(sfSponsor))
+        {
+            JLOG(ctx.j.debug())
+                << "preflight: sfSponsor must not be present when ending sponsorship";
+            return temMALFORMED;
+        }
+
+        // sfSponsorFlags should not be present if it is ending sponsorship.
+        if (ctx.tx.isFieldPresent(sfSponsorFlags))
+        {
+            // Unreachable: reaching here means sfSponsor is absent, which is already checked above,
+            // and preflight1Sponsor already rejects sfSponsorFlags present without sfSponsor with
+            // temINVALID_FLAG. Keep this as a defensive check.
+            // LCOV_EXCL_START
+            UNREACHABLE(
+                "xrpl::SponsorshipTransfer::preflight : sfSponsorFlags present without sfSponsor "
+                "when ending sponsorship");
+            return temINVALID_FLAG;
+            // LCOV_EXCL_STOP
+        }
+
+        if (ctx.tx.isFieldPresent(sfSponsee) &&
+            ctx.tx.getAccountID(sfSponsee) == ctx.tx.getAccountID(sfAccount))
+        {
+            JLOG(ctx.j.debug()) << "preflight: sfSponsee should not be the same as the account";
+            return temMALFORMED;
+        }
+    }
+
+    // Account-level reserve sponsorship changes the reserve responsibility for
+    // the account itself, so the new sponsor must explicitly co-sign. Object-level
+    // sponsorship may use pre-funded reserve sponsorship instead.
+    bool const isCreateOrReassign =
+        ctx.tx.isFlag(tfSponsorshipCreate) || ctx.tx.isFlag(tfSponsorshipReassign);
+    auto const reserveSponsor = getTxReserveSponsorID(ctx.tx);
+    bool const isAccountReserveSponsorship =
+        isCreateOrReassign && reserveSponsor && !ctx.tx.isFieldPresent(sfObjectID);
+
+    if (isAccountReserveSponsorship && !ctx.tx.isFieldPresent(sfSponsorSignature))
+    {
+        JLOG(ctx.j.debug()) << "preflight: account sponsorship requires sfSponsorSignature";
+        return temMALFORMED;
+    }
+
+    return tesSUCCESS;
+}
+
+TER
+SponsorshipTransfer::preclaim(PreclaimContext const& ctx)
+{
+    auto const objectID = ctx.tx[~sfObjectID];
+    auto const newSponsorSleExpected = getTxReserveSponsor(ctx.view, ctx.tx);
+    if (!newSponsorSleExpected)
+        return newSponsorSleExpected.error();  // LCOV_EXCL_LINE
+    auto const newSponsorSle = *newSponsorSleExpected;
+
+    auto const account = ctx.tx[sfAccount];
+    auto const sponseeID = ctx.tx[~sfSponsee].value_or(account);
+    auto const sponseeSle = ctx.view.read(keylet::account(sponseeID));
+    if (!sponseeSle)
+    {
+        // If it is ending sponsorship, sfSponsee is user input, return terNO_ACCOUNT if it does not
+        // exist.
+        if (ctx.tx.isFieldPresent(sfSponsee))
+            return terNO_ACCOUNT;
+
+        // If it is creating or reassigning sponsorship, sfSponsee is the account itself, which is
+        // always present by the time preclaim runs. Return tecINTERNAL if it does not exist.
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    // Default setup with an account sponsorship transfer. If it is an object transfer, they will be
+    // overridden to the object SLE and its type-specific sponsor field:
+    // sfHighSponsor/sfLowSponsor for a RippleState, sfSponsor for other object types.
+    SLE::const_pointer targetSle = sponseeSle;
+    auto const* sponsorField = &sfSponsor;
+
+    if (objectID.has_value())
+    {
+        auto const objectSle = ctx.view.read(keylet::unchecked(*objectID));
+        if (!objectSle)
+            return tecNO_ENTRY;
+
+        if (!isLedgerEntrySupportedBySponsorship(*objectSle))
+            return tecNO_PERMISSION;
+
+        if (!isLedgerEntryOwner(ctx.view, *objectSle, sponseeID))
+            return tecNO_PERMISSION;
+
+        // Object transfer: the target is the object, and its sponsor field
+        // depends on the object type, a RippleState stores the sponsor in
+        // sfHighSponsor/sfLowSponsor, while other object type uses sfSponsor.
+        targetSle = objectSle;
+        sponsorField = &getLedgerEntrySponsorField(*objectSle, sponseeID);
+    }
+
+    bool const isSponsored = targetSle->isFieldPresent(*sponsorField);
+
+    if (ctx.tx.isFlag(tfSponsorshipCreate))
+    {
+        // Creating a new sponsorship: needs a new reserve sponsor, and the
+        // target must not already be sponsored
+        if (!newSponsorSle || isSponsored)
+            return tecNO_PERMISSION;
+    }
+    else if (ctx.tx.isFlag(tfSponsorshipReassign))
+    {
+        // Reassigning sponsorship: needs a new reserve sponsor, and the target must already
+        // be sponsored
+        if (!newSponsorSle || !isSponsored)
+            return tecNO_PERMISSION;
+
+        // Reassigning to the current sponsor would change no state, but would
+        // still draw down the sponsor's pre-funded reserve budget (and its
+        // reserve headroom would be double-counted in checkReserve).
+        if (targetSle->getAccountID(*sponsorField) == ctx.tx.getAccountID(sfSponsor))
+            return tecNO_PERMISSION;
+    }
+    else if (ctx.tx.isFlag(tfSponsorshipEnd))
+    {
+        // Ending sponsorship: no new reserve sponsor, the target must be sponsored.
+        if (newSponsorSle || !isSponsored)
+            return tecNO_PERMISSION;
+
+        // Only the sponsor or sponsee can end sponsorship.
+        auto const sponsor = targetSle->getAccountID(*sponsorField);
+        if (account != sponsor && account != sponseeID)
+            return tecNO_PERMISSION;
+    }
+
+    return tesSUCCESS;
+}
+
+TER
+SponsorshipTransfer::doApply()
+{
+    auto const objectID = ctx_.tx[~sfObjectID];
+
+    auto const sponseeID = ctx_.tx[~sfSponsee].value_or(accountID_);
+    auto const sponseeSle = view().peek(keylet::account(sponseeID));
+    if (!sponseeSle)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const balanceBeforeFee = [&](SLE::const_ref sle) -> XRPAmount {
+        if (sle->getAccountID(sfAccount) == accountID_)
+            return preFeeBalance_;
+        return sle->getFieldAmount(sfBalance).xrp();
+    };
+
+    bool const isCreate = ctx_.tx.isFlag(tfSponsorshipCreate);
+    bool const isReassign = ctx_.tx.isFlag(tfSponsorshipReassign);
+
+    if (objectID.has_value())
+    {
+        // Transfer object sponsor
+        auto const objectSle = view().peek(keylet::unchecked(*objectID));
+        if (!objectSle)
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+
+        // preclaim established that the sponsee owns the object.
+        if (!isLedgerEntryOwner(view(), *objectSle, sponseeID))
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const ownerSle = view().peek(keylet::account(sponseeID));
+        if (!ownerSle)
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const ownerCountDelta =
+            static_cast<std::int32_t>(getLedgerEntryOwnerCount(*objectSle));
+        auto const& sponsorField = getLedgerEntrySponsorField(*objectSle, sponseeID);
+
+        if (isCreate || isReassign)
+        {
+            auto const newSponsor = ctx_.tx[~sfSponsor];
+            XRPL_ASSERT(
+                newSponsor.has_value(),
+                "xrpl::SponsorshipTransfer::doApply : sfSponsor present for object sponsor "
+                "create/reassign");
+            if (!newSponsor)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+            auto const newSponsorID = *newSponsor;
+            auto const newSponsorSle = view().peek(keylet::account(newSponsorID));
+            if (!newSponsorSle)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+
+            // Check if new sponsor has sufficient balance
+            // NOLINTNEXTLINE(readability-suspicious-call-argument)
+            if (auto const ter = checkReserve(
+                    ctx_.getApplyViewContext(),
+                    sponseeSle,
+                    sponseeSle->getFieldAmount(sfBalance).xrp(),
+                    newSponsorSle,
+                    {.ownerCountDelta = ownerCountDelta},
+                    ctx_.journal);
+                !isTesSuccess(ter))
+                return ter;
+
+            if (isCreate)
+            {
+                // Update owner's sponsored count
+                if (auto const ter = incrementSponsorCount(
+                        view(), ownerSle, sfSponsoredOwnerCount, ownerCountDelta);
+                    !isTesSuccess(ter))
+                    return ter;  // LCOV_EXCL_LINE
+            }
+            else if (isReassign)
+            {
+                auto const oldSponsorID = objectSle->getAccountID(sponsorField);
+                if (!oldSponsorID)
+                    return tefINTERNAL;  // LCOV_EXCL_LINE
+                auto const oldSponsorSle = view().peek(keylet::account(oldSponsorID));
+                if (!oldSponsorSle)
+                    return tefINTERNAL;  // LCOV_EXCL_LINE
+
+                // Decrement old sponsor's sponsoring count
+                if (auto const ter = decrementSponsorCount(
+                        view(), oldSponsorSle, sfSponsoringOwnerCount, ownerCountDelta);
+                    !isTesSuccess(ter))
+                    return ter;  // LCOV_EXCL_LINE
+            }
+
+            // Increment new sponsor's sponsoring count
+            if (auto const ter = incrementSponsorCount(
+                    view(), newSponsorSle, sfSponsoringOwnerCount, ownerCountDelta);
+                !isTesSuccess(ter))
+                return ter;  // LCOV_EXCL_LINE
+
+            // Object is now sponsored by new sponsor
+            objectSle->setAccountID(sponsorField, newSponsorID);
+            view().update(objectSle);
+
+            auto const sponsorshipSle = view().peek(keylet::sponsorship(newSponsorID, sponseeID));
+            if (sponsorshipSle)
+            {
+                // Update ReserveCount for sponsorship object if it exists
+                if (auto const ter =
+                        decrementPrefundedReserveCount(view(), sponsorshipSle, ownerCountDelta);
+                    !isTesSuccess(ter))
+                    return ter;  // LCOV_EXCL_LINE
+            }
+        }
+        else if (ctx_.tx.isFlag(tfSponsorshipEnd))
+        {
+            // End object sponsor
+            auto const oldSponsorID = objectSle->getAccountID(sponsorField);
+            if (!oldSponsorID)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+            auto const oldSponsorSle = view().peek(keylet::account(oldSponsorID));
+            if (!oldSponsorSle)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+
+            // The owner reclaims the reserve burden when the object is no longer sponsored.
+            // We do not check the sponsee's reserve here (via `checkReserve`) so that a sponsor can
+            // always end a sponsorship, even if the sponsee lacks sufficient reserve.
+
+            // Decrement sponsored count
+            if (auto const ter = decrementSponsorCount(
+                    view(), sponseeSle, sfSponsoredOwnerCount, ownerCountDelta);
+                !isTesSuccess(ter))
+                return ter;  // LCOV_EXCL_LINE
+
+            // Decrement old sponsoring count
+            if (auto const ter = decrementSponsorCount(
+                    view(), oldSponsorSle, sfSponsoringOwnerCount, ownerCountDelta);
+                !isTesSuccess(ter))
+                return ter;  // LCOV_EXCL_LINE
+
+            // Remove sponsor from object
+            objectSle->makeFieldAbsent(sponsorField);
+            view().update(objectSle);
+        }
+    }
+    else
+    {
+        // Account-level sponsorship is always co-signed (preflight requires
+        // sfSponsorSignature), so there is no pre-funded budget to draw down here.
+        if (isCreate || isReassign)
+        {
+            auto const newSponsor = ctx_.tx[~sfSponsor];
+            XRPL_ASSERT(
+                newSponsor.has_value(),
+                "xrpl::SponsorshipTransfer::doApply : sfSponsor present for account sponsor "
+                "create/reassign");
+            if (!newSponsor)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+            auto const newSponsorID = *newSponsor;
+            auto const newSponsorSle = view().peek(keylet::account(newSponsorID));
+            if (!newSponsorSle)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+
+            if (auto const ter = checkReserve(
+                    ctx_.getApplyViewContext(),
+                    sponseeSle,
+                    sponseeSle->getFieldAmount(sfBalance).xrp(),
+                    newSponsorSle,
+                    {.accountCountDelta = 1},
+                    ctx_.journal);
+                !isTesSuccess(ter))
+                return ter;
+
+            if (isReassign)
+            {
+                auto const oldSponsorID = sponseeSle->getAccountID(sfSponsor);
+                if (!oldSponsorID)
+                    return tefINTERNAL;  // LCOV_EXCL_LINE
+                auto const oldSponsorSle = view().peek(keylet::account(oldSponsorID));
+                if (!oldSponsorSle)
+                    return tefINTERNAL;  // LCOV_EXCL_LINE
+
+                // Decrement old sponsoring count
+                if (auto const ter =
+                        decrementSponsorCount(view(), oldSponsorSle, sfSponsoringAccountCount, 1);
+                    !isTesSuccess(ter))
+                    return ter;  // LCOV_EXCL_LINE
+            }
+
+            // Increment new sponsoring count
+            if (auto const ter =
+                    incrementSponsorCount(view(), newSponsorSle, sfSponsoringAccountCount, 1);
+                !isTesSuccess(ter))
+                return ter;  // LCOV_EXCL_LINE
+
+            // Account is now sponsored by new sponsor
+            sponseeSle->setAccountID(sfSponsor, newSponsorID);
+            view().update(sponseeSle);
+        }
+        else if (ctx_.tx.isFlag(tfSponsorshipEnd))
+        {
+            // End account sponsor
+            auto const oldSponsorID = sponseeSle->getAccountID(sfSponsor);
+            if (!oldSponsorID)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+            auto const oldSponsorSle = view().peek(keylet::account(oldSponsorID));
+            if (!oldSponsorSle)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+
+            // The sponsee must be able to hold its own account reserve after
+            // the sponsorship is removed.
+            if (auto const ter = checkReserve(
+                    ctx_.getApplyViewContext(),
+                    sponseeSle,
+                    balanceBeforeFee(sponseeSle),
+                    SLE::pointer(),
+                    {.accountCountDelta = 1},
+                    ctx_.journal);
+                !isTesSuccess(ter))
+                return ter;
+
+            sponseeSle->makeFieldAbsent(sfSponsor);
+            view().update(sponseeSle);
+
+            // Decrement account sponsoring count
+            if (auto const ter =
+                    decrementSponsorCount(view(), oldSponsorSle, sfSponsoringAccountCount, 1);
+                !isTesSuccess(ter))
+                return ter;  // LCOV_EXCL_LINE
+        }
+    }
+
+    return tesSUCCESS;
+}
+
+void
+SponsorshipTransfer::visitInvariantEntry(bool, SLE::const_ref, SLE::const_ref)
+{
+}
+
+bool
+SponsorshipTransfer::finalizeInvariants(
+    STTx const&,
+    TER,
+    XRPAmount,
+    ReadView const&,
+    beast::Journal const&)
+{
+    return true;
+}
+
+}  // namespace xrpl
diff --git a/src/libxrpl/tx/transactors/system/Batch.cpp b/src/libxrpl/tx/transactors/system/Batch.cpp
index ba54c14b1e..dee465cb88 100644
--- a/src/libxrpl/tx/transactors/system/Batch.cpp
+++ b/src/libxrpl/tx/transactors/system/Batch.cpp
@@ -7,6 +7,7 @@
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
@@ -227,6 +228,16 @@ Batch::preflight(PreflightContext const& ctx)
         return temINVALID_FLAG;
     }
 
+    if (ctx.tx.isFieldPresent(sfSponsorFlags))
+    {
+        if (isReserveSponsored(ctx.tx))
+        {
+            JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]:"
+                                << "spfSponsorReserve is not allowed on outer Batch.";
+            return temINVALID_FLAG;
+        }
+    }
+
     auto const& rawTxns = ctx.tx.getFieldArray(sfRawTransactions);
     if (rawTxns.size() <= 1)
     {
@@ -331,6 +342,14 @@ Batch::preflight(PreflightContext const& ctx)
                 return ret;
             }
         }
+        if (stx.isFieldPresent(sfSponsorSignature))
+        {
+            auto const sponsorSignature = stx.getFieldObject(sfSponsorSignature);
+            if (auto const ret = checkSignatureFields(sponsorSignature, hash, "sponsor signature "))
+            {
+                return ret;
+            }
+        }
 
         // Check that the Fee is native asset (XRP) and zero
         if (auto const fee = stx.getFieldAmount(sfFee); !fee.native() || fee.xrp() != beast::kZero)
@@ -341,6 +360,10 @@ Batch::preflight(PreflightContext const& ctx)
             return temBAD_FEE;
         }
 
+        // Disallow fee sponsorship on Batch inner txs
+        if (stx.isFieldPresent(sfSponsor) && isFeeSponsored(stx))
+            return temINVALID_FLAG;
+
         auto const innerAccount = stx.getAccountID(sfAccount);
         if (auto const preflightResult =
                 xrpl::preflight(ctx.registry, ctx.rules, parentBatchId, stx, TapBatch, ctx.j);
@@ -422,7 +445,7 @@ Batch::preflightSigValidated(PreflightContext const& ctx)
     {
         // A delegated inner is signed by the delegate, not the account holder,
         // so the delegate is the required signer when present.
-        AccountID const authorizer = rb.getFeePayer();
+        AccountID const authorizer = rb.getInitiator();
 
         // The outer account signs the batch itself, so it is never added to the
         // required signers.
@@ -433,6 +456,10 @@ Batch::preflightSigValidated(PreflightContext const& ctx)
         if (auto const counterparty = rb[~sfCounterparty];
             counterparty && counterparty != outerAccount)
             requiredSigners.push_back(*counterparty);
+
+        if (auto const sponsor = rb.at(~sfSponsor);
+            sponsor && rb.isFieldPresent(sfSponsorSignature) && sponsor != outerAccount)
+            requiredSigners.push_back(*sponsor);
     }
     std::ranges::sort(requiredSigners);
     auto const dupes = std::ranges::unique(requiredSigners);
diff --git a/src/libxrpl/tx/transactors/system/TicketCreate.cpp b/src/libxrpl/tx/transactors/system/TicketCreate.cpp
index 73a72c217d..e19dc9fe96 100644
--- a/src/libxrpl/tx/transactors/system/TicketCreate.cpp
+++ b/src/libxrpl/tx/transactors/system/TicketCreate.cpp
@@ -75,13 +75,12 @@ TicketCreate::doApply()
     // check the starting balance because we want to allow dipping into the
     // reserve to pay fees.
     std::uint32_t const ticketCount = ctx_.tx[sfTicketCount];
-    {
-        XRPAmount const reserve =
-            view().fees().accountReserve(sleAccountRoot->getFieldU32(sfOwnerCount) + ticketCount);
-
-        if (preFeeBalance_ < reserve)
-            return tecINSUFFICIENT_RESERVE;
-    }
+    if (preFeeBalance_ < accountReserve(
+                             view(),
+                             sleAccountRoot,
+                             j_,
+                             {.ownerCountDelta = static_cast<std::int32_t>(ticketCount)}))
+        return tecINSUFFICIENT_RESERVE;
 
     beast::Journal const viewJ{ctx_.registry.get().getJournal("View")};
 
@@ -105,6 +104,7 @@ TicketCreate::doApply()
 
         sleTicket->setAccountID(sfAccount, accountID_);
         sleTicket->setFieldU32(sfTicketSequence, curTicketSeq);
+
         view().insert(sleTicket);
 
         auto const page = view().dirInsert(
@@ -125,7 +125,7 @@ TicketCreate::doApply()
     sleAccountRoot->setFieldU32(sfTicketCount, oldTicketCount + ticketCount);
 
     // Every added Ticket counts against the creator's reserve.
-    adjustOwnerCount(view(), sleAccountRoot, ticketCount, viewJ);
+    increaseOwnerCount(view(), sleAccountRoot, {}, ticketCount, viewJ);
 
     // TicketCreate is the only transaction that can cause an account root's
     // Sequence field to increase by more than one.  October 2018.
diff --git a/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp b/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
index 6db37515cb..0aeb6f33d1 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenAuthorize.cpp
@@ -164,7 +164,7 @@ MPTokenAuthorize::doApply()
 {
     auto const& tx = ctx_.tx;
     return authorizeMPToken(
-        ctx_.view(),
+        ctx_.getApplyViewContext(),
         preFeeBalance_,
         tx[sfMPTokenIssuanceID],
         accountID_,
diff --git a/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp b/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
index e30127b688..aad1642f68 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenIssuanceCreate.cpp
@@ -7,6 +7,7 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
@@ -113,22 +114,35 @@ MPTokenIssuanceCreate::preflight(PreflightContext const& ctx)
 }
 
 std::expected<MPTID, TER>
-MPTokenIssuanceCreate::create(ApplyView& view, beast::Journal journal, MPTCreateArgs const& args)
+MPTokenIssuanceCreate::create(
+    ApplyViewContext ctx,
+    beast::Journal journal,
+    MPTCreateArgs const& args)
 {
-    auto const acct = view.peek(keylet::account(args.account));
+    auto const acct = ctx.view.peek(keylet::account(args.account));
     if (!acct)
         return std::unexpected(tecINTERNAL);  // LCOV_EXCL_LINE
 
-    if (args.priorBalance &&
-        *(args.priorBalance) < view.fees().accountReserve((*acct)[sfOwnerCount] + 1))
-        return std::unexpected(tecINSUFFICIENT_RESERVE);
+    // A reserve sponsor only covers tx.Account's own objects.
+    auto const sponsorExp = getEffectiveTxReserveSponsor(ctx, acct);
+    if (!sponsorExp)
+        return std::unexpected(sponsorExp.error());  // LCOV_EXCL_LINE
+    auto const sponsorSle = *sponsorExp;
+
+    if (args.priorBalance)
+    {
+        if (auto const ret = checkReserve(
+                ctx, acct, *(args.priorBalance), sponsorSle, {.ownerCountDelta = 1}, journal);
+            !isTesSuccess(ret))
+            return std::unexpected(ret);
+    }
 
     auto const mptId = makeMptID(args.sequence, args.account);
     auto const mptIssuanceKeylet = keylet::mptokenIssuance(mptId);
 
     // create the MPTokenIssuance
     {
-        auto const ownerNode = view.dirInsert(
+        auto const ownerNode = ctx.view.dirInsert(
             keylet::ownerDir(args.account), mptIssuanceKeylet, describeOwnerDir(args.account));
 
         if (!ownerNode)
@@ -166,7 +180,7 @@ MPTokenIssuanceCreate::create(ApplyView& view, beast::Journal journal, MPTCreate
             // populate this after the pseudo-account's MPToken /
             // RippleState has been installed. A missing holding here
             // would dangle the pointer and is a programmer error.
-            auto const sleHolding = view.read(keylet::unchecked(*args.referenceHolding));
+            auto const sleHolding = ctx.view.read(keylet::unchecked(*args.referenceHolding));
             if (!sleHolding)
                 return std::unexpected(tecINTERNAL);  // LCOV_EXCL_LINE
             auto const type = sleHolding->getType();
@@ -175,11 +189,13 @@ MPTokenIssuanceCreate::create(ApplyView& view, beast::Journal journal, MPTCreate
             (*mptIssuance)[sfReferenceHolding] = *args.referenceHolding;
         }
 
-        view.insert(mptIssuance);
+        addSponsorToLedgerEntry(mptIssuance, sponsorSle);
+
+        ctx.view.insert(mptIssuance);
     }
 
     // Update owner count.
-    adjustOwnerCount(view, acct, 1, journal);
+    increaseOwnerCount(ctx.view, acct, sponsorSle, 1, journal);
 
     return mptId;
 }
@@ -189,7 +205,7 @@ MPTokenIssuanceCreate::doApply()
 {
     auto const& tx = ctx_.tx;
     auto const result = create(
-        view(),
+        ctx_.getApplyViewContext(),
         j_,
         {
             .priorBalance = preFeeBalance_,
diff --git a/src/libxrpl/tx/transactors/token/MPTokenIssuanceDestroy.cpp b/src/libxrpl/tx/transactors/token/MPTokenIssuanceDestroy.cpp
index c56697767b..05d39c3596 100644
--- a/src/libxrpl/tx/transactors/token/MPTokenIssuanceDestroy.cpp
+++ b/src/libxrpl/tx/transactors/token/MPTokenIssuanceDestroy.cpp
@@ -49,10 +49,9 @@ MPTokenIssuanceDestroy::doApply()
     if (!view().dirRemove(keylet::ownerDir(accountID_), (*mpt)[sfOwnerNode], mpt->key(), false))
         return tefBAD_LEDGER;  // LCOV_EXCL_LINE
 
+    decreaseOwnerCountForObject(view(), accountID_, mpt, 1, j_);
     view().erase(mpt);
 
-    adjustOwnerCount(view(), view().peek(keylet::account(accountID_)), -1, j_);
-
     return tesSUCCESS;
 }
 
diff --git a/src/libxrpl/tx/transactors/token/TrustSet.cpp b/src/libxrpl/tx/transactors/token/TrustSet.cpp
index e79e3cad5a..3d078ce825 100644
--- a/src/libxrpl/tx/transactors/token/TrustSet.cpp
+++ b/src/libxrpl/tx/transactors/token/TrustSet.cpp
@@ -7,6 +7,7 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AMMCore.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
@@ -297,8 +298,6 @@ TrustSet::doApply()
     if (!sle)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
-    std::uint32_t const uOwnerCount = sle->getFieldU32(sfOwnerCount);
-
     // The reserve that is required to create the line. Note
     // that although the reserve increases with every item
     // an account owns, in the case of trust lines we only
@@ -317,9 +316,23 @@ TrustSet::doApply()
     // well. A person with no intention of using the gateway
     // could use the extra XRP for their own purposes.
 
+    auto const sponsorExp = getTxReserveSponsor(ctx_.getApplyViewContext());
+    if (!sponsorExp)
+        return sponsorExp.error();  // LCOV_EXCL_LINE
+    auto const sponsorSle = *sponsorExp;
+
+    auto getSponsor = [&sponsorSle, this](AccountID const& account) {
+        return (sponsorSle && account == accountID_) ? sponsorSle : SLE::pointer();
+    };
+
+    // The "free-tier" shortcut (ownerCount < 2) only applies when there is no sponsor.
+    // With any sponsor on the tx, the sponsor must cover the reserve (via balance or
+    // prefunded budget), so the reserve check always runs.
+    bool const freeTrustLine = !sponsorSle && (ownerCount(sle, j_) < 2);
+    std::uint32_t const uOwnerCount = ownerCount(sle, j_);
     XRPAmount const reserveCreate(
         (uOwnerCount < 2) ? XRPAmount(beast::kZero)
-                          : view().fees().accountReserve(uOwnerCount + 1));
+                          : accountReserve(view(), sle, j_, {.ownerCountDelta = 1}));
 
     std::uint32_t const uQualityIn(bQualityIn ? ctx_.tx.getFieldU32(sfQualityIn) : 0);
     std::uint32_t uQualityOut(bQualityOut ? ctx_.tx.getFieldU32(sfQualityOut) : 0);
@@ -505,6 +518,11 @@ TrustSet::doApply()
 
         bool bReserveIncrease = false;
 
+        auto const currentHighSponsor =
+            getLedgerEntryReserveSponsor(view(), sleRippleState, sfHighSponsor);
+        auto const currentLowSponsor =
+            getLedgerEntryReserveSponsor(view(), sleRippleState, sfLowSponsor);
+
         if (bSetAuth)
         {
             uFlagsOut |= (bHigh ? lsfHighAuth : lsfLowAuth);
@@ -512,10 +530,30 @@ TrustSet::doApply()
 
         if (bLowReserveSet && !bLowReserved)
         {
+            SLE::pointer const lowSponsor = getSponsor(uLowAccountID);
+
+            if (view().rules().enabled(featureSponsor))
+            {
+                if (auto const ret = checkReserve(
+                        ctx_.getApplyViewContext(),
+                        sleLowAccount,
+                        preFeeBalance_,
+                        lowSponsor,
+                        {.ownerCountDelta = 1},
+                        j_,
+                        tecINSUF_RESERVE_LINE);
+                    lowSponsor && !isTesSuccess(ret))
+                {
+                    return ret;
+                }
+            }
+
             // Set reserve for low account.
-            adjustOwnerCount(view(), sleLowAccount, 1, viewJ);
+            increaseOwnerCount(view(), sleLowAccount, lowSponsor, 1, viewJ);
             uFlagsOut |= lsfLowReserve;
 
+            addSponsorToLedgerEntry(sleRippleState, lowSponsor, sfLowSponsor);
+
             if (!bHigh)
                 bReserveIncrease = true;
         }
@@ -523,16 +561,41 @@ TrustSet::doApply()
         if (bLowReserveClear && bLowReserved)
         {
             // Clear reserve for low account.
-            adjustOwnerCount(view(), sleLowAccount, -1, viewJ);
+            decreaseOwnerCount(view(), sleLowAccount, currentLowSponsor, 1, viewJ);
             uFlagsOut &= ~lsfLowReserve;
+
+            removeSponsorFromLedgerEntry(sleRippleState, sfLowSponsor);
         }
 
         if (bHighReserveSet && !bHighReserved)
         {
+            SLE::pointer const highSponsor = getSponsor(uHighAccountID);
+
+            // should be checked PreFunded Sponsor before increaseOwnerCount()
+            // For PreFunded sponsors, we need to check if there are sufficient reserves before
+            // calling increaseOwnerCount().
+            if (view().rules().enabled(featureSponsor))
+            {
+                if (auto const ret = checkReserve(
+                        ctx_.getApplyViewContext(),
+                        sleHighAccount,
+                        preFeeBalance_,
+                        highSponsor,
+                        {.ownerCountDelta = 1},
+                        j_,
+                        tecINSUF_RESERVE_LINE);
+                    highSponsor && !isTesSuccess(ret))
+                {
+                    return ret;
+                }
+            }
+
             // Set reserve for high account.
-            adjustOwnerCount(view(), sleHighAccount, 1, viewJ);
+            increaseOwnerCount(view(), sleHighAccount, highSponsor, 1, viewJ);
             uFlagsOut |= lsfHighReserve;
 
+            addSponsorToLedgerEntry(sleRippleState, highSponsor, sfHighSponsor);
+
             if (bHigh)
                 bReserveIncrease = true;
         }
@@ -540,34 +603,75 @@ TrustSet::doApply()
         if (bHighReserveClear && bHighReserved)
         {
             // Clear reserve for high account.
-            adjustOwnerCount(view(), sleHighAccount, -1, viewJ);
+            decreaseOwnerCount(view(), sleHighAccount, currentHighSponsor, 1, viewJ);
             uFlagsOut &= ~lsfHighReserve;
+
+            removeSponsorFromLedgerEntry(sleRippleState, sfHighSponsor);
         }
 
         if (uFlagsIn != uFlagsOut)
             sleRippleState->setFieldU32(sfFlags, uFlagsOut);
 
-        if (bDefault || badCurrency() == currency)
+        if (view().rules().enabled(featureSponsor))
         {
-            // Delete.
+            if (bDefault || badCurrency() == currency)
+            {
+                // Delete.
 
-            terResult = trustDelete(view(), sleRippleState, uLowAccountID, uHighAccountID, viewJ);
-        }
-        // Reserve is not scaled by load.
-        else if (bReserveIncrease && preFeeBalance_ < reserveCreate)
-        {
-            JLOG(j_.trace()) << "Delay transaction: Insufficent reserve to "
-                                "add trust line.";
+                terResult =
+                    trustDelete(view(), sleRippleState, uLowAccountID, uHighAccountID, viewJ);
+            }
+            // Reserve is not scaled by load
+            else if (
+                auto const ret = checkReserve(
+                    ctx_.getApplyViewContext(),
+                    sle,
+                    preFeeBalance_,
+                    sponsorSle,
+                    {},
+                    j_,
+                    tecINSUF_RESERVE_LINE);
+                !freeTrustLine && bReserveIncrease && !isTesSuccess(ret))
+            {
+                JLOG(j_.trace()) << "Delay transaction: Insufficent reserve to "
+                                    "add trust line.";
 
-            // Another transaction could provide XRP to the account and then
-            // this transaction would succeed.
-            terResult = tecINSUF_RESERVE_LINE;
+                // Another transaction could provide XRP to the account and then
+                // this transaction would succeed.
+                terResult = ret;
+            }
+            else
+            {
+                view().update(sleRippleState);
+
+                JLOG(j_.trace()) << "Modify ripple line";
+            }
         }
         else
         {
-            view().update(sleRippleState);
+            if (bDefault || badCurrency() == currency)
+            {
+                // Delete.
 
-            JLOG(j_.trace()) << "Modify ripple line";
+                terResult =
+                    trustDelete(view(), sleRippleState, uLowAccountID, uHighAccountID, viewJ);
+            }
+            // Reserve is not scaled by load.
+            else if (bReserveIncrease && preFeeBalance_ < reserveCreate)
+            {
+                JLOG(j_.trace()) << "Delay transaction: Insufficent reserve to "
+                                    "add trust line.";
+
+                // Another transaction could provide XRP to the account and then
+                // this transaction would succeed.
+                terResult = tecINSUF_RESERVE_LINE;
+            }
+            else
+            {
+                view().update(sleRippleState);
+
+                JLOG(j_.trace()) << "Modify ripple line";
+            }
         }
     }
     // Line does not exist.
@@ -582,8 +686,8 @@ TrustSet::doApply()
         JLOG(j_.trace()) << "Redundant: Setting non-existent ripple line to defaults.";
         return tecNO_LINE_REDUNDANT;
     }
-    else if (preFeeBalance_ < reserveCreate)  // Reserve is not scaled by
-                                              // load.
+    // reserve is not scaled by load
+    else if (!view().rules().enabled(featureSponsor) && preFeeBalance_ < reserveCreate)
     {
         JLOG(j_.trace()) << "Delay transaction: Line does not exist. "
                             "Insufficent reserve to create line.";
@@ -592,6 +696,25 @@ TrustSet::doApply()
         // transaction would succeed.
         terResult = tecNO_LINE_INSUF_RESERVE;
     }
+    else if (
+        auto const ret = checkReserve(
+            ctx_.getApplyViewContext(),
+            sle,
+            preFeeBalance_,
+            sponsorSle,
+            {.ownerCountDelta = 1},
+            j_,
+            tecNO_LINE_INSUF_RESERVE);
+        view().rules().enabled(featureSponsor) && !freeTrustLine &&
+        !isTesSuccess(ret))  // Reserve is not scaled by load.
+    {
+        JLOG(j_.trace()) << "Delay transaction: Line does not exist. "
+                            "Insufficent reserve to create line.";
+
+        // Another transaction could create the account and then this
+        // transaction would succeed.
+        terResult = ret;
+    }
     else
     {
         // Zero balance in currency.
@@ -617,6 +740,7 @@ TrustSet::doApply()
             saLimitAllow,  // Limit for who is being charged.
             uQualityIn,
             uQualityOut,
+            sponsorSle,
             viewJ);
     }
 
diff --git a/src/libxrpl/tx/transactors/vault/VaultClawback.cpp b/src/libxrpl/tx/transactors/vault/VaultClawback.cpp
index 541660c98f..d77286b667 100644
--- a/src/libxrpl/tx/transactors/vault/VaultClawback.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultClawback.cpp
@@ -389,8 +389,8 @@ VaultClawback::doApply()
 
     auto const& vaultAccount = vault->at(sfAccount);
     // Transfer shares from holder to vault.
-    if (auto const ter =
-            accountSend(view(), holder, vaultAccount, sharesDestroyed, j_, WaiveTransferFee::Yes);
+    if (auto const ter = accountSend(
+            view(), holder, vaultAccount, sharesDestroyed, j_, {}, WaiveTransferFee::Yes);
         !isTesSuccess(ter))
         return ter;
 
@@ -399,7 +399,8 @@ VaultClawback::doApply()
     // Keep MPToken if holder is the vault owner.
     if (holder != vault->at(sfOwner))
     {
-        if (auto const ter = removeEmptyHolding(view(), holder, sharesDestroyed.asset(), j_);
+        if (auto const ter =
+                removeEmptyHolding(ctx_.getApplyViewContext(), holder, sharesDestroyed.asset(), j_);
             isTesSuccess(ter))
         {
             JLOG(j_.debug())  //
@@ -425,7 +426,7 @@ VaultClawback::doApply()
     {
         // Transfer assets from vault to issuer.
         if (auto const ter = accountSend(
-                view(), vaultAccount, accountID_, assetsRecovered, j_, WaiveTransferFee::Yes);
+                view(), vaultAccount, accountID_, assetsRecovered, j_, {}, WaiveTransferFee::Yes);
             !isTesSuccess(ter))
             return ter;
 
diff --git a/src/libxrpl/tx/transactors/vault/VaultCreate.cpp b/src/libxrpl/tx/transactors/vault/VaultCreate.cpp
index d262132b6f..e1f5873a89 100644
--- a/src/libxrpl/tx/transactors/vault/VaultCreate.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultCreate.cpp
@@ -146,6 +146,7 @@ VaultCreate::doApply()
     // we can consider downgrading them to `tef` or `tem`.
 
     auto const& tx = ctx_.tx;
+    auto applyViewContext = ctx_.getApplyViewContext();
     auto const sequence = tx.getSeqValue();
     auto const owner = view().peek(keylet::account(accountID_));
     if (owner == nullptr)
@@ -156,9 +157,8 @@ VaultCreate::doApply()
     if (auto ter = dirLink(view(), accountID_, vault))
         return ter;
     // We will create Vault and PseudoAccount, hence increase OwnerCount by 2
-    adjustOwnerCount(view(), owner, 2, j_);
-    auto const ownerCount = owner->at(sfOwnerCount);
-    if (preFeeBalance_ < view().fees().accountReserve(ownerCount))
+    increaseOwnerCount(view(), owner, {}, 2, j_);
+    if (preFeeBalance_ < accountReserve(view(), owner, j_))
         return tecINSUFFICIENT_RESERVE;
 
     auto maybePseudo = createPseudoAccount(view(), vault->key(), sfVaultID);
@@ -168,7 +168,8 @@ VaultCreate::doApply()
     AccountID const pseudoId = pseudo->at(sfAccount);
     auto const asset = tx[sfAsset];
 
-    if (auto ter = addEmptyHolding(view(), pseudoId, preFeeBalance_, asset, j_); !isTesSuccess(ter))
+    if (auto ter = addEmptyHolding(applyViewContext, pseudoId, preFeeBalance_, asset, j_);
+        !isTesSuccess(ter))
         return ter;
 
     std::uint8_t const scale = (asset.holds<MPTIssue>() || asset.native())
@@ -197,7 +198,7 @@ VaultCreate::doApply()
             : keylet::trustLine(pseudoId, asset.get<Issue>()).key;
     }();
     auto const maybeShare = MPTokenIssuanceCreate::create(
-        view(),
+        applyViewContext,
         j_,
         {
             .priorBalance = std::nullopt,
@@ -243,8 +244,8 @@ VaultCreate::doApply()
     view().insert(vault);
 
     // Explicitly create MPToken for the vault owner
-    if (auto const err =
-            authorizeMPToken(view(), preFeeBalance_, mptIssuanceID, accountID_, ctx_.journal);
+    if (auto const err = authorizeMPToken(
+            applyViewContext, preFeeBalance_, mptIssuanceID, accountID_, ctx_.journal);
         !isTesSuccess(err))
         return err;
 
@@ -252,7 +253,13 @@ VaultCreate::doApply()
     if (tx.isFlag(tfVaultPrivate))
     {
         if (auto const err = authorizeMPToken(
-                view(), preFeeBalance_, mptIssuanceID, pseudoId, ctx_.journal, {}, accountID_);
+                applyViewContext,
+                preFeeBalance_,
+                mptIssuanceID,
+                pseudoId,
+                ctx_.journal,
+                {},
+                accountID_);
             !isTesSuccess(err))
             return err;
     }
diff --git a/src/libxrpl/tx/transactors/vault/VaultDelete.cpp b/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
index fa38ae278b..497a2f2465 100644
--- a/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultDelete.cpp
@@ -96,13 +96,15 @@ TER
 VaultDelete::doApply()
 {
     auto const vault = view().peek(keylet::vault(ctx_.tx[sfVaultID]));
+    auto applyViewContext = ctx_.getApplyViewContext();
     if (!vault)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
     // Destroy the asset holding.
     auto asset = vault->at(sfAsset);
 
-    if (auto ter = removeEmptyHolding(view(), vault->at(sfAccount), asset, j_); !isTesSuccess(ter))
+    if (auto ter = removeEmptyHolding(applyViewContext, vault->at(sfAccount), asset, j_);
+        !isTesSuccess(ter))
         return ter;
 
     auto const& pseudoID = vault->at(sfAccount);
@@ -130,7 +132,8 @@ VaultDelete::doApply()
     // Try to remove MPToken for vault shares for the vault owner if it exists.
     if (auto const mptoken = view().peek(keylet::mptoken(shareMPTID, accountID_)))
     {
-        if (auto const ter = removeEmptyHolding(view(), accountID_, MPTIssue(shareMPTID), j_);
+        if (auto const ter =
+                removeEmptyHolding(applyViewContext, accountID_, MPTIssue(shareMPTID), j_);
             !isTesSuccess(ter))
         {
             // LCOV_EXCL_START
@@ -151,7 +154,7 @@ VaultDelete::doApply()
         return tefBAD_LEDGER;
         // LCOV_EXCL_STOP
     }
-    adjustOwnerCount(view(), pseudoAcct, -1, j_);
+    decreaseOwnerCountForObject(view(), pseudoAcct, mpt, 1, j_);
 
     view().erase(mpt);
 
@@ -210,7 +213,7 @@ VaultDelete::doApply()
     }
 
     // We are destroying Vault and PseudoAccount, hence decrease by 2
-    adjustOwnerCount(view(), owner, -2, j_);
+    decreaseOwnerCountForObject(view(), owner, vault, 2, j_);
 
     // Destroy the vault.
     view().erase(vault);
diff --git a/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp b/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
index d5eb80b84d..aa9cfc8537 100644
--- a/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultDeposit.cpp
@@ -23,6 +23,7 @@
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <optional>
 #include <stdexcept>
 
 namespace xrpl {
@@ -196,6 +197,7 @@ VaultDeposit::doApply()
 {
     bool const fix320Enabled = view().rules().enabled(fixCleanup3_2_0);
     auto const vault = view().peek(keylet::vault(ctx_.tx[sfVaultID]));
+    auto applyViewContext = ctx_.getApplyViewContext();
     if (!vault)
         return tefINTERNAL;  // LCOV_EXCL_LINE
     auto const vaultAsset = vault->at(sfAsset);
@@ -230,7 +232,7 @@ VaultDeposit::doApply()
     if (vault->isFlag(lsfVaultPrivate) && accountID_ != vault->at(sfOwner))
     {
         if (auto const err = enforceMPTokenAuthorization(
-                ctx_.view(), mptIssuanceID, accountID_, preFeeBalance_, j_);
+                applyViewContext, mptIssuanceID, accountID_, preFeeBalance_, j_);
             !isTesSuccess(err))
             return err;
     }
@@ -240,7 +242,11 @@ VaultDeposit::doApply()
         if (!view().exists(keylet::mptoken(mptIssuanceID, accountID_)))
         {
             if (auto const err = authorizeMPToken(
-                    view(), preFeeBalance_, mptIssuanceID->value(), accountID_, ctx_.journal);
+                    applyViewContext,
+                    preFeeBalance_,
+                    mptIssuanceID->value(),
+                    accountID_,
+                    ctx_.journal);
                 !isTesSuccess(err))
                 return err;
         }
@@ -252,7 +258,7 @@ VaultDeposit::doApply()
             XRPL_ASSERT(
                 accountID_ == vault->at(sfOwner), "xrpl::VaultDeposit::doApply : account is owner");
             if (auto const err = authorizeMPToken(
-                    view(),
+                    applyViewContext,
                     preFeeBalance_,             // priorBalance
                     mptIssuanceID->value(),     // mptIssuanceID
                     sleIssuance->at(sfIssuer),  // account
@@ -319,7 +325,7 @@ VaultDeposit::doApply()
 
     // Transfer assets from depositor to vault.
     if (auto const ter = accountSend(
-            view(), accountID_, vaultAccount, assetsDeposited, j_, WaiveTransferFee::Yes);
+            view(), accountID_, vaultAccount, assetsDeposited, j_, {}, WaiveTransferFee::Yes);
         !isTesSuccess(ter))
         return ter;
 
@@ -346,8 +352,8 @@ VaultDeposit::doApply()
     }
 
     // Transfer shares from vault to depositor.
-    if (auto const ter =
-            accountSend(view(), vaultAccount, accountID_, sharesCreated, j_, WaiveTransferFee::Yes);
+    if (auto const ter = accountSend(
+            view(), vaultAccount, accountID_, sharesCreated, j_, {}, WaiveTransferFee::Yes);
         !isTesSuccess(ter))
         return ter;
 
diff --git a/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp b/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
index ad91c55723..353b72c30d 100644
--- a/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/vault/VaultWithdraw.cpp
@@ -194,6 +194,7 @@ TER
 VaultWithdraw::doApply()
 {
     auto const vault = view().peek(keylet::vault(ctx_.tx[sfVaultID]));
+    auto applyViewContext = ctx_.getApplyViewContext();
     if (!vault)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 
@@ -349,9 +350,10 @@ VaultWithdraw::doApply()
     view().update(vault);
 
     auto const& vaultAccount = vault->at(sfAccount);
+
     // Transfer shares from depositor to vault.
     if (auto const ter = accountSend(
-            view(), accountID_, vaultAccount, sharesRedeemed, j_, WaiveTransferFee::Yes);
+            view(), accountID_, vaultAccount, sharesRedeemed, j_, {}, WaiveTransferFee::Yes);
         !isTesSuccess(ter))
         return ter;
 
@@ -360,7 +362,8 @@ VaultWithdraw::doApply()
     // Keep MPToken if holder is the vault owner.
     if (accountID_ != vault->at(sfOwner))
     {
-        if (auto const ter = removeEmptyHolding(view(), accountID_, sharesRedeemed.asset(), j_);
+        if (auto const ter =
+                removeEmptyHolding(applyViewContext, accountID_, sharesRedeemed.asset(), j_);
             isTesSuccess(ter))
         {
             JLOG(j_.debug())  //
@@ -386,7 +389,7 @@ VaultWithdraw::doApply()
 
     auto const dstAcct = ctx_.tx[~sfDestination].value_or(accountID_);
     return doWithdraw(
-        view(), ctx_.tx, accountID_, dstAcct, vaultAccount, preFeeBalance_, assetsWithdrawn, j_);
+        applyViewContext, accountID_, dstAcct, vaultAccount, preFeeBalance_, assetsWithdrawn, j_);
 }
 
 void
diff --git a/src/test/app/AMMExtendedMPT_test.cpp b/src/test/app/AMMExtendedMPT_test.cpp
index e6dcc95733..63b7841fba 100644
--- a/src/test/app/AMMExtendedMPT_test.cpp
+++ b/src/test/app/AMMExtendedMPT_test.cpp
@@ -463,7 +463,7 @@ private:
         // Provide micro amounts to compensate for fees to make results round
         // nice.
         auto const startingXrp =
-            XRP(100) + env.current()->fees().accountReserve(2) + env.current()->fees().base * 3;
+            XRP(100) + env.current()->fees().accountReserve(2, 1) + env.current()->fees().base * 3;
 
         env.fund(startingXrp, gw_, alice_);
         env.fund(XRP(2'000), bob_);
diff --git a/src/test/app/AMMExtended_test.cpp b/src/test/app/AMMExtended_test.cpp
index a0a7d0fb15..563bb3ca33 100644
--- a/src/test/app/AMMExtended_test.cpp
+++ b/src/test/app/AMMExtended_test.cpp
@@ -546,7 +546,7 @@ private:
         //  1 for each trust limit == 3 (alice_ < mtgox/amazon/bitstamp) +
         //  1 for payment          == 4
         auto const startingXrp =
-            XRP(100) + env.current()->fees().accountReserve(3) + env.current()->fees().base * 4;
+            XRP(100) + env.current()->fees().accountReserve(3, 1) + env.current()->fees().base * 4;
 
         env.fund(startingXrp, gw1, gw2, gw3, localAlice);
         env.fund(XRP(2'000), localBob);
diff --git a/src/test/app/AMMMPT_test.cpp b/src/test/app/AMMMPT_test.cpp
index 4877406ca1..bf0bc5c7d7 100644
--- a/src/test/app/AMMMPT_test.cpp
+++ b/src/test/app/AMMMPT_test.cpp
@@ -1002,7 +1002,7 @@ private:
 
         // Insufficient reserve, XRP/MPT
         {
-            Env env(*this);
+            Env env(*this, features);
             auto const startingXrp = reserve(env, 4) + env.current()->fees().base * 4;
             env.fund(XRP(10'000), gw_);
             env.fund(XRP(10'000), alice_);
diff --git a/src/test/app/AccountSet_test.cpp b/src/test/app/AccountSet_test.cpp
index 362113aec2..d94fb66e50 100644
--- a/src/test/app/AccountSet_test.cpp
+++ b/src/test/app/AccountSet_test.cpp
@@ -1,4 +1,3 @@
-
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
 #include <test/jtx/amount.h>
@@ -453,7 +452,7 @@ public:
 
                 // We'll insert a replacement for the account root
                 // with the higher (currently invalid) transfer rate.
-                auto replacement = std::make_shared<SLE>(*sle, sle->key());
+                auto replacement = std::make_shared<SLE>(*sle);
                 (*replacement)[sfTransferRate] =
                     static_cast<std::uint32_t>(transferRate * QUALITY_ONE);
                 view.rawReplace(replacement);
diff --git a/src/test/app/CheckMPT_test.cpp b/src/test/app/CheckMPT_test.cpp
index 861a115fc9..93e752154c 100644
--- a/src/test/app/CheckMPT_test.cpp
+++ b/src/test/app/CheckMPT_test.cpp
@@ -409,7 +409,7 @@ class CheckMPT_test : public beast::unit_test::Suite
 
         // Insufficient reserve.
         Account const cheri{"cheri"};
-        env.fund(env.current()->fees().accountReserve(1) - drops(1), cheri);
+        env.fund(env.current()->fees().accountReserve(1, 1) - drops(1), cheri);
 
         env(check::create(cheri, bob, usd(50)),
             Fee(drops(env.current()->fees().base)),
diff --git a/src/test/app/Check_test.cpp b/src/test/app/Check_test.cpp
index 3ad1e3fa4e..b19a9f6894 100644
--- a/src/test/app/Check_test.cpp
+++ b/src/test/app/Check_test.cpp
@@ -470,7 +470,7 @@ class Check_test : public beast::unit_test::Suite
 
         // Insufficient reserve.
         Account const cheri{"cheri"};
-        env.fund(env.current()->fees().accountReserve(1) - drops(1), cheri);
+        env.fund(env.current()->fees().accountReserve(1, 1) - drops(1), cheri);
         env.close();
 
         env(check::create(cheri, bob, usd(50)),
diff --git a/src/test/app/Credentials_test.cpp b/src/test/app/Credentials_test.cpp
index 456a53bc01..1f6ec012c8 100644
--- a/src/test/app/Credentials_test.cpp
+++ b/src/test/app/Credentials_test.cpp
@@ -638,8 +638,8 @@ struct Credentials_test : public beast::unit_test::Suite
         {
             Env env{*this, features};
 
-            env.fund(drops(env.current()->fees().accountReserve(1)), issuer);
-            env.fund(drops(env.current()->fees().accountReserve(0)), subject);
+            env.fund(drops(env.current()->fees().accountReserve(1, 1)), issuer);
+            env.fund(drops(env.current()->fees().accountReserve(0, 1)), subject);
             env.close();
 
             {
diff --git a/src/test/app/Delegate_test.cpp b/src/test/app/Delegate_test.cpp
index 6f1d2ce7de..257ed33619 100644
--- a/src/test/app/Delegate_test.cpp
+++ b/src/test/app/Delegate_test.cpp
@@ -275,7 +275,7 @@ class Delegate_test : public beast::unit_test::Suite
             Account const bob{"bob"};
 
             auto const txFee = env.current()->fees().base;
-            env.fund(env.current()->fees().accountReserve(0) + txFee, alice);
+            env.fund(env.current()->fees().accountReserve(0, 1) + txFee, alice);
             env.fund(XRP(100000), bob);
             env.close();
 
@@ -292,7 +292,7 @@ class Delegate_test : public beast::unit_test::Suite
 
             auto const txFee = env.current()->fees().base;
 
-            env.fund(env.current()->fees().accountReserve(1) + (txFee * 4), alice);
+            env.fund(env.current()->fees().accountReserve(1, 1) + (txFee * 4), alice);
             env.fund(XRP(100000), bob, carol);
             env.close();
 
@@ -318,8 +318,8 @@ class Delegate_test : public beast::unit_test::Suite
             Account const alice{"alice"};
             Account const bob{"bob"};
 
-            env.fund(drops(env.current()->fees().accountReserve(1)), alice);
-            env.fund(drops(env.current()->fees().accountReserve(2)), bob);
+            env.fund(drops(env.current()->fees().accountReserve(1, 1)), alice);
+            env.fund(drops(env.current()->fees().accountReserve(2, 1)), bob);
             env.close();
 
             // alice gives bob permission
@@ -422,7 +422,7 @@ class Delegate_test : public beast::unit_test::Suite
                 Account const carol{"carol"};
 
                 auto const baseFee = env.current()->fees().base;
-                auto const reserve = env.current()->fees().accountReserve(1);
+                auto const reserve = env.current()->fees().accountReserve(1, 1);
                 auto const paymentAmount = XRP(1);
                 auto const highFee = reserve + baseFee;
                 BEAST_EXPECT(highFee > reserve);
@@ -488,9 +488,9 @@ class Delegate_test : public beast::unit_test::Suite
             Account const carol{"carol"};
 
             auto const baseFee = env.current()->fees().base;
-            auto const baseReserve = env.current()->fees().accountReserve(0);
+            auto const baseReserve = env.current()->fees().accountReserve(0, 1);
 
-            env.fund(env.current()->fees().accountReserve(1) + baseFee + XRP(1), alice);
+            env.fund(env.current()->fees().accountReserve(1, 1) + baseFee + XRP(1), alice);
             env.fund(baseReserve, bob);
             env.fund(XRP(1000), carol);
             env.close();
@@ -523,7 +523,7 @@ class Delegate_test : public beast::unit_test::Suite
             Account const carol{"carol"};
 
             auto const baseFee = env.current()->fees().base;
-            auto const reserve = env.current()->fees().accountReserve(1);
+            auto const reserve = env.current()->fees().accountReserve(1, 1);
 
             // Alice is funded with (reserve + baseFee): after DelegateSet she has
             // exactly 'reserve', which is insufficient to send XRP(10) while keeping
@@ -2612,7 +2612,9 @@ class Delegate_test : public beast::unit_test::Suite
             {"CredentialDelete", featureCredentials},
             {"NFTokenModify", featureDynamicNFT},
             {"PermissionedDomainSet", featurePermissionedDomains},
-            {"PermissionedDomainDelete", featurePermissionedDomains}};
+            {"PermissionedDomainDelete", featurePermissionedDomains},
+            {"SponsorshipSet", featureSponsor},
+        };
 
         // Can not delegate tx if any required feature disabled.
         {
@@ -2747,7 +2749,7 @@ class Delegate_test : public beast::unit_test::Suite
         // DO NOT modify expectedDelegableCount unless all scenarios, including
         // edge cases, have been fully tested and verified.
         // ====================================================================
-        std::size_t const expectedDelegableCount = 56;
+        std::size_t const expectedDelegableCount = 57;
 
         BEAST_EXPECTS(
             delegableCount == expectedDelegableCount,
diff --git a/src/test/app/DepositAuth_test.cpp b/src/test/app/DepositAuth_test.cpp
index 3496e67b54..c75bdeaf3a 100644
--- a/src/test/app/DepositAuth_test.cpp
+++ b/src/test/app/DepositAuth_test.cpp
@@ -51,7 +51,7 @@ namespace xrpl::test {
 static XRPAmount
 reserve(jtx::Env& env, std::uint32_t count)
 {
-    return env.current()->fees().accountReserve(count);
+    return env.current()->fees().accountReserve(count, 1);
 }
 
 // Helper function that returns true if acct has the lsfDepositAuth flag set.
@@ -1025,7 +1025,7 @@ struct DepositPreauth_test : public beast::unit_test::Suite
             {
                 // not enough reserve
                 Account const john{"john"};
-                env.fund(env.current()->fees().accountReserve(0), john);
+                env.fund(env.current()->fees().accountReserve(0, 1), john);
                 env.close();
                 auto jv =
                     deposit::authCredentials(john, {{.issuer = issuer, .credType = credType}});
diff --git a/src/test/app/EscrowToken_test.cpp b/src/test/app/EscrowToken_test.cpp
index 666ee498bd..4015f5ddc8 100644
--- a/src/test/app/EscrowToken_test.cpp
+++ b/src/test/app/EscrowToken_test.cpp
@@ -937,7 +937,7 @@ struct EscrowToken_test : public beast::unit_test::Suite
 
             auto const expectedResult = env.current()->rules().enabled(fixCleanup3_2_0)
                 ? Ter(tesSUCCESS)
-                : Ter(tefEXCEPTION);
+                : Ter(tefINTERNAL);
             env(escrow::cancel(alice, alice, seq), Fee(baseFee), expectedResult);
             env.close();
 
diff --git a/src/test/app/FlowMPT_test.cpp b/src/test/app/FlowMPT_test.cpp
index 39d722da65..302e55a2cc 100644
--- a/src/test/app/FlowMPT_test.cpp
+++ b/src/test/app/FlowMPT_test.cpp
@@ -726,7 +726,7 @@ struct FlowMPT_test : public beast::unit_test::Suite
     static XRPAmount
     reserve(jtx::Env& env, std::uint32_t count)
     {
-        return env.current()->fees().accountReserve(count);
+        return env.current()->fees().accountReserve(count, 1);
     }
 
     // Helper function that returns the Offers on an account.
diff --git a/src/test/app/Flow_test.cpp b/src/test/app/Flow_test.cpp
index 72e39ab890..8d5162394e 100644
--- a/src/test/app/Flow_test.cpp
+++ b/src/test/app/Flow_test.cpp
@@ -706,7 +706,7 @@ struct Flow_test : public beast::unit_test::Suite
     static XRPAmount
     reserve(jtx::Env& env, std::uint32_t count)
     {
-        return env.current()->fees().accountReserve(count);
+        return env.current()->fees().accountReserve(count, 1);
     }
 
     // Helper function that returns the Offers on an account.
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 79fdbb54ed..b70d099ba4 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -337,7 +337,72 @@ class Invariants_test : public beast::unit_test::Suite
                 // check.
                 sleA1->at(sfBalance) = beast::kZero;
                 BEAST_EXPECT(sleA1->at(sfOwnerCount) == 0);
-                adjustOwnerCount(ac.view(), sleA1, 1, ac.journal);
+                increaseOwnerCount(ac.view(), sleA1, {}, 1, ac.journal);
+
+                ac.view().erase(sleA1);
+
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttACCOUNT_DELETE, [](STObject& tx) {}});
+
+        doInvariantCheck(
+            {{"account deletion left behind a sponsorship field"}},
+            [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto const sleA1 = ac.view().peek(keylet::account(a1.id()));
+                if (!sleA1)
+                    return false;
+                sleA1->at(sfBalance) = beast::kZero;
+                sleA1->setFieldU32(sfSponsoredOwnerCount, 1);
+
+                ac.view().erase(sleA1);
+
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttACCOUNT_DELETE, [](STObject& tx) {}});
+
+        doInvariantCheck(
+            {{"account deletion left behind a sponsorship field"}},
+            [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto const sleA1 = ac.view().peek(keylet::account(a1.id()));
+                if (!sleA1)
+                    return false;
+                sleA1->at(sfBalance) = beast::kZero;
+                sleA1->setFieldU32(sfSponsoringOwnerCount, 1);
+
+                ac.view().erase(sleA1);
+
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttACCOUNT_DELETE, [](STObject& tx) {}});
+
+        doInvariantCheck(
+            {{"account deletion left behind a sponsorship field"}},
+            [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto const a1Id = a1.id();
+                auto const sleA1 = ac.view().peek(keylet::account(a1Id));
+                if (!sleA1)
+                    return false;
+                sleA1->at(sfBalance) = beast::kZero;
+                sleA1->setFieldU32(sfSponsoringAccountCount, 1);
+
+                ac.view().erase(sleA1);
+
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttACCOUNT_DELETE, [](STObject& tx) {}});
+
+        doInvariantCheck(
+            {{"account deletion left behind a sponsorship field"}},
+            [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto const sleA1 = ac.view().peek(keylet::account(a1.id()));
+                if (!sleA1)
+                    return false;
+                sleA1->at(sfBalance) = beast::kZero;
+                sleA1->setAccountID(sfSponsor, a2.id());
 
                 ac.view().erase(sleA1);
 
@@ -1771,6 +1836,7 @@ class Invariants_test : public beast::unit_test::Suite
             "pseudo-account sequence changed"
             "pseudo-account flags are not set"
             "pseudo-account has a regular key"
+            "pseudo-account has a sponsorship field"
         */
         struct Mod
         {
@@ -1798,6 +1864,22 @@ class Invariants_test : public beast::unit_test::Suite
                 .expectedFailure = "pseudo-account has a regular key",
                 .func = [](SLE::pointer& sle) { sle->at(sfRegularKey) = Account("regular").id(); },
             },
+            {
+                .expectedFailure = "pseudo-account has a sponsorship field",
+                .func = [](SLE::pointer& sle) { sle->at(sfSponsoredOwnerCount) = 1; },
+            },
+            {
+                .expectedFailure = "pseudo-account has a sponsorship field",
+                .func = [](SLE::pointer& sle) { sle->at(sfSponsoringOwnerCount) = 1; },
+            },
+            {
+                .expectedFailure = "pseudo-account has a sponsorship field",
+                .func = [](SLE::pointer& sle) { sle->at(sfSponsoringAccountCount) = 1; },
+            },
+            {
+                .expectedFailure = "pseudo-account has a sponsorship field",
+                .func = [](SLE::pointer& sle) { sle->at(sfSponsor) = Account("sponsor").id(); },
+            },
         });
 
         for (auto const& mod : mods)
@@ -5065,6 +5147,111 @@ class Invariants_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testSponsorship()
+    {
+        using namespace test::jtx;
+        using namespace std::string_literals;
+        testcase("Sponsorship");
+        {
+            auto const expectMessage =
+                "SponsoredOwnerCount does not equal SponsoringOwnerCount delta.";
+
+            doInvariantCheck(
+                {{expectMessage}}, [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                    auto const sle = ac.view().peek(keylet::account(a1.id()));
+                    if (!sle)
+                        return false;
+                    sle->setFieldU32(sfSponsoredOwnerCount, 1);
+                    ac.view().update(sle);
+                    return true;
+                });
+
+            doInvariantCheck(
+                {{expectMessage}}, [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                    auto const sle = ac.view().peek(keylet::account(a1.id()));
+                    if (!sle)
+                        return false;
+                    sle->setFieldU32(sfSponsoringOwnerCount, 1);
+                    ac.view().update(sle);
+                    return true;
+                });
+        }
+
+        {
+            auto const expectMessage =
+                "OwnerCount must be greater than or equal to SponsoredOwnerCount.";
+
+            doInvariantCheck(
+                {{expectMessage}}, [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                    auto const sle = ac.view().peek(keylet::account(a1.id()));
+                    if (!sle)
+                        return false;
+                    sle->setFieldU32(sfOwnerCount, 0);
+                    sle->setFieldU32(sfSponsoredOwnerCount, 1);
+                    ac.view().update(sle);
+
+                    auto const sle2 = ac.view().peek(keylet::account(a2.id()));
+                    if (!sle2)
+                        return false;
+                    sle2->setFieldU32(sfSponsoringOwnerCount, 1);
+                    ac.view().update(sle2);
+                    return true;
+                });
+        }
+
+        {
+            auto const expectMessage =
+                "SponsoredObjectOwnerCount does not equal SponsoredOwnerCount delta.";
+            uint256 checkID;
+
+            doInvariantCheck(
+                {{expectMessage}},
+                [&](Account const&, Account const& a2, ApplyContext& ac) {
+                    auto const check = ac.view().peek(keylet::check(checkID));
+                    if (!check)
+                        return false;
+                    check->setAccountID(sfSponsor, a2.id());
+                    ac.view().update(check);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{ttACCOUNT_SET, [](STObject&) {}},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED},
+                [&checkID](Account const& a1, Account const& a2, Env& env) {
+                    checkID = keylet::check(a1.id(), env.seq(a1)).key;
+                    env(check::create(a1, a2, XRP(1)));
+                    return true;
+                });
+        }
+
+        {
+            auto const expectMessage =
+                "Invariant failed: Net delta of SponsoringAccountCount does "
+                "not match net delta of sfSponsor presence.";
+
+            doInvariantCheck(
+                {{expectMessage}}, [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                    auto const sle = ac.view().peek(keylet::account(a1.id()));
+                    if (!sle)
+                        return false;
+                    sle->setFieldU32(sfSponsoringAccountCount, 1);
+                    ac.view().update(sle);
+                    return true;
+                });
+
+            doInvariantCheck(
+                {{expectMessage}}, [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                    auto const sle = ac.view().peek(keylet::account(a1.id()));
+                    if (!sle)
+                        return false;
+                    sle->setAccountID(sfSponsor, a2.id());
+                    ac.view().update(sle);
+                    return true;
+                });
+        }
+    }
+
     void
     testObjectHasPseudoAccount()
     {
@@ -5467,6 +5654,7 @@ public:
         testVaultComputeCoarsestScale();
         testAMM();
         testObjectHasPseudoAccount();
+        testSponsorship();
     }
 };
 
diff --git a/src/test/app/LoanBroker_test.cpp b/src/test/app/LoanBroker_test.cpp
index 2a4de18a9c..b0b0924c6e 100644
--- a/src/test/app/LoanBroker_test.cpp
+++ b/src/test/app/LoanBroker_test.cpp
@@ -29,6 +29,7 @@
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
@@ -1078,7 +1079,7 @@ class LoanBroker_test : public beast::unit_test::Suite
             }
 
             auto const amt =
-                env.balance(alice) - env.current()->fees().accountReserve(env.ownerCount(alice));
+                env.balance(alice) - accountReserve(*env.current(), alice.id(), env.journal);
             env(pay(alice, issuer, amt));
 
             // preclaim:: tecINSUFFICIENT_RESERVE
diff --git a/src/test/app/Loan_test.cpp b/src/test/app/Loan_test.cpp
index 3e62af48ff..569306e920 100644
--- a/src/test/app/Loan_test.cpp
+++ b/src/test/app/Loan_test.cpp
@@ -18,6 +18,7 @@
 #include <test/jtx/permissioned_domains.h>
 #include <test/jtx/seq.h>
 #include <test/jtx/sig.h>
+#include <test/jtx/sponsor.h>
 #include <test/jtx/tags.h>
 #include <test/jtx/ter.h>
 #include <test/jtx/trust.h>
@@ -36,6 +37,7 @@
 #include <xrpl/beast/xor_shift_engine.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/to_string.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/LendingHelpers.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Feature.h>
@@ -671,11 +673,11 @@ protected:
             case AssetType::MPT: {
                 // Enough to cover initial fees
                 if (!env.le(keylet::account(issuer)))
-                    env.fund(env.current()->fees().accountReserve(10) * 10, issuer);
+                    env.fund(env.current()->fees().accountReserve(10, 1) * 10, issuer);
                 if (!env.le(keylet::account(lender)))
-                    env.fund(env.current()->fees().accountReserve(10) * 10, noripple(lender));
+                    env.fund(env.current()->fees().accountReserve(10, 1) * 10, noripple(lender));
                 if (!env.le(keylet::account(borrower)))
-                    env.fund(env.current()->fees().accountReserve(10) * 10, noripple(borrower));
+                    env.fund(env.current()->fees().accountReserve(10, 1) * 10, noripple(borrower));
 
                 MPTTester mptt{env, issuer, kMptInitNoFund};
                 mptt.create({.flags = tfMPTCanClawback | tfMPTCanTransfer | tfMPTCanLock});
@@ -760,11 +762,11 @@ protected:
         using namespace jtx;
 
         // Enough to cover initial fees
-        env.fund(env.current()->fees().accountReserve(10) * 10, issuer);
+        env.fund(env.current()->fees().accountReserve(10, 1) * 10, issuer);
         if (lender != issuer)
-            env.fund(env.current()->fees().accountReserve(10) * 10, noripple(lender));
+            env.fund(env.current()->fees().accountReserve(10, 1) * 10, noripple(lender));
         if (borrower != issuer && borrower != lender)
-            env.fund(env.current()->fees().accountReserve(10) * 10, noripple(borrower));
+            env.fund(env.current()->fees().accountReserve(10, 1) * 10, noripple(borrower));
 
         describeLoan(env, brokerParams, loanParams, assetType, issuer, lender, borrower);
 
@@ -841,11 +843,10 @@ protected:
         // Add extra for transaction fees and reserves, if appropriate, or a
         // tiny amount for the extra paid in each transaction
         auto const totalNeeded = state.totalValue + (serviceFee * state.paymentRemaining) +
-            (broker.asset.native()
-                 ? Number(
-                       baseFee * state.paymentRemaining +
-                       env.current()->fees().accountReserve(env.ownerCount(borrower)))
-                 : broker.asset(15).number());
+            (broker.asset.native() ? Number(
+                                         baseFee * state.paymentRemaining +
+                                         accountReserve(*env.current(), borrower.id(), env.journal))
+                                   : broker.asset(15).number());
 
         auto const shortage = totalNeeded - borrowerBalance.number();
 
@@ -3071,7 +3072,7 @@ protected:
         auto const [acctReserve, incReserve] = [this]() -> std::pair<int, int> {
             Env const env{*this, testableAmendments()};
             return {
-                env.current()->fees().accountReserve(0).drops() / kDropsPerXrp.drops(),
+                env.current()->fees().accountReserve(0, 1).drops() / kDropsPerXrp.drops(),
                 env.current()->fees().increment.drops() / kDropsPerXrp.drops()};
         }();
 
@@ -4419,11 +4420,12 @@ protected:
         Account const lender{"lender"};
         Account const issuer{"issuer"};
         Account const borrower{"borrower"};
+        Account const sponsor{"sponsor"};
         auto const iou = issuer["IOU"];
 
         auto testWrapper = [&](auto&& test) {
             Env env(*this);
-            env.fund(XRP(1'000), lender, issuer, borrower);
+            env.fund(XRP(1'000), lender, issuer, borrower, sponsor);
             env(trust(lender, iou(10'000'000)));
             env(pay(issuer, lender, iou(5'000'000)));
             BrokerInfo const brokerInfo{createVaultAndBroker(env, issuer["IOU"], lender)};
@@ -4438,6 +4440,15 @@ protected:
                         BrokerInfo const& brokerInfo,
                         jtx::Fee const& loanSetFee,
                         Number const& debtMaximumRequest) {
+            for (auto const sponsorFlags : {spfSponsorReserve, spfSponsorReserve | spfSponsorFee})
+            {
+                env(set(borrower, brokerInfo.brokerID, debtMaximumRequest),
+                    sponsor::As(sponsor, sponsorFlags),
+                    Sig(sfCounterpartySignature, lender),
+                    loanSetFee,
+                    Ter(temINVALID_FLAG));
+            }
+
             // first temBAD_SIGNER: TODO
             // invalid grace period
             {
@@ -4528,8 +4539,8 @@ protected:
                         BrokerInfo const& brokerInfo,
                         jtx::Fee const& loanSetFee,
                         Number const& debtMaximumRequest) {
-            auto const amt = env.balance(borrower) -
-                env.current()->fees().accountReserve(env.ownerCount(borrower));
+            auto const amt =
+                env.balance(borrower) - accountReserve(*env.current(), borrower.id(), env.journal);
             env(pay(borrower, issuer, amt));
 
             // tecINSUFFICIENT_RESERVE
diff --git a/src/test/app/MPToken_test.cpp b/src/test/app/MPToken_test.cpp
index bbf1c54ab1..7543db7364 100644
--- a/src/test/app/MPToken_test.cpp
+++ b/src/test/app/MPToken_test.cpp
@@ -2108,6 +2108,15 @@ class MPToken_test : public beast::unit_test::Suite
                 reward = STAmount{sfSignatureReward, usd(10)};
                 minAmount = STAmount{sfMinAccountCreateAmount, mpt};
             }
+            // SponsorshipSet
+            {
+                json::Value jv;
+                jv[jss::TransactionType] = jss::SponsorshipSet;
+                jv[jss::Account] = alice.human();
+                jv[sfSponsee.fieldName] = carol.human();
+                jv[sfFeeAmount.fieldName] = mpt.getJson(JsonOptions::Values::None);
+                test(jv, sfFeeAmount.fieldName.c_str());
+            }
         }
         BEAST_EXPECT(txWithAmounts.empty());
     }
@@ -7563,7 +7572,7 @@ class MPToken_test : public beast::unit_test::Suite
     void
     testFixDoubleOwnerCount(FeatureBitset all)
     {
-        testcase("Fix Double adjustOwnerCount in AMMWithdraw");
+        testcase("Fix Double OwnerCount in AMMWithdraw");
 
         using namespace jtx;
 
diff --git a/src/test/app/NFToken_test.cpp b/src/test/app/NFToken_test.cpp
index 844bb4ee87..acd54ae26a 100644
--- a/src/test/app/NFToken_test.cpp
+++ b/src/test/app/NFToken_test.cpp
@@ -452,7 +452,7 @@ class NFTokenBaseUtil_test : public beast::unit_test::Suite
 
             // Just for sanity's sake we'll check that the current value
             // of sfMintedNFTokens matches what we expect.
-            auto replacement = std::make_shared<SLE>(*sle, sle->key());
+            auto replacement = std::make_shared<SLE>(*sle);
             if (replacement->getFieldU32(sfMintedNFTokens) != 1)
                 return false;  // Unexpected test conditions.
 
diff --git a/src/test/app/OfferMPT_test.cpp b/src/test/app/OfferMPT_test.cpp
index 800b14877a..d03b1b8e93 100644
--- a/src/test/app/OfferMPT_test.cpp
+++ b/src/test/app/OfferMPT_test.cpp
@@ -59,7 +59,7 @@ class OfferMPT_test : public beast::unit_test::Suite
     static XRPAmount
     reserve(jtx::Env& env, std::uint32_t count)
     {
-        return env.current()->fees().accountReserve(count);
+        return env.current()->fees().accountReserve(count, 1);
     }
 
     static std::uint32_t
@@ -1794,7 +1794,8 @@ public:
             //  1 for each trust limit == 3 (alice < mtgox/amazon/bitstamp) +
             //  1 for payment          == 4
             auto const base = env.current()->fees().base;
-            auto const startingXrp = XRP(100) + env.current()->fees().accountReserve(3) + base * 4;
+            auto const startingXrp =
+                XRP(100) + env.current()->fees().accountReserve(3, 1) + base * 4;
 
             env.fund(startingXrp, gw1, gw2, gw3, alice, bob);
             env.close();
@@ -1814,7 +1815,8 @@ public:
             env(offer(alice, usD1(200), XRP(200)));
 
             BEAST_EXPECT(env.balance(alice, usD1) == usD1(100));
-            BEAST_EXPECT(env.balance(alice) == STAmount(env.current()->fees().accountReserve(3)));
+            BEAST_EXPECT(
+                env.balance(alice) == STAmount(env.current()->fees().accountReserve(3, 1)));
 
             BEAST_EXPECT(env.balance(bob, usD1) == usD1(400));
         };
@@ -1865,7 +1867,7 @@ public:
         auto const bob = Account{"bob"};
 
         auto const startingXrp =
-            XRP(100) + env.current()->fees().accountReserve(1) + env.current()->fees().base * 2;
+            XRP(100) + env.current()->fees().accountReserve(1, 1) + env.current()->fees().base * 2;
 
         env.fund(startingXrp, gw, alice, bob);
 
@@ -1884,7 +1886,7 @@ public:
         jrr = ledgerEntryRoot(env, alice);
         BEAST_EXPECT(
             jrr[jss::node][sfBalance.fieldName] ==
-            STAmount(env.current()->fees().accountReserve(1)).getText());
+            STAmount(env.current()->fees().accountReserve(1, 1)).getText());
 
         jrr = ledgerEntryMPT(env, bob, usd);
         BEAST_EXPECT(jrr[jss::node][sfMPTAmount.fieldName] == "400");
@@ -1904,7 +1906,7 @@ public:
         auto const bob = Account{"bob"};
 
         auto const startingXrp =
-            XRP(100) + env.current()->fees().accountReserve(1) + env.current()->fees().base * 2;
+            XRP(100) + env.current()->fees().accountReserve(1, 1) + env.current()->fees().base * 2;
 
         env.fund(startingXrp, gw, alice, bob);
 
@@ -1925,7 +1927,7 @@ public:
         jrr = ledgerEntryRoot(env, alice);
         BEAST_EXPECT(
             jrr[jss::node][sfBalance.fieldName] ==
-            STAmount(env.current()->fees().accountReserve(1)).getText());
+            STAmount(env.current()->fees().accountReserve(1, 1)).getText());
 
         jrr = ledgerEntryMPT(env, bob, usd);
         BEAST_EXPECT(jrr[jss::node][sfMPTAmount.fieldName] == "300");
@@ -1946,7 +1948,7 @@ public:
 
             auto const base = env.current()->fees().base;
             auto const startingXrp =
-                XRP(100.1) + env.current()->fees().accountReserve(1) + base * 2;
+                XRP(100.1) + env.current()->fees().accountReserve(1, 1) + base * 2;
 
             env.fund(startingXrp, gw, alice, bob);
             env.close();
diff --git a/src/test/app/Offer_test.cpp b/src/test/app/Offer_test.cpp
index 2724a6474b..7fc7161e36 100644
--- a/src/test/app/Offer_test.cpp
+++ b/src/test/app/Offer_test.cpp
@@ -60,7 +60,7 @@ class OfferBaseUtil_test : public beast::unit_test::Suite
     static XRPAmount
     reserve(jtx::Env& env, std::uint32_t count)
     {
-        return env.current()->fees().accountReserve(count);
+        return env.current()->fees().accountReserve(count, 1);
     }
 
     static std::uint32_t
@@ -1962,7 +1962,7 @@ public:
         //  1 for each trust limit == 3 (alice < mtgox/amazon/bitstamp) +
         //  1 for payment          == 4
         auto const startingXrp =
-            XRP(100) + env.current()->fees().accountReserve(3) + env.current()->fees().base * 4;
+            XRP(100) + env.current()->fees().accountReserve(3, 1) + env.current()->fees().base * 4;
 
         env.fund(startingXrp, gw1, gw2, gw3, alice, bob);
         env.close();
@@ -1985,7 +1985,7 @@ public:
         jrr = ledgerEntryRoot(env, alice);
         BEAST_EXPECT(
             jrr[jss::node][sfBalance.fieldName] ==
-            STAmount(env.current()->fees().accountReserve(3)).getText());
+            STAmount(env.current()->fees().accountReserve(3, 1)).getText());
 
         jrr = ledgerEntryState(env, bob, gw1, "USD");
         BEAST_EXPECT(jrr[jss::node][sfBalance.fieldName][jss::value] == "-400");
@@ -2045,7 +2045,7 @@ public:
         auto const usd = gw["USD"];
 
         auto const startingXrp =
-            XRP(100) + env.current()->fees().accountReserve(1) + env.current()->fees().base * 2;
+            XRP(100) + env.current()->fees().accountReserve(1, 1) + env.current()->fees().base * 2;
 
         env.fund(startingXrp, gw, alice, bob);
         env.close();
@@ -2066,7 +2066,7 @@ public:
         jrr = ledgerEntryRoot(env, alice);
         BEAST_EXPECT(
             jrr[jss::node][sfBalance.fieldName] ==
-            STAmount(env.current()->fees().accountReserve(1)).getText());
+            STAmount(env.current()->fees().accountReserve(1, 1)).getText());
 
         jrr = ledgerEntryState(env, bob, gw, "USD");
         BEAST_EXPECT(jrr[jss::node][sfBalance.fieldName][jss::value] == "-400");
@@ -2087,7 +2087,7 @@ public:
         auto const usd = gw["USD"];
 
         auto const startingXrp =
-            XRP(100) + env.current()->fees().accountReserve(1) + env.current()->fees().base * 2;
+            XRP(100) + env.current()->fees().accountReserve(1, 1) + env.current()->fees().base * 2;
 
         env.fund(startingXrp, gw, alice, bob);
         env.close();
@@ -2110,7 +2110,7 @@ public:
         jrr = ledgerEntryRoot(env, alice);
         BEAST_EXPECT(
             jrr[jss::node][sfBalance.fieldName] ==
-            STAmount(env.current()->fees().accountReserve(1)).getText());
+            STAmount(env.current()->fees().accountReserve(1, 1)).getText());
 
         jrr = ledgerEntryState(env, bob, gw, "USD");
         BEAST_EXPECT(jrr[jss::node][sfBalance.fieldName][jss::value] == "-300");
@@ -2131,8 +2131,8 @@ public:
         auto const xts = gw["XTS"];
         auto const xxx = gw["XXX"];
 
-        auto const startingXrp =
-            XRP(100.1) + env.current()->fees().accountReserve(1) + env.current()->fees().base * 2;
+        auto const startingXrp = XRP(100.1) + env.current()->fees().accountReserve(1, 1) +
+            env.current()->fees().base * 2;
 
         env.fund(startingXrp, gw, alice, bob);
         env.close();
diff --git a/src/test/app/Oracle_test.cpp b/src/test/app/Oracle_test.cpp
index 7e7f5e9bd0..b8d9fb32d1 100644
--- a/src/test/app/Oracle_test.cpp
+++ b/src/test/app/Oracle_test.cpp
@@ -60,7 +60,7 @@ private:
         // Insufficient reserve
         {
             Env env(*this);
-            env.fund(env.current()->fees().accountReserve(0), owner);
+            env.fund(env.current()->fees().accountReserve(0, 1), owner);
             Oracle const oracle(
                 env,
                 {.owner = owner,
@@ -71,7 +71,7 @@ private:
         {
             Env env(*this);
             env.fund(
-                env.current()->fees().accountReserve(1) + env.current()->fees().base * 2, owner);
+                env.current()->fees().accountReserve(1, 1) + env.current()->fees().base * 2, owner);
             Oracle oracle(
                 env, {.owner = owner, .fee = static_cast<int>(env.current()->fees().base.drops())});
             BEAST_EXPECT(oracle.exists());
@@ -640,7 +640,7 @@ private:
             Env env(*this);
             auto const baseFee = static_cast<int>(env.current()->fees().base.drops());
             env.fund(
-                env.current()->fees().accountReserve(1) + env.current()->fees().base * 2, owner);
+                env.current()->fees().accountReserve(1, 1) + env.current()->fees().base * 2, owner);
             Oracle oracle(env, {.owner = owner, .fee = baseFee});
             oracle.set(UpdateArg{.series = {{"XRP", "USD", 742, 2}}, .fee = baseFee});
         }
diff --git a/src/test/app/Sponsor_test.cpp b/src/test/app/Sponsor_test.cpp
new file mode 100644
index 0000000000..f20aac68f9
--- /dev/null
+++ b/src/test/app/Sponsor_test.cpp
@@ -0,0 +1,5511 @@
+#include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
+#include <test/jtx/TestHelpers.h>
+#include <test/jtx/acctdelete.h>
+#include <test/jtx/amount.h>
+#include <test/jtx/batch.h>
+#include <test/jtx/check.h>
+#include <test/jtx/credentials.h>
+#include <test/jtx/delegate.h>
+#include <test/jtx/deposit.h>
+#include <test/jtx/did.h>
+#include <test/jtx/escrow.h>
+#include <test/jtx/fee.h>
+#include <test/jtx/flags.h>
+#include <test/jtx/ledgerStateFix.h>
+#include <test/jtx/mpt.h>
+#include <test/jtx/multisign.h>
+#include <test/jtx/noop.h>
+#include <test/jtx/offer.h>
+#include <test/jtx/paths.h>
+#include <test/jtx/pay.h>
+#include <test/jtx/sendmax.h>
+#include <test/jtx/seq.h>
+#include <test/jtx/sig.h>
+#include <test/jtx/sponsor.h>
+#include <test/jtx/ter.h>
+#include <test/jtx/ticket.h>
+#include <test/jtx/token.h>
+#include <test/jtx/trust.h>
+#include <test/jtx/txflags.h>
+#include <test/jtx/vault.h>
+
+#include <xrpl/basics/Number.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
+#include <xrpl/basics/strHex.h>
+#include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/tx/apply.h>
+#include <xrpl/tx/applySteps.h>
+
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <set>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace xrpl::test {
+
+static STAmount
+accountReserve(jtx::Env& env, std::uint32_t count = 1)
+{
+    return env.current()->fees().reserve * count;
+}
+
+static STAmount
+reserve(jtx::Env& env, std::uint32_t count)
+{
+    return env.current()->fees().accountReserve(count, 1);
+}
+
+static void
+adjustAccountXRPBalance(jtx::Env& env, jtx::Account const& account, STAmount const& balanceTo)
+{
+    using namespace test::jtx;
+    XRPL_ASSERT(isXRP(balanceTo), "adjustAccountXRPBalance: balanceTo must be XRP");
+    auto const currentBalance = env.balance(account);
+    if (currentBalance == balanceTo)
+        return;
+
+    auto const baseFee = env.current()->fees().base;
+    if (currentBalance > balanceTo)
+    {
+        env(pay(account, env.master, currentBalance - balanceTo),
+            Fee(XRP(1)),
+            sponsor::As(env.master, spfSponsorFee),
+            Sig(sfSponsorSignature, env.master));
+    }
+    else
+    {
+        env(pay(env.master, account, balanceTo - currentBalance), Fee(baseFee));
+    }
+
+    env.close();
+}
+
+class Sponsor_test : public beast::unit_test::Suite
+{
+public:
+    void
+    testDisabled()
+    {
+        testcase("Disabled");
+        using namespace test::jtx;
+        Env env{*this, testableAmendments() - featureSponsor};
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        env.fund(XRP(10000), alice, sponsor);
+
+        // check Sponsor fields
+        auto const jt = noop(alice);
+        auto jt1 = jt;
+        jt1[sfSponsor.jsonName] = sponsor.human();
+        env(jt1, Ter(temDISABLED));
+        env(jt, Sig(sfSponsorSignature, sponsor), Ter(temDISABLED));
+
+        auto jt2 = jt;
+        jt2[sfSponsorFlags.jsonName] = spfSponsorFee | spfSponsorReserve;
+        env(jt2, Ter(temDISABLED));
+
+        // check Sponsor transactions
+        env(sponsor::transfer(alice, 0), Ter(temDISABLED));
+        env(sponsor::set(sponsor, 0), Ter(temDISABLED));
+    }
+
+    void
+    testInvalidSponsorshipSet()
+    {
+        testcase("Invalid SponsorshipSet");
+        using namespace test::jtx;
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        Account const noFunded("noFunded");
+        Account const gw("gw");
+
+        auto const usd = gw["usd"];
+        env.fund(XRP(10000), alice, sponsor, gw);
+        env.close();
+
+        //
+        // preflight
+        //
+
+        // Invalid flags
+        {
+            env(sponsor::set(sponsor, ~tfSponsorshipSetMask - tfInnerBatchTxn),
+                sponsor::SponseeAcc(alice),
+                Ter(temINVALID_FLAG));
+
+            env(sponsor::set(
+                    sponsor,
+                    tfSponsorshipSetRequireSignForFee | tfSponsorshipClearRequireSignForFee),
+                sponsor::SponseeAcc(alice),
+                Ter(temINVALID_FLAG));
+
+            env(sponsor::set(
+                    sponsor,
+                    tfSponsorshipSetRequireSignForReserve |
+                        tfSponsorshipClearRequireSignForReserve),
+                sponsor::SponseeAcc(alice),
+                Ter(temINVALID_FLAG));
+
+            for (auto flag :
+                 {tfSponsorshipSetRequireSignForFee,
+                  tfSponsorshipClearRequireSignForFee,
+                  tfSponsorshipSetRequireSignForReserve,
+                  tfSponsorshipClearRequireSignForReserve})
+            {
+                env(sponsor::set(sponsor, tfDeleteObject | flag),
+                    sponsor::SponseeAcc(alice),
+                    Ter(temINVALID_FLAG));
+            }
+        }
+
+        // invalid SponsorAccount / Sponsee
+        // Account = Sponsor
+        env(sponsor::set(alice, tfDeleteObject),
+            sponsor::CounterpartySponsor(alice),
+            Ter(temMALFORMED));
+        // Account = Sponsee
+        env(sponsor::set(alice, tfDeleteObject), sponsor::SponseeAcc(alice), Ter(temMALFORMED));
+        // Both Sponsor and Sponsee are specified
+        env(sponsor::set(alice, 0),
+            sponsor::CounterpartySponsor(sponsor),
+            sponsor::SponseeAcc(alice),
+            Ter(temMALFORMED));
+
+        // Invalid feeAmount
+        for (auto const& amt : {XRP(-1), usd(1)})
+        {
+            env(sponsor::set_fee(sponsor, 0, amt), sponsor::SponseeAcc(alice), Ter(temBAD_AMOUNT));
+        }
+        // Invalid MaxFee
+        for (auto const& amt : {XRP(-1), usd(1)})
+        {
+            env(sponsor::set_fee(sponsor, 0, XRP(1), amt),
+                sponsor::SponseeAcc(alice),
+                Ter(temBAD_AMOUNT));
+        }
+
+        // Invalid Delete operation
+        env(sponsor::set_reserve(sponsor, tfDeleteObject, 1),
+            sponsor::SponseeAcc(alice),
+            Ter(temMALFORMED));
+        env(sponsor::set_fee(sponsor, tfDeleteObject, XRP(1)),
+            sponsor::SponseeAcc(alice),
+            Ter(temMALFORMED));
+        env(sponsor::set_max_fee(sponsor, tfDeleteObject, XRP(1)),
+            sponsor::SponseeAcc(alice),
+            Ter(temMALFORMED));
+
+        // Invalid SponsorAccount with non-Delete operation
+        env(sponsor::set_reserve(sponsor, 0, 100),
+            sponsor::CounterpartySponsor(alice),
+            Ter(temMALFORMED));
+        env(sponsor::set_fee(sponsor, 0, XRP(1), XRP(1)),
+            sponsor::CounterpartySponsor(alice),
+            Ter(temMALFORMED));
+
+        //
+        // preclaim
+        //
+
+        // Invalid Sponsee
+        env(sponsor::set(sponsor, 0), sponsor::SponseeAcc(noFunded), Ter(tecNO_DST));
+        env.close();
+
+        // Invalid Sponsor
+        env(sponsor::set(sponsor, tfDeleteObject),
+            sponsor::CounterpartySponsor(noFunded),
+            Ter(tecNO_DST));
+        env.close();
+
+        // Invalid Delete operation (sponsorship not found)
+        env(sponsor::set(sponsor, tfDeleteObject), sponsor::SponseeAcc(alice), Ter(tecNO_ENTRY));
+        env.close();
+
+        // insufficient balance to sponsor Fee
+        adjustAccountXRPBalance(env, sponsor, env.current()->fees().reserve);
+        env(sponsor::set_fee(sponsor, 0, XRP(4)), sponsor::SponseeAcc(alice), Ter(tecUNFUNDED));
+        env.close();
+
+        // insufficient reserve to create sponsorship
+        adjustAccountXRPBalance(env, sponsor, XRP(100) + XRP(1) + reserve(env, 1) - drops(1));
+        env(sponsor::set(sponsor, 0, 100, XRP(100)),
+            sponsor::SponseeAcc(alice),
+            Fee(XRP(1)),
+            Ter(tecUNFUNDED));
+        env.close();
+
+        // FeeAmount + Fee > Balance
+        // Balance = 1000XRP, FeeAmount = 1001XRP
+        adjustAccountXRPBalance(env, sponsor, XRP(1000));
+        env(sponsor::set_fee(sponsor, 0, XRP(1001)),
+            sponsor::SponseeAcc(alice),
+            Fee(XRP(1)),
+            Ter(tecUNFUNDED));
+        env.close();
+        // Balance = 1000XRP, FeeAmount = 999XRP, Fee=2XRP
+        adjustAccountXRPBalance(env, sponsor, XRP(1000));
+        env(sponsor::set_fee(sponsor, 0, XRP(999)),
+            sponsor::SponseeAcc(alice),
+            Fee(XRP(2)),
+            Ter(tecUNFUNDED));
+        env.close();
+
+        // create sponsor to use above tests
+        // need feeAmount(1000) + Fee(1) + reserve(~250) = ~1251
+        adjustAccountXRPBalance(env, sponsor, XRP(1000) + XRP(1) + reserve(env, 1));
+        env(sponsor::set(sponsor, 0, 100, XRP(1000)),
+            sponsor::SponseeAcc(alice),
+            Fee(XRP(1)),
+            Ter(tesSUCCESS));
+        env.close();
+
+        // delta-based balance check
+        // After create: sponsor balance ~ 0, feeAmount = XRP(1000)
+
+        // Decreasing feeAmount should succeed (refund, negative delta)
+        adjustAccountXRPBalance(env, sponsor, XRP(500));
+        env(sponsor::set_fee(sponsor, 0, XRP(800)),
+            sponsor::SponseeAcc(alice),
+            Fee(XRP(1)),
+            Ter(tesSUCCESS));
+        env.close();
+        // balance was 500, delta = 800-1000 = -200 (refund), balance = 500+200-1 = 699
+
+        // Increasing feeAmount within delta budget should succeed
+        adjustAccountXRPBalance(env, sponsor, XRP(500));
+        env(sponsor::set_fee(sponsor, 0, XRP(850)),
+            sponsor::SponseeAcc(alice),
+            Fee(XRP(1)),
+            Ter(tesSUCCESS));
+        env.close();
+        // balance was 500, delta = 850-800 = 50, balance = 500-50-1 = 449
+
+        // Increasing feeAmount where delta exceeds balance should fail
+        adjustAccountXRPBalance(env, sponsor, XRP(310));
+        env(sponsor::set_fee(sponsor, 0, XRP(1200)),
+            sponsor::SponseeAcc(alice),
+            Fee(XRP(1)),
+            Ter(tecUNFUNDED));
+        env.close();
+
+        // Increasing feeAmount to reach insufficient reserve
+        auto const currentFeeAmount = env.le(keylet::sponsorship(sponsor.id(), alice.id()))
+                                          ->getFieldAmount(sfFeeAmount)
+                                          .xrp();
+        adjustAccountXRPBalance(env, sponsor, XRP(310));
+        env(sponsor::set_fee(sponsor, 0, currentFeeAmount + XRP(309)),
+            sponsor::SponseeAcc(alice),
+            Fee(XRP(1)),
+            Ter(tecUNFUNDED));
+        env.close();
+    }
+
+    void
+    testPseudoAccountSponsorship()
+    {
+        testcase("Pseudo account sponsorship");
+        using namespace test::jtx;
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const gw("gw");
+        Account const sp("sponsor");
+
+        Asset const asset = gw["IOU"].asset();
+
+        env.fund(XRP(1000000), alice, bob, gw, sp);
+        env.close();
+
+        // Create a vault to get a pseudo account
+        Vault const vault{env};
+        auto [tx, keylet] = vault.create({.owner = alice, .asset = asset});
+        env(tx);
+        env.close();
+
+        auto const vaultSle = env.le(keylet);
+        BEAST_EXPECT(vaultSle);
+        Account const pseudoAcc("vault", vaultSle->getAccountID(sfAccount));
+        env.memoize(pseudoAcc);
+
+        // Sponsee is a pseudo account -> tecNO_PERMISSION
+        env(sponsor::set(sp, 0, 100, XRP(100)),
+            sponsor::SponseeAcc(pseudoAcc),
+            Ter(tecNO_PERMISSION));
+        env.close();
+
+        // Sponsor is a pseudo account -> tecNO_PERMISSION
+        // (submitted by bob with counterpartySponsor pointing to pseudo account)
+        env(sponsor::set(bob, tfDeleteObject),
+            sponsor::CounterpartySponsor(pseudoAcc),
+            Ter(tecNO_PERMISSION));
+        env.close();
+    }
+
+    void
+    testSingleSigning()
+    {
+        testcase("Single signing");
+        using namespace test::jtx;
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        Account const invalid("invalid");
+
+        env.fund(XRP(10000), alice, sponsor);
+        env.close();
+
+        // Signature doesn't exist
+        auto tx = noop(alice);
+        tx[sfSponsor.jsonName] = sponsor.human();
+        tx[sfSponsorSignature.jsonName][sfSigningPubKey.jsonName] = strHex(sponsor.pk().slice());
+
+        env(tx, Fee(XRP(1)), sponsor::As(sponsor, spfSponsorReserve), Ter(telENV_RPC_FAILED));
+
+        // Invalid signature
+        tx[sfSponsorSignature.jsonName][sfTxnSignature.jsonName] = "DEADBEEF";
+        env(tx, Fee(XRP(1)), sponsor::As(sponsor, spfSponsorReserve), Ter(telENV_RPC_FAILED));
+
+        // Signer account doesn't exist
+        env(noop(alice),
+            Fee(XRP(1)),
+            sponsor::As(invalid, spfSponsorReserve),
+            Sig(sfSponsorSignature, invalid),
+            Ter(terNO_ACCOUNT));
+
+        // Success
+        env(noop(alice),
+            Fee(XRP(1)),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(tesSUCCESS));
+    }
+
+    void
+    testMultiSigning()
+    {
+        testcase("Multi signing");
+        using namespace test::jtx;
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        Account const signer1("signer1");
+        Account const signer2("signer2");
+
+        env.fund(XRP(10000), alice, bob, sponsor);
+        env.close();
+
+        env(signers(sponsor, 1, {{signer1, 1}, {signer2, 1}}));
+        env.close();
+
+        // Invalid signature
+        auto tx = noop(alice);
+        auto& signers1 = tx[sfSponsorSignature.jsonName][sfSigners.jsonName][0U][sfSigner.jsonName];
+        signers1[sfAccount.jsonName] = signer1.human();
+        signers1[sfSigningPubKey.jsonName] = strHex(signer1.pk().slice());
+        signers1[sfTxnSignature.jsonName] = "DEADBEEF";
+        env(tx, Fee(XRP(1)), sponsor::As(sponsor, spfSponsorReserve), Ter(telENV_RPC_FAILED));
+
+        // bob is not a multi-signing account.
+        env(noop(alice),
+            Fee(XRP(1)),
+            sponsor::As(bob, spfSponsorReserve),
+            Msig(sfSponsorSignature, {signer1}),
+            Ter(tefNOT_MULTI_SIGNING));
+
+        env(noop(alice),
+            Fee(XRP(1)),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Msig(sfSponsorSignature, {signer1}),
+            Ter(tesSUCCESS));
+        env.close();
+
+        env(signers(sponsor, 2, {{signer1, 1}, {signer2, 1}}));
+        env.close();
+
+        // test calculateBaseFee for multisigned sponsor
+        auto const baseFee = env.current()->fees().base;
+        env(noop(alice),
+            Fee(baseFee + 2 * baseFee - 1),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Msig(sfSponsorSignature, {signer1, signer2}),
+            Ter(telINSUF_FEE_P));
+
+        env(noop(alice),
+            Fee(baseFee + 2 * baseFee),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Msig(sfSponsorSignature, {signer1, signer2}),
+            Ter(tesSUCCESS));
+    }
+
+    void
+    testInvalidSponsorField()
+    {
+        testcase("Invalid Sponsor Field");
+        using namespace test::jtx;
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        Account const noFunded("noFunded");
+        env.fund(XRP(10000), alice, sponsor);
+        env.close();
+
+        // Invalid Sponsor Account (Account = Sponsor.Account)
+        env(noop(alice), sponsor::As(alice, spfSponsorFee), Ter(temMALFORMED));
+
+        // Invalid Sponsor Account
+        // (SponsorSignature is specified but Sponsor.Account is not specified)
+        env(noop(alice), Sig(sfSponsorSignature, sponsor), Ter(temMALFORMED));
+
+        // Invalid Sponsor Account (Sponsor.Account doesn't exist)
+        env(noop(alice), sponsor::As(noFunded, spfSponsorReserve), Ter(terNO_ACCOUNT));
+        env(noop(alice),
+            sponsor::As(noFunded, spfSponsorReserve),
+            Sig(sfSponsorSignature, noFunded),
+            Ter(terNO_ACCOUNT));
+
+        // Invalid Flags
+        env(noop(alice),
+            sponsor::As(sponsor, (spfSponsorFee | spfSponsorReserve) + 1),
+            Ter(temINVALID_FLAG));
+
+        // SponsorFlags=0 with valid sponsor (no sponsorship purpose)
+        env(noop(alice), sponsor::As(sponsor, 0), Ter(temINVALID_FLAG));
+
+        // no SponsorFlag with valid sponsor
+        auto tx = noop(alice);
+        tx[sfSponsor.jsonName] = sponsor.human();
+        env(tx, Ter(temINVALID_FLAG));
+
+        // Invalid Flags without sponsor
+        tx = noop(alice);
+        tx[sfSponsorFlags.jsonName] = spfSponsorFee | spfSponsorReserve;
+        env(tx, Ter(temINVALID_FLAG));
+    }
+
+    void
+    testSimpleSponsorshipSet()
+    {
+        testcase("Simple SponsorshipSet");
+        using namespace test::jtx;
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        env.fund(XRP(10000), alice, sponsor);
+        env.close();
+
+        {
+            // create sponsorship
+            env(sponsor::set(
+                    sponsor,
+                    tfSponsorshipSetRequireSignForFee | tfSponsorshipSetRequireSignForReserve,
+                    100,
+                    XRP(100),
+                    XRP(1)),
+                Fee(XRP(1)),
+                sponsor::SponseeAcc(alice),
+                Ter(tesSUCCESS));
+            env.close();
+
+            auto sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->at(sfRemainingOwnerCount) == 100);
+            BEAST_EXPECT(sle->at(sfFeeAmount) == XRP(100));
+            BEAST_EXPECT(sle->at(sfMaxFee) == XRP(1));
+            BEAST_EXPECT(sle->isFlag(lsfSponsorshipRequireSignForFee));
+            BEAST_EXPECT(sle->isFlag(lsfSponsorshipRequireSignForReserve));
+            BEAST_EXPECT(env.balance(sponsor) == XRP(10000) - sle->at(sfFeeAmount) - XRP(1));
+
+            // update sponsorship (decrement)
+            env(sponsor::set(sponsor, 0, 50, XRP(50), XRP(0.5)),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+
+            sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->at(sfRemainingOwnerCount) == 50);
+            BEAST_EXPECT(sle->at(sfFeeAmount) == XRP(50));
+            BEAST_EXPECT(sle->at(sfMaxFee) == XRP(0.5));
+            BEAST_EXPECT(env.balance(sponsor) == XRP(10000) - sle->at(sfFeeAmount) - XRP(2));
+
+            // update sponsorship (increment)
+            env(sponsor::set(sponsor, 0, 200, XRP(200), XRP(2)),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+
+            sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->at(sfRemainingOwnerCount) == 200);
+            BEAST_EXPECT(sle->at(sfFeeAmount) == XRP(200));
+            BEAST_EXPECT(sle->at(sfMaxFee) == XRP(2));
+            BEAST_EXPECT(env.balance(sponsor) == XRP(10000) - sle->at(sfFeeAmount) - XRP(3));
+
+            // delete from sponsor
+            env(sponsor::del(sponsor), sponsor::SponseeAcc(alice), Fee(XRP(1)), Ter(tesSUCCESS));
+            env.close();
+
+            BEAST_EXPECT(env.balance(sponsor) == XRP(10000) - XRP(4));
+
+            env(sponsor::set(
+                    sponsor,
+                    tfSponsorshipSetRequireSignForFee | tfSponsorshipSetRequireSignForReserve,
+                    100,
+                    XRP(100),
+                    XRP(1)),
+                sponsor::SponseeAcc(alice),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // delete from sponsee
+            env(sponsor::del(alice), sponsor::CounterpartySponsor(sponsor), Ter(tesSUCCESS));
+            env.close();
+            BEAST_EXPECT(!env.le(keylet::sponsorship(sponsor, alice)));
+
+            // Cannot create sponsorship with no fee or reserve budget. MaxFee
+            // and flags do not make a sponsorship object useful by themselves.
+            env(sponsor::set(sponsor, 0), sponsor::SponseeAcc(alice), Ter(tecNO_PERMISSION));
+            env.close();
+            BEAST_EXPECT(!env.le(keylet::sponsorship(sponsor, alice)));
+
+            env(sponsor::set_max_fee(sponsor, 0, XRP(1)),
+                sponsor::SponseeAcc(alice),
+                Ter(tecNO_PERMISSION));
+            env.close();
+            BEAST_EXPECT(!env.le(keylet::sponsorship(sponsor, alice)));
+
+            env(sponsor::set(sponsor, 0, 0, XRP(0), XRP(0)),
+                sponsor::SponseeAcc(alice),
+                Ter(tecNO_PERMISSION));
+            env.close();
+            BEAST_EXPECT(!env.le(keylet::sponsorship(sponsor, alice)));
+
+            // update sponsorship with non-zero value
+            env(sponsor::set(sponsor, 0, 100, XRP(100), XRP(1)),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)));
+            env.close();
+
+            sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->at(sfRemainingOwnerCount) == 100);
+            BEAST_EXPECT(sle->at(sfFeeAmount) == XRP(100));
+            BEAST_EXPECT(sle->at(sfMaxFee) == XRP(1));
+
+            // update sponsorship flags
+            auto testFlagUpdate = [&](auto setFlag, auto clearFlag, auto ledgerFlag) {
+                env(sponsor::set(sponsor, setFlag), sponsor::SponseeAcc(alice), Fee(XRP(1)));
+                env.close();
+
+                sle = env.le(keylet::sponsorship(sponsor, alice));
+                BEAST_EXPECT(sle);
+                BEAST_EXPECT(sle->isFlag(ledgerFlag));
+
+                env(sponsor::set(sponsor, clearFlag), sponsor::SponseeAcc(alice), Fee(XRP(1)));
+                env.close();
+
+                sle = env.le(keylet::sponsorship(sponsor, alice));
+                BEAST_EXPECT(sle);
+                BEAST_EXPECT(!sle->isFlag(ledgerFlag));
+            };
+
+            testFlagUpdate(
+                tfSponsorshipSetRequireSignForFee,
+                tfSponsorshipClearRequireSignForFee,
+                lsfSponsorshipRequireSignForFee);
+            testFlagUpdate(
+                tfSponsorshipSetRequireSignForReserve,
+                tfSponsorshipClearRequireSignForReserve,
+                lsfSponsorshipRequireSignForReserve);
+
+            // Cannot update sponsorship so both fee and reserve budgets are absent.
+            env(sponsor::set(sponsor, 0, 0, XRP(0), XRP(0)),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)),
+                Ter(tecNO_PERMISSION));
+            env.close();
+
+            sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->at(sfRemainingOwnerCount) == 100);
+            BEAST_EXPECT(sle->at(sfFeeAmount) == XRP(100));
+            BEAST_EXPECT(sle->at(sfMaxFee) == XRP(1));
+        }
+
+        {
+            // Removing one budget field while the other remains keeps the
+            // Sponsorship valid. Starting state (from above):
+            // RemainingOwnerCount = 100, FeeAmount = XRP(100).
+
+            // Remove only FeeAmount (set to 0); RemainingOwnerCount remains.
+            env(sponsor::set_fee(sponsor, 0, XRP(0)),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+
+            auto sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(!sle->isFieldPresent(sfFeeAmount));
+            BEAST_EXPECT(sle->at(sfRemainingOwnerCount) == 100);
+
+            // Re-add FeeAmount, then remove only RemainingOwnerCount;
+            // FeeAmount remains.
+            env(sponsor::set_fee(sponsor, 0, XRP(100)),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+
+            env(sponsor::set_reserve(sponsor, 0, 0),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+
+            sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(!sle->isFieldPresent(sfRemainingOwnerCount));
+            BEAST_EXPECT(sle->at(sfFeeAmount) == XRP(100));
+        }
+
+        {
+            // Update Sponsorship (FeeAmount)
+            // set empty FeeAmount
+            env(sponsor::set_reserve(sponsor, 0, 100), sponsor::SponseeAcc(alice), Ter(tesSUCCESS));
+            env.close();
+
+            // add FeeAmount
+            env(sponsor::set_fee(sponsor, 0, XRP(100)),
+                sponsor::SponseeAcc(alice),
+                Ter(tesSUCCESS));
+            env.close();
+
+            env(sponsor::del(alice), sponsor::CounterpartySponsor(sponsor), Ter(tesSUCCESS));
+            env.close();
+        }
+        {
+            // Update Sponsorship (ReserveCount)
+            // set empty ReserveCount
+            env(sponsor::set_fee(sponsor, 0, XRP(100)),
+                sponsor::SponseeAcc(alice),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // add ReserveCount
+            env(sponsor::set_reserve(sponsor, 0, 100), sponsor::SponseeAcc(alice), Ter(tesSUCCESS));
+            env.close();
+
+            env(sponsor::del(alice), sponsor::CounterpartySponsor(sponsor), Ter(tesSUCCESS));
+            env.close();
+        }
+        {
+            // delete Sponsorship (only with FeeAmount)
+            env(sponsor::set_fee(sponsor, 0, XRP(100)),
+                sponsor::SponseeAcc(alice),
+                Ter(tesSUCCESS));
+            env.close();
+
+            env(sponsor::del(alice), sponsor::CounterpartySponsor(sponsor), Ter(tesSUCCESS));
+            env.close();
+        }
+        {
+            // delete Sponsorship (only with ReserveCount)
+            env(sponsor::set_reserve(sponsor, 0, 100), sponsor::SponseeAcc(alice), Ter(tesSUCCESS));
+            env.close();
+
+            env(sponsor::del(alice), sponsor::CounterpartySponsor(sponsor), Ter(tesSUCCESS));
+            env.close();
+        }
+    }
+
+    void
+    testPreFundAndCosign()
+    {
+        testcase("PreFund and Cosign");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const charlie("charlie");
+        Account const sponsor("sponsor");
+
+        {
+            // Both pre-funded and co-signed; the pre-funded value is used.
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            env(sponsor::set(sponsor, 0, 100, XRP(100), XRP(1)),
+                sponsor::SponseeAcc(alice),
+                Ter(tesSUCCESS));
+            env.close();
+
+            auto const checkSeq = env.seq(alice);
+            env(check::create(alice, bob, XRP(1)),
+                sponsor::As(sponsor, spfSponsorReserve | spfSponsorFee),
+                Sig(sfSponsorSignature, sponsor),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+
+            auto sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->at(sfRemainingOwnerCount) == 99);
+            BEAST_EXPECT(sle->at(sfFeeAmount) == XRP(99));
+
+            env(check::cancel(alice, keylet::check(alice, checkSeq).key), Ter(tesSUCCESS));
+            env.close();
+
+            sle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->at(sfRemainingOwnerCount) == 99);  // not restored
+            BEAST_EXPECT(sle->at(sfFeeAmount) == XRP(99));
+        }
+
+        {
+            // if pre-funded value is not enough, error
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, charlie, sponsor);
+            env.close();
+
+            env(sponsor::set(sponsor, 0, 1, XRP(10), XRP(100)),
+                sponsor::SponseeAcc(alice),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Fee insufficient
+            env(check::create(alice, bob, XRP(1)),
+                sponsor::As(sponsor, spfSponsorReserve | spfSponsorFee),
+                Sig(sfSponsorSignature, sponsor),
+                Fee(XRP(11)),
+                Ter(terINSUF_FEE_B));
+            env.close();
+
+            env(sponsor::set_reserve(sponsor, 0, 0), sponsor::SponseeAcc(alice), Ter(tesSUCCESS));
+            env.close();
+
+            // reserve insufficient
+            env(check::create(alice, bob, XRP(1)),
+                sponsor::As(sponsor, spfSponsorReserve | spfSponsorFee),
+                Sig(sfSponsorSignature, sponsor),
+                Fee(XRP(1)),
+                Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+        }
+    }
+
+    void
+    testSponsoredFreeTierReserve()
+    {
+        testcase("Sponsored Free-Tier Reserve");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const issuer("issuer");
+        Account const sponsor("sponsor");
+
+        // Trust lines and MPTokens normally skip the reserve check when the
+        // holder's ownerCount < 2 (the "free-tier" / first-two-items shortcut). When the
+        // tx is sponsored, that shortcut must not apply — the sponsor must
+        // still cover the reserve.
+        Env env{*this, testableAmendments()};
+        env.fund(XRP(10000), alice, issuer);
+        // Sponsor is funded just below the reserve required to cover a single
+        // sponsored item.
+        env.fund(reserve(env, 1) - drops(1), sponsor);
+        env.close();
+        BEAST_EXPECT(ownerCount(env, alice) == 0);
+
+        MPTTester mptt(env, issuer, {.fund = false});
+        mptt.create();
+
+        // Free-tier trust line cosigned by an undercapitalized sponsor must
+        // fail — the holder's free-first-two-items shortcut does not let the
+        // sponsor skip the reserve check.
+        env(trust(alice, issuer["USD"](100)),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(tecNO_LINE_INSUF_RESERVE));
+        env.close();
+
+        // Free-tier MPTokenAuthorize must also fail for the same reason.
+        env(MPTTester::authorizeJV({.account = alice, .id = mptt.issuanceID()}),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(tecINSUFFICIENT_RESERVE));
+        env.close();
+    }
+
+    void
+    testTransferSponsor()
+    {
+        testcase("Transfer Sponsor");
+        using namespace test::jtx;
+
+        // Verify preflight checks
+        {
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // Test invalid flags for SponsorshipTransfer
+            {
+                // Invalid flag is provided
+                env(sponsor::transfer(
+                        alice,
+                        (tfSponsorshipCreate | tfSponsorshipReassign | tfSponsorshipEnd) + 1),
+                    Ter(temINVALID_FLAG));
+
+                // No SponsorshipTransfer flag is provided
+                env(sponsor::transfer(alice, 0), Ter(temINVALID_FLAG));
+
+                // Only one of the three valid flags can be set.
+                // Setting more than one flag is invalid
+                for (auto flag : {
+                         tfSponsorshipCreate | tfSponsorshipReassign,
+                         tfSponsorshipCreate | tfSponsorshipEnd,
+                         tfSponsorshipReassign | tfSponsorshipEnd,
+                         tfSponsorshipCreate | tfSponsorshipReassign | tfSponsorshipEnd,
+                     })
+                    env(sponsor::transfer(alice, flag), Ter(temINVALID_FLAG));
+            }
+
+            // Malformed tests for tfSponsorshipCreate
+            {
+                // No sponsor field present
+                env(sponsor::transfer(alice, tfSponsorshipCreate), Ter(temMALFORMED));
+
+                // Sponsor field present without spfSponsorReserve
+                env(sponsor::transfer(alice, tfSponsorshipCreate),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Ter(temINVALID_FLAG));
+
+                // Sponsee field present
+                env(sponsor::transfer(alice, tfSponsorshipCreate),
+                    sponsor::SponseeAcc(bob),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Ter(temMALFORMED));
+            }
+
+            // Malformed tests for tfSponsorshipReassign
+            {
+                // No sponsor field present
+                env(sponsor::transfer(alice, tfSponsorshipReassign), Ter(temMALFORMED));
+
+                // Sponsor field present without spfSponsorReserve
+                env(sponsor::transfer(alice, tfSponsorshipReassign),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Ter(temINVALID_FLAG));
+
+                // Sponsee field present
+                env(sponsor::transfer(alice, tfSponsorshipReassign),
+                    sponsor::SponseeAcc(bob),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Ter(temMALFORMED));
+            }
+
+            // Malformed tests for tfSponsorshipEnd
+            {
+                // Sponsor field present
+                env(sponsor::transfer(alice, tfSponsorshipEnd),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Ter(temMALFORMED));
+
+                // SponsorFlags field present
+                auto tx = sponsor::transfer(alice, tfSponsorshipEnd);
+                tx[sfSponsorFlags.jsonName] = spfSponsorFee;
+                env(tx, Ter(temINVALID_FLAG));
+
+                // Account = Sponsee
+                env(sponsor::transfer(alice, tfSponsorshipEnd),
+                    sponsor::SponseeAcc(alice),
+                    Ter(temMALFORMED));
+            }
+        }
+
+        {
+            // Invalid SponsorshipEnd permission (sponsor object/sponsor account)
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const charlie("charlie");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            {
+                // sponsor object
+                env.fund(XRP(1000), charlie);
+                env.close();
+                env(deposit::auth(alice, charlie),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor));
+                env.close();
+
+                auto const keylet = keylet::depositPreauth(alice, charlie);
+                env(sponsor::transfer(bob, tfSponsorshipEnd, keylet.key),
+                    sponsor::SponseeAcc(alice),
+                    Ter(tecNO_PERMISSION));
+            }
+            {
+                // sponsor object
+                env(sponsor::transfer(alice, tfSponsorshipCreate),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor));
+                env.close();
+
+                env(sponsor::transfer(bob, tfSponsorshipEnd),
+                    sponsor::SponseeAcc(alice),
+                    Ter(tecNO_PERMISSION));
+            }
+            {
+                // The provided sfSponsee account does not exist
+                // when ending sponsorship.
+                Account const ghost("ghost");  // never funded, absent from ledger
+                env(sponsor::transfer(sponsor, tfSponsorshipEnd),
+                    sponsor::SponseeAcc(ghost),
+                    Ter(terNO_ACCOUNT));
+            }
+        }
+
+        {
+            // sponsor account
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor1("sponsor1");
+            Account const sponsor2("sponsor2");
+            env.fund(XRP(10000), alice, bob, sponsor1, sponsor2);
+
+            // sfSponsor provided but sfSponsorSignature not provided
+            env(sponsor::transfer(alice, tfSponsorshipCreate),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Ter(temMALFORMED));
+            env.close();
+
+            adjustAccountXRPBalance(env, sponsor1, accountReserve(env, 2) - drops(1));
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor1),
+                Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+
+            adjustAccountXRPBalance(env, sponsor1, accountReserve(env, 2));
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor1));
+            env.close();
+
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 1);
+            auto const sle1 = env.le(keylet::account(alice));
+            BEAST_EXPECT(sle1->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(sle1->getAccountID(sfSponsor) == sponsor1.id());
+
+            // transfer sponsor
+            adjustAccountXRPBalance(env, sponsor2, accountReserve(env, 2) - drops(1));
+
+            env(sponsor::transfer(alice, tfSponsorshipReassign),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2),
+                Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+
+            adjustAccountXRPBalance(env, sponsor2, accountReserve(env, 2));
+
+            env(sponsor::transfer(alice, tfSponsorshipReassign),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2));
+            env.close();
+
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 1);
+            BEAST_EXPECT(
+                !env.le(keylet::account(sponsor1))->isFieldPresent(sfSponsoringAccountCount));
+            auto const sle2 = env.le(keylet::account(alice));
+            BEAST_EXPECT(sle2->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(sle2->getAccountID(sfSponsor) == sponsor2.id());
+
+            // Reassign to the current sponsor is a no-op and is rejected
+            env(sponsor::transfer(alice, tfSponsorshipReassign),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2),
+                Ter(tecNO_PERMISSION));
+            env.close();
+
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 1);
+
+            // sponsor 2 accounts
+            adjustAccountXRPBalance(env, sponsor2, accountReserve(env, 3));
+            env(sponsor::transfer(bob, tfSponsorshipCreate),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2));
+            env.close();
+
+            // dissolve sponsors
+            adjustAccountXRPBalance(env, alice, accountReserve(env, 1) - drops(1));
+
+            env(sponsor::transfer(alice, tfSponsorshipEnd), Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+
+            adjustAccountXRPBalance(env, alice, accountReserve(env, 1));
+
+            env(sponsor::transfer(alice, tfSponsorshipEnd));
+            env.close();
+
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 1);
+            auto const sle3 = env.le(keylet::account(alice));
+            BEAST_EXPECT(!sle3->isFieldPresent(sfSponsor));
+
+            env(sponsor::transfer(bob, tfSponsorshipEnd));
+            env.close();
+
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 0);
+            BEAST_EXPECT(
+                !env.le(keylet::account(sponsor2))->isFieldPresent(sfSponsoringAccountCount));
+            auto const sle4 = env.le(keylet::account(bob));
+            BEAST_EXPECT(!sle4->isFieldPresent(sfSponsor));
+
+            // not sponsored
+            env(sponsor::transfer(bob, tfSponsorshipEnd), Ter(tecNO_PERMISSION));
+            env.close();
+        }
+        {
+            // dissolve account sponsorship from sponsor
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            BEAST_EXPECT(env.le(alice)->getAccountID(sfSponsor) == sponsor.id());
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor) == 1);
+
+            env(sponsor::transfer(sponsor, tfSponsorshipEnd), sponsor::SponseeAcc(alice));
+            env.close();
+
+            BEAST_EXPECT(!env.le(alice)->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor) == 0);
+        }
+
+        {
+            // sponsor object (co-signing)
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor1("sponsor1");
+            Account const sponsor2("sponsor2");
+            env.fund(XRP(10000), alice, bob, sponsor1, sponsor2);
+            env.close();
+
+            adjustAccountXRPBalance(env, sponsor1, reserve(env, 1) - drops(1));
+            adjustAccountXRPBalance(env, sponsor2, reserve(env, 1) - drops(1));
+
+            auto const seq = env.seq(alice);
+            env(check::create(alice, bob, XRP(1)));
+            env.close();
+
+            auto const checkId = keylet::check(alice, seq).key;
+            BEAST_EXPECT(env.le(keylet::unchecked(checkId)) != nullptr);
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor1),
+                Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+
+            env(pay(alice, sponsor1, drops(1)));
+            env.close();
+
+            // Invalid ObjectID (not found)
+            env(sponsor::transfer(alice, tfSponsorshipCreate, keylet::check(alice, 0).key),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor1),
+                Ter(tecNO_ENTRY));
+            env.close();
+
+            // Invalid Owner
+            env(sponsor::transfer(bob, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor1),
+                Ter(tecNO_PERMISSION));
+            env.close();
+
+            // Reassign an object that is not sponsored yet
+            env(sponsor::transfer(alice, tfSponsorshipReassign, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor1),
+                Ter(tecNO_PERMISSION));
+            env.close();
+
+            // Valid Owner
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor1));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 1);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            auto const sle1 = env.le(keylet::unchecked(checkId));
+            BEAST_EXPECT(sle1->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(sle1->getAccountID(sfSponsor) == sponsor1.id());
+
+            // Create on an object that is already sponsored
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2),
+                Ter(tecNO_PERMISSION));
+            env.close();
+
+            // Reassign to the current sponsor is a no-op and is rejected
+            env(sponsor::transfer(alice, tfSponsorshipReassign, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor1),
+                Ter(tecNO_PERMISSION));
+            env.close();
+
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 1);
+
+            // transfer sponsor
+            env(sponsor::transfer(alice, tfSponsorshipReassign, checkId),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2),
+                Ter(tecINSUFFICIENT_RESERVE));
+
+            env(pay(alice, sponsor2, drops(1)));
+            env.close();
+
+            env(sponsor::transfer(alice, tfSponsorshipReassign, checkId),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2));
+            env.close();
+
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 0);
+            auto const sle2 = env.le(keylet::unchecked(checkId));
+            BEAST_EXPECT(sle2->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(sle2->getAccountID(sfSponsor) == sponsor2.id());
+
+            // dissolve sponsor: ending an object sponsorship succeeds even
+            // when the sponsee lacks sufficient reserve to reclaim the object.
+            adjustAccountXRPBalance(env, alice, reserve(env, 1) - drops(1));
+
+            env(sponsor::transfer(alice, tfSponsorshipEnd, checkId));
+            env.close();
+
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 0);
+            BEAST_EXPECT(
+                !env.le(keylet::account(sponsor2))->isFieldPresent(sfSponsoringOwnerCount));
+            auto const sle3 = env.le(keylet::unchecked(checkId));
+            BEAST_EXPECT(!sle3->isFieldPresent(sfSponsor));
+
+            // Ending sponsorship on an object that is not sponsored (a ticket,
+            // which cannot be sponsored) is rejected.
+            adjustAccountXRPBalance(env, alice, reserve(env, 2));
+            auto const ticketSeq = env.seq(alice);
+            env(ticket::create(alice, 1));
+            env.close();
+            auto ticketId = keylet::ticket(alice, ticketSeq + 1).key;
+            BEAST_EXPECT(env.le(keylet::unchecked(ticketId)));
+            env(sponsor::transfer(alice, tfSponsorshipEnd, ticketId), Ter(tecNO_PERMISSION));
+            env.close();
+            env(noop(alice), ticket::Use(ticketSeq + 1));
+            env.close();
+        }
+        {
+            // sponsor object (pre-funded + no ltSponsorship entry)
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor1("sponsor1");
+            Account const sponsor2("sponsor2");
+            env.fund(XRP(10000), alice, bob, sponsor1, sponsor2);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(check::create(alice, bob, XRP(1)));
+            env.close();
+
+            auto const checkId = keylet::check(alice, seq).key;
+            BEAST_EXPECT(env.le(keylet::unchecked(checkId)) != nullptr);
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Ter(terNO_PERMISSION));
+            env.close();
+
+            env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+            env.close();
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor2, spfSponsorReserve));
+            env.close();
+
+            env(sponsor::transfer(alice, tfSponsorshipReassign, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Ter(terNO_PERMISSION));
+            env.close();
+        }
+        {
+            // sponsor object (pre-funded)
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor1("sponsor1");
+            Account const sponsor2("sponsor2");
+            env.fund(XRP(10000), alice, bob, sponsor1, sponsor2);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(check::create(alice, bob, XRP(1)));
+            env.close();
+
+            auto const checkId = keylet::check(alice, seq).key;
+            BEAST_EXPECT(env.le(keylet::unchecked(checkId)) != nullptr);
+
+            // insufficient reserve count
+            env(sponsor::set_fee(sponsor1, 0, XRP(100)), sponsor::SponseeAcc(alice));
+            env.close();
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+
+            env(sponsor::set_reserve(sponsor1, 0, 100), sponsor::SponseeAcc(alice));
+            env.close();
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 1);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            auto checkSle = env.le(keylet::unchecked(checkId));
+            BEAST_EXPECT(checkSle->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(checkSle->getAccountID(sfSponsor) == sponsor1.id());
+            auto sponsor1Sle = env.le(keylet::sponsorship(sponsor1, alice));
+            BEAST_EXPECT(sponsor1Sle->getFieldU32(sfRemainingOwnerCount) == 99);
+
+            // Reassign to the current sponsor is rejected and must not draw
+            // down the pre-funded reserve budget
+            env(sponsor::transfer(alice, tfSponsorshipReassign, checkId),
+                sponsor::As(sponsor1, spfSponsorReserve),
+                Ter(tecNO_PERMISSION));
+            env.close();
+
+            sponsor1Sle = env.le(keylet::sponsorship(sponsor1, alice));
+            BEAST_EXPECT(sponsor1Sle->getFieldU32(sfRemainingOwnerCount) == 99);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 1);
+
+            // transfer sponsor
+            env(sponsor::set_reserve(sponsor2, 0, 100), sponsor::SponseeAcc(alice));
+            env.close();
+
+            env(sponsor::transfer(alice, tfSponsorshipReassign, checkId),
+                sponsor::As(sponsor2, spfSponsorReserve));
+            env.close();
+
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 0);
+            checkSle = env.le(keylet::unchecked(checkId));
+            BEAST_EXPECT(checkSle->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(checkSle->getAccountID(sfSponsor) == sponsor2.id());
+            sponsor1Sle = env.le(keylet::sponsorship(sponsor1, alice));
+            BEAST_EXPECT(sponsor1Sle->getFieldU32(sfRemainingOwnerCount) == 99);
+            auto sponsor2Sle = env.le(keylet::sponsorship(sponsor2, alice));
+            BEAST_EXPECT(sponsor2Sle->getFieldU32(sfRemainingOwnerCount) == 99);
+
+            // dissolve sponsor
+            adjustAccountXRPBalance(env, alice, reserve(env, 1));
+            env(sponsor::transfer(alice, tfSponsorshipEnd, checkId));
+            env.close();
+
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor1) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 0);
+            BEAST_EXPECT(
+                !env.le(keylet::account(sponsor2))->isFieldPresent(sfSponsoringOwnerCount));
+            checkSle = env.le(keylet::unchecked(checkId));
+            BEAST_EXPECT(!checkSle->isFieldPresent(sfSponsor));
+            sponsor2Sle = env.le(keylet::sponsorship(sponsor2, alice));
+            BEAST_EXPECT(sponsor2Sle->getFieldU32(sfRemainingOwnerCount) == 99);
+        }
+
+        {
+            // Dissolve object sponsorship from sponsor(no-ltSponsorship)
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(check::create(alice, bob, XRP(1)));
+            env.close();
+
+            auto const checkId = keylet::check(alice, seq).key;
+            BEAST_EXPECT(env.le(keylet::unchecked(checkId)) != nullptr);
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            BEAST_EXPECT(
+                env.le(keylet::unchecked(checkId))->getAccountID(sfSponsor) == sponsor.id());
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+            // not the owner of the object
+            env(sponsor::transfer(sponsor, tfSponsorshipEnd, checkId), Ter(tecNO_PERMISSION));
+            env.close();
+
+            env(sponsor::transfer(sponsor, tfSponsorshipEnd, checkId), sponsor::SponseeAcc(alice));
+            env.close();
+
+            BEAST_EXPECT(!env.le(keylet::unchecked(checkId))->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        }
+
+        {
+            // Dissolve object sponsorship from sponsor (with ltSponsorship)
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(check::create(alice, bob, XRP(1)));
+            env.close();
+
+            auto const checkId = keylet::check(alice, seq).key;
+            BEAST_EXPECT(env.le(keylet::unchecked(checkId)) != nullptr);
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate, checkId),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            env(sponsor::set_reserve(sponsor, 0, 100), sponsor::SponseeAcc(alice));
+            env.close();
+
+            BEAST_EXPECT(
+                env.le(keylet::unchecked(checkId))->getAccountID(sfSponsor) == sponsor.id());
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+            BEAST_EXPECT(
+                env.le(keylet::sponsorship(sponsor, alice))->getFieldU32(sfRemainingOwnerCount) ==
+                100);
+
+            // not the owner of the object
+            env(sponsor::transfer(sponsor, tfSponsorshipEnd, checkId), Ter(tecNO_PERMISSION));
+            env.close();
+
+            env(sponsor::transfer(sponsor, tfSponsorshipEnd, checkId), sponsor::SponseeAcc(alice));
+            env.close();
+
+            BEAST_EXPECT(!env.le(keylet::unchecked(checkId))->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(
+                env.le(keylet::sponsorship(sponsor, alice))->getFieldU32(sfRemainingOwnerCount) ==
+                100);
+        }
+
+        {
+            // sponsor trustline
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+
+            auto const& highAcc = alice > bob ? alice : bob;
+            auto const& lowAcc = alice > bob ? bob : alice;
+
+            for (bool const isIssuerHigh : {false, true})
+            {
+                Env env{*this, testableAmendments()};
+                env.fund(XRP(10000), alice, bob, sponsor);
+                env.close();
+
+                auto const& issuer = isIssuerHigh ? highAcc : lowAcc;
+                auto const& user = isIssuerHigh ? lowAcc : highAcc;
+
+                auto const usd = issuer["usd"];
+                auto const currency = usd.currency;
+
+                env(trust(user, issuer["usd"](100)));
+                env.close();
+
+                auto const trustId = keylet::trustLine(user, issuer, currency);
+                BEAST_EXPECT(env.le(trustId));
+
+                // transfer sponsor
+                env(sponsor::transfer(user, tfSponsorshipCreate, trustId.key),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor));
+                env.close();
+
+                BEAST_EXPECT(env.le(trustId));
+
+                BEAST_EXPECT(
+                    env.le(trustId)->getAccountID(isIssuerHigh ? sfLowSponsor : sfHighSponsor) ==
+                    sponsor.id());
+                BEAST_EXPECT(
+                    !env.le(trustId)->isFieldPresent(isIssuerHigh ? sfHighSponsor : sfLowSponsor));
+
+                // dissolve sponsor
+                env(sponsor::transfer(user, tfSponsorshipEnd, trustId.key));
+                env.close();
+
+                BEAST_EXPECT(env.le(trustId));
+                BEAST_EXPECT(
+                    !env.le(trustId)->isFieldPresent(isIssuerHigh ? sfLowSponsor : sfHighSponsor));
+                BEAST_EXPECT(
+                    !env.le(trustId)->isFieldPresent(isIssuerHigh ? sfHighSponsor : sfLowSponsor));
+            }
+        }
+
+        {
+            // invalid transfer
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // create owner dir
+            env(ticket::create(alice, 1));
+            env.close();
+
+            // AccountRoot
+            // Amendments
+            // LedgerHashes
+            // FeeSettings
+            // NegativeUNL
+            // DirNode
+            auto const keylets = {
+                keylet::account(alice),
+                // keylet::amendments(),
+                keylet::skip(),
+                keylet::feeSettings(),
+                // keylet::negativeUNL(),
+                keylet::ownerDir(alice),
+            };
+            for (auto const& keylet : keylets)
+            {
+                env(sponsor::transfer(alice, tfSponsorshipCreate, keylet.key),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(tecNO_PERMISSION));
+            }
+        }
+
+        {
+            // existing owner objects that are outside the v1 SponsorshipTransfer
+            // object allow-list
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, sponsor);
+            env.close();
+
+            auto const checkBlocked = [&](Account const& account, uint256 const& objectID) {
+                env(sponsor::transfer(account, tfSponsorshipCreate, objectID),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(tecNO_PERMISSION));
+                env.close();
+            };
+
+            auto const ticketSeq = env.seq(alice);
+            env(ticket::create(alice, 1));
+            env.close();
+            auto const ticketID = keylet::ticket(alice, ticketSeq + 1).key;
+            BEAST_EXPECT(env.le(keylet::unchecked(ticketID)));
+            checkBlocked(alice, ticketID);
+
+            env(did::setValid(alice));
+            env.close();
+            auto const didKeylet = keylet::did(alice.id());
+            BEAST_EXPECT(env.le(didKeylet));
+            checkBlocked(alice, didKeylet.key);
+
+            env(token::mint(alice, 0u));
+            env.close();
+            auto const nftPageKeylet = keylet::nftokenPageMax(alice);
+            BEAST_EXPECT(env.le(nftPageKeylet));
+            checkBlocked(alice, nftPageKeylet.key);
+
+            Account const borrower("borrower");
+            env.fund(XRP(1000000), borrower);
+            env.close();
+
+            PrettyAsset const xrpAsset{xrpIssue(), 1'000'000};
+            Vault const vault{env};
+            auto [vaultTx, vaultKeylet] = vault.create({.owner = alice, .asset = xrpAsset});
+            env(vaultTx);
+            env.close();
+
+            env(vault.deposit(
+                {.depositor = alice, .id = vaultKeylet.key, .amount = xrpAsset(1000)}));
+            env.close();
+
+            auto const brokerKeylet = keylet::loanBroker(alice.id(), env.seq(alice));
+            env(loanBroker::set(alice, vaultKeylet.key),
+                loanBroker::kDebtMaximum(xrpAsset(1000).value()),
+                loanBroker::kManagementFeeRate(TenthBips16{0}),
+                loanBroker::kCoverRateMinimum(TenthBips32{0}),
+                loanBroker::kCoverRateLiquidation(TenthBips32{0}));
+            env.close();
+
+            auto const loanKeylet = keylet::loan(brokerKeylet.key, 1);
+            env(loan::set(borrower, brokerKeylet.key, xrpAsset(100).value()),
+                Sig(sfCounterpartySignature, alice),
+                Fee(env.current()->fees().base * 2));
+            env.close();
+            BEAST_EXPECT(env.le(loanKeylet));
+            checkBlocked(borrower, loanKeylet.key);
+        }
+    }
+
+    void
+    testSponsorFee()
+    {
+        using namespace test::jtx;
+
+        testcase("Sponsor Fee");
+
+        {
+            // co-signing
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob);
+            env.close();
+
+            {
+                // Fee should be checked before sponsor permission, otherwise a tec
+                // result from a later check could cause context reset to pay Fee.
+                auto aliceBalance = env.balance(alice);
+                auto bobBalance = env.balance(bob);
+                auto sponsorBalance = env.balance(sponsor);
+
+                env(pay(alice, bob, XRP(100)),
+                    Fee(XRP(2000)),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(terNO_ACCOUNT));
+                env.close();
+                BEAST_EXPECT(env.balance(alice) == aliceBalance);
+                BEAST_EXPECT(env.balance(bob) == bobBalance);
+                BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+            }
+
+            env.fund(XRP(1000), sponsor);
+            env.close();
+
+            {
+                // Sponsor pays the Fee
+                auto aliceBalance = env.balance(alice);
+                auto bobBalance = env.balance(bob);
+                auto sponsorBalance = env.balance(sponsor);
+
+                auto const sendAmt = XRP(100);
+                auto const feeAmt = XRP(10);
+                env(pay(alice, bob, sendAmt),
+                    Fee(feeAmt),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Sig(sfSponsorSignature, sponsor));
+                env.close();
+                BEAST_EXPECT(env.balance(alice) == aliceBalance - sendAmt);
+                BEAST_EXPECT(env.balance(bob) == bobBalance + sendAmt);
+                BEAST_EXPECT(env.balance(sponsor) == sponsorBalance - feeAmt);
+            }
+
+            {
+                // insufficient balance to pay Fee
+                auto aliceBalance = env.balance(alice);
+                auto bobBalance = env.balance(bob);
+                auto sponsorBalance = env.balance(sponsor);
+
+                env(pay(alice, bob, XRP(100)),
+                    Fee(XRP(2000)),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(terINSUF_FEE_B));
+                env.close();
+                BEAST_EXPECT(env.balance(alice) == aliceBalance);
+                BEAST_EXPECT(env.balance(bob) == bobBalance);
+                BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+            }
+
+            {
+                // Fee is paid by Sponsor
+                // on context reset (tec error)
+                auto aliceBalance = env.balance(alice);
+                auto bobBalance = env.balance(bob);
+                auto sponsorBalance = env.balance(sponsor);
+                auto const feeAmt = XRP(10);
+
+                env(pay(alice, bob, XRP(20000)),
+                    Fee(feeAmt),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(tecUNFUNDED_PAYMENT));
+                env.close();
+
+                BEAST_EXPECT(env.balance(alice) == aliceBalance);
+                BEAST_EXPECT(env.balance(bob) == bobBalance);
+                BEAST_EXPECT(env.balance(sponsor) == sponsorBalance - feeAmt);
+            }
+
+            {
+                // A co-signed sponsor pays the fee from its own balance, but
+                // must never be charged into its own account reserve. With a
+                // balance of exactly reserve + fee the fee is still payable,
+                // charging the sponsor down to precisely its reserve.
+                auto const feeAmt = XRP(10);
+                adjustAccountXRPBalance(env, sponsor, reserve(env, 0) + feeAmt);
+                auto const sponsorBalance = env.balance(sponsor);
+
+                env(noop(alice),
+                    Fee(feeAmt),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(tesSUCCESS));
+                env.close();
+
+                BEAST_EXPECT(env.balance(sponsor) == sponsorBalance - feeAmt);
+                BEAST_EXPECT(env.balance(sponsor) == reserve(env, 0));
+            }
+
+            {
+                // below reserve
+                adjustAccountXRPBalance(env, sponsor, env.current()->fees().reserve);
+
+                env(noop(alice),
+                    Fee(env.current()->fees().base),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(terINSUF_FEE_B));
+                env.close();
+
+                env(noop(alice),
+                    Fee(XRP(10)),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(terINSUF_FEE_B));
+                env.close();
+            }
+        }
+
+        {
+            // pre funded
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            {
+                // Fee should be checked before sponsor permission, otherwise a tec
+                // result from a later check could cause context reset to pay Fee.
+                auto aliceBalance = env.balance(alice);
+                auto bobBalance = env.balance(bob);
+                auto sponsorBalance = env.balance(sponsor);
+
+                env(pay(alice, bob, XRP(100)),
+                    Fee(XRP(2000)),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Ter(terNO_PERMISSION));
+                env.close();
+                BEAST_EXPECT(env.balance(alice) == aliceBalance);
+                BEAST_EXPECT(env.balance(bob) == bobBalance);
+                BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+            }
+
+            env(sponsor::set_fee(sponsor, 0, XRP(100)), sponsor::SponseeAcc(alice));
+            env.close();
+
+            {
+                // Sponsor pays the Fee
+                auto aliceBalance = env.balance(alice);
+                auto bobBalance = env.balance(bob);
+                auto sponsorBalance = env.balance(sponsor);
+                auto sponsorFee = sponsor::sponsorshipFeeBalance(env, sponsor, alice);
+
+                auto const sendAmt = XRP(100);
+                auto const feeAmt = XRP(10);
+                env(pay(alice, bob, sendAmt), Fee(feeAmt), sponsor::As(sponsor, spfSponsorFee));
+                env.close();
+
+                BEAST_EXPECT(env.balance(alice) == aliceBalance - sendAmt);
+                BEAST_EXPECT(env.balance(bob) == bobBalance + sendAmt);
+                BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+                BEAST_EXPECT(
+                    sponsor::sponsorshipFeeBalance(env, sponsor, alice) == sponsorFee - feeAmt);
+            }
+
+            {
+                // insufficient balance to pay Fee
+                {
+                    // > FeeAmount
+                    auto aliceBalance = env.balance(alice);
+                    auto bobBalance = env.balance(bob);
+                    auto sponsorBalance = env.balance(sponsor);
+                    auto sponsorFee = sponsor::sponsorshipFeeBalance(env, sponsor, alice);
+
+                    env(pay(alice, bob, XRP(100)),
+                        Fee(XRP(90) + drops(1)),
+                        sponsor::As(sponsor, spfSponsorFee),
+                        Ter(terINSUF_FEE_B));
+                    env.close();
+
+                    BEAST_EXPECT(env.balance(alice) == aliceBalance);
+                    BEAST_EXPECT(env.balance(bob) == bobBalance);
+                    BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+                    BEAST_EXPECT(sponsor::sponsorshipFeeBalance(env, sponsor, alice) == sponsorFee);
+                }
+                // use all FeeAmount
+                {
+                    // = FeeAmount
+                    auto aliceBalance = env.balance(alice);
+                    auto bobBalance = env.balance(bob);
+                    auto sponsorBalance = env.balance(sponsor);
+
+                    env(pay(alice, bob, XRP(100)),
+                        Fee(XRP(90)),
+                        sponsor::As(sponsor, spfSponsorFee),
+                        Ter(tesSUCCESS));
+                    env.close();
+
+                    BEAST_EXPECT(env.balance(alice) == aliceBalance - XRP(100));
+                    BEAST_EXPECT(env.balance(bob) == bobBalance + XRP(100));
+                    BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+                    BEAST_EXPECT(
+                        !env.le(keylet::sponsorship(sponsor, alice))->isFieldPresent(sfFeeAmount));
+                }
+
+                // reset FeeAmount and MaxFee
+                env(sponsor::del(sponsor), sponsor::SponseeAcc(alice));
+                env.close();
+                env(sponsor::set_fee(sponsor, 0, XRP(10), XRP(1)), sponsor::SponseeAcc(alice));
+                env.close();
+
+                {
+                    // > MaxFee
+                    auto aliceBalance = env.balance(alice);
+                    auto bobBalance = env.balance(bob);
+                    auto sponsorBalance = env.balance(sponsor);
+                    auto sponsorFee = sponsor::sponsorshipFeeBalance(env, sponsor, alice);
+
+                    env(pay(alice, bob, XRP(100)),
+                        Fee(XRP(1) + drops(1)),
+                        sponsor::As(sponsor, spfSponsorFee),
+                        Ter(terINSUF_FEE_B));
+                    env.close();
+
+                    BEAST_EXPECT(env.balance(alice) == aliceBalance);
+                    BEAST_EXPECT(env.balance(bob) == bobBalance);
+                    BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+                    BEAST_EXPECT(sponsor::sponsorshipFeeBalance(env, sponsor, alice) == sponsorFee);
+                }
+            }
+
+            {
+                // Fee is paid by Sponsor
+                // on context reset (tec error)
+                auto aliceBalance = env.balance(alice);
+                auto bobBalance = env.balance(bob);
+                auto sponsorBalance = env.balance(sponsor);
+                auto sponsorFee = sponsor::sponsorshipFeeBalance(env, sponsor, alice);
+                auto const feeAmt = XRP(1);
+
+                env(pay(alice, bob, XRP(20000)),
+                    Fee(feeAmt),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Ter(tecUNFUNDED_PAYMENT));
+                env.close();
+
+                BEAST_EXPECT(env.balance(alice) == aliceBalance);
+                BEAST_EXPECT(env.balance(bob) == bobBalance);
+                BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+                BEAST_EXPECT(
+                    sponsor::sponsorshipFeeBalance(env, sponsor, alice) == sponsorFee - feeAmt);
+            }
+
+            // make sfFeeAmount absent if tec error and all Fee is paid
+            {
+                // reset FeeAmount and MaxFee
+                env(sponsor::del(sponsor), sponsor::SponseeAcc(alice));
+                env(sponsor::set_fee(sponsor, 0, XRP(10)), sponsor::SponseeAcc(alice));
+                env.close();
+
+                BEAST_EXPECT(
+                    env.le(keylet::sponsorship(sponsor, alice))->isFieldPresent(sfFeeAmount));
+                auto sponsorAvailableFee = sponsor::sponsorshipFeeBalance(env, sponsor, alice);
+                env(check::cancel(alice, uint256(1)),
+                    Fee(sponsorAvailableFee),
+                    sponsor::As(sponsor, spfSponsorFee),
+                    Ter(tecNO_ENTRY));
+                env.close();
+                BEAST_EXPECT(
+                    !env.le(keylet::sponsorship(sponsor, alice))->isFieldPresent(sfFeeAmount));
+            }
+        }
+
+        // MaxFee cap is enforced in reset() for tec-failing transactions.
+        // On a closed ledger view (!view.open()), checkFee returns tecINSUFF_FEE when
+        // Fee > MaxFee (not terINSUF_FEE_B), triggering reset()
+        {
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const carol("sponsor");
+
+            env.fund(XRP(10000), alice, carol);
+            env.close();
+
+            // FeeAmount=1000 drops, MaxFee=10 drops
+            env(sponsor::set_fee(carol, 0, drops(1000), drops(10)), sponsor::SponseeAcc(alice));
+            env.close();
+
+            // Apply directly against the closed ledger view (open_ = false) so that
+            // checkFee returns tecINSUFF_FEE and reset() is invoked.
+            OpenView overlay(&*env.closed());
+
+            auto jt = env.jt(
+                noop(alice),
+                Fee(drops(1000)),
+                Seq(env.seq(alice)),
+                sponsor::As(carol, spfSponsorFee));
+
+            auto const result = xrpl::apply(env.app(), overlay, *jt.stx, TapNone, env.journal);
+            BEAST_EXPECT(result.ter == tecINSUFF_FEE);
+            BEAST_EXPECT(result.applied);
+
+            // Only MaxFee (10 drops) must be deducted, not the full 1000 drops.
+            auto const sle = overlay.read(keylet::sponsorship(carol.id(), alice.id()));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->isFieldPresent(sfFeeAmount));
+            BEAST_EXPECT(sle->getFieldAmount(sfFeeAmount) == drops(990));  // 1000 - MaxFee(10)
+        }
+
+        // LedgerStateFix charges an owner-reserve fee and can claim that fee
+        // while returning tecFAILED_PROCESSING. That path must be safe when the
+        // fee is pre-funded by a sponsorship object.
+        {
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const sponsor("sponsor");
+            env.fund(XRP(1000), alice, sponsor);
+            env.close();
+
+            auto const fixFee = drops(env.current()->fees().increment);
+            env(sponsor::set_fee(sponsor, 0, fixFee), sponsor::SponseeAcc(alice));
+            env.close();
+
+            env(ledgerStateFix::nftPageLinks(alice, alice),
+                Fee(fixFee),
+                sponsor::As(sponsor, spfSponsorFee),
+                Ter(tecFAILED_PROCESSING));
+
+            if (auto const sle = env.le(keylet::sponsorship(sponsor, alice)); BEAST_EXPECT(sle))
+                BEAST_EXPECT(!sle->isFieldPresent(sfFeeAmount));
+        }
+
+        // If preclaim saw spendable sponsored FeeAmount but the apply view no
+        // longer has it, the fee path should fail cleanly instead of throwing.
+        {
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const sponsor("sponsor");
+            env.fund(XRP(1000), alice, sponsor);
+            env.close();
+
+            auto const fixFee = drops(env.current()->fees().increment);
+            env(sponsor::set_fee(sponsor, 0, fixFee), sponsor::SponseeAcc(alice));
+            env.close();
+
+            OpenView overlay(&*env.closed());
+            auto jt = env.jt(
+                ledgerStateFix::nftPageLinks(alice, alice),
+                Fee(fixFee),
+                sponsor::As(sponsor, spfSponsorFee));
+
+            auto const pf = preflight(env.app(), overlay.rules(), *jt.stx, TapNone, env.journal);
+            BEAST_EXPECT(isTesSuccess(pf.ter));
+            auto const pc = preclaim(pf, env.app(), overlay);
+            BEAST_EXPECT(isTesSuccess(pc.ter));
+
+            auto const original = overlay.read(keylet::sponsorship(sponsor, alice));
+            if (BEAST_EXPECT(original))
+            {
+                auto sle = std::make_shared<SLE>(*original);
+                sle->makeFieldAbsent(sfFeeAmount);
+                overlay.rawReplace(sle);
+            }
+
+            auto const result = doApply(pc, env.app(), overlay);
+            BEAST_EXPECT(result.ter == terINSUF_FEE_B);
+            BEAST_EXPECT(!result.applied);
+        }
+
+        // test lsfSponsorshipRequireSignForFee
+        {
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // set flag
+            env(sponsor::set_fee(sponsor, tfSponsorshipSetRequireSignForFee, XRP(10)),
+                sponsor::SponseeAcc(alice));
+            env.close();
+
+            env(pay(alice, bob, XRP(100)),
+                Fee(XRP(10)),
+                sponsor::As(sponsor, spfSponsorFee),
+                Ter(terNO_PERMISSION));
+            env.close();
+
+            BEAST_EXPECT(
+                env.le(keylet::sponsorship(sponsor, alice))->getFieldAmount(sfFeeAmount) ==
+                XRP(10));
+
+            // clear flag
+            env(sponsor::set_fee(sponsor, tfSponsorshipClearRequireSignForFee, XRP(10)),
+                sponsor::SponseeAcc(alice));
+            env.close();
+
+            // Payment is re-applied
+            BEAST_EXPECT(!env.le(keylet::sponsorship(sponsor, alice))->isFieldPresent(sfFeeAmount));
+        }
+
+        // RequireSignForFee: co-signing should succeed
+        {
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // set flag
+            env(sponsor::set_fee(sponsor, tfSponsorshipSetRequireSignForFee, XRP(10)),
+                sponsor::SponseeAcc(alice));
+            env.close();
+
+            // pre-funded (no sig) should fail
+            env(pay(alice, bob, XRP(100)),
+                Fee(XRP(1)),
+                sponsor::As(sponsor, spfSponsorFee),
+                Ter(terNO_PERMISSION));
+            env.close();
+
+            // co-signing (with sig) should succeed
+            env(pay(alice, bob, XRP(100)),
+                Fee(XRP(1)),
+                sponsor::As(sponsor, spfSponsorFee),
+                Sig(sfSponsorSignature, sponsor),
+                Ter(tesSUCCESS));
+            env.close();
+
+            BEAST_EXPECT(
+                env.le(keylet::sponsorship(sponsor, alice))->getFieldAmount(sfFeeAmount) == XRP(9));
+        }
+    }
+
+    void
+    testSponsorAccount()
+    {
+        testcase("Sponsor Account");
+        using namespace test::jtx;
+
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+        Account const sponsor3("sponsor3");
+        Account const bob("bob");
+        Account const charlie("charlie");
+        Account const dave("dave");
+        Account const gw("gw");
+        auto const usd = gw["usd"];
+
+        {
+            // Disabled
+            Env env{*this, testableAmendments() - featureSponsor};
+            env.fund(XRP(10000), alice, sponsor);
+            env.close();
+            env(pay(alice, bob, XRP(100)), Txflags(tfSponsorCreatedAccount), Ter(temDISABLED));
+            env.close();
+        }
+
+        Env env{*this, testableAmendments()};
+        env.fund(XRP(10000), alice, sponsor, sponsor2, sponsor3);
+        env.close();
+
+        // Invalid flags
+        for (auto flag : {
+                 tfNoRippleDirect,
+                 tfPartialPayment,
+                 tfLimitQuality,
+             })
+        {
+            env(pay(alice, bob, XRP(100)),
+                Txflags(tfSponsorCreatedAccount | flag),
+                Ter(temINVALID_FLAG));
+            env.close();
+        }
+
+        // Invalid amount(iou)
+        env(pay(alice, bob, usd(100)), Txflags(tfSponsorCreatedAccount), Ter(temBAD_AMOUNT));
+        env.close();
+
+        // Sponsored account creation is reserve sponsorship and is only supported for direct XRP
+        // payments.
+        env(pay(alice, bob, drops(1)),
+            Txflags(tfSponsorCreatedAccount),
+            Sendmax(usd(2)),
+            Ter(temINVALID));
+        env.close();
+
+        env(pay(alice, bob, drops(1)),
+            Txflags(tfSponsorCreatedAccount),
+            Path(~XRP),
+            Ter(temINVALID));
+        env.close();
+
+        // Account is not sponsored by normal Sponsor specification
+        {
+            env(pay(alice, bob, drops(env.current()->fees().accountReserve(0, 1))),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            auto const bobSle = env.le(keylet::account(bob));
+            BEAST_EXPECT(!bobSle->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor) == 0);
+        }
+
+        // Use tfSponsorCreatedAccount to sponsor an account
+        {
+            // to funded account
+            env(pay(sponsor2, bob, drops(1)),
+                Txflags(tfSponsorCreatedAccount),
+                Fee(XRP(1)),
+                Ter(tecNO_SPONSOR_PERMISSION));
+            env.close();
+
+            BEAST_EXPECT(env.balance(sponsor2) == XRP(9999));
+
+            // to non-funded account / insufficient balance for reserve
+            env(pay(sponsor2, charlie, XRP(9999) - env.current()->fees().reserve + drops(1)),
+                Txflags(tfSponsorCreatedAccount),
+                Ter(tecUNFUNDED_PAYMENT));
+            env.close();
+
+            // to non-funded account
+            auto const sponsor2BalanceBefore = env.balance(sponsor2);
+            env(pay(sponsor2, charlie, drops(1)), Txflags(tfSponsorCreatedAccount), Fee(XRP(1)));
+            env.close();
+
+            auto const charlieSle = env.le(keylet::account(charlie));
+            BEAST_EXPECT(charlieSle->isFieldPresent(sfSponsor));
+            BEAST_EXPECT(charlieSle->getAccountID(sfSponsor) == sponsor2.id());
+            BEAST_EXPECT(sponsoredOwnerCount(env, charlie) == 0);
+            BEAST_EXPECT(sponsoringAccountCount(env, sponsor2) == 1);
+            // verify sponsor balance decreased by payment + Fee
+            BEAST_EXPECT(env.balance(sponsor2) == sponsor2BalanceBefore - drops(1) - XRP(1));
+        }
+        {
+            // insufficient reserve to sponsor acount
+
+            auto const sendAmount = drops(1);
+            // 2 account reserve + send amount
+            auto const requireBalance = accountReserve(env, 2) + sendAmount;
+            adjustAccountXRPBalance(env, sponsor3, requireBalance - drops(1));
+            env(pay(sponsor3, dave, sendAmount),
+                Txflags(tfSponsorCreatedAccount),
+                Fee(XRP(1)),
+                Ter(tecUNFUNDED_PAYMENT));
+            env.close();
+
+            adjustAccountXRPBalance(env, sponsor3, requireBalance);
+            env(pay(sponsor3, dave, sendAmount),
+                Txflags(tfSponsorCreatedAccount),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+        }
+    }
+
+    void
+    testRequireFlag()
+    {
+        using namespace test::jtx;
+        {
+            testcase("SponsorshipRequireSignForReserve");
+
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // set flag
+            env(sponsor::set_reserve(sponsor, tfSponsorshipSetRequireSignForReserve, 10),
+                sponsor::SponseeAcc(alice));
+            env.close();
+
+            env(check::create(alice, bob, XRP(100)),
+                Fee(XRP(10)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Ter(terNO_PERMISSION));
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+
+            // clear flag
+            env(sponsor::set_reserve(sponsor, tfSponsorshipClearRequireSignForReserve, 1),
+                sponsor::SponseeAcc(alice));
+            env.close();
+
+            // CheckCreate is re-applied
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+        }
+
+        {
+            testcase("SponsorshipRequireSignForFee");
+
+            Env env{*this, testableAmendments()};
+            Account const alice("alice");
+            Account const bob("bob");
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // set flag
+            env(sponsor::set_fee(sponsor, tfSponsorshipSetRequireSignForFee, XRP(10)),
+                sponsor::SponseeAcc(alice));
+            env.close();
+
+            env(check::create(alice, bob, XRP(100)),
+                Fee(XRP(10)),
+                sponsor::As(sponsor, spfSponsorFee),
+                Ter(terNO_PERMISSION));
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(
+                env.le(keylet::sponsorship(sponsor, alice))->getFieldAmount(sfFeeAmount) ==
+                XRP(10));
+
+            // clear flag
+            env(sponsor::set_fee(sponsor, tfSponsorshipClearRequireSignForFee, XRP(10)),
+                sponsor::SponseeAcc(alice));
+            env.close();
+
+            // CheckCreate is re-applied
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(!env.le(keylet::sponsorship(sponsor, alice))->isFieldPresent(sfFeeAmount));
+        }
+    }
+
+    void
+    testSponsorReserveSimple(bool cosigning)
+    {
+        testcase("SponsorReserveSimple");
+        using namespace test::jtx;
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+
+        env.fund(XRP(10000), alice, bob, sponsor);
+        env.close();
+
+        if (cosigning)
+        {
+            adjustAccountXRPBalance(env, sponsor, reserve(env, 1) - drops(1));
+
+            env(check::create(alice, bob, XRP(100)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor),
+                Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+
+            adjustAccountXRPBalance(env, sponsor, reserve(env, 1));
+
+            env(check::create(alice, bob, XRP(100)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor),
+                Ter(tesSUCCESS));
+            env.close();
+        }
+        else
+        {
+            env(sponsor::set_reserve(sponsor, 0, 250), sponsor::SponseeAcc(alice));
+            env.close();
+
+            adjustAccountXRPBalance(env, sponsor, reserve(env, 2) - drops(1));
+
+            env(check::create(alice, bob, XRP(100)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Ter(tecINSUFFICIENT_RESERVE));
+            env.close();
+
+            adjustAccountXRPBalance(env, sponsor, reserve(env, 2));
+
+            env(check::create(alice, bob, XRP(100)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Ter(tesSUCCESS));
+            env.close();
+        }
+    }
+
+    // test helper for both cosigning and pre-funded sponsorship
+    template <typename SubmitCallback>
+    void
+    testEachSponsorship(
+        test::jtx::Env& env,
+        bool cosigning,
+        jtx::Account const& sponsor,
+        jtx::Account const& sponsee,
+        uint32_t reserveCount,
+        uint32_t sponsorReserveCount,
+        TER insufficientReserveResult,
+        SubmitCallback callback,
+        std::optional<std::function<void()>> expected = std::nullopt)
+    {
+        using namespace test::jtx;
+        auto const sponseeOwnerCountBefore = ownerCount(env, sponsee);
+        auto const sponseeSponsoredOwnerCountBefore = sponsoredOwnerCount(env, sponsee);
+        auto const sponseeSponsoringOwnerCountBefore = sponsoringOwnerCount(env, sponsee);
+        auto const sponsorOwnerCountBefore = ownerCount(env, sponsor);
+        auto const sponsorSponsoredOwnerCountBefore = sponsoredOwnerCount(env, sponsor);
+        auto const sponsorSponsoringOwnerCountBefore = sponsoringOwnerCount(env, sponsor);
+
+        std::optional<Sig> sponsorSig =
+            cosigning ? std::optional<Sig>(Sig(sfSponsorSignature, sponsor)) : std::nullopt;
+
+        auto const sponsorCurrentOwnerCount = ownerCount(env, sponsor) -
+            sponsoredOwnerCount(env, sponsor) + sponsoringOwnerCount(env, sponsor);
+
+        auto submit = [&](TER ter) {
+            return [&, ter](json::Value const& jv, auto const&... fN) {
+                if (sponsorSig)
+                {
+                    env(jv, fN..., sponsor::As(sponsor, spfSponsorReserve), *sponsorSig, Ter(ter));
+                }
+                else
+                {
+                    env(jv, fN..., sponsor::As(sponsor, spfSponsorReserve), Ter(ter));
+                }
+            };
+        };
+
+        // Insufficient Reserve
+        {
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(
+                    env,
+                    sponsor,
+                    reserve(env, sponsorCurrentOwnerCount + sponsorReserveCount) - drops(1));
+            }
+            else
+            {
+                // cleanup previous sponsorship
+                if (env.le(keylet::sponsorship(sponsor, sponsee)))
+                {
+                    env(sponsor::del(sponsor), sponsor::SponseeAcc(sponsee));
+                    env.close();
+                }
+
+                if (sponsorReserveCount > 1)
+                {
+                    env(sponsor::set(sponsor, 0, sponsorReserveCount - 1, XRP(1)),
+                        sponsor::SponseeAcc(sponsee));
+                }
+                else
+                {
+                    // just create sponsor object
+                    env(sponsor::set(sponsor, 0, std::nullopt, XRP(1)),
+                        sponsor::SponseeAcc(sponsee));
+                }
+                env.close();
+            }
+
+            // A failed sponsored create must not consume prefunded reserve or mutate owner counts.
+            auto const sponseeOwnerCountBeforeAttempt = ownerCount(env, sponsee);
+            auto const sponseeSponsoredOwnerCountBeforeAttempt = sponsoredOwnerCount(env, sponsee);
+            auto const sponseeSponsoringOwnerCountBeforeAttempt =
+                sponsoringOwnerCount(env, sponsee);
+            auto const sponsorOwnerCountBeforeAttempt = ownerCount(env, sponsor);
+            auto const sponsorSponsoredOwnerCountBeforeAttempt = sponsoredOwnerCount(env, sponsor);
+            auto const sponsorSponsoringOwnerCountBeforeAttempt =
+                sponsoringOwnerCount(env, sponsor);
+            auto const sponsorshipSleBeforeAttempt = env.le(keylet::sponsorship(sponsor, sponsee));
+            bool const reserveCountPresentBeforeAttempt = sponsorshipSleBeforeAttempt &&
+                sponsorshipSleBeforeAttempt->isFieldPresent(sfRemainingOwnerCount);
+            std::uint32_t const reserveCountBeforeAttempt = reserveCountPresentBeforeAttempt
+                ? sponsorshipSleBeforeAttempt->getFieldU32(sfRemainingOwnerCount)
+                : 0;
+
+            callback(env, submit(insufficientReserveResult));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, sponsee) == sponseeOwnerCountBeforeAttempt);
+            BEAST_EXPECT(
+                sponsoredOwnerCount(env, sponsee) == sponseeSponsoredOwnerCountBeforeAttempt);
+            BEAST_EXPECT(
+                sponsoringOwnerCount(env, sponsee) == sponseeSponsoringOwnerCountBeforeAttempt);
+            BEAST_EXPECT(ownerCount(env, sponsor) == sponsorOwnerCountBeforeAttempt);
+            BEAST_EXPECT(
+                sponsoredOwnerCount(env, sponsor) == sponsorSponsoredOwnerCountBeforeAttempt);
+            BEAST_EXPECT(
+                sponsoringOwnerCount(env, sponsor) == sponsorSponsoringOwnerCountBeforeAttempt);
+
+            auto const sponsorshipSleAfterAttempt = env.le(keylet::sponsorship(sponsor, sponsee));
+            BEAST_EXPECT(
+                static_cast<bool>(sponsorshipSleAfterAttempt) ==
+                static_cast<bool>(sponsorshipSleBeforeAttempt));
+            if (sponsorshipSleAfterAttempt)
+            {
+                BEAST_EXPECT(
+                    sponsorshipSleAfterAttempt->isFieldPresent(sfRemainingOwnerCount) ==
+                    reserveCountPresentBeforeAttempt);
+                if (reserveCountPresentBeforeAttempt)
+                {
+                    BEAST_EXPECT(
+                        sponsorshipSleAfterAttempt->getFieldU32(sfRemainingOwnerCount) ==
+                        reserveCountBeforeAttempt);
+                }
+            }
+        }
+
+        // Success
+        {
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(
+                    env, sponsor, reserve(env, sponsorCurrentOwnerCount + sponsorReserveCount));
+            }
+            else
+            {
+                // reset sponsorship
+                env(sponsor::del(sponsor), sponsor::SponseeAcc(sponsee));
+                env(sponsor::set(sponsor, 0, sponsorReserveCount, XRP(1)),
+                    sponsor::SponseeAcc(sponsee));
+                env.close();
+            }
+            callback(env, submit(tesSUCCESS));
+            env.close();
+
+            if (!cosigning)
+            {
+                // Prefunded success consumes the reserved owner slot before cleanup.
+                auto const sponsorshipSle = env.le(keylet::sponsorship(sponsor, sponsee));
+                BEAST_EXPECT(sponsorshipSle);
+                BEAST_EXPECT(
+                    !sponsorshipSle->isFieldPresent(sfRemainingOwnerCount) ||
+                    sponsorshipSle->getFieldU32(sfRemainingOwnerCount) == 0);
+
+                // cleanup sponsorship
+                env(sponsor::del(sponsor), sponsor::SponseeAcc(sponsee));
+                env.close();
+            }
+        }
+
+        if (expected)
+        {
+            (*expected)();
+        }
+        else
+        {
+            BEAST_EXPECT(ownerCount(env, sponsee) - sponseeOwnerCountBefore == reserveCount);
+            BEAST_EXPECT(
+                sponsoredOwnerCount(env, sponsee) - sponseeSponsoredOwnerCountBefore ==
+                sponsorReserveCount);
+            BEAST_EXPECT(
+                sponsoringOwnerCount(env, sponsee) - sponseeSponsoringOwnerCountBefore == 0);
+            BEAST_EXPECT(ownerCount(env, sponsor) == sponsorOwnerCountBefore);
+            BEAST_EXPECT(sponsoredOwnerCount(env, sponsor) == sponsorSponsoredOwnerCountBefore);
+            BEAST_EXPECT(
+                sponsoringOwnerCount(env, sponsor) - sponsorSponsoringOwnerCountBefore ==
+                sponsorReserveCount);
+        }
+    };
+
+    void
+    testCheck(bool cosigning)
+    {
+        testcase("Check");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const gw("gw");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+
+        auto const usd = gw["usd"];
+
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, sponsor, sponsor2);
+            env.close();
+
+            // CheckCreate -> Check -> CheckCancel
+
+            uint32_t seq = 0;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    seq = env.seq(alice);
+                    submit(check::create(alice, bob, XRP(1)));
+                });
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);  // Check
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+            auto const keylet = keylet::check(alice, seq);
+            BEAST_EXPECT(env.le(keylet)->getAccountID(sfSponsor) == sponsor.id());
+
+            if (cosigning)
+            {
+                // transfer sponsor
+                env(sponsor::transfer(alice, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+                env.close();
+
+                // transfer sponsor
+                env(sponsor::transfer(alice, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+            }
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);  // Check
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+
+            BEAST_EXPECT(env.le(keylet)->getAccountID(sfSponsor) == sponsor2.id());
+
+            // CheckCancel
+            env(check::cancel(alice, keylet.key));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+        }
+
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // CheckCreate -> CheckCash
+            uint32_t seq2 = 0;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    seq2 = env.seq(alice);
+                    submit(check::create(alice, bob, XRP(1)));
+                });
+
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);
+
+            // CheckCash
+            auto const checkId2 = keylet::check(alice, seq2).key;
+            env(check::cash(bob, checkId2, XRP(1)));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        }
+
+        // RippleState sponsor (CheckCashMakesTrustLine)
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, gw, sponsor, sponsor2);
+            env.close();
+
+            env.trust(usd(100), alice);
+            env.close();
+            env(pay(gw, alice, usd(100)));
+            env.close();
+
+            // CheckCreate -> CheckCash
+            uint32_t seq2 = 0;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    seq2 = env.seq(alice);
+                    submit(check::create(alice, bob, usd(1)));
+                });
+
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);
+
+            auto const keylet = keylet::check(alice, seq2);
+            BEAST_EXPECT(env.le(keylet)->getAccountID(sfSponsor) == sponsor.id());
+
+            // CheckCash
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                bob,
+                1,
+                1,
+                tecNO_LINE_INSUF_RESERVE,
+                [&](Env& env, auto const& submit) { submit(check::cash(bob, keylet.key, usd(1))); },
+                [&]() {
+                    BEAST_EXPECT(ownerCount(env, alice) == 1);  // RippleState
+                    BEAST_EXPECT(ownerCount(env, bob) == 1);    // RippleState
+                    BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+                    BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+                    BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+                    // the newly-created trust line carries the sponsor on
+                    // bob's side, and no sponsor on the counterparty side
+                    bool const bobLow = bob.id() < gw.id();
+                    auto const lineSle = env.le(keylet::trustLine(bob, gw, usd.currency));
+                    BEAST_EXPECT(lineSle);
+                    if (lineSle)
+                    {
+                        BEAST_EXPECT(
+                            lineSle->getAccountID(bobLow ? sfLowSponsor : sfHighSponsor) ==
+                            sponsor.id());
+                        BEAST_EXPECT(
+                            !lineSle->isFieldPresent(bobLow ? sfHighSponsor : sfLowSponsor));
+                    }
+                });
+        }
+
+        // MPT sponsor: cashing an MPT check creates a sponsored MPToken for
+        // the casher. Unlike the trust-line path, this returns
+        // tecINSUFFICIENT_RESERVE (not tecNO_LINE_INSUF_RESERVE) on shortfall.
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), bob, sponsor, sponsor2);
+            env.close();
+
+            MPTTester mptGw(env, gw, {.holders = {alice}});
+            mptGw.create({.ownerCount = 1, .holderCount = 0, .flags = tfMPTCanTransfer});
+            mptGw.authorize({.account = alice});
+            auto const mpt = mptGw["MPT"];
+            env(pay(gw, alice, mpt(10'000)));
+            env.close();
+
+            // CheckCreate (alice -> bob) paying the MPT
+            uint32_t seq2 = 0;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    seq2 = env.seq(alice);
+                    submit(check::create(alice, bob, mpt(1)));
+                });
+
+            auto const checkKeylet = keylet::check(alice, seq2);
+            BEAST_EXPECT(env.le(checkKeylet)->getAccountID(sfSponsor) == sponsor.id());
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+
+            // CheckCash by bob (no MPToken yet) creates a sponsored MPToken
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                bob,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    submit(check::cash(bob, checkKeylet.key, mpt(1)));
+                },
+                [&]() {
+                    BEAST_EXPECT(ownerCount(env, bob) == 1);  // MPToken
+                    BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+                    BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+                    BEAST_EXPECT(
+                        env.le(keylet::mptoken(mptGw.issuanceID(), bob))->getAccountID(sfSponsor) ==
+                        sponsor.id());
+                });
+        }
+    }
+
+    void
+    testDelegate(bool cosigning)
+    {
+        testcase("Delegate");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor, sponsor2);
+            env.close();
+
+            // DelegateSet
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    submit(delegate::set(alice, bob, {"Payment"}));
+                });
+
+            // the created Delegate object carries the sponsor
+            auto const keylet = keylet::delegate(alice, bob);
+            BEAST_EXPECT(env.le(keylet)->getAccountID(sfSponsor) == sponsor.id());
+
+            // transfer sponsor
+            if (cosigning)
+            {
+                env(sponsor::transfer(alice, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+                env.close();
+
+                env(sponsor::transfer(alice, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+            }
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+            BEAST_EXPECT(env.le(keylet)->getAccountID(sfSponsor) == sponsor2.id());
+
+            // delete
+            env(delegate::set(alice, bob, {}));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        }
+    }
+
+    void
+    testDepositPreauth(bool cosigning)
+    {
+        testcase("DepositPreauth");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+        auto const credType = std::string("credType");
+
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, sponsor, sponsor2);
+            env.close();
+
+            // DepositPreauthSet
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) { submit(deposit::auth(alice, sponsor)); });
+
+            // the created DepositPreauth object carries the sponsor
+            auto const keylet = keylet::depositPreauth(alice, sponsor);
+            BEAST_EXPECT(env.le(keylet)->getAccountID(sfSponsor) == sponsor.id());
+
+            // transfer sponsor
+            if (cosigning)
+            {
+                env(sponsor::transfer(alice, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+                env.close();
+                // No sponsor signature here: this exercises the prefunded reassign path.
+                env(sponsor::transfer(alice, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+
+                auto const sponsor2Sle = env.le(keylet::sponsorship(sponsor2, alice));
+                BEAST_EXPECT(sponsor2Sle);
+                if (sponsor2Sle)
+                {
+                    BEAST_EXPECT(
+                        !sponsor2Sle->isFieldPresent(sfRemainingOwnerCount) ||
+                        sponsor2Sle->getFieldU32(sfRemainingOwnerCount) == 0);
+                }
+            }
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+            BEAST_EXPECT(env.le(keylet)->getAccountID(sfSponsor) == sponsor2.id());
+
+            // DepositPreauthDelete
+            env(deposit::unauth(alice, sponsor));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+        }
+
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, sponsor);
+            env.close();
+            auto const authCreds = std::vector<deposit::AuthorizeCredentials>{
+                {.issuer = sponsor, .credType = credType}};
+            auto const preauthKeylet = keylet::depositPreauth(
+                alice.id(),
+                std::set<std::pair<AccountID, Slice>>{
+                    {sponsor.id(), Slice(credType.data(), credType.size())}});
+
+            // Cover DepositPreauth's sfAuthorizeCredentials sponsor-reserve branch.
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env&, auto const& submit) {
+                    submit(deposit::authCredentials(alice, authCreds));
+                });
+
+            // Cover sfUnauthorizeCredentials cleanup for a sponsored preauth object.
+            BEAST_EXPECT(env.le(preauthKeylet));
+            BEAST_EXPECT(env.le(preauthKeylet)->getAccountID(sfSponsor) == sponsor.id());
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+            env(deposit::unauthCredentials(alice, authCreds));
+            env.close();
+
+            BEAST_EXPECT(!env.le(preauthKeylet));
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        }
+    }
+
+    void
+    testCredential(bool cosigning)
+    {
+        testcase("Credential");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+        auto const credType = std::string("test");
+
+        // Self-issued credential: alice creates for herself, sponsor covers reserve
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor, sponsor2);
+            env.close();
+
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    submit(credentials::create(alice, alice, credType));
+                });
+
+            auto const credKeylet = credentials::keylet(alice, alice, credType);
+            BEAST_EXPECT(env.le(credKeylet)->getAccountID(sfSponsor) == sponsor.id());
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+            // Transfer sponsor
+            if (cosigning)
+            {
+                env(sponsor::transfer(alice, tfSponsorshipReassign, credKeylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+                env.close();
+                env(sponsor::transfer(alice, tfSponsorshipReassign, credKeylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+            }
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+            BEAST_EXPECT(env.le(credKeylet)->getAccountID(sfSponsor) == sponsor2.id());
+
+            // CredentialDelete
+            env(credentials::deleteCred(alice, alice, alice, credType));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+        }
+
+        // Issuer creates for subject; sponsorship transfers to subject on accept
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor);
+            env.close();
+
+            // alice (issuer) creates credential for bob (subject), sponsor covers alice's reserve
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    submit(credentials::create(bob, alice, credType));
+                });
+
+            // Before accept: alice (issuer) owns the credential
+            auto const credKeylet = credentials::keylet(bob, alice, credType);
+            BEAST_EXPECT(env.le(credKeylet)->getAccountID(sfSponsor) == sponsor.id());
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);
+
+            // Bob accepts: issuer's sponsorship ends, bob becomes unsponsored owner
+            env(credentials::accept(bob, alice, credType));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);  // original sponsorship ended
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);  // bob owns it without a sponsor
+
+            // CredentialDelete by subject
+            env(credentials::deleteCred(bob, bob, alice, credType));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        }
+
+        // Issuer creates for subject; accept tx itself is reserve-sponsored
+        // This exercises the checkReserve() call in CredentialAccept::doApply()
+        // that guards the sponsor's reserve when featureSponsor is enabled.
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor);
+            env.close();
+
+            // alice (issuer) creates credential for bob (subject) without sponsor
+            env(credentials::create(bob, alice, credType));
+            env.close();
+
+            auto const credKeylet = credentials::keylet(bob, alice, credType);
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+
+            // Bob accepts with a sponsored reserve; the first attempt uses an
+            // undercapitalized sponsor and must fail with tecINSUFFICIENT_RESERVE;
+            // the second attempt uses a properly funded sponsor and must succeed.
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                bob,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    submit(credentials::accept(bob, alice, credType));
+                });
+
+            // After successful accept: alice (issuer) no longer owns the credential,
+            // bob owns it and sponsor covers his reserve.
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+            BEAST_EXPECT(env.le(credKeylet)->getAccountID(sfSponsor) == sponsor.id());
+
+            // Cleanup
+            env(credentials::deleteCred(bob, bob, alice, credType));
+            env.close();
+        }
+    }
+
+    void
+    testEscrow(bool cosigning)
+    {
+        testcase("Escrow");
+        using namespace test::jtx;
+        using namespace std::chrono_literals;
+
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+        {
+            // Native Escrow
+            Env env{*this, testableAmendments()};
+            auto const baseFee = env.current()->fees().base;
+
+            env.fund(XRP(1000000), alice, bob, sponsor, sponsor2);
+            env.close();
+
+            // EscrowCreate
+            uint32_t seq = 0;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    seq = env.seq(alice);
+                    submit(
+                        escrow::create(alice, bob, XRP(100)),
+                        escrow::kCondition(escrow::kCb1),
+                        escrow::kCancelTime(env.now() + 100s));
+                });
+            BEAST_EXPECT(
+                env.le(keylet::escrow(alice, seq))->getAccountID(sfSponsor) == sponsor.id());
+
+            // transfer sponsor
+            if (cosigning)
+            {
+                env(sponsor::transfer(alice, tfSponsorshipReassign, keylet::escrow(alice, seq).key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+                env.close();
+
+                env(sponsor::transfer(alice, tfSponsorshipReassign, keylet::escrow(alice, seq).key),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+            }
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+
+            BEAST_EXPECT(
+                env.le(keylet::escrow(alice, seq))->getAccountID(sfSponsor) == sponsor2.id());
+
+            // EscrowFinish
+            env(escrow::finish(bob, alice, seq),
+                escrow::kCondition(escrow::kCb1),
+                escrow::kFulfillment(escrow::kFb1),
+                Fee(baseFee * 150));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+        }
+
+        Account const gw("gw");
+        auto const usd = gw["usd"];
+        {
+            // IOU Escrow
+            Env env{*this, testableAmendments()};
+            auto const baseFee = env.current()->fees().base;
+
+            env.fund(XRP(1000000), alice, bob, gw, sponsor, sponsor2);
+            env.close();
+
+            env(fset(gw, asfAllowTrustLineLocking));
+            env.close();
+
+            env.trust(usd(1000000), alice);
+            env.close();
+            env(pay(gw, alice, usd(10000)));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+
+            // EscrowCreate
+            uint32_t seq = 0;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    seq = env.seq(alice);
+                    submit(
+                        escrow::create(alice, bob, usd(100)),
+                        escrow::kCondition(escrow::kCb1),
+                        escrow::kCancelTime(env.now() + 100s));
+                });
+
+            BEAST_EXPECT(
+                env.le(keylet::escrow(alice, seq))->getAccountID(sfSponsor) == sponsor.id());
+
+            // EscrowFinish
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor2,
+                bob,
+                1,
+                1,
+                tecNO_LINE_INSUF_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    submit(
+                        escrow::finish(bob, alice, seq),
+                        escrow::kCondition(escrow::kCb1),
+                        escrow::kFulfillment(escrow::kFb1),
+                        Fee(baseFee * 150));
+                });
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+
+            BEAST_EXPECT(
+                env.le(keylet::trustLine(bob, gw, usd.currency))->getAccountID(sfHighSponsor) ==
+                sponsor2.id());
+        }
+        {
+            // IOU EscrowFinish recycles reserve when the same sponsor backs
+            // the escrow being removed and the destination line being created.
+            Env env{*this, testableAmendments()};
+            auto const baseFee = env.current()->fees().base;
+
+            env.fund(XRP(1000000), alice, bob, gw, sponsor);
+            env.close();
+
+            env(fset(gw, asfAllowTrustLineLocking));
+            env.close();
+
+            env.trust(usd(1000000), alice);
+            env.close();
+            env(pay(gw, alice, usd(10000)));
+            env.close();
+
+            uint32_t seq = 0;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    seq = env.seq(alice);
+                    submit(
+                        escrow::create(alice, bob, usd(100)),
+                        escrow::kCondition(escrow::kCb1),
+                        escrow::kCancelTime(env.now() + 100s));
+                });
+
+            BEAST_EXPECT(
+                env.le(keylet::escrow(alice, seq))->getAccountID(sfSponsor) == sponsor.id());
+
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(env, sponsor, reserve(env, 1));
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor, 0, 1), sponsor::SponseeAcc(bob));
+                env.close();
+            }
+
+            if (cosigning)
+            {
+                env(escrow::finish(bob, alice, seq),
+                    escrow::kCondition(escrow::kCb1),
+                    escrow::kFulfillment(escrow::kFb1),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Fee(baseFee * 150),
+                    Ter(tesSUCCESS));
+            }
+            else
+            {
+                env(escrow::finish(bob, alice, seq),
+                    escrow::kCondition(escrow::kCb1),
+                    escrow::kFulfillment(escrow::kFb1),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Fee(baseFee * 150),
+                    Ter(tesSUCCESS));
+            }
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+            BEAST_EXPECT(
+                env.le(keylet::trustLine(bob, gw, usd.currency))->getAccountID(sfHighSponsor) ==
+                sponsor.id());
+        }
+        {
+            // IOU Escrow cancel re-creates the owner's trust line, and the
+            // cancel transaction's sponsor can cover that new line's reserve.
+            // Creating an IOU escrow moves the sender's balance to the issuer,
+            // so the sender can delete their now-zero trust line while the
+            // escrow is pending. Cancelling returns the funds, re-creating the
+            // line.
+            Env env{*this, testableAmendments()};
+
+            env.fund(XRP(1000000), alice, bob, gw, sponsor, sponsor2);
+            env.close();
+
+            env(fset(gw, asfAllowTrustLineLocking));
+            env.close();
+
+            env.trust(usd(1000000), alice);
+            env.close();
+            env(pay(gw, alice, usd(10000)));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+
+            // alice escrows her entire balance so the trust line can be removed
+            auto const cancelAfter = env.now() + 100s;
+            auto const seq = env.seq(alice);
+            env(escrow::create(alice, bob, usd(10000)),
+                escrow::kCondition(escrow::kCb1),
+                escrow::kCancelTime(cancelAfter));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 2);  // trust line + escrow
+
+            // alice deletes her now-zero trust line while the escrow is pending
+            env(trust(alice, usd(0)));
+            env.close();
+            BEAST_EXPECT(!env.le(keylet::trustLine(alice, gw, usd.currency)));
+            BEAST_EXPECT(ownerCount(env, alice) == 1);  // just the escrow
+
+            // advance the ledger past the cancel time
+            for (; env.now() < cancelAfter; env.close())
+            {
+            }
+
+            // EscrowCancel by alice re-creates her trust line; the sponsor
+            // covers the new line's reserve. On the insufficient-reserve
+            // attempt the whole transaction rolls back, leaving the escrow
+            // intact to be cancelled on the success attempt.
+            bool const aliceLow = alice.id() < gw.id();
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecNO_LINE_INSUF_RESERVE,
+                [&](Env& env, auto const& submit) { submit(escrow::cancel(alice, alice, seq)); },
+                [&]() {
+                    BEAST_EXPECT(!env.le(keylet::escrow(alice, seq)));
+                    auto const trustSle = env.le(keylet::trustLine(alice, gw, usd.currency));
+                    BEAST_EXPECT(trustSle);
+                    if (trustSle)
+                    {
+                        BEAST_EXPECT(
+                            trustSle->getAccountID(aliceLow ? sfLowSponsor : sfHighSponsor) ==
+                            sponsor.id());
+                        BEAST_EXPECT(
+                            !trustSle->isFieldPresent(aliceLow ? sfHighSponsor : sfLowSponsor));
+                    }
+                    BEAST_EXPECT(ownerCount(env, alice) == 1);  // re-created trust line
+                    BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+                    BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+                });
+        }
+        {
+            // MPT Escrow
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), bob, sponsor);
+            env.close();
+
+            MPTTester mptGw(env, gw, {.holders = {alice}});
+            mptGw.create(
+                {.ownerCount = 1, .holderCount = 0, .flags = tfMPTCanEscrow | tfMPTCanTransfer});
+            mptGw.authorize({.account = alice});
+            auto const mpt = mptGw["MPT"];
+            env(pay(gw, alice, mpt(10'000)));
+            env.close();
+
+            // create Escrow from alice to bob
+            auto const seq = env.seq(alice);
+            env(escrow::create(alice, bob, mpt(100)),
+                escrow::kCondition(escrow::kCb1),
+                escrow::kCancelTime(env.now() + 100s));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 2);
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+
+            // finish Escrow: bob has no MPToken, so finishing creates one and
+            // the finish transaction's sponsor covers its reserve. The MPT
+            // create-token path returns tecINSUFFICIENT_RESERVE (not
+            // tecNO_LINE_INSUF_RESERVE) when the sponsor is underfunded.
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                bob,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    submit(
+                        escrow::finish(bob, alice, seq),
+                        escrow::kCondition(escrow::kCb1),
+                        escrow::kFulfillment(escrow::kFb1),
+                        Fee(XRP(1)));
+                });
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+            BEAST_EXPECT(
+                env.le(keylet::mptoken(mptGw.issuanceID(), bob))->getAccountID(sfSponsor) ==
+                sponsor.id());
+        }
+        {
+            // MPT EscrowFinish has the same reserve recycling behavior as IOU
+            // when it creates the destination MPToken.
+            Env env{*this, testableAmendments()};
+            auto const baseFee = env.current()->fees().base;
+            env.fund(XRP(1000000), bob, sponsor);
+            env.close();
+
+            MPTTester mptGw(env, gw, {.holders = {alice}});
+            mptGw.create(
+                {.ownerCount = 1, .holderCount = 0, .flags = tfMPTCanEscrow | tfMPTCanTransfer});
+            mptGw.authorize({.account = alice});
+            auto const mpt = mptGw["MPT"];
+            env(pay(gw, alice, mpt(10'000)));
+            env.close();
+
+            uint32_t seq = 0;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    seq = env.seq(alice);
+                    submit(
+                        escrow::create(alice, bob, mpt(100)),
+                        escrow::kCondition(escrow::kCb1),
+                        escrow::kCancelTime(env.now() + 100s));
+                });
+
+            BEAST_EXPECT(
+                env.le(keylet::escrow(alice, seq))->getAccountID(sfSponsor) == sponsor.id());
+
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(env, sponsor, reserve(env, 1));
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor, 0, 1), sponsor::SponseeAcc(bob));
+                env.close();
+            }
+
+            if (cosigning)
+            {
+                env(escrow::finish(bob, alice, seq),
+                    escrow::kCondition(escrow::kCb1),
+                    escrow::kFulfillment(escrow::kFb1),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Fee(baseFee * 150),
+                    Ter(tesSUCCESS));
+            }
+            else
+            {
+                env(escrow::finish(bob, alice, seq),
+                    escrow::kCondition(escrow::kCb1),
+                    escrow::kFulfillment(escrow::kFb1),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Fee(baseFee * 150),
+                    Ter(tesSUCCESS));
+            }
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+            BEAST_EXPECT(
+                env.le(keylet::mptoken(mptGw.issuanceID(), bob))->getAccountID(sfSponsor) ==
+                sponsor.id());
+        }
+
+        // A sponsored EscrowCreate must still verify that the source
+        // can fund the escrow amount and stay above its own base
+        // reserve. The sponsor covers the new object's owner
+        // increment, but cannot cover the source's base reserve.
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // alice's balance is just above the base reserve. After
+            // locking escrowAmount she would dip below it.
+            adjustAccountXRPBalance(env, alice, accountReserve(env, 1) + XRP(1));
+
+            auto const escrowAmount = XRP(2);
+            auto const seq = env.seq(alice);
+
+            if (cosigning)
+            {
+                env(escrow::create(alice, bob, escrowAmount),
+                    escrow::kCondition(escrow::kCb1),
+                    escrow::kCancelTime(env.now() + 100s),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(tecUNFUNDED));
+            }
+            else
+            {
+                env(sponsor::set(sponsor, 0, 1, XRP(1)), sponsor::SponseeAcc(alice));
+                env.close();
+
+                env(escrow::create(alice, bob, escrowAmount),
+                    escrow::kCondition(escrow::kCb1),
+                    escrow::kCancelTime(env.now() + 100s),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Ter(tecUNFUNDED));
+            }
+            env.close();
+
+            BEAST_EXPECT(!env.le(keylet::escrow(alice, seq)));
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        }
+    }
+
+    void
+    testMPToken(bool cosigning)
+    {
+        testcase("MPToken");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor, sponsor2);
+            env.close();
+
+            // MPTokenIssuanceCreate
+            json::Value jv = {};
+            jv[sfAccount] = alice.human();
+            jv[sfTransactionType] = jss::MPTokenIssuanceCreate;
+            MPTID mptid;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    mptid = makeMptID(env.seq(alice), alice.id());
+                    submit(jv);
+                });
+
+            // transfer sponsor
+            auto const mptIssuanceKeylet = keylet::mptokenIssuance(mptid);
+
+            if (cosigning)
+            {
+                env(sponsor::transfer(alice, tfSponsorshipReassign, mptIssuanceKeylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+                env.close();
+
+                env(sponsor::transfer(alice, tfSponsorshipReassign, mptIssuanceKeylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+            }
+
+            // MPTokenAuthorize
+            jv = {};
+            jv[sfTransactionType] = jss::MPTokenAuthorize;
+            jv[sfAccount] = bob.human();
+            jv[sfMPTokenIssuanceID] = to_string(mptid);
+
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(env, sponsor, reserve(env, 2));
+                env(ticket::create(sponsor, 2));  // adjust for free mptoken
+                env.close();
+            }
+
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                bob,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) { submit(jv); });
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+
+            // transfer sponsor
+            auto const mptTokenKeylet = keylet::mptoken(mptid, bob);
+            if (cosigning)
+            {
+                env(sponsor::transfer(bob, tfSponsorshipReassign, mptTokenKeylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(bob));
+                env.close();
+
+                env(sponsor::transfer(bob, tfSponsorshipReassign, mptTokenKeylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+            }
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 2);
+
+            // MPTokenAuthorize Unauthorize
+            jv = {};
+            jv[sfTransactionType] = jss::MPTokenAuthorize;
+            jv[sfAccount] = bob.human();
+            jv[sfMPTokenIssuanceID] = to_string(mptid);
+            jv[sfFlags] = tfMPTUnauthorize;
+            env(jv);
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+
+            // MPTokenIssuanceDestroy
+            jv = {};
+            jv[sfTransactionType] = jss::MPTokenIssuanceDestroy;
+            jv[sfAccount] = alice.human();
+            jv[sfMPTokenIssuanceID] = to_string(mptid);
+            env(jv);
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+        }
+        {
+            // check INSUFFICIENT_RESERVE for MPToken
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor);
+            env.close();
+
+            // MPTokenAuthorize
+            json::Value jv = {};
+            jv[sfAccount] = alice.human();
+            jv[sfTransactionType] = jss::MPTokenIssuanceCreate;
+            auto const mptid = makeMptID(env.seq(alice), alice.id());
+            env(jv);
+            env.close();
+
+            // Create tickets so the sponsor is past free-tier reserve behavior.
+            std::uint32_t const ticketSeq{env.seq(sponsor) + 1};
+            env(ticket::create(sponsor, 2));
+            env.close();
+
+            jv = {};
+            jv[sfTransactionType] = jss::MPTokenAuthorize;
+            jv[sfAccount] = bob.human();
+            jv[sfMPTokenIssuanceID] = to_string(mptid);
+            // error (non-free mptoken)
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(env, sponsor, reserve(env, 3) - drops(1));
+                env(jv,
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(tecINSUFFICIENT_RESERVE));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set(sponsor, 0, std::nullopt, XRP(1)), sponsor::SponseeAcc(bob));
+                env.close();
+
+                env(jv, sponsor::As(sponsor, spfSponsorReserve), Ter(tecINSUFFICIENT_RESERVE));
+                env.close();
+            }
+
+            env(noop(sponsor), ticket::Use(ticketSeq));
+            env.close();
+
+            // pass (free-tier mptoken for the holder, but the sponsor is still
+            // charged a reserve increment regardless of the ownerCount < 2 shortcut).
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(env, sponsor, reserve(env, 2));
+                env(jv,
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(tesSUCCESS));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor, 0, 1), sponsor::SponseeAcc(bob));
+                env.close();
+                env(jv, sponsor::As(sponsor, spfSponsorReserve), Ter(tesSUCCESS));
+                env.close();
+            }
+        }
+    }
+
+    void
+    testPayChan(bool cosigning)
+    {
+        testcase("PayChan");
+        using namespace test::jtx;
+        using namespace std::literals::chrono_literals;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor, sponsor2);
+            env.close();
+
+            // PayChanCreate
+            auto const pk = alice.pk();
+            auto const settleDelay = 10s;
+            uint256 chan;
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                alice,
+                1,
+                1,
+                tecINSUFFICIENT_RESERVE,
+                [&](Env& env, auto const& submit) {
+                    chan = paychan::channel(alice, bob, env.seq(alice));
+                    submit(paychan::create(alice, bob, XRP(100), settleDelay, pk));
+                });
+
+            // the created PayChannel object carries the sponsor
+            BEAST_EXPECT(env.le(Keylet(ltPAYCHAN, chan))->getAccountID(sfSponsor) == sponsor.id());
+
+            // transfer sponsor
+            if (cosigning)
+            {
+                env(sponsor::transfer(alice, tfSponsorshipReassign, chan),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+                env.close();
+
+                env(sponsor::transfer(alice, tfSponsorshipReassign, chan),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+            }
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+            BEAST_EXPECT(env.le(Keylet(ltPAYCHAN, chan))->getAccountID(sfSponsor) == sponsor2.id());
+
+            env.close(env.now() + settleDelay);
+            // PayChanClaim (delete PayChan)
+            env(paychan::claim(bob, chan), Txflags(tfClose));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+        }
+
+        // A sponsored PaymentChannelCreate must still verify that the
+        // source can fund the channel amount and stay above its own
+        // base reserve. The sponsor covers the new object's owner
+        // increment, but cannot cover the source's base reserve.
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, sponsor);
+            env.close();
+
+            // alice's balance is just above the base reserve. After
+            // locking channelAmount she would dip below it.
+            adjustAccountXRPBalance(env, alice, accountReserve(env, 1) + XRP(1));
+
+            auto const pk = alice.pk();
+            auto const settleDelay = 10s;
+            auto const channelAmount = XRP(2);
+            auto const chan = paychan::channel(alice, bob, env.seq(alice));
+
+            if (cosigning)
+            {
+                env(paychan::create(alice, bob, channelAmount, settleDelay, pk),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(tecUNFUNDED));
+            }
+            else
+            {
+                env(sponsor::set(sponsor, 0, 1, XRP(1)), sponsor::SponseeAcc(alice));
+                env.close();
+
+                env(paychan::create(alice, bob, channelAmount, settleDelay, pk),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Ter(tecUNFUNDED));
+            }
+            env.close();
+
+            BEAST_EXPECT(!paychan::channelExists(*env.current(), chan));
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        }
+    }
+
+    void
+    testSignerList(bool cosigning)
+    {
+        testcase("SignerList");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+
+        Env env{*this, testableAmendments()};
+        env.fund(XRP(1000000), alice, bob, sponsor, sponsor2);
+        env.close();
+
+        // SignerListSet
+        testEachSponsorship(
+            env,
+            cosigning,
+            sponsor,
+            alice,
+            1,
+            1,
+            tecINSUFFICIENT_RESERVE,
+            [&](Env& env, auto const& submit) { submit(signers(alice, 1, {{bob, 1}})); });
+
+        // the created SignerList object carries the sponsor
+        BEAST_EXPECT(env.le(keylet::signerList(alice))->getAccountID(sfSponsor) == sponsor.id());
+
+        // transfer sponsor
+        if (cosigning)
+        {
+            // invalid signer list owner 1
+            // account doesn't have signer list but specified signer list exists
+            env(sponsor::transfer(bob, tfSponsorshipReassign, keylet::signerList(alice).key),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2),
+                Ter(tecNO_PERMISSION));
+            // invalid signer list owner 2
+            // account has signer list and specified signer list exists
+            env(signers(bob, 1, {{alice, 1}}));
+            env.close();
+            env(sponsor::transfer(alice, tfSponsorshipReassign, keylet::signerList(bob).key),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2),
+                Ter(tecNO_PERMISSION));
+            env(sponsor::transfer(alice, tfSponsorshipReassign, keylet::signerList(alice).key),
+                sponsor::As(sponsor2, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor2));
+            env.close();
+        }
+        else
+        {
+            env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(alice));
+            env.close();
+            env(sponsor::transfer(alice, tfSponsorshipReassign, keylet::signerList(alice).key),
+                sponsor::As(sponsor2, spfSponsorReserve));
+            env.close();
+        }
+
+        BEAST_EXPECT(ownerCount(env, alice) == 1);
+        BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 1);
+        BEAST_EXPECT(env.le(keylet::signerList(alice))->getAccountID(sfSponsor) == sponsor2.id());
+
+        // Delete
+        env(signers(alice, NoneT()));
+        env.close();
+
+        BEAST_EXPECT(ownerCount(env, alice) == 0);
+        BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == 0);
+    }
+
+    // Legacy (pre-MultiSignReserve) SignerLists lack lsfOneOwnerCount and cost
+    // 2 + signer_count owner units, whereas modern lists cost 1.
+    void
+    testLegacySignerListReserve()
+    {
+        testcase("Legacy SignerList sponsorship reserve");
+        using namespace test::jtx;
+
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const dave("dave");
+        Account const sponsor("sponsor");
+
+        Env env{*this, testableAmendments()};
+        env.fund(XRP(1000000), alice, bob, carol, dave, sponsor);
+        env.close();
+
+        // Modern 3-signer list: weight 1, lsfOneOwnerCount set.
+        env(signers(alice, 1, {{bob, 1}, {carol, 1}, {dave, 1}}));
+        env.close();
+
+        auto const signerListKeylet = keylet::signerList(alice.id());
+        auto const sponsorKeylet = keylet::sponsorship(sponsor.id(), alice.id());
+        std::uint32_t const legacyWeight = 5;  // 2 + 3 signers
+        BEAST_EXPECT(ownerCount(env, alice) == 1);
+
+        // Pre-fund exactly the legacy weight
+        env(sponsor::set_reserve(sponsor, 0, legacyWeight), sponsor::SponseeAcc(alice));
+        env.close();
+        if (auto const sle = env.le(sponsorKeylet); BEAST_EXPECT(sle))
+            BEAST_EXPECT(sle->getFieldU32(sfRemainingOwnerCount) == legacyWeight);
+
+        // Synthesize a pre-MultiSignReserve list: clear lsfOneOwnerCount and
+        // restore the owner's OwnerCount to the legacy weight.
+        env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal) -> bool {
+            auto signerList = std::make_shared<SLE>(*view.read(signerListKeylet));
+            auto account = std::make_shared<SLE>(*view.read(keylet::account(alice.id())));
+            signerList->clearFlag(lsfOneOwnerCount);
+            account->setFieldU32(sfOwnerCount, legacyWeight);
+            view.rawReplace(signerList);
+            view.rawReplace(account);
+            return true;
+        });
+        if (auto const sle = env.le(signerListKeylet); BEAST_EXPECT(sle))
+            BEAST_EXPECT((sle->getFlags() & lsfOneOwnerCount) == 0);
+        BEAST_EXPECT(ownerCount(env, alice) == legacyWeight);
+
+        // Create must charge the full legacy weight (5), not 1: the bug bumped
+        // the counters by 1 and left 4 pre-funded units unspent.
+        env(sponsor::transfer(alice, tfSponsorshipCreate, signerListKeylet.key),
+            sponsor::As(sponsor, spfSponsorReserve));
+
+        BEAST_EXPECT(sponsoredOwnerCount(env, alice) == legacyWeight);
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == legacyWeight);
+        // All pre-funded units consumed (drained to absent).
+        if (auto const sle = env.le(sponsorKeylet); BEAST_EXPECT(sle))
+            BEAST_EXPECT(!sle->isFieldPresent(sfRemainingOwnerCount));
+
+        // Delete unwinds the legacy weight; create bumped by the same amount, so
+        // the counters return to 0 (the bug bumped by 1 -> underflow on delete).
+        env(signers(alice, NoneT()));
+
+        BEAST_EXPECT(!env.le(signerListKeylet));
+        BEAST_EXPECT(ownerCount(env, alice) == 0);
+        BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        if (auto const sle = env.le(sponsorKeylet); BEAST_EXPECT(sle))
+            BEAST_EXPECT(!sle->isFieldPresent(sfRemainingOwnerCount));
+    }
+
+    void
+    testSponsoredTrustLineNoFreeReserve()
+    {
+        // An account with ownerCount < 2 may create its first trust lines even
+        // without meeting the reserve. In any case, the sponsor pays the full
+        // reserve in all cases, even for the sponsee's very first trust line.
+        testcase("Sponsored trust line gets no free-reserve exception");
+        using namespace test::jtx;
+
+        Account const issuer("issuer");
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+
+        Env env{*this, testableAmendments()};
+        env.fund(XRP(10000), issuer, alice, sponsor);
+        env.close();
+
+        auto const usd = issuer["usd"];
+        auto const lineKeylet = keylet::trustLine(alice, issuer, usd.currency);
+
+        // Sponsor funded for exactly its base reserve
+        adjustAccountXRPBalance(env, sponsor, reserve(env, 0));
+
+        // alice's ownerCount is 0, so an unsponsored first trust line would be
+        // free; but because it is sponsored, the reserve check is enforced
+        // against the sponsor, which is one increment short.
+        env(trust(alice, usd(100)),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(tecNO_LINE_INSUF_RESERVE));
+        env.close();
+
+        BEAST_EXPECT(!env.le(lineKeylet));
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+
+        // Give the sponsor has exactly one owner-reserve increment; the same
+        // sponsored first trust line now succeeds and the sponsor pays for it.
+        adjustAccountXRPBalance(env, sponsor, reserve(env, 1));
+
+        env(trust(alice, usd(100)),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor));
+        env.close();
+
+        BEAST_EXPECT(env.le(lineKeylet));
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+        BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+        BEAST_EXPECT(ownerCount(env, alice) == 1);
+    }
+
+    void
+    testCoSignReserveBoundedBySponsorshipBudget()
+    {
+        // sponsor co-signs, so a fee-only object (ReserveCount == 0) makes a co-signed
+        // reserve sponsorship fail -- with no fallback to the sponsor's balance.
+        testcase("Co-signed reserve sponsorship is bounded by Sponsorship budget");
+        using namespace test::jtx;
+
+        Env env{*this, testableAmendments()};
+        Account const sponsor("sponsor");
+        Account const sponsee("sponsee");
+        env.fund(XRP(10000), sponsor, sponsee);
+        env.close();
+
+        // Prefund a FEE-only Sponsorship for the sponsee; ReserveCount
+        // defaults to 0.
+        env(sponsor::set_fee(sponsor, 0, XRP(100)), sponsor::SponseeAcc(sponsee));
+        env.close();
+        BEAST_EXPECT(env.le(keylet::sponsorship(sponsor, sponsee)));
+
+        // Sponsee creates a Check with the sponsor co-signing the reserve. The
+        // fee-only Sponsorship's has ReserveCount (0), so this fails
+        // with tecINSUFFICIENT_RESERVE
+        env(check::create(sponsee, sponsor, XRP(1)),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(tecINSUFFICIENT_RESERVE));
+        env.close();
+
+        BEAST_EXPECT(ownerCount(env, sponsee) == 0);
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        BEAST_EXPECT(sponsoredOwnerCount(env, sponsee) == 0);
+
+        // Bumping the Sponsorship's ReserveCount budget makes the same
+        // co-signed reserve sponsorship succeed, the budget is what gates it.
+        env(sponsor::set_reserve(sponsor, 0, 1), sponsor::SponseeAcc(sponsee));
+        env.close();
+
+        env(check::create(sponsee, sponsor, XRP(1)),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(tesSUCCESS));
+        env.close();
+
+        BEAST_EXPECT(ownerCount(env, sponsee) == 1);
+        BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+        BEAST_EXPECT(sponsoredOwnerCount(env, sponsee) == 1);
+    }
+
+    void
+    testTrustSet(bool cosigning)
+    {
+        testcase("TrustSet");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const charlie("charlie");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+
+        auto const validateSponsoredTrustline =
+            [&](std::shared_ptr<const SLE> const& sle, bool isIssuerHigh, Account const& sponsor) {
+                BEAST_EXPECT(
+                    sle->getAccountID(isIssuerHigh ? sfLowSponsor : sfHighSponsor) == sponsor.id());
+                BEAST_EXPECT(!sle->isFieldPresent(isIssuerHigh ? sfHighSponsor : sfLowSponsor));
+            };
+
+        auto const& highAcc = alice > bob ? alice : bob;
+        auto const& lowAcc = alice > bob ? bob : alice;
+
+        // create and delete
+        for (bool const isIssuerHigh : {false, true})
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, charlie, sponsor, sponsor2);
+            env.close();
+
+            auto const& issuer = isIssuerHigh ? highAcc : lowAcc;
+            auto const& user = isIssuerHigh ? lowAcc : highAcc;
+
+            auto const usd = issuer["usd"];
+            auto const currency = usd.currency;
+
+            // create TrustLine
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(env, sponsor, reserve(env, 2));
+                env(ticket::create(sponsor, 2));  // adjust for free trustline
+                env.close();
+            }
+
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                user,
+                1,
+                1,
+                tecNO_LINE_INSUF_RESERVE,
+                [&](Env& env, auto const& submit) { submit(trust(user, usd(100))); });
+
+            auto const keylet = keylet::trustLine(user, issuer, currency);
+
+            if (cosigning)
+            {
+                // invalid owner
+                env(sponsor::transfer(charlie, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2),
+                    Ter(tecNO_PERMISSION));
+                // invalid reserve owner
+                env(sponsor::transfer(issuer, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2),
+                    Ter(tecNO_PERMISSION));
+                env(sponsor::transfer(user, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor2));
+                env.close();
+            }
+            else
+            {
+                env(sponsor::set_reserve(sponsor2, 0, 1), sponsor::SponseeAcc(user));
+                env.close();
+                env(sponsor::transfer(user, tfSponsorshipReassign, keylet.key),
+                    sponsor::As(sponsor2, spfSponsorReserve));
+                env.close();
+            }
+
+            // delete TrustLine
+            env(trust(user, usd(0)));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, user) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, user) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+
+            BEAST_EXPECT(!env.le(keylet));
+        }
+
+        // update
+        for (bool const isIssuerHigh : {false, true})
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor, sponsor2);
+            env.close();
+
+            auto const& issuer = isIssuerHigh ? highAcc : lowAcc;
+            auto const& user = isIssuerHigh ? lowAcc : highAcc;
+
+            auto const usd = issuer["usd"];
+            auto const currency = usd.currency;
+
+            // create TrustLine from issuer
+            env(trust(issuer, user["usd"](100)));
+            env.close();
+
+            BEAST_EXPECT(env.le(keylet::trustLine(user, issuer, currency)));
+
+            if (cosigning)
+            {
+                adjustAccountXRPBalance(env, sponsor, reserve(env, 2));
+                env(ticket::create(sponsor, 2));  // adjust for free trustline
+                env.close();
+            }
+
+            testEachSponsorship(
+                env,
+                cosigning,
+                sponsor,
+                user,
+                1,
+                1,
+                tecINSUF_RESERVE_LINE,
+                [&](Env& env, auto const& submit) { submit(trust(user, usd(100))); });
+
+            auto const line = env.le(keylet::trustLine(user, issuer, currency));
+            validateSponsoredTrustline(line, isIssuerHigh, sponsor);
+
+            // update TrustLine from user to clear reserve
+            env(trust(user, usd(0)));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, user) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, user) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+            BEAST_EXPECT(env.le(keylet::trustLine(user, issuer, currency)));
+
+            // remove TrustLine from issuer
+            env(trust(issuer, user["usd"](0)));
+            env.close();
+            BEAST_EXPECT(!env.le(keylet::trustLine(user, issuer, currency)));
+        }
+
+        // both High and Low sponsored
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor);
+            env.close();
+
+            // create TrustLines
+            env(trust(alice, bob["usd"](100)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+            env(trust(bob, alice["usd"](100)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            auto sle = env.le(keylet::trustLine(alice, bob, alice["usd"].currency));
+            BEAST_EXPECT(sle);
+            BEAST_EXPECT(sle->isFlag(lsfHighReserve));
+            BEAST_EXPECT(sle->isFlag(lsfLowReserve));
+            BEAST_EXPECT(sle->getAccountID(sfHighSponsor) == sponsor.id());
+            BEAST_EXPECT(sle->getAccountID(sfLowSponsor) == sponsor.id());
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 2);
+
+            // clear TrustLines
+            env(trust(alice, bob["usd"](0)));
+            env.close();
+            env(trust(bob, alice["usd"](0)));
+            env.close();
+
+            sle = env.le(keylet::trustLine(alice, bob, alice["usd"].currency));
+            BEAST_EXPECT(!sle);
+            BEAST_EXPECT(ownerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+        }
+    }
+
+    void
+    testAccountDelete()
+    {
+        testcase("AccountDelete");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+
+        {
+            // Delete Sponsor/Sponsee Account with ltSponsorship (tecHAS_OBLIGATIONS)
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor);
+            env.close();
+
+            // set sponsor
+            env(sponsor::set(sponsor, 0, 100, XRP(100)),
+                sponsor::SponseeAcc(alice),
+                Ter(tesSUCCESS));
+            env.close();
+
+            incLgrSeqForAccDel(env, sponsor);
+
+            auto const keylet = keylet::sponsorship(sponsor, alice);
+            auto const sponsorObj = env.le(keylet);
+            BEAST_EXPECT(sponsorObj);
+
+            // AccountDelete
+            auto const requiredFee = drops(env.current()->fees().increment);
+            env(acctdelete(alice, bob), Fee(requiredFee), Ter(tecHAS_OBLIGATIONS));
+            env(acctdelete(sponsor, bob), Fee(requiredFee), Ter(tecHAS_OBLIGATIONS));
+        }
+
+        {
+            // Delete SponsoredAccount
+            Env env{*this, testableAmendments()};
+            env.memoize(alice);
+            env.fund(XRP(1000000), bob, sponsor);
+            env.close();
+
+            // create SponsoredAccount
+            env(pay(sponsor, alice, XRP(10000)), Txflags(tfSponsorCreatedAccount));
+            env.close();
+
+            incLgrSeqForAccDel(env, alice);
+
+            // AccountDelete: destination = non-sponsor
+            auto const requiredFee = drops(env.current()->fees().increment);
+            env(acctdelete(alice, bob), Fee(requiredFee), Ter(tecNO_SPONSOR_PERMISSION));
+
+            // The failed delete must leave the account sponsored by the original sponsor.
+            auto const aliceSle = env.le(keylet::account(alice));
+            BEAST_EXPECT(aliceSle);
+            if (aliceSle)
+                BEAST_EXPECT(aliceSle->getAccountID(sfSponsor) == sponsor.id());
+
+            auto const sponsorSle = env.le(keylet::account(sponsor));
+            BEAST_EXPECT(sponsorSle->getFieldU32(sfSponsoringAccountCount) == 1);
+
+            incLgrSeqForAccDel(env, alice);
+
+            // AccountDelete: destination = sponsor
+            env(acctdelete(alice, sponsor), Fee(requiredFee), Ter(tesSUCCESS));
+
+            auto const sponsorSle2 = env.le(keylet::account(sponsor));
+            BEAST_EXPECT(!sponsorSle2->isFieldPresent(sfSponsoringAccountCount));
+        }
+
+        {
+            // Sponsor with sfSponsoringOwnerCount cannot delete (tecHAS_OBLIGATIONS)
+            Env env{*this, testableAmendments()};
+            Account const gw("gw");
+            env.fund(XRP(1000000), alice, bob, sponsor, gw);
+            env.close();
+
+            auto const usd = gw["usd"];
+
+            // Create a trust line for alice
+            env(trust(alice, usd(1000)));
+            env.close();
+
+            // Transfer reserve sponsorship of trust line to sponsor
+            auto const trustId = keylet::trustLine(alice, gw, usd.currency);
+            BEAST_EXPECT(env.le(trustId));
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate, trustId.key),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            // Verify sfSponsoringOwnerCount is set on sponsor
+            auto const sponsorSle = env.le(keylet::account(sponsor));
+            BEAST_EXPECT(sponsorSle->isFieldPresent(sfSponsoringOwnerCount));
+            auto const sponsoringOwnerCount = sponsorSle->getFieldU32(sfSponsoringOwnerCount);
+            BEAST_EXPECT(sponsoringOwnerCount >= 1);
+
+            incLgrSeqForAccDel(env, sponsor);
+
+            // AccountDelete should fail
+            auto const requiredFee = drops(env.current()->fees().increment);
+            env(acctdelete(sponsor, bob), Fee(requiredFee), Ter(tecHAS_OBLIGATIONS));
+            // The failed delete must not decrement the outstanding sponsored-object count.
+            auto const sponsorSleAfter = env.le(keylet::account(sponsor));
+            BEAST_EXPECT(sponsorSleAfter->isFieldPresent(sfSponsoringOwnerCount));
+            BEAST_EXPECT(
+                sponsorSleAfter->getFieldU32(sfSponsoringOwnerCount) == sponsoringOwnerCount);
+        }
+
+        {
+            // Sponsor with sfSponsoringAccountCount cannot delete (tecHAS_OBLIGATIONS)
+            Env env{*this, testableAmendments()};
+            env.memoize(alice);
+            env.fund(XRP(1000000), bob, sponsor);
+            env.close();
+
+            // Create SponsoredAccount (sets sfSponsoringAccountCount on sponsor)
+            env(pay(sponsor, alice, XRP(10000)), Txflags(tfSponsorCreatedAccount));
+            env.close();
+
+            // Verify sfSponsoringAccountCount is set on sponsor
+            auto const sponsorSle = env.le(keylet::account(sponsor));
+            BEAST_EXPECT(sponsorSle->isFieldPresent(sfSponsoringAccountCount));
+            auto const sponsoringAccountCount = sponsorSle->getFieldU32(sfSponsoringAccountCount);
+            BEAST_EXPECT(sponsoringAccountCount == 1);
+
+            incLgrSeqForAccDel(env, sponsor);
+
+            // AccountDelete should fail
+            auto const requiredFee = drops(env.current()->fees().increment);
+            env(acctdelete(sponsor, bob), Fee(requiredFee), Ter(tecHAS_OBLIGATIONS));
+            // The failed delete must not decrement the outstanding sponsored-account count.
+            auto const sponsorSleAfter = env.le(keylet::account(sponsor));
+            BEAST_EXPECT(sponsorSleAfter->isFieldPresent(sfSponsoringAccountCount));
+            BEAST_EXPECT(
+                sponsorSleAfter->getFieldU32(sfSponsoringAccountCount) == sponsoringAccountCount);
+        }
+
+        {
+            // Account with sponsored objects should be deletable
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, sponsor);
+            env.close();
+
+            // Create sponsored delegate (a non-deletion-blocker)
+            env(deposit::auth(alice, bob),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+
+            {
+                auto const sponsorSle = env.le(keylet::account(sponsor));
+                auto const aliceSle = env.le(keylet::account(alice));
+                BEAST_EXPECT(sponsorSle->at(sfSponsoringOwnerCount) == 1);
+                BEAST_EXPECT(aliceSle->at(sfOwnerCount) == 1);
+                BEAST_EXPECT(aliceSle->at(sfSponsoredOwnerCount) == 1);
+            }
+
+            incLgrSeqForAccDel(env, alice);
+
+            // AccountDelete should succeed
+            {
+                auto const requiredFee = drops(env.current()->fees().increment);
+                env(acctdelete(alice, bob), Fee(requiredFee), Ter(tesSUCCESS));
+                BEAST_EXPECT(!env.le(keylet::account(alice)));
+                auto const sponsorSle = env.le(keylet::account(sponsor));
+                BEAST_EXPECT(sponsorSle->at(sfSponsoringOwnerCount) == 0);
+            }
+        }
+    }
+
+    void
+    testDelegatePermission()
+    {
+        testcase("DelegatePermission");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+
+        //
+        // SponsorshipTransfer is not delegable.
+        //
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, carol);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(check::create(alice, bob, XRP(1)));
+            env.close();
+
+            auto const keylet = keylet::check(alice, seq);
+
+            env(sponsor::transfer(alice, tfSponsorshipCreate, keylet.key),
+                sponsor::As(bob, spfSponsorReserve),
+                Sig(sfSponsorSignature, bob),
+                delegate::As(carol),
+                Ter(temINVALID));
+
+            env(delegate::set(alice, carol, {"SponsorshipTransfer"}), Ter(temMALFORMED));
+        }
+        //
+        // test send SponsorshipSet on other's behalf
+        //
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, carol);
+            env.close();
+
+            env(sponsor::set(alice, 0, 100, XRP(100)),
+                sponsor::SponseeAcc(bob),
+                delegate::As(carol),
+                Ter(terNO_DELEGATE_PERMISSION));
+
+            env(delegate::set(alice, carol, {"SponsorshipSet"}));
+            env.close();
+
+            env(sponsor::set(alice, 0, 100, XRP(100)),
+                sponsor::SponseeAcc(bob),
+                delegate::As(carol),
+                Ter(tesSUCCESS));
+            env.close();
+        }
+    }
+
+    void
+    testDelegateBlockReserveSponsor()
+    {
+        testcase("Delegate Block Reserve Sponsor");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const sponsor("sponsor");
+
+        // Co-signed reserve sponsorship is blocked for delegated transactions.
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, carol, sponsor);
+            env.close();
+
+            env(delegate::set(alice, bob, {"CheckCreate"}));
+            env.close();
+
+            env(check::create(alice, carol, XRP(1)),
+                delegate::As(bob),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor),
+                Ter(temINVALID));
+        }
+
+        // Pre-funded reserve sponsorship is blocked for delegated transactions.
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000000), alice, bob, carol, sponsor);
+            env.close();
+
+            env(delegate::set(alice, bob, {"CheckCreate"}));
+            env(sponsor::set_reserve(sponsor, 0, 1), sponsor::SponseeAcc(bob));
+            env.close();
+
+            env(check::create(alice, carol, XRP(1)),
+                delegate::As(bob),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Ter(temINVALID));
+        }
+    }
+
+    void
+    testDelegateSponsorFeePayer()
+    {
+        testcase("Delegate Sponsor Fee Payer");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const carol("carol");
+        Account const sponsor("sponsor");
+
+        // Co-signing: the sponsor account pays the delegated transaction fee.
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, carol, sponsor);
+            env.close();
+
+            env(delegate::set(alice, bob, {"Payment"}));
+            env.close();
+
+            auto const aliceBalance = env.balance(alice);
+            auto const bobBalance = env.balance(bob);
+            auto const carolBalance = env.balance(carol);
+            auto const sponsorBalance = env.balance(sponsor);
+            auto const sendAmt = XRP(100);
+            auto const feeAmt = XRP(10);
+
+            env(pay(alice, carol, sendAmt),
+                delegate::As(bob),
+                Fee(feeAmt),
+                sponsor::As(sponsor, spfSponsorFee),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            BEAST_EXPECT(env.balance(alice) == aliceBalance - sendAmt);
+            BEAST_EXPECT(env.balance(bob) == bobBalance);
+            BEAST_EXPECT(env.balance(carol) == carolBalance + sendAmt);
+            // sponsor pays the fee
+            BEAST_EXPECT(env.balance(sponsor) == sponsorBalance - feeAmt);
+        }
+
+        // Pre-funded: the Sponsorship object for sponsorship(sponsor, delegate)
+        // pays the fee.
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(10000), alice, bob, carol, sponsor);
+            env.close();
+
+            env(delegate::set(alice, bob, {"Payment"}));
+            env(sponsor::set_fee(sponsor, 0, XRP(100)), sponsor::SponseeAcc(bob));
+            env.close();
+
+            auto const aliceBalance = env.balance(alice);
+            auto const bobBalance = env.balance(bob);
+            auto const carolBalance = env.balance(carol);
+            auto const sponsorBalance = env.balance(sponsor);
+            auto const sponsorFee = sponsor::sponsorshipFeeBalance(env, sponsor, bob);
+            auto const sendAmt = XRP(100);
+            auto const feeAmt = XRP(10);
+
+            // verify sponsorship(sponsor, alice) is not present, because we are testing
+            // sponsorship(sponsor, bob) will pay the fee. bob is sfDelegate.
+            BEAST_EXPECT(!env.le(keylet::sponsorship(sponsor, alice)));
+
+            env(pay(alice, carol, sendAmt),
+                delegate::As(bob),
+                Fee(feeAmt),
+                sponsor::As(sponsor, spfSponsorFee));
+            env.close();
+
+            BEAST_EXPECT(env.balance(alice) == aliceBalance - sendAmt);
+            BEAST_EXPECT(env.balance(bob) == bobBalance);
+            BEAST_EXPECT(env.balance(carol) == carolBalance + sendAmt);
+            BEAST_EXPECT(env.balance(sponsor) == sponsorBalance);
+            // sponsorship(sponsor, bob) pays the fee, bob is sfDelegate
+            BEAST_EXPECT(sponsor::sponsorshipFeeBalance(env, sponsor, bob) == sponsorFee - feeAmt);
+        }
+    }
+
+    void
+    testBatch()
+    {
+        testcase("Batch");
+        using namespace test::jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+
+        //
+        // outer transaction
+        //
+        {
+            // test outer transaction with co-signing sponsor
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob, sponsor);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(batch::outer(alice, seq, XRP(1), tfAllOrNothing),
+                batch::Inner(noop(alice), seq + 1),
+                batch::Inner(ticket::create(alice, 1), seq + 2),
+                sponsor::As(sponsor, spfSponsorFee),
+                Sig(sfSponsorSignature, sponsor),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // does not affect reserve
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+
+            // Fee is paid by sponsor
+            BEAST_EXPECT(env.balance(alice) == XRP(1000));
+            BEAST_EXPECT(env.balance(sponsor) == XRP(1000 - 1));
+        }
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob, sponsor);
+            env.close();
+
+            // spfSponsorReserve on outer Batch is rejected
+            for (auto const flags : {spfSponsorReserve | spfSponsorFee, spfSponsorReserve})
+            {
+                auto const seq = env.seq(alice);
+                env(batch::outer(alice, seq, XRP(1), tfAllOrNothing),
+                    batch::Inner(noop(alice), seq + 1),
+                    batch::Inner(noop(alice), seq + 2),
+                    sponsor::As(sponsor, flags),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(temINVALID_FLAG));
+                env.close();
+            }
+        }
+        {
+            // test outer transaction with prefunded sponsor
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob);
+            env.fund(XRP(1001), sponsor);
+            env.close();
+
+            env(sponsor::set(sponsor, 0, 100, XRP(100)),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(batch::outer(alice, seq, XRP(1), tfAllOrNothing),
+                batch::Inner(noop(alice), seq + 1),
+                batch::Inner(ticket::create(alice, 1), seq + 2),
+                sponsor::As(sponsor, spfSponsorFee),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // does not affect reserve
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+
+            // Fee is paid by sponsor object
+            BEAST_EXPECT(env.balance(alice) == XRP(1000));
+            BEAST_EXPECT(env.balance(sponsor) == XRP(900));
+
+            auto const sponsorshipSle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sponsorshipSle);
+            BEAST_EXPECT(sponsorshipSle->at(sfFeeAmount) == XRP(100 - 1));
+            BEAST_EXPECT(sponsorshipSle->at(sfRemainingOwnerCount) == 100);
+        }
+        //
+        // Inner transaction
+        //
+        {
+            // test invalid Inner transaction with co-signing sponsor
+            Account const signerAccount("signer");
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob, sponsor, signerAccount);
+            env.close();
+
+            env(signers(sponsor, 1, {Signer(signerAccount, 1)}));
+            env.close();
+
+            {
+                auto jt = env.jtnofill(
+                    noop(alice),
+                    sponsor::As(sponsor, spfSponsorReserve | spfSponsorFee),
+                    Sig(sfSponsorSignature, sponsor));
+                jt.jv.removeMember(sfTxnSignature.jsonName);
+
+                auto const seq = env.seq(alice);
+                // should fail because Inner transaction cannot include SponsorSignature with
+                // TxnSignature
+                BEAST_EXPECT(jt.jv[sfSponsorSignature.jsonName].isMember(sfTxnSignature.jsonName));
+                env(batch::outer(alice, seq, XRP(1), tfAllOrNothing),
+                    batch::Inner(jt.jv, seq + 1),
+                    batch::Inner(ticket::create(alice, 1), seq + 2),
+                    Ter(temBAD_SIGNATURE));
+            }
+
+            {
+                auto jt = env.jtnofill(
+                    noop(alice),
+                    sponsor::As(sponsor, spfSponsorReserve | spfSponsorFee),
+                    Msig(sfSponsorSignature, sponsor, signerAccount));
+                jt.jv.removeMember(sfTxnSignature.jsonName);
+
+                auto const seq = env.seq(alice);
+                // should fail because Inner transaction cannot include SponsorSignature with
+                // Signers
+                BEAST_EXPECT(jt.jv[sfSponsorSignature.jsonName].isMember(sfSigners.jsonName));
+                env(batch::outer(alice, seq, XRP(1), tfAllOrNothing),
+                    batch::Inner(jt.jv, seq + 1),
+                    batch::Inner(ticket::create(alice, 1), seq + 2),
+                    Ter(temBAD_SIGNER));
+            }
+
+            {
+                auto jt = env.jtnofill(
+                    noop(alice),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor));
+                jt.jv.removeMember(sfTxnSignature.jsonName);
+                jt.jv[sfSponsorSignature.jsonName].removeMember(sfTxnSignature.jsonName);
+                jt.jv[sfSponsorSignature.jsonName][sfSigningPubKey.jsonName] = "";
+
+                auto const seq = env.seq(alice);
+                // should fail because BatchSigners does not have signer for SponsorSignature
+                env(batch::outer(alice, seq, XRP(1), tfAllOrNothing),
+                    batch::Inner(jt.jv, seq + 1),
+                    batch::Inner(ticket::create(alice, 1), seq + 2),
+                    Ter(temBAD_SIGNER));
+            }
+        }
+
+        {
+            // test Inner transaction with prefunded sponsor
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob);
+            env.fund(XRP(1001), sponsor);
+            env.close();
+
+            env(sponsor::set(sponsor, 0, 100, XRP(100)),
+                sponsor::SponseeAcc(alice),
+                Fee(XRP(1)),
+                Ter(tesSUCCESS));
+            env.close();
+            BEAST_EXPECT(env.balance(sponsor) == XRP(900));
+
+            auto jt = env.jtnofill(
+                check::create(alice, bob, XRP(1)), sponsor::As(sponsor, spfSponsorReserve));
+            // remove txn signature since it is filled by env.jtnofill()
+            jt.jv.removeMember(jss::TxnSignature);
+
+            auto const seq = env.seq(alice);
+            env(batch::outer(alice, seq, XRP(1), tfAllOrNothing),
+                batch::Inner(noop(alice), seq + 1),
+                batch::Inner(jt.jv, seq + 2),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // affect sponsor reserve
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+            // Fee is paid by outer transaction originator (alice)
+            BEAST_EXPECT(env.balance(alice) == XRP(999));
+            BEAST_EXPECT(env.balance(sponsor) == XRP(900));
+
+            // reserve count is decreased
+            auto const sponsorshipSle = env.le(keylet::sponsorship(sponsor, alice));
+            BEAST_EXPECT(sponsorshipSle);
+            BEAST_EXPECT(sponsorshipSle->at(sfFeeAmount) == XRP(100));
+            BEAST_EXPECT(sponsorshipSle->at(sfRemainingOwnerCount) == 99);
+        }
+
+        {
+            // test Inner transaction with co-signing sponsor
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob, sponsor);
+            env.close();
+
+            auto jt = env.jtnofill(
+                check::create(alice, bob, XRP(1)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            // remove txn signature since it is filled by env.jtnofill()
+            jt.jv.removeMember(sfTxnSignature.jsonName);
+            jt.jv[sfSponsorSignature.jsonName].removeMember(sfTxnSignature.jsonName);
+            jt.jv[sfSponsorSignature.jsonName][sfSigningPubKey.jsonName] = "";
+
+            auto const seq = env.seq(alice);
+            env(batch::outer(alice, seq, XRP(1), tfAllOrNothing),
+                batch::Inner(noop(alice), seq + 1),
+                batch::Inner(jt.jv, seq + 2),
+                batch::Sig(sponsor),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // affect sponsor reserve
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+
+            // Fee is paid by outer transaction originator (alice)
+            BEAST_EXPECT(env.balance(alice) == XRP(999));
+            BEAST_EXPECT(env.balance(sponsor) == XRP(1000));
+        }
+
+        // Inner tx with sfSponsor + spfSponsorFee (pre-funded) is rejected
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob, sponsor);
+            env.close();
+
+            // Create pre-funded sponsorship
+            env(sponsor::set(sponsor, 0, 0, XRP(1)), sponsor::SponseeAcc(alice), Fee(XRP(1)));
+            env.close();
+
+            auto const seq = env.seq(alice);
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+
+            // Create inner transaction with sponsor fee
+            auto innerPay = pay(alice, bob, XRP(1));
+            innerPay[sfSponsor.jsonName] = sponsor.human();
+            innerPay[sfSponsorFlags.jsonName] = static_cast<std::uint32_t>(spfSponsorFee);
+
+            // Should be rejected with temBAD_FEE
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(innerPay, seq + 1),
+                batch::Inner(noop(alice), seq + 2),
+                Ter(temINVALID_FLAG));
+            env.close();
+        }
+
+        // Inner tx with sfSponsor + spfSponsorFee (co-signed) is rejected
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob, sponsor);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+
+            auto innerPay = pay(alice, bob, XRP(1));
+            innerPay[sfSponsor.jsonName] = sponsor.human();
+            innerPay[sfSponsorFlags.jsonName] = static_cast<std::uint32_t>(spfSponsorFee);
+
+            // Should be rejected with temBAD_FEE
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(innerPay, seq + 1),
+                batch::Inner(noop(alice), seq + 2),
+                batch::Sig(sponsor),
+                Ter(temINVALID_FLAG));
+            env.close();
+        }
+
+        //  Inner tx with spfSponsorFee + spfSponsorReserve is rejected
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob, sponsor);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+
+            auto innerTx = check::create(alice, bob, XRP(1));
+            innerTx[sfSponsor.jsonName] = sponsor.human();
+            innerTx[sfSponsorFlags.jsonName] =
+                static_cast<std::uint32_t>(spfSponsorFee | spfSponsorReserve);
+
+            // Should be rejected with temBAD_FEE (fee sponsorship check comes first)
+            env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                batch::Inner(innerTx, seq + 1),
+                batch::Inner(noop(alice), seq + 2),
+                Ter(temINVALID_FLAG));
+            env.close();
+        }
+
+        // Outer batch tx with sponsor fee is allowed
+        {
+            Env env{*this, testableAmendments()};
+            env.fund(XRP(1000), alice, bob, sponsor);
+            env.close();
+
+            auto const seq = env.seq(bob);
+            auto const batchFee = batch::calcBatchFee(env, 0, 2);
+
+            // Outer batch with sponsor fee should work fine
+            env(batch::outer(bob, seq, batchFee, tfAllOrNothing),
+                batch::Inner(noop(bob), seq + 1),
+                batch::Inner(noop(bob), seq + 2),
+                sponsor::As(sponsor, spfSponsorFee),
+                Sig(sfSponsorSignature, sponsor),
+                Ter(tesSUCCESS));
+            env.close();
+
+            // Sponsor paid the fee
+            BEAST_EXPECT(env.balance(bob) == XRP(1000));
+        }
+    }
+
+    // Verify that the central allow-list in preflight1Sponsor rejects
+    // spfSponsorReserve for transaction types that v1 does not permit.
+    void
+    testReserveSponsorGate()
+    {
+        testcase("Reserve sponsor allow-list gate");
+        using namespace test::jtx;
+
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+        env.fund(XRP(10000), alice, bob, sponsor);
+        env.close();
+
+        env(sponsor::set(sponsor, 0, 10, XRP(10)), sponsor::SponseeAcc(alice));
+        env.close();
+
+        auto checkBlocked = [&](json::Value const& jv) {
+            env(jv,
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor),
+                Ter(temINVALID_FLAG));
+        };
+
+        checkBlocked(ticket::create(alice, 1));
+        checkBlocked(offer(alice, XRP(100), bob["USD"](100)));
+        checkBlocked(did::setValid(alice));
+        checkBlocked(token::mint(alice, 0u));
+        checkBlocked(sponsor::set(alice, 0, 10, XRP(10)));
+        checkBlocked(acctdelete(alice, bob));
+        checkBlocked(loan::set(alice, uint256(1), Number{1}));
+    }
+
+    void
+    testSponsorReserve(bool cosigning)
+    {
+        testRequireFlag();
+        testSponsorReserveSimple(cosigning);
+        testCheck(cosigning);
+        testCredential(cosigning);
+        testDelegate(cosigning);
+        testDepositPreauth(cosigning);
+        testEscrow(cosigning);
+        testMPToken(cosigning);
+        testPayChan(cosigning);
+        testSignerList(cosigning);
+        testTrustSet(cosigning);
+    }
+
+    void
+    testZeroBalanceSponsoredPaymentFeePayerCheck()
+    {
+        // Zero-balance sponsored Payment: getFeePayer() consistency check
+        testcase("Sponsored Payment: minimal-balance account with sponsor-pays-fee");
+
+        using namespace jtx;
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        Account const dest("dest");
+
+        auto const baseFee = env.current()->fees().base;
+        auto const baseReserve = env.current()->fees().reserve;
+
+        // Fund sponsor and dest generously, alice with base reserve + 1 XRP for payment
+        env.fund(XRP(10000), sponsor, dest);
+        env.fund(baseReserve + XRP(1), alice);
+        env.close();
+
+        // Precondition: alice has base reserve + 1 XRP (enough for payment but not fee)
+        BEAST_EXPECT(env.balance(alice) == baseReserve + XRP(1));
+
+        // Alice tries to send a Payment to dest where sponsor pays the fee via spfSponsorFee.
+        // Passed even alice balance doesn't have enough to pay fee.
+        auto const preDest = env.balance(dest);
+        auto const preSponsor = env.balance(sponsor);
+
+        // Alice sends 1 XRP to dest, sponsor pays the fee
+        env(pay(alice, dest, XRP(1)),
+            sponsor::As(sponsor, spfSponsorFee),
+            Sig(sfSponsorSignature, sponsor),
+            Fee(baseFee));
+        env.close();
+
+        // Payment succeeded
+        // Alice's balance decreased by 1 XRP (the payment amount, NOT the fee)
+        BEAST_EXPECT(env.balance(alice) == baseReserve);
+
+        // Dest received 1 XRP
+        BEAST_EXPECT(env.balance(dest) == preDest + XRP(1));
+
+        // Sponsor paid the fee (NOT alice)
+        BEAST_EXPECT(env.balance(sponsor) == preSponsor - baseFee);
+    }
+
+    void
+    testTrustSetCounterpartySponsorMisroute()
+    {
+        // TrustSet's modify path applies the tx-level reserve sponsor to whichever
+        // side has its reserve gate trip on this update, regardless of whether that
+        // side belongs to the tx submitter. trustCreate only sets the submitter's
+        // reserve flag and snapshots the counterparty's asfDefaultRipple state into
+        // the line's NoRipple bit; if the counterparty later toggles asfDefaultRipple
+        // (the canonical issuer flow), the line and account flags disagree and on
+        // the submitter's next TrustSet the counterparty-side gate fires. Sponsor still will be
+        // checked if it can be applied to that end of the trustLine.
+
+        testcase("TrustSet modify with sponsor does not misroute onto counterparty side");
+
+        using namespace test::jtx;
+
+        Env env{*this, testableAmendments()};
+        Account const alice{"alice_t2178"};
+        Account const bob{"bob_t2178"};
+        Account const carol{"carol_t2178"};
+
+        // Fund without auto-setting asfDefaultRipple
+        env.fund(XRP(100'000), alice, bob, carol);
+        env.close();
+
+        // Determine account ordering
+        bool const aliceIsHigh = alice.id() > bob.id();
+
+        // To trigger the bug, we need the COUNTERPARTY's reserve gate to trip
+        // We use issuer/holder terminology where:
+        // - holder creates the trust line (their reserve is set first)
+        // - issuer enables DefaultRipple after (creates flag mismatch)
+        // - holder's second TrustSet triggers issuer's reserve gate
+
+        auto const issuer = aliceIsHigh ? bob : alice;
+        auto const holder = aliceIsHigh ? alice : bob;
+        auto const usd = issuer["USD"];
+
+        // Issuer must NOT have DefaultRipple set initially
+        // Clear it explicitly (env.fund may have set it)
+        env(fclear(issuer, asfDefaultRipple));
+        env.close();
+
+        // Holder creates the trust line first (holder's reserve flag is set)
+        // At this point, issuer does NOT have DefaultRipple set, so
+        // the NoRipple bit on issuer's side is set according to issuer's current flag
+        env(trust(holder, usd(1'000)));
+        env.close();
+
+        // Issuer now enables asfDefaultRipple (canonical issuer flow)
+        // This creates a mismatch: issuer's account flag says DefaultRipple=true
+        // but the trust line's NoRipple bit on issuer's side is still set
+        env(fset(issuer, asfDefaultRipple));
+        env.close();
+
+        SF_ACCOUNT const& issuerSponsorField = aliceIsHigh ? sfLowSponsor : sfHighSponsor;
+        SF_ACCOUNT const& holderSponsorField = aliceIsHigh ? sfHighSponsor : sfLowSponsor;
+
+        auto const lineKey = keylet::trustLine(alice, bob, usd.currency);
+        auto const sleLineBefore = env.le(lineKey);
+        if (!BEAST_EXPECT(sleLineBefore))
+            return;
+        BEAST_EXPECT(!sleLineBefore->isFieldPresent(sfLowSponsor));
+        BEAST_EXPECT(!sleLineBefore->isFieldPresent(sfHighSponsor));
+
+        auto const carolBefore = sponsoringOwnerCount(env, carol);
+        BEAST_EXPECT(carolBefore == 0);
+        auto const issuerSponsoredBefore = sponsoredOwnerCount(env, issuer);
+        BEAST_EXPECT(issuerSponsoredBefore == 0);
+
+        // Holder modifies the trust line with Carol as sponsor
+        // This should trigger the issuer's reserve gate because of the DefaultRipple mismatch
+        // Carol (sponsor) should NOT be applied to issuer's side (issuer != tx submitter)
+        env(trust(holder, usd(2'000)),
+            sponsor::As(carol, spfSponsorReserve),
+            Sig(sfSponsorSignature, carol),
+            Ter(tesSUCCESS));
+        env.close();
+
+        auto const sleLineAfter = env.le(lineKey);
+        if (!BEAST_EXPECT(sleLineAfter))
+            return;
+
+        // Carol only agreed to back the holder, not the issuer
+        BEAST_EXPECT(!sleLineAfter->isFieldPresent(issuerSponsorField));
+
+        // Holder's side also has no sponsor because holder's reserve flag was
+        // already set on the FIRST TrustSet (no sponsor in scope then)
+        BEAST_EXPECT(!sleLineAfter->isFieldPresent(holderSponsorField));
+
+        // Carol's sponsoring count should remain unchanged (no misroute)
+        auto const carolAfter = sponsoringOwnerCount(env, carol);
+        BEAST_EXPECT(carolAfter == carolBefore);
+
+        // Issuer's sponsored count should remain unchanged (no misroute)
+        auto const issuerSponsoredAfter = sponsoredOwnerCount(env, issuer);
+        BEAST_EXPECT(issuerSponsoredAfter == issuerSponsoredBefore);
+    }
+
+    void
+    testSelfEscrowFinishReserveGate()
+    {
+        testcase("Self-escrow finish reserve order gated by amendment");
+        using namespace test::jtx;
+        using namespace std::chrono_literals;
+
+        // Finishing a self-escrow (source == destination) whose trust line
+        // was deleted while the escrow was outstanding auto-creates the line,
+        // and the outcome of that reserve check depends on whether the escrow
+        // reserve is released before delivery (Sponsor) or after (legacy).
+        // With the source's balance in the one-increment window
+        // [reserve(1), reserve(2)), the legacy order requires reserve(2) and
+        // fails, while the Sponsor order requires reserve(1) and succeeds.
+        auto runTest = [&](FeatureBitset features, TER expected) {
+            Account const alice("alice");
+            Account const gw("gw");
+            auto const usd = gw["usd"];
+
+            Env env{*this, features};
+            auto const baseFee = env.current()->fees().base;
+
+            env.fund(XRP(10000), alice, gw);
+            env.close();
+
+            env(fset(gw, asfAllowTrustLineLocking));
+            env.close();
+
+            env.trust(usd(1000), alice);
+            env.close();
+            env(pay(gw, alice, usd(100)));
+            env.close();
+
+            // Escrow alice's entire USD balance to herself. The escrowed
+            // IOUs return to the issuer, zeroing the line balance.
+            auto const seq = env.seq(alice);
+            env(escrow::create(alice, alice, usd(100)),
+                escrow::kCondition(escrow::kCb1),
+                escrow::kCancelTime(env.now() + 100s));
+            env.close();
+
+            // Delete the now-empty trust line. Both accounts have
+            // DefaultRipple set (jtx fund does that), so a plain limit-0
+            // TrustSet returns the line to its default state.
+            env(trust(alice, usd(0)));
+            env.close();
+            BEAST_EXPECT(!env.le(keylet::trustLine(alice, gw, usd.currency)));
+            BEAST_EXPECT(ownerCount(env, alice) == 1);  // just the escrow
+
+            // Put alice's balance in the window. Pay the excess away
+            // directly: adjustAccountXRPBalance needs the Sponsor amendment.
+            STAmount const target = reserve(env, 1) + XRP(1);
+            env(pay(alice, env.master, env.balance(alice) - target - baseFee), Fee(baseFee));
+            env.close();
+            BEAST_EXPECT(env.balance(alice) == target);
+
+            env(escrow::finish(alice, alice, seq),
+                escrow::kCondition(escrow::kCb1),
+                escrow::kFulfillment(escrow::kFb1),
+                Fee(baseFee * 150),
+                Ter(expected));
+            env.close();
+
+            if (expected == tesSUCCESS)
+            {
+                BEAST_EXPECT(!env.le(keylet::escrow(alice, seq)));
+                BEAST_EXPECT(env.le(keylet::trustLine(alice, gw, usd.currency)));
+                BEAST_EXPECT(env.balance(alice, usd) == usd(100));
+                BEAST_EXPECT(ownerCount(env, alice) == 1);  // the new line
+            }
+            else
+            {
+                BEAST_EXPECT(env.le(keylet::escrow(alice, seq)));
+                BEAST_EXPECT(!env.le(keylet::trustLine(alice, gw, usd.currency)));
+                BEAST_EXPECT(ownerCount(env, alice) == 1);  // still the escrow
+            }
+        };
+
+        // Pre-amendment: legacy order — the escrow still counts against the
+        // reserve while the auto-created line is checked.
+        runTest(testableAmendments() - featureSponsor, tecNO_LINE_INSUF_RESERVE);
+
+        // Post-amendment: the escrow reserve is recycled into the new line.
+        runTest(testableAmendments(), tesSUCCESS);
+    }
+
+    void
+    testFeeSponsoredVaultInvariant()
+    {
+        // The ValidVault invariant checks that the vault's balance and the
+        // depositor's balance change by equal amounts. For XRP vaults it adds the
+        // fee back into the depositor's balance change: normally the depositor
+        // pays the fee, so their balance drops by (deposit amount + fee), and
+        // adding the fee back leaves just the deposit amount to compare against
+        // the vault. But when a fee sponsor pays, the depositor's balance drops
+        // by only the deposit amount, so the fee must NOT be added back or the
+        // equal-amount check fails.
+        testcase("Fee-sponsored VaultDeposit/VaultWithdraw pass ValidVault invariant");
+        using namespace test::jtx;
+
+        Env env{*this, testableAmendments()};
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        env.fund(XRP(10000), alice, sponsor);
+        env.close();
+
+        PrettyAsset const xrpAsset{xrpIssue(), 1'000'000};
+        Vault const vault{env};
+        auto [vaultTx, vaultKeylet] = vault.create({.owner = alice, .asset = xrpAsset});
+        env(vaultTx);
+        env.close();
+
+        // Control: the same deposit shape, unsponsored, succeeds.
+        env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = xrpAsset(100)}),
+            Ter(tesSUCCESS));
+        env.close();
+
+        // Fee-sponsored (co-signed) deposit succeeds.
+        env(vault.deposit({.depositor = alice, .id = vaultKeylet.key, .amount = xrpAsset(100)}),
+            Fee(XRP(1)),
+            sponsor::As(sponsor, spfSponsorFee),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(tesSUCCESS));
+        env.close();
+
+        // The same helper (deltaAssetsTxAccount) drives the withdraw path, so a
+        // fee-sponsored withdrawal back to the depositor's own account also
+        // passes on the destination side.
+        env(vault.withdraw({.depositor = alice, .id = vaultKeylet.key, .amount = xrpAsset(50)}),
+            Fee(XRP(1)),
+            sponsor::As(sponsor, spfSponsorFee),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(tesSUCCESS));
+        env.close();
+    }
+
+    void
+    testSponsoredObjectDeletionRefund()
+    {
+        // Deleting a co-signed reserve-sponsored object must
+        // refund the sponsor's SponsoringOwnerCount back to zero.
+        testcase("Sponsored object deletion refunds sponsor owner count");
+        using namespace test::jtx;
+
+        Env env{*this, testableAmendments()};
+        Account const sponsor("sponsor");
+        env.fund(XRP(100000), sponsor);
+        env.close();
+
+        // Sponsored Check deletion - verify decreaseOwnerCountForObject
+        // (used by CheckCancel) reads the object's sfSponsor field and refunds
+        // the sponsor's owner count.
+        {
+            testcase("  — Check deletion");
+
+            Account const checkOwner("check_owner");
+            Account const dest("check_dest");
+            env.fund(XRP(100000), checkOwner, dest);
+            env.close();
+
+            // Create a check with co-signed reserve sponsorship. This bumps the
+            // sponsor's sfSponsoringOwnerCount rather than the check owner's.
+            auto const checkSeq = env.seq(checkOwner);
+            env(check::create(checkOwner, dest, XRP(1)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            auto sponsorCountBefore = sponsoringOwnerCount(env, sponsor);
+            BEAST_EXPECT(sponsorCountBefore == 1);  // check costs 1 owner count
+
+            // Cancel (delete) the check.
+            env(check::cancel(checkOwner, keylet::check(checkOwner, checkSeq).key));
+            env.close();
+
+            auto sponsorCountAfter = sponsoringOwnerCount(env, sponsor);
+            BEAST_EXPECT(sponsorCountAfter == 0);  // fully refunded
+        }
+
+        // Sponsored TrustSet (trust line) deletion - verify the sponsor
+        // refund works when a sponsored trust line is deleted
+        {
+            testcase("  — TrustLine deletion");
+
+            Account const issuer("issuer");
+            Account const holder("holder");
+            env.fund(XRP(100000), issuer, holder);
+            env.close();
+
+            auto const usd = issuer["USD"];
+
+            // Create trust line with sponsorship on the holder side
+            env(trust(holder, usd(1000)),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            auto sponsorCountBefore = sponsoringOwnerCount(env, sponsor);
+            BEAST_EXPECT(sponsorCountBefore == 1);  // trust line costs 1
+
+            // Delete the trust line by clearing it to default
+            env(trust(holder, usd(0)));
+            env.close();
+
+            auto sponsorCountAfter = sponsoringOwnerCount(env, sponsor);
+            BEAST_EXPECT(sponsorCountAfter == 0);  // fully refunded
+        }
+    }
+
+protected:
+    void
+    testSponsor()
+    {
+        testDisabled();
+        testInvalidSponsorshipSet();
+        testPseudoAccountSponsorship();
+
+        testSingleSigning();
+        testMultiSigning();
+
+        testInvalidSponsorField();
+
+        testSimpleSponsorshipSet();
+
+        testPreFundAndCosign();
+        testSponsoredFreeTierReserve();
+
+        testTransferSponsor();
+        testLegacySignerListReserve();
+        testSponsorFee();
+        testSponsorAccount();
+
+        testAccountDelete();
+
+        testDelegatePermission();
+        testDelegateBlockReserveSponsor();
+        testDelegateSponsorFeePayer();
+
+        testBatch();
+
+        testSponsoredTrustLineNoFreeReserve();
+        testCoSignReserveBoundedBySponsorshipBudget();
+        testReserveSponsorGate();
+
+        testZeroBalanceSponsoredPaymentFeePayerCheck();
+        testTrustSetCounterpartySponsorMisroute();
+        testSelfEscrowFinishReserveGate();
+
+        testFeeSponsoredVaultInvariant();
+        testSponsoredObjectDeletionRefund();
+    }
+
+    void
+    testTxSponsor(bool cosigning)
+    {
+        testSponsorReserve(cosigning);
+    }
+
+public:
+    void
+    run() override
+    {
+        testSponsor();
+    }
+};
+
+class SponsorTxCosigning_test : public Sponsor_test
+{
+    void
+    run() override
+    {
+        testTxSponsor(true);
+    }
+};
+
+class SponsorTxPrefunded_test : public Sponsor_test
+{
+    void
+    run() override
+    {
+        testTxSponsor(false);
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(Sponsor, app, xrpl);
+BEAST_DEFINE_TESTSUITE(SponsorTxCosigning, app, xrpl);
+BEAST_DEFINE_TESTSUITE(SponsorTxPrefunded, app, xrpl);
+
+}  // namespace xrpl::test
diff --git a/src/test/app/Ticket_test.cpp b/src/test/app/Ticket_test.cpp
index 626cdbe44d..5700503830 100644
--- a/src/test/app/Ticket_test.cpp
+++ b/src/test/app/Ticket_test.cpp
@@ -503,7 +503,7 @@ class Ticket_test : public beast::unit_test::Suite
         Account const alice{"alice"};
 
         // Fund alice not quite enough to make the reserve for a Ticket.
-        env.fund(env.current()->fees().accountReserve(1) - drops(1), alice);
+        env.fund(env.current()->fees().accountReserve(1, 1) - drops(1), alice);
         env.close();
 
         env(ticket::create(alice, 1), Ter(tecINSUFFICIENT_RESERVE));
@@ -511,7 +511,8 @@ class Ticket_test : public beast::unit_test::Suite
         env.require(Owners(alice, 0), tickets(alice, 0));
 
         // Give alice enough to exactly meet the reserve for one Ticket.
-        env(pay(env.master, alice, env.current()->fees().accountReserve(1) - env.balance(alice)));
+        env(pay(
+            env.master, alice, env.current()->fees().accountReserve(1, 1) - env.balance(alice)));
         env.close();
 
         env(ticket::create(alice, 1));
@@ -524,7 +525,7 @@ class Ticket_test : public beast::unit_test::Suite
         env(
             pay(env.master,
                 alice,
-                env.current()->fees().accountReserve(250) - drops(1) - env.balance(alice)));
+                env.current()->fees().accountReserve(250, 1) - drops(1) - env.balance(alice)));
         env.close();
 
         // alice doesn't quite have the reserve for a total of 250
@@ -535,7 +536,8 @@ class Ticket_test : public beast::unit_test::Suite
 
         // Give alice enough so she can make the reserve for all 250
         // Tickets.
-        env(pay(env.master, alice, env.current()->fees().accountReserve(250) - env.balance(alice)));
+        env(pay(
+            env.master, alice, env.current()->fees().accountReserve(250, 1) - env.balance(alice)));
         env.close();
 
         std::uint32_t const ticketSeq{env.seq(alice) + 1};
diff --git a/src/test/app/TrustSet_test.cpp b/src/test/app/TrustSet_test.cpp
index 15abc3bd06..e24373fd21 100644
--- a/src/test/app/TrustSet_test.cpp
+++ b/src/test/app/TrustSet_test.cpp
@@ -191,7 +191,7 @@ public:
 
         auto const txFee = env.current()->fees().base;
         auto const baseReserve = env.current()->fees().reserve;
-        auto const threelineReserve = env.current()->fees().accountReserve(3);
+        auto const threelineReserve = env.current()->fees().accountReserve(3, 1);
 
         env.fund(XRP(10000), gwA, gwB, assistor);
 
diff --git a/src/test/app/TxQ_test.cpp b/src/test/app/TxQ_test.cpp
index 91eb26da7e..3175e742d9 100644
--- a/src/test/app/TxQ_test.cpp
+++ b/src/test/app/TxQ_test.cpp
@@ -20,6 +20,8 @@
 #include <test/jtx/require.h>
 #include <test/jtx/sendmax.h>
 #include <test/jtx/seq.h>
+#include <test/jtx/sig.h>
+#include <test/jtx/sponsor.h>
 #include <test/jtx/tags.h>
 #include <test/jtx/ter.h>
 #include <test/jtx/ticket.h>
@@ -2335,6 +2337,43 @@ public:
         BEAST_EXPECT(env.balance(alice) == drops(5));
     }
 
+    void
+    testSponsorTxCannotQueue()
+    {
+        using namespace jtx;
+        testcase("disallow sponsored transaction from being queued");
+
+        Env env(*this, makeConfig({{Keys::kMinimumTxnInLedgerStandalone, "3"}}));
+
+        auto sponsor = Account("sponsor");
+        auto sponsee = Account("sponsee");
+        auto filler = Account("filler");
+
+        env.fund(XRP(50000), noripple(sponsor, sponsee));
+        env.close();
+        env.fund(XRP(50000), noripple(filler));
+        env.close();
+
+        fillQueue(env, filler);
+        checkMetrics(*this, env, 0, 6, 4, 3);
+
+        // Sponsored transactions are not allowed to be queued.
+        env(noop(sponsee),
+            sponsor::As(sponsor, spfSponsorFee),
+            Sig(sfSponsorSignature, sponsor),
+            Ter(telCAN_NOT_QUEUE));
+        checkMetrics(*this, env, 0, 6, 4, 3);
+
+        // Sponsored transactions may still apply directly if they pay the
+        // open ledger fee. They just cannot be held in the queue.
+        env(noop(sponsee),
+            sponsor::As(sponsor, spfSponsorFee),
+            Sig(sfSponsorSignature, sponsor),
+            Fee(openLedgerCost(env)),
+            Ter(tesSUCCESS));
+        checkMetrics(*this, env, 0, 6, 5, 3);
+    }
+
     void
     testDelegateTxCannotQueue()
     {
@@ -4698,6 +4737,7 @@ public:
         testBlockersSeq();
         testBlockersTicket();
         testInFlightBalance();
+        testSponsorTxCannotQueue();
         testDelegateTxCannotQueue();
         testConsequences();
     }
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index 3877e08f7e..4de8c9c616 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -10,6 +10,7 @@
 #include <test/jtx/fee.h>
 #include <test/jtx/flags.h>
 #include <test/jtx/mpt.h>
+#include <test/jtx/noop.h>
 #include <test/jtx/offer.h>
 #include <test/jtx/paths.h>
 #include <test/jtx/pay.h>
@@ -1804,7 +1805,7 @@ class Vault_test : public beast::unit_test::Suite
         auto const [acctReserve, incReserve] = [this]() -> std::pair<int, int> {
             Env const env{*this, testableAmendments()};
             return {
-                env.current()->fees().accountReserve(0).drops() / kDropsPerXrp.drops(),
+                env.current()->fees().accountReserve(0, 1).drops() / kDropsPerXrp.drops(),
                 env.current()->fees().increment.drops() / kDropsPerXrp.drops()};
         }();
 
@@ -2686,7 +2687,7 @@ class Vault_test : public beast::unit_test::Suite
         auto const [acctReserve, incReserve] = [this]() -> std::pair<int, int> {
             Env const env{*this, testableAmendments()};
             return {
-                env.current()->fees().accountReserve(0).drops() / kDropsPerXrp.drops(),
+                env.current()->fees().accountReserve(0, 1).drops() / kDropsPerXrp.drops(),
                 env.current()->fees().increment.drops() / kDropsPerXrp.drops()};
         }();
 
@@ -5927,8 +5928,9 @@ class Vault_test : public beast::unit_test::Suite
                 token->setFieldVL(*field, gMakeZeroBuffer(kEcGamalEncryptedTotalLength));
                 sb.update(token);
 
+                auto const dummyTx = *env.jt(noop(holder)).stx;
                 BEAST_EXPECT(
-                    removeEmptyHolding(sb, holder.id(), MPTIssue(mpt.issuanceID()), j) ==
+                    removeEmptyHolding({sb, dummyTx}, holder.id(), MPTIssue(mpt.issuanceID()), j) ==
                     tecHAS_OBLIGATIONS);
                 BEAST_EXPECT(sb.peek(tokenKeylet) != nullptr);
             }
diff --git a/src/test/app/XChain_test.cpp b/src/test/app/XChain_test.cpp
index 6c8377d8e3..4b007eea13 100644
--- a/src/test/app/XChain_test.cpp
+++ b/src/test/app/XChain_test.cpp
@@ -141,7 +141,7 @@ struct SEnv
     XRPAmount
     reserve(std::uint32_t count)
     {
-        return env.current()->fees().accountReserve(count);
+        return env.current()->fees().accountReserve(count, 1);
     }
 
     XRPAmount
@@ -370,7 +370,7 @@ struct XChain_test : public beast::unit_test::Suite, public jtx::XChainBridgeObj
     XRPAmount
     reserve(std::uint32_t count)
     {
-        return XEnv(*this).env.current()->fees().accountReserve(count);
+        return XEnv(*this).env.current()->fees().accountReserve(count, 1);
     }
 
     XRPAmount
diff --git a/src/test/jtx/Env.h b/src/test/jtx/Env.h
index ba28d19738..04cbce953a 100644
--- a/src/test/jtx/Env.h
+++ b/src/test/jtx/Env.h
@@ -561,6 +561,24 @@ public:
     [[nodiscard]] std::uint32_t
     ownerCount(Account const& account) const;
 
+    /** Return the number of sponsored objects owned by an account.
+     * Throws if the account does not exist.
+     */
+    [[nodiscard]] std::uint32_t
+    sponsoredOwnerCount(Account const& account) const;
+
+    /** Return the number of sponsoring objects owned by an account.
+     * Throws if the account does not exist.
+     */
+    [[nodiscard]] std::uint32_t
+    sponsoringOwnerCount(Account const& account) const;
+
+    /** Return the number of sponsoring accounts owned by an account.
+     * Throws if the account does not exist.
+     */
+    [[nodiscard]] std::uint32_t
+    sponsoringAccountCount(Account const& account) const;
+
     /** Return an account root.
         @return empty if the account does not exist.
     */
diff --git a/src/test/jtx/JTx.h b/src/test/jtx/JTx.h
index da105e01aa..ed585ebb6e 100644
--- a/src/test/jtx/JTx.h
+++ b/src/test/jtx/JTx.h
@@ -37,7 +37,7 @@ struct JTx
     // Functions that sign the transaction from the Account
     std::vector<std::function<void(Env&, JTx&)>> mainSigners;
     // Functions that sign something else after the mainSigners, such as
-    // sfCounterpartySignature
+    // sfCounterpartySignature and sfSponsorSignature
     std::vector<std::function<void(Env&, JTx&)>> postSigners;
 
     JTx() = default;
diff --git a/src/test/jtx/TestHelpers.h b/src/test/jtx/TestHelpers.h
index cb2193db99..4c18d7343c 100644
--- a/src/test/jtx/TestHelpers.h
+++ b/src/test/jtx/TestHelpers.h
@@ -379,6 +379,18 @@ checkArraySize(json::Value const& val, unsigned int size);
 std::uint32_t
 ownerCount(test::jtx::Env const& env, test::jtx::Account const& account);
 
+// Helper function that returns the sponsored owner count on an account.
+std::uint32_t
+sponsoredOwnerCount(test::jtx::Env const& env, test::jtx::Account const& account);
+
+// Helper function that returns the sponsoring owner count on an account.
+std::uint32_t
+sponsoringOwnerCount(test::jtx::Env const& env, test::jtx::Account const& account);
+
+// Helper function that returns the sponsoring account count on an account.
+std::uint32_t
+sponsoringAccountCount(test::jtx::Env const& env, test::jtx::Account const& account);
+
 [[nodiscard]]
 inline bool
 checkVL(Slice const& result, std::string const& expected)
diff --git a/src/test/jtx/impl/AMMTest.cpp b/src/test/jtx/impl/AMMTest.cpp
index 46c5e44bd3..3b4aae20e2 100644
--- a/src/test/jtx/impl/AMMTest.cpp
+++ b/src/test/jtx/impl/AMMTest.cpp
@@ -197,7 +197,7 @@ AMMTestBase::testAMM(std::function<void(jtx::AMM&, jtx::Env&)> const& cb, TestAM
 XRPAmount
 AMMTest::reserve(jtx::Env& env, std::uint32_t count)
 {
-    return env.current()->fees().accountReserve(count);
+    return env.current()->fees().accountReserve(count, 1);
 }
 
 XRPAmount
diff --git a/src/test/jtx/impl/Env.cpp b/src/test/jtx/impl/Env.cpp
index db45deb6de..3f6aca9fcb 100644
--- a/src/test/jtx/impl/Env.cpp
+++ b/src/test/jtx/impl/Env.cpp
@@ -271,6 +271,33 @@ Env::ownerCount(Account const& account) const
     return sle->getFieldU32(sfOwnerCount);
 }
 
+std::uint32_t
+Env::sponsoredOwnerCount(Account const& account) const
+{
+    auto const sle = le(account);
+    if (!sle)
+        Throw<std::runtime_error>("missing account root");
+    return sle->getFieldU32(sfSponsoredOwnerCount);
+}
+
+std::uint32_t
+Env::sponsoringOwnerCount(Account const& account) const
+{
+    auto const sle = le(account);
+    if (!sle)
+        Throw<std::runtime_error>("missing account root");
+    return sle->getFieldU32(sfSponsoringOwnerCount);
+}
+
+std::uint32_t
+Env::sponsoringAccountCount(Account const& account) const
+{
+    auto const sle = le(account);
+    if (!sle)
+        Throw<std::runtime_error>("missing account root");
+    return sle->getFieldU32(sfSponsoringAccountCount);
+}
+
 std::uint32_t
 Env::seq(Account const& account) const
 {
diff --git a/src/test/jtx/impl/TestHelpers.cpp b/src/test/jtx/impl/TestHelpers.cpp
index 95c8a68436..4d3869b4f9 100644
--- a/src/test/jtx/impl/TestHelpers.cpp
+++ b/src/test/jtx/impl/TestHelpers.cpp
@@ -94,6 +94,24 @@ ownerCount(Env const& env, Account const& account)
     return env.ownerCount(account);
 }
 
+std::uint32_t
+sponsoredOwnerCount(Env const& env, Account const& account)
+{
+    return env.sponsoredOwnerCount(account);
+}
+
+std::uint32_t
+sponsoringOwnerCount(Env const& env, Account const& account)
+{
+    return env.sponsoringOwnerCount(account);
+}
+
+std::uint32_t
+sponsoringAccountCount(Env const& env, Account const& account)
+{
+    return env.sponsoringAccountCount(account);
+}
+
 /* Path finding */
 /******************************************************************************/
 void
diff --git a/src/test/jtx/impl/multisign.cpp b/src/test/jtx/impl/multisign.cpp
index 66c5a4f27d..d948042bda 100644
--- a/src/test/jtx/impl/multisign.cpp
+++ b/src/test/jtx/impl/multisign.cpp
@@ -64,7 +64,8 @@ Msig::operator()(Env& env, JTx& jt) const
 {
     auto const mySigners = signers;
     auto callback = [subField = subField, mySigners, &env](Env&, JTx& jtx) {
-        // Where to put the signature. Supports sfCounterPartySignature.
+        // Where to put the signature. Supports sfCounterPartySignature and
+        // sfSponsorSignature.
         auto& sigObject = subField ? jtx[*subField] : jtx.jv;
 
         // The signing pub key is only required at the top level.
diff --git a/src/test/jtx/impl/owners.cpp b/src/test/jtx/impl/owners.cpp
index 2ff93757f0..ed10ca6930 100644
--- a/src/test/jtx/impl/owners.cpp
+++ b/src/test/jtx/impl/owners.cpp
@@ -44,6 +44,24 @@ Owners::operator()(Env& env) const
     env.test.expect(env.le(account_)->getFieldU32(sfOwnerCount) == value_);
 }
 
+void
+SponsoredOwners::operator()(Env& env) const
+{
+    env.test.expect(env.le(account_)->getFieldU32(sfSponsoredOwnerCount) == value_);
+}
+
+void
+SponsoringOwners::operator()(Env& env) const
+{
+    env.test.expect(env.le(account_)->getFieldU32(sfSponsoringOwnerCount) == value_);
+}
+
+void
+SponsoringAccountCount::operator()(Env& env) const
+{
+    env.test.expect(env.le(account_)->getFieldU32(sfSponsoringAccountCount) == value_);
+}
+
 }  // namespace test::jtx
 
 }  // namespace xrpl
diff --git a/src/test/jtx/impl/sig.cpp b/src/test/jtx/impl/sig.cpp
index 7140fad3de..e0123073b1 100644
--- a/src/test/jtx/impl/sig.cpp
+++ b/src/test/jtx/impl/sig.cpp
@@ -18,7 +18,7 @@ Sig::operator()(Env&, JTx& jt) const
         // VFALCO Inefficient pre-C++14
         auto const account = *account_;
         auto callback = [subField = subField_, account](Env&, JTx& jtx) {
-            // Where to put the signature. Supports sfCounterPartySignature.
+            // Where to put the signature. Supports sfCounterPartySignature and sfSponsorSignature.
             auto& sigObject = subField ? jtx[*subField] : jtx.jv;
 
             jtx::sign(jtx.jv, account, sigObject);
diff --git a/src/test/jtx/impl/sponsor.cpp b/src/test/jtx/impl/sponsor.cpp
new file mode 100644
index 0000000000..cdf68800f5
--- /dev/null
+++ b/src/test/jtx/impl/sponsor.cpp
@@ -0,0 +1,98 @@
+#include <test/jtx/sponsor.h>
+
+#include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/json/to_string.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/TxFlags.h>
+#include <xrpl/protocol/jss.h>
+
+#include <cstdint>
+#include <optional>
+
+namespace xrpl::test::jtx::sponsor {
+
+json::Value
+set(jtx::Account const& account,
+    uint32_t flags,
+    std::optional<uint32_t> const reserveCount,
+    std::optional<STAmount> const feeAmount,
+    std::optional<STAmount> const maxFee)
+{
+    json::Value jv;
+    jv[jss::TransactionType] = jss::SponsorshipSet;
+    jv[jss::Account] = account.human();
+    jv[sfFlags.jsonName] = flags;
+    if (reserveCount)
+        jv[sfRemainingOwnerCount.jsonName] = *reserveCount;
+    if (feeAmount)
+        jv[sfFeeAmount.jsonName] = feeAmount->getJson(JsonOptions::Values::None);
+    if (maxFee)
+        jv[sfMaxFee.jsonName] = maxFee->getJson(JsonOptions::Values::None);
+    return jv;
+}
+
+json::Value
+del(jtx::Account const& account)
+{
+    json::Value jv;
+    jv[jss::TransactionType] = jss::SponsorshipSet;
+    jv[jss::Account] = account.human();
+    jv[sfFlags.jsonName] = tfDeleteObject;
+    return jv;
+}
+
+json::Value
+transfer(jtx::Account const& account, uint32_t flags, std::optional<uint256> const& index)
+{
+    json::Value jv;
+    jv[jss::TransactionType] = jss::SponsorshipTransfer;
+    jv[jss::Account] = account.human();
+    jv[sfFlags.jsonName] = flags;
+    if (index)
+        jv[sfObjectID.jsonName] = to_string(*index);
+    return jv;
+}
+
+void
+CounterpartySponsor::operator()(Env& env, JTx& jt) const
+{
+    jt.jv[sfCounterpartySponsor.jsonName] = sponsor_.human();
+}
+
+void
+SponseeAcc::operator()(Env& env, JTx& jt) const
+{
+    jt.jv[sfSponsee.jsonName] = sponsee_.human();
+}
+
+void
+As::operator()(Env& env, JTx& jt) const
+{
+    jt.jv[sfSponsor.jsonName] = sponsor_.human();
+    jt.jv[sfSponsorFlags.jsonName] = flags_;
+}
+
+json::Value
+ledgerEntry(jtx::Env& env, jtx::Account const& sponsor, jtx::Account const& sponsee)
+{
+    json::Value jvParams;
+    jvParams[jss::ledger_index] = jss::validated;
+    jvParams[jss::sponsorship][jss::sponsor] = sponsor.human();
+    jvParams[jss::sponsorship][jss::sponsee] = sponsee.human();
+    return env.rpc("json", "ledger_entry", to_string(jvParams));
+}
+
+STAmount
+sponsorshipFeeBalance(jtx::Env& env, jtx::Account const& sponsor, jtx::Account const& sponsee)
+{
+    return env.le(keylet::sponsorship(sponsor, sponsee))->getFieldAmount(sfFeeAmount).xrp();
+}
+
+}  // namespace xrpl::test::jtx::sponsor
diff --git a/src/test/jtx/owners.h b/src/test/jtx/owners.h
index 0fb38b407c..3f64601244 100644
--- a/src/test/jtx/owners.h
+++ b/src/test/jtx/owners.h
@@ -64,6 +64,60 @@ public:
     operator()(Env& env) const;
 };
 
+/** Match the account's SponsoredOwnerCount field: the number of owned
+    objects whose reserve is sponsored by another account. */
+class SponsoredOwners
+{
+private:
+    Account account_;
+    std::uint32_t value_;
+
+public:
+    SponsoredOwners(Account account, std::uint32_t value)
+        : account_(std::move(account)), value_(value)
+    {
+    }
+
+    void
+    operator()(Env& env) const;
+};
+
+/** Match the account's SponsoringOwnerCount field: the number of objects
+    (owned by other accounts) whose reserve this account sponsors. */
+class SponsoringOwners
+{
+private:
+    Account account_;
+    std::uint32_t value_;
+
+public:
+    SponsoringOwners(Account account, std::uint32_t value)
+        : account_(std::move(account)), value_(value)
+    {
+    }
+
+    void
+    operator()(Env& env) const;
+};
+
+/** Match the account's SponsoringAccountCount field: the number of accounts
+    whose base reserve this account sponsors. */
+class SponsoringAccountCount
+{
+private:
+    Account account_;
+    std::uint32_t value_;
+
+public:
+    SponsoringAccountCount(Account account, std::uint32_t value)
+        : account_(std::move(account)), value_(value)
+    {
+    }
+
+    void
+    operator()(Env& env) const;
+};
+
 /** Match the number of trust lines in the account's owner directory */
 using lines = OwnerCount<ltRIPPLE_STATE>;
 
diff --git a/src/test/jtx/sponsor.h b/src/test/jtx/sponsor.h
new file mode 100644
index 0000000000..43d55d7246
--- /dev/null
+++ b/src/test/jtx/sponsor.h
@@ -0,0 +1,105 @@
+#pragma once
+
+#include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
+#include <test/jtx/JTx.h>
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+
+#include <cstdint>
+#include <optional>
+#include <utility>
+
+namespace xrpl::test::jtx::sponsor {
+
+json::Value
+set(jtx::Account const& account,
+    std::uint32_t flags,
+    std::optional<std::uint32_t> const reserveCount = std::nullopt,
+    std::optional<STAmount> const feeAmount = std::nullopt,
+    std::optional<STAmount> const maxFee = std::nullopt);
+
+inline json::Value
+set_fee(
+    jtx::Account const& account,
+    std::uint32_t flags,
+    STAmount feeAmount,
+    std::optional<STAmount> maxFee = std::nullopt)
+{
+    return set(account, flags, std::nullopt, std::move(feeAmount), std::move(maxFee));
+}
+
+inline json::Value
+set_reserve(jtx::Account const& account, std::uint32_t flags, std::uint32_t reserveCount)
+{
+    return set(account, flags, reserveCount);
+}
+
+inline json::Value
+set_max_fee(jtx::Account const& account, std::uint32_t flags, STAmount maxFee)
+{
+    return set(account, flags, std::nullopt, std::nullopt, std::move(maxFee));
+}
+
+json::Value
+del(jtx::Account const& account);
+
+json::Value
+transfer(
+    jtx::Account const& account,
+    uint32_t flags,
+    std::optional<uint256> const& index = std::nullopt);
+
+struct CounterpartySponsor
+{
+private:
+    jtx::Account sponsor_;
+
+public:
+    CounterpartySponsor(jtx::Account account) : sponsor_(std::move(account))
+    {
+    }
+
+    void
+    operator()(jtx::Env&, jtx::JTx& jtx) const;
+};
+
+struct SponseeAcc
+{
+private:
+    jtx::Account sponsee_;
+
+public:
+    SponseeAcc(jtx::Account account) : sponsee_(std::move(account))
+    {
+    }
+
+    void
+    operator()(jtx::Env&, jtx::JTx& jtx) const;
+};
+
+struct As
+{
+private:
+    jtx::Account sponsor_;
+    std::uint32_t flags_;
+
+public:
+    As(jtx::Account account, std::uint32_t flags = 0) : sponsor_(std::move(account)), flags_(flags)
+    {
+    }
+
+    void
+    operator()(jtx::Env&, jtx::JTx& jtx) const;
+};
+
+json::Value
+ledgerEntry(jtx::Env& env, jtx::Account const& sponsor, jtx::Account const& sponsee);
+
+STAmount
+sponsorshipFeeBalance(jtx::Env& env, jtx::Account const& sponsor, jtx::Account const& sponsee);
+
+}  // namespace xrpl::test::jtx::sponsor
diff --git a/src/test/ledger/PaymentSandbox_test.cpp b/src/test/ledger/PaymentSandbox_test.cpp
index f59b75091a..75f7410f94 100644
--- a/src/test/ledger/PaymentSandbox_test.cpp
+++ b/src/test/ledger/PaymentSandbox_test.cpp
@@ -1,17 +1,23 @@
 #include <test/jtx/Account.h>
 #include <test/jtx/Env.h>
 #include <test/jtx/PathSet.h>
+#include <test/jtx/TestHelpers.h>
 #include <test/jtx/amount.h>
 #include <test/jtx/balance.h>
 #include <test/jtx/jtx_json.h>
 #include <test/jtx/offer.h>
 #include <test/jtx/pay.h>
+#include <test/jtx/sig.h>
+#include <test/jtx/sponsor.h>
+#include <test/jtx/ter.h>
+#include <test/jtx/trust.h>
 #include <test/jtx/txflags.h>
 
 #include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ApplyViewImpl.h>
+#include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/PaymentSandbox.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
@@ -19,7 +25,9 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/AmountConversions.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
@@ -236,7 +244,7 @@ class PaymentSandbox_test : public beast::unit_test::Suite
             auto const startingAmount =
                 accountHolds(pv, alice, iss.currency, iss.account, FreezeHandling::IgnoreFreeze, j);
 
-            BEAST_EXPECT(issueIOU(pv, alice, toCredit, iss, j) == tesSUCCESS);
+            BEAST_EXPECT(issueIOU(pv, alice, toCredit, iss, {}, j) == tesSUCCESS);
             BEAST_EXPECT(
                 accountHolds(
                     pv, alice, iss.currency, iss.account, FreezeHandling::IgnoreFreeze, j) ==
@@ -330,7 +338,7 @@ class PaymentSandbox_test : public beast::unit_test::Suite
         };
 
         auto reserve = [](jtx::Env& env, std::uint32_t count) -> XRPAmount {
-            return env.current()->fees().accountReserve(count);
+            return env.current()->fees().accountReserve(count, 1);
         };
 
         Env env(*this, features);
@@ -389,6 +397,217 @@ class PaymentSandbox_test : public beast::unit_test::Suite
         BEAST_EXPECT(balance.getIssuer() == usd.account.id());
     }
 
+    void
+    testOwnerCountHook(FeatureBitset features)
+    {
+        // Test that PaymentSandbox::adjustOwnerCountHook and ownerCountHook
+        // correctly track and return the maximum owner counts during a payment.
+        testcase("ownerCountHook");
+
+        using namespace jtx;
+        Env env(*this, features);
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+
+        env.fund(XRP(10000), alice, sponsor);
+        env.close();
+
+        ApplyViewImpl av(&*env.current(), TapNone);
+        PaymentSandbox sb(&av);
+
+        // Test basic owner count hook without sponsor
+        {
+            auto const aliceSle = sb.peek(keylet::account(alice));
+            BEAST_EXPECT(aliceSle);
+
+            OwnerCounts const initial(aliceSle);
+            OwnerCounts updated = initial;
+            updated.owner = initial.owner + 2;
+
+            // Simulate adjusting owner count
+            sb.adjustOwnerCountHook(alice, initial, updated);
+
+            // ownerCountHook should return the max value
+            OwnerCounts const retrieved = sb.ownerCountHook(alice, initial);
+            BEAST_EXPECT(retrieved.owner == updated.owner);
+            BEAST_EXPECT(retrieved.sponsored == updated.sponsored);
+            BEAST_EXPECT(retrieved.sponsoring == updated.sponsoring);
+        }
+
+        // Test owner count hook with sponsor-related counts
+        {
+            auto const sponsorSle = sb.peek(keylet::account(sponsor));
+            BEAST_EXPECT(sponsorSle);
+
+            OwnerCounts const sponsorInitial(sponsorSle);
+            OwnerCounts sponsorUpdated = sponsorInitial;
+            sponsorUpdated.owner = sponsorInitial.owner + 1;
+            sponsorUpdated.sponsoring = sponsorInitial.sponsoring + 1;
+
+            sb.adjustOwnerCountHook(sponsor, sponsorInitial, sponsorUpdated);
+
+            OwnerCounts const sponsorRetrieved = sb.ownerCountHook(sponsor, sponsorInitial);
+            BEAST_EXPECT(sponsorRetrieved.owner == sponsorUpdated.owner);
+            BEAST_EXPECT(sponsorRetrieved.sponsoring == sponsorUpdated.sponsoring);
+        }
+
+        // Test with stacked PaymentSandboxes
+        {
+            PaymentSandbox sb2(&sb);
+
+            auto const aliceSle = sb2.peek(keylet::account(alice));
+            OwnerCounts const current(aliceSle);
+            OwnerCounts further = current;
+            further.owner = current.owner + 3;
+
+            sb2.adjustOwnerCountHook(alice, current, further);
+
+            // The nested sandbox should see the max from both levels
+            OwnerCounts const retrieved = sb2.ownerCountHook(alice, OwnerCounts());
+            BEAST_EXPECT(retrieved.owner >= further.owner);
+        }
+
+        // Test that max logic works correctly
+        {
+            auto const aliceSle = sb.peek(keylet::account(alice));
+            OwnerCounts const current(aliceSle);
+            OwnerCounts lower = current;
+            lower.owner = (current.owner > 0) ? current.owner - 1 : 0;
+
+            // Adjusting to a lower value
+            sb.adjustOwnerCountHook(alice, current, lower);
+
+            // Should still return the higher value seen previously
+            OwnerCounts const retrieved = sb.ownerCountHook(alice, OwnerCounts());
+            BEAST_EXPECT(retrieved.owner >= lower.owner);
+        }
+    }
+
+    void
+    testOwnerCountWithTransaction(FeatureBitset features)
+    {
+        // Test that owner count hooks work correctly during actual transactions.
+        // This verifies that when transactions modify owner counts (by creating
+        // or deleting ledger objects), the hooks properly track these changes.
+        testcase(
+            std::string("ownerCountWithTransaction") +
+            (features[featureSponsor] ? " with sponsor" : " without sponsor"));
+
+        using namespace jtx;
+
+        auto reserve = [](jtx::Env& env, std::uint32_t count) -> XRPAmount {
+            return env.current()->fees().accountReserve(count, 1);
+        };
+
+        Env env(*this, features);
+        Account const gw("gw");
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor("sponsor");
+
+        auto const usd = gw["USD"];
+
+        // Fund accounts. Alice starts with exactly enough for base reserve + 2 objects
+        env.fund(XRP(10000), gw, bob, sponsor);
+        env.fund(reserve(env, 3) + XRP(100), alice);  // Base + 2 objects + extra for fees
+        env.close();
+
+        // Verify initial state - no owner count
+        BEAST_EXPECT(ownerCount(env, alice) == 0);
+        BEAST_EXPECT(ownerCount(env, bob) == 0);
+
+        // Create a trust line - this increases owner count
+        env(trust(alice, usd(1000)));
+        env.close();
+
+        // alice now has 1 object (owner count = 1)
+        BEAST_EXPECT(ownerCount(env, alice) == 1);
+
+        // Create an offer - this further increases owner count
+        env(trust(bob, usd(1000)));
+        env(pay(gw, alice, usd(100)));
+        env.close();
+
+        auto const aliceOfferSeq = env.seq(alice);  // Capture the sequence before creating offer
+        env(offer(alice, usd(50), XRP(50)));
+        env.close();
+
+        // alice now has 2 objects (trust line + offer)
+        BEAST_EXPECT(ownerCount(env, alice) == 2);
+
+        // If sponsor feature is enabled, test sponsorship transfer
+        if (features[featureSponsor])
+        {
+            auto const trustId = keylet::trustLine(alice, gw, usd.currency);
+            BEAST_EXPECT(env.le(trustId));
+
+            // Transfer sponsorship - sponsor now sponsors alice's trust line
+            env(sponsor::transfer(alice, tfSponsorshipCreate, trustId.key),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            // alice still has 2 objects but 1 is sponsored
+            BEAST_EXPECT(ownerCount(env, alice) == 2);
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            // sponsor's sponsoring count should increase
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+        }
+
+        // Verify alice's available balance respects the reserve
+        auto const aliceSle = env.le(keylet::account(alice));
+        BEAST_EXPECT(aliceSle);
+
+        auto const aliceBalance = aliceSle->getFieldAmount(sfBalance);
+        // With sponsor, 1 object is sponsored so only 1 counts for reserve
+        auto const aliceReserve = reserve(env, features[featureSponsor] ? 1 : 2);
+
+        // alice should have limited available balance after accounting for reserve
+        auto const available = aliceBalance.xrp() - aliceReserve;
+        if (features[featureSponsor])
+        {
+            // With sponsor, alice has more available (1 sponsored object = less reserve)
+            BEAST_EXPECT(available > XRP(150));
+        }
+        else
+        {
+            BEAST_EXPECT(available < XRP(150));  // Most of the balance is in reserve
+        }
+
+        // Try to send nearly all balance - should fail due to reserve in both cases
+        auto const tooMuch = aliceBalance.xrp() - XRP(1);
+        env(pay(alice, bob, tooMuch), Ter(tecUNFUNDED_PAYMENT));
+        env.close();
+
+        // Verify owner count hasn't changed
+        BEAST_EXPECT(ownerCount(env, alice) == 2);
+
+        // Cancel the offer - this decreases owner count
+        env(offerCancel(alice, aliceOfferSeq));
+        env.close();
+
+        // alice now has 1 object (just the trust line)
+        BEAST_EXPECT(ownerCount(env, alice) == 1);
+
+        if (features[featureSponsor])
+        {
+            // Verify sponsored count stayed the same (trust line is still sponsored)
+            BEAST_EXPECT(sponsoredOwnerCount(env, alice) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+        }
+
+        // Now alice should have more available balance (less reserve needed)
+        auto const aliceSle2 = env.le(keylet::account(alice));
+        auto const aliceBalance2 = aliceSle2->getFieldAmount(sfBalance);
+        // With sponsor, trust line is still sponsored so 0 objects for reserve
+        // Without sponsor, 1 object for reserve
+        auto const aliceReserve2 = reserve(env, features[featureSponsor] ? 0 : 1);
+        auto const available2 = aliceBalance2.xrp() - aliceReserve2;
+
+        // available2 should be greater than available (less reserve needed)
+        BEAST_EXPECT(available2 > available);
+    }
+
 public:
     void
     run() override
@@ -399,11 +618,16 @@ public:
             testTinyBalance(features);
             testReserve(features);
             testBalanceHook(features);
+            testOwnerCountHook(features);
         };
         using namespace jtx;
         auto const sa = testableAmendments();
         testAll(sa - featurePermissionedDEX);
         testAll(sa);
+
+        // Test owner count with transactions
+        testOwnerCountWithTransaction(sa - featureSponsor);
+        testOwnerCountWithTransaction(sa);
     }
 };
 
diff --git a/src/test/rpc/AccountObjects_test.cpp b/src/test/rpc/AccountObjects_test.cpp
index 31b20b37d4..6ba6e7de9f 100644
--- a/src/test/rpc/AccountObjects_test.cpp
+++ b/src/test/rpc/AccountObjects_test.cpp
@@ -9,8 +9,11 @@
 #include <test/jtx/owners.h>  // IWYU pragma: keep
 #include <test/jtx/pay.h>
 #include <test/jtx/permissioned_domains.h>
+#include <test/jtx/sig.h>
+#include <test/jtx/sponsor.h>
 #include <test/jtx/ticket.h>
 #include <test/jtx/token.h>
+#include <test/jtx/trust.h>
 #include <test/jtx/txflags.h>
 #include <test/jtx/xchain_bridge.h>
 
@@ -22,6 +25,7 @@
 #include <xrpl/json/to_string.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/jss.h>
@@ -200,6 +204,15 @@ public:
                 resp[jss::result][jss::error_message] ==
                 "Invalid field 'limit', not unsigned integer.");
         }
+        // test error on sponsored param not a boolean
+        {
+            json::Value params;
+            params[jss::account] = bob.human();
+            params[jss::sponsored] = "true";
+            auto resp = env.rpc("json", "account_objects", to_string(params));
+            BEAST_EXPECT(
+                resp[jss::result][jss::error_message] == "Invalid field 'sponsored', not boolean.");
+        }
         // test errors on marker
         {
             Account const gw{"G"};
@@ -605,6 +618,7 @@ public:
         BEAST_EXPECT(acctObjsIsSize(acctObjs(gw, jss::amm), 0));
         BEAST_EXPECT(acctObjsIsSize(acctObjs(gw, jss::did), 0));
         BEAST_EXPECT(acctObjsIsSize(acctObjs(gw, jss::permissioned_domain), 0));
+        BEAST_EXPECT(acctObjsIsSize(acctObjs(gw, jss::sponsorship), 0));
 
         // we expect invalid field type reported for the following types
         BEAST_EXPECT(acctObjsTypeIsInvalid(acctObjs(gw, jss::amendments)));
@@ -926,6 +940,30 @@ public:
             BEAST_EXPECT(ticket[sfTicketSequence.jsonName].asUInt() == seq + 1);
         }
 
+        {
+            // Create a sponsorship
+            env(sponsor::set(alice, tfSponsorshipSetRequireSignForFee, 200, XRP(100), drops(10)),
+                sponsor::SponseeAcc(gw));
+            env.close();
+
+            // Find the sponsorship.
+            for (auto const& acct : {alice, gw})
+            {
+                json::Value const resp = acctObjs(acct, jss::sponsorship);
+                BEAST_EXPECT(acctObjsIsSize(resp, 1));
+
+                auto const& sponsorship = resp[jss::result][jss::account_objects][0u];
+
+                BEAST_EXPECT(sponsorship[sfOwner.jsonName] == alice.human());
+                BEAST_EXPECT(sponsorship[sfSponsee.jsonName] == gw.human());
+                BEAST_EXPECT(
+                    sponsorship[sfFlags.jsonName].asUInt() == tfSponsorshipSetRequireSignForFee);
+                BEAST_EXPECT(sponsorship[sfRemainingOwnerCount.jsonName].asUInt() == 200);
+                BEAST_EXPECT(sponsorship[sfFeeAmount.jsonName].asUInt() == 100000000);
+                BEAST_EXPECT(sponsorship[sfMaxFee.jsonName].asUInt() == 10);
+            }
+        }
+
         {
             // See how "deletion_blockers_only" handles gw's directory.
             json::Value params;
@@ -940,7 +978,8 @@ public:
                     jss::NFTokenPage.cStr(),
                     jss::RippleState.cStr(),
                     jss::PayChannel.cStr(),
-                    jss::PermissionedDomain.cStr()};
+                    jss::PermissionedDomain.cStr(),
+                    jss::Sponsorship.cStr()};
                 std::ranges::sort(v);
                 return v;
             }();
@@ -1350,6 +1389,233 @@ public:
         }
     }
 
+    void
+    testSponsoredFilter()
+    {
+        testcase("SponsoredFilter");
+        using namespace jtx;
+
+        Env env(*this, testableAmendments());
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const sponsor1("sponsor1");
+        Account const gw("gw");
+        auto const usd = gw["USD"];
+
+        env.fund(XRP(10000), alice, bob, sponsor1, gw);
+        env.close();
+
+        // Helper to call account_objects with sponsored filter
+        auto acctObjsSponsored = [](Env& testEnv,
+                                    AccountID const& acct,
+                                    bool sponsored,
+                                    std::optional<json::StaticString> const& type = std::nullopt) {
+            json::Value params;
+            params[jss::account] = to_string(acct);
+            params[jss::sponsored] = sponsored;
+            if (type)
+                params[jss::type] = *type;
+            params[jss::ledger_index] = "validated";
+            return testEnv.rpc("json", "account_objects", to_string(params));
+        };
+
+        // Create a trust line for bob (not sponsored)
+        env(trust(bob, usd(1000)));
+        env.close();
+
+        // sponsored=true should not find any objects for bob (doesn't have any sponsored objects)
+        {
+            auto const resp = acctObjsSponsored(env, bob.id(), true);
+            auto const& objs = resp[jss::result][jss::account_objects];
+            BEAST_EXPECT(objs.size() == 0);
+        }
+
+        // Now sponsor bob's trust line
+        auto const trustId = keylet::trustLine(bob, gw, usd.currency);
+        if (!BEAST_EXPECT(env.le(trustId)))
+            return;
+
+        env(sponsor::transfer(bob, tfSponsorshipCreate, trustId.key),
+            sponsor::As(sponsor1, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor1));
+        env.close();
+
+        // Verify trust line has sponsor field
+        {
+            auto const sle = env.le(trustId);
+            if (!BEAST_EXPECT(sle))
+                return;
+            BEAST_EXPECT(sle->isFieldPresent(sfHighSponsor) || sle->isFieldPresent(sfLowSponsor));
+        }
+
+        // sponsored=true on bob should include the sponsored trust line
+        {
+            auto const resp = acctObjsSponsored(env, bob.id(), true);
+            auto const& objs = resp[jss::result][jss::account_objects];
+            if (!BEAST_EXPECT(objs.size() == 1))
+                return;
+
+            auto const& obj = objs[0u];
+            BEAST_EXPECT(obj[sfLedgerEntryType.jsonName] == jss::RippleState);
+            BEAST_EXPECT(
+                obj.isMember(sfHighSponsor.jsonName) || obj.isMember(sfLowSponsor.jsonName));
+        }
+
+        // sponsored=false on bob should NOT include the sponsored trust line
+        {
+            auto const resp = acctObjsSponsored(env, bob.id(), false);
+            BEAST_EXPECT(resp[jss::result][jss::account_objects].size() == 0);
+        }
+
+        // A trust line sponsored on either side is classified as sponsored
+        // for both parties.
+        {
+            Env env(*this, testableAmendments());
+            Account const issuer("issuer");
+            Account const user("user");
+            Account const sponsor("sponsor");
+            auto const usd = issuer["USD"];
+
+            env.fund(XRP(10000), issuer, user, sponsor);
+            env.close();
+
+            env(trust(issuer, user["USD"](100)));
+            env.close();
+
+            env(trust(user, usd(100)));
+            env.close();
+
+            auto const trustId = keylet::trustLine(user, issuer, usd.currency);
+            if (!BEAST_EXPECT(env.le(trustId)))
+                return;
+
+            env(sponsor::transfer(user, tfSponsorshipCreate, trustId.key),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            auto const line = env.le(trustId);
+            if (!BEAST_EXPECT(line))
+                return;
+
+            auto const userIsHigh = line->getFieldAmount(sfHighLimit).getIssuer() == user.id();
+            auto const& userSponsorField = userIsHigh ? sfHighSponsor : sfLowSponsor;
+            auto const& issuerSponsorField = userIsHigh ? sfLowSponsor : sfHighSponsor;
+
+            BEAST_EXPECT(line->isFieldPresent(userSponsorField));
+            BEAST_EXPECT(!line->isFieldPresent(issuerSponsorField));
+
+            {
+                auto const resp = acctObjsSponsored(env, user.id(), true, jss::state);
+                auto const& objs = resp[jss::result][jss::account_objects];
+                if (BEAST_EXPECT(objs.size() == 1))
+                    BEAST_EXPECT(objs[0u][sfLedgerEntryType.jsonName] == jss::RippleState);
+            }
+            {
+                auto const resp = acctObjsSponsored(env, user.id(), false, jss::state);
+                auto const& objs = resp[jss::result][jss::account_objects];
+                BEAST_EXPECT(objs.size() == 0);
+            }
+            {
+                auto const resp = acctObjsSponsored(env, issuer.id(), true, jss::state);
+                auto const& objs = resp[jss::result][jss::account_objects];
+                if (BEAST_EXPECT(objs.size() == 1))
+                    BEAST_EXPECT(objs[0u][sfLedgerEntryType.jsonName] == jss::RippleState);
+            }
+            {
+                auto const resp = acctObjsSponsored(env, issuer.id(), false, jss::state);
+                auto const& objs = resp[jss::result][jss::account_objects];
+                BEAST_EXPECT(objs.size() == 0);
+            }
+        }
+
+        // A sponsored Check is classified as sponsored in both the writer's
+        // and the destination's results.
+        {
+            Env env(*this, testableAmendments());
+            Account const owner("owner");
+            Account const dest("dest");
+            Account const sponsor("sponsor");
+
+            env.fund(XRP(10000), owner, dest, sponsor);
+            env.close();
+
+            auto const checkSeq = env.seq(owner);
+            env(check::create(owner, dest, XRP(1)));
+            env.close();
+
+            auto const checkId = keylet::check(owner, checkSeq);
+            if (!BEAST_EXPECT(env.le(checkId)))
+                return;
+
+            env(sponsor::transfer(owner, tfSponsorshipCreate, checkId.key),
+                sponsor::As(sponsor, spfSponsorReserve),
+                Sig(sfSponsorSignature, sponsor));
+            env.close();
+
+            {
+                auto const sle = env.le(checkId);
+                if (!BEAST_EXPECT(sle))
+                    return;
+                BEAST_EXPECT(sle->isFieldPresent(sfSponsor));
+            }
+
+            for (auto const& acct : {owner.id(), dest.id()})
+            {
+                {
+                    auto const resp = acctObjsSponsored(env, acct, true, jss::check);
+                    auto const& objs = resp[jss::result][jss::account_objects];
+                    if (BEAST_EXPECT(objs.size() == 1))
+                        BEAST_EXPECT(objs[0u][sfLedgerEntryType.jsonName] == jss::Check);
+                }
+                {
+                    auto const resp = acctObjsSponsored(env, acct, false, jss::check);
+                    BEAST_EXPECT(resp[jss::result][jss::account_objects].size() == 0);
+                }
+            }
+        }
+
+        // A Sponsorship object is visible to both sides.
+        {
+            Env env(*this, testableAmendments());
+            Account const owner("owner");
+            Account const sponsee("sponsee");
+
+            env.fund(XRP(10000), owner, sponsee);
+            env.close();
+
+            env(sponsor::set(owner, 0, 100, XRP(100)), sponsor::SponseeAcc(sponsee));
+            env.close();
+
+            auto const sponsorshipKeylet = keylet::sponsorship(owner, sponsee);
+            if (!BEAST_EXPECT(env.le(sponsorshipKeylet)))
+                return;
+
+            {
+                auto const resp = acctObjsSponsored(env, owner.id(), false, jss::sponsorship);
+                auto const& objs = resp[jss::result][jss::account_objects];
+                if (BEAST_EXPECT(objs.size() == 1))
+                    BEAST_EXPECT(objs[0u][sfLedgerEntryType.jsonName] == jss::Sponsorship);
+            }
+            {
+                auto const resp = acctObjsSponsored(env, sponsee.id(), false, jss::sponsorship);
+                auto const& objs = resp[jss::result][jss::account_objects];
+                if (BEAST_EXPECT(objs.size() == 1))
+                    BEAST_EXPECT(objs[0u][sfLedgerEntryType.jsonName] == jss::Sponsorship);
+            }
+            {
+                auto const resp = acctObjsSponsored(env, owner.id(), true, jss::sponsorship);
+                auto const& objs = resp[jss::result][jss::account_objects];
+                BEAST_EXPECT(objs.size() == 0);
+            }
+            {
+                auto const resp = acctObjsSponsored(env, sponsee.id(), true, jss::sponsorship);
+                auto const& objs = resp[jss::result][jss::account_objects];
+                BEAST_EXPECT(objs.size() == 0);
+            }
+        }
+    }
+
     void
     run() override
     {
@@ -1360,6 +1626,7 @@ public:
         testNFTsMarker();
         testAccountNFTs();
         testAccountObjectMarker();
+        testSponsoredFilter();
     }
 };
 
diff --git a/src/test/rpc/AccountTx_test.cpp b/src/test/rpc/AccountTx_test.cpp
index ace8743e1e..a7f37d39b9 100644
--- a/src/test/rpc/AccountTx_test.cpp
+++ b/src/test/rpc/AccountTx_test.cpp
@@ -15,6 +15,7 @@
 #include <test/jtx/pay.h>
 #include <test/jtx/regkey.h>
 #include <test/jtx/sig.h>
+#include <test/jtx/sponsor.h>
 #include <test/jtx/ter.h>
 #include <test/jtx/ticket.h>
 #include <test/jtx/trust.h>
@@ -773,7 +774,7 @@ class AccountTx_test : public beast::unit_test::Suite
 
         // All it takes is a large enough XRP payment to resurrect
         // becky's account.  Try too small a payment.
-        env(pay(alice, becky, drops(env.current()->fees().accountReserve(0)) - drops(1)),
+        env(pay(alice, becky, drops(env.current()->fees().accountReserve(0, 1)) - drops(1)),
             Ter(tecNO_DST_INSUF_XRP));
         env.close();
 
@@ -888,6 +889,82 @@ class AccountTx_test : public beast::unit_test::Suite
         checkAliceAcctTx(9, jss::Payment);
     }
 
+    void
+    testSponsorship()
+    {
+        // test all sponsored transactions are in sponsor and sponsee's account
+        // tx list
+        testcase("Sponsorship");
+
+        using namespace test::jtx;
+        Env env(*this);
+        Account const alice("alice");
+        Account const sponsor("sponsor");
+        Account const sponsor2("sponsor2");
+        env.fund(XRP(10000), alice, sponsor, sponsor2);
+        env.close();
+
+        // check the latest sponsorship-related txn is in account tx list
+        auto const checkTx = [&](Account const& account, json::StaticString txType) {
+            json::Value params;
+            params[jss::account] = account.human();
+            params[jss::limit] = 100;
+            auto const jv = env.rpc("json", "account_tx", to_string(params))[jss::result];
+
+            auto const& tx0(jv[jss::transactions][0u][jss::tx]);
+            BEAST_EXPECT(tx0[jss::TransactionType] == txType);
+
+            std::string const txHash{
+                env.tx()->getJson(JsonOptions::Values::None)[jss::hash].asString()};
+            BEAST_EXPECT(tx0[jss::hash] == txHash);
+        };
+
+        // fee sponsorship
+        env(noop(alice), sponsor::As(sponsor, spfSponsorFee), Sig(sfSponsorSignature, sponsor));
+        env.close();
+        checkTx(alice, jss::AccountSet);
+        checkTx(sponsor, jss::AccountSet);
+
+        // set sponsor
+        env(sponsor::set(sponsor, 0, 100, XRP(100)), sponsor::SponseeAcc(alice), Ter(tesSUCCESS));
+        env.close();
+        checkTx(alice, jss::SponsorshipSet);
+        checkTx(sponsor, jss::SponsorshipSet);
+
+        // create an object with sponsor
+        auto const checkId = keylet::check(alice, env.seq(alice)).key;
+        env(check::create(alice, sponsor, XRP(1)), sponsor::As(sponsor, spfSponsorReserve));
+        env.close();
+        checkTx(alice, jss::CheckCreate);
+        checkTx(sponsor, jss::CheckCreate);
+
+        // transfer object sponsorship
+        env(sponsor::transfer(alice, tfSponsorshipReassign, checkId),
+            sponsor::As(sponsor2, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor2));
+        env.close();
+        checkTx(alice, jss::SponsorshipTransfer);
+        checkTx(sponsor, jss::SponsorshipTransfer);
+        checkTx(sponsor2, jss::SponsorshipTransfer);
+
+        // delete the sponsored object
+        env(check::cancel(alice, checkId),
+            sponsor::As(sponsor, spfSponsorFee),
+            Sig(sfSponsorSignature, sponsor));
+        env.close();
+        checkTx(alice, jss::CheckCancel);
+        checkTx(sponsor, jss::CheckCancel);
+        checkTx(sponsor2, jss::CheckCancel);
+
+        // account sponsorship
+        env(sponsor::transfer(alice, tfSponsorshipCreate),
+            sponsor::As(sponsor, spfSponsorReserve),
+            Sig(sfSponsorSignature, sponsor));
+        env.close();
+        checkTx(alice, jss::SponsorshipTransfer);
+        checkTx(sponsor, jss::SponsorshipTransfer);
+    }
+
 public:
     void
     run() override
@@ -896,6 +973,7 @@ public:
         testContents();
         testAccountDelete();
         testMPT();
+        testSponsorship();
     }
 };
 BEAST_DEFINE_TESTSUITE(AccountTx, rpc, xrpl);
diff --git a/src/test/rpc/LedgerEntry_test.cpp b/src/test/rpc/LedgerEntry_test.cpp
index c7ef5cef2d..d321ab39aa 100644
--- a/src/test/rpc/LedgerEntry_test.cpp
+++ b/src/test/rpc/LedgerEntry_test.cpp
@@ -15,6 +15,7 @@
 #include <test/jtx/offer.h>
 #include <test/jtx/pay.h>
 #include <test/jtx/permissioned_domains.h>
+#include <test/jtx/sponsor.h>
 #include <test/jtx/ticket.h>
 #include <test/jtx/token.h>
 #include <test/jtx/txflags.h>
@@ -93,6 +94,8 @@ std::vector<std::pair<json::StaticString, FieldType>> gMappings{
     {jss::oracle_document_id, FieldType::UInt32Field},
     {jss::owner, FieldType::AccountField},
     {jss::seq, FieldType::UInt32Field},
+    {jss::sponsor, FieldType::AccountField},
+    {jss::sponsee, FieldType::AccountField},
     {jss::subject, FieldType::AccountField},
     {jss::ticket_seq, FieldType::UInt32Field},
 };
@@ -107,7 +110,7 @@ getFieldType(json::StaticString fieldName)
         return it->second;
     }
 
-    Throw<std::runtime_error>("`mappings` is missing field " + std::string(fieldName.cStr()));
+    Throw<std::runtime_error>("`gMappings` is missing field " + std::string(fieldName.cStr()));
 }
 
 std::string
@@ -1884,6 +1887,59 @@ class LedgerEntry_test : public beast::unit_test::Suite
         runLedgerEntryTest(env, jss::signer_list);
     }
 
+    void
+    testSponsorship()
+    {
+        testcase("Sponsorship");
+
+        using namespace test::jtx;
+
+        Env env{*this};
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        env.fund(XRP(10000), alice, bob);
+        env.close();
+        env(sponsor::set(alice, 0, 100), sponsor::SponseeAcc(bob));
+        env.close();
+        std::string const ledgerHash{to_string(env.closed()->header().hash)};
+        auto const sponsorshipIndex = to_string(keylet::sponsorship(alice.id(), bob.id()).key);
+
+        {
+            // Request by sponsor and sponsee.
+            json::Value jvParams;
+            jvParams[jss::sponsorship][jss::sponsor] = alice.human();
+            jvParams[jss::sponsorship][jss::sponsee] = bob.human();
+            jvParams[jss::ledger_hash] = ledgerHash;
+            auto const jrr = env.rpc("json", "ledger_entry", to_string(jvParams))[jss::result];
+            BEAST_EXPECT(jrr[jss::node][sfLedgerEntryType.jsonName] == jss::Sponsorship);
+            BEAST_EXPECT(jrr[jss::node][sfOwner.jsonName] == alice.human());
+            BEAST_EXPECT(jrr[jss::node][sfSponsee.jsonName] == bob.human());
+            BEAST_EXPECT(sponsorshipIndex == jrr[jss::node][jss::index].asString());
+        }
+        {
+            // Request by index.
+            json::Value jvParams;
+            jvParams[jss::sponsorship] = sponsorshipIndex;
+            jvParams[jss::ledger_hash] = ledgerHash;
+            json::Value const jrr =
+                env.rpc("json", "ledger_entry", to_string(jvParams))[jss::result];
+            BEAST_EXPECT(jrr[jss::node][sfLedgerEntryType.jsonName] == jss::Sponsorship);
+            BEAST_EXPECT(jrr[jss::node][sfOwner.jsonName] == alice.human());
+            BEAST_EXPECT(jrr[jss::node][sfSponsee.jsonName] == bob.human());
+            BEAST_EXPECT(sponsorshipIndex == jrr[jss::node][jss::index].asString());
+        }
+        {
+            // Check all malformed cases.
+            runLedgerEntryTest(
+                env,
+                jss::sponsorship,
+                {
+                    {.fieldName = jss::sponsor, .malformedErrorMsg = "malformedSponsor"},
+                    {.fieldName = jss::sponsee, .malformedErrorMsg = "malformedSponsee"},
+                });
+        }
+    }
+
     void
     testTicket()
     {
@@ -2676,6 +2732,7 @@ public:
         testPayChan();
         testRippleState();
         testSignerList();
+        testSponsorship();
         testTicket();
         testDID();
         testInvalidOracleLedgerEntry();
diff --git a/src/test/rpc/Simulate_test.cpp b/src/test/rpc/Simulate_test.cpp
index 0d00360a58..16df733a66 100644
--- a/src/test/rpc/Simulate_test.cpp
+++ b/src/test/rpc/Simulate_test.cpp
@@ -364,6 +364,37 @@ class Simulate_test : public beast::unit_test::Suite
             auto const resp = env.rpc("json", "simulate", to_string(params));
             BEAST_EXPECT(resp[jss::result][jss::error_message] == "Invalid field 'tx.Signers[0]'.");
         }
+        {
+            // Non-object SponsorSignature field
+            json::Value params;
+            json::Value txJson = json::ValueType::Object;
+            txJson[jss::TransactionType] = jss::AccountSet;
+            txJson[jss::Account] = env.master.human();
+            txJson[sfSponsorSignature] = "";
+            params[jss::tx_json] = txJson;
+
+            auto const resp = env.rpc("json", "simulate", to_string(params));
+            BEAST_EXPECT(
+                resp[jss::result][jss::error_message] ==
+                "Invalid field 'SponsorSignature', not object.");
+        }
+        {
+            // Invalid SponsorSignature.Signers field
+            json::Value params;
+            json::Value txJson = json::ValueType::Object;
+            txJson[jss::TransactionType] = jss::AccountSet;
+            txJson[jss::Account] = env.master.human();
+            json::Value sponsorSignature = json::ValueType::Object;
+            sponsorSignature[sfSigners] = "1";
+            txJson[sfSponsorSignature] = sponsorSignature;
+            params[jss::tx_json] = txJson;
+
+            auto const resp = env.rpc("json", "simulate", to_string(params));
+            BEAST_EXPECTS(
+                resp[jss::result][jss::error_message] ==
+                    "Invalid field 'tx.SponsorSignature.Signers'.",
+                resp.toStyledString());
+        }
         {
             // Invalid transaction
             json::Value params;
@@ -561,6 +592,75 @@ class Simulate_test : public beast::unit_test::Suite
             // test without autofill
             testTx(env, tx, validateOutput);
         }
+
+        {
+            // autofill sponsor signature
+
+            auto validateOutput = [&](json::Value const& resp, json::Value const& tx) {
+                auto result = resp[jss::result];
+                checkBasicReturnValidity(
+                    result, tx, env.seq(env.master), env.current()->fees().base);
+
+                BEAST_EXPECT(result[jss::engine_result] == "tesSUCCESS");
+                BEAST_EXPECT(result[jss::engine_result_code] == 0);
+                BEAST_EXPECT(
+                    result[jss::engine_result_message] ==
+                    "The simulated transaction would have been applied.");
+
+                if (BEAST_EXPECT(result.isMember(jss::meta) || result.isMember(jss::meta_blob)))
+                {
+                    json::Value const metadata = getJsonMetadata(result);
+
+                    if (BEAST_EXPECT(metadata.isMember(sfAffectedNodes.jsonName)))
+                    {
+                        BEAST_EXPECT(metadata[sfAffectedNodes.jsonName].size() == 2);
+
+                        auto node = metadata[sfAffectedNodes.jsonName][0u];
+                        if (BEAST_EXPECT(node.isMember(sfModifiedNode.jsonName)))
+                        {
+                            auto modifiedNode = node[sfModifiedNode];
+                            BEAST_EXPECT(modifiedNode[sfLedgerEntryType] == "AccountRoot");
+                            auto previousFields = modifiedNode[sfPreviousFields];
+                            BEAST_EXPECT(!previousFields.isMember(sfBalance.jsonName));
+                        }
+
+                        auto node2 = metadata[sfAffectedNodes.jsonName][1u];
+                        if (BEAST_EXPECT(node2.isMember(sfModifiedNode.jsonName)))
+                        {
+                            auto modifiedNode = node2[sfModifiedNode];
+                            BEAST_EXPECT(modifiedNode[sfLedgerEntryType] == "AccountRoot");
+
+                            auto previousFields = modifiedNode[sfPreviousFields];
+                            BEAST_EXPECT(previousFields.isMember(sfBalance.jsonName));
+                        }
+                    }
+                    BEAST_EXPECT(metadata[sfTransactionIndex.jsonName] == 0);
+                    BEAST_EXPECT(metadata[sfTransactionResult.jsonName] == "tesSUCCESS");
+                }
+            };
+
+            Account const sponsor("sponsor");
+            env.fund(XRP(10000), sponsor);
+            env.close();
+
+            json::Value tx;
+
+            tx[jss::Account] = env.master.human();
+            tx[jss::TransactionType] = jss::AccountSet;
+            tx[sfDomain.jsonName] = kNewDomain;
+            tx[sfSponsor.jsonName] = sponsor.human();
+            tx[sfSponsorFlags.jsonName] = spfSponsorFee;
+            tx[sfSponsorSignature.jsonName] = json::ValueType::Object;
+
+            // test with autofill
+            testTx(env, tx, validateOutput);
+
+            tx[sfSponsorSignature.jsonName][sfTxnSignature.jsonName] = "";
+            tx[sfSponsorSignature.jsonName][sfSigningPubKey.jsonName] = "";
+
+            // test without autofill
+            testTx(env, tx, validateOutput);
+        }
     }
 
     void
@@ -763,6 +863,58 @@ class Simulate_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testSuccessfulSponsoredTransactionMultisigned()
+    {
+        testcase("Successful sponsored multi-signed transaction");
+
+        using namespace jtx;
+        Env env(*this);
+        Account const sponsor("sponsor");
+        Account const signer("signer");
+        env.fund(XRP(10000), sponsor, signer);
+        env.close();
+
+        env(signers(sponsor, 1, {{signer, 1}}));
+        env.close();
+
+        auto validateOutput = [&](json::Value const& resp, json::Value const& tx) {
+            auto const result = resp[jss::result];
+            // Verifies Fee autofill counts nested sponsor-signature signers.
+            auto const expectedFee = env.current()->fees().base * 2;
+            checkBasicReturnValidity(result, tx, env.seq(env.master), expectedFee);
+
+            BEAST_EXPECT(result[jss::engine_result] == "tesSUCCESS");
+            BEAST_EXPECT(result[jss::engine_result_code] == 0);
+            BEAST_EXPECT(
+                result[jss::engine_result_message] ==
+                "The simulated transaction would have been applied.");
+
+            if (BEAST_EXPECT(result.isMember(jss::meta) || result.isMember(jss::meta_blob)))
+            {
+                json::Value const metadata = getJsonMetadata(result);
+                BEAST_EXPECT(metadata[sfTransactionResult.jsonName] == "tesSUCCESS");
+            }
+        };
+
+        json::Value tx;
+        tx[jss::Account] = env.master.human();
+        tx[jss::TransactionType] = jss::AccountSet;
+        tx[sfDomain] = "123ABC";
+        tx[sfSponsor.jsonName] = sponsor.human();
+        tx[sfSponsorFlags.jsonName] = spfSponsorFee;
+        tx[sfSponsorSignature.jsonName] = json::ValueType::Object;
+        tx[sfSponsorSignature.jsonName][sfSigners.jsonName] = json::ValueType::Array;
+
+        json::Value signerObj;
+        signerObj[sfSigner][jss::Account] = signer.human();
+        tx[sfSponsorSignature.jsonName][sfSigners.jsonName].append(signerObj);
+
+        // Leave Fee unset so simulate must autofill it after sponsor signer normalization.
+        BEAST_EXPECT(!tx.isMember(jss::Fee));
+        testTx(env, tx, validateOutput, false);
+    }
+
     void
     testTransactionSigningFailure()
     {
@@ -1195,6 +1347,7 @@ public:
         testTransactionNonTecFailure();
         testTransactionTecFailure();
         testSuccessfulTransactionMultisigned();
+        testSuccessfulSponsoredTransactionMultisigned();
         testTransactionSigningFailure();
         testInvalidSingleAndMultiSigningTransaction();
         testMultisignedBadPubKey();
diff --git a/src/tests/libxrpl/protocol_autogen/ledger_entries/AccountRootTests.cpp b/src/tests/libxrpl/protocol_autogen/ledger_entries/AccountRootTests.cpp
index e967b614b7..17c80899f9 100644
--- a/src/tests/libxrpl/protocol_autogen/ledger_entries/AccountRootTests.cpp
+++ b/src/tests/libxrpl/protocol_autogen/ledger_entries/AccountRootTests.cpp
@@ -40,6 +40,9 @@ TEST(AccountRootTests, BuilderSettersRoundTrip)
     auto const mintedNFTokensValue = canonical_UINT32();
     auto const burnedNFTokensValue = canonical_UINT32();
     auto const firstNFTokenSequenceValue = canonical_UINT32();
+    auto const sponsoredOwnerCountValue = canonical_UINT32();
+    auto const sponsoringOwnerCountValue = canonical_UINT32();
+    auto const sponsoringAccountCountValue = canonical_UINT32();
     auto const aMMIDValue = canonical_UINT256();
     auto const vaultIDValue = canonical_UINT256();
     auto const loanBrokerIDValue = canonical_UINT256();
@@ -67,6 +70,9 @@ TEST(AccountRootTests, BuilderSettersRoundTrip)
     builder.setMintedNFTokens(mintedNFTokensValue);
     builder.setBurnedNFTokens(burnedNFTokensValue);
     builder.setFirstNFTokenSequence(firstNFTokenSequenceValue);
+    builder.setSponsoredOwnerCount(sponsoredOwnerCountValue);
+    builder.setSponsoringOwnerCount(sponsoringOwnerCountValue);
+    builder.setSponsoringAccountCount(sponsoringAccountCountValue);
     builder.setAMMID(aMMIDValue);
     builder.setVaultID(vaultIDValue);
     builder.setLoanBrokerID(loanBrokerIDValue);
@@ -228,6 +234,30 @@ TEST(AccountRootTests, BuilderSettersRoundTrip)
         EXPECT_TRUE(entry.hasFirstNFTokenSequence());
     }
 
+    {
+        auto const& expected = sponsoredOwnerCountValue;
+        auto const actualOpt = entry.getSponsoredOwnerCount();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfSponsoredOwnerCount");
+        EXPECT_TRUE(entry.hasSponsoredOwnerCount());
+    }
+
+    {
+        auto const& expected = sponsoringOwnerCountValue;
+        auto const actualOpt = entry.getSponsoringOwnerCount();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfSponsoringOwnerCount");
+        EXPECT_TRUE(entry.hasSponsoringOwnerCount());
+    }
+
+    {
+        auto const& expected = sponsoringAccountCountValue;
+        auto const actualOpt = entry.getSponsoringAccountCount();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfSponsoringAccountCount");
+        EXPECT_TRUE(entry.hasSponsoringAccountCount());
+    }
+
     {
         auto const& expected = aMMIDValue;
         auto const actualOpt = entry.getAMMID();
@@ -285,6 +315,9 @@ TEST(AccountRootTests, BuilderFromSleRoundTrip)
     auto const mintedNFTokensValue = canonical_UINT32();
     auto const burnedNFTokensValue = canonical_UINT32();
     auto const firstNFTokenSequenceValue = canonical_UINT32();
+    auto const sponsoredOwnerCountValue = canonical_UINT32();
+    auto const sponsoringOwnerCountValue = canonical_UINT32();
+    auto const sponsoringAccountCountValue = canonical_UINT32();
     auto const aMMIDValue = canonical_UINT256();
     auto const vaultIDValue = canonical_UINT256();
     auto const loanBrokerIDValue = canonical_UINT256();
@@ -311,6 +344,9 @@ TEST(AccountRootTests, BuilderFromSleRoundTrip)
     sle->at(sfMintedNFTokens) = mintedNFTokensValue;
     sle->at(sfBurnedNFTokens) = burnedNFTokensValue;
     sle->at(sfFirstNFTokenSequence) = firstNFTokenSequenceValue;
+    sle->at(sfSponsoredOwnerCount) = sponsoredOwnerCountValue;
+    sle->at(sfSponsoringOwnerCount) = sponsoringOwnerCountValue;
+    sle->at(sfSponsoringAccountCount) = sponsoringAccountCountValue;
     sle->at(sfAMMID) = aMMIDValue;
     sle->at(sfVaultID) = vaultIDValue;
     sle->at(sfLoanBrokerID) = loanBrokerIDValue;
@@ -566,6 +602,45 @@ TEST(AccountRootTests, BuilderFromSleRoundTrip)
         expectEqualField(expected, *fromBuilderOpt, "sfFirstNFTokenSequence");
     }
 
+    {
+        auto const& expected = sponsoredOwnerCountValue;
+
+        auto const fromSleOpt = entryFromSle.getSponsoredOwnerCount();
+        auto const fromBuilderOpt = entryFromBuilder.getSponsoredOwnerCount();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfSponsoredOwnerCount");
+        expectEqualField(expected, *fromBuilderOpt, "sfSponsoredOwnerCount");
+    }
+
+    {
+        auto const& expected = sponsoringOwnerCountValue;
+
+        auto const fromSleOpt = entryFromSle.getSponsoringOwnerCount();
+        auto const fromBuilderOpt = entryFromBuilder.getSponsoringOwnerCount();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfSponsoringOwnerCount");
+        expectEqualField(expected, *fromBuilderOpt, "sfSponsoringOwnerCount");
+    }
+
+    {
+        auto const& expected = sponsoringAccountCountValue;
+
+        auto const fromSleOpt = entryFromSle.getSponsoringAccountCount();
+        auto const fromBuilderOpt = entryFromBuilder.getSponsoringAccountCount();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfSponsoringAccountCount");
+        expectEqualField(expected, *fromBuilderOpt, "sfSponsoringAccountCount");
+    }
+
     {
         auto const& expected = aMMIDValue;
 
@@ -697,6 +772,12 @@ TEST(AccountRootTests, OptionalFieldsReturnNullopt)
     EXPECT_FALSE(entry.getBurnedNFTokens().has_value());
     EXPECT_FALSE(entry.hasFirstNFTokenSequence());
     EXPECT_FALSE(entry.getFirstNFTokenSequence().has_value());
+    EXPECT_FALSE(entry.hasSponsoredOwnerCount());
+    EXPECT_FALSE(entry.getSponsoredOwnerCount().has_value());
+    EXPECT_FALSE(entry.hasSponsoringOwnerCount());
+    EXPECT_FALSE(entry.getSponsoringOwnerCount().has_value());
+    EXPECT_FALSE(entry.hasSponsoringAccountCount());
+    EXPECT_FALSE(entry.getSponsoringAccountCount().has_value());
     EXPECT_FALSE(entry.hasAMMID());
     EXPECT_FALSE(entry.getAMMID().has_value());
     EXPECT_FALSE(entry.hasVaultID());
diff --git a/src/tests/libxrpl/protocol_autogen/ledger_entries/RippleStateTests.cpp b/src/tests/libxrpl/protocol_autogen/ledger_entries/RippleStateTests.cpp
index a51ce55f6f..de0769793b 100644
--- a/src/tests/libxrpl/protocol_autogen/ledger_entries/RippleStateTests.cpp
+++ b/src/tests/libxrpl/protocol_autogen/ledger_entries/RippleStateTests.cpp
@@ -31,6 +31,8 @@ TEST(RippleStateTests, BuilderSettersRoundTrip)
     auto const highNodeValue = canonical_UINT64();
     auto const highQualityInValue = canonical_UINT32();
     auto const highQualityOutValue = canonical_UINT32();
+    auto const highSponsorValue = canonical_ACCOUNT();
+    auto const lowSponsorValue = canonical_ACCOUNT();
 
     RippleStateBuilder builder{
         balanceValue,
@@ -46,6 +48,8 @@ TEST(RippleStateTests, BuilderSettersRoundTrip)
     builder.setHighNode(highNodeValue);
     builder.setHighQualityIn(highQualityInValue);
     builder.setHighQualityOut(highQualityOutValue);
+    builder.setHighSponsor(highSponsorValue);
+    builder.setLowSponsor(lowSponsorValue);
 
     builder.setLedgerIndex(index);
     builder.setFlags(0x1u);
@@ -134,6 +138,22 @@ TEST(RippleStateTests, BuilderSettersRoundTrip)
         EXPECT_TRUE(entry.hasHighQualityOut());
     }
 
+    {
+        auto const& expected = highSponsorValue;
+        auto const actualOpt = entry.getHighSponsor();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfHighSponsor");
+        EXPECT_TRUE(entry.hasHighSponsor());
+    }
+
+    {
+        auto const& expected = lowSponsorValue;
+        auto const actualOpt = entry.getLowSponsor();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfLowSponsor");
+        EXPECT_TRUE(entry.hasLowSponsor());
+    }
+
     EXPECT_TRUE(entry.hasLedgerIndex());
     auto const ledgerIndex = entry.getLedgerIndex();
     ASSERT_TRUE(ledgerIndex.has_value());
@@ -158,6 +178,8 @@ TEST(RippleStateTests, BuilderFromSleRoundTrip)
     auto const highNodeValue = canonical_UINT64();
     auto const highQualityInValue = canonical_UINT32();
     auto const highQualityOutValue = canonical_UINT32();
+    auto const highSponsorValue = canonical_ACCOUNT();
+    auto const lowSponsorValue = canonical_ACCOUNT();
 
     auto sle = std::make_shared<SLE>(RippleState::entryType, index);
 
@@ -172,6 +194,8 @@ TEST(RippleStateTests, BuilderFromSleRoundTrip)
     sle->at(sfHighNode) = highNodeValue;
     sle->at(sfHighQualityIn) = highQualityInValue;
     sle->at(sfHighQualityOut) = highQualityOutValue;
+    sle->at(sfHighSponsor) = highSponsorValue;
+    sle->at(sfLowSponsor) = lowSponsorValue;
 
     RippleStateBuilder builderFromSle{sle};
     EXPECT_TRUE(builderFromSle.validate());
@@ -310,6 +334,32 @@ TEST(RippleStateTests, BuilderFromSleRoundTrip)
         expectEqualField(expected, *fromBuilderOpt, "sfHighQualityOut");
     }
 
+    {
+        auto const& expected = highSponsorValue;
+
+        auto const fromSleOpt = entryFromSle.getHighSponsor();
+        auto const fromBuilderOpt = entryFromBuilder.getHighSponsor();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfHighSponsor");
+        expectEqualField(expected, *fromBuilderOpt, "sfHighSponsor");
+    }
+
+    {
+        auto const& expected = lowSponsorValue;
+
+        auto const fromSleOpt = entryFromSle.getLowSponsor();
+        auto const fromBuilderOpt = entryFromBuilder.getLowSponsor();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfLowSponsor");
+        expectEqualField(expected, *fromBuilderOpt, "sfLowSponsor");
+    }
+
     EXPECT_EQ(entryFromSle.getKey(), index);
     EXPECT_EQ(entryFromBuilder.getKey(), index);
 }
@@ -384,5 +434,9 @@ TEST(RippleStateTests, OptionalFieldsReturnNullopt)
     EXPECT_FALSE(entry.getHighQualityIn().has_value());
     EXPECT_FALSE(entry.hasHighQualityOut());
     EXPECT_FALSE(entry.getHighQualityOut().has_value());
+    EXPECT_FALSE(entry.hasHighSponsor());
+    EXPECT_FALSE(entry.getHighSponsor().has_value());
+    EXPECT_FALSE(entry.hasLowSponsor());
+    EXPECT_FALSE(entry.getLowSponsor().has_value());
 }
 }
diff --git a/src/tests/libxrpl/protocol_autogen/ledger_entries/SponsorshipTests.cpp b/src/tests/libxrpl/protocol_autogen/ledger_entries/SponsorshipTests.cpp
new file mode 100644
index 0000000000..e1d9ff15b9
--- /dev/null
+++ b/src/tests/libxrpl/protocol_autogen/ledger_entries/SponsorshipTests.cpp
@@ -0,0 +1,329 @@
+// Auto-generated unit tests for ledger entry Sponsorship
+
+
+#include <gtest/gtest.h>
+
+#include <protocol_autogen/TestHelpers.h>
+
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol_autogen/ledger_entries/Sponsorship.h>
+#include <xrpl/protocol_autogen/ledger_entries/Ticket.h>
+
+#include <string>
+
+namespace xrpl::ledger_entries {
+
+// 1 & 4) Set fields via builder setters, build, then read them back via
+// wrapper getters. After build(), validate() should succeed for both the
+// builder's STObject and the wrapper's SLE.
+TEST(SponsorshipTests, BuilderSettersRoundTrip)
+{
+    uint256 const index{1u};
+
+    auto const previousTxnIDValue = canonical_UINT256();
+    auto const previousTxnLgrSeqValue = canonical_UINT32();
+    auto const ownerValue = canonical_ACCOUNT();
+    auto const sponseeValue = canonical_ACCOUNT();
+    auto const feeAmountValue = canonical_AMOUNT();
+    auto const maxFeeValue = canonical_AMOUNT();
+    auto const remainingOwnerCountValue = canonical_UINT32();
+    auto const ownerNodeValue = canonical_UINT64();
+    auto const sponseeNodeValue = canonical_UINT64();
+
+    SponsorshipBuilder builder{
+        previousTxnIDValue,
+        previousTxnLgrSeqValue,
+        ownerValue,
+        sponseeValue,
+        ownerNodeValue,
+        sponseeNodeValue
+    };
+
+    builder.setFeeAmount(feeAmountValue);
+    builder.setMaxFee(maxFeeValue);
+    builder.setRemainingOwnerCount(remainingOwnerCountValue);
+
+    builder.setLedgerIndex(index);
+    builder.setFlags(0x1u);
+
+    EXPECT_TRUE(builder.validate());
+
+    auto const entry = builder.build(index);
+
+    EXPECT_TRUE(entry.validate());
+
+    {
+        auto const& expected = previousTxnIDValue;
+        auto const actual = entry.getPreviousTxnID();
+        expectEqualField(expected, actual, "sfPreviousTxnID");
+    }
+
+    {
+        auto const& expected = previousTxnLgrSeqValue;
+        auto const actual = entry.getPreviousTxnLgrSeq();
+        expectEqualField(expected, actual, "sfPreviousTxnLgrSeq");
+    }
+
+    {
+        auto const& expected = ownerValue;
+        auto const actual = entry.getOwner();
+        expectEqualField(expected, actual, "sfOwner");
+    }
+
+    {
+        auto const& expected = sponseeValue;
+        auto const actual = entry.getSponsee();
+        expectEqualField(expected, actual, "sfSponsee");
+    }
+
+    {
+        auto const& expected = ownerNodeValue;
+        auto const actual = entry.getOwnerNode();
+        expectEqualField(expected, actual, "sfOwnerNode");
+    }
+
+    {
+        auto const& expected = sponseeNodeValue;
+        auto const actual = entry.getSponseeNode();
+        expectEqualField(expected, actual, "sfSponseeNode");
+    }
+
+    {
+        auto const& expected = feeAmountValue;
+        auto const actualOpt = entry.getFeeAmount();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfFeeAmount");
+        EXPECT_TRUE(entry.hasFeeAmount());
+    }
+
+    {
+        auto const& expected = maxFeeValue;
+        auto const actualOpt = entry.getMaxFee();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfMaxFee");
+        EXPECT_TRUE(entry.hasMaxFee());
+    }
+
+    {
+        auto const& expected = remainingOwnerCountValue;
+        auto const actualOpt = entry.getRemainingOwnerCount();
+        ASSERT_TRUE(actualOpt.has_value());
+        expectEqualField(expected, *actualOpt, "sfRemainingOwnerCount");
+        EXPECT_TRUE(entry.hasRemainingOwnerCount());
+    }
+
+    EXPECT_TRUE(entry.hasLedgerIndex());
+    auto const ledgerIndex = entry.getLedgerIndex();
+    ASSERT_TRUE(ledgerIndex.has_value());
+    EXPECT_EQ(*ledgerIndex, index);
+    EXPECT_EQ(entry.getKey(), index);
+}
+
+// 2 & 4) Start from an SLE, set fields directly on it, construct a builder
+// from that SLE, build a new wrapper, and verify all fields (and validate()).
+TEST(SponsorshipTests, BuilderFromSleRoundTrip)
+{
+    uint256 const index{2u};
+
+    auto const previousTxnIDValue = canonical_UINT256();
+    auto const previousTxnLgrSeqValue = canonical_UINT32();
+    auto const ownerValue = canonical_ACCOUNT();
+    auto const sponseeValue = canonical_ACCOUNT();
+    auto const feeAmountValue = canonical_AMOUNT();
+    auto const maxFeeValue = canonical_AMOUNT();
+    auto const remainingOwnerCountValue = canonical_UINT32();
+    auto const ownerNodeValue = canonical_UINT64();
+    auto const sponseeNodeValue = canonical_UINT64();
+
+    auto sle = std::make_shared<SLE>(Sponsorship::entryType, index);
+
+    sle->at(sfPreviousTxnID) = previousTxnIDValue;
+    sle->at(sfPreviousTxnLgrSeq) = previousTxnLgrSeqValue;
+    sle->at(sfOwner) = ownerValue;
+    sle->at(sfSponsee) = sponseeValue;
+    sle->at(sfFeeAmount) = feeAmountValue;
+    sle->at(sfMaxFee) = maxFeeValue;
+    sle->at(sfRemainingOwnerCount) = remainingOwnerCountValue;
+    sle->at(sfOwnerNode) = ownerNodeValue;
+    sle->at(sfSponseeNode) = sponseeNodeValue;
+
+    SponsorshipBuilder builderFromSle{sle};
+    EXPECT_TRUE(builderFromSle.validate());
+
+    auto const entryFromBuilder = builderFromSle.build(index);
+
+    Sponsorship entryFromSle{sle};
+    EXPECT_TRUE(entryFromBuilder.validate());
+    EXPECT_TRUE(entryFromSle.validate());
+
+    {
+        auto const& expected = previousTxnIDValue;
+
+        auto const fromSle = entryFromSle.getPreviousTxnID();
+        auto const fromBuilder = entryFromBuilder.getPreviousTxnID();
+
+        expectEqualField(expected, fromSle, "sfPreviousTxnID");
+        expectEqualField(expected, fromBuilder, "sfPreviousTxnID");
+    }
+
+    {
+        auto const& expected = previousTxnLgrSeqValue;
+
+        auto const fromSle = entryFromSle.getPreviousTxnLgrSeq();
+        auto const fromBuilder = entryFromBuilder.getPreviousTxnLgrSeq();
+
+        expectEqualField(expected, fromSle, "sfPreviousTxnLgrSeq");
+        expectEqualField(expected, fromBuilder, "sfPreviousTxnLgrSeq");
+    }
+
+    {
+        auto const& expected = ownerValue;
+
+        auto const fromSle = entryFromSle.getOwner();
+        auto const fromBuilder = entryFromBuilder.getOwner();
+
+        expectEqualField(expected, fromSle, "sfOwner");
+        expectEqualField(expected, fromBuilder, "sfOwner");
+    }
+
+    {
+        auto const& expected = sponseeValue;
+
+        auto const fromSle = entryFromSle.getSponsee();
+        auto const fromBuilder = entryFromBuilder.getSponsee();
+
+        expectEqualField(expected, fromSle, "sfSponsee");
+        expectEqualField(expected, fromBuilder, "sfSponsee");
+    }
+
+    {
+        auto const& expected = ownerNodeValue;
+
+        auto const fromSle = entryFromSle.getOwnerNode();
+        auto const fromBuilder = entryFromBuilder.getOwnerNode();
+
+        expectEqualField(expected, fromSle, "sfOwnerNode");
+        expectEqualField(expected, fromBuilder, "sfOwnerNode");
+    }
+
+    {
+        auto const& expected = sponseeNodeValue;
+
+        auto const fromSle = entryFromSle.getSponseeNode();
+        auto const fromBuilder = entryFromBuilder.getSponseeNode();
+
+        expectEqualField(expected, fromSle, "sfSponseeNode");
+        expectEqualField(expected, fromBuilder, "sfSponseeNode");
+    }
+
+    {
+        auto const& expected = feeAmountValue;
+
+        auto const fromSleOpt = entryFromSle.getFeeAmount();
+        auto const fromBuilderOpt = entryFromBuilder.getFeeAmount();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfFeeAmount");
+        expectEqualField(expected, *fromBuilderOpt, "sfFeeAmount");
+    }
+
+    {
+        auto const& expected = maxFeeValue;
+
+        auto const fromSleOpt = entryFromSle.getMaxFee();
+        auto const fromBuilderOpt = entryFromBuilder.getMaxFee();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfMaxFee");
+        expectEqualField(expected, *fromBuilderOpt, "sfMaxFee");
+    }
+
+    {
+        auto const& expected = remainingOwnerCountValue;
+
+        auto const fromSleOpt = entryFromSle.getRemainingOwnerCount();
+        auto const fromBuilderOpt = entryFromBuilder.getRemainingOwnerCount();
+
+        ASSERT_TRUE(fromSleOpt.has_value());
+        ASSERT_TRUE(fromBuilderOpt.has_value());
+
+        expectEqualField(expected, *fromSleOpt, "sfRemainingOwnerCount");
+        expectEqualField(expected, *fromBuilderOpt, "sfRemainingOwnerCount");
+    }
+
+    EXPECT_EQ(entryFromSle.getKey(), index);
+    EXPECT_EQ(entryFromBuilder.getKey(), index);
+}
+
+// 3) Verify wrapper throws when constructed from wrong ledger entry type.
+TEST(SponsorshipTests, WrapperThrowsOnWrongEntryType)
+{
+    uint256 const index{3u};
+
+    // Build a valid ledger entry of a different type
+    // Ticket requires: Account, OwnerNode, TicketSequence, PreviousTxnID, PreviousTxnLgrSeq
+    // Check requires: Account, Destination, SendMax, Sequence, OwnerNode, DestinationNode, PreviousTxnID, PreviousTxnLgrSeq
+    TicketBuilder wrongBuilder{
+        canonical_ACCOUNT(),
+        canonical_UINT64(),
+        canonical_UINT32(),
+        canonical_UINT256(),
+        canonical_UINT32()};
+    auto wrongEntry = wrongBuilder.build(index);
+
+    EXPECT_THROW(Sponsorship{wrongEntry.getSle()}, std::runtime_error);
+}
+
+// 4) Verify builder throws when constructed from wrong ledger entry type.
+TEST(SponsorshipTests, BuilderThrowsOnWrongEntryType)
+{
+    uint256 const index{4u};
+
+    // Build a valid ledger entry of a different type
+    TicketBuilder wrongBuilder{
+        canonical_ACCOUNT(),
+        canonical_UINT64(),
+        canonical_UINT32(),
+        canonical_UINT256(),
+        canonical_UINT32()};
+    auto wrongEntry = wrongBuilder.build(index);
+
+    EXPECT_THROW(SponsorshipBuilder{wrongEntry.getSle()}, std::runtime_error);
+}
+
+// 5) Build with only required fields and verify optional fields return nullopt.
+TEST(SponsorshipTests, OptionalFieldsReturnNullopt)
+{
+    uint256 const index{3u};
+
+    auto const previousTxnIDValue = canonical_UINT256();
+    auto const previousTxnLgrSeqValue = canonical_UINT32();
+    auto const ownerValue = canonical_ACCOUNT();
+    auto const sponseeValue = canonical_ACCOUNT();
+    auto const ownerNodeValue = canonical_UINT64();
+    auto const sponseeNodeValue = canonical_UINT64();
+
+    SponsorshipBuilder builder{
+        previousTxnIDValue,
+        previousTxnLgrSeqValue,
+        ownerValue,
+        sponseeValue,
+        ownerNodeValue,
+        sponseeNodeValue
+    };
+
+    auto const entry = builder.build(index);
+
+    // Verify optional fields are not present
+    EXPECT_FALSE(entry.hasFeeAmount());
+    EXPECT_FALSE(entry.getFeeAmount().has_value());
+    EXPECT_FALSE(entry.hasMaxFee());
+    EXPECT_FALSE(entry.getMaxFee().has_value());
+    EXPECT_FALSE(entry.hasRemainingOwnerCount());
+    EXPECT_FALSE(entry.getRemainingOwnerCount().has_value());
+}
+}
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/SponsorshipSetTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/SponsorshipSetTests.cpp
new file mode 100644
index 0000000000..dce8cfca3f
--- /dev/null
+++ b/src/tests/libxrpl/protocol_autogen/transactions/SponsorshipSetTests.cpp
@@ -0,0 +1,261 @@
+// Auto-generated unit tests for transaction SponsorshipSet
+
+
+#include <gtest/gtest.h>
+
+#include <protocol_autogen/TestHelpers.h>
+
+#include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Seed.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol_autogen/transactions/SponsorshipSet.h>
+#include <xrpl/protocol_autogen/transactions/AccountSet.h>
+
+#include <string>
+
+namespace xrpl::transactions {
+
+// 1 & 4) Set fields via builder setters, build, then read them back via
+// wrapper getters. After build(), validate() should succeed.
+TEST(TransactionsSponsorshipSetTests, BuilderSettersRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testSponsorshipSet"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 1;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const counterpartySponsorValue = canonical_ACCOUNT();
+    auto const sponseeValue = canonical_ACCOUNT();
+    auto const feeAmountValue = canonical_AMOUNT();
+    auto const maxFeeValue = canonical_AMOUNT();
+    auto const remainingOwnerCountValue = canonical_UINT32();
+
+    SponsorshipSetBuilder builder{
+        accountValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Set optional fields
+    builder.setCounterpartySponsor(counterpartySponsorValue);
+    builder.setSponsee(sponseeValue);
+    builder.setFeeAmount(feeAmountValue);
+    builder.setMaxFee(maxFeeValue);
+    builder.setRemainingOwnerCount(remainingOwnerCountValue);
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(tx.validate(reason)) << reason;
+
+    // Verify signing was applied
+    EXPECT_FALSE(tx.getSigningPubKey().empty());
+    EXPECT_TRUE(tx.hasTxnSignature());
+
+    // Verify common fields
+    EXPECT_EQ(tx.getAccount(), accountValue);
+    EXPECT_EQ(tx.getSequence(), sequenceValue);
+    EXPECT_EQ(tx.getFee(), feeValue);
+
+    // Verify required fields
+    // Verify optional fields
+    {
+        auto const& expected = counterpartySponsorValue;
+        auto const actualOpt = tx.getCounterpartySponsor();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfCounterpartySponsor should be present";
+        expectEqualField(expected, *actualOpt, "sfCounterpartySponsor");
+        EXPECT_TRUE(tx.hasCounterpartySponsor());
+    }
+
+    {
+        auto const& expected = sponseeValue;
+        auto const actualOpt = tx.getSponsee();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfSponsee should be present";
+        expectEqualField(expected, *actualOpt, "sfSponsee");
+        EXPECT_TRUE(tx.hasSponsee());
+    }
+
+    {
+        auto const& expected = feeAmountValue;
+        auto const actualOpt = tx.getFeeAmount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfFeeAmount should be present";
+        expectEqualField(expected, *actualOpt, "sfFeeAmount");
+        EXPECT_TRUE(tx.hasFeeAmount());
+    }
+
+    {
+        auto const& expected = maxFeeValue;
+        auto const actualOpt = tx.getMaxFee();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfMaxFee should be present";
+        expectEqualField(expected, *actualOpt, "sfMaxFee");
+        EXPECT_TRUE(tx.hasMaxFee());
+    }
+
+    {
+        auto const& expected = remainingOwnerCountValue;
+        auto const actualOpt = tx.getRemainingOwnerCount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfRemainingOwnerCount should be present";
+        expectEqualField(expected, *actualOpt, "sfRemainingOwnerCount");
+        EXPECT_TRUE(tx.hasRemainingOwnerCount());
+    }
+
+}
+
+// 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
+// and verify all fields match.
+TEST(TransactionsSponsorshipSetTests, BuilderFromStTxRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testSponsorshipSetFromTx"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 2;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const counterpartySponsorValue = canonical_ACCOUNT();
+    auto const sponseeValue = canonical_ACCOUNT();
+    auto const feeAmountValue = canonical_AMOUNT();
+    auto const maxFeeValue = canonical_AMOUNT();
+    auto const remainingOwnerCountValue = canonical_UINT32();
+
+    // Build an initial transaction
+    SponsorshipSetBuilder initialBuilder{
+        accountValue,
+        sequenceValue,
+        feeValue
+    };
+
+    initialBuilder.setCounterpartySponsor(counterpartySponsorValue);
+    initialBuilder.setSponsee(sponseeValue);
+    initialBuilder.setFeeAmount(feeAmountValue);
+    initialBuilder.setMaxFee(maxFeeValue);
+    initialBuilder.setRemainingOwnerCount(remainingOwnerCountValue);
+
+    auto initialTx = initialBuilder.build(publicKey, secretKey);
+
+    // Create builder from existing STTx
+    SponsorshipSetBuilder builderFromTx{initialTx.getSTTx()};
+
+    auto rebuiltTx = builderFromTx.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(rebuiltTx.validate(reason)) << reason;
+
+    // Verify common fields
+    EXPECT_EQ(rebuiltTx.getAccount(), accountValue);
+    EXPECT_EQ(rebuiltTx.getSequence(), sequenceValue);
+    EXPECT_EQ(rebuiltTx.getFee(), feeValue);
+
+    // Verify required fields
+    // Verify optional fields
+    {
+        auto const& expected = counterpartySponsorValue;
+        auto const actualOpt = rebuiltTx.getCounterpartySponsor();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfCounterpartySponsor should be present";
+        expectEqualField(expected, *actualOpt, "sfCounterpartySponsor");
+    }
+
+    {
+        auto const& expected = sponseeValue;
+        auto const actualOpt = rebuiltTx.getSponsee();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfSponsee should be present";
+        expectEqualField(expected, *actualOpt, "sfSponsee");
+    }
+
+    {
+        auto const& expected = feeAmountValue;
+        auto const actualOpt = rebuiltTx.getFeeAmount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfFeeAmount should be present";
+        expectEqualField(expected, *actualOpt, "sfFeeAmount");
+    }
+
+    {
+        auto const& expected = maxFeeValue;
+        auto const actualOpt = rebuiltTx.getMaxFee();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfMaxFee should be present";
+        expectEqualField(expected, *actualOpt, "sfMaxFee");
+    }
+
+    {
+        auto const& expected = remainingOwnerCountValue;
+        auto const actualOpt = rebuiltTx.getRemainingOwnerCount();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfRemainingOwnerCount should be present";
+        expectEqualField(expected, *actualOpt, "sfRemainingOwnerCount");
+    }
+
+}
+
+// 3) Verify wrapper throws when constructed from wrong transaction type.
+TEST(TransactionsSponsorshipSetTests, WrapperThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongType"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(SponsorshipSet{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 4) Verify builder throws when constructed from wrong transaction type.
+TEST(TransactionsSponsorshipSetTests, BuilderThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongTypeBuilder"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(SponsorshipSetBuilder{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 5) Build with only required fields and verify optional fields return nullopt.
+TEST(TransactionsSponsorshipSetTests, OptionalFieldsReturnNullopt)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testSponsorshipSetNullopt"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 3;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific required field values
+
+    SponsorshipSetBuilder builder{
+        accountValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Do NOT set optional fields
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    // Verify optional fields are not present
+    EXPECT_FALSE(tx.hasCounterpartySponsor());
+    EXPECT_FALSE(tx.getCounterpartySponsor().has_value());
+    EXPECT_FALSE(tx.hasSponsee());
+    EXPECT_FALSE(tx.getSponsee().has_value());
+    EXPECT_FALSE(tx.hasFeeAmount());
+    EXPECT_FALSE(tx.getFeeAmount().has_value());
+    EXPECT_FALSE(tx.hasMaxFee());
+    EXPECT_FALSE(tx.getMaxFee().has_value());
+    EXPECT_FALSE(tx.hasRemainingOwnerCount());
+    EXPECT_FALSE(tx.getRemainingOwnerCount().has_value());
+}
+
+}
diff --git a/src/tests/libxrpl/protocol_autogen/transactions/SponsorshipTransferTests.cpp b/src/tests/libxrpl/protocol_autogen/transactions/SponsorshipTransferTests.cpp
new file mode 100644
index 0000000000..c8521b7b20
--- /dev/null
+++ b/src/tests/libxrpl/protocol_autogen/transactions/SponsorshipTransferTests.cpp
@@ -0,0 +1,198 @@
+// Auto-generated unit tests for transaction SponsorshipTransfer
+
+
+#include <gtest/gtest.h>
+
+#include <protocol_autogen/TestHelpers.h>
+
+#include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Seed.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol_autogen/transactions/SponsorshipTransfer.h>
+#include <xrpl/protocol_autogen/transactions/AccountSet.h>
+
+#include <string>
+
+namespace xrpl::transactions {
+
+// 1 & 4) Set fields via builder setters, build, then read them back via
+// wrapper getters. After build(), validate() should succeed.
+TEST(TransactionsSponsorshipTransferTests, BuilderSettersRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testSponsorshipTransfer"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 1;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const objectIDValue = canonical_UINT256();
+    auto const sponseeValue = canonical_ACCOUNT();
+
+    SponsorshipTransferBuilder builder{
+        accountValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Set optional fields
+    builder.setObjectID(objectIDValue);
+    builder.setSponsee(sponseeValue);
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(tx.validate(reason)) << reason;
+
+    // Verify signing was applied
+    EXPECT_FALSE(tx.getSigningPubKey().empty());
+    EXPECT_TRUE(tx.hasTxnSignature());
+
+    // Verify common fields
+    EXPECT_EQ(tx.getAccount(), accountValue);
+    EXPECT_EQ(tx.getSequence(), sequenceValue);
+    EXPECT_EQ(tx.getFee(), feeValue);
+
+    // Verify required fields
+    // Verify optional fields
+    {
+        auto const& expected = objectIDValue;
+        auto const actualOpt = tx.getObjectID();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfObjectID should be present";
+        expectEqualField(expected, *actualOpt, "sfObjectID");
+        EXPECT_TRUE(tx.hasObjectID());
+    }
+
+    {
+        auto const& expected = sponseeValue;
+        auto const actualOpt = tx.getSponsee();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfSponsee should be present";
+        expectEqualField(expected, *actualOpt, "sfSponsee");
+        EXPECT_TRUE(tx.hasSponsee());
+    }
+
+}
+
+// 2 & 4) Start from an STTx, construct a builder from it, build a new wrapper,
+// and verify all fields match.
+TEST(TransactionsSponsorshipTransferTests, BuilderFromStTxRoundTrip)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testSponsorshipTransferFromTx"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 2;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific field values
+    auto const objectIDValue = canonical_UINT256();
+    auto const sponseeValue = canonical_ACCOUNT();
+
+    // Build an initial transaction
+    SponsorshipTransferBuilder initialBuilder{
+        accountValue,
+        sequenceValue,
+        feeValue
+    };
+
+    initialBuilder.setObjectID(objectIDValue);
+    initialBuilder.setSponsee(sponseeValue);
+
+    auto initialTx = initialBuilder.build(publicKey, secretKey);
+
+    // Create builder from existing STTx
+    SponsorshipTransferBuilder builderFromTx{initialTx.getSTTx()};
+
+    auto rebuiltTx = builderFromTx.build(publicKey, secretKey);
+
+    std::string reason;
+    EXPECT_TRUE(rebuiltTx.validate(reason)) << reason;
+
+    // Verify common fields
+    EXPECT_EQ(rebuiltTx.getAccount(), accountValue);
+    EXPECT_EQ(rebuiltTx.getSequence(), sequenceValue);
+    EXPECT_EQ(rebuiltTx.getFee(), feeValue);
+
+    // Verify required fields
+    // Verify optional fields
+    {
+        auto const& expected = objectIDValue;
+        auto const actualOpt = rebuiltTx.getObjectID();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfObjectID should be present";
+        expectEqualField(expected, *actualOpt, "sfObjectID");
+    }
+
+    {
+        auto const& expected = sponseeValue;
+        auto const actualOpt = rebuiltTx.getSponsee();
+        ASSERT_TRUE(actualOpt.has_value()) << "Optional field sfSponsee should be present";
+        expectEqualField(expected, *actualOpt, "sfSponsee");
+    }
+
+}
+
+// 3) Verify wrapper throws when constructed from wrong transaction type.
+TEST(TransactionsSponsorshipTransferTests, WrapperThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongType"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(SponsorshipTransfer{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 4) Verify builder throws when constructed from wrong transaction type.
+TEST(TransactionsSponsorshipTransferTests, BuilderThrowsOnWrongTxType)
+{
+    // Build a valid transaction of a different type
+    auto const [pk, sk] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testWrongTypeBuilder"));
+    auto const account = calcAccountID(pk);
+
+    AccountSetBuilder wrongBuilder{account, 1, canonical_AMOUNT()};
+    auto wrongTx = wrongBuilder.build(pk, sk);
+
+    EXPECT_THROW(SponsorshipTransferBuilder{wrongTx.getSTTx()}, std::runtime_error);
+}
+
+// 5) Build with only required fields and verify optional fields return nullopt.
+TEST(TransactionsSponsorshipTransferTests, OptionalFieldsReturnNullopt)
+{
+    // Generate a deterministic keypair for signing
+    auto const [publicKey, secretKey] =
+        generateKeyPair(KeyType::Secp256k1, generateSeed("testSponsorshipTransferNullopt"));
+
+    // Common transaction fields
+    auto const accountValue = calcAccountID(publicKey);
+    std::uint32_t const sequenceValue = 3;
+    auto const feeValue = canonical_AMOUNT();
+
+    // Transaction-specific required field values
+
+    SponsorshipTransferBuilder builder{
+        accountValue,
+        sequenceValue,
+        feeValue
+    };
+
+    // Do NOT set optional fields
+
+    auto tx = builder.build(publicKey, secretKey);
+
+    // Verify optional fields are not present
+    EXPECT_FALSE(tx.hasObjectID());
+    EXPECT_FALSE(tx.getObjectID().has_value());
+    EXPECT_FALSE(tx.hasSponsee());
+    EXPECT_FALSE(tx.getSponsee().has_value());
+}
+
+}
diff --git a/src/xrpld/app/misc/detail/TxQ.cpp b/src/xrpld/app/misc/detail/TxQ.cpp
index f6d00974b4..041d2ade1e 100644
--- a/src/xrpld/app/misc/detail/TxQ.cpp
+++ b/src/xrpld/app/misc/detail/TxQ.cpp
@@ -15,6 +15,7 @@
 #include <xrpl/ledger/ApplyViewImpl.h>
 #include <xrpl/ledger/OpenView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Keylet.h>
@@ -408,6 +409,9 @@ TxQ::canBeHeld(
     // Disallow delegated transactions from being queued.
     if (tx.isFieldPresent(sfDelegate))
         return telCAN_NOT_QUEUE;
+    // Disallow fee-sponsored transactions from being queued.
+    if (isFeeSponsored(tx))
+        return telCAN_NOT_QUEUE;
 
     {
         // To be queued and relayed, the transaction needs to
diff --git a/src/xrpld/rpc/detail/TransactionSign.cpp b/src/xrpld/rpc/detail/TransactionSign.cpp
index 8c3a5ea245..b8731a2289 100644
--- a/src/xrpld/rpc/detail/TransactionSign.cpp
+++ b/src/xrpld/rpc/detail/TransactionSign.cpp
@@ -1256,7 +1256,7 @@ transactionSignFor(
         // The array must be sorted and validated.
         // For delegated transactions, the delegate account is
         // the one forbidden from appearing in its own Signers array.
-        auto err = sortAndValidateSigners(signers, sttx->getFeePayer());
+        auto err = sortAndValidateSigners(signers, sttx->getInitiator());
         if (RPC::containsError(err))
             return err;
     }
@@ -1423,9 +1423,9 @@ transactionSubmitMultiSigned(
     }
 
     // The array must be sorted and validated.
-    // For delegated transactions, getFeePayer() returns sfDelegate,
+    // For delegated transactions, getInitiator() returns sfDelegate,
     // that account is the one forbidden from appearing in its own Signers array.
-    auto err = sortAndValidateSigners(signers, stTx->getFeePayer());
+    auto err = sortAndValidateSigners(signers, stTx->getInitiator());
     if (RPC::containsError(err))
         return err;
 
diff --git a/src/xrpld/rpc/handlers/account/AccountObjects.cpp b/src/xrpld/rpc/handlers/account/AccountObjects.cpp
index 8375feb4e7..8967509262 100644
--- a/src/xrpld/rpc/handlers/account/AccountObjects.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountObjects.cpp
@@ -7,6 +7,7 @@
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/SponsorHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/Indexes.h>
@@ -33,6 +34,7 @@ namespace xrpl {
     @param dirIndex Begin gathering account objects from this directory.
     @param entryIndex Begin gathering objects from this directory node.
     @param limit Maximum number of objects to find.
+    @param sponsoredFilter If set, only return objects whose sponsored state matches the value.
     @param jvResult A JSON result that holds the request objects.
 */
 bool
@@ -43,6 +45,7 @@ getAccountObjects(
     uint256 dirIndex,
     uint256 entryIndex,
     std::uint32_t const limit,
+    std::optional<bool> const sponsoredFilter,
     json::Value& jvResult)
 {
     // check if dirIndex is valid
@@ -55,6 +58,12 @@ getAccountObjects(
         return it != typeFilter.end();
     };
 
+    auto sponsoredMatchesFilter = [&sponsoredFilter](std::optional<AccountID> const& sponsor) {
+        if (!sponsoredFilter.has_value())
+            return true;
+        return sponsor.has_value() == *sponsoredFilter;
+    };
+
     // if dirIndex != 0, then all NFTs have already been returned.  only
     // iterate NFT pages if the filter says so AND dirIndex == 0
     bool iterateNFTPages =
@@ -93,7 +102,10 @@ getAccountObjects(
 
         while (currentPage)
         {
-            jvObjects.append(currentPage->getJson(JsonOptions::Values::None));
+            std::optional<AccountID> const nftSponsor = currentPage->at(~sfSponsor);
+            bool const canAppendNFT = sponsoredMatchesFilter(nftSponsor);
+            if (canAppendNFT)
+                jvObjects.append(currentPage->getJson());
             auto const npm = (*currentPage)[~sfNextPageMin];
             if (npm)
             {
@@ -179,11 +191,32 @@ getAccountObjects(
         {
             auto const sleNode = ledger.read(keylet::child(*entryIter));
 
-            if (!typeFilter.has_value() ||
-                typeMatchesFilter(typeFilter.value(), sleNode->getType()))
+            bool canAppend = true;
+
+            if (typeFilter.has_value() &&
+                !typeMatchesFilter(typeFilter.value(), sleNode->getType()))
+                canAppend = false;
+
+            // An object counts as sponsored no matter which party's directory
+            // it was found through; the sponsorship need not belong to
+            // `account`'s side.
+            std::optional<AccountID> sponsor;
+            if (sleNode->getType() == ltRIPPLE_STATE)
             {
-                jvObjects.append(sleNode->getJson(JsonOptions::Values::None));
+                sponsor = getLedgerEntryReserveSponsorID(sleNode, sfHighSponsor);
+                if (!sponsor)
+                    sponsor = getLedgerEntryReserveSponsorID(sleNode, sfLowSponsor);
             }
+            else if (isLedgerEntrySupportedBySponsorship(*sleNode))
+            {
+                sponsor = getLedgerEntryReserveSponsorID(sleNode);
+            }
+
+            if (!sponsoredMatchesFilter(sponsor))
+                canAppend = false;
+
+            if (canAppend)
+                jvObjects.append(sleNode->getJson(JsonOptions::Values::None));
 
             if (++itemsAdded == limitLeft)
             {
@@ -271,6 +304,7 @@ doAccountObjects(RPC::JsonContext& context)
             {.name = jss::mptoken, .type = ltMPTOKEN},
             {.name = jss::permissioned_domain, .type = ltPERMISSIONED_DOMAIN},
             {.name = jss::vault, .type = ltVAULT},
+            {.name = jss::sponsorship, .type = ltSPONSORSHIP},
         };
 
         typeFilter.emplace();
@@ -329,7 +363,18 @@ doAccountObjects(RPC::JsonContext& context)
             return RPC::invalidFieldError(jss::marker);
     }
 
-    if (!getAccountObjects(*ledger, accountID, typeFilter, dirIndex, entryIndex, limit, result))
+    std::optional<bool> sponsoredFilter;
+    if (params.isMember(jss::sponsored))
+    {
+        auto const& sponsoredJv = params[jss::sponsored];
+        if (!sponsoredJv.isBool())
+            return RPC::expectedFieldError(jss::sponsored, "boolean");
+
+        sponsoredFilter = sponsoredJv.asBool();
+    }
+
+    if (!getAccountObjects(
+            *ledger, accountID, typeFilter, dirIndex, entryIndex, limit, sponsoredFilter, result))
         return RPC::invalidFieldError(jss::marker);
 
     result[jss::account] = toBase58(accountID);
diff --git a/src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp b/src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp
index 2dd7ae34d4..784be779bb 100644
--- a/src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp
+++ b/src/xrpld/rpc/handlers/ledger/LedgerEntry.cpp
@@ -719,6 +719,28 @@ parseSignerList(
     return parseObjectID(params, fieldName, "hex string");
 }
 
+static std::expected<uint256, json::Value>
+parseSponsorship(
+    json::Value const& params,
+    json::StaticString const fieldName,
+    [[maybe_unused]] unsigned const apiVersion)
+{
+    if (!params.isObject())
+        return parseObjectID(params, fieldName);
+
+    auto const sponsorID =
+        LedgerEntryHelpers::requiredAccountID(params, jss::sponsor, "malformedSponsor");
+    if (!sponsorID)
+        return std::unexpected(sponsorID.error());
+
+    auto const sponseeID =
+        LedgerEntryHelpers::requiredAccountID(params, jss::sponsee, "malformedSponsee");
+    if (!sponseeID)
+        return std::unexpected(sponseeID.error());
+
+    return keylet::sponsorship(*sponsorID, *sponseeID).key;
+}
+
 static std::expected<uint256, json::Value>
 parseTicket(
     json::Value const& params,
diff --git a/src/xrpld/rpc/handlers/transaction/Simulate.cpp b/src/xrpld/rpc/handlers/transaction/Simulate.cpp
index 2a6c2280e3..0f163c7356 100644
--- a/src/xrpld/rpc/handlers/transaction/Simulate.cpp
+++ b/src/xrpld/rpc/handlers/transaction/Simulate.cpp
@@ -77,7 +77,7 @@ getAutofillSequence(json::Value const& txJson, RPC::JsonContext& context)
 }
 
 static std::optional<json::Value>
-autofillSignature(json::Value& sigObject)
+autofillSignature(json::Value& sigObject, std::string const& fieldPrefix = "tx")
 {
     if (!sigObject.isMember(jss::SigningPubKey))
     {
@@ -88,14 +88,17 @@ autofillSignature(json::Value& sigObject)
     if (sigObject.isMember(jss::Signers))
     {
         if (!sigObject[jss::Signers].isArray())
-            return RPC::invalidFieldError("tx.Signers");
+            return RPC::invalidFieldError(fieldPrefix + ".Signers");
         // check multisigned signers
         for (unsigned index = 0; index < sigObject[jss::Signers].size(); index++)
         {
             auto& signer = sigObject[jss::Signers][index];
             if (!signer.isObject() || !signer.isMember(jss::Signer) ||
                 !signer[jss::Signer].isObject())
-                return RPC::invalidFieldError("tx.Signers[" + std::to_string(index) + "]");
+            {
+                return RPC::invalidFieldError(
+                    fieldPrefix + ".Signers[" + std::to_string(index) + "]");
+            }
 
             if (!signer[jss::Signer].isMember(jss::SigningPubKey))
             {
@@ -132,26 +135,19 @@ autofillSignature(json::Value& sigObject)
 static std::optional<json::Value>
 autofillTx(json::Value& txJson, RPC::JsonContext& context)
 {
-    if (!txJson.isMember(jss::Fee))
-    {
-        // autofill Fee
-        // Must happen after all the other autofills happen
-        // Error handling/messaging works better that way
-        auto feeOrError = RPC::getCurrentNetworkFee(
-            context.role,
-            context.app.config(),
-            context.app.getFeeTrack(),
-            context.app.getTxQ(),
-            context.app,
-            txJson);
-        if (feeOrError.isMember(jss::error))
-            return feeOrError;
-        txJson[jss::Fee] = feeOrError;
-    }
-
     if (auto error = autofillSignature(txJson))
         return error;
 
+    if (txJson.isMember(sfSponsorSignature.jsonName))
+    {
+        auto& sponsorSignature = txJson[sfSponsorSignature.jsonName];
+        if (!sponsorSignature.isObject())
+            return RPC::objectFieldError(sfSponsorSignature.jsonName);
+
+        if (auto const error = autofillSignature(sponsorSignature, "tx.SponsorSignature"))
+            return error;
+    }
+
     if (!txJson.isMember(jss::Sequence))
     {
         auto const seq = getAutofillSequence(txJson, context);
@@ -167,6 +163,22 @@ autofillTx(json::Value& txJson, RPC::JsonContext& context)
             txJson[jss::NetworkID] = to_string(networkId);
     }
 
+    if (!txJson.isMember(jss::Fee))
+    {
+        // Autofill Fee after normalizing nested signer fields so the fee
+        // estimator sees the full transaction shape.
+        auto feeOrError = RPC::getCurrentNetworkFee(
+            context.role,
+            context.app.config(),
+            context.app.getFeeTrack(),
+            context.app.getTxQ(),
+            context.app,
+            txJson);
+        if (feeOrError.isMember(jss::error))
+            return feeOrError;
+        txJson[jss::Fee] = feeOrError;
+    }
+
     return std::nullopt;
 }
 

From 8306ac7710d86bdfd26a84597fc7769afbd3f539 Mon Sep 17 00:00:00 2001
From: Ed Hennis <ed@ripple.com>
Date: Fri, 10 Jul 2026 20:18:31 -0400
Subject: [PATCH 059/100] fix: Improve Number addition/subtraction rounding
 (#7369)

Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 include/xrpl/basics/Number.h        | 123 +++---
 src/libxrpl/basics/Number.cpp       | 593 ++++++++++++++++++----------
 src/libxrpl/protocol/Rules.cpp      |  45 ++-
 src/libxrpl/protocol/STNumber.cpp   |   5 +-
 src/test/app/Invariants_test.cpp    |   7 +-
 src/tests/libxrpl/basics/Number.cpp | 575 +++++++++++++++++++++++----
 6 files changed, 994 insertions(+), 354 deletions(-)

diff --git a/include/xrpl/basics/Number.h b/include/xrpl/basics/Number.h
index 073da12f89..28c7b1dbda 100644
--- a/include/xrpl/basics/Number.h
+++ b/include/xrpl/basics/Number.h
@@ -14,7 +14,6 @@
 #include <stdexcept>
 #include <string>
 #include <type_traits>
-#include <unordered_map>
 #include <utility>
 
 namespace xrpl {
@@ -55,37 +54,43 @@ namespace detail {
  * compile time. Doing it at runtime would be pretty wasteful and
  * inefficient.
  */
-constexpr std::size_t kInt64Digits = 20;
-consteval std::array<std::uint64_t, kInt64Digits>
+constexpr std::size_t kUint64Digits = 20;
+[[maybe_unused]] constexpr std::size_t kUint128Digits = 39;
+
+template <typename T, std::size_t Digits>
+consteval std::array<T, Digits>
 buildPowersOfTen()
 {
-    std::array<std::uint64_t, kInt64Digits> result{};
+    std::array<T, Digits> result{};
 
-    std::uint64_t power = 1;
+    T power = 1;
     std::size_t exponent = 0;
     // end the loop early so it doesn't overflow;
     for (; exponent < result.size() - 1; ++exponent, power *= 10)
     {
         result[exponent] = power;
-        if (power > std::numeric_limits<std::uint64_t>::max() / 10)
+        if (power > std::numeric_limits<T>::max() / 10)
             throw std::logic_error("Power of 10 table is too big");
     }
     result[exponent] = power;
-    if (power < std::numeric_limits<std::uint64_t>::max() / 10)
-        throw std::logic_error("Power of 10 table is not big enough for the uint64_t type");
+    if (power < std::numeric_limits<T>::max() / 10)
+        throw std::logic_error("Power of 10 table is not big enough for the given type");
 
     return result;
 }
 
 }  // namespace detail
 
-constexpr std::array<std::uint64_t, detail::kInt64Digits> kPowerOfTen = detail::buildPowersOfTen();
+template <typename T = std::uint64_t, std::size_t Digits = detail::kUint64Digits>
+constexpr std::array<T, Digits> kPowerOfTenImpl = detail::buildPowersOfTen<T, Digits>();
+
+constexpr auto kPowerOfTen = kPowerOfTenImpl<std::uint64_t, detail::kUint64Digits>;
 
 static_assert(kPowerOfTen[0] == 1);
 static_assert(kPowerOfTen[1] == 10);
 static_assert(kPowerOfTen[10] == 10'000'000'000);
 static_assert(
-    isPowerOfTen(kPowerOfTen.back()) && *logTen(kPowerOfTen.back()) == detail::kInt64Digits - 1);
+    isPowerOfTen(kPowerOfTen.back()) && *logTen(kPowerOfTen.back()) == detail::kUint64Digits - 1);
 
 /** MantissaRange defines a range for the mantissa of a normalized Number.
  *
@@ -124,17 +129,37 @@ struct MantissaRange final
 {
     using rep = std::uint64_t;
 
+    // NOLINTBEGIN(readability-enum-initial-value)
+    // The values don't matter, except for Large
     enum class MantissaScale {
+        // Small can be removed when either featureSingleAssetVault or featureLendingProtocol are
+        // retired
         Small,
         // LargeLegacy can be removed when fixCleanup3_2_0 is retired
         LargeLegacy,
-        Large,
+        // Large320 can be removed when fixCleanup3_3_0 is retired
+        Large320,
+        // If Large330 is ever the only remaining "Large*" entry, it can be renamed to just "Large".
+        Large330,
+        // Large is a de-facto alias for "the latest", and is only here for backward compatibility
+        // in the extremely unlikely case that a downstream project made use of it. Note that
+        // because the behavior changed, this may still be a breaking change.
+        Large = Large330,
     };
+    // NOLINTEND(readability-enum-initial-value)
 
-    // This entire enum can be removed when fixCleanup3_2_0 is retired
-    enum class CuspRoundingFix : bool {
-        Disabled = false,
-        Enabled = true,
+    // This entire enum can be removed when the last relevant amendment is retired
+    enum class CuspRoundingFix : std::uint8_t {
+        // Disabled can be removed when fixCleanup3_2_0 is retired
+        Disabled = 0,
+        // Enabled320 can be removed when fixCleanup3_3_0 is retired
+        Enabled320 = 1,
+        // If we ever get to the point that there's only one entry, remove the entire enum
+        Enabled330 = 2,
+        // Enabled is a de-facto alias for "the latest", and is only here for backward compatibility
+        // in the extremely unlikely case that a downstream project made use of it. Note that
+        // because the behavior changed, this may still be a breaking change.
+        Enabled = Enabled330,
     };
 
     explicit constexpr MantissaRange(MantissaScale sc) : scale(sc)
@@ -145,13 +170,27 @@ struct MantissaRange final
     int const log{getExponent(scale)};
     rep const min{getMin(scale, log)};
     rep const max{(min * 10) - 1};
-    CuspRoundingFix const cuspRoundingFixEnabled{isCuspFixEnabled(scale)};
-
-    static MantissaRange const&
-    getMantissaRange(MantissaScale scale);
+    CuspRoundingFix const cuspRoundingFix{isCuspFixEnabled(scale)};
 
     static std::set<MantissaScale> const&
-    getAllScales();
+    getAllScales()
+    {
+        static std::set<MantissaRange::MantissaScale> const kScales = {
+            MantissaRange::MantissaScale::Small,
+            MantissaRange::MantissaScale::LargeLegacy,
+            MantissaRange::MantissaScale::Large320,
+            MantissaRange::MantissaScale::Large330,
+        };
+        return kScales;
+    }
+
+    class Access
+    {
+        static constexpr MantissaRange const&
+        mantissaRange(MantissaScale scale);
+
+        friend Number;
+    };
 
 private:
     static constexpr int
@@ -162,7 +201,8 @@ private:
             case MantissaScale::Small:
                 return 15;
             case MantissaScale::LargeLegacy:
-            case MantissaScale::Large:
+            case MantissaScale::Large320:
+            case MantissaScale::Large330:
                 return 18;
             // LCOV_EXCL_START
             default:
@@ -191,17 +231,16 @@ private:
             case MantissaScale::Small:
             case MantissaScale::LargeLegacy:
                 return CuspRoundingFix::Disabled;
-            case MantissaScale::Large:
-                return CuspRoundingFix::Enabled;
+            case MantissaScale::Large320:
+                return CuspRoundingFix::Enabled320;
+            case MantissaScale::Large330:
+                return CuspRoundingFix::Enabled330;
             default:
                 // If called in a constexpr context, this throw assures that the build fails if an
                 // invalid scale is used.
                 throw std::runtime_error("Unknown mantissa scale");  // LCOV_EXCL_LINE
         }
     }
-
-    static std::unordered_map<MantissaScale, MantissaRange> const&
-    getRanges();
 };
 
 // Like std::integral, but only 64-bit integral types.
@@ -554,9 +593,15 @@ private:
     // changing the values inside the range.
     static thread_local std::reference_wrapper<MantissaRange const> kRange;
 
+    class Guard;
+
     void
     normalize(MantissaRange const& range);
 
+    // Guard has the fields that we need, as well as MantissaRange, so if we have a guard, use that
+    void
+    normalize(Guard const& guard);
+
     /** Normalize Number components to an arbitrary range.
      *
      * min/maxMantissa are parameters because this function is used by both
@@ -571,7 +616,7 @@ private:
         int& exponent,
         internalrep const& minMantissa,
         internalrep const& maxMantissa,
-        MantissaRange::CuspRoundingFix cuspRoundingFixEnabled);
+        MantissaRange::CuspRoundingFix cuspRoundingFix);
 
     template <class T>
     friend void
@@ -581,7 +626,7 @@ private:
         int& exponent,
         MantissaRange::rep const& minMantissa,
         MantissaRange::rep const& maxMantissa,
-        MantissaRange::CuspRoundingFix cuspRoundingFixEnabled,
+        MantissaRange::CuspRoundingFix cuspRoundingFix,
         bool dropped);
 
     [[nodiscard]] bool
@@ -599,8 +644,6 @@ private:
     // UB, and can vary across compilers.
     static internalrep
     externalToInternal(rep mantissa);
-
-    class Guard;
 };
 
 constexpr Number::Number(bool negative, internalrep mantissa, int exponent, Unchecked) noexcept
@@ -862,21 +905,11 @@ squelch(Number const& x, Number const& limit) noexcept
     return x;
 }
 
-inline std::string
-to_string(MantissaRange::MantissaScale const& scale)
-{
-    switch (scale)
-    {
-        case MantissaRange::MantissaScale::Small:
-            return "small";
-        case MantissaRange::MantissaScale::LargeLegacy:
-            return "largeLegacy";
-        case MantissaRange::MantissaScale::Large:
-            return "large";
-        default:
-            throw std::runtime_error("Bad scale");
-    }
-}
+std::string
+to_string(MantissaRange::MantissaScale const& scale);
+
+std::string
+to_string(Number::RoundingMode const& round);
 
 class SaveNumberRoundMode
 {
diff --git a/src/libxrpl/basics/Number.cpp b/src/libxrpl/basics/Number.cpp
index 4d7a821040..0a1d558421 100644
--- a/src/libxrpl/basics/Number.cpp
+++ b/src/libxrpl/basics/Number.cpp
@@ -14,7 +14,6 @@
 #include <stdexcept>
 #include <string>
 #include <type_traits>
-#include <unordered_map>
 #include <utility>
 
 #ifdef _MSC_VER
@@ -31,74 +30,103 @@ namespace xrpl {
 
 thread_local Number::RoundingMode Number::mode = Number::RoundingMode::ToNearest;
 thread_local std::reference_wrapper<MantissaRange const> Number::kRange =
-    MantissaRange::getMantissaRange(MantissaRange::MantissaScale::Large);
+    MantissaRange::Access::mantissaRange(MantissaRange::MantissaScale::Large330);
 
-std::set<MantissaRange::MantissaScale> const&
-MantissaRange::getAllScales()
+std::string
+to_string(MantissaRange::MantissaScale const& scale)
 {
-    static std::set<MantissaRange::MantissaScale> const kScales = {
-        MantissaRange::MantissaScale::Small,
-        MantissaRange::MantissaScale::LargeLegacy,
-        MantissaRange::MantissaScale::Large,
-    };
-    return kScales;
+    switch (scale)
+    {
+        case MantissaRange::MantissaScale::Small:
+            return "Small";
+        case MantissaRange::MantissaScale::LargeLegacy:
+            return "LargeLegacy";
+        case MantissaRange::MantissaScale::Large320:
+            return "Large320";
+        case MantissaRange::MantissaScale::Large330:
+            return "Large330";
+        default:
+            throw std::runtime_error("Bad scale");  // LCOV_EXCL_LINE
+    }
 }
 
-std::unordered_map<MantissaRange::MantissaScale, MantissaRange> const&
-MantissaRange::getRanges()
+std::string
+to_string(Number::RoundingMode const& round)
 {
-    static auto const kMap = []() {
-        std::unordered_map<MantissaScale, MantissaRange> map;
-        for (auto const scale : getAllScales())
-        {
-            map.emplace(scale, scale);
-        }
-
-        // Use these constexpr declarations to do static_asserts to verify the MantissaRanges are
-        // created correctly, but nothing else.
-        {
-            [[maybe_unused]]
-            constexpr static MantissaRange kRange{MantissaRange::MantissaScale::Small};
-            static_assert(isPowerOfTen(kRange.min));
-            static_assert(kRange.min == 1'000'000'000'000'000LL);
-            static_assert(kRange.max == 9'999'999'999'999'999LL);
-            static_assert(kRange.log == 15);
-            static_assert(kRange.min < Number::kMaxRep);
-            static_assert(kRange.max < Number::kMaxRep);
-            static_assert(kRange.cuspRoundingFixEnabled == CuspRoundingFix::Disabled);
-        }
-        {
-            [[maybe_unused]]
-            constexpr static MantissaRange kRange{MantissaRange::MantissaScale::LargeLegacy};
-            static_assert(isPowerOfTen(kRange.min));
-            static_assert(kRange.min == 1'000'000'000'000'000'000ULL);
-            static_assert(kRange.max == rep(9'999'999'999'999'999'999ULL));
-            static_assert(kRange.log == 18);
-            static_assert(kRange.min < Number::kMaxRep);
-            static_assert(kRange.max > Number::kMaxRep);
-            static_assert(kRange.cuspRoundingFixEnabled == CuspRoundingFix::Disabled);
-        }
-        {
-            [[maybe_unused]]
-            constexpr static MantissaRange kRange{MantissaRange::MantissaScale::Large};
-            static_assert(isPowerOfTen(kRange.min));
-            static_assert(kRange.min == 1'000'000'000'000'000'000ULL);
-            static_assert(kRange.max == rep(9'999'999'999'999'999'999ULL));
-            static_assert(kRange.log == 18);
-            static_assert(kRange.min < Number::kMaxRep);
-            static_assert(kRange.max > Number::kMaxRep);
-            static_assert(kRange.cuspRoundingFixEnabled == CuspRoundingFix::Enabled);
-        }
-        return map;
-    }();
-
-    return kMap;
+    switch (round)
+    {
+        case Number::RoundingMode::ToNearest:
+            return "ToNearest";
+        case Number::RoundingMode::TowardsZero:
+            return "TowardsZero";
+        case Number::RoundingMode::Downward:
+            return "Downward";
+        case Number::RoundingMode::Upward:
+            return "Upward";
+        default:
+            throw std::runtime_error("Bad rounding mode");  // LCOV_EXCL_LINE
+    }
 }
 
-MantissaRange const&
-MantissaRange::getMantissaRange(MantissaScale scale)
+constexpr MantissaRange const&
+MantissaRange::Access::mantissaRange(MantissaScale scale)
 {
-    return getRanges().at(scale);
+    static constexpr MantissaRange kSmall{MantissaScale::Small};
+    static constexpr MantissaRange kLegacy{MantissaScale::LargeLegacy};
+    static constexpr MantissaRange kLarge320{MantissaScale::Large320};
+    static constexpr MantissaRange kLarge330{MantissaScale::Large330};
+
+    switch (scale)
+    {
+        case MantissaScale::Small:
+            return kSmall;
+        case MantissaScale::LargeLegacy:
+            return kLegacy;
+        case MantissaScale::Large320:
+            return kLarge320;
+        case MantissaScale::Large330:
+            return kLarge330;
+    }
+    throw std::logic_error("Unknown mantissa scale");
+
+    // static_asserts are checked at compile time, so it doesn't matter where in the function they
+    // are located. For readability of the main body, put them after it.
+
+    // Small
+    static_assert(isPowerOfTen(kSmall.min));
+    static_assert(kSmall.min == 1'000'000'000'000'000LL);
+    static_assert(kSmall.max == 9'999'999'999'999'999LL);
+    static_assert(kSmall.log == 15);
+    static_assert(kSmall.min < Number::kMaxRep);
+    static_assert(kSmall.max < Number::kMaxRep);
+    static_assert(kSmall.cuspRoundingFix == CuspRoundingFix::Disabled);
+
+    // LargeLegacy
+    static_assert(isPowerOfTen(kLegacy.min));
+    static_assert(kLegacy.min == 1'000'000'000'000'000'000ULL);
+    static_assert(kLegacy.max == rep(9'999'999'999'999'999'999ULL));
+    static_assert(kLegacy.log == 18);
+    static_assert(kLegacy.min < Number::kMaxRep);
+    static_assert(kLegacy.max > Number::kMaxRep);
+    static_assert(kLegacy.cuspRoundingFix == CuspRoundingFix::Disabled);
+
+    // Large320
+    static_assert(isPowerOfTen(kLarge320.min));
+    static_assert(kLarge320.min == 1'000'000'000'000'000'000ULL);
+    static_assert(kLarge320.max == rep(9'999'999'999'999'999'999ULL));
+    static_assert(kLarge320.log == 18);
+    static_assert(kLarge320.min < Number::kMaxRep);
+    static_assert(kLarge320.max > Number::kMaxRep);
+    static_assert(kLarge320.cuspRoundingFix == CuspRoundingFix::Enabled320);
+
+    // Large330
+    static_assert(isPowerOfTen(kLarge330.min));
+    static_assert(kLarge330.min == 1'000'000'000'000'000'000ULL);
+    static_assert(kLarge330.max == rep(9'999'999'999'999'999'999ULL));
+    static_assert(kLarge330.log == 18);
+    static_assert(kLarge330.min < Number::kMaxRep);
+    static_assert(kLarge330.max > Number::kMaxRep);
+    static_assert(kLarge330.cuspRoundingFix == CuspRoundingFix::Enabled330);
 }
 
 Number::RoundingMode
@@ -124,7 +152,7 @@ Number::setMantissaScale(MantissaRange::MantissaScale scale)
 {
     if (!MantissaRange::getAllScales().contains(scale))
         logicError("Unknown mantissa scale");
-    kRange = MantissaRange::getMantissaRange(scale);
+    kRange = MantissaRange::Access::mantissaRange(scale);
 }
 
 // Optimization equivalent to:
@@ -155,15 +183,38 @@ divu10(uint128_t& u)
     return r;
 }
 
-// Guard
-
-// The Guard class is used to temporarily add extra digits of
-// precision to an operation.  This enables the final result
-// to be correctly rounded to the internal precision of Number.
-
 template <class T>
 concept UnsignedMantissa = std::is_unsigned_v<T> || std::is_same_v<T, uint128_t>;
 
+/** Guard
+
+    The Guard class is used to temporarily add extra digits of
+    precision to an operation.  This enables the final result
+    to be correctly rounded to the internal precision of Number.
+
+    At its core, the Guard really only needs three pieces of information to determine how to round:
+    1. The rounding mode
+    2. The last digit dropped from the mantissa (i.e. the first digit after the decimal point).
+        (first byte of digits_)
+    3. Whether any other non-zero digits were dropped from the mantissa. (remaining bytes of digits_
+   and xbit_)
+
+    Upward and Downward rounding modes round the unsigned mantissa toward or away from zero
+    depending on whether the sign is negative (sbit_). For positive values, Upward is away, and
+    Downward is toward. For negative values, that's reversed. For simplicity, I'm going to describe
+    the logic using "TowardZero" and "AwayFromZero".
+
+    * TowardZero is the easiest rounding mode. It always rounds down. digits_ and xbit_ are
+        irrelevant.
+    * AwayFromZero is almost as simple. If both "digits_" and "xbit_" are zero (0), it rounds down.
+        Else it rounds up.
+    * ToNearest is only a little more complicated. If the last dropped digit is < 5, then round
+        down. If it is > 5, round up. If it is exactly 5, and there are _any_ other digits (the
+        remainder of "digits_" or "xbit_"), round up, else round to even.
+
+    The current implementation stores 16 digits in "digits_" so that digits can be "pop"ped back
+    out if needed during subtraction (negative addition) operations.
+*/
 class Number::Guard
 {
     std::uint64_t digits_{0};    // 16 decimal guard digits
@@ -171,7 +222,21 @@ class Number::Guard
     std::uint8_t sbit_ : 1 {0};  // the sign of the guard digits
 
 public:
-    explicit Guard() = default;
+    internalrep const minMantissa;
+    internalrep const maxMantissa;
+    MantissaRange::CuspRoundingFix const cuspRoundingFix;
+
+    explicit Guard(
+        internalrep const& minMantissa,
+        internalrep const& maxMantissa,
+        MantissaRange::CuspRoundingFix cuspRoundingFix)
+        : minMantissa(minMantissa), maxMantissa(maxMantissa), cuspRoundingFix(cuspRoundingFix)
+    {
+    }
+
+    explicit Guard(MantissaRange const& range) : Guard(range.min, range.max, range.cuspRoundingFix)
+    {
+    }
 
     // set & test the sign bit
     void
@@ -194,6 +259,10 @@ public:
     unsigned
     pop() noexcept;
 
+    // if true, there are no digits in the guard, including dropped digits (xbit_)
+    [[nodiscard]] bool
+    empty() const noexcept;
+
     /** Drop a digit from the mantissa, and increment the exponent, storing the dropped digit in
      * this Guard.
      *
@@ -206,28 +275,37 @@ public:
     void
     doDropDigit(T& mantissa, int& exponent) noexcept;
 
+    enum class Round {
+        // The result is exact. No rounding is needed. Only used if cuspRoundingFix is Enabled330 or
+        // higher.
+        Exact = -2,
+        // Round down. Since we use integer math, that usually means no change is needed.
+        // Exceptions are for when the result is between kMaxRep and kMaxRepUp (round to kMaxRep),
+        // or after subtraction where _any_ remainder will modify the result. The latter is what
+        // distinguishes Exact from Down.
+        Down = -1,
+        // The result was exactly half-way between two integers. This will round to even.
+        Even = 0,
+        // Round up. Always adds 1 (or subtracts 1 in some cases if cuspRoundingFix is not
+        // Enabled)
+        Up = 1,
+    };
+
     // Indicate round direction:  1 is up, -1 is down, 0 is even
     // This enables the client to round towards nearest, and on
     // tie, round towards even.
-    [[nodiscard]] int
+    [[nodiscard]] Round
     round() const noexcept;
 
     // Modify the result to the correctly rounded value
     template <UnsignedMantissa T>
     void
-    doRoundUp(
-        bool& negative,
-        T& mantissa,
-        int& exponent,
-        internalrep const& minMantissa,
-        internalrep const& maxMantissa,
-        MantissaRange::CuspRoundingFix cuspRoundingFixEnabled,
-        std::string location);
+    doRoundUp(bool& negative, T& mantissa, int& exponent, std::string location);
 
     // Modify the result to the correctly rounded value
     template <UnsignedMantissa T>
     void
-    doRoundDown(bool& negative, T& mantissa, int& exponent, internalrep const& minMantissa);
+    doRoundDown(bool& negative, T& mantissa, int& exponent);
 
     // Modify the result to the correctly rounded value
     void
@@ -239,7 +317,7 @@ private:
 
     template <UnsignedMantissa T>
     void
-    bringIntoRange(bool& negative, T& mantissa, int& exponent, internalrep const& minMantissa);
+    bringIntoRange(bool& negative, T& mantissa, int& exponent);
 };
 
 inline void
@@ -289,6 +367,12 @@ Number::Guard::pop() noexcept
     return d;
 }
 
+inline bool
+Number::Guard::empty() const noexcept
+{
+    return digits_ == 0 && !xbit_;
+}
+
 template <class T>
 void
 Number::Guard::doDropDigit(T& mantissa, int& exponent) noexcept
@@ -314,50 +398,52 @@ Number::Guard::doDropDigit<uint128_t>(uint128_t& mantissa, int& exponent) noexce
 //     -1 if Guard is less than half
 //      0 if Guard is exactly half
 //      1 if Guard is greater than half
-int
+Number::Guard::Round
 Number::Guard::round() const noexcept
 {
-    auto mode = Number::getround();
+    // Local "mode" shadows and has the same value as the static thread_local "Number::mode".
+    // This ensures the overhead of loading the thread_local is only incurred once.
+    auto const mode = Number::getround();
+
+    if (cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330 && empty())
+    {
+        // No remainder
+        return Round::Exact;
+    }
 
     if (mode == RoundingMode::TowardsZero)
-        return -1;
+        return Round::Down;
 
-    if (mode == RoundingMode::Downward)
+    // Also Towards Zero
+    if ((mode == RoundingMode::Downward && !sbit_) || (mode == RoundingMode::Upward && sbit_))
     {
-        if (sbit_)
-        {
-            if (digits_ > 0 || xbit_)
-                return 1;
-        }
-        return -1;
+        return Round::Down;
     }
 
-    if (mode == RoundingMode::Upward)
+    // Away from Zero. Since we checked sbit_ in the previous block, we don't need to check it
+    // again.
+    if (mode == RoundingMode::Downward || mode == RoundingMode::Upward)
     {
-        if (sbit_)
-            return -1;
-        if (digits_ > 0 || xbit_)
-            return 1;
-        return -1;
+        if (empty())
+            return Round::Down;
+        return Round::Up;
     }
 
+    XRPL_ASSERT(
+        mode == RoundingMode::ToNearest, "xrpl::Number::Guard::Round : fallthrough to ToNearest");
     // assume round to nearest if mode is not one of the predefined values
     if (digits_ > 0x5000'0000'0000'0000)
-        return 1;
+        return Round::Up;
     if (digits_ < 0x5000'0000'0000'0000)
-        return -1;
+        return Round::Down;
     if (xbit_)
-        return 1;
-    return 0;
+        return Round::Up;
+    return Round::Even;
 }
 
 template <UnsignedMantissa T>
 void
-Number::Guard::bringIntoRange(
-    bool& negative,
-    T& mantissa,
-    int& exponent,
-    internalrep const& minMantissa)
+Number::Guard::bringIntoRange(bool& negative, T& mantissa, int& exponent)
 {
     // Bring mantissa back into the minMantissa / maxMantissa range AFTER
     // rounding
@@ -378,22 +464,15 @@ Number::Guard::bringIntoRange(
 
 template <UnsignedMantissa T>
 void
-Number::Guard::doRoundUp(
-    bool& negative,
-    T& mantissa,
-    int& exponent,
-    internalrep const& minMantissa,
-    internalrep const& maxMantissa,
-    MantissaRange::CuspRoundingFix cuspRoundingFixEnabled,
-    std::string location)
+Number::Guard::doRoundUp(bool& negative, T& mantissa, int& exponent, std::string location)
 {
     auto r = round();
-    if (r == 1 || (r == 0 && (mantissa & 1) == 1))
+    if (r == Round::Up || (r == Round::Even && (mantissa & 1) == 1))
     {
-        auto const safeToIncrement = [&maxMantissa](auto const& mantissa) {
+        auto const safeToIncrement = [this](auto const& mantissa) {
             return mantissa < maxMantissa && mantissa < kMaxRep;
         };
-        if (cuspRoundingFixEnabled == MantissaRange::CuspRoundingFix::Enabled)
+        if (cuspRoundingFix != MantissaRange::CuspRoundingFix::Disabled)
         {
             // Ensure mantissa after incrementing fits within both the
             // min/maxMantissa range and is a valid "rep".
@@ -414,14 +493,7 @@ Number::Guard::doRoundUp(
                     safeToIncrement(mantissa),
                     "xrpl::Number::Guard::doRoundUp",
                     "can't recurse more than once");
-                doRoundUp(
-                    negative,
-                    mantissa,
-                    exponent,
-                    minMantissa,
-                    maxMantissa,
-                    cuspRoundingFixEnabled,
-                    location);
+                doRoundUp(negative, mantissa, exponent, location);
                 return;
             }
         }
@@ -440,30 +512,43 @@ Number::Guard::doRoundUp(
             }
         }
     }
-    bringIntoRange(negative, mantissa, exponent, minMantissa);
+    bringIntoRange(negative, mantissa, exponent);
     if (exponent > kMaxExponent)
         Throw<std::overflow_error>(std::string(location));
 }
 
 template <UnsignedMantissa T>
 void
-Number::Guard::doRoundDown(
-    bool& negative,
-    T& mantissa,
-    int& exponent,
-    internalrep const& minMantissa)
+Number::Guard::doRoundDown(bool& negative, T& mantissa, int& exponent)
 {
     auto r = round();
-    if (r == 1 || (r == 0 && (mantissa & 1) == 1))
+    if (cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330)
     {
-        --mantissa;
-        if (mantissa < minMantissa)
+        // If there was any remainder, subtract 1 from the result. This is sufficient to get the
+        // best rounding.
+        XRPL_ASSERT(
+            r == Round::Exact || mantissa > maxMantissa,
+            "xrpl::Number::Guard::doRoundDown : mantissa is expected size");
+        if (r != Round::Exact)
         {
-            mantissa *= 10;
-            --exponent;
+            --mantissa;
         }
     }
-    bringIntoRange(negative, mantissa, exponent, minMantissa);
+    else
+    {
+        // Need to preserve the incorrect behavior until the fix amendment can be retired,
+        // because otherwise would risk an unplanned ledger fork.
+        if (r == Round::Up || (r == Round::Even && (mantissa & 1) == 1))
+        {
+            --mantissa;
+            if (mantissa < minMantissa)
+            {
+                mantissa *= 10;
+                --exponent;
+            }
+        }
+    }
+    bringIntoRange(negative, mantissa, exponent);
 }
 
 // Modify the result to the correctly rounded value
@@ -471,7 +556,7 @@ void
 Number::Guard::doRound(rep& drops, std::string location) const
 {
     auto r = round();
-    if (r == 1 || (r == 0 && (drops & 1) == 1))
+    if (r == Round::Up || (r == Round::Even && (drops & 1) == 1))
     {
         if (drops >= kMaxRep)
         {
@@ -530,7 +615,7 @@ doNormalize(
     int& exponent,
     MantissaRange::rep const& minMantissa,
     MantissaRange::rep const& maxMantissa,
-    MantissaRange::CuspRoundingFix cuspRoundingFixEnabled,
+    MantissaRange::CuspRoundingFix cuspRoundingFix,
     bool dropped)
 {
     static constexpr auto kMinExponent = Number::kMinExponent;
@@ -553,7 +638,7 @@ doNormalize(
         m *= 10;
         --exponent;
     }
-    Guard g;
+    Guard g(minMantissa, maxMantissa, cuspRoundingFix);
     if (negative)
         g.setNegative();
     if (dropped)
@@ -598,14 +683,7 @@ doNormalize(
     XRPL_ASSERT_PARTS(m <= kMaxRep, "xrpl::doNormalize", "intermediate mantissa fits in int64");
     mantissa = m;
 
-    g.doRoundUp(
-        negative,
-        mantissa,
-        exponent,
-        minMantissa,
-        maxMantissa,
-        cuspRoundingFixEnabled,
-        "Number::normalize 2");
+    g.doRoundUp(negative, mantissa, exponent, "Number::normalize 2");
     XRPL_ASSERT_PARTS(
         mantissa >= minMantissa && mantissa <= maxMantissa,
         "xrpl::doNormalize",
@@ -620,13 +698,12 @@ Number::normalize<uint128_t>(
     int& exponent,
     internalrep const& minMantissa,
     internalrep const& maxMantissa,
-    MantissaRange::CuspRoundingFix cuspRoundingFixEnabled)
+    MantissaRange::CuspRoundingFix cuspRoundingFix)
 {
     // Not used by every compiler version, and thus not necessarily
     // counted by coverage build
     // LCOV_EXCL_START
-    doNormalize(
-        negative, mantissa, exponent, minMantissa, maxMantissa, cuspRoundingFixEnabled, false);
+    doNormalize(negative, mantissa, exponent, minMantissa, maxMantissa, cuspRoundingFix, false);
     // LCOV_EXCL_STOP
 }
 
@@ -638,13 +715,12 @@ Number::normalize<unsigned long long>(
     int& exponent,
     internalrep const& minMantissa,
     internalrep const& maxMantissa,
-    MantissaRange::CuspRoundingFix cuspRoundingFixEnabled)
+    MantissaRange::CuspRoundingFix cuspRoundingFix)
 {
     // Not used by every compiler version, and thus not necessarily
     // counted by coverage build
     // LCOV_EXCL_START
-    doNormalize(
-        negative, mantissa, exponent, minMantissa, maxMantissa, cuspRoundingFixEnabled, false);
+    doNormalize(negative, mantissa, exponent, minMantissa, maxMantissa, cuspRoundingFix, false);
     // LCOV_EXCL_STOP
 }
 
@@ -656,16 +732,27 @@ Number::normalize<unsigned long>(
     int& exponent,
     internalrep const& minMantissa,
     internalrep const& maxMantissa,
-    MantissaRange::CuspRoundingFix cuspRoundingFixEnabled)
+    MantissaRange::CuspRoundingFix cuspRoundingFix)
 {
-    doNormalize(
-        negative, mantissa, exponent, minMantissa, maxMantissa, cuspRoundingFixEnabled, false);
+    doNormalize(negative, mantissa, exponent, minMantissa, maxMantissa, cuspRoundingFix, false);
 }
 
 void
 Number::normalize(MantissaRange const& range)
 {
-    normalize(negative_, mantissa_, exponent_, range.min, range.max, range.cuspRoundingFixEnabled);
+    normalize(negative_, mantissa_, exponent_, range.min, range.max, range.cuspRoundingFix);
+}
+
+void
+Number::normalize(Guard const& guard)
+{
+    normalize(
+        negative_,
+        mantissa_,
+        exponent_,
+        guard.minMantissa,
+        guard.maxMantissa,
+        guard.cuspRoundingFix);
 }
 
 // Copy the number, but set a new exponent. Because the mantissa doesn't change,
@@ -719,46 +806,102 @@ Number::operator+=(Number const& y)
     bool const yn = y.negative_;
     uint128_t ym = y.mantissa_;
     auto ye = y.exponent_;
-    Guard g;
+    Guard g(kRange);
+
+    auto const& minMantissa = g.minMantissa;
+    auto const& maxMantissa = g.maxMantissa;
+    auto const cuspRoundingFix = g.cuspRoundingFix;
+
+    // Bring the exponents of both values into agreement, so the mantissas are on the same scale
+    //   and can be added directly together.
+
+    auto const upperLimit = static_cast<uint128_t>(g.minMantissa) * 1000;
+    // For the "adjust" lambda
+    // expandM / expandE: The values for which the mantissa will be expanded, and the exponent
+    //  decreased to match. Mantissa won't be expanded beyond upperLimit.
+    //  (37e8 == 37000e5 == 37000000e2)
+    // shrinkM / shrinkE: The values for which the mantissa will be shrunk, and exponent increased
+    //  to match, if necessary.
+    auto const adjust = [&g, &upperLimit](
+                            uint128_t& expandM, int& expandE, uint128_t& shrinkM, int& shrinkE) {
+        // Adjust up and down until the exponents match
+        if (g.cuspRoundingFix == MantissaRange::CuspRoundingFix::Enabled330)
+        {
+            // For Enabled330, there are three steps.
+            // 1. First, shrink the mantissa of shrinkM/shrinkE while shrinkM ends in 0.
+            while (shrinkE < expandE && shrinkM % 10 == 0)
+            {
+                g.doDropDigit(shrinkM, shrinkE);
+            }
+
+            // 2. Then expand the mantissa of expandM/expandE, with a limit for expandM a few orders
+            // of magnitude above the MantissaRange. This will leave a few extra digits for rounding
+            // later, but nothing excessive.
+            while (shrinkE < expandE && expandE > kMinExponent && expandM < upperLimit)
+            {
+                expandM *= 10;
+                --expandE;
+            }
+        }
+
+        // 3. Finally, shrink the mantissa of shrinkM/shrinkE until the exponents match. Any removed
+        // digits will be put into the Guard. This is the only step for non-Enabled330 modes.
+        while (shrinkE < expandE)
+        {
+            g.doDropDigit(shrinkM, shrinkE);
+        }
+    };
+
+    // Shrink the mantissa and raise the exponent of the value with the lower exponent. Store any
+    // dropped digits in the Guard.
     if (xe < ye)
     {
         if (xn)
             g.setNegative();
-        do
-        {
-            g.doDropDigit(xm, xe);
-        } while (xe < ye);
+
+        adjust(ym, ye, xm, xe);
     }
     else if (xe > ye)
     {
         if (yn)
             g.setNegative();
-        do
-        {
-            g.doDropDigit(ym, ye);
-        } while (xe > ye);
-    }
 
-    auto const& range = kRange.get();
-    auto const& minMantissa = range.min;
-    auto const& maxMantissa = range.max;
-    auto const cuspRoundingFixEnabled = range.cuspRoundingFixEnabled;
+        adjust(xm, xe, ym, ye);
+    }
+    else if (g.cuspRoundingFix == MantissaRange::CuspRoundingFix::Enabled330)
+    {
+        // Both values have the same exponent.
+        // Set the sign of the Guard based on the sign of the Number with the smallest
+        // unsigned _mantissa_
+        if ((xm < ym && xn) || (ym < xm && yn))
+            g.setNegative();
+    }
 
     if (xn == yn)
     {
         xm += ym;
-        if (xm > maxMantissa || xm > kMaxRep)
+
+        if (g.cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330)
         {
-            g.doDropDigit(xm, xe);
+            // Don't do any adjustments for Enabled330. Normalize will take care of it
+            // Because of "adjust", the only way there can be data in the Guard is if we first grew
+            // the mantissa past the maxMantissa. Since we added here, it can only get bigger.
+            // If xm > maxMantissa, then doNormalize has all the data it needs from the last 3-4
+            // digits, plus the "dropped" flag that will be passed in.
+            // If not, then the mantissa will only need to be padded out with 0s and won't need to
+            // round.
+            XRPL_ASSERT(
+                xm > maxMantissa || g.empty(),
+                "xrpl::Number::operator+ : rounding state expected after add");
+        }
+        else
+        {
+            if (xm > maxMantissa || xm > kMaxRep)
+            {
+                g.doDropDigit(xm, xe);
+            }
+            g.doRoundUp(xn, xm, xe, "Number::addition overflow");
         }
-        g.doRoundUp(
-            xn,
-            xm,
-            xe,
-            minMantissa,
-            maxMantissa,
-            cuspRoundingFixEnabled,
-            "Number::addition overflow");
     }
     else
     {
@@ -772,19 +915,67 @@ Number::operator+=(Number const& y)
             xe = ye;
             xn = yn;
         }
-        while (xm < minMantissa && xm * 10 <= kMaxRep)
+        if (cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330)
         {
-            xm *= 10;
-            xm -= g.pop();
-            --xe;
+            // Because we subtracted, xm can have any number of digits from 1 up to
+            // upperLimit * 10, and g can be in any state. (Note that xm can't be zero, because that
+            // special case was tested earlier.)
+
+            // Grow xm/xe and pull digits out of the Guard until xm reaches upperLimit, but stop if
+            // the Guard empties out, because no rounding will be necessary. This will ensure that
+            // normalize will have enough information to make an accurate rounding decision.
+            // (Normalize will pad a small mantissa back into range.) Note that if any digits were
+            // lost (xbit_), the Guard will never be empty, so xm will grow larger than upperLimit.
+            while (xm < upperLimit && !g.empty())
+            {
+                xm *= 10;
+                xm -= g.pop();
+                --xe;
+            }
+            XRPL_ASSERT(
+                xm > maxMantissa || g.empty(),
+                "xrpl::Number::operator+ : rounding state expected after subtract");
         }
-        g.doRoundDown(xn, xm, xe, minMantissa);
+        else
+        {
+            // Grow xm/xe and pull digits out of the Guard until it's back in the
+            // minMantissa/maxMantissa range.
+            while (xm < minMantissa && xm * 10 <= kMaxRep)
+            {
+                xm *= 10;
+                xm -= g.pop();
+                --xe;
+            }
+        }
+        // Rounding down can result in decrementing xm, based on whether there is any data left in
+        // the Guard (depending on cuspRoundingFix). Note that if that happens, then the Guard is
+        // not empty. For Enabled330, that will also result in the "dropped" flag being passed to
+        // doNormalize, which may result in the mantissa being incremented again. It doesn't matter
+        // what the dropped digits are, only that they exist. This is because subtracting one
+        // "overcorrects", so we know there are still trailing digits to be accounted for in the
+        // rounding.
+        //
+        // This works because
+        // 1. The rounding up will be done _after_ the mantissa is brought into range. It may not
+        //    be in range right now, and
+        // 2. The "dropped" flag is only ever used as a tie-breaker, specifically when rounding
+        //    away from zero, and the dropped digits are 0, or when rounding to nearest, and
+        //    the dropped digits represent exactly 0.5.
+        g.doRoundDown(xn, xm, xe);
     }
 
+    doNormalize(
+        xn,
+        xm,
+        xe,
+        minMantissa,
+        maxMantissa,
+        cuspRoundingFix,
+        cuspRoundingFix == MantissaRange::CuspRoundingFix::Enabled330 && !g.empty());
     negative_ = xn;
     mantissa_ = static_cast<internalrep>(xm);
     exponent_ = xe;
-    normalize(range);
+    XRPL_ASSERT(isnormal(), "xrpl::Number::operator+= : result is normal");
     return *this;
 }
 
@@ -818,14 +1009,11 @@ Number::operator*=(Number const& y)
     auto ze = xe + ye;
     auto zs = xs * ys;
     bool zn = (zs == -1);
-    Guard g;
+    Guard g(kRange);
     if (zn)
         g.setNegative();
 
-    auto const& range = kRange.get();
-    auto const& minMantissa = range.min;
-    auto const& maxMantissa = range.max;
-    auto const cuspRoundingFixEnabled = range.cuspRoundingFixEnabled;
+    auto const& maxMantissa = g.maxMantissa;
 
     while (zm > maxMantissa || zm > kMaxRep)
     {
@@ -834,19 +1022,12 @@ Number::operator*=(Number const& y)
 
     xm = static_cast<internalrep>(zm);
     xe = ze;
-    g.doRoundUp(
-        zn,
-        xm,
-        xe,
-        minMantissa,
-        maxMantissa,
-        cuspRoundingFixEnabled,
-        "Number::multiplication overflow : exponent is " + std::to_string(xe));
+    g.doRoundUp(zn, xm, xe, "Number::multiplication overflow : exponent is " + std::to_string(xe));
     negative_ = zn;
     mantissa_ = xm;
     exponent_ = xe;
 
-    normalize(range);
+    normalize(g);
     return *this;
 }
 
@@ -882,7 +1063,7 @@ Number::operator/=(Number const& y)
     auto const& range = kRange.get();
     auto const& minMantissa = range.min;
     auto const& maxMantissa = range.max;
-    auto const cuspRoundingFixEnabled = range.cuspRoundingFixEnabled;
+    auto const cuspRoundingFix = range.cuspRoundingFix;
 
     // Division operates on two large integers (16-digit for small
     // mantissas, 19-digit for large) using integer math. If the values
@@ -930,7 +1111,7 @@ Number::operator/=(Number const& y)
     // This is equivalent to if we had used an initial factor of 10^22,
     // a couple digits more than we actually need.
     //
-    // Stage 3: If there is still a remainder, and the CuspRoundingFix
+    // Stage 3: If there is still a remainder, and the cuspRoundingFix
     // is enabled, pass a flag indicating such to doNormalize. The Guard
     // in doNormalize will treat that flag as if non-zero digits had
     // been dropped from the mantissa when shrinking it into range.
@@ -1014,14 +1195,14 @@ Number::operator/=(Number const& y)
             // rounding fix is enabled, flag if there is still
             // a remainder from stage 2.
             bool const useTrailingRemainder =
-                cuspRoundingFixEnabled == MantissaRange::CuspRoundingFix::Enabled;
+                cuspRoundingFix != MantissaRange::CuspRoundingFix::Disabled;
             if (useTrailingRemainder)
             {
                 dropped = partialNumerator % dm != 0;
             }
         }
     }
-    doNormalize(zp, zm, ze, minMantissa, maxMantissa, cuspRoundingFixEnabled, dropped);
+    doNormalize(zp, zm, ze, minMantissa, maxMantissa, cuspRoundingFix, dropped);
     negative_ = zp;
     mantissa_ = static_cast<internalrep>(zm);
     exponent_ = ze;
@@ -1035,7 +1216,7 @@ operator rep() const
 {
     rep drops = mantissa();
     int offset = exponent();
-    Guard g;
+    Guard g(kRange);
     if (drops != 0)
     {
         if (negative_)
diff --git a/src/libxrpl/protocol/Rules.cpp b/src/libxrpl/protocol/Rules.cpp
index e0968ea868..d71bb77f66 100644
--- a/src/libxrpl/protocol/Rules.cpp
+++ b/src/libxrpl/protocol/Rules.cpp
@@ -39,22 +39,30 @@ setCurrentTransactionRules(std::optional<Rules> r)
     // Push the appropriate setting, instead of having the class pull every time
     // the value is needed. That could get expensive fast.
 
-    // If any new conditions with new amendments are added, those amendments must also be added to
-    // useRulesGuards.
-    bool const enableVaultNumbers =
-        !r || (r->enabled(featureSingleAssetVault) || r->enabled(featureLendingProtocol));
-    bool const enableCuspRoundingFix = !r || r->enabled(fixCleanup3_2_0);
-    XRPL_ASSERT(
-        !r || useRulesGuards(*r) == (enableCuspRoundingFix || enableVaultNumbers),
-        "setCurrentTransactionRules : rule decisions match");
-
     // Declare the range this way to keep clang-tidy from complaining
-    auto const range = [enableCuspRoundingFix, enableVaultNumbers]() {
-        if (enableVaultNumbers)
+    auto const range = [&r]() {
+        // If any new conditions with new amendments are added to "enableLargeNumbers", those
+        // amendments must also be added to useRulesGuards.
+        bool const enableLargeNumbers =
+            !r || (r->enabled(featureSingleAssetVault) || r->enabled(featureLendingProtocol));
+        // If enableLargeNumbers is true, then useRulesGuard must also return true.
+        // However, the reverse is not true. Other amendments can cause the rules guard to be used,
+        // even though large numbers are _not_ used.
+        XRPL_ASSERT(
+            !r || !enableLargeNumbers || useRulesGuards(*r),
+            "setCurrentTransactionRules : rule decisions match");
+
+        if (enableLargeNumbers)
         {
-            if (enableCuspRoundingFix)
+            static_assert(
+                MantissaRange::MantissaScale::Large == MantissaRange::MantissaScale::Large330);
+            if (!r || r->enabled(fixCleanup3_3_0))
             {
-                return MantissaRange::MantissaScale::Large;
+                return MantissaRange::MantissaScale::Large330;
+            }
+            if (r->enabled(fixCleanup3_2_0))
+            {
+                return MantissaRange::MantissaScale::Large320;
             }
             return MantissaRange::MantissaScale::LargeLegacy;
         }
@@ -69,14 +77,14 @@ bool
 useRulesGuards(Rules const& rules)
 {
     // The list of amendments used here - to decide whether to create a RulesGuard - must be a
-    // superset of the list used to figure out which mantissa scale to use in
-    // setCurrentTransactionRules. Additional amendments can be added if desired.
+    // superset of the list used to determine "enableLargeNumbers" in setCurrentTransactionRules.
+    // Additional amendments can be added if desired.
     //
     // As soon as any one of these amendments is retired, this whole function can be removed, along
     // with createGuards, and any other callers, and the first set of guards can be created directly
     // at the call site, without using optional.
-    return rules.enabled(fixCleanup3_2_0) || rules.enabled(featureSingleAssetVault) ||
-        rules.enabled(featureLendingProtocol);
+    return rules.enabled(featureSingleAssetVault) || rules.enabled(featureLendingProtocol) ||
+        rules.enabled(fixCleanup3_2_0) || rules.enabled(fixCleanup3_3_0);
 }
 
 void
@@ -87,7 +95,8 @@ createGuards(
 {
     if (useRulesGuards(rules))
     {
-        // raii classes for the current ledger rules.
+        // raii classes for the current ledger rules. If the rules are set, the MantissaRange will
+        // be updated, too.
         rulesGuard.emplace(rules);
     }
     else
diff --git a/src/libxrpl/protocol/STNumber.cpp b/src/libxrpl/protocol/STNumber.cpp
index 79f7655869..bd7f67649b 100644
--- a/src/libxrpl/protocol/STNumber.cpp
+++ b/src/libxrpl/protocol/STNumber.cpp
@@ -88,7 +88,6 @@ STNumber::add(Serializer& s) const
         }
         else
         {
-#if !NDEBUG
             // There are circumstances where an already-rounded Number is
             // serialized without being touched by a transactor, and thus
             // without an asset. We can't know if it's rounded, because it could
@@ -96,11 +95,9 @@ STNumber::add(Serializer& s) const
             // Json. Regardless, the only time we should be serializing an
             // STNumber is when the scale is large.
             XRPL_ASSERT_PARTS(
-                Number::getMantissaScale() == MantissaRange::MantissaScale::LargeLegacy ||
-                    Number::getMantissaScale() == MantissaRange::MantissaScale::Large,
+                Number::getMantissaScale() != MantissaRange::MantissaScale::Small,
                 "xrpl::STNumber::add",
                 "STNumber only used with large mantissa scale");
-#endif
         }
     }
 
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index b70d099ba4..8a1f24e30b 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -5030,11 +5030,10 @@ class Invariants_test : public beast::unit_test::Suite
             std::vector<ValidVault::DeltaInfo> values;
         };
 
-        for (auto const mantissaScale : {
-                 MantissaRange::MantissaScale::LargeLegacy,
-                 MantissaRange::MantissaScale::Large,
-             })
+        for (auto const mantissaScale : MantissaRange::getAllScales())
         {
+            if (mantissaScale == MantissaRange::MantissaScale::Small)
+                continue;
             NumberMantissaScaleGuard const g{mantissaScale};
 
             auto makeDelta = [&vaultAsset](Number const& n) -> ValidVault::DeltaInfo {
diff --git a/src/tests/libxrpl/basics/Number.cpp b/src/tests/libxrpl/basics/Number.cpp
index e8c4e4209f..70d6be2da5 100644
--- a/src/tests/libxrpl/basics/Number.cpp
+++ b/src/tests/libxrpl/basics/Number.cpp
@@ -48,6 +48,22 @@ fmt(BigInt const& value)
     return out;
 }
 
+BigInt
+toBigInt(Number const& n)
+{
+    BigInt v = n.mantissa();
+    auto e = n.exponent();
+
+    for (; e > 0; --e)
+        v *= 10;
+    for (; e < 0; ++e)
+    {
+        EXPECT_EQ(v % 10, 0);
+        v /= 10;
+    }
+    return v;
+}
+
 template <class T = Dec>
 static T
 pow10(int n)
@@ -177,28 +193,35 @@ TEST(NumberTest, add)
 
         auto const scale = Number::getMantissaScale();
 
-        using Case = std::tuple<Number, Number, Number>;
-        auto const cSmall = std::to_array<Case>(
-            {{Number{1'000'000'000'000'000, -15},
-              Number{6'555'555'555'555'555, -29},
-              Number{1'000'000'000'000'066, -15}},
-             {Number{-1'000'000'000'000'000, -15},
-              Number{-6'555'555'555'555'555, -29},
-              Number{-1'000'000'000'000'066, -15}},
-             {Number{-1'000'000'000'000'000, -15},
-              Number{6'555'555'555'555'555, -29},
-              Number{-9'999'999'999'999'344, -16}},
-             {Number{-6'555'555'555'555'555, -29},
-              Number{1'000'000'000'000'000, -15},
-              Number{9'999'999'999'999'344, -16}},
-             {Number{}, Number{5}, Number{5}},
-             {Number{5}, Number{}, Number{5}},
-             {Number{5'555'555'555'555'555, -32768},
-              Number{-5'555'555'555'555'554, -32768},
-              Number{0}},
-             {Number{-9'999'999'999'999'999, -31},
-              Number{1'000'000'000'000'000, -15},
-              Number{9'999'999'999'999'990, -16}}});
+        using Case = std::tuple<Number, Number, Number, int>;
+        auto const cSmall = std::to_array<Case>({
+            {Number{1'000'000'000'000'000, -15},
+             Number{6'555'555'555'555'555, -29},
+             Number{1'000'000'000'000'066, -15},
+             __LINE__},
+            {Number{-1'000'000'000'000'000, -15},
+             Number{-6'555'555'555'555'555, -29},
+             Number{-1'000'000'000'000'066, -15},
+             __LINE__},
+            {Number{-1'000'000'000'000'000, -15},
+             Number{6'555'555'555'555'555, -29},
+             Number{-9'999'999'999'999'344, -16},
+             __LINE__},
+            {Number{-6'555'555'555'555'555, -29},
+             Number{1'000'000'000'000'000, -15},
+             Number{9'999'999'999'999'344, -16},
+             __LINE__},
+            {Number{}, Number{5}, Number{5}, __LINE__},
+            {Number{5}, Number{}, Number{5}, __LINE__},
+            {Number{5'555'555'555'555'555, -32768},
+             Number{-5'555'555'555'555'554, -32768},
+             Number{0},
+             __LINE__},
+            {Number{-9'999'999'999'999'999, -31},
+             Number{1'000'000'000'000'000, -15},
+             Number{9'999'999'999'999'990, -16},
+             __LINE__},
+        });
         auto const cLarge = std::to_array<Case>(
             // Note that items with extremely large mantissas need to be
             // calculated, because otherwise they overflow uint64. Items from C
@@ -206,45 +229,57 @@ TEST(NumberTest, add)
             {
                 {Number{1'000'000'000'000'000, -15},
                  Number{6'555'555'555'555'555, -29},
-                 Number{1'000'000'000'000'065'556, -18}},
+                 Number{1'000'000'000'000'065'556, -18},
+                 __LINE__},
                 {Number{-1'000'000'000'000'000, -15},
                  Number{-6'555'555'555'555'555, -29},
-                 Number{-1'000'000'000'000'065'556, -18}},
+                 Number{-1'000'000'000'000'065'556, -18},
+                 __LINE__},
                 {Number{-1'000'000'000'000'000, -15},
                  Number{6'555'555'555'555'555, -29},
-                 Number{true, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}}},
+                 Number{true, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}},
+                 __LINE__},
                 {Number{-6'555'555'555'555'555, -29},
                  Number{1'000'000'000'000'000, -15},
-                 Number{false, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}}},
-                {Number{}, Number{5}, Number{5}},
-                {Number{5}, Number{}, Number{5}},
+                 Number{false, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}},
+                 __LINE__},
+                {Number{}, Number{5}, Number{5}, __LINE__},
+                {Number{5}, Number{}, Number{5}, __LINE__},
                 {Number{5'555'555'555'555'555'000, -32768},
                  Number{-5'555'555'555'555'554'000, -32768},
-                 Number{0}},
+                 Number{0},
+                 __LINE__},
                 {Number{-9'999'999'999'999'999, -31},
                  Number{1'000'000'000'000'000, -15},
-                 Number{9'999'999'999'999'990, -16}},
+                 Number{9'999'999'999'999'990, -16},
+                 __LINE__},
                 // Items from cSmall expanded for the larger mantissa
                 {Number{1'000'000'000'000'000'000, -18},
                  Number{6'555'555'555'555'555'555, -35},
-                 Number{1'000'000'000'000'000'066, -18}},
+                 Number{1'000'000'000'000'000'066, -18},
+                 __LINE__},
                 {Number{-1'000'000'000'000'000'000, -18},
                  Number{-6'555'555'555'555'555'555, -35},
-                 Number{-1'000'000'000'000'000'066, -18}},
+                 Number{-1'000'000'000'000'000'066, -18},
+                 __LINE__},
                 {Number{-1'000'000'000'000'000'000, -18},
                  Number{6'555'555'555'555'555'555, -35},
-                 Number{true, 9'999'999'999'999'999'344ULL, -19, Number::Normalized{}}},
+                 Number{true, 9'999'999'999'999'999'344ULL, -19, Number::Normalized{}},
+                 __LINE__},
                 {Number{-6'555'555'555'555'555'555, -35},
                  Number{1'000'000'000'000'000'000, -18},
-                 Number{false, 9'999'999'999'999'999'344ULL, -19, Number::Normalized{}}},
-                {Number{}, Number{5}, Number{5}},
+                 Number{false, 9'999'999'999'999'999'344ULL, -19, Number::Normalized{}},
+                 __LINE__},
+                {Number{}, Number{5}, Number{5}, __LINE__},
                 {Number{5'555'555'555'555'555'555, -32768},
                  Number{-5'555'555'555'555'555'554, -32768},
-                 Number{0}},
+                 Number{0},
+                 __LINE__},
                 {Number{true, 9'999'999'999'999'999'999ULL, -37, Number::Normalized{}},
                  Number{1'000'000'000'000'000'000, -18},
-                 Number{false, 9'999'999'999'999'999'990ULL, -19, Number::Normalized{}}},
-                {Number{Number::kMaxRep - 1}, Number{1, 0}, Number{Number::kMaxRep}},
+                 Number{false, 9'999'999'999'999'999'990ULL, -19, Number::Normalized{}},
+                 __LINE__},
+                {Number{Number::kMaxRep - 1}, Number{1, 0}, Number{Number::kMaxRep}, __LINE__},
                 // Test extremes
                 {
                     // Each Number operand rounds up, so the actual mantissa is
@@ -252,6 +287,7 @@ TEST(NumberTest, add)
                     Number{false, 9'999'999'999'999'999'999ULL, 0, Number::Normalized{}},
                     Number{false, 9'999'999'999'999'999'999ULL, 0, Number::Normalized{}},
                     Number{2, 19},
+                    __LINE__,
                 },
                 {
                     // Does not round. Mantissas are going to be > maxRep, so if
@@ -262,21 +298,25 @@ TEST(NumberTest, add)
                     Number{false, 9'999'999'999'999'999'990ULL, 0, Number::Normalized{}},
                     Number{false, 9'999'999'999'999'999'990ULL, 0, Number::Normalized{}},
                     Number{false, 1'999'999'999'999'999'998ULL, 1, Number::Normalized{}},
+                    __LINE__,
                 },
             });
         auto const cLargeLegacy = std::to_array<Case>({
-            {Number{Number::kMaxRep}, Number{6, -1}, Number{Number::kMaxRep / 10, 1}},
+            {Number{Number::kMaxRep}, Number{6, -1}, Number{Number::kMaxRep / 10, 1}, __LINE__},
         });
         auto const cLargeCorrected = std::to_array<Case>({
-            {Number{Number::kMaxRep}, Number{6, -1}, Number{(Number::kMaxRep / 10) + 1, 1}},
+            {Number{Number::kMaxRep},
+             Number{6, -1},
+             Number{(Number::kMaxRep / 10) + 1, 1},
+             __LINE__},
         });
         auto test = [](auto const& c) {
-            for (auto const& [x, y, z] : c)
+            for (auto const& [x, y, z, line] : c)
             {
                 auto const result = x + y;
                 std::stringstream ss;
                 ss << x << " + " << y << " = " << result << ". Expected: " << z;
-                EXPECT_EQ(result, z) << ss.str();
+                EXPECT_EQ(result, z) << ss.str() << " Line: " << line;
             }
         };
         if (scale == MantissaRange::MantissaScale::Small)
@@ -319,21 +359,28 @@ TEST(NumberTest, sub)
 
         auto const scale = Number::getMantissaScale();
 
-        using Case = std::tuple<Number, Number, Number>;
+        using Case = std::tuple<Number, Number, Number, int>;
         auto const cSmall = std::to_array<Case>(
             {{Number{1'000'000'000'000'000, -15},
               Number{6'555'555'555'555'555, -29},
-              Number{9'999'999'999'999'344, -16}},
+              Number{9'999'999'999'999'344, -16},
+              __LINE__},
              {Number{6'555'555'555'555'555, -29},
               Number{1'000'000'000'000'000, -15},
-              Number{-9'999'999'999'999'344, -16}},
-             {Number{1'000'000'000'000'000, -15}, Number{1'000'000'000'000'000, -15}, Number{0}},
+              Number{-9'999'999'999'999'344, -16},
+              __LINE__},
+             {Number{1'000'000'000'000'000, -15},
+              Number{1'000'000'000'000'000, -15},
+              Number{0},
+              __LINE__},
              {Number{1'000'000'000'000'000, -15},
               Number{1'000'000'000'000'001, -15},
-              Number{-1'000'000'000'000'000, -30}},
+              Number{-1'000'000'000'000'000, -30},
+              __LINE__},
              {Number{1'000'000'000'000'001, -15},
               Number{1'000'000'000'000'000, -15},
-              Number{1'000'000'000'000'000, -30}}});
+              Number{1'000'000'000'000'000, -30},
+              __LINE__}});
         auto const cLarge = std::to_array<Case>(
             // Note that items with extremely large mantissas need to be
             // calculated, because otherwise they overflow uint64. Items from C
@@ -341,49 +388,63 @@ TEST(NumberTest, sub)
             {
                 {Number{1'000'000'000'000'000, -15},
                  Number{6'555'555'555'555'555, -29},
-                 Number{false, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}}},
+                 Number{false, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}},
+                 __LINE__},
                 {Number{6'555'555'555'555'555, -29},
                  Number{1'000'000'000'000'000, -15},
-                 Number{true, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}}},
-                {Number{1'000'000'000'000'000, -15}, Number{1'000'000'000'000'000, -15}, Number{0}},
+                 Number{true, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}},
+                 __LINE__},
+                {Number{1'000'000'000'000'000, -15},
+                 Number{1'000'000'000'000'000, -15},
+                 Number{0},
+                 __LINE__},
                 {Number{1'000'000'000'000'000, -15},
                  Number{1'000'000'000'000'001, -15},
-                 Number{-1'000'000'000'000'000, -30}},
+                 Number{-1'000'000'000'000'000, -30},
+                 __LINE__},
                 {Number{1'000'000'000'000'001, -15},
                  Number{1'000'000'000'000'000, -15},
-                 Number{1'000'000'000'000'000, -30}},
+                 Number{1'000'000'000'000'000, -30},
+                 __LINE__},
                 // Items from cSmall expanded for the larger mantissa
                 {Number{1'000'000'000'000'000'000, -18},
                  Number{6'555'555'555'555'555'555, -32},
-                 Number{false, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}}},
+                 Number{false, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}},
+                 __LINE__},
                 {Number{6'555'555'555'555'555'555, -32},
                  Number{1'000'000'000'000'000'000, -18},
-                 Number{true, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}}},
+                 Number{true, 9'999'999'999'999'344'444ULL, -19, Number::Normalized{}},
+                 __LINE__},
                 {Number{1'000'000'000'000'000'000, -18},
                  Number{1'000'000'000'000'000'000, -18},
-                 Number{0}},
+                 Number{0},
+                 __LINE__},
                 {Number{1'000'000'000'000'000'000, -18},
                  Number{1'000'000'000'000'000'001, -18},
-                 Number{-1'000'000'000'000'000'000, -36}},
+                 Number{-1'000'000'000'000'000'000, -36},
+                 __LINE__},
                 {Number{1'000'000'000'000'000'001, -18},
                  Number{1'000'000'000'000'000'000, -18},
-                 Number{1'000'000'000'000'000'000, -36}},
-                {Number{Number::kMaxRep}, Number{6, -1}, Number{Number::kMaxRep - 1}},
+                 Number{1'000'000'000'000'000'000, -36},
+                 __LINE__},
+                {Number{Number::kMaxRep}, Number{6, -1}, Number{Number::kMaxRep - 1}, __LINE__},
                 {Number{false, Number::kMaxRep + 1, 0, Number::Normalized{}},
                  Number{1, 0},
-                 Number{(Number::kMaxRep / 10) + 1, 1}},
+                 Number{(Number::kMaxRep / 10) + 1, 1},
+                 __LINE__},
                 {Number{false, Number::kMaxRep + 1, 0, Number::Normalized{}},
                  Number{3, 0},
-                 Number{Number::kMaxRep}},
-                {power(2, 63), Number{3, 0}, Number{Number::kMaxRep}},
+                 Number{Number::kMaxRep},
+                 __LINE__},
+                {power(2, 63), Number{3, 0}, Number{Number::kMaxRep}, __LINE__},
             });
         auto test = [](auto const& c) {
-            for (auto const& [x, y, z] : c)
+            for (auto const& [x, y, z, line] : c)
             {
                 auto const result = x - y;
                 std::stringstream ss;
                 ss << x << " - " << y << " = " << result << ". Expected: " << z;
-                EXPECT_EQ(result, z) << ss.str();
+                EXPECT_EQ(result, z) << ss.str() << " Line: " << line;
             }
         };
         if (scale == MantissaRange::MantissaScale::Small)
@@ -1365,8 +1426,7 @@ TEST(NumberTest, to_string)
                         "9223372036854775e3");
                 }
                 break;
-            case MantissaRange::MantissaScale::LargeLegacy:
-            case MantissaRange::MantissaScale::Large:
+            default:
                 // Test the edges
                 // ((exponent < -(28)) || (exponent > -(8)))))
                 test(Number::min(), "1e-32750");
@@ -1405,8 +1465,6 @@ TEST(NumberTest, to_string)
                     -(Number{std::numeric_limits<std::int64_t>::max(), 0} + 1),
                     "-9223372036854775810");
                 break;
-            default:
-                EXPECT_TRUE(false);
         }
     }
 }
@@ -1787,9 +1845,7 @@ TEST(NumberTest, upward_rounding_produces_value_not_below_exact_at_k_max_rep_cus
         BigInt const exactProduct = BigInt(kAValue) * BigInt(kBValue);
 
         // What Number actually stored.
-        BigInt storedValue = BigInt(product.mantissa());
-        for (int i = 0; i < product.exponent(); ++i)
-            storedValue *= 10;
+        BigInt const storedValue = toBigInt(product);
 
         BigInt const signedDifference = storedValue - exactProduct;
 
@@ -1809,7 +1865,8 @@ TEST(NumberTest, upward_rounding_produces_value_not_below_exact_at_k_max_rep_cus
 
         switch (scale)
         {
-            case MantissaRange::MantissaScale::Large:
+            case MantissaRange::MantissaScale::Large320:
+            case MantissaRange::MantissaScale::Large330:
                 EXPECT_TRUE(signedDifference >= 0) << message();
                 EXPECT_TRUE(signedDifference < pow10<BigInt>(product.exponent())) << message();
                 EXPECT_EQ(product.mantissa(), (std::numeric_limits<std::int64_t>::max() / 10) + 1);
@@ -1897,7 +1954,8 @@ TEST(NumberTest, upward_division_returns_value_not_below_exact_on_large_scale)
         // Upward invariant: stored >= exact. Bug: stored < exact.
         switch (scale)
         {
-            case MantissaRange::MantissaScale::Large:
+            case MantissaRange::MantissaScale::Large320:
+            case MantissaRange::MantissaScale::Large330:
                 EXPECT_TRUE(stored >= exact) << message();
                 EXPECT_TRUE(diff < pow10(quotient.exponent())) << message();
                 break;
@@ -1951,10 +2009,11 @@ TEST(NumberTest, downward_division_returns_value_not_above_exact_on_large_scale)
             return os.str();
         };
 
-        // Downward invariant: stored <= exact. Bug: stored > exact.
+        // invariant: stored <= exact. Bug: stored > exact.
         switch (scale)
         {
-            case MantissaRange::MantissaScale::Large:
+            case MantissaRange::MantissaScale::Large320:
+            case MantissaRange::MantissaScale::Large330:
                 EXPECT_TRUE(stored <= exact) << message();
                 EXPECT_TRUE(diff > -pow10(quotient.exponent())) << message();
                 break;
@@ -2018,10 +2077,11 @@ TEST(NumberTest, to_nearest_division_uses_dropped_digits_on_large_scale)
             return os.str();
         };
 
-        // ToNearest should account for dropped digits beyond the visible "5".
+        // invariant: stored >= exact. Bug: stored < exact.
         switch (scale)
         {
-            case MantissaRange::MantissaScale::Large:
+            case MantissaRange::MantissaScale::Large320:
+            case MantissaRange::MantissaScale::Large330:
                 EXPECT_TRUE(stored >= exact) << message();
                 EXPECT_TRUE(diff < pow10(quotient.exponent())) << message();
                 break;
@@ -2039,4 +2099,365 @@ TEST(NumberTest, to_nearest_division_uses_dropped_digits_on_large_scale)
     }
 }
 
+TEST(NumberTest, subtraction_rounding)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
+    {
+        NumberMantissaScaleGuard const mg{mantissaScale};
+        NumberRoundModeGuard const rg{Number::RoundingMode::ToNearest};
+
+        auto const scale = Number::getMantissaScale();
+
+        auto const exp = Number::mantissaLog();
+        // SubCase is <offset, extraB, aString, bString>
+        //  * offset: offset from exp
+        //  * extraB: whether to include 1e"exp" in "b"
+        //  * aString: expected string value for "a"
+        //  * bString: expected string value for "b"
+        // There aren't too many valid combinations for test cases here. If extraB is true,
+        // offset can really only be 2, because any larger and the mantissa can't be represented
+        // without loss. Offset can't be less than 2, or there's no error.
+        using SubCase = std::tuple<int, bool, std::string, std::string>;
+        auto const c = std::to_array<SubCase>({
+            {2,
+             true,
+             scale == MantissaRange::MantissaScale::Small ? "100000000000000000"
+                                                          : "100000000000000000000",
+             scale == MantissaRange::MantissaScale::Small ? "-1000000000000001"
+                                                          : "-1000000000000000001"},
+            {2,
+             false,
+             scale == MantissaRange::MantissaScale::Small ? "100000000000000000"
+                                                          : "100000000000000000000",
+             "-1"},
+            {30,
+             false,
+             scale == MantissaRange::MantissaScale::Small
+                 ? "1000000000000000000000000000000000000000000000"
+                 : "1000000000000000000000000000000000000000000000000",
+             "-1"},
+        });
+
+        for (auto const& [offset, extraB, aString, bString] : c)
+        {
+            Number const a{1LL, exp + offset};
+            Number const b{-((extraB ? Number{1, exp} : kNumZero) + 1)};
+
+            auto const bigA = toBigInt(a);
+            auto const bigB = toBigInt(b);
+
+            EXPECT_EQ(bigA, BigInt{aString});
+            EXPECT_EQ(bigB, BigInt{bString});
+
+            auto construct = [&a, &b](Number::RoundingMode r) {
+                NumberRoundModeGuard const roundGuard{r};
+                auto const sum = a + b;
+                BigInt const stored = toBigInt(sum);
+                return std::make_pair(r, std::make_pair(stored, sum));
+            };
+
+            BigInt const exact = bigA + bigB;
+
+            auto const sums = [&]() {
+                std::map<Number::RoundingMode, std::pair<BigInt, Number>> r;
+                r.emplace(construct(Number::RoundingMode::TowardsZero));
+                r.emplace(construct(Number::RoundingMode::Upward));
+                r.emplace(construct(Number::RoundingMode::Downward));
+                r.emplace(construct(Number::RoundingMode::ToNearest));
+                return r;
+            }();
+
+            auto const message = [&](auto const& r, auto const& sum) {
+                std::ostringstream os;
+                os << "\n              a = " << a << " (" << fmt(bigA)
+                   << ")\n              b = " << b << " (" << fmt(bigB)
+                   << ")\n    exact a + b = " << fmt(exact) << "\n";
+
+                auto const diff = sum.first - exact;
+                auto const rLabel = to_string(r);
+                os << std::string(15 - rLabel.length(), ' ') << rLabel << " = " << fmt(sum.first)
+                   << "\n     difference = " << fmt(diff) << "\n";
+
+                return os.str();
+            };
+
+            auto const expectedExponent =
+                offset - (scale == MantissaRange::MantissaScale::Small && extraB ? 1 : 0);
+            auto const epsilon = pow10<BigInt>(expectedExponent);
+            for (auto const& [r, sum] : sums)
+            {
+                auto diff = sum.first - exact;
+                switch (scale)
+                {
+                    case MantissaRange::MantissaScale::Small:
+                    case MantissaRange::MantissaScale::LargeLegacy:
+                    case MantissaRange::MantissaScale::Large320: {
+                        // Without the fix, all the results but one round up
+                        if (r == Number::RoundingMode::Downward)
+                        {
+                            // Downward works because the Guard sign is negative, and Downward
+                            // returns Up instead of Down if negative and there's a remainder,
+                            // whereas TowardsZero always returns Down.
+                            EXPECT_LT(sum.first, exact) << message(r, sum);
+                            EXPECT_EQ(diff, -(epsilon - 1)) << message(r, sum);
+                        }
+                        else
+                        {
+                            EXPECT_GT(sum.first, exact) << message(r, sum);
+                            EXPECT_EQ(diff, 1) << message(r, sum);
+                        }
+                        break;
+                    }
+                    default: {
+                        EXPECT_LE(sum.second.exponent(), expectedExponent) << message(r, sum);
+                        switch (r)
+                        {
+                            case Number::RoundingMode::Upward:
+                            case Number::RoundingMode::ToNearest:
+                                EXPECT_GT(sum.first, exact) << message(r, sum);
+                                EXPECT_EQ(diff, 1) << message(r, sum);
+                                break;
+                            default:
+                                EXPECT_LT(sum.first, exact) << message(r, sum);
+                                EXPECT_EQ(diff, -(epsilon - 1)) << message(r, sum);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+TEST(NumberTest, number_add_directed_sign_wrong)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
+    {
+        NumberMantissaScaleGuard const mg{mantissaScale};
+        NumberRoundModeGuard const rg{Number::RoundingMode::ToNearest};
+
+        auto const scale = Number::getMantissaScale();
+        {
+            // Two negative numbers with the same exponent
+            Number const a{-6, Number::mantissaLog()};
+            Number const b{a - 3};
+            EXPECT_TRUE(a.exponent() == b.exponent() && abs(b) > abs(a));
+
+            BigInt const exact = toBigInt(a) + toBigInt(b);
+            if (scale == MantissaRange::MantissaScale::Small)
+            {
+                EXPECT_EQ(exact, BigInt{"-12000000000000003"});
+            }
+            else
+            {
+                EXPECT_EQ(exact, BigInt{"-12000000000000000003"});
+            }
+
+            Number down, up;
+            {
+                NumberRoundModeGuard const g{Number::RoundingMode::Downward};
+                down = a + b;
+            }
+            {
+                NumberRoundModeGuard const g{Number::RoundingMode::Upward};
+                up = a + b;
+            }
+
+            auto const valueDown = toBigInt(down);
+            auto const valueUp = toBigInt(up);
+            auto message = [&] {
+                std::ostringstream log;
+                log << "    exact    = " << fmt(exact) << "\n    downward = " << fmt(valueDown)
+                    << "   (correct rounding: <= exact)"
+                    << "\n    upward   = " << fmt(valueUp) << "   (correct rounding: >= exact)\n\n";
+                return log.str();
+            };
+
+            if (scale == MantissaRange::MantissaScale::Large330)
+            {
+                EXPECT_LE(valueDown, exact) << message();  // Downward should round away from zero
+                EXPECT_GE(valueUp, exact) << message();    // Upward should round toward 0
+            }
+            else
+            {
+                EXPECT_GT(valueDown, exact)
+                    << message();                        // Downward rounded toward zero (too high)
+                EXPECT_LT(valueUp, exact) << message();  // Upward rounded toward -inf (too low)
+            }
+        }
+
+        {
+            // Positive control: the same magnitudes with a positive result round
+            Number const pa{6, Number::mantissaLog()};
+            Number const pb{pa + 3};
+            EXPECT_TRUE(pa.exponent() == pb.exponent() && abs(pb) > abs(pa));
+            BigInt const pexact = toBigInt(pa) + toBigInt(pb);  // 12'000'000'000'000'000'003
+
+            Number pdown, pup;
+            {
+                NumberRoundModeGuard const g{Number::RoundingMode::Downward};
+                pdown = pa + pb;
+            }
+            {
+                NumberRoundModeGuard const g{Number::RoundingMode::Upward};
+                pup = pa + pb;
+            }
+            auto const valuePDown = toBigInt(pdown);
+            auto const valuePUp = toBigInt(pup);
+            auto message = [&] {
+                std::ostringstream log;
+                log << "    exact    = " << fmt(pexact) << "\n    downward = " << fmt(valuePDown)
+                    << "   (correct rounding: <= exact)"
+                    << "\n    upward   = " << fmt(valuePUp)
+                    << "   (correct rounding: >= exact)\n\n";
+                return log.str();
+            };
+
+            EXPECT_LE(valuePDown, pexact) << message();  // correct for positive results
+            EXPECT_GE(valuePUp, pexact) << message();
+        }
+
+        {
+            // Mixed sign numbers with the same exponent: negative second value
+            Number const a{1, Number::mantissaLog()};
+            Number const b{Number{-9, Number::mantissaLog()} - 3};
+            EXPECT_TRUE(a.exponent() == b.exponent() && abs(b) > abs(a));
+
+            BigInt const exact = toBigInt(a) + toBigInt(b);
+            if (scale == MantissaRange::MantissaScale::Small)
+            {
+                EXPECT_EQ(exact, BigInt{"-8000000000000003"});
+            }
+            else
+            {
+                EXPECT_EQ(exact, BigInt{"-8000000000000000003"});
+            }
+
+            Number down, up;
+            {
+                NumberRoundModeGuard const g{Number::RoundingMode::Downward};
+                down = a + b;
+            }
+            {
+                NumberRoundModeGuard const g{Number::RoundingMode::Upward};
+                up = a + b;
+            }
+
+            auto const valueDown = toBigInt(down);
+            auto const valueUp = toBigInt(up);
+            auto message = [&] {
+                std::ostringstream log;
+                log << "    exact    = " << fmt(exact) << "\n    downward = " << fmt(valueDown)
+                    << "   (correct rounding: <= exact)"
+                    << "\n    upward   = " << fmt(valueUp) << "   (correct rounding: >= exact)\n\n";
+                return log.str();
+            };
+
+            EXPECT_LE(valueDown, exact) << message();  // Downward should round away from zero
+            EXPECT_GE(valueUp, exact) << message();    // Upward should round toward 0
+        }
+
+        {
+            // Mixed sign numbers with the same exponent: negative first value
+            Number const a{-1, Number::mantissaLog()};
+            Number const b{Number{9, Number::mantissaLog()} + 3};
+            EXPECT_TRUE(a.exponent() == b.exponent() && abs(b) > abs(a));
+
+            BigInt const exact = toBigInt(a) + toBigInt(b);
+            if (scale == MantissaRange::MantissaScale::Small)
+            {
+                EXPECT_EQ(exact, BigInt{"8000000000000003"});
+            }
+            else
+            {
+                EXPECT_EQ(exact, BigInt{"8000000000000000003"});
+            }
+
+            Number down, up;
+            {
+                NumberRoundModeGuard const g{Number::RoundingMode::Downward};
+                down = a + b;
+            }
+            {
+                NumberRoundModeGuard const g{Number::RoundingMode::Upward};
+                up = a + b;
+            }
+
+            auto const valueDown = toBigInt(down);
+            auto const valueUp = toBigInt(up);
+            auto message = [&] {
+                std::ostringstream log;
+                log << "    exact    = " << fmt(exact) << "\n    downward = " << fmt(valueDown)
+                    << "   (correct rounding: <= exact)"
+                    << "\n    upward   = " << fmt(valueUp) << "   (correct rounding: >= exact)\n\n";
+                return log.str();
+            };
+
+            EXPECT_LE(valueDown, exact) << message();  // Downward should round away from zero
+            EXPECT_GE(valueUp, exact) << message();    // Upward should round toward 0
+        }
+    }
+}
+
+TEST(NumberTest, number_add_to_nearest_picks_farther)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
+    {
+        NumberMantissaScaleGuard const mg{mantissaScale};
+        NumberRoundModeGuard const rg{Number::RoundingMode::ToNearest};
+
+        auto const scale = Number::getMantissaScale();
+
+        // Case is <y, expected q>
+        using Case = std::pair<Number, std::int64_t>;
+
+        auto const c = std::to_array<Case>({
+            {Number{5'175'909'259'972'499'745LL, 22}, -1'074'951'375'311'646'003},
+            {Number{1}, -1'074'956'551'220'905'975},
+            {Number{1, 10}, -1'074'956'551'220'905'975},
+            {Number{1, 20}, -1'074'956'551'220'905'975},
+            {Number{1, 27}, -1'074'956'551'220'905'975},
+            {Number{1, 28}, -1'074'956'551'220'905'974},
+            {Number{1, 31}, -1'074'956'551'220'904'975},
+        });
+
+        for (auto const& [y, expectedQ] : c)
+        {
+            Number const x{-1'074'956'551'220'905'975LL, 28};
+            Number const res = x + y;
+
+            BigInt const exact = toBigInt(x) + toBigInt(y);
+            BigInt const vres = toBigInt(res);
+
+            BigInt ulp = 1;
+            for (int i = 0; i < res.exponent(); ++i)
+                ulp *= 10;
+
+            BigInt const q = (exact - ulp / 2) / ulp;
+            Number const normalizedExact{static_cast<std::int64_t>(q), res.exponent()};
+            BigInt const norm = toBigInt(normalizedExact);
+
+            auto message = [&](auto const& comp) {
+                std::ostringstream log;
+                log << fmt(q) + " != " + fmt(comp) << "\n"
+                    << "    x                = " << x << "\n    y                = " << y
+                    << "\n    exact            = " << fmt(exact)
+                    << "\n    result (x + y)   = " << fmt(vres)
+                    << "\n    normalize(exact) = " << fmt(norm) << "\n\n";
+                return log.str();
+            };
+
+            if (scale == MantissaRange::MantissaScale::Small)
+            {
+                auto const comp = toBigInt(Number{expectedQ, -3});
+                EXPECT_EQ(q, comp) << message(comp);
+            }
+            else
+            {
+                EXPECT_EQ(q, expectedQ) << message(BigInt(expectedQ));
+            }
+            EXPECT_EQ(normalizedExact, res);
+        }
+    }
+}
+
 }  // namespace xrpl

From 73b6852a122854140336e6e6bc30a3a4b41aa5fd Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:40:40 +0100
Subject: [PATCH 060/100] style: Unify style for all Doxygen comments (#7776)

---
 .../codegen/templates/LedgerEntry.h.mako      |   4 +-
 .../codegen/templates/Transaction.h.mako      |   4 +-
 include/xrpl/basics/Archive.h                 |  15 +-
 include/xrpl/basics/Blob.h                    |   7 +-
 include/xrpl/basics/Buffer.h                  |  81 +-
 include/xrpl/basics/CompressionAlgorithms.h   |   6 +-
 include/xrpl/basics/CountedObject.h           |  28 +-
 include/xrpl/basics/DecayingSample.h          |  32 +-
 include/xrpl/basics/IntrusivePointer.h        | 302 +++---
 include/xrpl/basics/IntrusiveRefCounts.h      | 210 ++--
 include/xrpl/basics/LocalValue.h              |   8 +-
 include/xrpl/basics/Log.h                     | 114 ++-
 include/xrpl/basics/MathUtilities.h           |   5 +-
 include/xrpl/basics/Number.h                  |  42 +-
 include/xrpl/basics/RangeSet.h                | 123 +--
 include/xrpl/basics/Resolver.h                |  21 +-
 include/xrpl/basics/SharedWeakCachePointer.h  |  75 +-
 include/xrpl/basics/SlabAllocator.h           |  98 +-
 include/xrpl/basics/Slice.h                   |  80 +-
 include/xrpl/basics/StringUtilities.h         |  30 +-
 include/xrpl/basics/TaggedCache.h             | 176 ++--
 include/xrpl/basics/ToString.h                |   9 +-
 include/xrpl/basics/UptimeClock.h             |  13 +-
 include/xrpl/basics/base_uint.h               |  62 +-
 include/xrpl/basics/chrono.h                  |  36 +-
 include/xrpl/basics/contract.h                |  29 +-
 include/xrpl/basics/hardened_hash.h           |  54 +-
 include/xrpl/basics/make_SSLContext.h         |   8 +-
 include/xrpl/basics/mulDiv.h                  |  20 +-
 include/xrpl/basics/random.h                  |  68 +-
 include/xrpl/basics/scope.h                   |  70 +-
 include/xrpl/basics/spinlock.h                | 130 +--
 include/xrpl/basics/tagged_integer.h          |  23 +-
 include/xrpl/beast/asio/io_latency_probe.h    |  33 +-
 include/xrpl/beast/clock/abstract_clock.h     |  72 +-
 .../xrpl/beast/clock/basic_seconds_clock.h    |  19 +-
 include/xrpl/beast/clock/manual_clock.h       |  35 +-
 .../beast/container/aged_container_utility.h  |   4 +-
 .../container/detail/aged_ordered_container.h |  37 +-
 .../detail/aged_unordered_container.h         |  39 +-
 include/xrpl/beast/core/CurrentThreadName.h   |  39 +-
 include/xrpl/beast/core/LexicalCast.h         |  38 +-
 include/xrpl/beast/core/List.h                | 428 ++++----
 include/xrpl/beast/core/LockFreeStack.h       |  84 +-
 include/xrpl/beast/core/SemanticVersion.h     |  35 +-
 include/xrpl/beast/hash/hash_append.h         |  74 +-
 include/xrpl/beast/insight/Collector.h        |  74 +-
 include/xrpl/beast/insight/Counter.h          |  39 +-
 include/xrpl/beast/insight/Event.h            |  41 +-
 include/xrpl/beast/insight/Gauge.h            |  52 +-
 include/xrpl/beast/insight/Group.h            |   8 +-
 include/xrpl/beast/insight/Groups.h           |  12 +-
 include/xrpl/beast/insight/Hook.h             |  22 +-
 include/xrpl/beast/insight/Meter.h            |  37 +-
 include/xrpl/beast/insight/NullCollector.h    |   4 +-
 include/xrpl/beast/insight/StatsDCollector.h  |  20 +-
 include/xrpl/beast/net/IPAddress.h            |  24 +-
 include/xrpl/beast/net/IPAddressConversion.h  |  22 +-
 include/xrpl/beast/net/IPAddressV4.h          |  15 +-
 include/xrpl/beast/net/IPAddressV6.h          |   8 +-
 include/xrpl/beast/net/IPEndpoint.h           |  85 +-
 include/xrpl/beast/rfc2616.h                  |  69 +-
 include/xrpl/beast/test/yield_to.h            |  44 +-
 include/xrpl/beast/unit_test/amount.h         |   4 +-
 .../beast/unit_test/detail/const_container.h  |  21 +-
 include/xrpl/beast/unit_test/global_suites.h  |   8 +-
 include/xrpl/beast/unit_test/match.h          |  42 +-
 include/xrpl/beast/unit_test/recorder.h       |   8 +-
 include/xrpl/beast/unit_test/reporter.h       |   7 +-
 include/xrpl/beast/unit_test/results.h        |  80 +-
 include/xrpl/beast/unit_test/runner.h         | 115 ++-
 include/xrpl/beast/unit_test/suite.h          | 225 +++--
 include/xrpl/beast/unit_test/suite_info.h     |  20 +-
 include/xrpl/beast/unit_test/suite_list.h     |  13 +-
 include/xrpl/beast/unit_test/thread.h         |   4 +-
 include/xrpl/beast/utility/Journal.h          | 136 ++-
 include/xrpl/beast/utility/PropertyStream.h   |  88 +-
 include/xrpl/beast/utility/WrappedSink.h      |   4 +-
 include/xrpl/beast/utility/Zero.h             |  37 +-
 include/xrpl/beast/utility/maybe_const.h      |   8 +-
 include/xrpl/beast/utility/temp_dir.h         |  32 +-
 include/xrpl/beast/xor_shift_engine.h         |  17 +-
 include/xrpl/conditions/Condition.h           |  55 +-
 include/xrpl/conditions/Fulfillment.h         | 137 +--
 .../xrpl/conditions/detail/PreimageSha256.h   |  32 +-
 include/xrpl/config/BasicConfig.h             | 144 +--
 include/xrpl/core/ClosureCounter.h            |  51 +-
 include/xrpl/core/Coro.ipp                    |   6 +-
 include/xrpl/core/HashRouter.h                |  90 +-
 include/xrpl/core/Job.h                       |  17 +-
 include/xrpl/core/JobQueue.h                  | 157 +--
 include/xrpl/core/JobTypeInfo.h               |  17 +-
 include/xrpl/core/NetworkIDService.h          |  30 +-
 include/xrpl/core/PeerReservationTable.h      |   2 +-
 include/xrpl/core/ServiceRegistry.h           |  26 +-
 include/xrpl/core/detail/Workers.h            | 107 +-
 include/xrpl/core/detail/semaphore.h          |  22 +-
 include/xrpl/crypto/RFC1751.h                 |  15 +-
 include/xrpl/crypto/csprng.h                  |  46 +-
 include/xrpl/crypto/secure_erase.h            |  29 +-
 include/xrpl/json/JsonPropertyStream.h        |   4 +-
 include/xrpl/json/Output.h                    |  18 +-
 include/xrpl/json/Writer.h                    | 184 ++--
 include/xrpl/json/json_reader.h               |  94 +-
 include/xrpl/json/json_value.h                | 255 +++--
 include/xrpl/json/json_writer.h               |  99 +-
 include/xrpl/json/to_string.h                 |   8 +-
 include/xrpl/ledger/AcceptedLedgerTx.h        |  22 +-
 include/xrpl/ledger/AmendmentTable.h          |  24 +-
 include/xrpl/ledger/ApplyView.h               | 377 +++----
 include/xrpl/ledger/ApplyViewImpl.h           |  47 +-
 include/xrpl/ledger/CachedView.h              |  18 +-
 include/xrpl/ledger/CanonicalTXSet.h          |  14 +-
 include/xrpl/ledger/Dir.h                     |  25 +-
 include/xrpl/ledger/Ledger.h                  | 132 +--
 include/xrpl/ledger/LedgerTiming.h            | 108 +-
 include/xrpl/ledger/OpenView.h                | 141 +--
 include/xrpl/ledger/OrderBookDB.h             | 119 +--
 include/xrpl/ledger/PaymentSandbox.h          |  59 +-
 include/xrpl/ledger/PendingSaves.h            |  73 +-
 include/xrpl/ledger/RawView.h                 |  99 +-
 include/xrpl/ledger/ReadView.h                | 152 +--
 include/xrpl/ledger/Sandbox.h                 |  13 +-
 include/xrpl/ledger/View.h                    | 124 +--
 include/xrpl/ledger/helpers/AMMHelpers.h      | 104 +-
 .../xrpl/ledger/helpers/AccountRootHelpers.h  | 336 ++++---
 .../xrpl/ledger/helpers/DirectoryHelpers.h    |  99 +-
 include/xrpl/ledger/helpers/LendingHelpers.h  |  24 +-
 include/xrpl/ledger/helpers/MPTokenHelpers.h  | 115 ++-
 include/xrpl/ledger/helpers/NFTokenHelpers.h  |  60 +-
 include/xrpl/ledger/helpers/OfferHelpers.h    |  25 +-
 .../ledger/helpers/PaymentChannelHelpers.h    |  43 +-
 .../xrpl/ledger/helpers/RippleStateHelpers.h  |  55 +-
 include/xrpl/ledger/helpers/SponsorHelpers.h  | 170 ++--
 include/xrpl/ledger/helpers/TokenHelpers.h    |  43 +-
 include/xrpl/ledger/helpers/VaultHelpers.h    | 132 +--
 include/xrpl/net/HTTPClient.h                 |  16 +-
 include/xrpl/net/RegisterSSLCerts.h           |  15 +-
 include/xrpl/nodestore/Backend.h              | 143 +--
 include/xrpl/nodestore/Database.h             | 197 ++--
 include/xrpl/nodestore/DatabaseRotating.h     |  15 +-
 include/xrpl/nodestore/DummyScheduler.h       |   4 +-
 include/xrpl/nodestore/Factory.h              |  44 +-
 include/xrpl/nodestore/Manager.h              |  86 +-
 include/xrpl/nodestore/NodeObject.h           |  58 +-
 include/xrpl/nodestore/Scheduler.h            |  50 +-
 include/xrpl/nodestore/Task.h                 |  11 +-
 include/xrpl/nodestore/Types.h                |   8 +-
 include/xrpl/nodestore/detail/BatchWriter.h   |  49 +-
 include/xrpl/nodestore/detail/DecodedBlob.h   |  33 +-
 include/xrpl/nodestore/detail/EncodedBlob.h   |  65 +-
 include/xrpl/protocol/AMMCore.h               |  24 +-
 include/xrpl/protocol/AccountID.h             |  69 +-
 include/xrpl/protocol/Asset.h                 |   6 +-
 include/xrpl/protocol/Book.h                  |  17 +-
 include/xrpl/protocol/BuildInfo.h             | 109 ++-
 include/xrpl/protocol/ConfidentialTransfer.h  |  12 +-
 include/xrpl/protocol/ErrorCodes.h            |  41 +-
 include/xrpl/protocol/Feature.h               |  30 +-
 include/xrpl/protocol/Fees.h                  |  34 +-
 include/xrpl/protocol/HashPrefix.h            |  77 +-
 include/xrpl/protocol/IOUAmount.h             |  42 +-
 include/xrpl/protocol/Indexes.h               | 193 ++--
 include/xrpl/protocol/InnerObjectFormats.h    |  10 +-
 include/xrpl/protocol/Issue.h                 |  23 +-
 include/xrpl/protocol/Keylet.h                |  21 +-
 include/xrpl/protocol/KnownFormats.h          |  82 +-
 include/xrpl/protocol/LedgerFormats.h         | 147 +--
 include/xrpl/protocol/LedgerHeader.h          |  16 +-
 include/xrpl/protocol/LedgerShortcut.h        |  12 +-
 include/xrpl/protocol/MPTAmount.h             |  34 +-
 include/xrpl/protocol/MPTIssue.h              |   3 +-
 .../xrpl/protocol/NFTSyntheticSerializer.h    |   5 +-
 include/xrpl/protocol/NFTokenID.h             |  12 +-
 include/xrpl/protocol/NFTokenOfferID.h        |  10 +-
 include/xrpl/protocol/Protocol.h              | 347 ++++---
 include/xrpl/protocol/PublicKey.h             | 138 +--
 include/xrpl/protocol/Quality.h               | 105 +-
 include/xrpl/protocol/QualityFunction.h       |  12 +-
 include/xrpl/protocol/Rate.h                  |  21 +-
 include/xrpl/protocol/Rules.h                 |  37 +-
 include/xrpl/protocol/SField.h                |  29 +-
 include/xrpl/protocol/SOTemplate.h            |  43 +-
 include/xrpl/protocol/STAmount.h              |  21 +-
 include/xrpl/protocol/STBase.h                |  52 +-
 include/xrpl/protocol/STExchange.h            |  24 +-
 include/xrpl/protocol/STLedgerEntry.h         |  22 +-
 include/xrpl/protocol/STObject.h              | 172 ++--
 include/xrpl/protocol/STParsedJSON.h          |  41 +-
 include/xrpl/protocol/STTakesAsset.h          |   7 +-
 include/xrpl/protocol/STTx.h                  |  58 +-
 include/xrpl/protocol/STValidation.h          |  61 +-
 include/xrpl/protocol/STVector256.h           |   8 +-
 include/xrpl/protocol/SecretKey.h             |  72 +-
 include/xrpl/protocol/Seed.h                  |  65 +-
 include/xrpl/protocol/SeqProxy.h              |  59 +-
 include/xrpl/protocol/Sign.h                  |  69 +-
 include/xrpl/protocol/SystemParameters.h      |  40 +-
 include/xrpl/protocol/TxFlags.h               |  47 +-
 include/xrpl/protocol/TxFormats.h             |  84 +-
 include/xrpl/protocol/TxMeta.h                |   4 +-
 include/xrpl/protocol/UintTypes.h             |  70 +-
 include/xrpl/protocol/Units.h                 |  68 +-
 include/xrpl/protocol/XRPAmount.h             |  25 +-
 include/xrpl/protocol/detail/STVar.h          |   3 +-
 include/xrpl/protocol/digest.h                | 103 +-
 include/xrpl/protocol/serialize.h             |   8 +-
 include/xrpl/protocol/tokens.h                |  23 +-
 .../xrpl/protocol_autogen/LedgerEntryBase.h   |   4 +-
 .../xrpl/protocol_autogen/TransactionBase.h   |   4 +-
 .../protocol_autogen/ledger_entries/AMM.h     |   4 +-
 .../ledger_entries/AccountRoot.h              |   4 +-
 .../ledger_entries/Amendments.h               |   4 +-
 .../protocol_autogen/ledger_entries/Bridge.h  |   4 +-
 .../protocol_autogen/ledger_entries/Check.h   |   4 +-
 .../ledger_entries/Credential.h               |   4 +-
 .../protocol_autogen/ledger_entries/DID.h     |   4 +-
 .../ledger_entries/Delegate.h                 |   4 +-
 .../ledger_entries/DepositPreauth.h           |   4 +-
 .../ledger_entries/DirectoryNode.h            |   4 +-
 .../protocol_autogen/ledger_entries/Escrow.h  |   4 +-
 .../ledger_entries/FeeSettings.h              |   4 +-
 .../ledger_entries/LedgerHashes.h             |   4 +-
 .../protocol_autogen/ledger_entries/Loan.h    |   4 +-
 .../ledger_entries/LoanBroker.h               |   4 +-
 .../protocol_autogen/ledger_entries/MPToken.h |   4 +-
 .../ledger_entries/MPTokenIssuance.h          |   4 +-
 .../ledger_entries/NFTokenOffer.h             |   4 +-
 .../ledger_entries/NFTokenPage.h              |   4 +-
 .../ledger_entries/NegativeUNL.h              |   4 +-
 .../protocol_autogen/ledger_entries/Offer.h   |   4 +-
 .../protocol_autogen/ledger_entries/Oracle.h  |   4 +-
 .../ledger_entries/PayChannel.h               |   4 +-
 .../ledger_entries/PermissionedDomain.h       |   4 +-
 .../ledger_entries/RippleState.h              |   4 +-
 .../ledger_entries/SignerList.h               |   4 +-
 .../ledger_entries/Sponsorship.h              |   4 +-
 .../protocol_autogen/ledger_entries/Ticket.h  |   4 +-
 .../protocol_autogen/ledger_entries/Vault.h   |   4 +-
 .../ledger_entries/XChainOwnedClaimID.h       |   4 +-
 .../XChainOwnedCreateAccountClaimID.h         |   4 +-
 .../protocol_autogen/transactions/AMMBid.h    |   4 +-
 .../transactions/AMMClawback.h                |   4 +-
 .../protocol_autogen/transactions/AMMCreate.h |   4 +-
 .../protocol_autogen/transactions/AMMDelete.h |   4 +-
 .../transactions/AMMDeposit.h                 |   4 +-
 .../protocol_autogen/transactions/AMMVote.h   |   4 +-
 .../transactions/AMMWithdraw.h                |   4 +-
 .../transactions/AccountDelete.h              |   4 +-
 .../transactions/AccountSet.h                 |   4 +-
 .../protocol_autogen/transactions/Batch.h     |   4 +-
 .../transactions/CheckCancel.h                |   4 +-
 .../protocol_autogen/transactions/CheckCash.h |   4 +-
 .../transactions/CheckCreate.h                |   4 +-
 .../protocol_autogen/transactions/Clawback.h  |   4 +-
 .../transactions/ConfidentialMPTClawback.h    |   4 +-
 .../transactions/ConfidentialMPTConvert.h     |   4 +-
 .../transactions/ConfidentialMPTConvertBack.h |   4 +-
 .../transactions/ConfidentialMPTMergeInbox.h  |   4 +-
 .../transactions/ConfidentialMPTSend.h        |   4 +-
 .../transactions/CredentialAccept.h           |   4 +-
 .../transactions/CredentialCreate.h           |   4 +-
 .../transactions/CredentialDelete.h           |   4 +-
 .../protocol_autogen/transactions/DIDDelete.h |   4 +-
 .../protocol_autogen/transactions/DIDSet.h    |   4 +-
 .../transactions/DelegateSet.h                |   4 +-
 .../transactions/DepositPreauth.h             |   4 +-
 .../transactions/EnableAmendment.h            |   4 +-
 .../transactions/EscrowCancel.h               |   4 +-
 .../transactions/EscrowCreate.h               |   4 +-
 .../transactions/EscrowFinish.h               |   4 +-
 .../transactions/LedgerStateFix.h             |   4 +-
 .../transactions/LoanBrokerCoverClawback.h    |   4 +-
 .../transactions/LoanBrokerCoverDeposit.h     |   4 +-
 .../transactions/LoanBrokerCoverWithdraw.h    |   4 +-
 .../transactions/LoanBrokerDelete.h           |   4 +-
 .../transactions/LoanBrokerSet.h              |   4 +-
 .../transactions/LoanDelete.h                 |   4 +-
 .../transactions/LoanManage.h                 |   4 +-
 .../protocol_autogen/transactions/LoanPay.h   |   4 +-
 .../protocol_autogen/transactions/LoanSet.h   |   4 +-
 .../transactions/MPTokenAuthorize.h           |   4 +-
 .../transactions/MPTokenIssuanceCreate.h      |   4 +-
 .../transactions/MPTokenIssuanceDestroy.h     |   4 +-
 .../transactions/MPTokenIssuanceSet.h         |   4 +-
 .../transactions/NFTokenAcceptOffer.h         |   4 +-
 .../transactions/NFTokenBurn.h                |   4 +-
 .../transactions/NFTokenCancelOffer.h         |   4 +-
 .../transactions/NFTokenCreateOffer.h         |   4 +-
 .../transactions/NFTokenMint.h                |   4 +-
 .../transactions/NFTokenModify.h              |   4 +-
 .../transactions/OfferCancel.h                |   4 +-
 .../transactions/OfferCreate.h                |   4 +-
 .../transactions/OracleDelete.h               |   4 +-
 .../protocol_autogen/transactions/OracleSet.h |   4 +-
 .../protocol_autogen/transactions/Payment.h   |   4 +-
 .../transactions/PaymentChannelClaim.h        |   4 +-
 .../transactions/PaymentChannelCreate.h       |   4 +-
 .../transactions/PaymentChannelFund.h         |   4 +-
 .../transactions/PermissionedDomainDelete.h   |   4 +-
 .../transactions/PermissionedDomainSet.h      |   4 +-
 .../protocol_autogen/transactions/SetFee.h    |   4 +-
 .../transactions/SetRegularKey.h              |   4 +-
 .../transactions/SignerListSet.h              |   4 +-
 .../transactions/SponsorshipSet.h             |   4 +-
 .../transactions/SponsorshipTransfer.h        |   4 +-
 .../transactions/TicketCreate.h               |   4 +-
 .../protocol_autogen/transactions/TrustSet.h  |   4 +-
 .../protocol_autogen/transactions/UNLModify.h |   4 +-
 .../transactions/VaultClawback.h              |   4 +-
 .../transactions/VaultCreate.h                |   4 +-
 .../transactions/VaultDelete.h                |   4 +-
 .../transactions/VaultDeposit.h               |   4 +-
 .../protocol_autogen/transactions/VaultSet.h  |   4 +-
 .../transactions/VaultWithdraw.h              |   4 +-
 .../transactions/XChainAccountCreateCommit.h  |   4 +-
 .../XChainAddAccountCreateAttestation.h       |   4 +-
 .../transactions/XChainAddClaimAttestation.h  |   4 +-
 .../transactions/XChainClaim.h                |   4 +-
 .../transactions/XChainCommit.h               |   4 +-
 .../transactions/XChainCreateBridge.h         |   4 +-
 .../transactions/XChainCreateClaimID.h        |   4 +-
 .../transactions/XChainModifyBridge.h         |   4 +-
 include/xrpl/rdb/RelationalDatabase.h         |   6 +-
 include/xrpl/rdb/SociDB.h                     |  64 +-
 include/xrpl/resource/Charge.h                |  24 +-
 include/xrpl/resource/Consumer.h              |  47 +-
 include/xrpl/resource/Disposition.h           |  16 +-
 include/xrpl/resource/Fees.h                  |   4 +-
 include/xrpl/resource/Gossip.h                |   8 +-
 include/xrpl/resource/ResourceManager.h       |  33 +-
 include/xrpl/resource/detail/Entry.h          |   4 +-
 include/xrpl/resource/detail/Import.h         |   4 +-
 include/xrpl/resource/detail/Logic.h          |   4 +-
 include/xrpl/resource/detail/Tuning.h         |   4 +-
 include/xrpl/server/Handoff.h                 |   4 +-
 include/xrpl/server/InfoSub.h                 |  59 +-
 include/xrpl/server/LoadFeeTrack.h            |  19 +-
 include/xrpl/server/Manifest.h                | 353 ++++---
 include/xrpl/server/NetworkOPs.h              |  82 +-
 include/xrpl/server/Port.h                    |   4 +-
 include/xrpl/server/Server.h                  |   4 +-
 include/xrpl/server/Session.h                 |  79 +-
 include/xrpl/server/SimpleWriter.h            |   4 +-
 include/xrpl/server/WSSession.h               |  48 +-
 include/xrpl/server/Wallet.h                  |  23 +-
 include/xrpl/server/Writer.h                  |  28 +-
 include/xrpl/server/detail/BaseHTTPPeer.h     |   4 +-
 include/xrpl/server/detail/BaseWSPeer.h       |  12 +-
 include/xrpl/server/detail/Door.h             |  17 +-
 include/xrpl/server/detail/ServerImpl.h       |  50 +-
 include/xrpl/server/detail/io_list.h          | 149 +--
 include/xrpl/shamap/Family.h                  |  14 +-
 include/xrpl/shamap/FullBelowCache.h          |  76 +-
 include/xrpl/shamap/SHAMap.h                  | 228 +++--
 .../xrpl/shamap/SHAMapAccountStateLeafNode.h  |   4 +-
 include/xrpl/shamap/SHAMapInnerNode.h         |  81 +-
 include/xrpl/shamap/SHAMapLeafNode.h          |  11 +-
 include/xrpl/shamap/SHAMapNodeID.h            |  15 +-
 include/xrpl/shamap/SHAMapSyncFilter.h        |   4 +-
 include/xrpl/shamap/SHAMapTreeNode.h          | 103 +-
 include/xrpl/shamap/SHAMapTxLeafNode.h        |   4 +-
 .../xrpl/shamap/SHAMapTxPlusMetaLeafNode.h    |   4 +-
 include/xrpl/shamap/detail/TaggedPointer.h    | 254 ++---
 include/xrpl/tx/ApplyContext.h                |  35 +-
 include/xrpl/tx/Transactor.h                  | 170 ++--
 include/xrpl/tx/apply.h                       | 186 ++--
 include/xrpl/tx/applySteps.h                  | 383 +++++---
 include/xrpl/tx/invariants/InvariantCheck.h   |   3 +-
 include/xrpl/tx/invariants/MPTInvariant.h     |  18 +-
 include/xrpl/tx/invariants/VaultInvariant.h   |  16 +-
 include/xrpl/tx/paths/AMMLiquidity.h          |  15 +-
 include/xrpl/tx/paths/AMMOffer.h              |  15 +-
 include/xrpl/tx/paths/BookTip.h               |  22 +-
 include/xrpl/tx/paths/Flow.h                  |  38 +-
 include/xrpl/tx/paths/Offer.h                 |  41 +-
 include/xrpl/tx/paths/OfferStream.h           |  59 +-
 include/xrpl/tx/paths/RippleCalc.h            |  11 +-
 include/xrpl/tx/paths/detail/FlatSets.h       |  11 +-
 include/xrpl/tx/paths/detail/Steps.h          | 415 ++++----
 include/xrpl/tx/paths/detail/StrandFlow.h     |  83 +-
 .../tx/transactors/account/SignerListSet.h    |   6 +-
 include/xrpl/tx/transactors/dex/AMMBid.h      |   3 +-
 include/xrpl/tx/transactors/dex/AMMClawback.h |   3 +-
 include/xrpl/tx/transactors/dex/AMMContext.h  |   6 +-
 include/xrpl/tx/transactors/dex/AMMCreate.h   |  53 +-
 include/xrpl/tx/transactors/dex/AMMDelete.h   |   3 +-
 include/xrpl/tx/transactors/dex/AMMDeposit.h  |  24 +-
 include/xrpl/tx/transactors/dex/AMMVote.h     |   3 +-
 include/xrpl/tx/transactors/dex/AMMWithdraw.h |  37 +-
 include/xrpl/tx/transactors/dex/OfferCreate.h |  20 +-
 .../xrpl/tx/transactors/lending/LoanManage.h  |   9 +-
 .../xrpl/tx/transactors/oracle/OracleDelete.h |  14 +-
 .../xrpl/tx/transactors/oracle/OracleSet.h    |  14 +-
 .../PermissionedDomainDelete.h                |   4 +-
 .../PermissionedDomainSet.h                   |   4 +-
 .../xrpl/tx/transactors/system/TicketCreate.h |  12 +-
 src/libxrpl/basics/Number.cpp                 |  68 +-
 src/libxrpl/basics/ResolverAsio.cpp           |  18 +-
 src/libxrpl/basics/base64.cpp                 |  56 +-
 src/libxrpl/basics/make_SSLContext.cpp        |  83 +-
 src/libxrpl/core/detail/LoadMonitor.cpp       |   9 +-
 src/libxrpl/crypto/RFC1751.cpp                |  20 +-
 src/libxrpl/json/Writer.cpp                   |  14 +-
 src/libxrpl/json/json_value.cpp               |   7 +-
 src/libxrpl/ledger/helpers/NFTokenHelpers.cpp |  12 +-
 src/libxrpl/nodestore/backend/NullFactory.cpp |   4 +-
 .../nodestore/backend/RocksDBFactory.cpp      |   4 +-
 src/libxrpl/protocol/AccountID.cpp            |   4 +-
 src/libxrpl/protocol/Feature.cpp              |  52 +-
 src/libxrpl/protocol/Indexes.cpp              |  35 +-
 src/libxrpl/protocol/PublicKey.cpp            |  25 +-
 src/libxrpl/protocol/SecretKey.cpp            |  39 +-
 src/libxrpl/protocol/tokens.cpp               |  19 +-
 src/libxrpl/rdb/SociDB.cpp                    |  17 +-
 src/libxrpl/shamap/SHAMap.cpp                 |  23 +-
 src/libxrpl/shamap/SHAMapSync.cpp             |  15 +-
 src/libxrpl/tx/Transactor.cpp                 |  24 +-
 src/libxrpl/tx/paths/BookStep.cpp             |  15 +-
 .../tx/transactors/bridge/XChainBridge.cpp    | 196 ++--
 src/libxrpl/tx/transactors/dex/AMMDeposit.cpp |  15 +-
 .../tx/transactors/dex/AMMWithdraw.cpp        |  18 +-
 .../PermissionedDomainDelete.cpp              |   4 +-
 .../PermissionedDomainSet.cpp                 |   4 +-
 src/test/app/AMMCalc_test.cpp                 |   3 +-
 src/test/app/AMMExtendedMPT_test.cpp          |   6 +-
 src/test/app/AMMExtended_test.cpp             |  12 +-
 src/test/app/CheckMPT_test.cpp                |   3 +-
 src/test/app/Invariants_test.cpp              |   3 +-
 src/test/app/LedgerHistory_test.cpp           |  14 +-
 src/test/app/Loan_test.cpp                    |  30 +-
 src/test/app/Ticket_test.cpp                  |  20 +-
 src/test/beast/define_print.cpp               |   4 +-
 .../DistributedValidatorsSim_test.cpp         |   3 +-
 src/test/consensus/LedgerTrie_test.cpp        |  92 +-
 src/test/core/Config_test.cpp                 |   4 +-
 src/test/csf/BasicNetwork.h                   | 225 ++---
 src/test/csf/CollectorRef.h                   |  99 +-
 src/test/csf/Digraph.h                        | 158 +--
 src/test/csf/Histogram.h                      |  58 +-
 src/test/csf/Peer.h                           | 238 +++--
 src/test/csf/PeerGroup.h                      | 166 ++--
 src/test/csf/Proposal.h                       |   7 +-
 src/test/csf/Scheduler.h                      | 188 ++--
 src/test/csf/Sim.h                            |  88 +-
 src/test/csf/TrustGraph.h                     |  76 +-
 src/test/csf/Tx.h                             |  31 +-
 src/test/csf/Validation.h                     |  16 +-
 src/test/csf/collectors.h                     | 104 +-
 src/test/csf/events.h                         |  73 +-
 src/test/csf/ledgers.h                        | 169 ++--
 src/test/csf/random.h                         |  78 +-
 src/test/csf/submitters.h                     |  39 +-
 src/test/csf/timers.h                         |   3 +-
 src/test/jtx/AMM.h                            |  12 +-
 src/test/jtx/AMMTest.h                        |   3 +-
 src/test/jtx/AbstractClient.h                 |  27 +-
 src/test/jtx/Account.h                        |  62 +-
 src/test/jtx/CheckMessageLogs.h               |  16 +-
 src/test/jtx/Env.h                            | 508 +++++-----
 src/test/jtx/Env_ss.h                         |   9 +-
 src/test/jtx/JSONRPCClient.h                  |   4 +-
 src/test/jtx/JTx.h                            |  25 +-
 src/test/jtx/Oracle.h                         |   3 +-
 src/test/jtx/PathSet.h                        |   9 +-
 src/test/jtx/TestHelpers.h                    |  30 +-
 src/test/jtx/WSClient.h                       |  12 +-
 src/test/jtx/acctdelete.h                     |   4 +-
 src/test/jtx/amount.h                         | 167 ++--
 src/test/jtx/balance.h                        |  17 +-
 src/test/jtx/batch.h                          |  16 +-
 src/test/jtx/check.h                          |  24 +-
 src/test/jtx/delivermin.h                     |   4 +-
 src/test/jtx/deposit.h                        |  12 +-
 src/test/jtx/did.h                            |  16 +-
 src/test/jtx/directory.h                      |  32 +-
 src/test/jtx/domain.h                         |   4 +-
 src/test/jtx/envconfig.h                      | 174 ++--
 src/test/jtx/escrow.h                         |  12 +-
 src/test/jtx/fee.h                            |   4 +-
 src/test/jtx/flags.h                          |  16 +-
 src/test/jtx/impl/dids.cpp                    |   4 +-
 src/test/jtx/impl/directory.cpp               |   4 +-
 src/test/jtx/impl/escrow.cpp                  |   4 +-
 src/test/jtx/jtx_json.h                       |   4 +-
 src/test/jtx/ledgerStateFix.h                 |  12 +-
 src/test/jtx/memo.h                           |  11 +-
 src/test/jtx/mpt.h                            |  84 +-
 src/test/jtx/multisign.h                      |  25 +-
 src/test/jtx/noop.h                           |   4 +-
 src/test/jtx/offer.h                          |   8 +-
 src/test/jtx/owners.h                         |  34 +-
 src/test/jtx/paths.h                          |  13 +-
 src/test/jtx/pay.h                            |   4 +-
 src/test/jtx/prop.h                           |   4 +-
 src/test/jtx/quality.h                        |  16 +-
 src/test/jtx/rate.h                           |   4 +-
 src/test/jtx/regkey.h                         |   8 +-
 src/test/jtx/require.h                        |  17 +-
 src/test/jtx/rpc.h                            |  15 +-
 src/test/jtx/sendmax.h                        |   4 +-
 src/test/jtx/seq.h                            |   4 +-
 src/test/jtx/sig.h                            |  19 +-
 src/test/jtx/tag.h                            |   8 +-
 src/test/jtx/tags.h                           |   4 +-
 src/test/jtx/ter.h                            |   7 +-
 src/test/jtx/ticket.h                         |  16 +-
 src/test/jtx/token.h                          |  84 +-
 src/test/jtx/trust.h                          |   8 +-
 src/test/jtx/txflags.h                        |   4 +-
 src/test/jtx/utility.h                        |  41 +-
 src/test/jtx/vault.h                          |   4 +-
 src/test/nodestore/TestBase.h                 |  19 +-
 src/test/overlay/reduce_relay_test.cpp        |  83 +-
 src/test/rpc/LedgerEntry_test.cpp             |  16 +-
 src/test/rpc/LedgerRPC_test.cpp               |  10 +-
 src/test/unit_test/FileDirGuard.h             |   8 +-
 src/test/unit_test/multi_runner.h             |   6 +-
 src/test/unit_test/utils.h                    |   8 +-
 src/tests/libxrpl/helpers/Account.h           |  20 +-
 src/tests/libxrpl/helpers/TestFamily.h        |  15 +-
 .../libxrpl/helpers/TestServiceRegistry.h     |  25 +-
 src/tests/libxrpl/helpers/TxTest.h            |  16 +-
 .../app/consensus/RCLCensorshipDetector.h     |  49 +-
 src/xrpld/app/consensus/RCLConsensus.cpp      |   4 +-
 src/xrpld/app/consensus/RCLConsensus.h        | 363 ++++---
 src/xrpld/app/consensus/RCLCxLedger.h         |  82 +-
 src/xrpld/app/consensus/RCLCxPeerPos.h        |  83 +-
 src/xrpld/app/consensus/RCLCxTx.h             | 152 +--
 src/xrpld/app/consensus/RCLValidations.h      | 147 ++-
 .../app/ledger/AbstractFetchPackContainer.h   |  20 +-
 src/xrpld/app/ledger/AcceptedLedger.h         |  17 +-
 src/xrpld/app/ledger/BuildLedger.h            |  50 +-
 src/xrpld/app/ledger/InboundLedger.h          |  12 +-
 src/xrpld/app/ledger/InboundLedgers.h         |  17 +-
 src/xrpld/app/ledger/InboundTransactions.h    |  15 +-
 src/xrpld/app/ledger/LedgerCleaner.h          |  25 +-
 src/xrpld/app/ledger/LedgerHistory.cpp        |   3 +-
 src/xrpld/app/ledger/LedgerHistory.h          |  78 +-
 src/xrpld/app/ledger/LedgerHolder.h           |  13 +-
 src/xrpld/app/ledger/LedgerMaster.h           |  57 +-
 src/xrpld/app/ledger/LedgerPersistence.h      |  91 +-
 src/xrpld/app/ledger/LedgerReplay.h           |   9 +-
 src/xrpld/app/ledger/LedgerReplayTask.h       |  12 +-
 src/xrpld/app/ledger/LedgerReplayer.h         |   8 +-
 src/xrpld/app/ledger/LedgerToJson.h           |  13 +-
 src/xrpld/app/ledger/OpenLedger.h             | 183 ++--
 src/xrpld/app/ledger/OrderBookDBImpl.h        |  17 +-
 src/xrpld/app/ledger/detail/BuildLedger.cpp   |  19 +-
 src/xrpld/app/ledger/detail/InboundLedger.cpp |  59 +-
 .../app/ledger/detail/InboundLedgers.cpp      |  20 +-
 .../app/ledger/detail/InboundTransactions.cpp |   3 +-
 src/xrpld/app/ledger/detail/LedgerCleaner.cpp |  30 +-
 src/xrpld/app/ledger/detail/LedgerMaster.cpp  |  70 +-
 src/xrpld/app/ledger/detail/TimeoutCounter.h  |  99 +-
 src/xrpld/app/main/Application.h              |  14 +-
 src/xrpld/app/main/CollectorManager.h         |   4 +-
 src/xrpld/app/main/LoadManager.h              |  60 +-
 src/xrpld/app/main/NodeIdentity.h             |   9 +-
 src/xrpld/app/main/NodeStoreScheduler.h       |   4 +-
 src/xrpld/app/misc/DeliverMax.h               |  12 +-
 src/xrpld/app/misc/FeeVote.h                  |  35 +-
 src/xrpld/app/misc/NegativeUNLVote.h          |   4 +-
 src/xrpld/app/misc/NetworkOPs.cpp             |  14 +-
 src/xrpld/app/misc/SHAMapStore.h              |  56 +-
 src/xrpld/app/misc/SHAMapStoreImp.h           |  13 +-
 src/xrpld/app/misc/Transaction.h              |  40 +-
 src/xrpld/app/misc/TxQ.h                      | 921 ++++++++++--------
 src/xrpld/app/misc/ValidatorKeys.h            |   7 +-
 src/xrpld/app/misc/ValidatorList.h            | 784 ++++++++-------
 src/xrpld/app/misc/ValidatorSite.h            | 199 ++--
 src/xrpld/app/misc/detail/AmendmentTable.cpp  |  95 +-
 src/xrpld/app/misc/setup_HashRouter.h         |   4 +-
 src/xrpld/consensus/Consensus.h               | 683 ++++++-------
 src/xrpld/consensus/ConsensusParms.h          | 130 ++-
 src/xrpld/consensus/ConsensusProposal.h       | 170 ++--
 src/xrpld/consensus/ConsensusTypes.h          | 185 ++--
 src/xrpld/consensus/DisputedTx.h              | 129 ++-
 src/xrpld/consensus/LedgerTrie.h              | 389 ++++----
 src/xrpld/consensus/Validations.h             | 675 +++++++------
 src/xrpld/core/Config.h                       | 110 ++-
 src/xrpld/core/NetworkIDServiceImpl.h         |  13 +-
 src/xrpld/core/TimeKeeper.h                   |  54 +-
 src/xrpld/core/detail/Config.cpp              |  16 +-
 src/xrpld/overlay/Cluster.h                   |  56 +-
 src/xrpld/overlay/Compression.h               |   6 +-
 src/xrpld/overlay/Message.h                   |  27 +-
 src/xrpld/overlay/Overlay.h                   | 108 +-
 src/xrpld/overlay/Peer.h                      |  35 +-
 src/xrpld/overlay/PeerSet.h                   |  29 +-
 src/xrpld/overlay/Slot.h                      | 124 ++-
 src/xrpld/overlay/Squelch.h                   |  19 +-
 src/xrpld/overlay/detail/ConnectAttempt.h     |   4 +-
 src/xrpld/overlay/detail/Handshake.cpp        |  29 +-
 src/xrpld/overlay/detail/Handshake.h          | 189 ++--
 src/xrpld/overlay/detail/Message.cpp          |  71 +-
 src/xrpld/overlay/detail/OverlayImpl.cpp      |  20 +-
 src/xrpld/overlay/detail/OverlayImpl.h        | 133 +--
 src/xrpld/overlay/detail/PeerImp.cpp          |   8 +-
 src/xrpld/overlay/detail/PeerImp.h            | 163 ++--
 src/xrpld/overlay/detail/PeerSet.cpp          |   8 +-
 src/xrpld/overlay/detail/ProtocolMessage.h    |  74 +-
 src/xrpld/overlay/detail/ProtocolVersion.cpp  |  11 +-
 src/xrpld/overlay/detail/ProtocolVersion.h    |  54 +-
 src/xrpld/overlay/detail/TrafficCount.h       |  48 +-
 src/xrpld/overlay/detail/Tuning.h             | 203 ++--
 src/xrpld/overlay/detail/TxMetrics.h          |  65 +-
 src/xrpld/overlay/detail/ZeroCopyStream.h     |  20 +-
 src/xrpld/overlay/make_Overlay.h              |   4 +-
 src/xrpld/overlay/predicates.h                |  32 +-
 src/xrpld/peerfinder/PeerfinderManager.h      | 230 +++--
 src/xrpld/peerfinder/Slot.h                   |  43 +-
 src/xrpld/peerfinder/detail/Bootcache.h       |  71 +-
 src/xrpld/peerfinder/detail/Checker.h         |  43 +-
 src/xrpld/peerfinder/detail/Counts.h          | 140 ++-
 src/xrpld/peerfinder/detail/Fixed.h           |  16 +-
 src/xrpld/peerfinder/detail/Handouts.h        |  33 +-
 src/xrpld/peerfinder/detail/Livecache.h       |  62 +-
 src/xrpld/peerfinder/detail/Logic.h           |  42 +-
 src/xrpld/peerfinder/detail/SlotImp.h         |  13 +-
 src/xrpld/peerfinder/detail/Source.h          |  21 +-
 src/xrpld/peerfinder/detail/SourceStrings.h   |   4 +-
 src/xrpld/peerfinder/detail/Store.h           |   4 +-
 src/xrpld/peerfinder/detail/StoreSqdb.h       |   4 +-
 src/xrpld/peerfinder/detail/Tuning.h          |  45 +-
 src/xrpld/peerfinder/detail/iosformat.h       |  20 +-
 src/xrpld/peerfinder/make_Manager.h           |   4 +-
 src/xrpld/perflog/detail/PerfLogImp.h         |   4 +-
 src/xrpld/rpc/Context.h                       |   4 +-
 src/xrpld/rpc/DeliveredAmount.h               |  13 +-
 src/xrpld/rpc/MPTokenIssuanceID.h             |  11 +-
 src/xrpld/rpc/RPCCall.h                       |   7 +-
 src/xrpld/rpc/RPCHandler.h                    |   4 +-
 src/xrpld/rpc/RPCSub.h                        |   4 +-
 src/xrpld/rpc/Role.h                          |  20 +-
 src/xrpld/rpc/Status.h                        |  52 +-
 src/xrpld/rpc/detail/AssetCache.h             |  25 +-
 src/xrpld/rpc/detail/Handler.cpp              |   4 +-
 src/xrpld/rpc/detail/Handler.h                |   8 +-
 src/xrpld/rpc/detail/PathRequest.h            |   7 +-
 src/xrpld/rpc/detail/PathRequestManager.cpp   |   7 +-
 src/xrpld/rpc/detail/PathRequestManager.h     |  11 +-
 src/xrpld/rpc/detail/Pathfinder.h             |  27 +-
 src/xrpld/rpc/detail/RPCHandler.cpp           | 153 ++-
 src/xrpld/rpc/detail/RPCHelpers.h             |   3 +-
 src/xrpld/rpc/detail/TransactionSign.cpp      |  16 +-
 src/xrpld/rpc/detail/TransactionSign.h        |  71 +-
 src/xrpld/rpc/detail/TrustLine.h              |  56 +-
 src/xrpld/rpc/detail/Tuning.h                 |  64 +-
 .../rpc/handlers/account/AccountNFTs.cpp      |  21 +-
 .../rpc/handlers/account/AccountObjects.cpp   |  21 +-
 .../handlers/orderbook/GetAggregatePrice.cpp  |   3 +-
 src/xrpld/rpc/json_body.h                     |   4 +-
 653 files changed, 18022 insertions(+), 12993 deletions(-)

diff --git a/cmake/scripts/codegen/templates/LedgerEntry.h.mako b/cmake/scripts/codegen/templates/LedgerEntry.h.mako
index 63f5f39ef9..c799903b21 100644
--- a/cmake/scripts/codegen/templates/LedgerEntry.h.mako
+++ b/cmake/scripts/codegen/templates/LedgerEntry.h.mako
@@ -177,7 +177,9 @@ ${field['typeData']['setter_type']} ${field['paramName']}${',' if i < len(requir
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 % for field in fields:
 
     /**
diff --git a/cmake/scripts/codegen/templates/Transaction.h.mako b/cmake/scripts/codegen/templates/Transaction.h.mako
index d3b303d9d6..49e2e4a5cd 100644
--- a/cmake/scripts/codegen/templates/Transaction.h.mako
+++ b/cmake/scripts/codegen/templates/Transaction.h.mako
@@ -185,7 +185,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 % for field in fields:
 
     /**
diff --git a/include/xrpl/basics/Archive.h b/include/xrpl/basics/Archive.h
index 58e12bbb71..66d6a019af 100644
--- a/include/xrpl/basics/Archive.h
+++ b/include/xrpl/basics/Archive.h
@@ -4,13 +4,14 @@
 
 namespace xrpl {
 
-/** Extract a tar archive compressed with lz4
-
-    @param src the path of the archive to be extracted
-    @param dst the directory to extract to
-
-    @throws runtime_error
-*/
+/**
+ * Extract a tar archive compressed with lz4
+ *
+ * @param src the path of the archive to be extracted
+ * @param dst the directory to extract to
+ *
+ * @throws runtime_error
+ */
 void
 extractTarLz4(boost::filesystem::path const& src, boost::filesystem::path const& dst);
 
diff --git a/include/xrpl/basics/Blob.h b/include/xrpl/basics/Blob.h
index ee0d6cf3b5..bfb8e5a697 100644
--- a/include/xrpl/basics/Blob.h
+++ b/include/xrpl/basics/Blob.h
@@ -4,9 +4,10 @@
 
 namespace xrpl {
 
-/** Storage for linear binary data.
-    Blocks of binary data appear often in various idioms and structures.
-*/
+/**
+ * Storage for linear binary data.
+ * Blocks of binary data appear often in various idioms and structures.
+ */
 using Blob = std::vector<unsigned char>;
 
 }  // namespace xrpl
diff --git a/include/xrpl/basics/Buffer.h b/include/xrpl/basics/Buffer.h
index c0ae8ef56e..05af6c409a 100644
--- a/include/xrpl/basics/Buffer.h
+++ b/include/xrpl/basics/Buffer.h
@@ -10,9 +10,10 @@
 
 namespace xrpl {
 
-/** Like std::vector<char> but better.
-    Meets the requirements of BufferFactory.
-*/
+/**
+ * Like std::vector<char> but better.
+ * Meets the requirements of BufferFactory.
+ */
 class Buffer
 {
 private:
@@ -24,30 +25,37 @@ public:
 
     Buffer() = default;
 
-    /** Create an uninitialized buffer with the given size. */
+    /**
+     * Create an uninitialized buffer with the given size.
+     */
     explicit Buffer(std::size_t size)
         : p_((size != 0u) ? new std::uint8_t[size] : nullptr), size_(size)
     {
     }
 
-    /** Create a buffer as a copy of existing memory.
-
-        @param data a pointer to the existing memory. If
-                    size is non-zero, it must not be null.
-        @param size size of the existing memory block.
-    */
+    /**
+     * Create a buffer as a copy of existing memory.
+     *
+     * @param data a pointer to the existing memory. If
+     *             size is non-zero, it must not be null.
+     * @param size size of the existing memory block.
+     */
     Buffer(void const* data, std::size_t size) : Buffer(size)
     {
         if (size != 0u)
             std::memcpy(p_.get(), data, size);
     }
 
-    /** Copy-construct */
+    /**
+     * Copy-construct
+     */
     Buffer(Buffer const& other) : Buffer(other.p_.get(), other.size_)
     {
     }
 
-    /** Copy assign */
+    /**
+     * Copy assign
+     */
     Buffer&
     operator=(Buffer const& other)
     {
@@ -59,17 +67,19 @@ public:
         return *this;
     }
 
-    /** Move-construct.
-        The other buffer is reset.
-    */
+    /**
+     * Move-construct.
+     * The other buffer is reset.
+     */
     Buffer(Buffer&& other) noexcept : p_(std::move(other.p_)), size_(other.size_)
     {
         other.size_ = 0;
     }
 
-    /** Move-assign.
-        The other buffer is reset.
-    */
+    /**
+     * Move-assign.
+     * The other buffer is reset.
+     */
     Buffer&
     operator=(Buffer&& other) noexcept
     {
@@ -82,12 +92,16 @@ public:
         return *this;
     }
 
-    /** Construct from a slice */
+    /**
+     * Construct from a slice
+     */
     explicit Buffer(Slice s) : Buffer(s.data(), s.size())
     {
     }
 
-    /** Assign from slice */
+    /**
+     * Assign from slice
+     */
     Buffer&
     operator=(Slice s)
     {
@@ -101,7 +115,9 @@ public:
         return *this;
     }
 
-    /** Returns the number of bytes in the buffer. */
+    /**
+     * Returns the number of bytes in the buffer.
+     */
     [[nodiscard]] std::size_t
     size() const noexcept
     {
@@ -121,10 +137,11 @@ public:
         return Slice{p_.get(), size_};
     }
 
-    /** Return a pointer to beginning of the storage.
-        @note The return type is guaranteed to be a pointer
-              to a single byte, to facilitate pointer arithmetic.
-    */
+    /**
+     * Return a pointer to beginning of the storage.
+     * @note The return type is guaranteed to be a pointer
+     *       to a single byte, to facilitate pointer arithmetic.
+     */
     /** @{ */
     [[nodiscard]] std::uint8_t const*
     data() const noexcept
@@ -139,9 +156,10 @@ public:
     }
     /** @} */
 
-    /** Reset the buffer.
-        All memory is deallocated. The resulting size is 0.
-    */
+    /**
+     * Reset the buffer.
+     * All memory is deallocated. The resulting size is 0.
+     */
     void
     clear() noexcept
     {
@@ -149,9 +167,10 @@ public:
         size_ = 0;
     }
 
-    /** Reallocate the storage.
-        Existing data, if any, is discarded.
-    */
+    /**
+     * Reallocate the storage.
+     * Existing data, if any, is discarded.
+     */
     std::uint8_t*
     alloc(std::size_t n)
     {
diff --git a/include/xrpl/basics/CompressionAlgorithms.h b/include/xrpl/basics/CompressionAlgorithms.h
index a5ec8645b6..316acb14ac 100644
--- a/include/xrpl/basics/CompressionAlgorithms.h
+++ b/include/xrpl/basics/CompressionAlgorithms.h
@@ -12,7 +12,8 @@
 
 namespace xrpl::compression_algorithms {
 
-/** LZ4 block compression.
+/**
+ * LZ4 block compression.
  * @tparam BufferFactory Callable object or lambda.
  *     Takes the requested buffer size and returns allocated buffer pointer.
  * @param in Data to compress
@@ -80,7 +81,8 @@ lz4Decompress(
     return decompressedSize;
 }
 
-/** LZ4 block decompression.
+/**
+ * LZ4 block decompression.
  * @tparam InputStream ZeroCopyInputStream
  * @param in Input source stream
  * @param inSize Size of compressed data
diff --git a/include/xrpl/basics/CountedObject.h b/include/xrpl/basics/CountedObject.h
index 275894673e..bb7b0d8877 100644
--- a/include/xrpl/basics/CountedObject.h
+++ b/include/xrpl/basics/CountedObject.h
@@ -9,7 +9,9 @@
 
 namespace xrpl {
 
-/** Manages all counted object types. */
+/**
+ * Manages all counted object types.
+ */
 class CountedObjects
 {
 public:
@@ -23,10 +25,11 @@ public:
     getCounts(int minimumThreshold) const;
 
 public:
-    /** Implementation for @ref CountedObject.
-
-        @internal
-    */
+    /**
+     * Implementation for @ref CountedObject.
+     *
+     * @internal
+     */
     class Counter
     {
     public:
@@ -94,13 +97,14 @@ private:
 
 //------------------------------------------------------------------------------
 
-/** Tracks the number of instances of an object.
-
-    Derived classes have their instances counted automatically. This is used
-    for reporting purposes.
-
-    @ingroup basics
-*/
+/**
+ * Tracks the number of instances of an object.
+ *
+ * Derived classes have their instances counted automatically. This is used
+ * for reporting purposes.
+ *
+ * @ingroup basics
+ */
 template <class Object>
 class CountedObject
 {
diff --git a/include/xrpl/basics/DecayingSample.h b/include/xrpl/basics/DecayingSample.h
index 86a8baa62e..1b05770734 100644
--- a/include/xrpl/basics/DecayingSample.h
+++ b/include/xrpl/basics/DecayingSample.h
@@ -6,9 +6,10 @@
 
 namespace xrpl {
 
-/** Sampling function using exponential decay to provide a continuous value.
-    @tparam The number of seconds in the decay window.
-*/
+/**
+ * Sampling function using exponential decay to provide a continuous value.
+ * @tparam The number of seconds in the decay window.
+ */
 template <int Window, typename Clock>
 class DecayingSample
 {
@@ -19,15 +20,16 @@ public:
     DecayingSample() = delete;
 
     /**
-        @param now Start time of DecayingSample.
-    */
+     * @param now Start time of DecayingSample.
+     */
     explicit DecayingSample(time_point now) : value_(value_type()), when_(now)
     {
     }
 
-    /** Add a new sample.
-        The value is first aged according to the specified time.
-    */
+    /**
+     * Add a new sample.
+     * The value is first aged according to the specified time.
+     */
     value_type
     add(value_type value, time_point now)
     {
@@ -36,9 +38,10 @@ public:
         return value_ / Window;
     }
 
-    /** Retrieve the current value in normalized units.
-        The samples are first aged according to the specified time.
-    */
+    /**
+     * Retrieve the current value in normalized units.
+     * The samples are first aged according to the specified time.
+     */
     value_type
     value(time_point now)
     {
@@ -87,9 +90,10 @@ private:
 
 //------------------------------------------------------------------------------
 
-/** Sampling function using exponential decay to provide a continuous value.
-    @tparam HalfLife The half life of a sample, in seconds.
-*/
+/**
+ * Sampling function using exponential decay to provide a continuous value.
+ * @tparam HalfLife The half life of a sample, in seconds.
+ */
 template <int HalfLife, class Clock>
 class DecayWindow
 {
diff --git a/include/xrpl/basics/IntrusivePointer.h b/include/xrpl/basics/IntrusivePointer.h
index c23d6afb85..59853ad4d0 100644
--- a/include/xrpl/basics/IntrusivePointer.h
+++ b/include/xrpl/basics/IntrusivePointer.h
@@ -10,33 +10,37 @@ namespace xrpl {
 
 //------------------------------------------------------------------------------
 
-/** Tag to create an intrusive pointer from another intrusive pointer by using a
-    static cast. This is useful to create an intrusive pointer to a derived
-    class from an intrusive pointer to a base class.
-*/
+/**
+ * Tag to create an intrusive pointer from another intrusive pointer by using a
+ * static cast. This is useful to create an intrusive pointer to a derived
+ * class from an intrusive pointer to a base class.
+ */
 struct StaticCastTagSharedIntrusive
 {
 };
 
-/** Tag to create an intrusive pointer from another intrusive pointer by using a
-    dynamic cast. This is useful to create an intrusive pointer to a derived
-    class from an intrusive pointer to a base class. If the cast fails an empty
-    (null) intrusive pointer is created.
-*/
+/**
+ * Tag to create an intrusive pointer from another intrusive pointer by using a
+ * dynamic cast. This is useful to create an intrusive pointer to a derived
+ * class from an intrusive pointer to a base class. If the cast fails an empty
+ * (null) intrusive pointer is created.
+ */
 struct DynamicCastTagSharedIntrusive
 {
 };
 
-/** When creating or adopting a raw pointer, controls whether the strong count
-    is incremented or not. Use this tag to increment the strong count.
-*/
+/**
+ * When creating or adopting a raw pointer, controls whether the strong count
+ * is incremented or not. Use this tag to increment the strong count.
+ */
 struct SharedIntrusiveAdoptIncrementStrongTag
 {
 };
 
-/** When creating or adopting a raw pointer, controls whether the strong count
-    is incremented or not. Use this tag to leave the strong count unchanged.
-*/
+/**
+ * When creating or adopting a raw pointer, controls whether the strong count
+ * is incremented or not. Use this tag to leave the strong count unchanged.
+ */
 struct SharedIntrusiveAdoptNoIncrementTag
 {
 };
@@ -50,20 +54,21 @@ concept CAdoptTag = std::is_same_v<T, SharedIntrusiveAdoptIncrementStrongTag> ||
 
 //------------------------------------------------------------------------------
 
-/** A shared intrusive pointer class that supports weak pointers.
-
-    This is meant to be used for SHAMapInnerNodes, but may be useful for other
-    cases. Since the reference counts are stored on the pointee, the pointee is
-    not destroyed until both the strong _and_ weak pointer counts go to zero.
-    When the strong pointer count goes to zero, the "partialDestructor" is
-    called. This can be used to destroy as much of the object as possible while
-    still retaining the reference counts. For example, for SHAMapInnerNodes the
-    children may be reset in that function. Note that std::shared_pointer WILL
-    run the destructor when the strong count reaches zero, but may not free the
-    memory used by the object until the weak count reaches zero. In xrpld, we
-    typically allocate shared pointers with the `make_shared` function. When
-    that is used, the memory is not reclaimed until the weak count reaches zero.
-*/
+/**
+ * A shared intrusive pointer class that supports weak pointers.
+ *
+ * This is meant to be used for SHAMapInnerNodes, but may be useful for other
+ * cases. Since the reference counts are stored on the pointee, the pointee is
+ * not destroyed until both the strong _and_ weak pointer counts go to zero.
+ * When the strong pointer count goes to zero, the "partialDestructor" is
+ * called. This can be used to destroy as much of the object as possible while
+ * still retaining the reference counts. For example, for SHAMapInnerNodes the
+ * children may be reset in that function. Note that std::shared_pointer WILL
+ * run the destructor when the strong count reaches zero, but may not free the
+ * memory used by the object until the weak count reaches zero. In xrpld, we
+ * typically allocate shared pointers with the `make_shared` function. When
+ * that is used, the memory is not reclaimed until the weak count reaches zero.
+ */
 template <class T>
 class SharedIntrusive
 {
@@ -111,8 +116,9 @@ public:
     operator=(
         SharedIntrusive<TT>&& rhs);  // NOLINT(cppcoreguidelines-rvalue-reference-param-not-moved)
 
-    /** Adopt the raw pointer. The strong reference may or may not be
-        incremented, depending on the TAdoptTag
+    /**
+     * Adopt the raw pointer. The strong reference may or may not be
+     * incremented, depending on the TAdoptTag
      */
     template <CAdoptTag TAdoptTag = SharedIntrusiveAdoptIncrementStrongTag>
     void
@@ -120,27 +126,31 @@ public:
 
     ~SharedIntrusive();
 
-    /** Create a new SharedIntrusive by statically casting the pointer
-        controlled by the rhs param.
-    */
+    /**
+     * Create a new SharedIntrusive by statically casting the pointer
+     * controlled by the rhs param.
+     */
     template <class TT>
     SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs);
 
-    /** Create a new SharedIntrusive by statically casting the pointer
-       controlled by the rhs param.
-    */
+    /**
+     * Create a new SharedIntrusive by statically casting the pointer
+     * controlled by the rhs param.
+     */
     template <class TT>
     SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusive<TT>&& rhs);
 
-    /** Create a new SharedIntrusive by dynamically casting the pointer
-       controlled by the rhs param.
-    */
+    /**
+     * Create a new SharedIntrusive by dynamically casting the pointer
+     * controlled by the rhs param.
+     */
     template <class TT>
     SharedIntrusive(DynamicCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs);
 
-    /** Create a new SharedIntrusive by dynamically casting the pointer
-       controlled by the rhs param.
-    */
+    /**
+     * Create a new SharedIntrusive by dynamically casting the pointer
+     * controlled by the rhs param.
+     */
     template <class TT>
     SharedIntrusive(DynamicCastTagSharedIntrusive, SharedIntrusive<TT>&& rhs);
 
@@ -153,17 +163,22 @@ public:
     explicit
     operator bool() const noexcept;
 
-    /** Set the pointer to null, decrement the strong count, and run the
-        appropriate release action.
-      */
+    /**
+     * Set the pointer to null, decrement the strong count, and run the
+     * appropriate release action.
+     */
     void
     reset();
 
-    /** Get the raw pointer */
+    /**
+     * Get the raw pointer
+     */
     [[nodiscard]] T*
     get() const;
 
-    /** Return the strong count */
+    /**
+     * Return the strong count
+     */
     [[nodiscard]] std::size_t
     useCount() const;
 
@@ -181,43 +196,51 @@ public:
     friend class WeakIntrusive;
 
 private:
-    /** Return the raw pointer held by this object. */
+    /**
+     * Return the raw pointer held by this object.
+     */
     [[nodiscard]] T*
     unsafeGetRawPtr() const;
 
-    /** Exchange the current raw pointer held by this object with the given
-        pointer. Decrement the strong count of the raw pointer previously held
-        by this object and run the appropriate release action.
+    /**
+     * Exchange the current raw pointer held by this object with the given
+     * pointer. Decrement the strong count of the raw pointer previously held
+     * by this object and run the appropriate release action.
      */
     void
     unsafeReleaseAndStore(T* next);
 
-    /** Set the raw pointer directly. This is wrapped in a function so the class
-        can support both atomic and non-atomic pointers in a future patch.
+    /**
+     * Set the raw pointer directly. This is wrapped in a function so the class
+     * can support both atomic and non-atomic pointers in a future patch.
      */
     void
     unsafeSetRawPtr(T* p);
 
-    /** Exchange the raw pointer directly.
-        This sets the raw pointer to the given value and returns the previous
-        value. This is wrapped in a function so the class can support both
-        atomic and non-atomic pointers in a future patch.
+    /**
+     * Exchange the raw pointer directly.
+     * This sets the raw pointer to the given value and returns the previous
+     * value. This is wrapped in a function so the class can support both
+     * atomic and non-atomic pointers in a future patch.
      */
     T*
     unsafeExchange(T* p);
 
-    /** pointer to the type with an intrusive count */
+    /**
+     * pointer to the type with an intrusive count
+     */
     T* ptr_{nullptr};
 };
 
 //------------------------------------------------------------------------------
 
-/** A weak intrusive pointer class for the SharedIntrusive pointer class.
-
-Note that this weak pointer class asks differently from normal weak pointer
-classes. When the strong pointer count goes to zero, the "partialDestructor"
-is called. See the comment on SharedIntrusive for a fuller explanation.
-*/
+/**
+ * A weak intrusive pointer class for the SharedIntrusive pointer class.
+ *
+ * Note that this weak pointer class asks differently from normal weak pointer
+ * classes. When the strong pointer count goes to zero, the "partialDestructor"
+ * is called. See the comment on SharedIntrusive for a fuller explanation.
+ */
 template <class T>
 class WeakIntrusive
 {
@@ -247,54 +270,62 @@ public:
     WeakIntrusive&
     operator=(SharedIntrusive<TT> const& rhs);
 
-    /** Adopt the raw pointer and increment the weak count. */
+    /**
+     * Adopt the raw pointer and increment the weak count.
+     */
     void
     adopt(T* ptr);
 
     ~WeakIntrusive();
 
-    /** Get a strong pointer from the weak pointer, if possible. This will
-       only return a seated pointer if the strong count on the raw pointer
-       is non-zero before locking.
+    /**
+     * Get a strong pointer from the weak pointer, if possible. This will
+     * only return a seated pointer if the strong count on the raw pointer
+     * is non-zero before locking.
      */
     SharedIntrusive<T>
     lock() const;
 
-    /** Return true if the strong count is zero. */
+    /**
+     * Return true if the strong count is zero.
+     */
     [[nodiscard]] bool
     expired() const;
 
-    /** Set the pointer to null and decrement the weak count.
-
-    Note: This may run the destructor if the strong count is zero.
-    */
+    /**
+     * Set the pointer to null and decrement the weak count.
+     *
+     * Note: This may run the destructor if the strong count is zero.
+     */
     void
     reset();
 
 private:
     T* ptr_ = nullptr;
 
-    /** Decrement the weak count. This does _not_ set the raw pointer to
-    null.
-
-    Note: This may run the destructor if the strong count is zero.
-    */
+    /**
+     * Decrement the weak count. This does _not_ set the raw pointer to
+     * null.
+     *
+     * Note: This may run the destructor if the strong count is zero.
+     */
     void
     unsafeReleaseNoStore();
 };
 
 //------------------------------------------------------------------------------
 
-/** A combination of a strong and a weak intrusive pointer stored in the
-    space of a single pointer.
-
-    This class is similar to a `std::variant<SharedIntrusive,WeakIntrusive>`
-    with some optimizations. In particular, it uses a low-order bit to
-    determine if the raw pointer represents a strong pointer or a weak
-    pointer. It can also be quickly switched between its strong pointer and
-    weak pointer representations. This class is useful for storing intrusive
-    pointers in tagged caches.
-  */
+/**
+ * A combination of a strong and a weak intrusive pointer stored in the
+ * space of a single pointer.
+ *
+ * This class is similar to a `std::variant<SharedIntrusive,WeakIntrusive>`
+ * with some optimizations. In particular, it uses a low-order bit to
+ * determine if the raw pointer represents a strong pointer or a weak
+ * pointer. It can also be quickly switched between its strong pointer and
+ * weak pointer representations. This class is useful for storing intrusive
+ * pointers in tagged caches.
+ */
 
 template <class T>
 class SharedWeakUnion
@@ -336,69 +367,83 @@ public:
 
     ~SharedWeakUnion();
 
-    /** Return a strong pointer if this is already a strong pointer (i.e.
-       don't lock the weak pointer. Use the `lock` method if that's what's
-       needed)
+    /**
+     * Return a strong pointer if this is already a strong pointer (i.e.
+     * don't lock the weak pointer. Use the `lock` method if that's what's
+     * needed)
      */
     [[nodiscard]] SharedIntrusive<T>
     getStrong() const;
 
-    /** Return true if this is a strong pointer and the strong pointer is
-        seated.
+    /**
+     * Return true if this is a strong pointer and the strong pointer is
+     * seated.
      */
     explicit
     operator bool() const noexcept;
 
-    /** Set the pointer to null, decrement the appropriate ref count, and
-       run the appropriate release action.
+    /**
+     * Set the pointer to null, decrement the appropriate ref count, and
+     * run the appropriate release action.
      */
     void
     reset();
 
-    /** If this is a strong pointer, return the raw pointer. Otherwise
-       return null.
+    /**
+     * If this is a strong pointer, return the raw pointer. Otherwise
+     * return null.
      */
     [[nodiscard]] T*
     get() const;
 
-    /** If this is a strong pointer, return the strong count. Otherwise
+    /**
+     * If this is a strong pointer, return the strong count. Otherwise
      * return 0
      */
     [[nodiscard]] std::size_t
     useCount() const;
 
-    /** Return true if there is a non-zero strong count. */
+    /**
+     * Return true if there is a non-zero strong count.
+     */
     [[nodiscard]] bool
     expired() const;
 
-    /** If this is a strong pointer, return the strong pointer. Otherwise
-        attempt to lock the weak pointer.
+    /**
+     * If this is a strong pointer, return the strong pointer. Otherwise
+     * attempt to lock the weak pointer.
      */
     [[nodiscard]] SharedIntrusive<T>
     lock() const;
 
-    /** Return true is this represents a strong pointer. */
+    /**
+     * Return true is this represents a strong pointer.
+     */
     [[nodiscard]] bool
     isStrong() const;
 
-    /** Return true is this represents a weak pointer. */
+    /**
+     * Return true is this represents a weak pointer.
+     */
     [[nodiscard]] bool
     isWeak() const;
 
-    /** If this is a weak pointer, attempt to convert it to a strong
-       pointer.
-
-        @return true if successfully converted to a strong pointer (or was
-                already a strong pointer). Otherwise false.
-      */
+    /**
+     * If this is a weak pointer, attempt to convert it to a strong
+     * pointer.
+     *
+     * @return true if successfully converted to a strong pointer (or was
+     *         already a strong pointer). Otherwise false.
+     */
     bool
     convertToStrong();
 
-    /** If this is a strong pointer, attempt to convert it to a weak
-       pointer.
-
-        @return false if the pointer is null. Otherwise return true.
-      */
+    /**
+     * If this is a strong pointer, attempt to convert it to a weak
+     * pointer.
+     *
+     * @return false if the pointer is null. Otherwise return true.
+     */
     bool
     convertToWeak();
 
@@ -411,23 +456,27 @@ private:
     static constexpr std::uintptr_t kPtrMask = ~kTagMask;
 
 private:
-    /** Return the raw pointer held by this object.
+    /**
+     * Return the raw pointer held by this object.
      */
     [[nodiscard]] T*
     unsafeGetRawPtr() const;
 
     enum class RefStrength { Strong, Weak };
-    /** Set the raw pointer and tag bit directly.
+    /**
+     * Set the raw pointer and tag bit directly.
      */
     void
     unsafeSetRawPtr(T* p, RefStrength rs);
 
-    /** Set the raw pointer and tag bit to all zeros (strong null pointer).
+    /**
+     * Set the raw pointer and tag bit to all zeros (strong null pointer).
      */
     void unsafeSetRawPtr(std::nullptr_t);
 
-    /** Decrement the appropriate ref count, and run the appropriate release
-        action. Note: this does _not_ set the raw pointer to null.
+    /**
+     * Decrement the appropriate ref count, and run the appropriate release
+     * action. Note: this does _not_ set the raw pointer to null.
      */
     void
     unsafeReleaseNoStore();
@@ -435,12 +484,13 @@ private:
 
 //------------------------------------------------------------------------------
 
-/** Create a shared intrusive pointer.
-
-    Note: unlike std::shared_ptr, where there is an advantage of allocating
-    the pointer and control block together, there is no benefit for intrusive
-    pointers.
-*/
+/**
+ * Create a shared intrusive pointer.
+ *
+ * Note: unlike std::shared_ptr, where there is an advantage of allocating
+ * the pointer and control block together, there is no benefit for intrusive
+ * pointers.
+ */
 template <class TT, class... Args>
 SharedIntrusive<TT>
 makeSharedIntrusive(Args&&... args)
diff --git a/include/xrpl/basics/IntrusiveRefCounts.h b/include/xrpl/basics/IntrusiveRefCounts.h
index 5eb1422541..caa06ed786 100644
--- a/include/xrpl/basics/IntrusiveRefCounts.h
+++ b/include/xrpl/basics/IntrusiveRefCounts.h
@@ -8,35 +8,38 @@
 
 namespace xrpl {
 
-/** Action to perform when releasing a strong pointer.
-
-    noop: Do nothing. For example, a `noop` action will occur when a count is
-    decremented to a non-zero value.
-
-    partialDestroy: Run the `partialDestructor`. This action will happen when a
-    strong count is decremented to zero and the weak count is non-zero.
-
-    destroy: Run the destructor. This action will occur when either the strong
-    count or weak count is decremented and the other count is also zero.
+/**
+ * Action to perform when releasing a strong pointer.
+ *
+ * noop: Do nothing. For example, a `noop` action will occur when a count is
+ * decremented to a non-zero value.
+ *
+ * partialDestroy: Run the `partialDestructor`. This action will happen when a
+ * strong count is decremented to zero and the weak count is non-zero.
+ *
+ * destroy: Run the destructor. This action will occur when either the strong
+ * count or weak count is decremented and the other count is also zero.
  */
 enum class ReleaseStrongRefAction { NoOp, PartialDestroy, Destroy };
 
-/** Action to perform when releasing a weak pointer.
-
-    noop: Do nothing. For example, a `noop` action will occur when a count is
-    decremented to a non-zero value.
-
-    destroy: Run the destructor. This action will occur when either the strong
-    count or weak count is decremented and the other count is also zero.
+/**
+ * Action to perform when releasing a weak pointer.
+ *
+ * noop: Do nothing. For example, a `noop` action will occur when a count is
+ * decremented to a non-zero value.
+ *
+ * destroy: Run the destructor. This action will occur when either the strong
+ * count or weak count is decremented and the other count is also zero.
  */
 enum class ReleaseWeakRefAction { NoOp, Destroy };
 
-/** Implement the strong count, weak count, and bit flags for an intrusive
-    pointer.
-
-    A class can satisfy the requirements of an xrpl::IntrusivePointer by
-    inheriting from this class.
-  */
+/**
+ * Implement the strong count, weak count, and bit flags for an intrusive
+ * pointer.
+ *
+ * A class can satisfy the requirements of an xrpl::IntrusivePointer by
+ * inheriting from this class.
+ */
 struct IntrusiveRefCounts
 {
     virtual ~IntrusiveRefCounts() noexcept;
@@ -105,109 +108,123 @@ private:
     static constexpr size_t kFieldTypeBits = sizeof(FieldType) * 8;
     static constexpr FieldType kOne = 1;
 
-    /** `refCounts` consists of four fields that are treated atomically:
-
-         1. Strong count. This is a count of the number of shared pointers that
-         hold a reference to this object. When the strong counts goes to zero,
-         if the weak count is zero, the destructor is run. If the weak count is
-         non-zero when the strong count goes to zero then the partialDestructor
-         is run.
-
-         2. Weak count. This is a count of the number of weak pointer that hold
-         a reference to this object. When the weak count goes to zero and the
-         strong count is also zero, then the destructor is run.
-
-         3. Partial destroy started bit. This bit is set if the
-         `partialDestructor` function has been started (or is about to be
-         started). This is used to prevent the destructor from running
-         concurrently with the partial destructor. This can easily happen when
-         the last strong pointer release its reference in one thread and starts
-         the partialDestructor, while in another thread the last weak pointer
-         goes out of scope and starts the destructor while the partialDestructor
-         is still running. Both a start and finished bit is needed to handle a
-         corner-case where the last strong pointer goes out of scope, then then
-         last `weakPointer` goes out of scope, but this happens before the
-         `partialDestructor` bit is set. It would be possible to use a single
-         bit if it could also be set atomically when the strong count goes to
-         zero and the weak count is non-zero, but that would add complexity (and
-         likely slow down common cases as well).
-
-         4. Partial destroy finished bit. This bit is set when the
-         `partialDestructor` has finished running. See (3) above for more
-         information.
-
-         */
+    /**
+     * `refCounts` consists of four fields that are treated atomically:
+     *
+     * 1. Strong count. This is a count of the number of shared pointers that
+     * hold a reference to this object. When the strong counts goes to zero,
+     * if the weak count is zero, the destructor is run. If the weak count is
+     * non-zero when the strong count goes to zero then the partialDestructor
+     * is run.
+     *
+     * 2. Weak count. This is a count of the number of weak pointer that hold
+     * a reference to this object. When the weak count goes to zero and the
+     * strong count is also zero, then the destructor is run.
+     *
+     * 3. Partial destroy started bit. This bit is set if the
+     * `partialDestructor` function has been started (or is about to be
+     * started). This is used to prevent the destructor from running
+     * concurrently with the partial destructor. This can easily happen when
+     * the last strong pointer release its reference in one thread and starts
+     * the partialDestructor, while in another thread the last weak pointer
+     * goes out of scope and starts the destructor while the partialDestructor
+     * is still running. Both a start and finished bit is needed to handle a
+     * corner-case where the last strong pointer goes out of scope, then then
+     * last `weakPointer` goes out of scope, but this happens before the
+     * `partialDestructor` bit is set. It would be possible to use a single
+     * bit if it could also be set atomically when the strong count goes to
+     * zero and the weak count is non-zero, but that would add complexity (and
+     * likely slow down common cases as well).
+     *
+     * 4. Partial destroy finished bit. This bit is set when the
+     * `partialDestructor` has finished running. See (3) above for more
+     * information.
+     */
 
     mutable std::atomic<FieldType> refCounts_{kStrongDelta};
 
-    /**  Amount to change the strong count when adding or releasing a reference
-
-         Note: The strong count is stored in the low `StrongCountNumBits` bits
-       of refCounts
-      */
+    /**
+     * Amount to change the strong count when adding or releasing a reference
+     *
+     *   Note: The strong count is stored in the low `StrongCountNumBits` bits
+     * of refCounts
+     */
     static constexpr FieldType kStrongDelta = 1;
 
-    /**  Amount to change the weak count when adding or releasing a reference
-
-         Note: The weak count is stored in the high `WeakCountNumBits` bits of
-         refCounts
-      */
+    /**
+     * Amount to change the weak count when adding or releasing a reference
+     *
+     * Note: The weak count is stored in the high `WeakCountNumBits` bits of
+     * refCounts
+     */
     static constexpr FieldType kWeakDelta = (kOne << kStrongCountNumBits);
 
-    /**  Flag that is set when the partialDestroy function has started running
-         (or is about to start running).
-
-         See description of the `refCounts` field for a fuller description of
-         this field.
-      */
+    /**
+     * Flag that is set when the partialDestroy function has started running
+     * (or is about to start running).
+     *
+     * See description of the `refCounts` field for a fuller description of
+     * this field.
+     */
     static constexpr FieldType kPartialDestroyStartedMask = (kOne << (kFieldTypeBits - 1));
 
-    /**  Flag that is set when the partialDestroy function has finished running
-
-         See description of the `refCounts` field for a fuller description of
-         this field.
-      */
+    /**
+     * Flag that is set when the partialDestroy function has finished running
+     *
+     * See description of the `refCounts` field for a fuller description of
+     * this field.
+     */
     static constexpr FieldType kPartialDestroyFinishedMask = (kOne << (kFieldTypeBits - 2));
 
-    /** Mask that will zero out all the `count` bits and leave the tag bits
-        unchanged.
-      */
+    /**
+     * Mask that will zero out all the `count` bits and leave the tag bits
+     * unchanged.
+     */
     static constexpr FieldType kTagMask = kPartialDestroyStartedMask | kPartialDestroyFinishedMask;
 
-    /** Mask that will zero out the `tag` bits and leave the count bits
-        unchanged.
-      */
+    /**
+     * Mask that will zero out the `tag` bits and leave the count bits
+     * unchanged.
+     */
     static constexpr FieldType kValueMask = ~kTagMask;
 
-    /** Mask that will zero out everything except the strong count.
+    /**
+     * Mask that will zero out everything except the strong count.
      */
     static constexpr FieldType kStrongMask = ((kOne << kStrongCountNumBits) - 1) & kValueMask;
 
-    /** Mask that will zero out everything except the weak count.
+    /**
+     * Mask that will zero out everything except the weak count.
      */
     static constexpr FieldType kWeakMask =
         (((kOne << kWeakCountNumBits) - 1) << kStrongCountNumBits) & kValueMask;
 
-    /** Unpack the count and tag fields from the packed atomic integer form. */
+    /**
+     * Unpack the count and tag fields from the packed atomic integer form.
+     */
     struct RefCountPair
     {
         CountType strong;
         CountType weak;
-        /**  The `partialDestroyStartedBit` is set to on when the partial
-             destroy function is started. It is not a boolean; it is a uint32
-             with all bits zero with the possible exception of the
-             `partialDestroyStartedMask` bit. This is done so it can be directly
-             masked into the `combinedValue`.
+        /**
+         * The `partialDestroyStartedBit` is set to on when the partial
+         * destroy function is started. It is not a boolean; it is a uint32
+         * with all bits zero with the possible exception of the
+         * `partialDestroyStartedMask` bit. This is done so it can be directly
+         * masked into the `combinedValue`.
          */
         FieldType partialDestroyStartedBit{0};
-        /**  The `partialDestroyFinishedBit` is set to on when the partial
-             destroy function has finished.
+        /**
+         * The `partialDestroyFinishedBit` is set to on when the partial
+         * destroy function has finished.
          */
         FieldType partialDestroyFinishedBit{0};
         RefCountPair(FieldType v) noexcept;
         RefCountPair(CountType s, CountType w) noexcept;
 
-        /** Convert back to the packed integer form. */
+        /**
+         * Convert back to the packed integer form.
+         */
         [[nodiscard]] FieldType
         combinedValue() const noexcept;
 
@@ -215,9 +232,10 @@ private:
             static_cast<CountType>((kOne << kStrongCountNumBits) - 1);
         static constexpr CountType kMaxWeakValue =
             static_cast<CountType>((kOne << kWeakCountNumBits) - 1);
-        /**  Put an extra margin to detect when running up against limits.
-             This is only used in debug code, and is useful if we reduce the
-             number of bits in the strong and weak counts (to 16 and 14 bits).
+        /**
+         * Put an extra margin to detect when running up against limits.
+         * This is only used in debug code, and is useful if we reduce the
+         * number of bits in the strong and weak counts (to 16 and 14 bits).
          */
         static constexpr CountType kCheckStrongMaxValue = kMaxStrongValue - 32;
         static constexpr CountType kCheckWeakMaxValue = kMaxWeakValue - 32;
diff --git a/include/xrpl/basics/LocalValue.h b/include/xrpl/basics/LocalValue.h
index 1c2a657a18..c5e544a343 100644
--- a/include/xrpl/basics/LocalValue.h
+++ b/include/xrpl/basics/LocalValue.h
@@ -70,11 +70,15 @@ public:
     {
     }
 
-    /** Stores instance of T specific to the calling coroutine or thread. */
+    /**
+     * Stores instance of T specific to the calling coroutine or thread.
+     */
     T&
     operator*();
 
-    /** Stores instance of T specific to the calling coroutine or thread. */
+    /**
+     * Stores instance of T specific to the calling coroutine or thread.
+     */
     T*
     operator->()
     {
diff --git a/include/xrpl/basics/Log.h b/include/xrpl/basics/Log.h
index 4e3437fe71..945dc1b4ec 100644
--- a/include/xrpl/basics/Log.h
+++ b/include/xrpl/basics/Log.h
@@ -16,7 +16,9 @@
 
 namespace xrpl {
 
-/** Manages partitions for logging. */
+/**
+ * Manages partitions for logging.
+ */
 class Logs
 {
 private:
@@ -40,69 +42,81 @@ private:
         writeAlways(beast::Severity level, std::string const& text) override;
     };
 
-    /** Manages a system file containing logged output.
-        The system file remains open during program execution. Interfaces
-        are provided for interoperating with standard log management
-        tools like logrotate(8):
-            http://linuxcommand.org/man_pages/logrotate8.html
-        @note None of the listed interfaces are thread-safe.
-    */
+    /**
+     * Manages a system file containing logged output.
+     * The system file remains open during program execution. Interfaces
+     * are provided for interoperating with standard log management
+     * tools like logrotate(8):
+     *     http://linuxcommand.org/man_pages/logrotate8.html
+     * @note None of the listed interfaces are thread-safe.
+     */
     class File
     {
     public:
-        /** Construct with no associated system file.
-            A system file may be associated later with @ref open.
-            @see open
-        */
+        /**
+         * Construct with no associated system file.
+         * A system file may be associated later with @ref open.
+         * @see open
+         */
         File();
 
-        /** Destroy the object.
-            If a system file is associated, it will be flushed and closed.
-        */
+        /**
+         * Destroy the object.
+         * If a system file is associated, it will be flushed and closed.
+         */
         ~File() = default;
 
-        /** Determine if a system file is associated with the log.
-            @return `true` if a system file is associated and opened for
-            writing.
-        */
+        /**
+         * Determine if a system file is associated with the log.
+         * @return `true` if a system file is associated and opened for
+         * writing.
+         */
         [[nodiscard]] bool
         isOpen() const noexcept;
 
-        /** Associate a system file with the log.
-            If the file does not exist an attempt is made to create it
-            and open it for writing. If the file already exists an attempt is
-            made to open it for appending.
-            If a system file is already associated with the log, it is closed
-            first.
-            @return `true` if the file was opened.
-        */
+        /**
+         * Associate a system file with the log.
+         * If the file does not exist an attempt is made to create it
+         * and open it for writing. If the file already exists an attempt is
+         * made to open it for appending.
+         * If a system file is already associated with the log, it is closed
+         * first.
+         * @return `true` if the file was opened.
+         */
         bool
         open(boost::filesystem::path const& path);
 
-        /** Close and re-open the system file associated with the log
-            This assists in interoperating with external log management tools.
-            @return `true` if the file was opened.
-        */
+        /**
+         * Close and re-open the system file associated with the log
+         * This assists in interoperating with external log management tools.
+         * @return `true` if the file was opened.
+         */
         bool
         closeAndReopen();
 
-        /** Close the system file if it is open. */
+        /**
+         * Close the system file if it is open.
+         */
         void
         close();
 
-        /** write to the log file.
-            Does nothing if there is no associated system file.
-        */
+        /**
+         * write to the log file.
+         * Does nothing if there is no associated system file.
+         */
         void
         write(char const* text);
 
-        /** write to the log file and append an end of line marker.
-            Does nothing if there is no associated system file.
-        */
+        /**
+         * write to the log file and append an end of line marker.
+         * Does nothing if there is no associated system file.
+         */
         void
         writeln(char const* text);
 
-        /** Write to the log file using std::string. */
+        /**
+         * Write to the log file using std::string.
+         */
         /** @{ */
         void
         write(std::string const& str)
@@ -223,19 +237,21 @@ private:
 //------------------------------------------------------------------------------
 // Debug logging:
 
-/** Set the sink for the debug journal.
-
-    @param sink unique_ptr to new debug Sink.
-    @return unique_ptr to the previous Sink.  nullptr if there was no Sink.
-*/
+/**
+ * Set the sink for the debug journal.
+ *
+ * @param sink unique_ptr to new debug Sink.
+ * @return unique_ptr to the previous Sink.  nullptr if there was no Sink.
+ */
 std::unique_ptr<beast::Journal::Sink>
 setDebugLogSink(std::unique_ptr<beast::Journal::Sink> sink);
 
-/** Returns a debug journal.
-    The journal may drain to a null sink, so its output
-    may never be seen. Never use it for critical
-    information.
-*/
+/**
+ * Returns a debug journal.
+ * The journal may drain to a null sink, so its output
+ * may never be seen. Never use it for critical
+ * information.
+ */
 beast::Journal
 debugLog();
 
diff --git a/include/xrpl/basics/MathUtilities.h b/include/xrpl/basics/MathUtilities.h
index 4552b335e1..78f5c76988 100644
--- a/include/xrpl/basics/MathUtilities.h
+++ b/include/xrpl/basics/MathUtilities.h
@@ -6,7 +6,8 @@
 
 namespace xrpl {
 
-/** Calculate one number divided by another number in percentage.
+/**
+ * Calculate one number divided by another number in percentage.
  * The result is rounded up to the next integer, and capped in the range [0,100]
  * E.g. calculatePercent(1, 100) = 1 because 1/100 = 0.010000
  *      calculatePercent(1, 99) = 2 because 1/99 = 0.010101
@@ -19,7 +20,7 @@ namespace xrpl {
  * @return the percentage, in [0, 100]
  *
  * @note total cannot be zero.
- * */
+ */
 constexpr std::size_t
 calculatePercent(std::size_t count, std::size_t total)
 {
diff --git a/include/xrpl/basics/Number.h b/include/xrpl/basics/Number.h
index 28c7b1dbda..0026e7f006 100644
--- a/include/xrpl/basics/Number.h
+++ b/include/xrpl/basics/Number.h
@@ -47,7 +47,8 @@ isPowerOfTen(T value)
 
 namespace detail {
 
-/** Builds a table of the powers of 10
+/**
+ * Builds a table of the powers of 10
  *
  * This function is marked consteval, so it can only be run in
  * a constexpr context. This assures that it is and can only be run at
@@ -92,7 +93,8 @@ static_assert(kPowerOfTen[10] == 10'000'000'000);
 static_assert(
     isPowerOfTen(kPowerOfTen.back()) && *logTen(kPowerOfTen.back()) == detail::kUint64Digits - 1);
 
-/** MantissaRange defines a range for the mantissa of a normalized Number.
+/**
+ * MantissaRange defines a range for the mantissa of a normalized Number.
  *
  * The mantissa is in the range [min, max], where
  * * min is a power of 10, and
@@ -247,7 +249,8 @@ private:
 template <class T>
 concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::uint64_t>;
 
-/** Number is a floating point type that can represent a wide range of values.
+/**
+ * Number is a floating point type that can represent a wide range of values.
  *
  * It can represent all values that can be represented by an STAmount -
  * regardless of asset type - XRPAmount, MPTAmount, and IOUAmount, with at least
@@ -343,7 +346,6 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  * disable the amendments that control the mantissa range choice
  * (SingleAssetVault and LendingProtocol), and/or check if either of those
  * amendments are enabled to determine which result to expect.
- *
  */
 class Number final
 {
@@ -429,10 +431,11 @@ public:
     static Number
     lowest() noexcept;
 
-    /** Conversions to Number are implicit and conversions away from Number
-     *  are explicit. This design encourages and facilitates the use of Number
-     *  as the preferred type for floating point arithmetic as it makes
-     *  "mixed mode" more convenient, e.g. MPTAmount + Number.
+    /**
+     * Conversions to Number are implicit and conversions away from Number
+     * are explicit. This design encourages and facilitates the use of Number
+     * as the preferred type for floating point arithmetic as it makes
+     * "mixed mode" more convenient, e.g. MPTAmount + Number.
      */
     explicit
     operator rep() const;  // round to nearest, even on tie
@@ -487,7 +490,9 @@ public:
         return l.mantissa_ < r.mantissa_;
     }
 
-    /** Return the sign of the amount */
+    /**
+     * Return the sign of the amount
+     */
     [[nodiscard]] constexpr int
     signum() const noexcept
     {
@@ -541,14 +546,16 @@ public:
     static RoundingMode
     setround(RoundingMode inMode);
 
-    /** Returns which mantissa scale is currently in use for normalization.
+    /**
+     * Returns which mantissa scale is currently in use for normalization.
      *
      * If you think you need to call this outside of unit tests, no you don't.
      */
     static MantissaRange::MantissaScale
     getMantissaScale();
 
-    /** Changes which mantissa scale is used for normalization.
+    /**
+     * Changes which mantissa scale is used for normalization.
      *
      * If you think you need to call this outside of unit tests, no you don't.
      */
@@ -602,7 +609,8 @@ private:
     void
     normalize(Guard const& guard);
 
-    /** Normalize Number components to an arbitrary range.
+    /**
+     * Normalize Number components to an arbitrary range.
      *
      * min/maxMantissa are parameters because this function is used by both
      * normalize(), which reads from kRange, and by normalizeToRange,
@@ -678,7 +686,8 @@ inline Number::Number(rep mantissa) : Number{mantissa, 0}
 {
 }
 
-/** Returns the mantissa of the external view of the Number.
+/**
+ * Returns the mantissa of the external view of the Number.
  *
  * Please see the "---- External Interface ----" section of the class
  * documentation for an explanation of why the internal value may be modified.
@@ -699,7 +708,8 @@ Number::mantissa() const noexcept
     return sign * static_cast<Number::rep>(m);
 }
 
-/** Returns the exponent of the external view of the Number.
+/**
+ * Returns the exponent of the external view of the Number.
  *
  * Please see the "---- External Interface ----" section of the class
  * documentation for an explanation of why the internal value may be modified.
@@ -948,10 +958,10 @@ public:
     operator=(NumberRoundModeGuard const&) = delete;
 };
 
-/** Sets the new scale and restores the old scale when it leaves scope.
+/**
+ * Sets the new scale and restores the old scale when it leaves scope.
  *
  * If you think you need to use this class outside of unit tests, no you don't.
- *
  */
 class NumberMantissaScaleGuard
 {
diff --git a/include/xrpl/basics/RangeSet.h b/include/xrpl/basics/RangeSet.h
index 2ed543b376..3de882979e 100644
--- a/include/xrpl/basics/RangeSet.h
+++ b/include/xrpl/basics/RangeSet.h
@@ -13,23 +13,25 @@
 
 namespace xrpl {
 
-/** A closed interval over the domain T.
-
-    For an instance ClosedInterval c, this represents the closed interval
-    (c.first(), c.last()).  A single element interval has c.first() == c.last().
-
-    This is simply a type-alias for boost interval container library interval
-    set, so users should consult that documentation for available supporting
-    member and free functions.
-*/
+/**
+ * A closed interval over the domain T.
+ *
+ * For an instance ClosedInterval c, this represents the closed interval
+ * (c.first(), c.last()).  A single element interval has c.first() == c.last().
+ *
+ * This is simply a type-alias for boost interval container library interval
+ * set, so users should consult that documentation for available supporting
+ * member and free functions.
+ */
 template <class T>
 using ClosedInterval = boost::icl::closed_interval<T>;
 
-/** Create a closed range interval
-
-    Helper function to create a closed range interval without having to qualify
-    the template argument.
-*/
+/**
+ * Create a closed range interval
+ *
+ * Helper function to create a closed range interval without having to qualify
+ * the template argument.
+ */
 template <class T>
 ClosedInterval<T>
 range(T low, T high)
@@ -37,28 +39,30 @@ range(T low, T high)
     return ClosedInterval<T>(low, high);
 }
 
-/** A set of closed intervals over the domain T.
-
-    Represents a set of values of the domain T using the minimum number
-    of disjoint ClosedInterval<T>.  This is useful to represent ranges of
-    T where a few instances are missing, e.g. the set 1-5,8-9,11-14.
-
-    This is simply a type-alias for boost interval container library interval
-    set, so users should consult that documentation for available supporting
-    member and free functions.
-*/
+/**
+ * A set of closed intervals over the domain T.
+ *
+ * Represents a set of values of the domain T using the minimum number
+ * of disjoint ClosedInterval<T>.  This is useful to represent ranges of
+ * T where a few instances are missing, e.g. the set 1-5,8-9,11-14.
+ *
+ * This is simply a type-alias for boost interval container library interval
+ * set, so users should consult that documentation for available supporting
+ * member and free functions.
+ */
 template <class T>
 using RangeSet = boost::icl::interval_set<T, std::less, ClosedInterval<T>>;
 
-/** Convert a ClosedInterval to a styled string
-
-    The styled string is
-        "c.first()-c.last()"  if c.first() != c.last()
-        "c.first()" if c.first() == c.last()
-
-    @param ci The closed interval to convert
-    @return The style string
-*/
+/**
+ * Convert a ClosedInterval to a styled string
+ *
+ * The styled string is
+ *     "c.first()-c.last()"  if c.first() != c.last()
+ *     "c.first()" if c.first() == c.last()
+ *
+ * @param ci The closed interval to convert
+ * @return The style string
+ */
 template <class T>
 std::string
 to_string(ClosedInterval<T> const& ci)
@@ -68,14 +72,15 @@ to_string(ClosedInterval<T> const& ci)
     return std::to_string(ci.first()) + "-" + std::to_string(ci.last());
 }
 
-/** Convert the given RangeSet to a styled string.
-
-    The styled string representation is the set of disjoint intervals joined
-    by commas.  The string "empty" is returned if the set is empty.
-
-    @param rs The rangeset to convert
-    @return The styled string
-*/
+/**
+ * Convert the given RangeSet to a styled string.
+ *
+ * The styled string representation is the set of disjoint intervals joined
+ * by commas.  The string "empty" is returned if the set is empty.
+ *
+ * @param rs The rangeset to convert
+ * @return The styled string
+ */
 template <class T>
 std::string
 to_string(RangeSet<T> const& rs)
@@ -91,15 +96,16 @@ to_string(RangeSet<T> const& rs)
     return s;
 }
 
-/** Convert the given styled string to a RangeSet.
-
-    The styled string representation is the set
-    of disjoint intervals joined by commas.
-
-    @param rs The set to be populated
-    @param s The styled string to convert
-    @return True on successfully converting styled string
-*/
+/**
+ * Convert the given styled string to a RangeSet.
+ *
+ * The styled string representation is the set
+ * of disjoint intervals joined by commas.
+ *
+ * @param rs The set to be populated
+ * @param s The styled string to convert
+ * @return True on successfully converting styled string
+ */
 template <class T>
 [[nodiscard]] bool
 fromString(RangeSet<T>& rs, std::string const& s)
@@ -161,14 +167,15 @@ fromString(RangeSet<T>& rs, std::string const& s)
     return result;
 }
 
-/** Find the largest value not in the set that is less than a given value.
-
-    @param rs The set of interest
-    @param t The value that must be larger than the result
-    @param minVal (Default is 0) The smallest allowed value
-    @return The largest v such that minV <= v < t and !contains(rs, v) or
-            std::nullopt if no such v exists.
-*/
+/**
+ * Find the largest value not in the set that is less than a given value.
+ *
+ * @param rs The set of interest
+ * @param t The value that must be larger than the result
+ * @param minVal (Default is 0) The smallest allowed value
+ * @return The largest v such that minV <= v < t and !contains(rs, v) or
+ *         std::nullopt if no such v exists.
+ */
 template <class T>
 std::optional<T>
 prevMissing(RangeSet<T> const& rs, T t, T minVal = 0)
diff --git a/include/xrpl/basics/Resolver.h b/include/xrpl/basics/Resolver.h
index d48958b76d..239eb9630e 100644
--- a/include/xrpl/basics/Resolver.h
+++ b/include/xrpl/basics/Resolver.h
@@ -15,22 +15,29 @@ public:
 
     virtual ~Resolver() = 0;
 
-    /** Issue an asynchronous stop request. */
+    /**
+     * Issue an asynchronous stop request.
+     */
     virtual void
     stopAsync() = 0;
 
-    /** Issue a synchronous stop request. */
+    /**
+     * Issue a synchronous stop request.
+     */
     virtual void
     stop() = 0;
 
-    /** Issue a synchronous start request. */
+    /**
+     * Issue a synchronous start request.
+     */
     virtual void
     start() = 0;
 
-    /** resolve all hostnames on the list
-        @param names the names to be resolved
-        @param handler the handler to call
-    */
+    /**
+     * resolve all hostnames on the list
+     * @param names the names to be resolved
+     * @param handler the handler to call
+     */
     /** @{ */
     template <class Handler>
     void
diff --git a/include/xrpl/basics/SharedWeakCachePointer.h b/include/xrpl/basics/SharedWeakCachePointer.h
index a143647a1e..1b78af2fae 100644
--- a/include/xrpl/basics/SharedWeakCachePointer.h
+++ b/include/xrpl/basics/SharedWeakCachePointer.h
@@ -7,13 +7,14 @@
 
 namespace xrpl {
 
-/** A combination of a std::shared_ptr and a std::weak_pointer.
-
-
-This class is a wrapper to a `std::variant<std::shared_ptr,std::weak_ptr>`
-This class is useful for storing intrusive pointers in tagged caches using less
-memory than storing both pointers directly.
-*/
+/**
+ * A combination of a std::shared_ptr and a std::weak_pointer.
+ *
+ *
+ * This class is a wrapper to a `std::variant<std::shared_ptr,std::weak_ptr>`
+ * This class is useful for storing intrusive pointers in tagged caches using less
+ * memory than storing both pointers directly.
+ */
 
 template <class T>
 class SharedWeakCachePointer
@@ -48,65 +49,79 @@ public:
 
     ~SharedWeakCachePointer();
 
-    /** Return a strong pointer if this is already a strong pointer (i.e. don't
-        lock the weak pointer. Use the `lock` method if that's what's needed)
+    /**
+     * Return a strong pointer if this is already a strong pointer (i.e. don't
+     * lock the weak pointer. Use the `lock` method if that's what's needed)
      */
     [[nodiscard]] std::shared_ptr<T> const&
     getStrong() const;
 
-    /** Return true if this is a strong pointer and the strong pointer is
-        seated.
+    /**
+     * Return true if this is a strong pointer and the strong pointer is
+     * seated.
      */
     explicit
     operator bool() const noexcept;
 
-    /** Set the pointer to null, decrement the appropriate ref count, and run
-        the appropriate release action.
+    /**
+     * Set the pointer to null, decrement the appropriate ref count, and run
+     * the appropriate release action.
      */
     void
     reset();
 
-    /** If this is a strong pointer, return the raw pointer. Otherwise return
-        null.
+    /**
+     * If this is a strong pointer, return the raw pointer. Otherwise return
+     * null.
      */
     [[nodiscard]] T*
     get() const;
 
-    /** If this is a strong pointer, return the strong count. Otherwise return 0
+    /**
+     * If this is a strong pointer, return the strong count. Otherwise return 0
      */
     [[nodiscard]] std::size_t
     useCount() const;
 
-    /** Return true if there is a non-zero strong count. */
+    /**
+     * Return true if there is a non-zero strong count.
+     */
     [[nodiscard]] bool
     expired() const;
 
-    /** If this is a strong pointer, return the strong pointer. Otherwise
-        attempt to lock the weak pointer.
+    /**
+     * If this is a strong pointer, return the strong pointer. Otherwise
+     * attempt to lock the weak pointer.
      */
     [[nodiscard]] std::shared_ptr<T>
     lock() const;
 
-    /** Return true is this represents a strong pointer. */
+    /**
+     * Return true is this represents a strong pointer.
+     */
     [[nodiscard]] bool
     isStrong() const;
 
-    /** Return true is this represents a weak pointer. */
+    /**
+     * Return true is this represents a weak pointer.
+     */
     [[nodiscard]] bool
     isWeak() const;
 
-    /** If this is a weak pointer, attempt to convert it to a strong pointer.
-
-        @return true if successfully converted to a strong pointer (or was
-                already a strong pointer). Otherwise false.
-      */
+    /**
+     * If this is a weak pointer, attempt to convert it to a strong pointer.
+     *
+     * @return true if successfully converted to a strong pointer (or was
+     *         already a strong pointer). Otherwise false.
+     */
     bool
     convertToStrong();
 
-    /** If this is a strong pointer, attempt to convert it to a weak pointer.
-
-        @return false if the pointer is null. Otherwise return true.
-      */
+    /**
+     * If this is a strong pointer, attempt to convert it to a weak pointer.
+     *
+     * @return false if the pointer is null. Otherwise return true.
+     */
     bool
     convertToWeak();
 
diff --git a/include/xrpl/basics/SlabAllocator.h b/include/xrpl/basics/SlabAllocator.h
index 8e741991f6..7b6e88e8bc 100644
--- a/include/xrpl/basics/SlabAllocator.h
+++ b/include/xrpl/basics/SlabAllocator.h
@@ -33,7 +33,9 @@ class SlabAllocator
 
     static_assert(alignof(Type) == 8 || alignof(Type) == 4);
 
-    /** A block of memory that is owned by a slab allocator */
+    /**
+     * A block of memory that is owned by a slab allocator
+     */
     struct SlabBlock
     {
         // A mutex to protect the freelist for this block:
@@ -80,7 +82,9 @@ class SlabAllocator
         SlabBlock&
         operator=(SlabBlock&& other) = delete;
 
-        /** Determines whether the given pointer belongs to this allocator */
+        /**
+         * Determines whether the given pointer belongs to this allocator
+         */
         bool
         own(std::uint8_t const* pIn) const noexcept
         {
@@ -107,14 +111,15 @@ class SlabAllocator
             return ret;
         }
 
-        /** Return an item to this allocator's freelist.
-
-            @param ptr The pointer to the chunk of memory being deallocated.
-
-            @note This is a dangerous, private interface; the item being
-                  returned should belong to this allocator. Debug builds
-                  will check and assert if this is not the case. Release
-                  builds will not.
+        /**
+         * Return an item to this allocator's freelist.
+         *
+         * @param ptr The pointer to the chunk of memory being deallocated.
+         *
+         * @note This is a dangerous, private interface; the item being
+         *       returned should belong to this allocator. Debug builds
+         *       will check and assert if this is not the case. Release
+         *       builds will not.
          */
         void
         deallocate(std::uint8_t* ptr) noexcept
@@ -145,13 +150,14 @@ private:
     std::size_t const slabSize_;
 
 public:
-    /** Constructs a slab allocator able to allocate objects of a fixed size
-
-        @param count the number of items the slab allocator can allocate; note
-                     that a count of 0 is valid and means that the allocator
-                     is, effectively, disabled. This can be very useful in some
-                     contexts (e.g. when minimal memory usage is needed) and
-                     allows for graceful failure.
+    /**
+     * Constructs a slab allocator able to allocate objects of a fixed size
+     *
+     * @param count the number of items the slab allocator can allocate; note
+     *              that a count of 0 is valid and means that the allocator
+     *              is, effectively, disabled. This can be very useful in some
+     *              contexts (e.g. when minimal memory usage is needed) and
+     *              allows for graceful failure.
      */
     constexpr explicit SlabAllocator(
         std::size_t extra,
@@ -179,17 +185,20 @@ public:
     //        shutdown process up could make this possible.
     ~SlabAllocator() = default;
 
-    /** Returns the size of the memory block this allocator returns. */
+    /**
+     * Returns the size of the memory block this allocator returns.
+     */
     [[nodiscard]] constexpr std::size_t
     size() const noexcept
     {
         return itemSize_;
     }
 
-    /** Returns a suitably aligned pointer, if one is available.
-
-        @return a pointer to a block of memory from the allocator, or
-                nullptr if the allocator can't satisfy this request.
+    /**
+     * Returns a suitably aligned pointer, if one is available.
+     *
+     * @return a pointer to a block of memory from the allocator, or
+     *         nullptr if the allocator can't satisfy this request.
      */
     std::uint8_t*
     allocate() noexcept
@@ -250,12 +259,13 @@ public:
         return slab->allocate();
     }
 
-    /** Returns the memory block to the allocator.
-
-        @param ptr A pointer to a memory block.
-        @param size If non-zero, a hint as to the size of the block.
-        @return true if this memory block belonged to the allocator and has
-                     been released; false otherwise.
+    /**
+     * Returns the memory block to the allocator.
+     *
+     * @param ptr A pointer to a memory block.
+     * @param size If non-zero, a hint as to the size of the block.
+     * @return true if this memory block belonged to the allocator and has
+     *              been released; false otherwise.
      */
     bool
     deallocate(std::uint8_t* ptr) noexcept
@@ -278,7 +288,9 @@ public:
     }
 };
 
-/** A collection of slab allocators of various sizes for a given type. */
+/**
+ * A collection of slab allocators of various sizes for a given type.
+ */
 template <typename Type>
 class SlabAllocatorSet
 {
@@ -345,13 +357,14 @@ public:
 
     ~SlabAllocatorSet() = default;
 
-    /** Returns a suitably aligned pointer, if one is available.
-
-        @param extra The number of extra bytes, above and beyond the size of
-                     the object, that should be returned by the allocator.
-
-        @return a pointer to a block of memory, or nullptr if the allocator
-                can't satisfy this request.
+    /**
+     * Returns a suitably aligned pointer, if one is available.
+     *
+     * @param extra The number of extra bytes, above and beyond the size of
+     *              the object, that should be returned by the allocator.
+     *
+     * @return a pointer to a block of memory, or nullptr if the allocator
+     *         can't satisfy this request.
      */
     std::uint8_t*
     allocate(std::size_t extra) noexcept
@@ -368,12 +381,13 @@ public:
         return nullptr;
     }
 
-    /** Returns the memory block to the allocator.
-
-        @param ptr A pointer to a memory block.
-
-        @return true if this memory block belonged to one of the allocators
-                     in this set and has been released; false otherwise.
+    /**
+     * Returns the memory block to the allocator.
+     *
+     * @param ptr A pointer to a memory block.
+     *
+     * @return true if this memory block belonged to one of the allocators
+     *              in this set and has been released; false otherwise.
      */
     bool
     deallocate(std::uint8_t* ptr) noexcept
diff --git a/include/xrpl/basics/Slice.h b/include/xrpl/basics/Slice.h
index f87ca063b8..36e7615c3a 100644
--- a/include/xrpl/basics/Slice.h
+++ b/include/xrpl/basics/Slice.h
@@ -16,12 +16,13 @@
 
 namespace xrpl {
 
-/** An immutable linear range of bytes.
-
-    A fully constructed Slice is guaranteed to be in a valid state.
-    A Slice is lightweight and copyable, it retains no ownership
-    of the underlying memory.
-*/
+/**
+ * An immutable linear range of bytes.
+ *
+ * A fully constructed Slice is guaranteed to be in a valid state.
+ * A Slice is lightweight and copyable, it retains no ownership
+ * of the underlying memory.
+ */
 class Slice
 {
 private:
@@ -32,30 +33,37 @@ public:
     using value_type = std::uint8_t;
     using const_iterator = value_type const*;
 
-    /** Default constructed Slice has length 0. */
+    /**
+     * Default constructed Slice has length 0.
+     */
     Slice() noexcept = default;
 
     Slice(Slice const&) noexcept = default;
     Slice&
     operator=(Slice const&) noexcept = default;
 
-    /** Create a slice pointing to existing memory. */
+    /**
+     * Create a slice pointing to existing memory.
+     */
     Slice(void const* data, std::size_t size) noexcept
         : data_(reinterpret_cast<std::uint8_t const*>(data)), size_(size)
     {
     }
 
-    /** Return `true` if the byte range is empty. */
+    /**
+     * Return `true` if the byte range is empty.
+     */
     [[nodiscard]] bool
     empty() const noexcept
     {
         return size_ == 0;
     }
 
-    /** Returns the number of bytes in the storage.
-
-        This may be zero for an empty range.
-    */
+    /**
+     * Returns the number of bytes in the storage.
+     *
+     * This may be zero for an empty range.
+     */
     /** @{ */
     [[nodiscard]] std::size_t
     size() const noexcept
@@ -70,17 +78,20 @@ public:
     }
     /** @} */
 
-    /** Return a pointer to beginning of the storage.
-        @note The return type is guaranteed to be a pointer
-              to a single byte, to facilitate pointer arithmetic.
-    */
+    /**
+     * Return a pointer to beginning of the storage.
+     * @note The return type is guaranteed to be a pointer
+     *       to a single byte, to facilitate pointer arithmetic.
+     */
     [[nodiscard]] std::uint8_t const*
     data() const noexcept
     {
         return data_;
     }
 
-    /** Access raw bytes. */
+    /**
+     * Access raw bytes.
+     */
     std::uint8_t
     operator[](std::size_t i) const noexcept
     {
@@ -88,7 +99,9 @@ public:
         return data_[i];
     }
 
-    /** Advance the buffer. */
+    /**
+     * Advance the buffer.
+     */
     /** @{ */
     Slice&
     operator+=(std::size_t n)
@@ -108,7 +121,9 @@ public:
     }
     /** @} */
 
-    /** Shrinks the slice by moving its start forward by n characters. */
+    /**
+     * Shrinks the slice by moving its start forward by n characters.
+     */
     void
     removePrefix(std::size_t n)
     {
@@ -116,7 +131,9 @@ public:
         size_ -= n;
     }
 
-    /** Shrinks the slice by moving its end backward by n characters. */
+    /**
+     * Shrinks the slice by moving its end backward by n characters.
+     */
     void
     removeSuffix(std::size_t n)
     {
@@ -147,16 +164,17 @@ public:
         return data_ + size_;
     }
 
-    /** Return a "sub slice" of given length starting at the given position
-
-        Note that the subslice encompasses the range [pos, pos + rCount),
-        where rCount is the smaller of count and size() - pos.
-
-        @param pos position of the first character
-        @count requested length
-
-        @returns The requested subslice, if the request is valid.
-        @throws std::out_of_range if pos > size()
+    /**
+     * Return a "sub slice" of given length starting at the given position
+     *
+     * Note that the subslice encompasses the range [pos, pos + rCount),
+     * where rCount is the smaller of count and size() - pos.
+     *
+     * @param pos position of the first character
+     * @count requested length
+     *
+     * @return The requested subslice, if the request is valid.
+     * @throws std::out_of_range if pos > size()
      */
     [[nodiscard]] Slice
     substr(std::size_t pos, std::size_t count = std::numeric_limits<std::size_t>::max()) const
diff --git a/include/xrpl/basics/StringUtilities.h b/include/xrpl/basics/StringUtilities.h
index 97df43d68f..2b360d2fda 100644
--- a/include/xrpl/basics/StringUtilities.h
+++ b/include/xrpl/basics/StringUtilities.h
@@ -17,15 +17,16 @@
 
 namespace xrpl {
 
-/** Format arbitrary binary data as an SQLite "blob literal".
-
-    In SQLite, blob literals must be encoded when used in a query. Per
-    https://sqlite.org/lang_expr.html#literal_values_constants_ they are
-    encoded as string literals containing hexadecimal data and preceded
-    by a single 'X' character.
-
-    @param blob An arbitrary blob of binary data
-    @return The input, encoded as a blob literal.
+/**
+ * Format arbitrary binary data as an SQLite "blob literal".
+ *
+ * In SQLite, blob literals must be encoded when used in a query. Per
+ * https://sqlite.org/lang_expr.html#literal_values_constants_ they are
+ * encoded as string literals containing hexadecimal data and preceded
+ * by a single 'X' character.
+ *
+ * @param blob An arbitrary blob of binary data
+ * @return The input, encoded as a blob literal.
  */
 std::string
 sqlBlobLiteral(Blob const& blob);
@@ -130,11 +131,12 @@ trimWhitespace(std::string str);
 std::optional<std::uint64_t>
 toUInt64(std::string const& s);
 
-/** Determines if the given string looks like a TOML-file hosting domain.
-
-    Do not use this function to determine if a particular string is a valid
-    domain, as this function may reject domains that are otherwise valid and
-    doesn't check whether the TLD is valid.
+/**
+ * Determines if the given string looks like a TOML-file hosting domain.
+ *
+ * Do not use this function to determine if a particular string is a valid
+ * domain, as this function may reject domains that are otherwise valid and
+ * doesn't check whether the TLD is valid.
  */
 bool
 isProperlyFormedTomlDomain(std::string_view domain);
diff --git a/include/xrpl/basics/TaggedCache.h b/include/xrpl/basics/TaggedCache.h
index 16c87cf833..7bb2cb552b 100644
--- a/include/xrpl/basics/TaggedCache.h
+++ b/include/xrpl/basics/TaggedCache.h
@@ -41,18 +41,19 @@ struct ReplaceDynamically;
 
 }  // namespace detail
 
-/** Map/cache combination.
-    This class implements a cache and a map. The cache keeps objects alive
-    in the map. The map allows multiple code paths that reference objects
-    with the same tag to get the same actual object.
-
-    So long as data is in the cache, it will stay in memory.
-    If it stays in memory even after it is ejected from the cache,
-    the map will track it.
-
-    @note Callers must not modify data objects that are stored in the cache
-          unless they hold their own lock over all cache operations.
-*/
+/**
+ * Map/cache combination.
+ * This class implements a cache and a map. The cache keeps objects alive
+ * in the map. The map allows multiple code paths that reference objects
+ * with the same tag to get the same actual object.
+ *
+ * So long as data is in the cache, it will stay in memory.
+ * If it stays in memory even after it is ejected from the cache,
+ * the map will track it.
+ *
+ * @note Callers must not modify data objects that are stored in the cache
+ *       unless they hold their own lock over all cache operations.
+ */
 template <
     class Key,
     class T,
@@ -82,11 +83,15 @@ public:
         beast::insight::Collector::ptr const& collector = beast::insight::NullCollector::make());
 
 public:
-    /** Return the clock associated with the cache. */
+    /**
+     * Return the clock associated with the cache.
+     */
     clock_type&
     clock();
 
-    /** Returns the number of items in the container. */
+    /**
+     * Returns the number of items in the container.
+     */
     std::size_t
     size() const;
 
@@ -105,9 +110,10 @@ public:
     void
     reset();
 
-    /** Refresh the last access time on a key if present.
-        @return `true` If the key was found.
-    */
+    /**
+     * Refresh the last access time on a key if present.
+     * @return `true` If the key was found.
+     */
     template <class KeyComparable>
     bool
     touchIfExists(KeyComparable const& key);
@@ -130,14 +136,15 @@ private:
         SharedPointerType const&,
         SharedPointerType&>;
 
-    /** Shared implementation of the canonicalize family.
-
-        `policy` selects how a collision is resolved when `key` already exists:
-        detail::ReplaceCached, detail::ReplaceClient or
-        detail::ReplaceDynamically. For ReplaceDynamically `replaceCallback` is
-        invoked with the existing strong pointer and returns whether to replace
-        the cached value with `data`; for the tag policies it is unused.
-    */
+    /**
+     * Shared implementation of the canonicalize family.
+     *
+     * `policy` selects how a collision is resolved when `key` already exists:
+     * detail::ReplaceCached, detail::ReplaceClient or
+     * detail::ReplaceDynamically. For ReplaceDynamically `replaceCallback` is
+     * invoked with the existing strong pointer and returns whether to replace
+     * the cached value with `data`; for the tag policies it is unused.
+     */
     template <class Policy, class Callback = std::nullptr_t>
     bool
     canonicalizeImpl(
@@ -147,69 +154,73 @@ private:
         Callback&& replaceCallback = nullptr);
 
 public:
-    /** Replace aliased objects with originals.
-
-        Due to concurrency it is possible for two separate objects with
-        the same content and referring to the same unique "thing" to exist.
-        This routine eliminates the duplicate and performs a replacement
-        on the callers shared pointer if needed.
-
-        `replaceCallback` is a callable taking the existing strong pointer and
-        returning whether to replace the cached value with `data` (true) or to
-        keep the cached value and write it back into `data` (false). Because the
-        write-back case mutates `data`, `data` must be writable.
-
-        @param key The key corresponding to the object
-        @param data A shared pointer to the data corresponding to the object.
-        @param replaceCallback A callable (existing strong pointer -> bool).
-
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
+    /**
+     * Replace aliased objects with originals.
+     *
+     * Due to concurrency it is possible for two separate objects with
+     * the same content and referring to the same unique "thing" to exist.
+     * This routine eliminates the duplicate and performs a replacement
+     * on the callers shared pointer if needed.
+     *
+     * `replaceCallback` is a callable taking the existing strong pointer and
+     * returning whether to replace the cached value with `data` (true) or to
+     * keep the cached value and write it back into `data` (false). Because the
+     * write-back case mutates `data`, `data` must be writable.
+     *
+     * @param key The key corresponding to the object
+     * @param data A shared pointer to the data corresponding to the object.
+     * @param replaceCallback A callable (existing strong pointer -> bool).
+     *
+     * @return `true` if an existing live entry was found and used; `false` if a new entry was
+     *         inserted or an expired tracked entry was re-cached.
+     */
     template <class Callback>
     bool
     canonicalize(key_type const& key, SharedPointerType& data, Callback&& replaceCallback);
 
-    /** Insert/update the canonical entry for `key`, always replacing the
-        cached value with `data`.
-
-        If an entry already exists for `key`, the cached value is unconditionally
-        replaced with `data`; otherwise `data` is inserted. `data` is never
-        written back, so it may be const.
-
-        @param key The key corresponding to the object.
-        @param data A shared pointer to the data corresponding to the object.
-
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
+    /**
+     * Insert/update the canonical entry for `key`, always replacing the
+     * cached value with `data`.
+     *
+     * If an entry already exists for `key`, the cached value is unconditionally
+     * replaced with `data`; otherwise `data` is inserted. `data` is never
+     * written back, so it may be const.
+     *
+     * @param key The key corresponding to the object.
+     * @param data A shared pointer to the data corresponding to the object.
+     *
+     * @return `true` if an existing live entry was found and used; `false` if a new entry was
+     *         inserted or an expired tracked entry was re-cached.
+     */
     bool
     canonicalizeReplaceCache(key_type const& key, SharedPointerType const& data);
 
-    /** Insert the canonical entry for `key`, keeping any existing cached value.
-
-        If an entry already exists for `key`, the cached value is kept and
-        written back into `data` so the caller ends up with the canonical
-        object; otherwise `data` is inserted. Because `data` may be overwritten
-        it must be writable.
-
-        @param key The key corresponding to the object.
-        @param data A shared pointer to the data corresponding to the object;
-                    updated to the canonical value when one already exists.
-
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
+    /**
+     * Insert the canonical entry for `key`, keeping any existing cached value.
+     *
+     * If an entry already exists for `key`, the cached value is kept and
+     * written back into `data` so the caller ends up with the canonical
+     * object; otherwise `data` is inserted. Because `data` may be overwritten
+     * it must be writable.
+     *
+     * @param key The key corresponding to the object.
+     * @param data A shared pointer to the data corresponding to the object;
+     *             updated to the canonical value when one already exists.
+     *
+     * @return `true` if an existing live entry was found and used; `false` if a new entry was
+     *         inserted or an expired tracked entry was re-cached.
+     */
     bool
     canonicalizeReplaceClient(key_type const& key, SharedPointerType& data);
 
     SharedPointerType
     fetch(key_type const& key);
 
-    /** Insert the element into the container.
-        If the key already exists, nothing happens.
-        @return `true` If the element was inserted
-    */
+    /**
+     * Insert the element into the container.
+     * If the key already exists, nothing happens.
+     * @return `true` If the element was inserted
+     */
     template <class ReturnType = bool>
     auto
     insert(key_type const& key, T const& value) -> ReturnType
@@ -235,15 +246,18 @@ public:
     getKeys() const;
 
     // CachedSLEs functions.
-    /** Returns the fraction of cache hits. */
+    /**
+     * Returns the fraction of cache hits.
+     */
     double
     rate() const;
 
-    /** Fetch an item from the cache.
-        If the digest was not found, Handler
-        will be called with this signature:
-            SLE::const_pointer(void)
-    */
+    /**
+     * Fetch an item from the cache.
+     * If the digest was not found, Handler
+     * will be called with this signature:
+     *     SLE::const_pointer(void)
+     */
     template <class Handler>
     SharedPointerType
     fetch(key_type const& digest, Handler const& h);
diff --git a/include/xrpl/basics/ToString.h b/include/xrpl/basics/ToString.h
index e9f8f43633..a54db8a8ce 100644
--- a/include/xrpl/basics/ToString.h
+++ b/include/xrpl/basics/ToString.h
@@ -5,10 +5,11 @@
 
 namespace xrpl {
 
-/** to_string() generalizes std::to_string to handle bools, chars, and strings.
-
-    It's also possible to provide implementation of to_string for a class
-    which needs a string implementation.
+/**
+ * to_string() generalizes std::to_string to handle bools, chars, and strings.
+ *
+ * It's also possible to provide implementation of to_string for a class
+ * which needs a string implementation.
  */
 
 template <class T>
diff --git a/include/xrpl/basics/UptimeClock.h b/include/xrpl/basics/UptimeClock.h
index 502aae7c25..b375de4497 100644
--- a/include/xrpl/basics/UptimeClock.h
+++ b/include/xrpl/basics/UptimeClock.h
@@ -7,12 +7,13 @@
 
 namespace xrpl {
 
-/** Tracks program uptime to seconds precision.
-
-    The timer caches the current time as a performance optimization.
-    This allows clients to query the current time thousands of times
-    per second.
-*/
+/**
+ * Tracks program uptime to seconds precision.
+ *
+ * The timer caches the current time as a performance optimization.
+ * This allows clients to query the current time thousands of times
+ * per second.
+ */
 
 class UptimeClock
 {
diff --git a/include/xrpl/basics/base_uint.h b/include/xrpl/basics/base_uint.h
index f75100f862..96cfa343e3 100644
--- a/include/xrpl/basics/base_uint.h
+++ b/include/xrpl/basics/base_uint.h
@@ -63,18 +63,19 @@ struct AlwaysFalseT : std::bool_constant<false>
 
 }  // namespace detail
 
-/** Integers of any length that is a multiple of 32-bits
-
-    @note This class stores its values internally in big-endian
-          form and that internal representation is part of the
-          binary protocol of the XRP Ledger and cannot be changed
-          arbitrarily without causing breakage.
-
-          @tparam Bits The number of bits this integer should have; must
-                       be at least 64 and a multiple of 32.
-          @tparam Tag An arbitrary type that functions as a tag and allows
-                      the instantiation of "distinct" types that the same
-                      number of bits.
+/**
+ * Integers of any length that is a multiple of 32-bits
+ *
+ * @note This class stores its values internally in big-endian
+ *       form and that internal representation is part of the
+ *       binary protocol of the XRP Ledger and cannot be changed
+ *       arbitrarily without causing breakage.
+ *
+ * @tparam Bits The number of bits this integer should have; must
+ *              be at least 64 and a multiple of 32.
+ * @tparam Tag An arbitrary type that functions as a tag and allows
+ *             the instantiation of "distinct" types that the same
+ *             number of bits.
  */
 template <std::size_t Bits, class Tag = void>
 class BaseUInt
@@ -154,21 +155,23 @@ public:
         return data() + kBytes;
     }
 
-    /** Value hashing function.
-        The seed prevents crafted inputs from causing degenerate parent
-       containers.
-    */
+    /**
+     * Value hashing function.
+     *  The seed prevents crafted inputs from causing degenerate parent
+     * containers.
+     */
     using hasher = HardenedHash<>;
 
     //--------------------------------------------------------------------------
 
 private:
-    /** Construct from a raw pointer.
-        The buffer pointed to by `data` must be at least Bits/8 bytes.
-
-        @note the structure is used to disambiguate this from the std::uint64_t
-              constructor: something like base_uint(0) is ambiguous.
-    */
+    /**
+     * Construct from a raw pointer.
+     * The buffer pointed to by `data` must be at least Bits/8 bytes.
+     *
+     * @note the structure is used to disambiguate this from the std::uint64_t
+     *       constructor: something like base_uint(0) is ambiguous.
+     */
     // NIKB TODO Remove the need for this constructor.
     struct VoidHelper
     {
@@ -503,13 +506,14 @@ public:
         h(a.data_.data(), sizeof(a.data_));
     }
 
-    /** Parse a hex string into a base_uint
-
-        The input must be precisely `2 * bytes` hexadecimal characters
-        long, with one exception: the value '0'.
-
-        @param sv A null-terminated string of hexadecimal characters
-        @return true if the input was parsed properly; false otherwise.
+    /**
+     * Parse a hex string into a base_uint
+     *
+     * The input must be precisely `2 * bytes` hexadecimal characters
+     * long, with one exception: the value '0'.
+     *
+     * @param sv A null-terminated string of hexadecimal characters
+     * @return true if the input was parsed properly; false otherwise.
      */
     [[nodiscard]] constexpr bool
     parseHex(std::string_view sv)
diff --git a/include/xrpl/basics/chrono.h b/include/xrpl/basics/chrono.h
index 61246fc699..b855318524 100644
--- a/include/xrpl/basics/chrono.h
+++ b/include/xrpl/basics/chrono.h
@@ -21,15 +21,16 @@ using days =
 
 using weeks = std::chrono::duration<int, std::ratio_multiply<days::period, std::ratio<7>>>;
 
-/** Clock for measuring the network time.
-
-    The epoch is January 1, 2000
-
-    epoch_offset
-    = date(2000-01-01) - date(1970-0-01)
-    = days(10957)
-    = seconds(946684800)
-*/
+/**
+ * Clock for measuring the network time.
+ *
+ * The epoch is January 1, 2000
+ *
+ * epoch_offset
+ * = date(2000-01-01) - date(1970-0-01)
+ * = days(10957)
+ * = seconds(946684800)
+ */
 
 static constexpr std::chrono::seconds kEpochOffset =
     date::sys_days{date::year{2000} / 1 / 1} - date::sys_days{date::year{1970} / 1 / 1};
@@ -81,16 +82,21 @@ toStringIso(NetClock::time_point tp)
     return toStringIso(date::sys_time<NetClock::duration>{tp.time_since_epoch() + kEpochOffset});
 }
 
-/** A clock for measuring elapsed time.
-
-    The epoch is unspecified.
-*/
+/**
+ * A clock for measuring elapsed time.
+ *
+ * The epoch is unspecified.
+ */
 using Stopwatch = beast::AbstractClock<std::chrono::steady_clock>;
 
-/** A manual Stopwatch for unit tests. */
+/**
+ * A manual Stopwatch for unit tests.
+ */
 using TestStopwatch = beast::ManualClock<std::chrono::steady_clock>;
 
-/** Returns an instance of a wall clock. */
+/**
+ * Returns an instance of a wall clock.
+ */
 inline Stopwatch&
 stopwatch()
 {
diff --git a/include/xrpl/basics/contract.h b/include/xrpl/basics/contract.h
index 0e90687de3..6588cb5d1a 100644
--- a/include/xrpl/basics/contract.h
+++ b/include/xrpl/basics/contract.h
@@ -15,20 +15,23 @@ namespace xrpl {
     preconditions, postconditions, and invariants.
 */
 
-/** Generates and logs a call stack */
+/**
+ * Generates and logs a call stack
+ */
 void
 logThrow(std::string const& title);
 
-/** Rethrow the exception currently being handled.
-
-    When called from within a catch block, it will pass
-    control to the next matching exception handler, if any.
-    Otherwise, std::terminate will be called.
-
-    ASAN can't handle sudden jumps in control flow very well. This
-    function is marked as XRPL_NO_SANITIZE_ADDRESS to prevent it from
-    triggering false positives, since it throws.
-*/
+/**
+ * Rethrow the exception currently being handled.
+ *
+ * When called from within a catch block, it will pass
+ * control to the next matching exception handler, if any.
+ * Otherwise, std::terminate will be called.
+ *
+ * ASAN can't handle sudden jumps in control flow very well. This
+ * function is marked as XRPL_NO_SANITIZE_ADDRESS to prevent it from
+ * triggering false positives, since it throws.
+ */
 [[noreturn]] XRPL_NO_SANITIZE_ADDRESS inline void
 rethrow()
 {
@@ -56,7 +59,9 @@ Throw(Args&&... args)
     throw std::move(e);
 }
 
-/** Called when faulty logic causes a broken invariant. */
+/**
+ * Called when faulty logic causes a broken invariant.
+ */
 [[noreturn]] void
 logicError(std::string const& how) noexcept;
 
diff --git a/include/xrpl/basics/hardened_hash.h b/include/xrpl/basics/hardened_hash.h
index 5a855736b3..6b8277a560 100644
--- a/include/xrpl/basics/hardened_hash.h
+++ b/include/xrpl/basics/hardened_hash.h
@@ -39,33 +39,33 @@ makeSeedPair() noexcept
 
 /**
  * Seed functor once per construction
-
-   A std compatible hash adapter that resists adversarial inputs.
-   For this to work, T must implement in its own namespace:
-
-   @code
-
-   template <class Hasher>
-   void
-   hash_append (Hasher& h, T const& t) noexcept
-   {
-       // hash_append each base and member that should
-       //  participate in forming the hash
-       using beast::hash_append;
-       hash_append (h, static_cast<T::base1 const&>(t));
-       hash_append (h, static_cast<T::base2 const&>(t));
-       // ...
-       hash_append (h, t.member1);
-       hash_append (h, t.member2);
-       // ...
-   }
-
-   @endcode
-
-   Do not use any version of Murmur or CityHash for the Hasher
-   template parameter (the hashing algorithm).  For details
-   see https://131002.net/siphash/#at
-*/
+ *
+ * A std compatible hash adapter that resists adversarial inputs.
+ * For this to work, T must implement in its own namespace:
+ *
+ * @code
+ *
+ * template <class Hasher>
+ * void
+ * hash_append (Hasher& h, T const& t) noexcept
+ * {
+ *     // hash_append each base and member that should
+ *     //  participate in forming the hash
+ *     using beast::hash_append;
+ *     hash_append (h, static_cast<T::base1 const&>(t));
+ *     hash_append (h, static_cast<T::base2 const&>(t));
+ *     // ...
+ *     hash_append (h, t.member1);
+ *     hash_append (h, t.member2);
+ *     // ...
+ * }
+ *
+ * @endcode
+ *
+ * Do not use any version of Murmur or CityHash for the Hasher
+ * template parameter (the hashing algorithm).  For details
+ * see https://131002.net/siphash/#at
+ */
 
 template <class HashAlgorithm = beast::Xxhasher>
 class HardenedHash
diff --git a/include/xrpl/basics/make_SSLContext.h b/include/xrpl/basics/make_SSLContext.h
index 45ac637c36..c8ada176f9 100644
--- a/include/xrpl/basics/make_SSLContext.h
+++ b/include/xrpl/basics/make_SSLContext.h
@@ -7,11 +7,15 @@
 
 namespace xrpl {
 
-/** Create a self-signed SSL context that allows anonymous Diffie Hellman. */
+/**
+ * Create a self-signed SSL context that allows anonymous Diffie Hellman.
+ */
 std::shared_ptr<boost::asio::ssl::context>
 makeSslContext(std::string const& cipherList);
 
-/** Create an authenticated SSL context using the specified files. */
+/**
+ * Create an authenticated SSL context using the specified files.
+ */
 std::shared_ptr<boost::asio::ssl::context>
 makeSslContextAuthed(
     std::string const& keyFile,
diff --git a/include/xrpl/basics/mulDiv.h b/include/xrpl/basics/mulDiv.h
index 9076da62f2..38fa57294b 100644
--- a/include/xrpl/basics/mulDiv.h
+++ b/include/xrpl/basics/mulDiv.h
@@ -7,16 +7,16 @@
 namespace xrpl {
 constexpr auto kMuldivMax = std::numeric_limits<std::uint64_t>::max();
 
-/** Return value*mul/div accurately.
-    Computes the result of the multiplication and division in
-    a single step, avoiding overflow and retaining precision.
-    Throws:
-        None
-    Returns:
-        `std::optional`:
-            `std::nullopt` if the calculation overflows. Otherwise, `value * mul
-   / div`.
-*/
+/**
+ * Return value*mul/div accurately.
+ *
+ * Computes the result of the multiplication and division in
+ * a single step, avoiding overflow and retaining precision.
+ *
+ * @throws None
+ * @return `std::nullopt` if the calculation overflows. Otherwise,
+ *         `value * mul / div`.
+ */
 std::optional<std::uint64_t>
 mulDiv(std::uint64_t value, std::uint64_t mul, std::uint64_t div);
 
diff --git a/include/xrpl/basics/random.h b/include/xrpl/basics/random.h
index c544e7d0c8..7aeb7d6145 100644
--- a/include/xrpl/basics/random.h
+++ b/include/xrpl/basics/random.h
@@ -33,16 +33,17 @@ template <class Engine, class Result = typename Engine::result_type>
 using is_engine = std::is_invocable_r<Result, Engine>;
 }  // namespace detail
 
-/** Return the default random engine.
-
-    This engine is guaranteed to be deterministic, but by
-    default will be randomly seeded. It is NOT cryptographically
-    secure and MUST NOT be used to generate randomness that
-    will be used for keys, secure cookies, IVs, padding, etc.
-
-    Each thread gets its own instance of the engine which
-    will be randomly seeded.
-*/
+/**
+ * Return the default random engine.
+ *
+ * This engine is guaranteed to be deterministic, but by
+ * default will be randomly seeded. It is NOT cryptographically
+ * secure and MUST NOT be used to generate randomness that
+ * will be used for keys, secure cookies, IVs, padding, etc.
+ *
+ * Each thread gets its own instance of the engine which
+ * will be randomly seeded.
+ */
 inline beast::xor_shift_engine&
 defaultPrng()
 {
@@ -70,25 +71,26 @@ defaultPrng()
     return kEngine;
 }
 
-/** Return a uniformly distributed random integer.
-
-    @param min The smallest value to return. If not specified
-               the value defaults to 0.
-    @param max The largest value to return. If not specified
-               the value defaults to the largest value that
-               can be represented.
-
-    The randomness is generated by the specified engine (or
-    the default engine if one is not specified). The result
-    is cryptographically secure only when the engine passed
-    into the function is cryptographically secure.
-
-    @note The range is always a closed interval, so calling
-          rand_int(-5, 15) can return any integer in the
-          closed interval [-5, 15]; similarly, calling
-          rand_int(7) can return any integer in the closed
-          interval [0, 7].
-*/
+/**
+ * Return a uniformly distributed random integer.
+ *
+ * @param min The smallest value to return. If not specified
+ *            the value defaults to 0.
+ * @param max The largest value to return. If not specified
+ *            the value defaults to the largest value that
+ *            can be represented.
+ *
+ * The randomness is generated by the specified engine (or
+ * the default engine if one is not specified). The result
+ * is cryptographically secure only when the engine passed
+ * into the function is cryptographically secure.
+ *
+ * @note The range is always a closed interval, so calling
+ *       rand_int(-5, 15) can return any integer in the
+ *       closed interval [-5, 15]; similarly, calling
+ *       rand_int(7) can return any integer in the closed
+ *       interval [0, 7].
+ */
 /** @{ */
 template <class Engine, class Integral>
 Integral
@@ -144,7 +146,9 @@ randInt()
 }
 /** @} */
 
-/** Return a random byte */
+/**
+ * Return a random byte
+ */
 /** @{ */
 template <class Byte, class Engine>
 Byte
@@ -166,7 +170,9 @@ randByte()
 }
 /** @} */
 
-/** Return a random boolean value */
+/**
+ * Return a random boolean value
+ */
 /** @{ */
 template <class Engine>
 inline bool
diff --git a/include/xrpl/basics/scope.h b/include/xrpl/basics/scope.h
index e63bb69eb5..5821e1dacc 100644
--- a/include/xrpl/basics/scope.h
+++ b/include/xrpl/basics/scope.h
@@ -156,41 +156,41 @@ template <class EF>
 ScopeSuccess(EF) -> ScopeSuccess<EF>;
 
 /**
-    Automatically unlocks and re-locks a unique_lock object.
-
-    This is the reverse of a std::unique_lock object - instead of locking the
-   mutex for the lifetime of this object, it unlocks it.
-
-    Make sure you don't try to unlock mutexes that aren't actually locked!
-
-    This is essentially a less-versatile boost::reverse_lock.
-
-    e.g. @code
-
-    std::mutex mut;
-
-    for (;;)
-    {
-        std::unique_lock myScopedLock{mut};
-        // mut is now locked
-
-        ... do some stuff with it locked ..
-
-        while (xyz)
-        {
-            ... do some stuff with it locked ..
-
-            scope_unlock unlocker{myScopedLock};
-
-            // mut is now unlocked for the remainder of this block,
-            // and re-locked at the end.
-
-            ...do some stuff with it unlocked ...
-        }  // mut gets locked here.
-
-    }  // mut gets unlocked here
-    @endcode
-*/
+ * Automatically unlocks and re-locks a unique_lock object.
+ *
+ * This is the reverse of a std::unique_lock object - instead of locking the
+ * mutex for the lifetime of this object, it unlocks it.
+ *
+ * Make sure you don't try to unlock mutexes that aren't actually locked!
+ *
+ * This is essentially a less-versatile boost::reverse_lock.
+ *
+ * e.g. @code
+ *
+ * std::mutex mut;
+ *
+ * for (;;)
+ * {
+ *     std::unique_lock myScopedLock{mut};
+ *     // mut is now locked
+ *
+ *     ... do some stuff with it locked ..
+ *
+ *     while (xyz)
+ *     {
+ *         ... do some stuff with it locked ..
+ *
+ *         scope_unlock unlocker{myScopedLock};
+ *
+ *         // mut is now unlocked for the remainder of this block,
+ *         // and re-locked at the end.
+ *
+ *         ...do some stuff with it unlocked ...
+ *     }  // mut gets locked here.
+ *
+ * }  // mut gets unlocked here
+ * @endcode
+ */
 
 template <class Mutex>
 class ScopeUnlock
diff --git a/include/xrpl/basics/spinlock.h b/include/xrpl/basics/spinlock.h
index 2cc00efdef..87611f20ba 100644
--- a/include/xrpl/basics/spinlock.h
+++ b/include/xrpl/basics/spinlock.h
@@ -15,15 +15,16 @@
 namespace xrpl {
 
 namespace detail {
-/** Inform the processor that we are in a tight spin-wait loop.
-
-    Spinlocks caught in tight loops can result in the processor's pipeline
-    filling up with comparison operations, resulting in a misprediction at
-    the time the lock is finally acquired, necessitating pipeline flushing
-    which is ridiculously expensive and results in very high latency.
-
-    This function instructs the processor to "pause" for some architecture
-    specific amount of time, to prevent this.
+/**
+ * Inform the processor that we are in a tight spin-wait loop.
+ *
+ * Spinlocks caught in tight loops can result in the processor's pipeline
+ * filling up with comparison operations, resulting in a misprediction at
+ * the time the lock is finally acquired, necessitating pipeline flushing
+ * which is ridiculously expensive and results in very high latency.
+ *
+ * This function instructs the processor to "pause" for some architecture
+ * specific amount of time, to prevent this.
  */
 inline void
 spinPause() noexcept
@@ -38,37 +39,39 @@ spinPause() noexcept
 }  // namespace detail
 
 /** @{ */
-/** Classes to handle arrays of spinlocks packed into a single atomic integer:
-
-    Packed spinlocks allow for tremendously space-efficient lock-sharding
-    but they come at a cost.
-
-    First, the implementation is necessarily low-level and uses advanced
-    features like memory ordering and highly platform-specific tricks to
-    maximize performance. This imposes a significant and ongoing cost to
-    developers.
-
-    Second, and perhaps most important, is that the packing of multiple
-    locks into a single integer which, albeit space-efficient, also has
-    performance implications stemming from data dependencies, increased
-    cache-coherency traffic between processors and heavier loads on the
-    processor's load/store units.
-
-    To be sure, these locks can have advantages but they are definitely
-    not general purpose locks and should not be thought of or used that
-    way. The use cases for them are likely few and far between; without
-    a compelling reason to use them, backed by profiling data, it might
-    be best to use one of the standard locking primitives instead. Note
-    that in most common platforms, `std::mutex` is so heavily optimized
-    that it can, usually, outperform spinlocks.
-
-    @tparam T An unsigned integral type (e.g. std::uint16_t)
+/**
+ * Classes to handle arrays of spinlocks packed into a single atomic integer:
+ *
+ * Packed spinlocks allow for tremendously space-efficient lock-sharding
+ * but they come at a cost.
+ *
+ * First, the implementation is necessarily low-level and uses advanced
+ * features like memory ordering and highly platform-specific tricks to
+ * maximize performance. This imposes a significant and ongoing cost to
+ * developers.
+ *
+ * Second, and perhaps most important, is that the packing of multiple
+ * locks into a single integer which, albeit space-efficient, also has
+ * performance implications stemming from data dependencies, increased
+ * cache-coherency traffic between processors and heavier loads on the
+ * processor's load/store units.
+ *
+ * To be sure, these locks can have advantages but they are definitely
+ * not general purpose locks and should not be thought of or used that
+ * way. The use cases for them are likely few and far between; without
+ * a compelling reason to use them, backed by profiling data, it might
+ * be best to use one of the standard locking primitives instead. Note
+ * that in most common platforms, `std::mutex` is so heavily optimized
+ * that it can, usually, outperform spinlocks.
+ *
+ * @tparam T An unsigned integral type (e.g. std::uint16_t)
  */
 
-/** A class that grabs a single packed spinlock from an atomic integer.
-
-    This class meets the requirements of Lockable:
-        https://en.cppreference.com/w/cpp/named_req/Lockable
+/**
+ * A class that grabs a single packed spinlock from an atomic integer.
+ *
+ * This class meets the requirements of Lockable:
+ *     https://en.cppreference.com/w/cpp/named_req/Lockable
  */
 template <class T>
 class PackedSpinlock
@@ -91,13 +94,14 @@ public:
     PackedSpinlock&
     operator=(PackedSpinlock const&) = delete;
 
-    /** A single spinlock packed inside the specified atomic
-
-        @param lock The atomic integer inside which the spinlock is packed.
-        @param index The index of the spinlock this object acquires.
-
-        @note For performance reasons, you should strive to have `lock` be
-              on a cacheline by itself.
+    /**
+     * A single spinlock packed inside the specified atomic
+     *
+     * @param lock The atomic integer inside which the spinlock is packed.
+     * @param index The index of the spinlock this object acquires.
+     *
+     * @note For performance reasons, you should strive to have `lock` be
+     *       on a cacheline by itself.
      */
     PackedSpinlock(std::atomic<T>& lock, int index) : bits_(lock), mask_(static_cast<T>(1) << index)
     {
@@ -133,17 +137,18 @@ public:
     }
 };
 
-/** A spinlock implemented on top of an atomic integer.
-
-    @note Using `packed_spinlock` and `spinlock` against the same underlying
-          atomic integer can result in `spinlock` not being able to actually
-          acquire the lock during periods of high contention, because of how
-          the two locks operate: `spinlock` will spin trying to grab all the
-          bits at once, whereas any given `packed_spinlock` will only try to
-          grab one bit at a time. Caveat emptor.
-
-    This class meets the requirements of Lockable:
-        https://en.cppreference.com/w/cpp/named_req/Lockable
+/**
+ * A spinlock implemented on top of an atomic integer.
+ *
+ * @note Using `packed_spinlock` and `spinlock` against the same underlying
+ *       atomic integer can result in `spinlock` not being able to actually
+ *       acquire the lock during periods of high contention, because of how
+ *       the two locks operate: `spinlock` will spin trying to grab all the
+ *       bits at once, whereas any given `packed_spinlock` will only try to
+ *       grab one bit at a time. Caveat emptor.
+ *
+ * This class meets the requirements of Lockable:
+ *     https://en.cppreference.com/w/cpp/named_req/Lockable
  */
 template <class T>
 class Spinlock
@@ -159,12 +164,13 @@ public:
     Spinlock&
     operator=(Spinlock const&) = delete;
 
-    /** Grabs the
-
-        @param lock The atomic integer to spin against.
-
-        @note For performance reasons, you should strive to have `lock` be
-              on a cacheline by itself.
+    /**
+     * Grabs the
+     *
+     * @param lock The atomic integer to spin against.
+     *
+     * @note For performance reasons, you should strive to have `lock` be
+     *       on a cacheline by itself.
      */
     Spinlock(std::atomic<T>& lock) : lock_(lock)
     {
diff --git a/include/xrpl/basics/tagged_integer.h b/include/xrpl/basics/tagged_integer.h
index 5a088db863..2edb314a16 100644
--- a/include/xrpl/basics/tagged_integer.h
+++ b/include/xrpl/basics/tagged_integer.h
@@ -12,17 +12,18 @@
 
 namespace xrpl {
 
-/** A type-safe wrap around standard integral types
-
-    The tag is used to implement type safety, catching mismatched types at
-    compile time. Multiple instantiations wrapping the same underlying integral
-    type are distinct types (distinguished by tag) and will not interoperate. A
-    tagged_integer supports all the usual assignment, arithmetic, comparison and
-    shifting operations defined for the underlying type
-
-    The tag is not meant as a unit, which would require restricting the set of
-    allowed arithmetic operations.
-*/
+/**
+ * A type-safe wrap around standard integral types
+ *
+ * The tag is used to implement type safety, catching mismatched types at
+ * compile time. Multiple instantiations wrapping the same underlying integral
+ * type are distinct types (distinguished by tag) and will not interoperate. A
+ * tagged_integer supports all the usual assignment, arithmetic, comparison and
+ * shifting operations defined for the underlying type
+ *
+ * The tag is not meant as a unit, which would require restricting the set of
+ * allowed arithmetic operations.
+ */
 template <class Int, class Tag>
 class TaggedInteger : boost::totally_ordered<
                           TaggedInteger<Int, Tag>,
diff --git a/include/xrpl/beast/asio/io_latency_probe.h b/include/xrpl/beast/asio/io_latency_probe.h
index f67ff4a692..d87bdafe45 100644
--- a/include/xrpl/beast/asio/io_latency_probe.h
+++ b/include/xrpl/beast/asio/io_latency_probe.h
@@ -14,7 +14,9 @@
 
 namespace beast {
 
-/** Measures handler latency on an io_context queue. */
+/**
+ * Measures handler latency on an io_context queue.
+ */
 template <class Clock>
 class IOLatencyProbe
 {
@@ -42,7 +44,9 @@ public:
         cancel(lock, true);
     }
 
-    /** Return the io_context associated with the latency probe. */
+    /**
+     * Return the io_context associated with the latency probe.
+     */
     /** @{ */
     boost::asio::io_context&
     getIoContext()
@@ -57,9 +61,10 @@ public:
     }
     /** @} */
 
-    /** Cancel all pending i/o.
-        Any handlers which have already been queued will still be called.
-    */
+    /**
+     * Cancel all pending i/o.
+     * Any handlers which have already been queued will still be called.
+     */
     /** @{ */
     void
     cancel()
@@ -76,10 +81,11 @@ public:
     }
     /** @} */
 
-    /** Measure one sample of i/o latency.
-        Handler will be called with this signature:
-            void Handler (Duration d);
-    */
+    /**
+     * Measure one sample of i/o latency.
+     * Handler will be called with this signature:
+     *     void Handler (Duration d);
+     */
     template <class Handler>
     void
     sampleOne(Handler&& handler)
@@ -91,10 +97,11 @@ public:
             ios_, SampleOp<Handler>(std::forward<Handler>(handler), Clock::now(), false, this));
     }
 
-    /** Initiate continuous i/o latency sampling.
-        Handler will be called with this signature:
-            void Handler (std::chrono::milliseconds);
-    */
+    /**
+     * Initiate continuous i/o latency sampling.
+     * Handler will be called with this signature:
+     *     void Handler (std::chrono::milliseconds);
+     */
     template <class Handler>
     void
     sample(Handler&& handler)
diff --git a/include/xrpl/beast/clock/abstract_clock.h b/include/xrpl/beast/clock/abstract_clock.h
index 15d785d138..6e23700730 100644
--- a/include/xrpl/beast/clock/abstract_clock.h
+++ b/include/xrpl/beast/clock/abstract_clock.h
@@ -2,34 +2,35 @@
 
 namespace beast {
 
-/** Abstract interface to a clock.
-
-    This makes now() a member function instead of a static member, so
-    an instance of the class can be dependency injected, facilitating
-    unit tests where time may be controlled.
-
-    An abstract_clock inherits all the nested types of the Clock
-    template parameter.
-
-    Example:
-
-    @code
-
-    struct Implementation
-    {
-        using clock_type = abstract_clock <std::chrono::steady_clock>;
-        clock_type& clock_;
-        explicit Implementation (clock_type& clock)
-            : clock_(clock)
-        {
-        }
-    };
-
-    @endcode
-
-    @tparam Clock A type meeting these requirements:
-        http://en.cppreference.com/w/cpp/concept/Clock
-*/
+/**
+ * Abstract interface to a clock.
+ *
+ * This makes now() a member function instead of a static member, so
+ * an instance of the class can be dependency injected, facilitating
+ * unit tests where time may be controlled.
+ *
+ * An abstract_clock inherits all the nested types of the Clock
+ * template parameter.
+ *
+ * Example:
+ *
+ * @code
+ *
+ * struct Implementation
+ * {
+ *     using clock_type = abstract_clock <std::chrono::steady_clock>;
+ *     clock_type& clock_;
+ *     explicit Implementation (clock_type& clock)
+ *         : clock_(clock)
+ *     {
+ *     }
+ * };
+ *
+ * @endcode
+ *
+ * @tparam Clock A type meeting these requirements:
+ *     http://en.cppreference.com/w/cpp/concept/Clock
+ */
 template <class Clock>
 class AbstractClock
 {
@@ -46,7 +47,9 @@ public:
     AbstractClock() = default;
     AbstractClock(AbstractClock const&) = default;
 
-    /** Returns the current time. */
+    /**
+     * Returns the current time.
+     */
     [[nodiscard]] virtual time_point
     now() const = 0;
 };
@@ -74,11 +77,12 @@ struct AbstractClockWrapper : public AbstractClock<Facade>
 
 //------------------------------------------------------------------------------
 
-/** Returns a global instance of an abstract clock.
-    @tparam Facade A type meeting these requirements:
-        http://en.cppreference.com/w/cpp/concept/Clock
-    @tparam Clock The actual concrete clock to use.
-*/
+/**
+ * Returns a global instance of an abstract clock.
+ * @tparam Facade A type meeting these requirements:
+ *     http://en.cppreference.com/w/cpp/concept/Clock
+ * @tparam Clock The actual concrete clock to use.
+ */
 template <class Facade, class Clock = Facade>
 AbstractClock<Facade>&
 getAbstractClock()
diff --git a/include/xrpl/beast/clock/basic_seconds_clock.h b/include/xrpl/beast/clock/basic_seconds_clock.h
index 5a267e9458..dce521d0b8 100644
--- a/include/xrpl/beast/clock/basic_seconds_clock.h
+++ b/include/xrpl/beast/clock/basic_seconds_clock.h
@@ -4,15 +4,16 @@
 
 namespace beast {
 
-/** A clock whose minimum resolution is one second.
-
-    The purpose of this class is to optimize the performance of the now()
-    member function call. It uses a dedicated thread that wakes up at least
-    once per second to sample the requested trivial clock.
-
-    @tparam Clock A type meeting these requirements:
-        http://en.cppreference.com/w/cpp/concept/Clock
-*/
+/**
+ * A clock whose minimum resolution is one second.
+ *
+ * The purpose of this class is to optimize the performance of the now()
+ * member function call. It uses a dedicated thread that wakes up at least
+ * once per second to sample the requested trivial clock.
+ *
+ * @tparam Clock A type meeting these requirements:
+ *     http://en.cppreference.com/w/cpp/concept/Clock
+ */
 class BasicSecondsClock
 {
 public:
diff --git a/include/xrpl/beast/clock/manual_clock.h b/include/xrpl/beast/clock/manual_clock.h
index 8b3e4e63c6..4dc9553644 100644
--- a/include/xrpl/beast/clock/manual_clock.h
+++ b/include/xrpl/beast/clock/manual_clock.h
@@ -7,15 +7,16 @@
 
 namespace beast {
 
-/** Manual clock implementation.
-
-    This concrete class implements the @ref abstract_clock interface and
-    allows the time to be advanced manually, mainly for the purpose of
-    providing a clock in unit tests.
-
-    @tparam Clock A type meeting these requirements:
-        http://en.cppreference.com/w/cpp/concept/Clock
-*/
+/**
+ * Manual clock implementation.
+ *
+ * This concrete class implements the @ref abstract_clock interface and
+ * allows the time to be advanced manually, mainly for the purpose of
+ * providing a clock in unit tests.
+ *
+ * @tparam Clock A type meeting these requirements:
+ *     http://en.cppreference.com/w/cpp/concept/Clock
+ */
 template <class Clock>
 class ManualClock : public AbstractClock<Clock>
 {
@@ -38,7 +39,9 @@ public:
         return now_;
     }
 
-    /** Set the current time of the manual clock. */
+    /**
+     * Set the current time of the manual clock.
+     */
     void
     set(time_point const& when)
     {
@@ -48,7 +51,9 @@ public:
         now_ = when;
     }
 
-    /** Convenience for setting the time in seconds from epoch. */
+    /**
+     * Convenience for setting the time in seconds from epoch.
+     */
     template <class Integer>
     void
     set(Integer secondsFromEpoch)
@@ -56,7 +61,9 @@ public:
         set(time_point(duration(std::chrono::seconds(secondsFromEpoch))));
     }
 
-    /** Advance the clock by a duration. */
+    /**
+     * Advance the clock by a duration.
+     */
     template <class Rep, class Period>
     void
     advance(std::chrono::duration<Rep, Period> const& elapsed)
@@ -67,7 +74,9 @@ public:
         now_ += elapsed;
     }
 
-    /** Convenience for advancing the clock by one second. */
+    /**
+     * Convenience for advancing the clock by one second.
+     */
     ManualClock&
     operator++()
     {
diff --git a/include/xrpl/beast/container/aged_container_utility.h b/include/xrpl/beast/container/aged_container_utility.h
index f43e59b0f7..da3e4e0500 100644
--- a/include/xrpl/beast/container/aged_container_utility.h
+++ b/include/xrpl/beast/container/aged_container_utility.h
@@ -7,7 +7,9 @@
 
 namespace beast {
 
-/** Expire aged container items past the specified age. */
+/**
+ * Expire aged container items past the specified age.
+ */
 template <class AgedContainer, class Rep, class Period>
 std::size_t
 expire(AgedContainer& c, std::chrono::duration<Rep, Period> const& age)
diff --git a/include/xrpl/beast/container/detail/aged_ordered_container.h b/include/xrpl/beast/container/detail/aged_ordered_container.h
index c98f16022f..5b60ef7e6d 100644
--- a/include/xrpl/beast/container/detail/aged_ordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_ordered_container.h
@@ -39,22 +39,23 @@ struct IsBoostReverseIterator<boost::intrusive::reverse_iterator<It>> : std::tru
     explicit IsBoostReverseIterator() = default;
 };
 
-/** Associative container where each element is also indexed by time.
-
-    This container mirrors the interface of the standard library ordered
-    associative containers, with the addition that each element is associated
-    with a `when` `time_point` which is obtained from the value of the clock's
-    `now`. The function `touch` updates the time for an element to the current
-    time as reported by the clock.
-
-    An extra set of iterator types and member functions are provided in the
-    `chronological` memberspace that allow traversal in temporal or reverse
-    temporal order. This container is useful as a building block for caches
-    whose items expire after a certain amount of time. The chronological
-    iterators allow for fully customizable expiration strategies.
-
-    @see aged_set, aged_multiset, aged_map, aged_multimap
-*/
+/**
+ * Associative container where each element is also indexed by time.
+ *
+ * This container mirrors the interface of the standard library ordered
+ * associative containers, with the addition that each element is associated
+ * with a `when` `time_point` which is obtained from the value of the clock's
+ * `now`. The function `touch` updates the time for an element to the current
+ * time as reported by the clock.
+ *
+ * An extra set of iterator types and member functions are provided in the
+ * `chronological` memberspace that allow traversal in temporal or reverse
+ * temporal order. This container is useful as a building block for caches
+ * whose items expire after a certain amount of time. The chronological
+ * iterators allow for fully customizable expiration strategies.
+ *
+ * @see aged_set, aged_multiset, aged_map, aged_multimap
+ */
 template <
     bool IsMulti,
     bool IsMap,
@@ -1795,7 +1796,9 @@ swap(
     lhs.swap(rhs);
 }
 
-/** Expire aged container items past the specified age. */
+/**
+ * Expire aged container items past the specified age.
+ */
 template <
     bool IsMulti,
     bool IsMap,
diff --git a/include/xrpl/beast/container/detail/aged_unordered_container.h b/include/xrpl/beast/container/detail/aged_unordered_container.h
index 9be9e96ba2..db10e8cc23 100644
--- a/include/xrpl/beast/container/detail/aged_unordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_unordered_container.h
@@ -43,23 +43,24 @@ TODO
 namespace beast {
 namespace detail {
 
-/** Associative container where each element is also indexed by time.
-
-    This container mirrors the interface of the standard library unordered
-    associative containers, with the addition that each element is associated
-    with a `when` `time_point` which is obtained from the value of the clock's
-    `now`. The function `touch` updates the time for an element to the current
-    time as reported by the clock.
-
-    An extra set of iterator types and member functions are provided in the
-    `chronological` memberspace that allow traversal in temporal or reverse
-    temporal order. This container is useful as a building block for caches
-    whose items expire after a certain amount of time. The chronological
-    iterators allow for fully customizable expiration strategies.
-
-    @see aged_unordered_set, aged_unordered_multiset
-    @see aged_unordered_map, aged_unordered_multimap
-*/
+/**
+ * Associative container where each element is also indexed by time.
+ *
+ * This container mirrors the interface of the standard library unordered
+ * associative containers, with the addition that each element is associated
+ * with a `when` `time_point` which is obtained from the value of the clock's
+ * `now`. The function `touch` updates the time for an element to the current
+ * time as reported by the clock.
+ *
+ * An extra set of iterator types and member functions are provided in the
+ * `chronological` memberspace that allow traversal in temporal or reverse
+ * temporal order. This container is useful as a building block for caches
+ * whose items expire after a certain amount of time. The chronological
+ * iterators allow for fully customizable expiration strategies.
+ *
+ * @see aged_unordered_set, aged_unordered_multiset
+ * @see aged_unordered_map, aged_unordered_multimap
+ */
 template <
     bool IsMulti,
     bool IsMap,
@@ -2709,7 +2710,9 @@ swap(
     lhs.swap(rhs);
 }
 
-/** Expire aged container items past the specified age. */
+/**
+ * Expire aged container items past the specified age.
+ */
 template <
     bool IsMulti,
     bool IsMap,
diff --git a/include/xrpl/beast/core/CurrentThreadName.h b/include/xrpl/beast/core/CurrentThreadName.h
index 3cdfe4c678..d1f14a6f80 100644
--- a/include/xrpl/beast/core/CurrentThreadName.h
+++ b/include/xrpl/beast/core/CurrentThreadName.h
@@ -12,9 +12,10 @@
 
 namespace beast {
 
-/** Changes the name of the caller thread.
-    Different OSes may place different length or content limits on this name.
-*/
+/**
+ * Changes the name of the caller thread.
+ * Different OSes may place different length or content limits on this name.
+ */
 void
 setCurrentThreadName(std::string_view newThreadName);
 
@@ -24,13 +25,14 @@ setCurrentThreadName(std::string_view newThreadName);
 // Maximum number of characters is therefore 15.
 constexpr std::size_t kMaxThreadNameLength = 15;
 
-/** Sets the name of the caller thread with compile-time size checking.
-    @tparam N The size of the string literal including null terminator
-    @param newThreadName A string literal to set as the thread name
-
-    This template overload enforces that thread names are at most 16 characters
-    (including null terminator) at compile time, matching Linux's limit.
-*/
+/**
+ * Sets the name of the caller thread with compile-time size checking.
+ * @tparam N The size of the string literal including null terminator
+ * @param newThreadName A string literal to set as the thread name
+ *
+ * This template overload enforces that thread names are at most 16 characters
+ * (including null terminator) at compile time, matching Linux's limit.
+ */
 template <std::size_t N>
 void
 setCurrentThreadName(char const (&newThreadName)[N])
@@ -41,14 +43,15 @@ setCurrentThreadName(char const (&newThreadName)[N])
 }
 #endif
 
-/** Returns the name of the caller thread.
-
-    The name returned is the name as set by a call to setCurrentThreadName().
-    If the thread name is set by an external force, then that name change
-    will not be reported.
-
-    If no name has ever been set, then the empty string is returned.
-*/
+/**
+ * Returns the name of the caller thread.
+ *
+ * The name returned is the name as set by a call to setCurrentThreadName().
+ * If the thread name is set by an external force, then that name change
+ * will not be reported.
+ *
+ * If no name has ever been set, then the empty string is returned.
+ */
 std::string
 getCurrentThreadName();
 
diff --git a/include/xrpl/beast/core/LexicalCast.h b/include/xrpl/beast/core/LexicalCast.h
index 1162d83078..7cf21892bd 100644
--- a/include/xrpl/beast/core/LexicalCast.h
+++ b/include/xrpl/beast/core/LexicalCast.h
@@ -163,17 +163,19 @@ struct LexicalCast<Out, char*>
 
 //------------------------------------------------------------------------------
 
-/** Thrown when a conversion is not possible with LexicalCast.
-    Only used in the throw variants of lexicalCast.
-*/
+/**
+ * Thrown when a conversion is not possible with LexicalCast.
+ * Only used in the throw variants of lexicalCast.
+ */
 struct BadLexicalCast : public std::bad_cast
 {
     explicit BadLexicalCast() = default;
 };
 
-/** Intelligently convert from one type to another.
-    @return `false` if there was a parsing or range error
-*/
+/**
+ * Intelligently convert from one type to another.
+ * @return `false` if there was a parsing or range error
+ */
 template <class Out, class In>
 bool
 lexicalCastChecked(Out& out, In in)
@@ -181,12 +183,13 @@ lexicalCastChecked(Out& out, In in)
     return detail::LexicalCast<Out, In>()(out, in);
 }
 
-/** Convert from one type to another, throw on error
-
-    An exception of type BadLexicalCast is thrown if the conversion fails.
-
-    @return The new type.
-*/
+/**
+ * Convert from one type to another, throw on error
+ *
+ * An exception of type BadLexicalCast is thrown if the conversion fails.
+ *
+ * @return The new type.
+ */
 template <class Out, class In>
 Out
 lexicalCastThrow(In in)
@@ -197,11 +200,12 @@ lexicalCastThrow(In in)
     throw BadLexicalCast();
 }
 
-/** Convert from one type to another.
-
-    @param defaultValue The value returned if parsing fails
-    @return The new type.
-*/
+/**
+ * Convert from one type to another.
+ *
+ * @param defaultValue The value returned if parsing fails
+ * @return The new type.
+ */
 template <class Out, class In>
 Out
 lexicalCast(In in, Out defaultValue = Out())
diff --git a/include/xrpl/beast/core/List.h b/include/xrpl/beast/core/List.h
index 1eeeaa87d1..b9b6829d31 100644
--- a/include/xrpl/beast/core/List.h
+++ b/include/xrpl/beast/core/List.h
@@ -11,7 +11,9 @@ class List;
 
 namespace detail {
 
-/** Copy `const` attribute from T to U if present. */
+/**
+ * Copy `const` attribute from T to U if present.
+ */
 /** @{ */
 template <typename T, typename U>
 struct CopyConst
@@ -153,110 +155,111 @@ private:
 
 }  // namespace detail
 
-/** Intrusive doubly linked list.
-
-    This intrusive List is a container similar in operation to std::list in the
-    Standard Template Library (STL). Like all @ref intrusive containers, List
-    requires you to first derive your class from List<>::Node:
-
-    @code
-
-    struct Object : List <Object>::Node
-    {
-        explicit Object (int value) : value_ (value)
-        {
-        }
-
-        int value_;
-    };
-
-    @endcode
-
-    Now we define the list, and add a couple of items.
-
-    @code
-
-    List <Object> list;
-
-    list.push_back (* (new Object (1)));
-    list.push_back (* (new Object (2)));
-
-    @endcode
-
-    For compatibility with the standard containers, push_back() expects a
-    reference to the object. Unlike the standard container, however, push_back()
-    places the actual object in the list and not a copy-constructed duplicate.
-
-    Iterating over the list follows the same idiom as the STL:
-
-    @code
-
-    for (List <Object>::iterator iter = list.begin(); iter != list.end; ++iter)
-        std::cout << iter->value_;
-
-    @endcode
-
-    You can even use BOOST_FOREACH, or range based for loops:
-
-    @code
-
-    BOOST_FOREACH (Object& object, list)  // boost only
-        std::cout << object.value_;
-
-    for (Object& object : list)           // C++11 only
-        std::cout << object.value_;
-
-    @endcode
-
-    Because List is mostly STL compliant, it can be passed into STL algorithms:
-    e.g. `std::for_each()` or `std::find_first_of()`.
-
-    In general, objects placed into a List should be dynamically allocated
-    although this cannot be enforced at compile time. Since the caller provides
-    the storage for the object, the caller is also responsible for deleting the
-    object. An object still exists after being removed from a List, until the
-    caller deletes it. This means an element can be moved from one List to
-    another with practically no overhead.
-
-    Unlike the standard containers, an object may only exist in one list at a
-    time, unless special preparations are made. The Tag template parameter is
-    used to distinguish between different list types for the same object,
-    allowing the object to exist in more than one list simultaneously.
-
-    For example, consider an actor system where a global list of actors is
-    maintained, so that they can each be periodically receive processing
-    time. We wish to also maintain a list of the subset of actors that require
-    a domain-dependent update. To achieve this, we declare two tags, the
-    associated list types, and the list element thusly:
-
-    @code
-
-    struct Actor;         // Forward declaration required
-
-    struct ProcessTag { };
-    struct UpdateTag { };
-
-    using ProcessList = List <Actor, ProcessTag>;
-    using UpdateList = List <Actor, UpdateTag>;
-
-    // Derive from both node types so we can be in each list at once.
-    //
-    struct Actor : ProcessList::Node, UpdateList::Node
-    {
-        bool process ();    // returns true if we need an update
-        void update ();
-    };
-
-    @endcode
-
-    @tparam T The base type of element which the list will store
-                    pointers to.
-
-    @tparam Tag An optional unique type name used to distinguish lists and
-   nodes, when the object can exist in multiple lists simultaneously.
-
-    @ingroup beast_core intrusive
-*/
+/**
+ * Intrusive doubly linked list.
+ *
+ * This intrusive List is a container similar in operation to std::list in the
+ * Standard Template Library (STL). Like all @ref intrusive containers, List
+ * requires you to first derive your class from List<>::Node:
+ *
+ * @code
+ *
+ * struct Object : List <Object>::Node
+ * {
+ *     explicit Object (int value) : value_ (value)
+ *     {
+ *     }
+ *
+ *     int value_;
+ * };
+ *
+ * @endcode
+ *
+ * Now we define the list, and add a couple of items.
+ *
+ * @code
+ *
+ * List <Object> list;
+ *
+ * list.push_back (* (new Object (1)));
+ * list.push_back (* (new Object (2)));
+ *
+ * @endcode
+ *
+ * For compatibility with the standard containers, push_back() expects a
+ * reference to the object. Unlike the standard container, however, push_back()
+ * places the actual object in the list and not a copy-constructed duplicate.
+ *
+ * Iterating over the list follows the same idiom as the STL:
+ *
+ * @code
+ *
+ * for (List <Object>::iterator iter = list.begin(); iter != list.end; ++iter)
+ *     std::cout << iter->value_;
+ *
+ * @endcode
+ *
+ * You can even use BOOST_FOREACH, or range based for loops:
+ *
+ * @code
+ *
+ * BOOST_FOREACH (Object& object, list)  // boost only
+ *     std::cout << object.value_;
+ *
+ * for (Object& object : list)           // C++11 only
+ *     std::cout << object.value_;
+ *
+ * @endcode
+ *
+ * Because List is mostly STL compliant, it can be passed into STL algorithms:
+ * e.g. `std::for_each()` or `std::find_first_of()`.
+ *
+ * In general, objects placed into a List should be dynamically allocated
+ * although this cannot be enforced at compile time. Since the caller provides
+ * the storage for the object, the caller is also responsible for deleting the
+ * object. An object still exists after being removed from a List, until the
+ * caller deletes it. This means an element can be moved from one List to
+ * another with practically no overhead.
+ *
+ * Unlike the standard containers, an object may only exist in one list at a
+ * time, unless special preparations are made. The Tag template parameter is
+ * used to distinguish between different list types for the same object,
+ * allowing the object to exist in more than one list simultaneously.
+ *
+ * For example, consider an actor system where a global list of actors is
+ * maintained, so that they can each be periodically receive processing
+ * time. We wish to also maintain a list of the subset of actors that require
+ * a domain-dependent update. To achieve this, we declare two tags, the
+ * associated list types, and the list element thusly:
+ *
+ * @code
+ *
+ * struct Actor;         // Forward declaration required
+ *
+ * struct ProcessTag { };
+ * struct UpdateTag { };
+ *
+ * using ProcessList = List <Actor, ProcessTag>;
+ * using UpdateList = List <Actor, UpdateTag>;
+ *
+ * // Derive from both node types so we can be in each list at once.
+ * //
+ * struct Actor : ProcessList::Node, UpdateList::Node
+ * {
+ *     bool process ();    // returns true if we need an update
+ *     void update ();
+ * };
+ *
+ * @endcode
+ *
+ * @tparam T The base type of element which the list will store
+ *                 pointers to.
+ *
+ * @tparam Tag An optional unique type name used to distinguish lists and
+ * nodes, when the object can exist in multiple lists simultaneously.
+ *
+ * @ingroup beast_core intrusive
+ */
 template <typename T, typename Tag = void>
 class List
 {
@@ -274,7 +277,9 @@ public:
     using iterator = detail::ListIterator<Node>;
     using const_iterator = detail::ListIterator<Node const>;
 
-    /** Create an empty list. */
+    /**
+     * Create an empty list.
+     */
     List()
     {
         head_.prev_ = nullptr;  // identifies the head
@@ -286,119 +291,133 @@ public:
     List&
     operator=(List const&) = delete;
 
-    /** Determine if the list is empty.
-        @return `true` if the list is empty.
-    */
+    /**
+     * Determine if the list is empty.
+     * @return `true` if the list is empty.
+     */
     [[nodiscard]] bool
     empty() const noexcept
     {
         return size() == 0;
     }
 
-    /** Returns the number of elements in the list. */
+    /**
+     * Returns the number of elements in the list.
+     */
     [[nodiscard]] size_type
     size() const noexcept
     {
         return size_;
     }
 
-    /** Obtain a reference to the first element.
-        @invariant The list may not be empty.
-        @return A reference to the first element.
-    */
+    /**
+     * Obtain a reference to the first element.
+     * @invariant The list may not be empty.
+     * @return A reference to the first element.
+     */
     reference
     front() noexcept
     {
         return element_from(head_.next_);
     }
 
-    /** Obtain a const reference to the first element.
-        @invariant The list may not be empty.
-        @return A const reference to the first element.
-    */
+    /**
+     * Obtain a const reference to the first element.
+     * @invariant The list may not be empty.
+     * @return A const reference to the first element.
+     */
     [[nodiscard]] const_reference
     front() const noexcept
     {
         return element_from(head_.next_);
     }
 
-    /** Obtain a reference to the last element.
-        @invariant The list may not be empty.
-        @return A reference to the last element.
-    */
+    /**
+     * Obtain a reference to the last element.
+     * @invariant The list may not be empty.
+     * @return A reference to the last element.
+     */
     reference
     back() noexcept
     {
         return element_from(tail_.prev_);
     }
 
-    /** Obtain a const reference to the last element.
-        @invariant The list may not be empty.
-        @return A const reference to the last element.
-    */
+    /**
+     * Obtain a const reference to the last element.
+     * @invariant The list may not be empty.
+     * @return A const reference to the last element.
+     */
     [[nodiscard]] const_reference
     back() const noexcept
     {
         return element_from(tail_.prev_);
     }
 
-    /** Obtain an iterator to the beginning of the list.
-        @return An iterator pointing to the beginning of the list.
-    */
+    /**
+     * Obtain an iterator to the beginning of the list.
+     * @return An iterator pointing to the beginning of the list.
+     */
     iterator
     begin() noexcept
     {
         return iterator(head_.next_);
     }
 
-    /** Obtain a const iterator to the beginning of the list.
-        @return A const iterator pointing to the beginning of the list.
-    */
+    /**
+     * Obtain a const iterator to the beginning of the list.
+     * @return A const iterator pointing to the beginning of the list.
+     */
     [[nodiscard]] const_iterator
     begin() const noexcept
     {
         return const_iterator(head_.next_);
     }
 
-    /** Obtain a const iterator to the beginning of the list.
-        @return A const iterator pointing to the beginning of the list.
-    */
+    /**
+     * Obtain a const iterator to the beginning of the list.
+     * @return A const iterator pointing to the beginning of the list.
+     */
     [[nodiscard]] const_iterator
     cbegin() const noexcept
     {
         return const_iterator(head_.next_);
     }
 
-    /** Obtain a iterator to the end of the list.
-        @return An iterator pointing to the end of the list.
-    */
+    /**
+     * Obtain a iterator to the end of the list.
+     * @return An iterator pointing to the end of the list.
+     */
     iterator
     end() noexcept
     {
         return iterator(&tail_);
     }
 
-    /** Obtain a const iterator to the end of the list.
-        @return A constiterator pointing to the end of the list.
-    */
+    /**
+     * Obtain a const iterator to the end of the list.
+     * @return A constiterator pointing to the end of the list.
+     */
     [[nodiscard]] const_iterator
     end() const noexcept
     {
         return const_iterator(&tail_);
     }
 
-    /** Obtain a const iterator to the end of the list
-        @return A constiterator pointing to the end of the list.
-    */
+    /**
+     * Obtain a const iterator to the end of the list
+     * @return A constiterator pointing to the end of the list.
+     */
     [[nodiscard]] const_iterator
     cend() const noexcept
     {
         return const_iterator(&tail_);
     }
 
-    /** Clear the list.
-        @note This does not free the elements.
-    */
+    /**
+     * Clear the list.
+     * @note This does not free the elements.
+     */
     void
     clear() noexcept
     {
@@ -407,12 +426,13 @@ public:
         size_ = 0;
     }
 
-    /** Insert an element.
-        @invariant The element must not already be in the list.
-        @param pos The location to insert after.
-        @param element The element to insert.
-        @return An iterator pointing to the newly inserted element.
-    */
+    /**
+     * Insert an element.
+     * @invariant The element must not already be in the list.
+     * @param pos The location to insert after.
+     * @param element The element to insert.
+     * @return An iterator pointing to the newly inserted element.
+     */
     iterator
     insert(iterator pos, T& element) noexcept
     {
@@ -425,11 +445,12 @@ public:
         return iterator(node);
     }
 
-    /** Insert another list into this one.
-        The other list is cleared.
-        @param pos The location to insert after.
-        @param other The list to insert.
-    */
+    /**
+     * Insert another list into this one.
+     * The other list is cleared.
+     * @param pos The location to insert after.
+     * @param other The list to insert.
+     */
     void
     insert(iterator pos, List& other) noexcept
     {
@@ -445,11 +466,12 @@ public:
         }
     }
 
-    /** Remove an element.
-        @invariant The element must exist in the list.
-        @param pos An iterator pointing to the element to remove.
-        @return An iterator pointing to the next element after the one removed.
-    */
+    /**
+     * Remove an element.
+     * @invariant The element must exist in the list.
+     * @param pos An iterator pointing to the element to remove.
+     * @return An iterator pointing to the next element after the one removed.
+     */
     iterator
     erase(iterator pos) noexcept
     {
@@ -461,20 +483,22 @@ public:
         return pos;
     }
 
-    /** Insert an element at the beginning of the list.
-        @invariant The element must not exist in the list.
-        @param element The element to insert.
-    */
+    /**
+     * Insert an element at the beginning of the list.
+     * @invariant The element must not exist in the list.
+     * @param element The element to insert.
+     */
     iterator
     pushFront(T& element) noexcept
     {
         return insert(begin(), element);
     }
 
-    /** Remove the element at the beginning of the list.
-        @invariant The list must not be empty.
-        @return A reference to the popped element.
-    */
+    /**
+     * Remove the element at the beginning of the list.
+     * @invariant The list must not be empty.
+     * @return A reference to the popped element.
+     */
     T&
     popFront() noexcept
     {
@@ -483,20 +507,22 @@ public:
         return element;
     }
 
-    /** Append an element at the end of the list.
-        @invariant The element must not exist in the list.
-        @param element The element to append.
-    */
+    /**
+     * Append an element at the end of the list.
+     * @invariant The element must not exist in the list.
+     * @param element The element to append.
+     */
     iterator
     pushBack(T& element) noexcept
     {
         return insert(end(), element);
     }
 
-    /** Remove the element at the end of the list.
-        @invariant The list must not be empty.
-        @return A reference to the popped element.
-    */
+    /**
+     * Remove the element at the end of the list.
+     * @invariant The list must not be empty.
+     * @return A reference to the popped element.
+     */
     T&
     popBack() noexcept
     {
@@ -505,7 +531,9 @@ public:
         return element;
     }
 
-    /** Swap contents with another list. */
+    /**
+     * Swap contents with another list.
+     */
     void
     swap(List& other) noexcept
     {
@@ -515,42 +543,46 @@ public:
         append(temp);
     }
 
-    /** Insert another list at the beginning of this list.
-        The other list is cleared.
-        @param list The other list to insert.
-    */
+    /**
+     * Insert another list at the beginning of this list.
+     * The other list is cleared.
+     * @param list The other list to insert.
+     */
     iterator
     prepend(List& list) noexcept
     {
         return insert(begin(), list);
     }
 
-    /** Append another list at the end of this list.
-        The other list is cleared.
-        @param list the other list to append.
-    */
+    /**
+     * Append another list at the end of this list.
+     * The other list is cleared.
+     * @param list the other list to append.
+     */
     iterator
     append(List& list) noexcept
     {
         return insert(end(), list);
     }
 
-    /** Obtain an iterator from an element.
-        @invariant The element must exist in the list.
-        @param element The element to obtain an iterator for.
-        @return An iterator to the element.
-    */
+    /**
+     * Obtain an iterator from an element.
+     * @invariant The element must exist in the list.
+     * @param element The element to obtain an iterator for.
+     * @return An iterator to the element.
+     */
     iterator
     iteratorTo(T& element) const noexcept
     {
         return iterator(static_cast<Node*>(&element));
     }
 
-    /** Obtain a const iterator from an element.
-        @invariant The element must exist in the list.
-        @param element The element to obtain an iterator for.
-        @return A const iterator to the element.
-    */
+    /**
+     * Obtain a const iterator from an element.
+     * @invariant The element must exist in the list.
+     * @param element The element to obtain an iterator for.
+     * @return A const iterator to the element.
+     */
     [[nodiscard]] const_iterator
     constIteratorTo(T const& element) const noexcept
     {
diff --git a/include/xrpl/beast/core/LockFreeStack.h b/include/xrpl/beast/core/LockFreeStack.h
index dd135d2d98..849edc8fce 100644
--- a/include/xrpl/beast/core/LockFreeStack.h
+++ b/include/xrpl/beast/core/LockFreeStack.h
@@ -103,18 +103,19 @@ operator!=(
 
 //------------------------------------------------------------------------------
 
-/** Multiple Producer, Multiple Consumer (MPMC) intrusive stack.
-
-    This stack is implemented using the same intrusive interface as List.
-    All mutations are lock-free.
-
-    The caller is responsible for preventing the "ABA" problem:
-        http://en.wikipedia.org/wiki/ABA_problem
-
-    @param Tag  A type name used to distinguish lists and nodes, for
-                putting objects in multiple lists. If this parameter is
-                omitted, the default tag is used.
-*/
+/**
+ * Multiple Producer, Multiple Consumer (MPMC) intrusive stack.
+ *
+ * This stack is implemented using the same intrusive interface as List.
+ * All mutations are lock-free.
+ *
+ * The caller is responsible for preventing the "ABA" problem:
+ *     http://en.wikipedia.org/wiki/ABA_problem
+ *
+ * @param Tag  A type name used to distinguish lists and nodes, for
+ *             putting objects in multiple lists. If this parameter is
+ *             omitted, the default tag is used.
+ */
 template <class Element, class Tag = void>
 class LockFreeStack
 {
@@ -162,24 +163,27 @@ public:
     LockFreeStack&
     operator=(LockFreeStack const&) = delete;
 
-    /** Returns true if the stack is empty. */
+    /**
+     * Returns true if the stack is empty.
+     */
     [[nodiscard]] bool
     empty() const
     {
         return head_.load() == &end_;
     }
 
-    /** Push a node onto the stack.
-        The caller is responsible for preventing the ABA problem.
-        This operation is lock-free.
-        Thread safety:
-            Safe to call from any thread.
-
-        @param node The node to push.
-
-        @return `true` if the stack was previously empty. If multiple threads
-                are attempting to push, only one will receive `true`.
-    */
+    /**
+     * Push a node onto the stack.
+     * The caller is responsible for preventing the ABA problem.
+     * This operation is lock-free.
+     * Thread safety:
+     *     Safe to call from any thread.
+     *
+     * @param node The node to push.
+     *
+     * @return `true` if the stack was previously empty. If multiple threads
+     *         are attempting to push, only one will receive `true`.
+     */
     // VFALCO NOTE Fix this, shouldn't it be a reference like intrusive list?
     bool
     pushFront(Node* node)
@@ -195,15 +199,16 @@ public:
         return first;
     }
 
-    /** Pop an element off the stack.
-        The caller is responsible for preventing the ABA problem.
-        This operation is lock-free.
-        Thread safety:
-            Safe to call from any thread.
-
-        @return The element that was popped, or `nullptr` if the stack
-                was empty.
-    */
+    /**
+     * Pop an element off the stack.
+     * The caller is responsible for preventing the ABA problem.
+     * This operation is lock-free.
+     * Thread safety:
+     *     Safe to call from any thread.
+     *
+     * @return The element that was popped, or `nullptr` if the stack
+     *         was empty.
+     */
     Element*
     popFront()
     {
@@ -219,12 +224,13 @@ public:
         return static_cast<Element*>(node);
     }
 
-    /** Return a forward iterator to the beginning or end of the stack.
-        Undefined behavior results if push_front or pop_front is called
-        while an iteration is in progress.
-        Thread safety:
-            Caller is responsible for synchronization.
-    */
+    /**
+     * Return a forward iterator to the beginning or end of the stack.
+     * Undefined behavior results if push_front or pop_front is called
+     * while an iteration is in progress.
+     * Thread safety:
+     *     Caller is responsible for synchronization.
+     */
     /** @{ */
     iterator
     begin()
diff --git a/include/xrpl/beast/core/SemanticVersion.h b/include/xrpl/beast/core/SemanticVersion.h
index 826a43d3f8..338942c252 100644
--- a/include/xrpl/beast/core/SemanticVersion.h
+++ b/include/xrpl/beast/core/SemanticVersion.h
@@ -6,13 +6,14 @@
 
 namespace beast {
 
-/** A Semantic Version number.
-
-    Identifies the build of a particular version of software using
-    the Semantic Versioning Specification described here:
-
-    http://semver.org/
-*/
+/**
+ * A Semantic Version number.
+ *
+ * Identifies the build of a particular version of software using
+ * the Semantic Versioning Specification described here:
+ *
+ * http://semver.org/
+ */
 class SemanticVersion
 {
 public:
@@ -29,14 +30,17 @@ public:
 
     SemanticVersion(std::string_view version);
 
-    /** Parse a semantic version string.
-        The parsing is as strict as possible.
-        @return `true` if the string was parsed.
-    */
+    /**
+     * Parse a semantic version string.
+     * The parsing is as strict as possible.
+     * @return `true` if the string was parsed.
+     */
     bool
     parse(std::string_view input);
 
-    /** Produce a string from semantic version components. */
+    /**
+     * Produce a string from semantic version components.
+     */
     [[nodiscard]] std::string
     print() const;
 
@@ -52,9 +56,10 @@ public:
     }
 };
 
-/** Compare two SemanticVersions against each other.
-    The comparison follows the rules as per the specification.
-*/
+/**
+ * Compare two SemanticVersions against each other.
+ * The comparison follows the rules as per the specification.
+ */
 int
 compare(SemanticVersion const& lhs, SemanticVersion const& rhs);
 
diff --git a/include/xrpl/beast/hash/hash_append.h b/include/xrpl/beast/hash/hash_append.h
index 3592ffbfe8..c5374f95e5 100644
--- a/include/xrpl/beast/hash/hash_append.h
+++ b/include/xrpl/beast/hash/hash_append.h
@@ -135,19 +135,20 @@ struct IsUniquelyRepresented<std::array<T, N>>
     explicit IsUniquelyRepresented() = default;
 };
 
-/** Metafunction returning `true` if the type can be hashed in one call.
-
-    For `IsContiguouslyHashable<T>::value` to be true, then for every
-    combination of possible values of `T` held in `x` and `y`,
-    if `x == y`, then it must be true that `memcmp(&x, &y, sizeof(T))`
-    return 0; i.e. that `x` and `y` are represented by the same bit pattern.
-
-    For example:  A two's complement `int` should be contiguously hashable.
-    Every bit pattern produces a unique value that does not compare equal to
-    any other bit pattern's value.  A IEEE floating point should not be
-    contiguously hashable because -0. and 0. have different bit patterns,
-    though they compare equal.
-*/
+/**
+ * Metafunction returning `true` if the type can be hashed in one call.
+ *
+ * For `IsContiguouslyHashable<T>::value` to be true, then for every
+ * combination of possible values of `T` held in `x` and `y`,
+ * if `x == y`, then it must be true that `memcmp(&x, &y, sizeof(T))`
+ * return 0; i.e. that `x` and `y` are represented by the same bit pattern.
+ *
+ * For example:  A two's complement `int` should be contiguously hashable.
+ * Every bit pattern produces a unique value that does not compare equal to
+ * any other bit pattern's value.  A IEEE floating point should not be
+ * contiguously hashable because -0. and 0. have different bit patterns,
+ * though they compare equal.
+ */
 /** @{ */
 template <class T, class HashAlgorithm>
 struct IsContiguouslyHashable
@@ -172,29 +173,30 @@ struct IsContiguouslyHashable<T[N], HashAlgorithm>
 
 //------------------------------------------------------------------------------
 
-/** Logically concatenate input data to a `Hasher`.
-
-    Hasher requirements:
-
-        `X` is the type `Hasher`
-        `h` is a value of type `x`
-        `p` is a value convertible to `void const*`
-        `n` is a value of type `std::size_t`, greater than zero
-
-        Expression:
-            `h.append (p, n);`
-        Throws:
-            Never
-        Effect:
-            Adds the input data to the hasher state.
-
-        Expression:
-            `static_cast<std::size_t>(j)`
-        Throws:
-            Never
-        Effect:
-            Returns the resulting hash of all the input data.
-*/
+/**
+ * Logically concatenate input data to a `Hasher`.
+ *
+ * Hasher requirements:
+ *
+ *     `X` is the type `Hasher`
+ *     `h` is a value of type `x`
+ *     `p` is a value convertible to `void const*`
+ *     `n` is a value of type `std::size_t`, greater than zero
+ *
+ *     Expression:
+ *         `h.append (p, n);`
+ *     Throws:
+ *         Never
+ *     Effect:
+ *         Adds the input data to the hasher state.
+ *
+ *     Expression:
+ *         `static_cast<std::size_t>(j)`
+ *     Throws:
+ *         Never
+ *     Effect:
+ *         Returns the resulting hash of all the input data.
+ */
 /** @{ */
 
 // scalars
diff --git a/include/xrpl/beast/insight/Collector.h b/include/xrpl/beast/insight/Collector.h
index 3f83e329d4..9da2a8bb74 100644
--- a/include/xrpl/beast/insight/Collector.h
+++ b/include/xrpl/beast/insight/Collector.h
@@ -12,16 +12,17 @@
 
 namespace beast::insight {
 
-/** Interface for a manager that allows collection of metrics.
-
-    To export metrics from a class, pass and save a shared_ptr to this
-    interface in the class constructor. Create the metric objects
-    as desired (counters, events, gauges, meters, and an optional hook)
-    using the interface.
-
-    @see Counter, Event, Gauge, Hook, Meter
-    @see NullCollector, StatsDCollector
-*/
+/**
+ * Interface for a manager that allows collection of metrics.
+ *
+ * To export metrics from a class, pass and save a shared_ptr to this
+ * interface in the class constructor. Create the metric objects
+ * as desired (counters, events, gauges, meters, and an optional hook)
+ * using the interface.
+ *
+ * @see Counter, Event, Gauge, Hook, Meter
+ * @see NullCollector, StatsDCollector
+ */
 class Collector
 {
 public:
@@ -29,18 +30,19 @@ public:
 
     virtual ~Collector() = 0;
 
-    /** Create a hook.
-
-        A hook is called at each collection interval, on an implementation
-        defined thread. This is a convenience facility for gathering metrics
-        in the polling style. The typical usage is to update all the metrics
-        of interest in the handler.
-
-        Handler will be called with this signature:
-            void handler (void)
-
-        @see Hook
-    */
+    /**
+     * Create a hook.
+     *
+     * A hook is called at each collection interval, on an implementation
+     * defined thread. This is a convenience facility for gathering metrics
+     * in the polling style. The typical usage is to update all the metrics
+     * of interest in the handler.
+     *
+     * Handler will be called with this signature:
+     *     void handler (void)
+     *
+     * @see Hook
+     */
     /** @{ */
     template <class Handler>
     Hook
@@ -53,9 +55,10 @@ public:
     makeHook(HookImpl::HandlerType const& handler) = 0;
     /** @} */
 
-    /** Create a counter with the specified name.
-        @see Counter
-    */
+    /**
+     * Create a counter with the specified name.
+     * @see Counter
+     */
     /** @{ */
     virtual Counter
     makeCounter(std::string const& name) = 0;
@@ -69,9 +72,10 @@ public:
     }
     /** @} */
 
-    /** Create an event with the specified name.
-        @see Event
-    */
+    /**
+     * Create an event with the specified name.
+     * @see Event
+     */
     /** @{ */
     virtual Event
     makeEvent(std::string const& name) = 0;
@@ -85,9 +89,10 @@ public:
     }
     /** @} */
 
-    /** Create a gauge with the specified name.
-        @see Gauge
-    */
+    /**
+     * Create a gauge with the specified name.
+     * @see Gauge
+     */
     /** @{ */
     virtual Gauge
     makeGauge(std::string const& name) = 0;
@@ -101,9 +106,10 @@ public:
     }
     /** @} */
 
-    /** Create a meter with the specified name.
-        @see Meter
-    */
+    /**
+     * Create a meter with the specified name.
+     * @see Meter
+     */
     /** @{ */
     virtual Meter
     makeMeter(std::string const& name) = 0;
diff --git a/include/xrpl/beast/insight/Counter.h b/include/xrpl/beast/insight/Counter.h
index 482808b2c7..875fadf33a 100644
--- a/include/xrpl/beast/insight/Counter.h
+++ b/include/xrpl/beast/insight/Counter.h
@@ -7,34 +7,39 @@
 
 namespace beast::insight {
 
-/** A metric for measuring an integral value.
-
-    A counter is a gauge calculated at the server. The owner of the counter
-    may increment and decrement the value by an amount.
-
-    This is a lightweight reference wrapper which is cheap to copy and assign.
-    When the last reference goes away, the metric is no longer collected.
-*/
+/**
+ * A metric for measuring an integral value.
+ *
+ * A counter is a gauge calculated at the server. The owner of the counter
+ * may increment and decrement the value by an amount.
+ *
+ * This is a lightweight reference wrapper which is cheap to copy and assign.
+ * When the last reference goes away, the metric is no longer collected.
+ */
 class Counter final
 {
 public:
     using value_type = CounterImpl::value_type;
 
-    /** Create a null metric.
-        A null metric reports no information.
-    */
+    /**
+     * Create a null metric.
+     * A null metric reports no information.
+     */
     Counter() = default;
 
-    /** Create the metric reference the specified implementation.
-        Normally this won't be called directly. Instead, call the appropriate
-        factory function in the Collector interface.
-        @see Collector.
-    */
+    /**
+     * Create the metric reference the specified implementation.
+     * Normally this won't be called directly. Instead, call the appropriate
+     * factory function in the Collector interface.
+     * @see Collector.
+     */
     explicit Counter(std::shared_ptr<CounterImpl> impl) : impl_(std::move(impl))
     {
     }
 
-    /** Increment the counter. */
+    /**
+     * Increment the counter.
+     */
     /** @{ */
     void
     increment(value_type amount) const
diff --git a/include/xrpl/beast/insight/Event.h b/include/xrpl/beast/insight/Event.h
index afccf9baba..c3ff1a8877 100644
--- a/include/xrpl/beast/insight/Event.h
+++ b/include/xrpl/beast/insight/Event.h
@@ -8,35 +8,40 @@
 
 namespace beast::insight {
 
-/** A metric for reporting event timing.
-
-    An event is an operation that has an associated millisecond time, or
-    other integral value. Because events happen at a specific moment, the
-    metric only supports a push-style interface.
-
-    This is a lightweight reference wrapper which is cheap to copy and assign.
-    When the last reference goes away, the metric is no longer collected.
-*/
+/**
+ * A metric for reporting event timing.
+ *
+ * An event is an operation that has an associated millisecond time, or
+ * other integral value. Because events happen at a specific moment, the
+ * metric only supports a push-style interface.
+ *
+ * This is a lightweight reference wrapper which is cheap to copy and assign.
+ * When the last reference goes away, the metric is no longer collected.
+ */
 class Event final
 {
 public:
     using value_type = EventImpl::value_type;
 
-    /** Create a null metric.
-        A null metric reports no information.
-    */
+    /**
+     * Create a null metric.
+     * A null metric reports no information.
+     */
     Event() = default;
 
-    /** Create the metric reference the specified implementation.
-        Normally this won't be called directly. Instead, call the appropriate
-        factory function in the Collector interface.
-        @see Collector.
-    */
+    /**
+     * Create the metric reference the specified implementation.
+     * Normally this won't be called directly. Instead, call the appropriate
+     * factory function in the Collector interface.
+     * @see Collector.
+     */
     explicit Event(std::shared_ptr<EventImpl> impl) : impl_(std::move(impl))
     {
     }
 
-    /** Push an event notification. */
+    /**
+     * Push an event notification.
+     */
     template <class Rep, class Period>
     void
     notify(std::chrono::duration<Rep, Period> const& value) const
diff --git a/include/xrpl/beast/insight/Gauge.h b/include/xrpl/beast/insight/Gauge.h
index 9a23ea6665..ef62e252b3 100644
--- a/include/xrpl/beast/insight/Gauge.h
+++ b/include/xrpl/beast/insight/Gauge.h
@@ -7,40 +7,44 @@
 
 namespace beast::insight {
 
-/** A metric for measuring an integral value.
-
-    A gauge is an instantaneous measurement of a value, like the gas gauge
-    in a car. The caller directly sets the value, or adjusts it by a
-    specified amount. The value is kept in the client rather than the collector.
-
-    This is a lightweight reference wrapper which is cheap to copy and assign.
-    When the last reference goes away, the metric is no longer collected.
-*/
+/**
+ * A metric for measuring an integral value.
+ *
+ * A gauge is an instantaneous measurement of a value, like the gas gauge
+ * in a car. The caller directly sets the value, or adjusts it by a
+ * specified amount. The value is kept in the client rather than the collector.
+ *
+ * This is a lightweight reference wrapper which is cheap to copy and assign.
+ * When the last reference goes away, the metric is no longer collected.
+ */
 class Gauge final
 {
 public:
     using value_type = GaugeImpl::value_type;
     using difference_type = GaugeImpl::difference_type;
 
-    /** Create a null metric.
-        A null metric reports no information.
-    */
+    /**
+     * Create a null metric.
+     * A null metric reports no information.
+     */
     Gauge() = default;
 
-    /** Create the metric reference the specified implementation.
-        Normally this won't be called directly. Instead, call the appropriate
-        factory function in the Collector interface.
-        @see Collector.
-    */
+    /**
+     * Create the metric reference the specified implementation.
+     * Normally this won't be called directly. Instead, call the appropriate
+     * factory function in the Collector interface.
+     * @see Collector.
+     */
     explicit Gauge(std::shared_ptr<GaugeImpl> impl) : impl_(std::move(impl))
     {
     }
 
-    /** Set the value on the gauge.
-        A Collector implementation should combine multiple calls to value
-        changes into a single change if the calls occur within a single
-        collection interval.
-    */
+    /**
+     * Set the value on the gauge.
+     * A Collector implementation should combine multiple calls to value
+     * changes into a single change if the calls occur within a single
+     * collection interval.
+     */
     /** @{ */
     void
     set(value_type value) const
@@ -62,7 +66,9 @@ public:
     }
     /** @} */
 
-    /** Adjust the value of the gauge. */
+    /**
+     * Adjust the value of the gauge.
+     */
     /** @{ */
     void
     increment(difference_type amount) const
diff --git a/include/xrpl/beast/insight/Group.h b/include/xrpl/beast/insight/Group.h
index 3e0eb93452..ecf7709546 100644
--- a/include/xrpl/beast/insight/Group.h
+++ b/include/xrpl/beast/insight/Group.h
@@ -7,13 +7,17 @@
 
 namespace beast::insight {
 
-/** A collector front-end that manages a group of metrics. */
+/**
+ * A collector front-end that manages a group of metrics.
+ */
 class Group : public Collector
 {
 public:
     using ptr = std::shared_ptr<Group>;
 
-    /** Returns the name of this group, for diagnostics. */
+    /**
+     * Returns the name of this group, for diagnostics.
+     */
     [[nodiscard]] virtual std::string const&
     name() const = 0;
 };
diff --git a/include/xrpl/beast/insight/Groups.h b/include/xrpl/beast/insight/Groups.h
index cfe4d99bdc..77fc2d3336 100644
--- a/include/xrpl/beast/insight/Groups.h
+++ b/include/xrpl/beast/insight/Groups.h
@@ -8,13 +8,17 @@
 
 namespace beast::insight {
 
-/** A container for managing a set of metric groups. */
+/**
+ * A container for managing a set of metric groups.
+ */
 class Groups
 {
 public:
     virtual ~Groups() = 0;
 
-    /** Find or create a new collector with a given name. */
+    /**
+     * Find or create a new collector with a given name.
+     */
     /** @{ */
     virtual Group::ptr const&
     get(std::string const& name) = 0;
@@ -27,7 +31,9 @@ public:
     /** @} */
 };
 
-/** Create a group container that uses the specified collector. */
+/**
+ * Create a group container that uses the specified collector.
+ */
 std::unique_ptr<Groups>
 makeGroups(Collector::ptr const& collector);
 
diff --git a/include/xrpl/beast/insight/Hook.h b/include/xrpl/beast/insight/Hook.h
index 8dbe5a4be0..572a9ffcb4 100644
--- a/include/xrpl/beast/insight/Hook.h
+++ b/include/xrpl/beast/insight/Hook.h
@@ -7,20 +7,24 @@
 
 namespace beast::insight {
 
-/** A reference to a handler for performing polled collection. */
+/**
+ * A reference to a handler for performing polled collection.
+ */
 class Hook final
 {
 public:
-    /** Create a null hook.
-        A null hook has no associated handler.
-    */
+    /**
+     * Create a null hook.
+     * A null hook has no associated handler.
+     */
     Hook() = default;
 
-    /** Create a hook referencing the specified implementation.
-        Normally this won't be called directly. Instead, call the appropriate
-        factory function in the Collector interface.
-        @see Collector.
-    */
+    /**
+     * Create a hook referencing the specified implementation.
+     * Normally this won't be called directly. Instead, call the appropriate
+     * factory function in the Collector interface.
+     * @see Collector.
+     */
     explicit Hook(std::shared_ptr<HookImpl> impl) : impl_(std::move(impl))
     {
     }
diff --git a/include/xrpl/beast/insight/Meter.h b/include/xrpl/beast/insight/Meter.h
index 25ffabd928..ac2f3a352c 100644
--- a/include/xrpl/beast/insight/Meter.h
+++ b/include/xrpl/beast/insight/Meter.h
@@ -7,33 +7,38 @@
 
 namespace beast::insight {
 
-/** A metric for measuring an integral value.
-
-    A meter may be thought of as an increment-only counter.
-
-    This is a lightweight reference wrapper which is cheap to copy and assign.
-    When the last reference goes away, the metric is no longer collected.
-*/
+/**
+ * A metric for measuring an integral value.
+ *
+ * A meter may be thought of as an increment-only counter.
+ *
+ * This is a lightweight reference wrapper which is cheap to copy and assign.
+ * When the last reference goes away, the metric is no longer collected.
+ */
 class Meter final
 {
 public:
     using value_type = MeterImpl::value_type;
 
-    /** Create a null metric.
-        A null metric reports no information.
-    */
+    /**
+     * Create a null metric.
+     * A null metric reports no information.
+     */
     Meter() = default;
 
-    /** Create the metric reference the specified implementation.
-        Normally this won't be called directly. Instead, call the appropriate
-        factory function in the Collector interface.
-        @see Collector.
-    */
+    /**
+     * Create the metric reference the specified implementation.
+     * Normally this won't be called directly. Instead, call the appropriate
+     * factory function in the Collector interface.
+     * @see Collector.
+     */
     explicit Meter(std::shared_ptr<MeterImpl> impl) : impl_(std::move(impl))
     {
     }
 
-    /** Increment the meter. */
+    /**
+     * Increment the meter.
+     */
     /** @{ */
     void
     increment(value_type amount) const
diff --git a/include/xrpl/beast/insight/NullCollector.h b/include/xrpl/beast/insight/NullCollector.h
index 67903420fa..ffafe6d6d5 100644
--- a/include/xrpl/beast/insight/NullCollector.h
+++ b/include/xrpl/beast/insight/NullCollector.h
@@ -6,7 +6,9 @@
 
 namespace beast::insight {
 
-/** A Collector which does not collect metrics. */
+/**
+ * A Collector which does not collect metrics.
+ */
 class NullCollector : public Collector
 {
 public:
diff --git a/include/xrpl/beast/insight/StatsDCollector.h b/include/xrpl/beast/insight/StatsDCollector.h
index 9a438c48f1..e14d3a27ff 100644
--- a/include/xrpl/beast/insight/StatsDCollector.h
+++ b/include/xrpl/beast/insight/StatsDCollector.h
@@ -9,20 +9,22 @@
 
 namespace beast::insight {
 
-/** A Collector that reports metrics to a StatsD server.
-    Reference:
-        https://github.com/b/statsd_spec
-*/
+/**
+ * A Collector that reports metrics to a StatsD server.
+ * Reference:
+ *     https://github.com/b/statsd_spec
+ */
 class StatsDCollector : public Collector
 {
 public:
     explicit StatsDCollector() = default;
 
-    /** Create a StatsD collector.
-        @param address The IP address and port of the StatsD server.
-        @param prefix A string pre-pended before each metric name.
-        @param journal Destination for logging output.
-    */
+    /**
+     * Create a StatsD collector.
+     * @param address The IP address and port of the StatsD server.
+     * @param prefix A string pre-pended before each metric name.
+     * @param journal Destination for logging output.
+     */
     static std::shared_ptr<StatsDCollector>
     make(IP::Endpoint const& address, std::string const& prefix, Journal journal);
 };
diff --git a/include/xrpl/beast/net/IPAddress.h b/include/xrpl/beast/net/IPAddress.h
index f4327b7b8a..4f4fb189a6 100644
--- a/include/xrpl/beast/net/IPAddress.h
+++ b/include/xrpl/beast/net/IPAddress.h
@@ -19,42 +19,54 @@ namespace IP {
 
 using Address = boost::asio::ip::address;
 
-/** Returns the address represented as a string. */
+/**
+ * Returns the address represented as a string.
+ */
 inline std::string
 to_string(Address const& addr)
 {
     return addr.to_string();
 }
 
-/** Returns `true` if this is a loopback address. */
+/**
+ * Returns `true` if this is a loopback address.
+ */
 inline bool
 isLoopback(Address const& addr)
 {
     return addr.is_loopback();
 }
 
-/** Returns `true` if the address is unspecified. */
+/**
+ * Returns `true` if the address is unspecified.
+ */
 inline bool
 isUnspecified(Address const& addr)
 {
     return addr.is_unspecified();
 }
 
-/** Returns `true` if the address is a multicast address. */
+/**
+ * Returns `true` if the address is a multicast address.
+ */
 inline bool
 isMulticast(Address const& addr)
 {
     return addr.is_multicast();
 }
 
-/** Returns `true` if the address is a private unroutable address. */
+/**
+ * Returns `true` if the address is a private unroutable address.
+ */
 inline bool
 isPrivate(Address const& addr)
 {
     return (addr.is_v4()) ? isPrivate(addr.to_v4()) : isPrivate(addr.to_v6());
 }
 
-/** Returns `true` if the address is a public routable address. */
+/**
+ * Returns `true` if the address is a public routable address.
+ */
 inline bool
 isPublic(Address const& addr)
 {
diff --git a/include/xrpl/beast/net/IPAddressConversion.h b/include/xrpl/beast/net/IPAddressConversion.h
index b5fb697233..73777cf841 100644
--- a/include/xrpl/beast/net/IPAddressConversion.h
+++ b/include/xrpl/beast/net/IPAddressConversion.h
@@ -6,23 +6,29 @@
 
 namespace beast::IP {
 
-/** Convert to Endpoint.
-    The port is set to zero.
-*/
+/**
+ * Convert to Endpoint.
+ * The port is set to zero.
+ */
 Endpoint
 fromAsio(boost::asio::ip::address const& address);
 
-/** Convert to Endpoint. */
+/**
+ * Convert to Endpoint.
+ */
 Endpoint
 fromAsio(boost::asio::ip::tcp::endpoint const& endpoint);
 
-/** Convert to asio::ip::address.
-    The port is ignored.
-*/
+/**
+ * Convert to asio::ip::address.
+ * The port is ignored.
+ */
 boost::asio::ip::address
 toAsioAddress(Endpoint const& endpoint);
 
-/** Convert to asio::ip::tcp::endpoint. */
+/**
+ * Convert to asio::ip::tcp::endpoint.
+ */
 boost::asio::ip::tcp::endpoint
 toAsioEndpoint(Endpoint const& endpoint);
 
diff --git a/include/xrpl/beast/net/IPAddressV4.h b/include/xrpl/beast/net/IPAddressV4.h
index 9367fbe1eb..94943af3ea 100644
--- a/include/xrpl/beast/net/IPAddressV4.h
+++ b/include/xrpl/beast/net/IPAddressV4.h
@@ -6,17 +6,22 @@ namespace beast::IP {
 
 using AddressV4 = boost::asio::ip::address_v4;
 
-/** Returns `true` if the address is a private unroutable address. */
+/**
+ * Returns `true` if the address is a private unroutable address.
+ */
 bool
 isPrivate(AddressV4 const& addr);
 
-/** Returns `true` if the address is a public routable address. */
+/**
+ * Returns `true` if the address is a public routable address.
+ */
 bool
 isPublic(AddressV4 const& addr);
 
-/** Returns the address class for the given address.
-    @note Class 'D' represents multicast addresses (224.*.*.*).
-*/
+/**
+ * Returns the address class for the given address.
+ * @note Class 'D' represents multicast addresses (224.*.*.*).
+ */
 char
 getClass(AddressV4 const& address);
 
diff --git a/include/xrpl/beast/net/IPAddressV6.h b/include/xrpl/beast/net/IPAddressV6.h
index 1bfa079990..b51cb62532 100644
--- a/include/xrpl/beast/net/IPAddressV6.h
+++ b/include/xrpl/beast/net/IPAddressV6.h
@@ -6,11 +6,15 @@ namespace beast::IP {
 
 using AddressV6 = boost::asio::ip::address_v6;
 
-/** Returns `true` if the address is a private unroutable address. */
+/**
+ * Returns `true` if the address is a private unroutable address.
+ */
 bool
 isPrivate(AddressV6 const& addr);
 
-/** Returns `true` if the address is a public routable address. */
+/**
+ * Returns `true` if the address is a public routable address.
+ */
 bool
 isPublic(AddressV6 const& addr);
 
diff --git a/include/xrpl/beast/net/IPEndpoint.h b/include/xrpl/beast/net/IPEndpoint.h
index 0b661108f2..c4b269e9c3 100644
--- a/include/xrpl/beast/net/IPEndpoint.h
+++ b/include/xrpl/beast/net/IPEndpoint.h
@@ -17,51 +17,68 @@ namespace beast::IP {
 
 using Port = std::uint16_t;
 
-/** A version-independent IP address and port combination. */
+/**
+ * A version-independent IP address and port combination.
+ */
 class Endpoint
 {
 public:
-    /** Create an unspecified endpoint. */
+    /**
+     * Create an unspecified endpoint.
+     */
     Endpoint();
 
-    /** Create an endpoint from the address and optional port. */
+    /**
+     * Create an endpoint from the address and optional port.
+     */
     explicit Endpoint(Address addr, Port port = 0);
 
-    /** Create an Endpoint from a string.
-        If the port is omitted, the endpoint will have a zero port.
-        @return An optional endpoint; will be `std::nullopt` on failure
-    */
+    /**
+     * Create an Endpoint from a string.
+     * If the port is omitted, the endpoint will have a zero port.
+     * @return An optional endpoint; will be `std::nullopt` on failure
+     */
     static std::optional<Endpoint>
     fromStringChecked(std::string const& s);
     static Endpoint
     fromString(std::string const& s);
 
-    /** Returns a string representing the endpoint. */
+    /**
+     * Returns a string representing the endpoint.
+     */
     [[nodiscard]] std::string
     toString() const;
 
-    /** Returns the port number on the endpoint. */
+    /**
+     * Returns the port number on the endpoint.
+     */
     [[nodiscard]] Port
     port() const
     {
         return port_;
     }
 
-    /** Returns a new Endpoint with a different port. */
+    /**
+     * Returns a new Endpoint with a different port.
+     */
     [[nodiscard]] Endpoint
     atPort(Port port) const
     {
         return Endpoint(addr_, port);
     }
 
-    /** Returns the address portion of this endpoint. */
+    /**
+     * Returns the address portion of this endpoint.
+     */
     [[nodiscard]] Address const&
     address() const
     {
         return addr_;
     }
 
-    /** Convenience accessors for the address part. */
+    /**
+     * Convenience accessors for the address part.
+     */
     /** @{ */
     [[nodiscard]] bool
     isV4() const
@@ -85,7 +102,9 @@ public:
     }
     /** @} */
 
-    /** Arithmetic comparison. */
+    /**
+     * Arithmetic comparison.
+     */
     /** @{ */
     friend bool
     operator==(Endpoint const& lhs, Endpoint const& rhs);
@@ -131,35 +150,45 @@ private:
 
 // Properties
 
-/** Returns `true` if the endpoint is a loopback address. */
+/**
+ * Returns `true` if the endpoint is a loopback address.
+ */
 inline bool
 isLoopback(Endpoint const& endpoint)
 {
     return isLoopback(endpoint.address());
 }
 
-/** Returns `true` if the endpoint is unspecified. */
+/**
+ * Returns `true` if the endpoint is unspecified.
+ */
 inline bool
 isUnspecified(Endpoint const& endpoint)
 {
     return isUnspecified(endpoint.address());
 }
 
-/** Returns `true` if the endpoint is a multicast address. */
+/**
+ * Returns `true` if the endpoint is a multicast address.
+ */
 inline bool
 isMulticast(Endpoint const& endpoint)
 {
     return isMulticast(endpoint.address());
 }
 
-/** Returns `true` if the endpoint is a private unroutable address. */
+/**
+ * Returns `true` if the endpoint is a private unroutable address.
+ */
 inline bool
 isPrivate(Endpoint const& endpoint)
 {
     return isPrivate(endpoint.address());
 }
 
-/** Returns `true` if the endpoint is a public routable address. */
+/**
+ * Returns `true` if the endpoint is a public routable address.
+ */
 inline bool
 isPublic(Endpoint const& endpoint)
 {
@@ -168,14 +197,18 @@ isPublic(Endpoint const& endpoint)
 
 //------------------------------------------------------------------------------
 
-/** Returns the endpoint represented as a string. */
+/**
+ * Returns the endpoint represented as a string.
+ */
 inline std::string
 to_string(Endpoint const& endpoint)
 {
     return endpoint.toString();
 }
 
-/** Output stream conversion. */
+/**
+ * Output stream conversion.
+ */
 template <typename OutputStream>
 OutputStream&
 operator<<(OutputStream& os, Endpoint const& endpoint)
@@ -184,7 +217,9 @@ operator<<(OutputStream& os, Endpoint const& endpoint)
     return os;
 }
 
-/** Input stream conversion. */
+/**
+ * Input stream conversion.
+ */
 std::istream&
 operator>>(std::istream& is, Endpoint& endpoint);
 
@@ -193,7 +228,9 @@ operator>>(std::istream& is, Endpoint& endpoint);
 //------------------------------------------------------------------------------
 
 namespace std {
-/** std::hash support. */
+/**
+ * std::hash support.
+ */
 template <>
 struct hash<::beast::IP::Endpoint>
 {
@@ -208,7 +245,9 @@ struct hash<::beast::IP::Endpoint>
 }  // namespace std
 
 namespace boost {
-/** boost::hash support. */
+/**
+ * boost::hash support.
+ */
 template <>
 struct hash<::beast::IP::Endpoint>
 {
diff --git a/include/xrpl/beast/rfc2616.h b/include/xrpl/beast/rfc2616.h
index 7c681ab140..bd9a78fddb 100644
--- a/include/xrpl/beast/rfc2616.h
+++ b/include/xrpl/beast/rfc2616.h
@@ -30,17 +30,20 @@ struct CiEqualPred
     }
 };
 
-/** Returns `true` if `c` is linear white space.
-
-    This excludes the CRLF sequence allowed for line continuations.
-*/
+/**
+ * Returns `true` if `c` is linear white space.
+ *
+ * This excludes the CRLF sequence allowed for line continuations.
+ */
 inline bool
 isLws(char c)
 {
     return c == ' ' || c == '\t';
 }
 
-/** Returns `true` if `c` is any whitespace character. */
+/**
+ * Returns `true` if `c` is any whitespace character.
+ */
 inline bool
 isWhite(char c)
 {
@@ -87,14 +90,15 @@ trimRight(String const& s)
 
 }  // namespace detail
 
-/** Parse a character sequence of values separated by commas.
-    Double quotes and escape sequences will be converted.  Excess white
-    space, commas, double quotes, and empty elements are not copied.
-    Format:
-       #(token|quoted-string)
-    Reference:
-        http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2
-*/
+/**
+ * Parse a character sequence of values separated by commas.
+ * Double quotes and escape sequences will be converted.  Excess white
+ * space, commas, double quotes, and empty elements are not copied.
+ * Format:
+ *    #(token|quoted-string)
+ * Reference:
+ *     http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2
+ */
 template <
     class FwdIt,
     class Result = std::vector<std::basic_string<typename std::iterator_traits<FwdIt>::value_type>>,
@@ -189,14 +193,15 @@ splitCommas(boost::beast::string_view const& s)
 
 //------------------------------------------------------------------------------
 
-/** Iterates through a comma separated list.
-
-    Meets the requirements of ForwardIterator.
-
-    List defined in rfc2616 2.1.
-
-    @note Values returned may contain backslash escapes.
-*/
+/**
+ * Iterates through a comma separated list.
+ *
+ * Meets the requirements of ForwardIterator.
+ *
+ * List defined in rfc2616 2.1.
+ *
+ * @note Values returned may contain backslash escapes.
+ */
 class ListIterator
 {
     using iter_type = boost::string_ref::const_iterator;
@@ -323,17 +328,20 @@ ListIterator::increment()
         }
     }
 }
-/** Returns true if two strings are equal.
-
-    A case-insensitive comparison is used.
-*/
+/**
+ * Returns true if two strings are equal.
+ *
+ * A case-insensitive comparison is used.
+ */
 inline bool
 ciEqual(boost::string_ref s1, boost::string_ref s2)
 {
     return boost::range::equal(s1, s2, detail::CiEqualPred{});
 }
 
-/** Returns a range representing the list. */
+/**
+ * Returns a range representing the list.
+ */
 inline boost::iterator_range<ListIterator>
 makeList(boost::string_ref const& field)
 {
@@ -341,10 +349,11 @@ makeList(boost::string_ref const& field)
         ListIterator{field.begin(), field.end()}, ListIterator{field.end(), field.end()}};
 }
 
-/** Returns true if the specified token exists in the list.
-
-    A case-insensitive comparison is used.
-*/
+/**
+ * Returns true if the specified token exists in the list.
+ *
+ * A case-insensitive comparison is used.
+ */
 template <class = void>
 bool
 tokenInList(boost::string_ref const& value, boost::string_ref const& token)
diff --git a/include/xrpl/beast/test/yield_to.h b/include/xrpl/beast/test/yield_to.h
index 1a34ec436e..b3aa482dd5 100644
--- a/include/xrpl/beast/test/yield_to.h
+++ b/include/xrpl/beast/test/yield_to.h
@@ -19,12 +19,13 @@
 
 namespace beast::test {
 
-/** Mix-in to support tests using asio coroutines.
-
-    Derive from this class and use yield_to to launch test
-    functions inside coroutines. This is handy for testing
-    asynchronous asio code.
-*/
+/**
+ * Mix-in to support tests using asio coroutines.
+ *
+ * Derive from this class and use yield_to to launch test
+ * functions inside coroutines. This is handy for testing
+ * asynchronous asio code.
+ */
 class EnableYieldTo
 {
 protected:
@@ -38,7 +39,9 @@ private:
     std::size_t running_ = 0;
 
 public:
-    /// The type of yield context passed to functions.
+    /**
+     * The type of yield context passed to functions.
+     */
     using yield_context = boost::asio::yield_context;
 
     explicit EnableYieldTo(std::size_t concurrency = 1) : work_(boost::asio::make_work_guard(ios_))
@@ -57,24 +60,27 @@ public:
             t.join();
     }
 
-    /// Return the `io_context` associated with the object
+    /**
+     * Return the `io_context` associated with the object
+     */
     boost::asio::io_context&
     getIoContext()
     {
         return ios_;
     }
 
-    /** Run one or more functions, each in a coroutine.
-
-        This call will block until all coroutines terminate.
-
-        Each functions should have this signature:
-        @code
-            void f(yield_context);
-        @endcode
-
-        @param fn... One or more functions to invoke.
-    */
+    /**
+     * Run one or more functions, each in a coroutine.
+     *
+     * This call will block until all coroutines terminate.
+     *
+     * Each functions should have this signature:
+     * @code
+     *     void f(yield_context);
+     * @endcode
+     *
+     * @param fn... One or more functions to invoke.
+     */
 #if BEAST_DOXYGEN
     template <class... FN>
     void
diff --git a/include/xrpl/beast/unit_test/amount.h b/include/xrpl/beast/unit_test/amount.h
index 3a392f393f..c1e4357753 100644
--- a/include/xrpl/beast/unit_test/amount.h
+++ b/include/xrpl/beast/unit_test/amount.h
@@ -10,7 +10,9 @@
 
 namespace beast::unit_test {
 
-/** Utility for producing nicely composed output of amounts with units. */
+/**
+ * Utility for producing nicely composed output of amounts with units.
+ */
 class Amount
 {
 private:
diff --git a/include/xrpl/beast/unit_test/detail/const_container.h b/include/xrpl/beast/unit_test/detail/const_container.h
index 6826bf4258..9f4646cbdb 100644
--- a/include/xrpl/beast/unit_test/detail/const_container.h
+++ b/include/xrpl/beast/unit_test/detail/const_container.h
@@ -6,10 +6,11 @@
 
 namespace beast::unit_test::detail {
 
-/** Adapter to constrain a container interface.
-    The interface allows for limited read only operations. Derived classes
-    provide additional behavior.
-*/
+/**
+ * Adapter to constrain a container interface.
+ * The interface allows for limited read only operations. Derived classes
+ * provide additional behavior.
+ */
 template <class Container>
 class ConstContainer
 {
@@ -38,21 +39,27 @@ public:
     using iterator = cont_type::const_iterator;
     using const_iterator = cont_type::const_iterator;
 
-    /** Returns `true` if the container is empty. */
+    /**
+     * Returns `true` if the container is empty.
+     */
     [[nodiscard]] bool
     empty() const
     {
         return cont_.empty();
     }
 
-    /** Returns the number of items in the container. */
+    /**
+     * Returns the number of items in the container.
+     */
     [[nodiscard]] size_type
     size() const
     {
         return cont_.size();
     }
 
-    /** Returns forward iterators for traversal. */
+    /**
+     * Returns forward iterators for traversal.
+     */
     /** @{ */
     [[nodiscard]] const_iterator
     begin() const
diff --git a/include/xrpl/beast/unit_test/global_suites.h b/include/xrpl/beast/unit_test/global_suites.h
index 72ed738bdb..18e5bc3a6b 100644
--- a/include/xrpl/beast/unit_test/global_suites.h
+++ b/include/xrpl/beast/unit_test/global_suites.h
@@ -10,7 +10,9 @@ namespace beast::unit_test {
 
 namespace detail {
 
-/// Holds test suites registered during static initialization.
+/**
+ * Holds test suites registered during static initialization.
+ */
 inline SuiteList&
 globalSuites()
 {
@@ -34,7 +36,9 @@ struct InsertSuite
 
 }  // namespace detail
 
-/// Holds test suites registered during static initialization.
+/**
+ * Holds test suites registered during static initialization.
+ */
 inline SuiteList const&
 globalSuites()
 {
diff --git a/include/xrpl/beast/unit_test/match.h b/include/xrpl/beast/unit_test/match.h
index 5faeaa1100..966574b833 100644
--- a/include/xrpl/beast/unit_test/match.h
+++ b/include/xrpl/beast/unit_test/match.h
@@ -121,42 +121,48 @@ Selector::operator()(SuiteInfo const& s)
 
 // Utility functions for producing predicates to select suites.
 
-/** Returns a predicate that implements a smart matching rule.
-    The predicate checks the suite, module, and library fields of the
-    SuiteInfo in that order. When it finds a match, it changes modes
-    depending on what was found:
-
-        If a suite is matched first, then only the suite is selected. The
-        suite may be marked manual.
-
-        If a module is matched first, then only suites from that module
-        and library not marked manual are selected from then on.
-
-        If a library is matched first, then only suites from that library
-        not marked manual are selected from then on.
-
-*/
+/**
+ * Returns a predicate that implements a smart matching rule.
+ * The predicate checks the suite, module, and library fields of the
+ * SuiteInfo in that order. When it finds a match, it changes modes
+ * depending on what was found:
+ *
+ *     If a suite is matched first, then only the suite is selected. The
+ *     suite may be marked manual.
+ *
+ *     If a module is matched first, then only suites from that module
+ *     and library not marked manual are selected from then on.
+ *
+ *     If a library is matched first, then only suites from that library
+ *     not marked manual are selected from then on.
+ */
 inline Selector
 matchAuto(std::string const& name)
 {
     return Selector(Selector::ModeT::Automatch, name);
 }
 
-/** Return a predicate that matches all suites not marked manual. */
+/**
+ * Return a predicate that matches all suites not marked manual.
+ */
 inline Selector
 matchAll()
 {
     return Selector(Selector::ModeT::All);
 }
 
-/** Returns a predicate that matches a specific suite. */
+/**
+ * Returns a predicate that matches a specific suite.
+ */
 inline Selector
 matchSuite(std::string const& name)
 {
     return Selector(Selector::ModeT::Suite, name);
 }
 
-/** Returns a predicate that matches all suites in a library. */
+/**
+ * Returns a predicate that matches all suites in a library.
+ */
 inline Selector
 matchLibrary(std::string const& name)
 {
diff --git a/include/xrpl/beast/unit_test/recorder.h b/include/xrpl/beast/unit_test/recorder.h
index 1b7347dc2e..fcadb63fc9 100644
--- a/include/xrpl/beast/unit_test/recorder.h
+++ b/include/xrpl/beast/unit_test/recorder.h
@@ -13,7 +13,9 @@
 
 namespace beast::unit_test {
 
-/** A test runner that stores the results. */
+/**
+ * A test runner that stores the results.
+ */
 class Recorder : public Runner
 {
 private:
@@ -24,7 +26,9 @@ private:
 public:
     Recorder() = default;
 
-    /** Returns a report with the results of all completed suites. */
+    /**
+     * Returns a report with the results of all completed suites.
+     */
     [[nodiscard]] Results const&
     report() const
     {
diff --git a/include/xrpl/beast/unit_test/reporter.h b/include/xrpl/beast/unit_test/reporter.h
index a903d9f8c2..0fe77a7862 100644
--- a/include/xrpl/beast/unit_test/reporter.h
+++ b/include/xrpl/beast/unit_test/reporter.h
@@ -25,9 +25,10 @@ namespace beast::unit_test {
 
 namespace detail {
 
-/** A simple test runner that writes everything to a stream in real time.
-    The totals are output when the object is destroyed.
-*/
+/**
+ * A simple test runner that writes everything to a stream in real time.
+ * The totals are output when the object is destroyed.
+ */
 template <class = void>
 class Reporter : public Runner
 {
diff --git a/include/xrpl/beast/unit_test/results.h b/include/xrpl/beast/unit_test/results.h
index 718d764c9f..273ad5b129 100644
--- a/include/xrpl/beast/unit_test/results.h
+++ b/include/xrpl/beast/unit_test/results.h
@@ -13,11 +13,15 @@
 
 namespace beast::unit_test {
 
-/** Holds a set of test condition outcomes in a testcase. */
+/**
+ * Holds a set of test condition outcomes in a testcase.
+ */
 class CaseResults
 {
 public:
-    /** Holds the result of evaluating one test condition. */
+    /**
+     * Holds the result of evaluating one test condition.
+     */
     struct Test
     {
         explicit Test(bool pass) : pass(pass)
@@ -41,28 +45,36 @@ private:
     public:
         TestsT() = default;
 
-        /** Returns the total number of test conditions. */
+        /**
+         * Returns the total number of test conditions.
+         */
         [[nodiscard]] std::size_t
         total() const
         {
             return cont().size();
         }
 
-        /** Returns the number of failed test conditions. */
+        /**
+         * Returns the number of failed test conditions.
+         */
         [[nodiscard]] std::size_t
         failed() const
         {
             return failed_;
         }
 
-        /** Register a successful test condition. */
+        /**
+         * Register a successful test condition.
+         */
         void
         pass()
         {
             cont().emplace_back(true);
         }
 
-        /** Register a failed test condition. */
+        /**
+         * Register a failed test condition.
+         */
         void
         fail(std::string const& reason = "")
         {
@@ -74,7 +86,9 @@ private:
     class LogT : public detail::ConstContainer<std::vector<std::string>>
     {
     public:
-        /** Insert a string into the log. */
+        /**
+         * Insert a string into the log.
+         */
         void
         insert(std::string const& s)
         {
@@ -89,23 +103,31 @@ public:
     {
     }
 
-    /** Returns the name of this testcase. */
+    /**
+     * Returns the name of this testcase.
+     */
     [[nodiscard]] std::string const&
     name() const
     {
         return name_;
     }
 
-    /** Memberspace for a container of test condition outcomes. */
+    /**
+     * Memberspace for a container of test condition outcomes.
+     */
     TestsT tests;
 
-    /** Memberspace for a container of testcase log messages. */
+    /**
+     * Memberspace for a container of testcase log messages.
+     */
     LogT log;
 };
 
 //--------------------------------------------------------------------------
 
-/** Holds the set of testcase results in a suite. */
+/**
+ * Holds the set of testcase results in a suite.
+ */
 class SuiteResults : public detail::ConstContainer<std::vector<CaseResults>>
 {
 private:
@@ -118,28 +140,36 @@ public:
     {
     }
 
-    /** Returns the name of this suite. */
+    /**
+     * Returns the name of this suite.
+     */
     [[nodiscard]] std::string const&
     name() const
     {
         return name_;
     }
 
-    /** Returns the total number of test conditions. */
+    /**
+     * Returns the total number of test conditions.
+     */
     [[nodiscard]] std::size_t
     total() const
     {
         return total_;
     }
 
-    /** Returns the number of failures. */
+    /**
+     * Returns the number of failures.
+     */
     [[nodiscard]] std::size_t
     failed() const
     {
         return failed_;
     }
 
-    /** Insert a set of testcase results. */
+    /**
+     * Insert a set of testcase results.
+     */
     /** @{ */
     void
     insert(CaseResults&& r)
@@ -162,7 +192,9 @@ public:
 //------------------------------------------------------------------------------
 
 // VFALCO TODO Make this a template class using scoped allocators
-/** Holds the results of running a set of testsuites. */
+/**
+ * Holds the results of running a set of testsuites.
+ */
 class Results : public detail::ConstContainer<std::vector<SuiteResults>>
 {
 private:
@@ -173,28 +205,36 @@ private:
 public:
     Results() = default;
 
-    /** Returns the total number of test cases. */
+    /**
+     * Returns the total number of test cases.
+     */
     [[nodiscard]] std::size_t
     cases() const
     {
         return cases_;
     }
 
-    /** Returns the total number of test conditions. */
+    /**
+     * Returns the total number of test conditions.
+     */
     [[nodiscard]] std::size_t
     total() const
     {
         return total_;
     }
 
-    /** Returns the number of failures. */
+    /**
+     * Returns the number of failures.
+     */
     [[nodiscard]] std::size_t
     failed() const
     {
         return failed_;
     }
 
-    /** Insert a set of suite results. */
+    /**
+     * Insert a set of suite results.
+     */
     /** @{ */
     void
     insert(SuiteResults&& r)
diff --git a/include/xrpl/beast/unit_test/runner.h b/include/xrpl/beast/unit_test/runner.h
index b88bfc5fe1..f8f9deca48 100644
--- a/include/xrpl/beast/unit_test/runner.h
+++ b/include/xrpl/beast/unit_test/runner.h
@@ -13,11 +13,12 @@
 
 namespace beast::unit_test {
 
-/** Unit test runner interface.
-
-    Derived classes can customize the reporting behavior. This interface is
-    injected into the unit_test class to receive the results of the tests.
-*/
+/**
+ * Unit test runner interface.
+ *
+ * Derived classes can customize the reporting behavior. This interface is
+ * injected into the unit_test class to receive the results of the tests.
+ */
 class Runner
 {
     std::string arg_;
@@ -33,110 +34,132 @@ public:
     Runner&
     operator=(Runner const&) = delete;
 
-    /** Set the argument string.
-
-        The argument string is available to suites and
-        allows for customization of the test. Each suite
-        defines its own syntax for the argument string.
-        The same argument is passed to all suites.
-    */
+    /**
+     * Set the argument string.
+     *
+     * The argument string is available to suites and
+     * allows for customization of the test. Each suite
+     * defines its own syntax for the argument string.
+     * The same argument is passed to all suites.
+     */
     void
     arg(std::string const& s)
     {
         arg_ = s;
     }
 
-    /** Returns the argument string. */
+    /**
+     * Returns the argument string.
+     */
     [[nodiscard]] std::string const&
     arg() const
     {
         return arg_;
     }
 
-    /** Run the specified suite.
-        @return `true` if any conditions failed.
-    */
+    /**
+     * Run the specified suite.
+     * @return `true` if any conditions failed.
+     */
     template <class = void>
     bool
     run(SuiteInfo const& s);
 
-    /** Run a sequence of suites.
-        The expression
-            `FwdIter::value_type`
-        must be convertible to `SuiteInfo`.
-        @return `true` if any conditions failed.
-    */
+    /**
+     * Run a sequence of suites.
+     * The expression
+     *     `FwdIter::value_type`
+     * must be convertible to `SuiteInfo`.
+     * @return `true` if any conditions failed.
+     */
     template <class FwdIter>
     bool
     run(FwdIter first, FwdIter last);
 
-    /** Conditionally run a sequence of suites.
-        pred will be called as:
-        @code
-            bool pred(SuiteInfo const&);
-        @endcode
-        @return `true` if any conditions failed.
-    */
+    /**
+     * Conditionally run a sequence of suites.
+     * pred will be called as:
+     * @code
+     *     bool pred(SuiteInfo const&);
+     * @endcode
+     * @return `true` if any conditions failed.
+     */
     template <class FwdIter, class Pred>
     bool
     runIf(FwdIter first, FwdIter last, Pred pred = Pred{});
 
-    /** Run all suites in a container.
-        @return `true` if any conditions failed.
-    */
+    /**
+     * Run all suites in a container.
+     * @return `true` if any conditions failed.
+     */
     template <class SequenceContainer>
     bool
     runEach(SequenceContainer const& c);
 
-    /** Conditionally run suites in a container.
-        pred will be called as:
-        @code
-            bool pred(SuiteInfo const&);
-        @endcode
-        @return `true` if any conditions failed.
-    */
+    /**
+     * Conditionally run suites in a container.
+     * pred will be called as:
+     * @code
+     *     bool pred(SuiteInfo const&);
+     * @endcode
+     * @return `true` if any conditions failed.
+     */
     template <class SequenceContainer, class Pred>
     bool
     runEachIf(SequenceContainer const& c, Pred pred = Pred{});
 
 protected:
-    /// Called when a new suite starts.
+    /**
+     * Called when a new suite starts.
+     */
     virtual void
     onSuiteBegin(SuiteInfo const&)
     {
     }
 
-    /// Called when a suite ends.
+    /**
+     * Called when a suite ends.
+     */
     virtual void
     onSuiteEnd()
     {
     }
 
-    /// Called when a new case starts.
+    /**
+     * Called when a new case starts.
+     */
     virtual void
     onCaseBegin(std::string const&)
     {
     }
 
-    /// Called when a new case ends.
+    /**
+     * Called when a new case ends.
+     */
     virtual void
     onCaseEnd()
     {
     }
 
-    /// Called for each passing condition.
+    /**
+     * Called for each passing condition.
+     */
     virtual void
     onPass()
     {
     }
 
-    /// Called for each failing condition.
+    /**
+     * Called for each failing condition.
+     */
     virtual void
     onFail(std::string const&)
     {
     }
 
-    /// Called when a test logs output.
+    /**
+     * Called when a test logs output.
+     */
     virtual void
     onLog(std::string const&)
     {
diff --git a/include/xrpl/beast/unit_test/suite.h b/include/xrpl/beast/unit_test/suite.h
index 487663fcc5..c20fe2522c 100644
--- a/include/xrpl/beast/unit_test/suite.h
+++ b/include/xrpl/beast/unit_test/suite.h
@@ -41,13 +41,14 @@ class Thread;
 
 enum class AbortT { NoAbortOnFail, AbortOnFail };
 
-/** A testsuite class.
-
-    Derived classes execute a series of testcases, where each testcase is
-    a series of pass/fail tests. To provide a unit test using this class,
-    derive from it and use the BEAST_DEFINE_UNIT_TEST macro in a
-    translation unit.
-*/
+/**
+ * A testsuite class.
+ *
+ * Derived classes execute a series of testcases, where each testcase is
+ * a series of pass/fail tests. To provide a unit test using this class,
+ * derive from it and use the BEAST_DEFINE_UNIT_TEST macro in a
+ * translation unit.
+ */
 class Suite
 {
 private:
@@ -118,16 +119,17 @@ private:
         {
         }
 
-        /** Open a new testcase.
-
-            A testcase is a series of evaluated test conditions. A test
-            suite may have multiple test cases. A test is associated with
-            the last opened testcase. When the test first runs, a default
-            unnamed case is opened. Tests with only one case may omit the
-            call to testcase.
-
-            @param abort Determines if suite continues running after a failure.
-        */
+        /**
+         * Open a new testcase.
+         *
+         * A testcase is a series of evaluated test conditions. A test
+         * suite may have multiple test cases. A test is associated with
+         * the last opened testcase. When the test first runs, a default
+         * unnamed case is opened. Tests with only one case may omit the
+         * call to testcase.
+         *
+         * @param abort Determines if suite continues running after a failure.
+         */
         void
         operator()(std::string const& name, AbortT abort = AbortT::NoAbortOnFail);
 
@@ -140,19 +142,23 @@ private:
     };
 
 public:
-    /** Logging output stream.
-
-        Text sent to the log output stream will be forwarded to
-        the output stream associated with the runner.
-    */
+    /**
+     * Logging output stream.
+     *
+     * Text sent to the log output stream will be forwarded to
+     * the output stream associated with the runner.
+     */
     LogOs<char> log;
 
-    /** Memberspace for declaring test cases. */
+    /**
+     * Memberspace for declaring test cases.
+     */
     TestcaseT testcase;
 
-    /** Returns the "current" running suite.
-        If no suite is running, nullptr is returned.
-    */
+    /**
+     * Returns the "current" running suite.
+     * If no suite is running, nullptr is returned.
+     */
     static Suite*
     thisSuite()
     {
@@ -168,30 +174,34 @@ public:
     Suite&
     operator=(Suite const&) = delete;
 
-    /** Invokes the test using the specified runner.
-
-        Data members are set up here instead of the constructor as a
-        convenience to writing the derived class to avoid repetition of
-        forwarded constructor arguments to the base.
-        Normally this is called by the framework for you.
-    */
+    /**
+     * Invokes the test using the specified runner.
+     *
+     * Data members are set up here instead of the constructor as a
+     * convenience to writing the derived class to avoid repetition of
+     * forwarded constructor arguments to the base.
+     * Normally this is called by the framework for you.
+     */
     template <class = void>
     void
     operator()(Runner& r);
 
-    /** Record a successful test condition. */
+    /**
+     * Record a successful test condition.
+     */
     template <class = void>
     void
     pass();
 
-    /** Record a failure.
-
-        @param reason Optional text added to the output on a failure.
-
-        @param file The source code file where the test failed.
-
-        @param line The source code line number where the test failed.
-    */
+    /**
+     * Record a failure.
+     *
+     * @param reason Optional text added to the output on a failure.
+     *
+     * @param file The source code file where the test failed.
+     *
+     * @param line The source code line number where the test failed.
+     */
     /** @{ */
     template <class String>
     void
@@ -202,23 +212,24 @@ public:
     fail(std::string const& reason = "");
     /** @} */
 
-    /** Evaluate a test condition.
-
-        This function provides improved logging by incorporating the
-        file name and line number into the reported output on failure,
-        as well as additional text specified by the caller.
-
-        @param shouldBeTrue The condition to test. The condition
-        is evaluated in a boolean context.
-
-        @param reason Optional added text to output on a failure.
-
-        @param file The source code file where the test failed.
-
-        @param line The source code line number where the test failed.
-
-        @return `true` if the test condition indicates success.
-    */
+    /**
+     * Evaluate a test condition.
+     *
+     * This function provides improved logging by incorporating the
+     * file name and line number into the reported output on failure,
+     * as well as additional text specified by the caller.
+     *
+     * @param shouldBeTrue The condition to test. The condition
+     * is evaluated in a boolean context.
+     *
+     * @param reason Optional added text to output on a failure.
+     *
+     * @param file The source code file where the test failed.
+     *
+     * @param line The source code line number where the test failed.
+     *
+     * @return `true` if the test condition indicates success.
+     */
     /** @{ */
     template <class Condition>
     bool
@@ -275,15 +286,19 @@ public:
         return unexcept(f, "");
     }
 
-    /** Return the argument associated with the runner. */
+    /**
+     * Return the argument associated with the runner.
+     */
     std::string const&
     arg() const
     {
         return runner_->arg();
     }
 
-    // DEPRECATED
-    // @return `true` if the test condition indicates success(a false value)
+    /**
+     * DEPRECATED
+     * @return `true` if the test condition indicates success(a false value)
+     */
     template <class Condition, class String>
     bool
     unexpected(Condition shouldBeFalse, String const& reason);
@@ -305,7 +320,9 @@ private:
         return &kPTs;
     }
 
-    /** Runs the suite. */
+    /**
+     * Runs the suite.
+     */
     virtual void
     run() = 0;
 
@@ -558,18 +575,20 @@ Suite::run(Runner& r)
 }
 
 #ifndef BEAST_EXPECT
-/** Check a precondition.
-
-    If the condition is false, the file and line number are reported.
-*/
+/**
+ * Check a precondition.
+ *
+ * If the condition is false, the file and line number are reported.
+ */
 #define BEAST_EXPECT(cond) expect(cond, __FILE__, __LINE__)
 #endif
 
 #ifndef BEAST_EXPECTS
-/** Check a precondition.
-
-    If the condition is false, the file and line number are reported.
-*/
+/**
+ * Check a precondition.
+ *
+ * If the condition is false, the file and line number are reported.
+ */
 #define BEAST_EXPECTS(cond, reason) \
     ((cond) ? (pass(), true) : (fail((reason), __FILE__, __LINE__), false))
 #endif
@@ -593,41 +612,43 @@ Suite::run(Runner& r)
 //
 #ifndef BEAST_DEFINE_TESTSUITE
 
-/** Enables insertion of test suites into the global container.
-    The default is to insert all test suite definitions into the global
-    container. If BEAST_DEFINE_TESTSUITE is user defined, this macro
-    has no effect.
-*/
+/**
+ * Enables insertion of test suites into the global container.
+ * The default is to insert all test suite definitions into the global
+ * container. If BEAST_DEFINE_TESTSUITE is user defined, this macro
+ * has no effect.
+ */
 #ifndef BEAST_NO_UNIT_TEST_INLINE
 #define BEAST_NO_UNIT_TEST_INLINE 0
 #endif
 
-/** Define a unit test suite.
-
-    Class     The type representing the class being tested.
-    Module    Identifies the module.
-    Library   Identifies the library.
-
-    The declaration for the class implementing the test should be the same
-    as Class ## _test. For example, if Class is aged_ordered_container, the
-    test class must be declared as:
-
-    @code
-
-    struct aged_ordered_container_test : beast::unit_test::suite
-    {
-        //...
-    };
-
-    @endcode
-
-    The macro invocation must appear in the same namespace as the test class.
-
-    Unit test priorities were introduced so parallel unit_test::suites would
-    execute faster. Suites with longer running times have higher priorities
-    than unit tests with shorter running times.  Suites with no priorities
-    are assumed to run most quickly, so they run last.
-*/
+/**
+ * Define a unit test suite.
+ *
+ * Class     The type representing the class being tested.
+ * Module    Identifies the module.
+ * Library   Identifies the library.
+ *
+ * The declaration for the class implementing the test should be the same
+ * as Class ## _test. For example, if Class is aged_ordered_container, the
+ * test class must be declared as:
+ *
+ * @code
+ *
+ * struct aged_ordered_container_test : beast::unit_test::suite
+ * {
+ *     //...
+ * };
+ *
+ * @endcode
+ *
+ * The macro invocation must appear in the same namespace as the test class.
+ *
+ * Unit test priorities were introduced so parallel unit_test::suites would
+ * execute faster. Suites with longer running times have higher priorities
+ * than unit tests with shorter running times.  Suites with no priorities
+ * are assumed to run most quickly, so they run last.
+ */
 
 #if BEAST_NO_UNIT_TEST_INLINE
 #define BEAST_DEFINE_TESTSUITE(Class, Module, Library)
diff --git a/include/xrpl/beast/unit_test/suite_info.h b/include/xrpl/beast/unit_test/suite_info.h
index bda10ae7e3..c4e3496f13 100644
--- a/include/xrpl/beast/unit_test/suite_info.h
+++ b/include/xrpl/beast/unit_test/suite_info.h
@@ -13,7 +13,9 @@ namespace beast::unit_test {
 
 class Runner;
 
-/** Associates a unit test type with metadata. */
+/**
+ * Associates a unit test type with metadata.
+ */
 class SuiteInfo
 {
     using run_type = std::function<void(Runner&)>;
@@ -60,21 +62,27 @@ public:
         return library_;
     }
 
-    /// Returns `true` if this suite only runs manually.
+    /**
+     * Returns `true` if this suite only runs manually.
+     */
     [[nodiscard]] bool
     manual() const
     {
         return manual_;
     }
 
-    /// Return the canonical suite name as a string.
+    /**
+     * Return the canonical suite name as a string.
+     */
     [[nodiscard]] std::string
     fullName() const
     {
         return library_ + "." + module_ + "." + name_;
     }
 
-    /// Run a new instance of the associated test suite.
+    /**
+     * Run a new instance of the associated test suite.
+     */
     void
     run(Runner& r) const
     {
@@ -93,7 +101,9 @@ public:
 
 //------------------------------------------------------------------------------
 
-/// Convenience for producing SuiteInfo for a given test type.
+/**
+ * Convenience for producing SuiteInfo for a given test type.
+ */
 template <class Suite>
 SuiteInfo
 makeSuiteInfo(std::string name, std::string module, std::string library, bool manual, int priority)
diff --git a/include/xrpl/beast/unit_test/suite_list.h b/include/xrpl/beast/unit_test/suite_list.h
index 7dd0dd80f0..057a362859 100644
--- a/include/xrpl/beast/unit_test/suite_list.h
+++ b/include/xrpl/beast/unit_test/suite_list.h
@@ -16,7 +16,9 @@
 
 namespace beast::unit_test {
 
-/// A container of test suites.
+/**
+ * A container of test suites.
+ */
 class SuiteList : public detail::ConstContainer<std::set<SuiteInfo>>
 {
 private:
@@ -26,10 +28,11 @@ private:
 #endif
 
 public:
-    /** Insert a suite into the set.
-
-        The suite must not already exist.
-    */
+    /**
+     * Insert a suite into the set.
+     *
+     * The suite must not already exist.
+     */
     template <class Suite>
     void
     insert(char const* name, char const* module, char const* library, bool manual, int priority);
diff --git a/include/xrpl/beast/unit_test/thread.h b/include/xrpl/beast/unit_test/thread.h
index 91d8cf3cab..5a5a99d149 100644
--- a/include/xrpl/beast/unit_test/thread.h
+++ b/include/xrpl/beast/unit_test/thread.h
@@ -14,7 +14,9 @@
 
 namespace beast::unit_test {
 
-/** Replacement for std::thread that handles exceptions in unit tests. */
+/**
+ * Replacement for std::thread that handles exceptions in unit tests.
+ */
 class Thread
 {
 private:
diff --git a/include/xrpl/beast/utility/Journal.h b/include/xrpl/beast/utility/Journal.h
index 3de3cfb0e0..9f0a1ead66 100644
--- a/include/xrpl/beast/utility/Journal.h
+++ b/include/xrpl/beast/utility/Journal.h
@@ -10,7 +10,9 @@
 
 namespace beast {
 
-/** Severity level / threshold of a Journal message. */
+/**
+ * Severity level / threshold of a Journal message.
+ */
 enum class Severity : std::uint8_t {
     All = 0,
 
@@ -25,18 +27,19 @@ enum class Severity : std::uint8_t {
     None = Disabled
 };
 
-/** A generic endpoint for log messages.
-
-    The Journal has a few simple goals:
-
-     * To be light-weight and copied by value.
-     * To allow logging statements to be left in source code.
-     * The logging is controlled at run-time based on a logging threshold.
-
-    It is advisable to check Journal::active(level) prior to formatting log
-    text.  Doing so sidesteps expensive text formatting when the results
-    will not be sent to the log.
-*/
+/**
+ * A generic endpoint for log messages.
+ *
+ * The Journal has a few simple goals:
+ *
+ *  * To be light-weight and copied by value.
+ *  * To allow logging statements to be left in source code.
+ *  * The logging is controlled at run-time based on a logging threshold.
+ *
+ * It is advisable to check Journal::active(level) prior to formatting log
+ * text.  Doing so sidesteps expensive text formatting when the results
+ * will not be sent to the log.
+ */
 class Journal
 {
 public:
@@ -49,7 +52,9 @@ private:
 public:
     //--------------------------------------------------------------------------
 
-    /** Abstraction for the underlying message destination. */
+    /**
+     * Abstraction for the underlying message destination.
+     */
     class Sink
     {
     protected:
@@ -63,36 +68,47 @@ public:
         Sink&
         operator=(Sink const& lhs) = delete;
 
-        /** Returns `true` if text at the passed severity produces output. */
+        /**
+         * Returns `true` if text at the passed severity produces output.
+         */
         [[nodiscard]] virtual bool
         active(Severity level) const;
 
-        /** Returns `true` if a message is also written to the Output Window
-         * (MSVC). */
+        /**
+         * Returns `true` if a message is also written to the Output Window
+         * (MSVC).
+         */
         [[nodiscard]] virtual bool
         console() const;
 
-        /** Set whether messages are also written to the Output Window (MSVC).
+        /**
+         * Set whether messages are also written to the Output Window (MSVC).
          */
         virtual void
         console(bool output);
 
-        /** Returns the minimum severity level this sink will report. */
+        /**
+         * Returns the minimum severity level this sink will report.
+         */
         [[nodiscard]] virtual Severity
         threshold() const;
 
-        /** Set the minimum severity this sink will report. */
+        /**
+         * Set the minimum severity this sink will report.
+         */
         virtual void
         threshold(Severity thresh);
 
-        /** Write text to the sink at the specified severity.
-            A conforming implementation will not write the text if the passed
-            level is below the current threshold().
-        */
+        /**
+         * Write text to the sink at the specified severity.
+         * A conforming implementation will not write the text if the passed
+         * level is below the current threshold().
+         */
         virtual void
         write(Severity level, std::string const& text) = 0;
 
-        /** Bypass filter and write text to the sink at the specified severity.
+        /**
+         * Bypass filter and write text to the sink at the specified severity.
          * Always write the message, but maintain the same formatting as if
          * it passed through a level filter.
          *
@@ -116,7 +132,9 @@ public:
     static_assert(std::is_nothrow_destructible_v<Sink>);
 #endif
 
-    /** Returns a Sink which does nothing. */
+    /**
+     * Returns a Sink which does nothing.
+     */
     static Sink&
     getNullSink();
 
@@ -174,26 +192,33 @@ public:
 
     //--------------------------------------------------------------------------
 public:
-    /** Provide a light-weight way to check active() before string formatting */
+    /**
+     * Provide a light-weight way to check active() before string formatting
+     */
     class Stream
     {
     public:
-        /** Create a stream which produces no output. */
+        /**
+         * Create a stream which produces no output.
+         */
         explicit Stream() : sink_(getNullSink()), level_(Severity::Disabled)
         {
         }
 
-        /** Create a stream that writes at the given level.
-
-            Constructor is inlined so checking active() very inexpensive.
-        */
+        /**
+         * Create a stream that writes at the given level.
+         *
+         * Constructor is inlined so checking active() very inexpensive.
+         */
         Stream(Sink& sink, Severity level) : sink_(sink), level_(level)
         {
             XRPL_ASSERT(
                 level_ < Severity::Disabled, "beast::Journal::Stream::Stream : maximum level");
         }
 
-        /** Construct or copy another Stream. */
+        /**
+         * Construct or copy another Stream.
+         */
         Stream(Stream const& other) : Stream(other.sink_, other.level_)
         {
         }
@@ -201,21 +226,27 @@ public:
         Stream&
         operator=(Stream const& other) = delete;
 
-        /** Returns the Sink that this Stream writes to. */
+        /**
+         * Returns the Sink that this Stream writes to.
+         */
         [[nodiscard]] Sink&
         sink() const
         {
             return sink_;
         }
 
-        /** Returns the Severity level of messages this Stream reports. */
+        /**
+         * Returns the Severity level of messages this Stream reports.
+         */
         [[nodiscard]] Severity
         level() const
         {
             return level_;
         }
 
-        /** Returns `true` if sink logs anything at this stream's level. */
+        /**
+         * Returns `true` if sink logs anything at this stream's level.
+         */
         /** @{ */
         [[nodiscard]] bool
         active() const
@@ -230,7 +261,9 @@ public:
         }
         /** @} */
 
-        /** Output stream support. */
+        /**
+         * Output stream support.
+         */
         /** @{ */
         ScopedStream
         operator<<(std::ostream& manip(std::ostream&)) const;
@@ -256,39 +289,50 @@ public:
 
     //--------------------------------------------------------------------------
 
-    /** Journal has no default constructor. */
+    /**
+     * Journal has no default constructor.
+     */
     Journal() = delete;
 
-    /** Create a journal that writes to the specified sink. */
+    /**
+     * Create a journal that writes to the specified sink.
+     */
     explicit Journal(Sink& sink) : sink_(&sink)
     {
     }
 
-    /** Returns the Sink associated with this Journal. */
+    /**
+     * Returns the Sink associated with this Journal.
+     */
     [[nodiscard]] Sink&
     sink() const
     {
         return *sink_;
     }
 
-    /** Returns a stream for this sink, with the specified severity level. */
+    /**
+     * Returns a stream for this sink, with the specified severity level.
+     */
     [[nodiscard]] Stream
     stream(Severity level) const
     {
         return Stream(*sink_, level);
     }
 
-    /** Returns `true` if any message would be logged at this severity level.
-        For a message to be logged, the severity must be at or above the
-        sink's severity threshold.
-    */
+    /**
+     * Returns `true` if any message would be logged at this severity level.
+     * For a message to be logged, the severity must be at or above the
+     * sink's severity threshold.
+     */
     [[nodiscard]] bool
     active(Severity level) const
     {
         return sink_->active(level);
     }
 
-    /** Severity stream access functions. */
+    /**
+     * Severity stream access functions.
+     */
     /** @{ */
     [[nodiscard]] Stream
     trace() const
diff --git a/include/xrpl/beast/utility/PropertyStream.h b/include/xrpl/beast/utility/PropertyStream.h
index 3fb6df53d9..f32f5b7fef 100644
--- a/include/xrpl/beast/utility/PropertyStream.h
+++ b/include/xrpl/beast/utility/PropertyStream.h
@@ -12,7 +12,9 @@ namespace beast {
 
 //------------------------------------------------------------------------------
 
-/** Abstract stream with RAII containers that produce a property tree. */
+/**
+ * Abstract stream with RAII containers that produce a property tree.
+ */
 class PropertyStream
 {
 public:
@@ -306,7 +308,9 @@ public:
 //
 //------------------------------------------------------------------------------
 
-/** Subclasses can be called to write to a stream and have children. */
+/**
+ * Subclasses can be called to write to a stream and have children.
+ */
 class PropertyStream::Source
 {
 private:
@@ -324,17 +328,22 @@ public:
     Source&
     operator=(Source const&) = delete;
 
-    /** Returns the name of this source. */
+    /**
+     * Returns the name of this source.
+     */
     [[nodiscard]] std::string const&
     name() const;
 
-    /** Add a child source. */
+    /**
+     * Add a child source.
+     */
     void
     add(Source& source);
 
-    /** Add a child source by pointer.
-        The source pointer is returned so it can be used in ctor-initializers.
-    */
+    /**
+     * Add a child source by pointer.
+     * The source pointer is returned so it can be used in ctor-initializers.
+     */
     template <class Derived>
     Derived*
     add(Derived* child)
@@ -343,45 +352,55 @@ public:
         return child;
     }
 
-    /** Remove a child source from this Source. */
+    /**
+     * Remove a child source from this Source.
+     */
     void
     remove(Source& child);
 
-    /** Remove all child sources from this Source. */
+    /**
+     * Remove all child sources from this Source.
+     */
     void
     removeAll();
 
-    /** Write only this Source to the stream. */
+    /**
+     * Write only this Source to the stream.
+     */
     void
     writeOne(PropertyStream& stream);
 
-    /** write this source and all its children recursively to the stream. */
+    /**
+     * write this source and all its children recursively to the stream.
+     */
     void
     write(PropertyStream& stream);
 
-    /** Parse the path and write the corresponding Source and optional children.
-        If the source is found, it is written. If the wildcard character '*'
-        exists as the last character in the path, then all the children are
-        written recursively.
-    */
+    /**
+     * Parse the path and write the corresponding Source and optional children.
+     * If the source is found, it is written. If the wildcard character '*'
+     * exists as the last character in the path, then all the children are
+     * written recursively.
+     */
     void
     write(PropertyStream& stream, std::string const& path);
 
-    /** Parse the dot-delimited Source path and return the result.
-        The first value will be a pointer to the Source object corresponding
-        to the given path. If no Source object exists, then the first value
-        will be nullptr and the second value will be undefined.
-        The second value is a boolean indicating whether or not the path string
-        specifies the wildcard character '*' as the last character.
-
-        print statement examples
-        "parent.child" prints child and all of its children
-        "parent.child." start at the parent and print down to child
-        "parent.grandchild" prints nothing- grandchild not direct descendent
-        "parent.grandchild." starts at the parent and prints down to grandchild
-        "parent.grandchild.*" starts at parent, print through grandchild
-       children
-    */
+    /**
+     * Parse the dot-delimited Source path and return the result.
+     *  The first value will be a pointer to the Source object corresponding
+     *  to the given path. If no Source object exists, then the first value
+     *  will be nullptr and the second value will be undefined.
+     *  The second value is a boolean indicating whether or not the path string
+     *  specifies the wildcard character '*' as the last character.
+     *
+     *  print statement examples
+     *  "parent.child" prints child and all of its children
+     *  "parent.child." start at the parent and print down to child
+     *  "parent.grandchild" prints nothing- grandchild not direct descendent
+     *  "parent.grandchild." starts at the parent and prints down to grandchild
+     *  "parent.grandchild.*" starts at parent, print through grandchild
+     * children
+     */
     std::pair<Source*, bool>
     find(std::string path);
 
@@ -401,9 +420,10 @@ public:
 
     //--------------------------------------------------------------------------
 
-    /** Subclass override.
-        The default version does nothing.
-    */
+    /**
+     * Subclass override.
+     * The default version does nothing.
+     */
     virtual void
     onWrite(Map&);
 };
diff --git a/include/xrpl/beast/utility/WrappedSink.h b/include/xrpl/beast/utility/WrappedSink.h
index a24ad595db..3ab48e1939 100644
--- a/include/xrpl/beast/utility/WrappedSink.h
+++ b/include/xrpl/beast/utility/WrappedSink.h
@@ -7,7 +7,9 @@
 
 namespace beast {
 
-/** Wraps a Journal::Sink to prefix its output with a string. */
+/**
+ * Wraps a Journal::Sink to prefix its output with a string.
+ */
 
 // A WrappedSink both is a Sink and has a Sink:
 //   o It inherits from Sink so it has the correct interface.
diff --git a/include/xrpl/beast/utility/Zero.h b/include/xrpl/beast/utility/Zero.h
index e28589760b..406921c500 100644
--- a/include/xrpl/beast/utility/Zero.h
+++ b/include/xrpl/beast/utility/Zero.h
@@ -4,22 +4,23 @@
 
 namespace beast {
 
-/** Zero allows classes to offer efficient comparisons to zero.
-
-    Zero is a struct to allow classes to efficiently compare with zero without
-    requiring an rvalue construction.
-
-    It's often the case that we have classes which combine a number and a unit.
-    In such cases, comparisons like t > 0 or t != 0 make sense, but comparisons
-    like t > 1 or t != 1 do not.
-
-    The class Zero allows such comparisons to be easily made.
-
-    The comparing class T either needs to have a method called signum() which
-    returns a positive number, 0, or a negative; or there needs to be a signum
-    function which resolves in the namespace which takes an instance of T and
-    returns a positive, zero or negative number.
-*/
+/**
+ * Zero allows classes to offer efficient comparisons to zero.
+ *
+ * Zero is a struct to allow classes to efficiently compare with zero without
+ * requiring an rvalue construction.
+ *
+ * It's often the case that we have classes which combine a number and a unit.
+ * In such cases, comparisons like t > 0 or t != 0 make sense, but comparisons
+ * like t > 1 or t != 1 do not.
+ *
+ * The class Zero allows such comparisons to be easily made.
+ *
+ * The comparing class T either needs to have a method called signum() which
+ * returns a positive number, 0, or a negative; or there needs to be a signum
+ * function which resolves in the namespace which takes an instance of T and
+ * returns a positive, zero or negative number.
+ */
 
 struct Zero
 {
@@ -28,7 +29,9 @@ struct Zero
 
 inline constexpr Zero kZero{};
 
-/** Default implementation of signum calls the method on the class. */
+/**
+ * Default implementation of signum calls the method on the class.
+ */
 template <typename T>
 auto
 signum(T const& t)
diff --git a/include/xrpl/beast/utility/maybe_const.h b/include/xrpl/beast/utility/maybe_const.h
index 10b2eaf7f6..848ea86cb2 100644
--- a/include/xrpl/beast/utility/maybe_const.h
+++ b/include/xrpl/beast/utility/maybe_const.h
@@ -4,7 +4,9 @@
 
 namespace beast {
 
-/** Makes T const or non const depending on a bool. */
+/**
+ * Makes T const or non const depending on a bool.
+ */
 template <bool IsConst, class T>
 struct MaybeConst
 {
@@ -13,7 +15,9 @@ struct MaybeConst
         conditional_t<IsConst, typename std::remove_const<T>::type const, std::remove_const_t<T>>;
 };
 
-/** Alias for omitting `typename`. */
+/**
+ * Alias for omitting `typename`.
+ */
 template <bool IsConst, class T>
 using maybe_const_t = MaybeConst<IsConst, T>::type;
 
diff --git a/include/xrpl/beast/utility/temp_dir.h b/include/xrpl/beast/utility/temp_dir.h
index ec661b51c4..a0ff1e6940 100644
--- a/include/xrpl/beast/utility/temp_dir.h
+++ b/include/xrpl/beast/utility/temp_dir.h
@@ -6,11 +6,12 @@
 
 namespace beast {
 
-/** RAII temporary directory.
-
-    The directory and all its contents are deleted when
-    the instance of `temp_dir` is destroyed.
-*/
+/**
+ * RAII temporary directory.
+ *
+ * The directory and all its contents are deleted when
+ * the instance of `temp_dir` is destroyed.
+ */
 class TempDir
 {
     boost::filesystem::path path_;
@@ -22,7 +23,9 @@ public:
     operator=(TempDir const&) = delete;
 #endif
 
-    /// Construct a temporary directory.
+    /**
+     * Construct a temporary directory.
+     */
     TempDir()
     {
         auto const dir = boost::filesystem::temp_directory_path();
@@ -33,7 +36,9 @@ public:
         boost::filesystem::create_directory(path_);
     }
 
-    /// Destroy a temporary directory.
+    /**
+     * Destroy a temporary directory.
+     */
     ~TempDir()
     {
         // use non-throwing calls in the destructor
@@ -42,17 +47,20 @@ public:
         // TODO: warn/notify if ec set ?
     }
 
-    /// Get the native path for the temporary directory
+    /**
+     * Get the native path for the temporary directory
+     */
     [[nodiscard]] std::string
     path() const
     {
         return path_.string();
     }
 
-    /** Get the native path for the a file.
-
-        The file does not need to exist.
-    */
+    /**
+     * Get the native path for the a file.
+     *
+     * The file does not need to exist.
+     */
     [[nodiscard]] std::string
     file(std::string const& name) const
     {
diff --git a/include/xrpl/beast/xor_shift_engine.h b/include/xrpl/beast/xor_shift_engine.h
index 45baecf101..6a7272c195 100644
--- a/include/xrpl/beast/xor_shift_engine.h
+++ b/include/xrpl/beast/xor_shift_engine.h
@@ -85,14 +85,15 @@ XorShiftEngine<Unused>::murmurhash3(result_type x) -> result_type
 
 }  // namespace detail
 
-/** XOR-shift Generator.
-
-    Meets the requirements of UniformRandomNumberGenerator.
-
-    Simple and fast RNG based on:
-    http://xorshift.di.unimi.it/xorshift128plus.c
-    does not accept seed==0
-*/
+/**
+ * XOR-shift Generator.
+ *
+ * Meets the requirements of UniformRandomNumberGenerator.
+ *
+ * Simple and fast RNG based on:
+ * http://xorshift.di.unimi.it/xorshift128plus.c
+ * does not accept seed==0
+ */
 using xor_shift_engine = detail::XorShiftEngine<>;
 
 }  // namespace beast
diff --git a/include/xrpl/conditions/Condition.h b/include/xrpl/conditions/Condition.h
index 3c798663d7..365a41a087 100644
--- a/include/xrpl/conditions/Condition.h
+++ b/include/xrpl/conditions/Condition.h
@@ -24,42 +24,49 @@ enum class Type : std::uint8_t {
 class Condition
 {
 public:
-    /** The largest binary condition we support.
-
-        @note This value will be increased in the future, but it
-              must never decrease, as that could cause conditions
-              that were previously considered valid to no longer
-              be allowed.
-    */
+    /**
+     * The largest binary condition we support.
+     *
+     * @note This value will be increased in the future, but it
+     *       must never decrease, as that could cause conditions
+     *       that were previously considered valid to no longer
+     *       be allowed.
+     */
     static constexpr std::size_t kMaxSerializedCondition = 128;
 
-    /** Load a condition from its binary form
-
-        @param s The buffer containing the fulfillment to load.
-        @param ec Set to the error, if any occurred.
-
-        The binary format for a condition is specified in the
-        cryptoconditions RFC. See:
-
-        https://tools.ietf.org/html/draft-thomas-crypto-conditions-02#section-7.2
-    */
+    /**
+     * Load a condition from its binary form
+     *
+     * @param s The buffer containing the fulfillment to load.
+     * @param ec Set to the error, if any occurred.
+     *
+     * The binary format for a condition is specified in the
+     * cryptoconditions RFC. See:
+     *
+     * https://tools.ietf.org/html/draft-thomas-crypto-conditions-02#section-7.2
+     */
     static std::unique_ptr<Condition>
     deserialize(Slice s, std::error_code& ec);
 
 public:
     Type type;
 
-    /** An identifier for this condition.
-
-        This fingerprint is meant to be unique only with
-        respect to other conditions of the same type.
-    */
+    /**
+     * An identifier for this condition.
+     *
+     * This fingerprint is meant to be unique only with
+     * respect to other conditions of the same type.
+     */
     Buffer fingerprint;
 
-    /** The cost associated with this condition. */
+    /**
+     * The cost associated with this condition.
+     */
     std::uint32_t cost;
 
-    /** For compound conditions, set of conditions includes */
+    /**
+     * For compound conditions, set of conditions includes
+     */
     std::set<Type> subtypes;
 
     Condition(Type t, std::uint32_t c, Slice fp) : type(t), fingerprint(fp), cost(c)
diff --git a/include/xrpl/conditions/Fulfillment.h b/include/xrpl/conditions/Fulfillment.h
index a3001b2620..11f3165a58 100644
--- a/include/xrpl/conditions/Fulfillment.h
+++ b/include/xrpl/conditions/Fulfillment.h
@@ -14,64 +14,73 @@ namespace xrpl::cryptoconditions {
 struct Fulfillment
 {
 public:
-    /** The largest binary fulfillment we support.
-
-        @note This value will be increased in the future, but it
-              must never decrease, as that could cause fulfillments
-              that were previously considered valid to no longer
-              be allowed.
-    */
+    /**
+     * The largest binary fulfillment we support.
+     *
+     * @note This value will be increased in the future, but it
+     *       must never decrease, as that could cause fulfillments
+     *       that were previously considered valid to no longer
+     *       be allowed.
+     */
     static constexpr std::size_t kMaxSerializedFulfillment = 256;
 
-    /** Load a fulfillment from its binary form
-
-        @param s The buffer containing the fulfillment to load.
-        @param ec Set to the error, if any occurred.
-
-        The binary format for a fulfillment is specified in the
-        cryptoconditions RFC. See:
-
-        https://tools.ietf.org/html/draft-thomas-crypto-conditions-02#section-7.3
-    */
+    /**
+     * Load a fulfillment from its binary form
+     *
+     * @param s The buffer containing the fulfillment to load.
+     * @param ec Set to the error, if any occurred.
+     *
+     * The binary format for a fulfillment is specified in the
+     * cryptoconditions RFC. See:
+     *
+     * https://tools.ietf.org/html/draft-thomas-crypto-conditions-02#section-7.3
+     */
     static std::unique_ptr<Fulfillment>
     deserialize(Slice s, std::error_code& ec);
 
 public:
     virtual ~Fulfillment() = default;
 
-    /** Returns the fulfillment's fingerprint:
-
-        The fingerprint is an octet string uniquely
-        representing this fulfillment's condition
-        with respect to other conditions of the
-        same type.
-   */
+    /**
+     * Returns the fulfillment's fingerprint:
+     *
+     * The fingerprint is an octet string uniquely
+     * representing this fulfillment's condition
+     * with respect to other conditions of the
+     * same type.
+     */
     [[nodiscard]] virtual Buffer
     fingerprint() const = 0;
 
-    /** Returns the type of this condition. */
+    /**
+     * Returns the type of this condition.
+     */
     [[nodiscard]] virtual Type
     type() const = 0;
 
-    /** Validates a fulfillment. */
+    /**
+     * Validates a fulfillment.
+     */
     [[nodiscard]] virtual bool
     validate(Slice data) const = 0;
 
-    /** Calculates the cost associated with this fulfillment. *
-
-        The cost function is deterministic and depends on the
-        type and properties of the condition and the fulfillment
-        that the condition is generated from.
-    */
+    /**
+     * Calculates the cost associated with this fulfillment. *
+     *
+     * The cost function is deterministic and depends on the
+     * type and properties of the condition and the fulfillment
+     * that the condition is generated from.
+     */
     [[nodiscard]] virtual std::uint32_t
     cost() const = 0;
 
-    /** Returns the condition associated with the given fulfillment.
-
-        This process is completely deterministic. All implementations
-        will, if compliant, produce the identical condition for the
-        same fulfillment.
-    */
+    /**
+     * Returns the condition associated with the given fulfillment.
+     *
+     * This process is completely deterministic. All implementations
+     * will, if compliant, produce the identical condition for the
+     * same fulfillment.
+     */
     [[nodiscard]] virtual Condition
     condition() const = 0;
 };
@@ -90,36 +99,40 @@ operator!=(Fulfillment const& lhs, Fulfillment const& rhs)
     return !(lhs == rhs);
 }
 
-/** Determine whether the given fulfillment and condition match */
+/**
+ * Determine whether the given fulfillment and condition match
+ */
 bool
 match(Fulfillment const& f, Condition const& c);
 
-/** Verify if the given message satisfies the fulfillment.
-
-    @param f The fulfillment
-    @param c The condition
-    @param m The message
-
-    @note the message is not relevant for some conditions
-          and a fulfillment will successfully satisfy its
-          condition for any given message.
-*/
+/**
+ * Verify if the given message satisfies the fulfillment.
+ *
+ * @param f The fulfillment
+ * @param c The condition
+ * @param m The message
+ *
+ * @note the message is not relevant for some conditions
+ *       and a fulfillment will successfully satisfy its
+ *       condition for any given message.
+ */
 bool
 validate(Fulfillment const& f, Condition const& c, Slice m);
 
-/** Verify a cryptoconditional trigger.
-
-    A cryptoconditional trigger is a cryptocondition with
-    an empty message.
-
-    When using such triggers, it is recommended that the
-    trigger be of type preimage, prefix or threshold. If
-    a signature type is used (i.e. Ed25519 or RSA-SHA256)
-    then the Ed25519 or RSA keys should be single-use keys.
-
-    @param f The fulfillment
-    @param c The condition
-*/
+/**
+ * Verify a cryptoconditional trigger.
+ *
+ * A cryptoconditional trigger is a cryptocondition with
+ * an empty message.
+ *
+ * When using such triggers, it is recommended that the
+ * trigger be of type preimage, prefix or threshold. If
+ * a signature type is used (i.e. Ed25519 or RSA-SHA256)
+ * then the Ed25519 or RSA keys should be single-use keys.
+ *
+ * @param f The fulfillment
+ * @param c The condition
+ */
 bool
 validate(Fulfillment const& f, Condition const& c);
 
diff --git a/include/xrpl/conditions/detail/PreimageSha256.h b/include/xrpl/conditions/detail/PreimageSha256.h
index 0973a52e4a..007588a0b5 100644
--- a/include/xrpl/conditions/detail/PreimageSha256.h
+++ b/include/xrpl/conditions/detail/PreimageSha256.h
@@ -18,23 +18,25 @@ namespace xrpl::cryptoconditions {
 class PreimageSha256 final : public Fulfillment
 {
 public:
-    /** The maximum allowed length of a preimage.
-
-        The specification does not specify a minimum supported
-        length, nor does it require all conditions to support
-        the same minimum length.
-
-        While future versions of this code will never lower
-        this limit, they may opt to raise it.
-    */
+    /**
+     * The maximum allowed length of a preimage.
+     *
+     * The specification does not specify a minimum supported
+     * length, nor does it require all conditions to support
+     * the same minimum length.
+     *
+     * While future versions of this code will never lower
+     * this limit, they may opt to raise it.
+     */
     static constexpr std::size_t kMaxPreimageLength = 128;
 
-    /** Parse the payload for a PreimageSha256 condition
-
-        @param s A slice containing the DER encoded payload
-        @param ec indicates success or failure of the operation
-        @return the preimage, if successful; empty pointer otherwise.
-    */
+    /**
+     * Parse the payload for a PreimageSha256 condition
+     *
+     * @param s A slice containing the DER encoded payload
+     * @param ec indicates success or failure of the operation
+     * @return the preimage, if successful; empty pointer otherwise.
+     */
     static std::unique_ptr<Fulfillment>
     deserialize(Slice s, std::error_code& ec)
     {
diff --git a/include/xrpl/config/BasicConfig.h b/include/xrpl/config/BasicConfig.h
index 5680b51fe7..607a0c3e5f 100644
--- a/include/xrpl/config/BasicConfig.h
+++ b/include/xrpl/config/BasicConfig.h
@@ -21,9 +21,10 @@ using IniFileSections = std::unordered_map<std::string, std::vector<std::string>
 
 //------------------------------------------------------------------------------
 
-/** Holds a collection of configuration values.
-    A configuration file contains zero or more sections.
-*/
+/**
+ * Holds a collection of configuration values.
+ * A configuration file contains zero or more sections.
+ */
 class Section
 {
 private:
@@ -36,28 +37,34 @@ private:
     using const_iterator = decltype(lookup_)::const_iterator;
 
 public:
-    /** Create an empty section. */
+    /**
+     * Create an empty section.
+     */
     explicit Section(std::string name = "");
 
-    /** Returns the name of this section. */
+    /**
+     * Returns the name of this section.
+     */
     [[nodiscard]] std::string const&
     name() const
     {
         return name_;
     }
 
-    /** Returns all the lines in the section.
-        This includes everything.
-    */
+    /**
+     * Returns all the lines in the section.
+     * This includes everything.
+     */
     [[nodiscard]] std::vector<std::string> const&
     lines() const
     {
         return lines_;
     }
 
-    /** Returns all the values in the section.
-        Values are non-empty lines which are not key/value pairs.
-    */
+    /**
+     * Returns all the values in the section.
+     * Values are non-empty lines which are not key/value pairs.
+     */
     [[nodiscard]] std::vector<std::string> const&
     values() const
     {
@@ -84,7 +91,7 @@ public:
      * Get the legacy value for this section.
      *
      * @return The retrieved value. A section with an empty legacy value returns
-               an empty string.
+     *         an empty string.
      */
     [[nodiscard]] std::string
     legacy() const
@@ -99,28 +106,34 @@ public:
         return lines_[0];
     }
 
-    /** Set a key/value pair.
-        The previous value is discarded.
-    */
+    /**
+     * Set a key/value pair.
+     * The previous value is discarded.
+     */
     void
     set(std::string const& key, std::string const& value);
 
-    /** Append a set of lines to this section.
-        Lines containing key/value pairs are added to the map,
-        else they are added to the values list. Everything is
-        added to the lines list.
-    */
+    /**
+     * Append a set of lines to this section.
+     * Lines containing key/value pairs are added to the map,
+     * else they are added to the values list. Everything is
+     * added to the lines list.
+     */
     void
     append(std::vector<std::string> const& lines);
 
-    /** Append a line to this section. */
+    /**
+     * Append a line to this section.
+     */
     void
     append(std::string const& line)
     {
         append(std::vector<std::string>{line});
     }
 
-    /** Returns `true` if a key with the given name exists. */
+    /**
+     * Returns `true` if a key with the given name exists.
+     */
     [[nodiscard]] bool
     exists(std::string const& name) const;
 
@@ -134,7 +147,9 @@ public:
         return boost::lexical_cast<T>(iter->second);
     }
 
-    /// Returns a value if present, else another value.
+    /**
+     * Returns a value if present, else another value.
+     */
     template <class T>
     [[nodiscard]] T
     valueOr(std::string const& name, T const& other) const
@@ -199,23 +214,27 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** Holds unparsed configuration information.
-    The raw data sections are processed with intermediate parsers specific
-    to each module instead of being all parsed in a central location.
-*/
+/**
+ * Holds unparsed configuration information.
+ * The raw data sections are processed with intermediate parsers specific
+ * to each module instead of being all parsed in a central location.
+ */
 class BasicConfig
 {
 private:
     std::unordered_map<std::string, Section> map_;
 
 public:
-    /** Returns `true` if a section with the given name exists. */
+    /**
+     * Returns `true` if a section with the given name exists.
+     */
     [[nodiscard]] bool
     exists(std::string const& name) const;
 
-    /** Returns the section with the given name.
-        If the section does not exist, an empty section is returned.
-    */
+    /**
+     * Returns the section with the given name.
+     * If the section does not exist, an empty section is returned.
+     */
     /** @{ */
     Section&
     section(std::string const& name);
@@ -236,37 +255,39 @@ public:
     }
     /** @} */
 
-    /** Overwrite a key/value pair with a command line argument
-        If the section does not exist it is created.
-        The previous value, if any, is overwritten.
-    */
+    /**
+     * Overwrite a key/value pair with a command line argument
+     * If the section does not exist it is created.
+     * The previous value, if any, is overwritten.
+     */
     void
     overwrite(std::string const& section, std::string const& key, std::string const& value);
 
-    /** Remove all the key/value pairs from the section.
+    /**
+     * Remove all the key/value pairs from the section.
      */
     void
     deprecatedClearSection(std::string const& section);
 
     /**
-     *  Set a value that is not a key/value pair.
+     * Set a value that is not a key/value pair.
      *
-     *  The value is stored as the section's first value and may be retrieved
-     *  through section::legacy.
+     * The value is stored as the section's first value and may be retrieved
+     * through section::legacy.
      *
-     *  @param section Name of the section to modify.
-     *  @param value Contents of the legacy value.
+     * @param section Name of the section to modify.
+     * @param value Contents of the legacy value.
      */
     void
     legacy(std::string const& section, std::string value);
 
     /**
-     *  Get the legacy value of a section. A section with a
-     *  single-line value may be retrieved as a legacy value.
+     * Get the legacy value of a section. A section with a
+     * single-line value may be retrieved as a legacy value.
      *
-     *  @param sectionName Retrieve the contents of this section's
-     *         legacy value.
-     *  @return Contents of the legacy value.
+     * @param sectionName Retrieve the contents of this section's
+     *        legacy value.
+     * @return Contents of the legacy value.
      */
     [[nodiscard]] std::string
     legacy(std::string const& sectionName) const;
@@ -289,11 +310,12 @@ protected:
 
 //------------------------------------------------------------------------------
 
-/** Set a value from a configuration Section
-    If the named value is not found or doesn't parse as a T,
-    the variable is unchanged.
-    @return `true` if value was set.
-*/
+/**
+ * Set a value from a configuration Section
+ * If the named value is not found or doesn't parse as a T,
+ * the variable is unchanged.
+ * @return `true` if value was set.
+ */
 template <class T>
 bool
 set(T& target, std::string const& name, Section const& section)
@@ -312,11 +334,12 @@ set(T& target, std::string const& name, Section const& section)
     return foundAndValid;
 }
 
-/** Set a value from a configuration Section
-    If the named value is not found or doesn't cast to T,
-    the variable is assigned the default.
-    @return `true` if the named value was found and is valid.
-*/
+/**
+ * Set a value from a configuration Section
+ * If the named value is not found or doesn't cast to T,
+ * the variable is assigned the default.
+ * @return `true` if the named value was found and is valid.
+ */
 template <class T>
 bool
 set(T& target, T const& defaultValue, std::string const& name, Section const& section)
@@ -327,10 +350,11 @@ set(T& target, T const& defaultValue, std::string const& name, Section const& se
     return foundAndValid;
 }
 
-/** Retrieve a key/value pair from a section.
-    @return The value string converted to T if it exists
-            and can be parsed, or else defaultValue.
-*/
+/**
+ * Retrieve a key/value pair from a section.
+ * @return The value string converted to T if it exists
+ *         and can be parsed, or else defaultValue.
+ */
 // NOTE This routine might be more clumsy than the previous two
 template <class T = std::string>
 T
diff --git a/include/xrpl/core/ClosureCounter.h b/include/xrpl/core/ClosureCounter.h
index ed15db032e..33899d671b 100644
--- a/include/xrpl/core/ClosureCounter.h
+++ b/include/xrpl/core/ClosureCounter.h
@@ -30,8 +30,8 @@ namespace xrpl {
  * the caller that they should drop the closure and cancel their operation.
  * `join` blocks until all existing closure substitutes are destroyed.
  *
- * \tparam Ret The return type of the closure.
- * \tparam Args The argument types of the closure.
+ * @tparam Ret The return type of the closure.
+ * @tparam Args The argument types of the closure.
  */
 template <typename Ret, typename... Args>
 class ClosureCounter
@@ -131,18 +131,21 @@ public:
     ClosureCounter&
     operator=(ClosureCounter const&) = delete;
 
-    /** Destructor verifies all in-flight closures are complete. */
+    /**
+     * Destructor verifies all in-flight closures are complete.
+     */
     ~ClosureCounter()
     {
         using namespace std::chrono_literals;
         join("ClosureCounter", 1s, debugLog());
     }
 
-    /** Returns once all counted in-flight closures are destroyed.
-
-        @param name Name reported if join time exceeds wait.
-        @param wait If join() exceeds this duration report to Journal.
-        @param j Journal written to if wait is exceeded.
+    /**
+     * Returns once all counted in-flight closures are destroyed.
+     *
+     * @param name Name reported if join time exceeds wait.
+     * @param wait If join() exceeds this duration report to Journal.
+     * @param j Journal written to if wait is exceeded.
      */
     void
     join(char const* name, std::chrono::milliseconds wait, beast::Journal j)
@@ -160,13 +163,14 @@ public:
         }
     }
 
-    /** Wrap the passed closure with a reference counter.
-
-        @param closure Closure that accepts Args parameters and returns Ret.
-        @return If join() has been called returns std::nullopt.  Otherwise
-                returns a std::optional that wraps closure with a
-                reference counter.
-    */
+    /**
+     * Wrap the passed closure with a reference counter.
+     *
+     * @param closure Closure that accepts Args parameters and returns Ret.
+     * @return If join() has been called returns std::nullopt.  Otherwise
+     *         returns a std::optional that wraps closure with a
+     *         reference counter.
+     */
     template <class Closure>
     std::optional<Substitute<Closure>>
     wrap(Closure&& closure)
@@ -180,19 +184,22 @@ public:
         return ret;
     }
 
-    /** Current number of Closures outstanding.  Only useful for testing. */
+    /**
+     * Current number of Closures outstanding.  Only useful for testing.
+     */
     int
     count() const
     {
         return closureCount_;
     }
 
-    /** Returns true if this has been joined.
-
-        Even if true is returned, counted closures may still be in flight.
-        However if (joined() && (count() == 0)) there should be no more
-        counted closures in flight.
-    */
+    /**
+     * Returns true if this has been joined.
+     *
+     * Even if true is returned, counted closures may still be in flight.
+     * However if (joined() && (count() == 0)) there should be no more
+     * counted closures in flight.
+     */
     bool
     joined() const
     {
diff --git a/include/xrpl/core/Coro.ipp b/include/xrpl/core/Coro.ipp
index 133caf37a9..9a45dac504 100644
--- a/include/xrpl/core/Coro.ipp
+++ b/include/xrpl/core/Coro.ipp
@@ -4,8 +4,10 @@
 
 namespace xrpl {
 
-/// Coroutine stack size (1.5 MB). Increased from 1 MB because
-/// ASAN-instrumented deep call stacks exceeded the original limit.
+/**
+ * Coroutine stack size (1.5 MB). Increased from 1 MB because
+ * ASAN-instrumented deep call stacks exceeded the original limit.
+ */
 constexpr std::size_t kCoroStackSize = 1536 * 1024;
 
 template <class F>
diff --git a/include/xrpl/core/HashRouter.h b/include/xrpl/core/HashRouter.h
index dad1afb405..20aafecc5f 100644
--- a/include/xrpl/core/HashRouter.h
+++ b/include/xrpl/core/HashRouter.h
@@ -75,19 +75,21 @@ any(HashRouterFlags flags)
 
 class Config;
 
-/** Routing table for objects identified by hash.
-
-    This table keeps track of which hashes have been received by which peers.
-    It is used to manage the routing and broadcasting of messages in the peer
-    to peer overlay.
-*/
+/**
+ * Routing table for objects identified by hash.
+ *
+ * This table keeps track of which hashes have been received by which peers.
+ * It is used to manage the routing and broadcasting of messages in the peer
+ * to peer overlay.
+ */
 class HashRouter
 {
 public:
     // The type here *MUST* match the type of Peer::id_t
     using PeerShortID = std::uint32_t;
 
-    /** Structure used to customize @ref HashRouter behavior.
+    /**
+     * Structure used to customize @ref HashRouter behavior.
      *
      * Even though these items are configurable, they are undocumented. Don't
      * change them unless there is a good reason, and network-wide coordination
@@ -97,22 +99,27 @@ public:
      */
     struct Setup
     {
-        /// Default constructor
+        /**
+         * Default constructor
+         */
         explicit Setup() = default;
 
         using seconds = std::chrono::seconds;
 
-        /** Expiration time for a hash entry
+        /**
+         * Expiration time for a hash entry
          */
         seconds holdTime{300};
 
-        /** Amount of time required before a relayed item will be relayed again.
+        /**
+         * Amount of time required before a relayed item will be relayed again.
          */
         seconds relayTime{30};
     };
 
 private:
-    /** An entry in the routing table.
+    /**
+     * An entry in the routing table.
      */
     class Entry : public CountedObject<Entry>
     {
@@ -138,26 +145,31 @@ private:
             flags_ |= flagsToSet;
         }
 
-        /** Return set of peers we've relayed to and reset tracking */
+        /**
+         * Return set of peers we've relayed to and reset tracking
+         */
         std::set<PeerShortID>
         releasePeerSet()
         {
             return std::move(peers_);
         }
 
-        /** Return seated relay time point if the message has been relayed */
+        /**
+         * Return seated relay time point if the message has been relayed
+         */
         [[nodiscard]] std::optional<Stopwatch::time_point>
         relayed() const
         {
             return relayed_;
         }
 
-        /** Determines if this item should be relayed.
-
-            Checks whether the item has been recently relayed.
-            If it has, return false. If it has not, update the
-            last relay timestamp and return true.
-        */
+        /**
+         * Determines if this item should be relayed.
+         *
+         * Checks whether the item has been recently relayed.
+         * If it has, return false. If it has not, update the
+         * last relay timestamp and return true.
+         */
         bool
         shouldRelay(Stopwatch::time_point const& now, std::chrono::seconds relayTime)
         {
@@ -203,11 +215,13 @@ public:
     bool
     addSuppressionPeer(uint256 const& key, PeerShortID peer);
 
-    /** Add a suppression peer and get message's relay status.
+    /**
+     * Add a suppression peer and get message's relay status.
      * Return pair:
      * element 1: true if the peer is added.
      * element 2: optional is seated to the relay time point or
-     * is unseated if has not relayed yet. */
+     * is unseated if has not relayed yet.
+     */
     std::pair<bool, std::optional<Stopwatch::time_point>>
     addSuppressionPeerWithStatus(uint256 const& key, PeerShortID peer);
 
@@ -222,28 +236,30 @@ public:
         HashRouterFlags& flags,
         std::chrono::seconds txInterval);
 
-    /** Set the flags on a hash.
-
-        @return `true` if the flags were changed. `false` if unchanged.
-    */
+    /**
+     * Set the flags on a hash.
+     *
+     * @return `true` if the flags were changed. `false` if unchanged.
+     */
     bool
     setFlags(uint256 const& key, HashRouterFlags flags);
 
     HashRouterFlags
     getFlags(uint256 const& key);
 
-    /** Determines whether the hashed item should be relayed.
-
-        Effects:
-
-            If the item should be relayed, this function will not
-            return a seated optional again until the relay time has expired.
-            The internal set of peers will also be reset.
-
-        @return A `std::optional` set of peers which do not need to be
-            relayed to. If the result is unseated, the item should
-            _not_ be relayed.
-    */
+    /**
+     * Determines whether the hashed item should be relayed.
+     *
+     * Effects:
+     *
+     *     If the item should be relayed, this function will not
+     *     return a seated optional again until the relay time has expired.
+     *     The internal set of peers will also be reset.
+     *
+     * @return A `std::optional` set of peers which do not need to be
+     *     relayed to. If the result is unseated, the item should
+     *     _not_ be relayed.
+     */
     std::optional<std::set<PeerShortID>>
     shouldRelay(uint256 const& key);
 
diff --git a/include/xrpl/core/Job.h b/include/xrpl/core/Job.h
index e16d7412bf..93b39701be 100644
--- a/include/xrpl/core/Job.h
+++ b/include/xrpl/core/Job.h
@@ -83,12 +83,13 @@ class Job : public CountedObject<Job>
 public:
     using clock_type = std::chrono::steady_clock;
 
-    /** Default constructor.
-
-        Allows Job to be used as a container type.
-
-        This is used to allow things like jobMap [key] = value.
-    */
+    /**
+     * Default constructor.
+     *
+     * Allows Job to be used as a container type.
+     *
+     * This is used to allow things like jobMap [key] = value.
+     */
     // VFALCO NOTE I'd prefer not to have a default constructed object.
     //             What is the semantic meaning of a Job with no associated
     //             function? Having the invariant "all Job objects refer to
@@ -108,7 +109,9 @@ public:
     [[nodiscard]] JobType
     getType() const;
 
-    /** Returns the time when the job was queued. */
+    /**
+     * Returns the time when the job was queued.
+     */
     [[nodiscard]] clock_type::time_point const&
     queueTime() const;
 
diff --git a/include/xrpl/core/JobQueue.h b/include/xrpl/core/JobQueue.h
index e4b64546f3..0c9fc76357 100644
--- a/include/xrpl/core/JobQueue.h
+++ b/include/xrpl/core/JobQueue.h
@@ -45,20 +45,23 @@ struct CoroCreateT
     explicit CoroCreateT() = default;
 };
 
-/** A pool of threads to perform work.
-
-    A job posted will always run to completion.
-
-    Coroutines that are suspended must be resumed,
-    and run to completion.
-
-    When the JobQueue stops, it waits for all jobs
-    and coroutines to finish.
-*/
+/**
+ * A pool of threads to perform work.
+ *
+ * A job posted will always run to completion.
+ *
+ * Coroutines that are suspended must be resumed,
+ * and run to completion.
+ *
+ * When the JobQueue stops, it waits for all jobs
+ * and coroutines to finish.
+ */
 class JobQueue : private Workers::Callback
 {
 public:
-    /** Coroutines must run to completion. */
+    /**
+     * Coroutines must run to completion.
+     */
     class Coro : public std::enable_shared_from_this<Coro>
     {
     private:
@@ -87,55 +90,64 @@ public:
 
         ~Coro();
 
-        /** Suspend coroutine execution.
-            Effects:
-              The coroutine's stack is saved.
-              The associated Job thread is released.
-            Note:
-              The associated Job function returns.
-              Undefined behavior if called consecutively without a corresponding
-           post.
-        */
+        /**
+         * Suspend coroutine execution.
+         *  Effects:
+         *    The coroutine's stack is saved.
+         *    The associated Job thread is released.
+         *  Note:
+         *    The associated Job function returns.
+         *    Undefined behavior if called consecutively without a corresponding
+         * post.
+         */
         void
         yield() const;
 
-        /** Schedule coroutine execution.
-            Effects:
-              Returns immediately.
-              A new job is scheduled to resume the execution of the coroutine.
-              When the job runs, the coroutine's stack is restored and execution
-                continues at the beginning of coroutine function or the
-           statement after the previous call to yield. Undefined behavior if
-           called after the coroutine has completed with a return (as opposed to
-           a yield()). Undefined behavior if post() or resume() called
-           consecutively without a corresponding yield.
-
-            @return true if the Coro's job is added to the JobQueue.
-        */
+        /**
+         * Schedule coroutine execution.
+         * Effects:
+         *   Returns immediately.
+         *   A new job is scheduled to resume the execution of the coroutine.
+         *   When the job runs, the coroutine's stack is restored and execution
+         *     continues at the beginning of coroutine function or the
+         * statement after the previous call to yield. Undefined behavior if
+         * called after the coroutine has completed with a return (as opposed to
+         * a yield()). Undefined behavior if post() or resume() called
+         * consecutively without a corresponding yield.
+         *
+         * @return true if the Coro's job is added to the JobQueue.
+         */
         bool
         post();
 
-        /** Resume coroutine execution.
-            Effects:
-               The coroutine continues execution from where it last left off
-                 using this same thread.
-               If the coroutine has already completed, returns immediately
-                 (handles the documented post-before-yield race condition).
-            Undefined behavior if resume() or post() called consecutively
-              without a corresponding yield.
-        */
+        /**
+         * Resume coroutine execution.
+         * Effects:
+         *    The coroutine continues execution from where it last left off
+         *      using this same thread.
+         *    If the coroutine has already completed, returns immediately
+         *      (handles the documented post-before-yield race condition).
+         * Undefined behavior if resume() or post() called consecutively
+         *   without a corresponding yield.
+         */
         void
         resume();
 
-        /** Returns true if the Coro is still runnable (has not returned). */
+        /**
+         * Returns true if the Coro is still runnable (has not returned).
+         */
         [[nodiscard]] bool
         runnable() const;
 
-        /** Once called, the Coro allows early exit without an assert. */
+        /**
+         * Once called, the Coro allows early exit without an assert.
+         */
         void
         expectEarlyExit();
 
-        /** Waits until coroutine returns from the user function. */
+        /**
+         * Waits until coroutine returns from the user function.
+         */
         void
         join();
     };
@@ -150,14 +162,15 @@ public:
         perf::PerfLog& perfLog);
     ~JobQueue() override;
 
-    /** Adds a job to the JobQueue.
-
-        @param type The type of job.
-        @param name Name of the job.
-        @param jobHandler Callable with signature void(). Called when the job is executed.
-
-        @return true if jobHandler added to queue.
-    */
+    /**
+     * Adds a job to the JobQueue.
+     *
+     * @param type The type of job.
+     * @param name Name of the job.
+     * @param jobHandler Callable with signature void(). Called when the job is executed.
+     *
+     * @return true if jobHandler added to queue.
+     */
     template <typename JobHandler>
     bool
     addJob(JobType type, std::string const& name, JobHandler&& jobHandler)
@@ -170,40 +183,46 @@ public:
         return false;
     }
 
-    /** Creates a coroutine and adds a job to the queue which will run it.
-
-        @param t The type of job.
-        @param name Name of the job.
-        @param f Has a signature of void(std::shared_ptr<Coro>). Called when the
-       job executes.
-
-        @return shared_ptr to posted Coro.  nullptr if post was not successful.
-    */
+    /**
+     * Creates a coroutine and adds a job to the queue which will run it.
+     *
+     * @param t The type of job.
+     * @param name Name of the job.
+     * @param f Has a signature of void(std::shared_ptr<Coro>). Called when the
+     * job executes.
+     *
+     * @return shared_ptr to posted Coro.  nullptr if post was not successful.
+     */
     template <class F>
     std::shared_ptr<Coro>
     postCoro(JobType t, std::string const& name, F&& f);
 
-    /** Jobs waiting at this priority.
+    /**
+     * Jobs waiting at this priority.
      */
     int
     getJobCount(JobType t) const;
 
-    /** Jobs waiting plus running at this priority.
+    /**
+     * Jobs waiting plus running at this priority.
      */
     int
     getJobCountTotal(JobType t) const;
 
-    /** All waiting jobs at or greater than this priority.
+    /**
+     * All waiting jobs at or greater than this priority.
      */
     int
     getJobCountGE(JobType t) const;
 
-    /** Return a scoped LoadEvent.
+    /**
+     * Return a scoped LoadEvent.
      */
     std::unique_ptr<LoadEvent>
     makeLoadEvent(JobType t, std::string const& name);
 
-    /** Add multiple load events.
+    /**
+     * Add multiple load events.
      */
     void
     addLoadEvents(JobType t, int count, std::chrono::milliseconds elapsed);
@@ -216,7 +235,9 @@ public:
     json::Value
     getJson(int c = 0);
 
-    /** Block until no jobs running. */
+    /**
+     * Block until no jobs running.
+     */
     void
     rendezvous();
 
diff --git a/include/xrpl/core/JobTypeInfo.h b/include/xrpl/core/JobTypeInfo.h
index b5db0dbaab..302a462ac6 100644
--- a/include/xrpl/core/JobTypeInfo.h
+++ b/include/xrpl/core/JobTypeInfo.h
@@ -8,21 +8,26 @@
 
 namespace xrpl {
 
-/** Holds all the 'static' information about a job, which does not change */
+/**
+ * Holds all the 'static' information about a job, which does not change
+ */
 class JobTypeInfo
 {
 private:
     JobType const type_;
     std::string const name_;
 
-    /** The limit on the number of running jobs for this job type.
-
-        A limit of 0 marks this as a "special job" which is not
-        dispatched via the job queue.
+    /**
+     * The limit on the number of running jobs for this job type.
+     *
+     * A limit of 0 marks this as a "special job" which is not
+     * dispatched via the job queue.
      */
     int const limit_;
 
-    /** Average and peak latencies for this job type. 0 is none specified */
+    /**
+     * Average and peak latencies for this job type. 0 is none specified
+     */
     std::chrono::milliseconds const avgLatency_;
     std::chrono::milliseconds const peakLatency_;
 
diff --git a/include/xrpl/core/NetworkIDService.h b/include/xrpl/core/NetworkIDService.h
index 009f9ba6f8..8e2b3fcfe2 100644
--- a/include/xrpl/core/NetworkIDService.h
+++ b/include/xrpl/core/NetworkIDService.h
@@ -4,25 +4,27 @@
 
 namespace xrpl {
 
-/** Service that provides access to the network ID.
-
-    This service provides read-only access to the network ID configured
-    for this server. The network ID identifies which network (mainnet,
-    testnet, devnet, or custom network) this server is configured to
-    connect to.
-
-    Well-known network IDs:
-    - 0: Mainnet
-    - 1: Testnet
-    - 2: Devnet
-    - 1025+: Custom networks (require NetworkID field in transactions)
-*/
+/**
+ * Service that provides access to the network ID.
+ *
+ * This service provides read-only access to the network ID configured
+ * for this server. The network ID identifies which network (mainnet,
+ * testnet, devnet, or custom network) this server is configured to
+ * connect to.
+ *
+ * Well-known network IDs:
+ * - 0: Mainnet
+ * - 1: Testnet
+ * - 2: Devnet
+ * - 1025+: Custom networks (require NetworkID field in transactions)
+ */
 class NetworkIDService
 {
 public:
     virtual ~NetworkIDService() = default;
 
-    /** Get the configured network ID
+    /**
+     * Get the configured network ID
      *
      * @return The network ID this server is configured for
      */
diff --git a/include/xrpl/core/PeerReservationTable.h b/include/xrpl/core/PeerReservationTable.h
index e6f6dd622e..c95c88b967 100644
--- a/include/xrpl/core/PeerReservationTable.h
+++ b/include/xrpl/core/PeerReservationTable.h
@@ -81,7 +81,7 @@ public:
 
     /**
      * @return the replaced reservation if it existed
-     * @throw soci::soci_error
+     * @throws soci::soci_error
      */
     std::optional<PeerReservation>
     insertOrAssign(PeerReservation const& reservation);
diff --git a/include/xrpl/core/ServiceRegistry.h b/include/xrpl/core/ServiceRegistry.h
index 50bf2d7c10..592964134b 100644
--- a/include/xrpl/core/ServiceRegistry.h
+++ b/include/xrpl/core/ServiceRegistry.h
@@ -83,17 +83,17 @@ using RCLValidations = Validations<RCLValidationsAdaptor>;
 
 using NodeCache = TaggedCache<SHAMapHash, Blob>;
 
-/** Service registry for dependency injection.
-
-    This abstract interface provides access to various services and components
-    used throughout the application. It separates the service locator pattern
-    from the Application lifecycle management.
-
-    Components that need access to services can hold a reference to
-    ServiceRegistry rather than Application when they only need service
-    access and not lifecycle management.
-
-*/
+/**
+ * Service registry for dependency injection.
+ *
+ * This abstract interface provides access to various services and components
+ * used throughout the application. It separates the service locator pattern
+ * from the Application lifecycle management.
+ *
+ * Components that need access to services can hold a reference to
+ * ServiceRegistry rather than Application when they only need service
+ * access and not lifecycle management.
+ */
 class ServiceRegistry
 {
 public:
@@ -240,7 +240,9 @@ public:
     [[nodiscard]] virtual std::optional<uint256> const&
     getTrapTxID() const = 0;
 
-    /** Retrieve the "wallet database" */
+    /**
+     * Retrieve the "wallet database"
+     */
     virtual DatabaseCon&
     getWalletDB() = 0;
 
diff --git a/include/xrpl/core/detail/Workers.h b/include/xrpl/core/detail/Workers.h
index d20ebf7a64..6829d5a14b 100644
--- a/include/xrpl/core/detail/Workers.h
+++ b/include/xrpl/core/detail/Workers.h
@@ -60,7 +60,9 @@ class PerfLog;
 class Workers
 {
 public:
-    /** Called to perform tasks as needed. */
+    /**
+     * Called to perform tasks as needed.
+     */
     struct Callback
     {
         virtual ~Callback() = default;
@@ -69,27 +71,29 @@ public:
         Callback&
         operator=(Callback const&) = delete;
 
-        /** Perform a task.
-
-            The call is made on a thread owned by Workers. It is important
-            that you only process one task from inside your callback. Each
-            call to addTask will result in exactly one call to processTask.
-
-            @param instance The worker thread instance.
-
-            @see Workers::addTask
-        */
+        /**
+         * Perform a task.
+         *
+         * The call is made on a thread owned by Workers. It is important
+         * that you only process one task from inside your callback. Each
+         * call to addTask will result in exactly one call to processTask.
+         *
+         * @param instance The worker thread instance.
+         *
+         * @see Workers::addTask
+         */
         virtual void
         processTask(int instance) = 0;
     };
 
-    /** Create the object.
-
-        A number of initial threads may be optionally specified. The
-        default is to create one thread per CPU.
-
-        @param threadNames The name given to each created worker thread.
-    */
+    /**
+     * Create the object.
+     *
+     * A number of initial threads may be optionally specified. The
+     * default is to create one thread per CPU.
+     *
+     * @param threadNames The name given to each created worker thread.
+     */
     explicit Workers(
         Callback& callback,
         perf::PerfLog* perfLog,
@@ -98,49 +102,54 @@ public:
 
     ~Workers();
 
-    /** Retrieve the desired number of threads.
-
-        This just returns the number of active threads that were requested. If
-        there was a recent call to setNumberOfThreads, the actual number of
-       active threads may be temporarily different from what was last requested.
-
-        @note This function is not thread-safe.
-    */
+    /**
+     * Retrieve the desired number of threads.
+     *
+     * This just returns the number of active threads that were requested. If
+     * there was a recent call to setNumberOfThreads, the actual number of
+     * active threads may be temporarily different from what was last requested.
+     *
+     * @note This function is not thread-safe.
+     */
     [[nodiscard]] int
     getNumberOfThreads() const noexcept;
 
-    /** Set the desired number of threads.
-        @note This function is not thread-safe.
-    */
+    /**
+     * Set the desired number of threads.
+     * @note This function is not thread-safe.
+     */
     void
     setNumberOfThreads(int numberOfThreads);
 
-    /** Pause all threads and wait until they are paused.
-
-        If a thread is processing a task it will pause as soon as the task
-        completes. There may still be tasks signaled even after all threads
-        have paused.
-
-        @note This function is not thread-safe.
-    */
+    /**
+     * Pause all threads and wait until they are paused.
+     *
+     * If a thread is processing a task it will pause as soon as the task
+     * completes. There may still be tasks signaled even after all threads
+     * have paused.
+     *
+     * @note This function is not thread-safe.
+     */
     void
     stop();
 
-    /** Add a task to be performed.
-
-        Every call to addTask will eventually result in a call to
-        Callback::processTask unless the Workers object is destroyed or
-        the number of threads is never set above zero.
-
-        @note This function is thread-safe.
-    */
+    /**
+     * Add a task to be performed.
+     *
+     * Every call to addTask will eventually result in a call to
+     * Callback::processTask unless the Workers object is destroyed or
+     * the number of threads is never set above zero.
+     *
+     * @note This function is thread-safe.
+     */
     void
     addTask();
 
-    /** Get the number of currently executing calls of Callback::processTask.
-        While this function is thread-safe, the value may not stay
-        accurate for very long. It's mainly for diagnostic purposes.
-    */
+    /**
+     * Get the number of currently executing calls of Callback::processTask.
+     * While this function is thread-safe, the value may not stay
+     * accurate for very long. It's mainly for diagnostic purposes.
+     */
     [[nodiscard]] int
     numberOfCurrentlyRunningTasks() const noexcept;
 
diff --git a/include/xrpl/core/detail/semaphore.h b/include/xrpl/core/detail/semaphore.h
index e40463e322..abf6705097 100644
--- a/include/xrpl/core/detail/semaphore.h
+++ b/include/xrpl/core/detail/semaphore.h
@@ -45,14 +45,17 @@ private:
 public:
     using size_type = std::size_t;
 
-    /** Create the semaphore, with an optional initial count.
-        If unspecified, the initial count is zero.
-    */
+    /**
+     * Create the semaphore, with an optional initial count.
+     * If unspecified, the initial count is zero.
+     */
     explicit BasicSemaphore(size_type count = 0) : count_(count)
     {
     }
 
-    /** Increment the count and unblock one waiting thread. */
+    /**
+     * Increment the count and unblock one waiting thread.
+     */
     void
     notify()
     {
@@ -61,7 +64,9 @@ public:
         cond_.notify_one();
     }
 
-    /** Block until notify is called. */
+    /**
+     * Block until notify is called.
+     */
     void
     wait()
     {
@@ -71,9 +76,10 @@ public:
         --count_;
     }
 
-    /** Perform a non-blocking wait.
-        @return `true` If the wait would be satisfied.
-    */
+    /**
+     * Perform a non-blocking wait.
+     * @return `true` If the wait would be satisfied.
+     */
     bool
     tryWait()
     {
diff --git a/include/xrpl/crypto/RFC1751.h b/include/xrpl/crypto/RFC1751.h
index 278f3c207b..3de65c3028 100644
--- a/include/xrpl/crypto/RFC1751.h
+++ b/include/xrpl/crypto/RFC1751.h
@@ -16,13 +16,14 @@ public:
     static void
     getEnglishFromKey(std::string& strHuman, std::string const& strKey);
 
-    /** Chooses a single dictionary word from the data.
-
-        This is not particularly secure but it can be useful to provide
-        a unique name for something given a GUID or fixed data. We use
-        it to turn the pubkey_node into an easily remembered and identified
-        4 character string.
-    */
+    /**
+     * Chooses a single dictionary word from the data.
+     *
+     * This is not particularly secure but it can be useful to provide
+     * a unique name for something given a GUID or fixed data. We use
+     * it to turn the pubkey_node into an easily remembered and identified
+     * 4 character string.
+     */
     static std::string
     getWordFromBlob(void const* blob, size_t bytes);
 
diff --git a/include/xrpl/crypto/csprng.h b/include/xrpl/crypto/csprng.h
index cdc6a723c8..e19d33a464 100644
--- a/include/xrpl/crypto/csprng.h
+++ b/include/xrpl/crypto/csprng.h
@@ -7,14 +7,15 @@
 
 namespace xrpl {
 
-/** A cryptographically secure random number engine
-
-    The engine is thread-safe (it uses a lock to serialize
-    access) and will, automatically, mix in some randomness
-    from std::random_device.
-
-    Meets the requirements of UniformRandomNumberEngine
-*/
+/**
+ * A cryptographically secure random number engine
+ *
+ * The engine is thread-safe (it uses a lock to serialize
+ * access) and will, automatically, mix in some randomness
+ * from std::random_device.
+ *
+ * Meets the requirements of UniformRandomNumberEngine
+ */
 class CsprngEngine
 {
 private:
@@ -34,15 +35,21 @@ public:
     CsprngEngine();
     ~CsprngEngine();
 
-    /** Mix entropy into the pool */
+    /**
+     * Mix entropy into the pool
+     */
     void
     mixEntropy(void* buffer = nullptr, std::size_t count = 0);
 
-    /** Generate a random integer */
+    /**
+     * Generate a random integer
+     */
     result_type
     operator()();
 
-    /** Fill a buffer with the requested amount of random data */
+    /**
+     * Fill a buffer with the requested amount of random data
+     */
     void
     operator()(void* ptr, std::size_t count);
 
@@ -61,14 +68,15 @@ public:
     }
 };
 
-/** The default cryptographically secure PRNG
-
-    Use this when you need to generate random numbers or
-    data that will be used for encryption or passed into
-    cryptographic routines.
-
-    This meets the requirements of UniformRandomNumberEngine
-*/
+/**
+ * The default cryptographically secure PRNG
+ *
+ * Use this when you need to generate random numbers or
+ * data that will be used for encryption or passed into
+ * cryptographic routines.
+ *
+ * This meets the requirements of UniformRandomNumberEngine
+ */
 CsprngEngine&
 cryptoPrng();
 
diff --git a/include/xrpl/crypto/secure_erase.h b/include/xrpl/crypto/secure_erase.h
index 74284b03f7..38531afc1d 100644
--- a/include/xrpl/crypto/secure_erase.h
+++ b/include/xrpl/crypto/secure_erase.h
@@ -4,20 +4,21 @@
 
 namespace xrpl {
 
-/** Attempts to clear the given blob of memory.
-
-    The underlying implementation of this function takes pains to
-    attempt to outsmart the compiler from optimizing the clearing
-    away. Please note that, despite that, remnants of content may
-    remain floating around in memory as well as registers, caches
-    and more.
-
-    For a more in-depth discussion of the subject please see the
-    below posts by Colin Percival:
-
-    http://www.daemonology.net/blog/2014-09-04-how-to-zero-a-buffer.html
-    http://www.daemonology.net/blog/2014-09-06-zeroing-buffers-is-insufficient.html
-*/
+/**
+ * Attempts to clear the given blob of memory.
+ *
+ * The underlying implementation of this function takes pains to
+ * attempt to outsmart the compiler from optimizing the clearing
+ * away. Please note that, despite that, remnants of content may
+ * remain floating around in memory as well as registers, caches
+ * and more.
+ *
+ * For a more in-depth discussion of the subject please see the
+ * below posts by Colin Percival:
+ *
+ * http://www.daemonology.net/blog/2014-09-04-how-to-zero-a-buffer.html
+ * http://www.daemonology.net/blog/2014-09-06-zeroing-buffers-is-insufficient.html
+ */
 void
 secureErase(void* dest, std::size_t bytes);
 
diff --git a/include/xrpl/json/JsonPropertyStream.h b/include/xrpl/json/JsonPropertyStream.h
index 405a61cd34..498283c16b 100644
--- a/include/xrpl/json/JsonPropertyStream.h
+++ b/include/xrpl/json/JsonPropertyStream.h
@@ -8,7 +8,9 @@
 
 namespace xrpl {
 
-/** A PropertyStream::Sink which produces a json::Value of type ValueType::Object. */
+/**
+ * A PropertyStream::Sink which produces a json::Value of type ValueType::Object.
+ */
 class JsonPropertyStream : public beast::PropertyStream
 {
 public:
diff --git a/include/xrpl/json/Output.h b/include/xrpl/json/Output.h
index c01253f713..53d453c277 100644
--- a/include/xrpl/json/Output.h
+++ b/include/xrpl/json/Output.h
@@ -17,18 +17,20 @@ stringOutput(std::string& s)
     return [&](boost::beast::string_view const& b) { s.append(b.data(), b.size()); };
 }
 
-/** Writes a minimal representation of a Json value to an Output in O(n) time.
-
-    Data is streamed right to the output, so only a marginal amount of memory is
-    used.  This can be very important for a very large json::Value.
+/**
+ * Writes a minimal representation of a Json value to an Output in O(n) time.
+ *
+ * Data is streamed right to the output, so only a marginal amount of memory is
+ * used.  This can be very important for a very large json::Value.
  */
 void
 outputJson(json::Value const&, Output const&);
 
-/** Return the minimal string representation of a json::Value in O(n) time.
-
-    This requires a memory allocation for the full size of the output.
-    If possible, use outputJson().
+/**
+ * Return the minimal string representation of a json::Value in O(n) time.
+ *
+ * This requires a memory allocation for the full size of the output.
+ * If possible, use outputJson().
  */
 std::string
 jsonAsString(json::Value const&);
diff --git a/include/xrpl/json/Writer.h b/include/xrpl/json/Writer.h
index 024876a43c..ec7fd6a0d2 100644
--- a/include/xrpl/json/Writer.h
+++ b/include/xrpl/json/Writer.h
@@ -12,98 +12,98 @@
 namespace json {
 
 /**
- *  Writer implements an O(1)-space, O(1)-granular output JSON writer.
+ * Writer implements an O(1)-space, O(1)-granular output JSON writer.
  *
- *  O(1)-space means that it uses a fixed amount of memory, and that there are
- *  no heap allocations at each step of the way.
+ * O(1)-space means that it uses a fixed amount of memory, and that there are
+ * no heap allocations at each step of the way.
  *
- *  O(1)-granular output means the writer only outputs in small segments of a
- *  bounded size, using a bounded number of CPU cycles in doing so.  This is
- *  very helpful in scheduling long jobs.
+ * O(1)-granular output means the writer only outputs in small segments of a
+ * bounded size, using a bounded number of CPU cycles in doing so.  This is
+ * very helpful in scheduling long jobs.
  *
- *  The tradeoff is that you have to fill items in the JSON tree as you go,
- *  and you can never go backward.
+ * The tradeoff is that you have to fill items in the JSON tree as you go,
+ * and you can never go backward.
  *
- *  Writer can write single JSON tokens, but the typical use is to write out an
- *  entire JSON object.  For example:
+ * Writer can write single JSON tokens, but the typical use is to write out an
+ * entire JSON object.  For example:
  *
- *      {
- *          Writer w (out);
+ *     {
+ *         Writer w (out);
  *
- *          w.startObject ();          // Start the root object.
- *          w.set ("hello", "world");
- *          w.set ("goodbye", 23);
- *          w.finishObject ();         // Finish the root object.
- *      }
+ *         w.startObject ();          // Start the root object.
+ *         w.set ("hello", "world");
+ *         w.set ("goodbye", 23);
+ *         w.finishObject ();         // Finish the root object.
+ *     }
  *
- *  which outputs the string
+ * which outputs the string
  *
- *      {"hello":"world","goodbye":23}
+ *     {"hello":"world","goodbye":23}
  *
- *  There can be an object inside an object:
+ * There can be an object inside an object:
  *
- *      {
- *          Writer w (out);
+ *     {
+ *         Writer w (out);
  *
- *          w.startObject ();                // Start the root object.
- *          w.set ("hello", "world");
+ *         w.startObject ();                // Start the root object.
+ *         w.set ("hello", "world");
  *
- *          w.startObjectSet ("subobject");  // Start a sub-object.
- *          w.set ("goodbye", 23);           // Add a key, value assignment.
- *          w.finishObject ();               // Finish the sub-object.
+ *         w.startObjectSet ("subobject");  // Start a sub-object.
+ *         w.set ("goodbye", 23);           // Add a key, value assignment.
+ *         w.finishObject ();               // Finish the sub-object.
  *
- *          w.finishObject ();               // Finish the root-object.
- *      }
+ *         w.finishObject ();               // Finish the root-object.
+ *     }
  *
- *  which outputs the string
+ * which outputs the string
  *
- *     {"hello":"world","subobject":{"goodbye":23}}.
+ *    {"hello":"world","subobject":{"goodbye":23}}.
  *
- *  Arrays work similarly
+ * Arrays work similarly
  *
- *      {
- *          Writer w (out);
- *          w.startObject ();           // Start the root object.
+ *     {
+ *         Writer w (out);
+ *         w.startObject ();           // Start the root object.
  *
- *          w.startArraySet ("hello");  // Start an array.
- *          w.append (23)               // Append some items.
- *          w.append ("skidoo")
- *          w.finishArray ();           // Finish the array.
+ *         w.startArraySet ("hello");  // Start an array.
+ *         w.append (23)               // Append some items.
+ *         w.append ("skidoo")
+ *         w.finishArray ();           // Finish the array.
  *
- *          w.finishObject ();          // Finish the root object.
- *      }
+ *         w.finishObject ();          // Finish the root object.
+ *     }
  *
- *  which outputs the string
+ * which outputs the string
  *
- *      {"hello":[23,"skidoo"]}.
+ *     {"hello":[23,"skidoo"]}.
  *
  *
- *  If you've reached the end of a long object, you can just use finishAll()
- *  which finishes all arrays and objects that you have started.
+ * If you've reached the end of a long object, you can just use finishAll()
+ * which finishes all arrays and objects that you have started.
  *
- *      {
- *          Writer w (out);
- *          w.startObject ();           // Start the root object.
+ *     {
+ *         Writer w (out);
+ *         w.startObject ();           // Start the root object.
  *
- *          w.startArraySet ("hello");  // Start an array.
- *          w.append (23)               // Append an item.
+ *         w.startArraySet ("hello");  // Start an array.
+ *         w.append (23)               // Append an item.
  *
- *          w.startArrayAppend ()       // Start a sub-array.
- *          w.append ("one");
- *          w.append ("two");
+ *         w.startArrayAppend ()       // Start a sub-array.
+ *         w.append ("one");
+ *         w.append ("two");
  *
- *          w.startObjectAppend ();     // Append a sub-object.
- *          w.finishAll ();             // Finish everything.
- *      }
+ *         w.startObjectAppend ();     // Append a sub-object.
+ *         w.finishAll ();             // Finish everything.
+ *     }
  *
- *  which outputs the string
+ * which outputs the string
  *
- *      {"hello":[23,["one","two",{}]]}.
+ *     {"hello":[23,["one","two",{}]]}.
  *
- *  For convenience, the destructor of Writer calls w.finishAll() which makes
- *  sure that all arrays and objects are closed.  This means that you can throw
- *  an exception, or have a coroutine simply clean up the stack, and be sure
- *  that you do in fact generate a complete JSON object.
+ * For convenience, the destructor of Writer calls w.finishAll() which makes
+ * sure that all arrays and objects are closed.  This means that you can throw
+ * an exception, or have a coroutine simply clean up the stack, and be sure
+ * that you do in fact generate a complete JSON object.
  */
 
 class Writer
@@ -118,26 +118,37 @@ public:
 
     ~Writer();
 
-    /** Start a new collection at the root level. */
+    /**
+     * Start a new collection at the root level.
+     */
     void startRoot(CollectionType);
 
-    /** Start a new collection inside an array. */
+    /**
+     * Start a new collection inside an array.
+     */
     void startAppend(CollectionType);
 
-    /** Start a new collection inside an object. */
+    /**
+     * Start a new collection inside an object.
+     */
     void
     startSet(CollectionType, std::string const& key);
 
-    /** Finish the collection most recently started. */
+    /**
+     * Finish the collection most recently started.
+     */
     void
     finish();
 
-    /** Finish all objects and arrays.  After finishArray() has been called, no
-     *  more operations can be performed. */
+    /**
+     * Finish all objects and arrays.  After finishArray() has been called, no
+     *  more operations can be performed.
+     */
     void
     finishAll();
 
-    /** Append a value to an array.
+    /**
+     * Append a value to an array.
      *
      *  Scalar must be a scalar - that is, a number, boolean, string, string
      *  literal, nullptr or json::Value
@@ -150,12 +161,15 @@ public:
         output(t);
     }
 
-    /** Add a comma before this next item if not the first item in an array.
-        Useful if you are writing the actual array yourself. */
+    /**
+     * Add a comma before this next item if not the first item in an array.
+     * Useful if you are writing the actual array yourself.
+     */
     void
     rawAppend();
 
-    /** Add a key, value assignment to an object.
+    /**
+     * Add a key, value assignment to an object.
      *
      *  Scalar must be a scalar - that is, a number, boolean, string, string
      *  literal, or nullptr.
@@ -174,8 +188,10 @@ public:
         output(t);
     }
 
-    /** Emit just "tag": as part of an object.  Useful if you are writing the
-        actual value data yourself. */
+    /**
+     * Emit just "tag": as part of an object.  Useful if you are writing the
+     * actual value data yourself.
+     */
     void
     rawSet(std::string const& key);
 
@@ -194,22 +210,32 @@ public:
     void
     output(json::Value const&);
 
-    /** Output a null. */
+    /**
+     * Output a null.
+     */
     void output(std::nullptr_t);
 
-    /** Output a float. */
+    /**
+     * Output a float.
+     */
     void
     output(float);
 
-    /** Output a double. */
+    /**
+     * Output a double.
+     */
     void
     output(double);
 
-    /** Output a bool. */
+    /**
+     * Output a bool.
+     */
     void
     output(bool);
 
-    /** Output numbers or booleans. */
+    /**
+     * Output numbers or booleans.
+     */
     template <typename Type>
     void
     output(Type t)
diff --git a/include/xrpl/json/json_reader.h b/include/xrpl/json/json_reader.h
index d1e4ada579..ed60f49ce4 100644
--- a/include/xrpl/json/json_reader.h
+++ b/include/xrpl/json/json_reader.h
@@ -12,9 +12,9 @@
 
 namespace json {
 
-/** \brief Unserialize a <a HREF="http://www.json.org">JSON</a> document into a
+/**
+ * @brief Unserialize a <a HREF="http://www.json.org">JSON</a> document into a
  * Value.
- *
  */
 class Reader
 {
@@ -22,48 +22,55 @@ public:
     using Char = char;
     using Location = Char const*;
 
-    /** \brief Constructs a Reader allowing all features
+    /**
+     * @brief Constructs a Reader allowing all features
      * for parsing.
      */
     Reader() = default;
 
-    /** \brief Read a Value from a <a HREF="http://www.json.org">JSON</a>
-     * document. \param document UTF-8 encoded string containing the document to
-     * read. \param root [out] Contains the root value of the document if it was
+    /**
+     * @brief Read a Value from a <a HREF="http://www.json.org">JSON</a>
+     * document. @param document UTF-8 encoded string containing the document to
+     * read. @param root [out] Contains the root value of the document if it was
      *             successfully parsed.
-     * \return \c true if the document was successfully parsed, \c false if an
+     * @return @c true if the document was successfully parsed, @c false if an
      * error occurred.
      */
     bool
     parse(std::string const& document, Value& root);
 
-    /** \brief Read a Value from a <a HREF="http://www.json.org">JSON</a>
-     * document. \param document UTF-8 encoded string containing the document to
-     * read. \param root [out] Contains the root value of the document if it was
+    /**
+     * @brief Read a Value from a <a HREF="http://www.json.org">JSON</a>
+     * document. @param document UTF-8 encoded string containing the document to
+     * read. @param root [out] Contains the root value of the document if it was
      *             successfully parsed.
-     * \return \c true if the document was successfully parsed, \c false if an
+     * @return @c true if the document was successfully parsed, @c false if an
      * error occurred.
      */
     bool
     parse(char const* beginDoc, char const* endDoc, Value& root);
 
-    /// \brief Parse from input stream.
-    /// \see json::operator>>(std::istream&, json::Value&).
+    /**
+     * @brief Parse from input stream.
+     * @see json::operator>>(std::istream&, json::Value&).
+     */
     bool
     parse(std::istream& is, Value& root);
 
-    /** \brief Read a Value from a <a HREF="http://www.json.org">JSON</a> buffer
-     * sequence. \param root [out] Contains the root value of the document if it
-     * was successfully parsed. \param UTF-8 encoded buffer sequence. \return \c
-     * true if the buffer was successfully parsed, \c false if an error
+    /**
+     * @brief Read a Value from a <a HREF="http://www.json.org">JSON</a> buffer
+     * sequence. @param root [out] Contains the root value of the document if it
+     * was successfully parsed. @param UTF-8 encoded buffer sequence. @return @c
+     * true if the buffer was successfully parsed, @c false if an error
      * occurred.
      */
     template <class BufferSequence>
     bool
     parse(Value& root, BufferSequence const& bs);
 
-    /** \brief Returns a user friendly string that list errors in the parsed
-     * document. \return Formatted error message with the list of errors with
+    /**
+     * @brief Returns a user friendly string that list errors in the parsed
+     * document. @return Formatted error message with the list of errors with
      * their location in the parsed document. An empty string is returned if no
      * error occurred during parsing.
      */
@@ -195,30 +202,31 @@ Reader::parse(Value& root, BufferSequence const& bs)
     return parse(s, root);
 }
 
-/** \brief Read from 'sin' into 'root'.
-
- Always keep comments from the input JSON.
-
- This can be used to read a file into a particular sub-object.
- For example:
- \code
- json::Value root;
- cin >> root["dir"]["file"];
- cout << root;
- \endcode
- Result:
- \verbatim
- {
-"dir": {
-    "file": {
- // The input stream JSON would be nested here.
-    }
-}
- }
- \endverbatim
- \throw std::exception on parse error.
- \see json::operator<<()
-*/
+/**
+ * @brief Read from 'sin' into 'root'.
+ *
+ * Always keep comments from the input JSON.
+ *
+ * This can be used to read a file into a particular sub-object.
+ * For example:
+ * @code
+ * json::Value root;
+ * cin >> root["dir"]["file"];
+ * cout << root;
+ * @endcode
+ * Result:
+ * @verbatim
+ * {
+ * "dir": {
+ *    "file": {
+ * // The input stream JSON would be nested here.
+ *    }
+ * }
+ * }
+ * @endverbatim
+ * @throws std::exception on parse error.
+ * @see json::operator<<()
+ */
 std::istream&
 operator>>(std::istream&, Value&);
 
diff --git a/include/xrpl/json/json_value.h b/include/xrpl/json/json_value.h
index f786c6a9dc..47ad3ac1e0 100644
--- a/include/xrpl/json/json_value.h
+++ b/include/xrpl/json/json_value.h
@@ -9,11 +9,13 @@
 #include <string>
 #include <vector>
 
-/** \brief JSON (JavaScript Object Notation).
+/**
+ * @brief JSON (JavaScript Object Notation).
  */
 namespace json {
 
-/** \brief Type of the value held by a Value object.
+/**
+ * @brief Type of the value held by a Value object.
  */
 enum class ValueType {
     Null = 0,  ///< 'null' value
@@ -26,19 +28,20 @@ enum class ValueType {
     Object     ///< object value (collection of name/value pairs).
 };
 
-/** \brief Lightweight wrapper to tag static string.
+/**
+ * @brief Lightweight wrapper to tag static string.
  *
  * Value constructor and ValueType::Object member assignment takes advantage of the
  * StaticString and avoid the cost of string duplication when storing the
  * string or the member name.
  *
  * Example of usage:
- * \code
+ * @code
  * json::Value aValue( StaticString("some text") );
  * json::Value object;
  * static const StaticString code("code");
  * object[code] = 1234;
- * \endcode
+ * @endcode
  */
 class StaticString
 {
@@ -99,7 +102,8 @@ operator!=(StaticString x, std::string const& y)
     return !(y == x);
 }
 
-/** \brief Represents a <a HREF="http://www.json.org">JSON</a> value.
+/**
+ * @brief Represents a <a HREF="http://www.json.org">JSON</a> value.
  *
  * This class is a discriminated union wrapper that can represent a:
  * - signed integer [range: Value::kMinInt - Value::kMaxInt]
@@ -175,37 +179,39 @@ public:
     using ObjectValues = std::map<CZString, Value>;
 
 public:
-    /** \brief Create a default Value of the given type.
-
-      This is a very useful constructor.
-      To create an empty array, pass ValueType::Array.
-      To create an empty object, pass ValueType::Object.
-      Another Value can then be set to this one by assignment.
-    This is useful since clear() and resize() will not alter types.
-
-           Examples:
-    \code
-    json::Value null_value; // null
-    json::Value arr_value(json::ValueType::Array); // []
-    json::Value obj_value(json::ValueType::Object); // {}
-    \endcode
-         */
+    /**
+     * @brief Create a default Value of the given type.
+     *
+     *   This is a very useful constructor.
+     *   To create an empty array, pass ValueType::Array.
+     *   To create an empty object, pass ValueType::Object.
+     *   Another Value can then be set to this one by assignment.
+     * This is useful since clear() and resize() will not alter types.
+     *
+     *        Examples:
+     * @code
+     * json::Value null_value; // null
+     * json::Value arr_value(json::ValueType::Array); // []
+     * json::Value obj_value(json::ValueType::Object); // {}
+     * @endcode
+     */
     Value(ValueType type = ValueType::Null);
     Value(Int value);
     Value(UInt value);
     Value(double value);
     Value(char const* value);
     Value(xrpl::Number const& value);
-    /** \brief Constructs a value from a static string.
-
+    /**
+     * @brief Constructs a value from a static string.
+     *
      * Like other value string constructor but do not duplicate the string for
      * internal storage. The given string must remain alive after the call to
-     this
+     * this
      * constructor.
      * Example of usage:
-     * \code
+     * @code
      * json::Value aValue( StaticString("some text") );
-     * \endcode
+     * @endcode
      */
     Value(StaticString const& value);
     Value(std::string const& value);
@@ -220,7 +226,9 @@ public:
 
     Value(Value&& other) noexcept;
 
-    /// Swap values.
+    /**
+     * Swap values.
+     */
     void
     swap(Value& other) noexcept;
 
@@ -229,7 +237,9 @@ public:
 
     [[nodiscard]] char const*
     asCString() const;
-    /** Returns the unquoted string value. */
+    /**
+     * Returns the unquoted string value.
+     */
     [[nodiscard]] std::string
     asString() const;
     [[nodiscard]] Int
@@ -241,13 +251,17 @@ public:
     [[nodiscard]] bool
     asBool() const;
 
-    /** Correct absolute value from int or unsigned int */
+    /**
+     * Correct absolute value from int or unsigned int
+     */
     [[nodiscard]] UInt
     asAbsUInt() const;
 
     // TODO: What is the "empty()" method this docstring mentions?
-    /** isNull() tests to see if this field is null.  Don't use this method to
-        test for emptiness: use empty(). */
+    /**
+     * isNull() tests to see if this field is null.  Don't use this method to
+     * test for emptiness: use empty().
+     */
     [[nodiscard]] bool
     isNull() const;
     [[nodiscard]] bool
@@ -276,116 +290,157 @@ public:
     [[nodiscard]] bool
     isConvertibleTo(ValueType other) const;
 
-    /// Number of values in array or object
+    /**
+     * Number of values in array or object
+     */
     [[nodiscard]] UInt
     size() const;
 
-    /** Returns false if this is an empty array, empty object, empty string,
-        or null. */
+    /**
+     * Returns false if this is an empty array, empty object, empty string,
+     * or null.
+     */
     explicit
     operator bool() const;
 
-    /// Remove all object members and array elements.
-    /// \pre type() is ValueType::Array, ValueType::Object, or ValueType::Null
-    /// \post type() is unchanged
+    /**
+     * Remove all object members and array elements.
+     * @pre type() is ValueType::Array, ValueType::Object, or ValueType::Null
+     * @post type() is unchanged
+     */
     void
     clear();
 
-    /// Access an array element (zero based index ).
-    /// If the array contains less than index element, then null value are
-    /// inserted in the array so that its size is index+1. (You may need to say
-    /// 'value[0u]' to get your compiler to distinguish
-    ///  this from the operator[] which takes a string.)
+    /**
+     * Access an array element (zero based index ).
+     * If the array contains less than index element, then null value are
+     * inserted in the array so that its size is index+1. (You may need to say
+     * 'value[0u]' to get your compiler to distinguish
+     *  this from the operator[] which takes a string.)
+     */
     Value&
     operator[](UInt index);
-    /// Access an array element (zero based index )
-    /// (You may need to say 'value[0u]' to get your compiler to distinguish
-    ///  this from the operator[] which takes a string.)
+    /**
+     * Access an array element (zero based index )
+     * (You may need to say 'value[0u]' to get your compiler to distinguish
+     *  this from the operator[] which takes a string.)
+     */
     Value const&
     operator[](UInt index) const;
-    /// If the array contains at least index+1 elements, returns the element
-    /// value, otherwise returns defaultValue.
+    /**
+     * If the array contains at least index+1 elements, returns the element
+     * value, otherwise returns defaultValue.
+     */
     [[nodiscard]] Value
     get(UInt index, Value const& defaultValue) const;
-    /// Return true if index < size().
+    /**
+     * Return true if index < size().
+     */
     [[nodiscard]] bool
     isValidIndex(UInt index) const;
-    /// \brief Append value to array at the end.
-    ///
-    /// Equivalent to jsonvalue[jsonvalue.size()] = value;
+    /**
+     * @brief Append value to array at the end.
+     *
+     * Equivalent to jsonvalue[jsonvalue.size()] = value;
+     */
     Value&
     append(Value const& value);
     Value&
     append(Value&& value);
 
-    /// Access an object value by name, create a null member if it does not
-    /// exist.
+    /**
+     * Access an object value by name, create a null member if it does not
+     * exist.
+     */
     Value&
     operator[](char const* key);
-    /// Access an object value by name, returns null if there is no member with
-    /// that name.
+    /**
+     * Access an object value by name, returns null if there is no member with
+     * that name.
+     */
     Value const&
     operator[](char const* key) const;
-    /// Access an object value by name, create a null member if it does not
-    /// exist.
+    /**
+     * Access an object value by name, create a null member if it does not
+     * exist.
+     */
     Value&
     operator[](std::string const& key);
-    /// Access an object value by name, returns null if there is no member with
-    /// that name.
+    /**
+     * Access an object value by name, returns null if there is no member with
+     * that name.
+     */
     Value const&
     operator[](std::string const& key) const;
-    /** \brief Access an object value by name, create a null member if it does
-     not exist.
-
+    /**
+     * @brief Access an object value by name, create a null member if it does
+     * not exist.
+     *
      * If the object as no entry for that name, then the member name used to
-     store
+     * store
      * the new entry is not duplicated.
      * Example of use:
-     * \code
+     * @code
      * json::Value object;
      * static const StaticString code("code");
      * object[code] = 1234;
-     * \endcode
+     * @endcode
      */
     Value&
     operator[](StaticString const& key);
     Value const&
     operator[](StaticString const& key) const;
 
-    /// Return the member named key if it exist, defaultValue otherwise.
+    /**
+     * Return the member named key if it exist, defaultValue otherwise.
+     */
     Value
     get(char const* key, Value const& defaultValue) const;
-    /// Return the member named key if it exist, defaultValue otherwise.
+    /**
+     * Return the member named key if it exist, defaultValue otherwise.
+     */
     [[nodiscard]] Value
     get(std::string const& key, Value const& defaultValue) const;
 
-    /// \brief Remove and return the named member.
-    ///
-    /// Do nothing if it did not exist.
-    /// \return the removed Value, or null.
-    /// \pre type() is ValueType::Object or ValueType::Null
-    /// \post type() is unchanged
+    /**
+     * @brief Remove and return the named member.
+     *
+     * Do nothing if it did not exist.
+     * @return the removed Value, or null.
+     * @pre type() is ValueType::Object or ValueType::Null
+     * @post type() is unchanged
+     */
     Value
     removeMember(char const* key);
-    /// Same as removeMember(const char*)
+    /**
+     * Same as removeMember(const char*)
+     */
     Value
     removeMember(std::string const& key);
 
-    /// Return true if the object has a member named key.
+    /**
+     * Return true if the object has a member named key.
+     */
     bool
     isMember(char const* key) const;
-    /// Return true if the object has a member named key.
+    /**
+     * Return true if the object has a member named key.
+     */
     [[nodiscard]] bool
     isMember(std::string const& key) const;
-    /// Return true if the object has a member named key.
+    /**
+     * Return true if the object has a member named key.
+     */
     [[nodiscard]] bool
     isMember(StaticString const& key) const;
 
-    /// \brief Return a list of the member names.
-    ///
-    /// If null, return an empty list.
-    /// \pre type() is ValueType::Object or ValueType::Null
-    /// \post if type() was ValueType::Null, it remains ValueType::Null
+    /**
+     * @brief Return a list of the member names.
+     *
+     * If null, return an empty list.
+     * @pre type() is ValueType::Object or ValueType::Null
+     * @post if type() was ValueType::Null, it remains ValueType::Null
+     */
     [[nodiscard]] Members
     getMemberNames() const;
 
@@ -461,7 +516,8 @@ operator>=(Value const& x, Value const& y)
     return !(x < y);
 }
 
-/** \brief Experimental do not use: Allocator to customize member name and
+/**
+ * @brief Experimental do not use: Allocator to customize member name and
  * string value memory management done by Value.
  *
  * - makeMemberName() and releaseMemberName() are called to respectively
@@ -486,8 +542,8 @@ public:
     releaseStringValue(char* value) = 0;
 };
 
-/** \brief base class for Value iterators.
- *
+/**
+ * @brief base class for Value iterators.
  */
 class ValueIteratorBase
 {
@@ -512,17 +568,23 @@ public:
         return !isEqual(other);
     }
 
-    /// Return either the index or the member name of the referenced value as a
-    /// Value.
+    /**
+     * Return either the index or the member name of the referenced value as a
+     * Value.
+     */
     [[nodiscard]] Value
     key() const;
 
-    /// Return the index of the referenced Value. -1 if it is not an ValueType::Array.
+    /**
+     * Return the index of the referenced Value. -1 if it is not an ValueType::Array.
+     */
     [[nodiscard]] UInt
     index() const;
 
-    /// Return the member name of the referenced Value. "" if it is not an
-    /// ValueType::Object.
+    /**
+     * Return the member name of the referenced Value. "" if it is not an
+     * ValueType::Object.
+     */
     [[nodiscard]] char const*
     memberName() const;
 
@@ -551,8 +613,8 @@ private:
     bool isNull_;
 };
 
-/** \brief const iterator for object and array value.
- *
+/**
+ * @brief const iterator for object and array value.
  */
 class ValueConstIterator : public ValueIteratorBase
 {
@@ -569,7 +631,8 @@ public:
     ValueConstIterator(ValueConstIterator const& other) = default;
 
 private:
-    /*! \internal Use by Value to create an iterator.
+    /**
+     * @internal Use by Value to create an iterator.
      */
     explicit ValueConstIterator(Value::ObjectValues::iterator const& current);
 
@@ -614,7 +677,8 @@ public:
     }
 };
 
-/** \brief Iterator for object and array value.
+/**
+ * @brief Iterator for object and array value.
  */
 class ValueIterator : public ValueIteratorBase
 {
@@ -632,7 +696,8 @@ public:
     ValueIterator(ValueIterator const& other);
 
 private:
-    /*! \internal Use by Value to create an iterator.
+    /**
+     * @internal Use by Value to create an iterator.
      */
     explicit ValueIterator(Value::ObjectValues::iterator const& current);
 
diff --git a/include/xrpl/json/json_writer.h b/include/xrpl/json/json_writer.h
index 4bc15b71da..65c8b20931 100644
--- a/include/xrpl/json/json_writer.h
+++ b/include/xrpl/json/json_writer.h
@@ -13,7 +13,8 @@ namespace json {
 
 class Value;
 
-/** \brief Abstract class for writers.
+/**
+ * @brief Abstract class for writers.
  */
 class WriterBase
 {
@@ -23,12 +24,13 @@ public:
     write(Value const& root) = 0;
 };
 
-/** \brief Outputs a Value in <a HREF="http://www.json.org">JSON</a> format
+/**
+ * @brief Outputs a Value in <a HREF="http://www.json.org">JSON</a> format
  * without formatting (not human friendly).
  *
  * The JSON document is written in a single line. It is not intended for 'human'
  * consumption, but may be useful to support feature such as RPC where bandwidth
- * is limited. \sa Reader, Value
+ * is limited. @see Reader, Value
  */
 
 class FastWriter : public WriterBase
@@ -48,7 +50,8 @@ private:
     std::string document_;
 };
 
-/** \brief Writes a Value in <a HREF="http://www.json.org">JSON</a> format in a
+/**
+ * @brief Writes a Value in <a HREF="http://www.json.org">JSON</a> format in a
  * human friendly way.
  *
  * The rules for line break and indent are as follow:
@@ -64,7 +67,7 @@ private:
  *     - otherwise, it the values do not fit on one line, or the array contains
  *       object or non empty array, then print one value per line.
  *
- * \sa Reader, Value
+ * @see Reader, Value
  */
 class StyledWriter : public WriterBase
 {
@@ -73,8 +76,9 @@ public:
     ~StyledWriter() override = default;
 
 public:  // overridden from Writer
-    /** \brief Serialize a Value in <a HREF="http://www.json.org">JSON</a>
-     * format. \param root Value to serialize. \return String containing the
+    /**
+     * @brief Serialize a Value in <a HREF="http://www.json.org">JSON</a>
+     * format. @param root Value to serialize. @return String containing the
      * JSON document that represents the root value.
      */
     std::string
@@ -108,26 +112,27 @@ private:
     bool addChildValues_{};
 };
 
-/** \brief Writes a Value in <a HREF="http://www.json.org">JSON</a> format in a
- human friendly way, to a stream rather than to a string.
+/**
+ * @brief Writes a Value in <a HREF="http://www.json.org">JSON</a> format in a
+ * human friendly way, to a stream rather than to a string.
  *
  * The rules for line break and indent are as follow:
  * - Object value:
  *     - if empty then print {} without indent and line break
  *     - if not empty the print '{', line break & indent, print one value per
- line
+ * line
  *       and then unindent and line break and print '}'.
  * - Array value:
  *     - if empty then print [] without indent and line break
  *     - if the array contains no object value, empty array or some other value
- types,
+ * types,
  *       and all the values fit on one lines, then print the array on a single
- line.
+ * line.
  *     - otherwise, it the values do not fit on one line, or the array contains
  *       object or non empty array, then print one value per line.
  *
- * \param indentation Each level will be indented by this amount extra.
- * \sa Reader, Value
+ * @param indentation Each level will be indented by this amount extra.
+ * @see Reader, Value
  */
 class StyledStreamWriter
 {
@@ -136,10 +141,11 @@ public:
     ~StyledStreamWriter() = default;
 
 public:
-    /** \brief Serialize a Value in <a HREF="http://www.json.org">JSON</a>
-     * format. \param out Stream to write to. (Can be ostringstream, e.g.)
-     * \param root Value to serialize.
-     * \note There is no point in deriving from Writer, since write() should not
+    /**
+     * @brief Serialize a Value in <a HREF="http://www.json.org">JSON</a>
+     * format. @param out Stream to write to. (Can be ostringstream, e.g.)
+     * @param root Value to serialize.
+     * @note There is no point in deriving from Writer, since write() should not
      * return a value.
      */
     void
@@ -184,8 +190,10 @@ valueToString(bool value);
 std::string
 valueToQuotedString(char const* value);
 
-/// \brief Output using the StyledStreamWriter.
-/// \see json::operator>>()
+/**
+ * @brief Output using the StyledStreamWriter.
+ * @see json::operator>>()
+ */
 std::ostream&
 operator<<(std::ostream&, Value const& root);
 
@@ -265,12 +273,13 @@ writeValue(Write const& write, Value const& value)
 
 }  // namespace detail
 
-/** Stream compact JSON to the specified function.
-
-    @param jv The json::Value to write
-    @param write Invocable with signature void(void const*, std::size_t) that
-                 is called when output should be written to the stream.
-*/
+/**
+ * Stream compact JSON to the specified function.
+ *
+ * @param jv The json::Value to write
+ * @param write Invocable with signature void(void const*, std::size_t) that
+ *              is called when output should be written to the stream.
+ */
 template <class Write>
 void
 stream(json::Value const& jv, Write const& write)
@@ -279,29 +288,31 @@ stream(json::Value const& jv, Write const& write)
     write("\n", 1);
 }
 
-/** Decorator for streaming out compact json
-
-    Use
-
-        json::Value jv;
-        out << json::Compact{jv}
-
-    to write a single-line, compact version of `jv` to the stream, rather
-    than the styled format that comes from undecorated streaming.
-*/
+/**
+ * Decorator for streaming out compact json
+ *
+ * Use
+ *
+ *     json::Value jv;
+ *     out << json::Compact{jv}
+ *
+ * to write a single-line, compact version of `jv` to the stream, rather
+ * than the styled format that comes from undecorated streaming.
+ */
 class Compact
 {
     json::Value jv_;
 
 public:
-    /** Wrap a json::Value for compact streaming
-
-        @param jv The json::Value to stream
-
-        @note For now, we do not support wrapping lvalues to avoid
-              potentially costly copies. If we find a need, we can consider
-              adding support for compact lvalue streaming in the future.
-    */
+    /**
+     * Wrap a json::Value for compact streaming
+     *
+     * @param jv The json::Value to stream
+     *
+     * @note For now, we do not support wrapping lvalues to avoid
+     *       potentially costly copies. If we find a need, we can consider
+     *       adding support for compact lvalue streaming in the future.
+     */
     Compact(json::Value&& jv) : jv_{std::move(jv)}
     {
     }
diff --git a/include/xrpl/json/to_string.h b/include/xrpl/json/to_string.h
index 1d7b4c785a..bdd7a51e6a 100644
--- a/include/xrpl/json/to_string.h
+++ b/include/xrpl/json/to_string.h
@@ -6,11 +6,15 @@
 
 namespace json {
 
-/** Writes a json::Value to an std::string. */
+/**
+ * Writes a json::Value to an std::string.
+ */
 std::string
 to_string(Value const&);
 
-/** Writes a json::Value to an std::string. */
+/**
+ * Writes a json::Value to an std::string.
+ */
 std::string
 pretty(Value const&);
 
diff --git a/include/xrpl/ledger/AcceptedLedgerTx.h b/include/xrpl/ledger/AcceptedLedgerTx.h
index f59b8a074d..283dcf6e24 100644
--- a/include/xrpl/ledger/AcceptedLedgerTx.h
+++ b/include/xrpl/ledger/AcceptedLedgerTx.h
@@ -21,17 +21,17 @@
 namespace xrpl {
 
 /**
-    A transaction that is in a closed ledger.
-
-    Description
-
-    An accepted ledger transaction contains additional information that the
-    server needs to tell clients about the transaction. For example,
-        - The transaction in JSON form
-        - Which accounts are affected
-          * This is used by InfoSub to report to clients
-        - Cached stuff
-*/
+ * A transaction that is in a closed ledger.
+ *
+ * Description
+ *
+ * An accepted ledger transaction contains additional information that the
+ * server needs to tell clients about the transaction. For example,
+ *     - The transaction in JSON form
+ *     - Which accounts are affected
+ *       * This is used by InfoSub to report to clients
+ *     - Cached stuff
+ */
 class AcceptedLedgerTx : public CountedObject<AcceptedLedgerTx>
 {
 public:
diff --git a/include/xrpl/ledger/AmendmentTable.h b/include/xrpl/ledger/AmendmentTable.h
index 6598be5a5c..c3ef779eb1 100644
--- a/include/xrpl/ledger/AmendmentTable.h
+++ b/include/xrpl/ledger/AmendmentTable.h
@@ -37,10 +37,11 @@ namespace xrpl {
 
 class ServiceRegistry;
 
-/** The amendment table stores the list of enabled and potential amendments.
-    Individuals amendments are voted on by validators during the consensus
-    process.
-*/
+/**
+ * The amendment table stores the list of enabled and potential amendments.
+ * Individuals amendments are voted on by validators during the consensus
+ * process.
+ */
 class AmendmentTable
 {
 public:
@@ -90,11 +91,15 @@ public:
     [[nodiscard]] virtual json::Value
     getJson(bool isAdmin) const = 0;
 
-    /** Returns a json::ValueType::Object. */
+    /**
+     * Returns a json::ValueType::Object.
+     */
     [[nodiscard]] virtual json::Value
     getJson(uint256 const& amendment, bool isAdmin) const = 0;
 
-    /** Called when a new fully-validated ledger is accepted. */
+    /**
+     * Called when a new fully-validated ledger is accepted.
+     */
     void
     doValidatedLedger(std::shared_ptr<ReadView const> const& lastValidatedLedger)
     {
@@ -107,9 +112,10 @@ public:
         }
     }
 
-    /** Called to determine whether the amendment logic needs to process
-        a new validated ledger. (If it could have changed things.)
-    */
+    /**
+     * Called to determine whether the amendment logic needs to process
+     * a new validated ledger. (If it could have changed things.)
+     */
     [[nodiscard]] virtual bool
     needValidatedLedger(LedgerIndex seq) const = 0;
 
diff --git a/include/xrpl/ledger/ApplyView.h b/include/xrpl/ledger/ApplyView.h
index afe6b291b2..724d89b7c6 100644
--- a/include/xrpl/ledger/ApplyView.h
+++ b/include/xrpl/ledger/ApplyView.h
@@ -92,47 +92,50 @@ operator&=(ApplyFlags& lhs, ApplyFlags const& rhs)
 
 //------------------------------------------------------------------------------
 
-/** Writeable view to a ledger, for applying a transaction.
-
-    This refinement of ReadView provides an interface where
-    the SLE can be "checked out" for modifications and put
-    back in an updated or removed state. Also added is an
-    interface to provide contextual information necessary
-    to calculate the results of transaction processing,
-    including the metadata if the view is later applied to
-    the parent (using an interface in the derived class).
-    The context info also includes values from the base
-    ledger such as sequence number and the network time.
-
-    This allows implementations to journal changes made to
-    the state items in a ledger, with the option to apply
-    those changes to the base or discard the changes without
-    affecting the base.
-
-    Typical usage is to call read() for non-mutating
-    operations.
-
-    For mutating operations the sequence is as follows:
-
-        // Add a new value
-        v.insert(sle);
-
-        // Check out a value for modification
-        sle = v.peek(k);
-
-        // Indicate that changes were made
-        v.update(sle)
-
-        // Or, erase the value
-        v.erase(sle)
-
-    The invariant is that insert, update, and erase may not
-    be called with any SLE which belongs to different view.
-*/
+/**
+ * Writeable view to a ledger, for applying a transaction.
+ *
+ * This refinement of ReadView provides an interface where
+ * the SLE can be "checked out" for modifications and put
+ * back in an updated or removed state. Also added is an
+ * interface to provide contextual information necessary
+ * to calculate the results of transaction processing,
+ * including the metadata if the view is later applied to
+ * the parent (using an interface in the derived class).
+ * The context info also includes values from the base
+ * ledger such as sequence number and the network time.
+ *
+ * This allows implementations to journal changes made to
+ * the state items in a ledger, with the option to apply
+ * those changes to the base or discard the changes without
+ * affecting the base.
+ *
+ * Typical usage is to call read() for non-mutating
+ * operations.
+ *
+ * For mutating operations the sequence is as follows:
+ *
+ *     // Add a new value
+ *     v.insert(sle);
+ *
+ *     // Check out a value for modification
+ *     sle = v.peek(k);
+ *
+ *     // Indicate that changes were made
+ *     v.update(sle)
+ *
+ *     // Or, erase the value
+ *     v.erase(sle)
+ *
+ * The invariant is that insert, update, and erase may not
+ * be called with any SLE which belongs to different view.
+ */
 class ApplyView : public ReadView
 {
 private:
-    /** Add an entry to a directory using the specified insert strategy */
+    /**
+     * Add an entry to a directory using the specified insert strategy
+     */
     std::optional<std::uint64_t>
     dirAdd(
         bool preserveOrder,
@@ -143,84 +146,89 @@ private:
 public:
     ApplyView() = default;
 
-    /** Returns the tx apply flags.
-
-        Flags can affect the outcome of transaction
-        processing. For example, transactions applied
-        to an open ledger generate "local" failures,
-        while transactions applied to the consensus
-        ledger produce hard failures (and claim a fee).
-    */
+    /**
+     * Returns the tx apply flags.
+     *
+     * Flags can affect the outcome of transaction
+     * processing. For example, transactions applied
+     * to an open ledger generate "local" failures,
+     * while transactions applied to the consensus
+     * ledger produce hard failures (and claim a fee).
+     */
     [[nodiscard]] virtual ApplyFlags
     flags() const = 0;
 
-    /** Prepare to modify the SLE associated with key.
-
-        Effects:
-
-            Gives the caller ownership of a modifiable
-            SLE associated with the specified key.
-
-        The returned SLE may be used in a subsequent
-        call to erase or update.
-
-        The SLE must not be passed to any other ApplyView.
-
-        @return `nullptr` if the key is not present
-    */
+    /**
+     * Prepare to modify the SLE associated with key.
+     *
+     * Effects:
+     *
+     *     Gives the caller ownership of a modifiable
+     *     SLE associated with the specified key.
+     *
+     * The returned SLE may be used in a subsequent
+     * call to erase or update.
+     *
+     * The SLE must not be passed to any other ApplyView.
+     *
+     * @return `nullptr` if the key is not present
+     */
     virtual SLE::pointer
     peek(Keylet const& k) = 0;
 
-    /** Remove a peeked SLE.
-
-        Requirements:
-
-            `sle` was obtained from prior call to peek()
-            on this instance of the RawView.
-
-        Effects:
-
-            The key is no longer associated with the SLE.
-    */
+    /**
+     * Remove a peeked SLE.
+     *
+     * Requirements:
+     *
+     *     `sle` was obtained from prior call to peek()
+     *     on this instance of the RawView.
+     *
+     * Effects:
+     *
+     *     The key is no longer associated with the SLE.
+     */
     virtual void
     erase(SLE::ref sle) = 0;
 
-    /** Insert a new state SLE
-
-        Requirements:
-
-            `sle` was not obtained from any calls to
-            peek() on any instances of RawView.
-
-            The SLE's key must not already exist.
-
-        Effects:
-
-            The key in the state map is associated
-            with the SLE.
-
-            The RawView acquires ownership of the shared_ptr.
-
-        @note The key is taken from the SLE
-    */
+    /**
+     * Insert a new state SLE
+     *
+     * Requirements:
+     *
+     *     `sle` was not obtained from any calls to
+     *     peek() on any instances of RawView.
+     *
+     *     The SLE's key must not already exist.
+     *
+     * Effects:
+     *
+     *     The key in the state map is associated
+     *     with the SLE.
+     *
+     *     The RawView acquires ownership of the shared_ptr.
+     *
+     * @note The key is taken from the SLE
+     */
     virtual void
     insert(SLE::ref sle) = 0;
 
-    /** Indicate changes to a peeked SLE
-
-        Requirements:
-
-            The SLE's key must exist.
-
-            `sle` was obtained from prior call to peek()
-            on this instance of the RawView.
-
-        Effects:
-
-            The SLE is updated
-
-        @note The key is taken from the SLE
-    */
+    /**
+     * Indicate changes to a peeked SLE
+     *
+     * Requirements:
+     *
+     *     The SLE's key must exist.
+     *
+     *     `sle` was obtained from prior call to peek()
+     *     on this instance of the RawView.
+     *
+     * Effects:
+     *
+     *     The SLE is updated
+     *
+     * @note The key is taken from the SLE
+     */
     /** @{ */
     virtual void
     update(SLE::ref sle) = 0;
@@ -250,7 +258,8 @@ public:
         XRPL_ASSERT(amount.holds<MPTIssue>(), "creditHookMPT: amount is for MPTIssue");
     }
 
-    /** Facilitate tracking of MPT sold by an issuer owning MPT sell offer.
+    /**
+     * Facilitate tracking of MPT sold by an issuer owning MPT sell offer.
      * Unlike IOU, MPT doesn't have bi-directional relationship with an issuer,
      * where a trustline limits an amount that can be issued to a holder.
      * Consequently, the credit step (last MPTEndpointStep or
@@ -294,23 +303,24 @@ public:
     {
     }
 
-    /** Append an entry to a directory
-
-        Entries in the directory will be stored in order of insertion, i.e. new
-        entries will always be added at the tail end of the last page.
-
-        @param directory the base of the directory
-        @param key the entry to insert
-        @param describe callback to add required entries to a new page
-
-        @return a \c std::optional which, if insertion was successful,
-                will contain the page number in which the item was stored.
-
-        @note this function may create a page (including a root page), if no
-              page with space is available. This function will only fail if the
-              page counter exceeds the protocol-defined maximum number of
-              allowable pages.
-    */
+    /**
+     * Append an entry to a directory
+     *
+     * Entries in the directory will be stored in order of insertion, i.e. new
+     * entries will always be added at the tail end of the last page.
+     *
+     * @param directory the base of the directory
+     * @param key the entry to insert
+     * @param describe callback to add required entries to a new page
+     *
+     * @return a @c std::optional which, if insertion was successful,
+     *         will contain the page number in which the item was stored.
+     *
+     * @note this function may create a page (including a root page), if no
+     *       page with space is available. This function will only fail if the
+     *       page counter exceeds the protocol-defined maximum number of
+     *       allowable pages.
+     */
     /** @{ */
     std::optional<std::uint64_t>
     dirAppend(
@@ -333,23 +343,24 @@ public:
     }
     /** @} */
 
-    /** Insert an entry to a directory
-
-        Entries in the directory will be stored in a semi-random order, but
-        each page will be maintained in sorted order.
-
-        @param directory the base of the directory
-        @param key the entry to insert
-        @param describe callback to add required entries to a new page
-
-        @return a \c std::optional which, if insertion was successful,
-                will contain the page number in which the item was stored.
-
-        @note this function may create a page (including a root page), if no
-              page with space is available.this function will only fail if the
-              page counter exceeds the protocol-defined maximum number of
-              allowable pages.
-    */
+    /**
+     * Insert an entry to a directory
+     *
+     * Entries in the directory will be stored in a semi-random order, but
+     * each page will be maintained in sorted order.
+     *
+     * @param directory the base of the directory
+     * @param key the entry to insert
+     * @param describe callback to add required entries to a new page
+     *
+     * @return a @c std::optional which, if insertion was successful,
+     *         will contain the page number in which the item was stored.
+     *
+     * @note this function may create a page (including a root page), if no
+     *       page with space is available.this function will only fail if the
+     *       page counter exceeds the protocol-defined maximum number of
+     *       allowable pages.
+     */
     /** @{ */
     std::optional<std::uint64_t>
     dirInsert(
@@ -370,21 +381,22 @@ public:
     }
     /** @} */
 
-    /** Remove an entry from a directory
-
-        @param directory the base of the directory
-        @param page the page number for this page
-        @param key the entry to remove
-        @param keepRoot if deleting the last entry, don't
-                        delete the root page (i.e. the directory itself).
-
-        @return \c true if the entry was found and deleted and
-                \c false otherwise.
-
-        @note This function will remove zero or more pages from the directory;
-              the root page will not be deleted even if it is empty, unless
-              \p keepRoot is not set and the directory is empty.
-    */
+    /**
+     * Remove an entry from a directory
+     *
+     * @param directory the base of the directory
+     * @param page the page number for this page
+     * @param key the entry to remove
+     * @param keepRoot if deleting the last entry, don't
+     *                 delete the root page (i.e. the directory itself).
+     *
+     * @return @c true if the entry was found and deleted and
+     *         @c false otherwise.
+     *
+     * @note This function will remove zero or more pages from the directory;
+     *       the root page will not be deleted even if it is empty, unless
+     *       \p keepRoot is not set and the directory is empty.
+     */
     /** @{ */
     bool
     dirRemove(Keylet const& directory, std::uint64_t page, uint256 const& key, bool keepRoot);
@@ -396,34 +408,38 @@ public:
     }
     /** @} */
 
-    /** Remove the specified directory, invoking the callback for every node. */
+    /**
+     * Remove the specified directory, invoking the callback for every node.
+     */
     bool
     dirDelete(Keylet const& directory, std::function<void(uint256 const&)> const&);
 
-    /** Remove the specified directory, if it is empty.
-
-        @param directory the identifier of the directory node to be deleted
-        @return \c true if the directory was found and was successfully deleted
-                \c false otherwise.
-
-        @note The function should only be called with the root entry (i.e. with
-              the first page) of a directory.
-    */
+    /**
+     * Remove the specified directory, if it is empty.
+     *
+     * @param directory the identifier of the directory node to be deleted
+     * @return @c true if the directory was found and was successfully deleted
+     *         @c false otherwise.
+     *
+     * @note The function should only be called with the root entry (i.e. with
+     *       the first page) of a directory.
+     */
     bool
     emptyDirDelete(Keylet const& directory);
 };
 
-/** Bundles the mutable ledger view and the transaction being applied.
-
-    Passed together to avoid threading two separate parameters through every
-    helper that needs both the view (for state reads/writes) and the
-    transaction (for field inspection and metadata).
-
-    Both members are non-owning references; the caller is responsible for
-    ensuring that the referenced objects outlive the ApplyViewContext.
-
-    TODO: replace with ApplyContext after it's untangled with xrpl/tx
-*/
+/**
+ * Bundles the mutable ledger view and the transaction being applied.
+ *
+ * Passed together to avoid threading two separate parameters through every
+ * helper that needs both the view (for state reads/writes) and the
+ * transaction (for field inspection and metadata).
+ *
+ * Both members are non-owning references; the caller is responsible for
+ * ensuring that the referenced objects outlive the ApplyViewContext.
+ *
+ * TODO: replace with ApplyContext after it's untangled with xrpl/tx
+ */
 struct ApplyViewContext
 {
     ApplyView& view;
@@ -431,11 +447,12 @@ struct ApplyViewContext
 };
 
 namespace directory {
-/** Helper functions for managing low-level directory operations.
-    These are not part of the ApplyView interface.
-
-    Don't use them unless you really, really know what you're doing.
-    Instead use dirAdd, dirInsert, etc.
+/**
+ * Helper functions for managing low-level directory operations.
+ * These are not part of the ApplyView interface.
+ *
+ * Don't use them unless you really, really know what you're doing.
+ * Instead use dirAdd, dirInsert, etc.
  */
 
 std::uint64_t
diff --git a/include/xrpl/ledger/ApplyViewImpl.h b/include/xrpl/ledger/ApplyViewImpl.h
index 9a3734a8ca..630153f90a 100644
--- a/include/xrpl/ledger/ApplyViewImpl.h
+++ b/include/xrpl/ledger/ApplyViewImpl.h
@@ -18,12 +18,13 @@
 
 namespace xrpl {
 
-/** Editable, discardable view that can build metadata for one tx.
-
-    Iteration of the tx map is delegated to the base.
-
-    @note Presented as ApplyView to clients.
-*/
+/**
+ * Editable, discardable view that can build metadata for one tx.
+ *
+ * Iteration of the tx map is delegated to the base.
+ *
+ * @note Presented as ApplyView to clients.
+ */
 class ApplyViewImpl final : public detail::ApplyViewBase
 {
 public:
@@ -37,12 +38,13 @@ public:
     ApplyViewImpl(ApplyViewImpl&&) = default;
     ApplyViewImpl(ReadView const* base, ApplyFlags flags);
 
-    /** Apply the transaction.
-
-        After a call to `apply`, the only valid
-        operation on this object is to call the
-        destructor.
-    */
+    /**
+     * Apply the transaction.
+     *
+     * After a call to `apply`, the only valid
+     * operation on this object is to call the
+     * destructor.
+     */
     std::optional<TxMeta>
     apply(
         OpenView& to,
@@ -52,25 +54,28 @@ public:
         bool isDryRun,
         beast::Journal j);
 
-    /** Set the amount of currency delivered.
-
-        This value is used when generating metadata
-        for payments, to set the DeliveredAmount field.
-        If the amount is not specified, the field is
-        excluded from the resulting metadata.
-    */
+    /**
+     * Set the amount of currency delivered.
+     *
+     * This value is used when generating metadata
+     * for payments, to set the DeliveredAmount field.
+     * If the amount is not specified, the field is
+     * excluded from the resulting metadata.
+     */
     void
     deliver(STAmount const& amount)
     {
         deliver_ = amount;
     }
 
-    /** Get the number of modified entries
+    /**
+     * Get the number of modified entries
      */
     std::size_t
     size();
 
-    /** Visit modified entries
+    /**
+     * Visit modified entries
      */
     void
     visit(
diff --git a/include/xrpl/ledger/CachedView.h b/include/xrpl/ledger/CachedView.h
index 1da3a67563..b9e2cf8d66 100644
--- a/include/xrpl/ledger/CachedView.h
+++ b/include/xrpl/ledger/CachedView.h
@@ -133,10 +133,11 @@ public:
 
 }  // namespace detail
 
-/** Wraps a DigestAwareReadView to provide caching.
-
-    @tparam Base A subclass of DigestAwareReadView
-*/
+/**
+ * Wraps a DigestAwareReadView to provide caching.
+ *
+ * @tparam Base A subclass of DigestAwareReadView
+ */
 template <class Base>
 class CachedView : public detail::CachedViewImpl
 {
@@ -158,10 +159,11 @@ public:
     {
     }
 
-    /** Returns the base type.
-
-        @note This breaks encapsulation and bypasses the cache.
-    */
+    /**
+     * Returns the base type.
+     *
+     * @note This breaks encapsulation and bypasses the cache.
+     */
     std::shared_ptr<Base const> const&
     base() const
     {
diff --git a/include/xrpl/ledger/CanonicalTXSet.h b/include/xrpl/ledger/CanonicalTXSet.h
index f8349dfab6..11aadf4e92 100644
--- a/include/xrpl/ledger/CanonicalTXSet.h
+++ b/include/xrpl/ledger/CanonicalTXSet.h
@@ -13,13 +13,13 @@
 
 namespace xrpl {
 
-/** Holds transactions which were deferred to the next pass of consensus.
-
-    "Canonical" refers to the order in which transactions are applied.
-
-    - Puts transactions from the same account in SeqProxy order
-
-*/
+/**
+ * Holds transactions which were deferred to the next pass of consensus.
+ *
+ * "Canonical" refers to the order in which transactions are applied.
+ *
+ * - Puts transactions from the same account in SeqProxy order
+ */
 // VFALCO TODO rename to SortedTxSet
 class CanonicalTXSet : public CountedObject<CanonicalTXSet>
 {
diff --git a/include/xrpl/ledger/Dir.h b/include/xrpl/ledger/Dir.h
index 05df887d8b..233719cdeb 100644
--- a/include/xrpl/ledger/Dir.h
+++ b/include/xrpl/ledger/Dir.h
@@ -13,18 +13,19 @@
 
 namespace xrpl {
 
-/** A class that simplifies iterating ledger directory pages
-
-    The Dir class provides a forward iterator for walking through
-    the uint256 values contained in ledger directories.
-
-    The Dir class also allows accelerated directory walking by
-    stepping directly from one page to the next using the next_page()
-    member function.
-
-    As of July 2024, the Dir class is only being used with NFTokenOffer
-    directories and for unit tests.
-*/
+/**
+ * A class that simplifies iterating ledger directory pages
+ *
+ * The Dir class provides a forward iterator for walking through
+ * the uint256 values contained in ledger directories.
+ *
+ * The Dir class also allows accelerated directory walking by
+ * stepping directly from one page to the next using the next_page()
+ * member function.
+ *
+ * As of July 2024, the Dir class is only being used with NFTokenOffer
+ * directories and for unit tests.
+ */
 class Dir
 {
 private:
diff --git a/include/xrpl/ledger/Ledger.h b/include/xrpl/ledger/Ledger.h
index 3453389a5e..e1dd2c422e 100644
--- a/include/xrpl/ledger/Ledger.h
+++ b/include/xrpl/ledger/Ledger.h
@@ -42,32 +42,33 @@ struct CreateGenesisT
 };
 extern CreateGenesisT const kCreateGenesis;
 
-/** Holds a ledger.
-
-    The ledger is composed of two SHAMaps. The state map holds all of the
-    ledger entries such as account roots and order books. The tx map holds
-    all of the transactions and associated metadata that made it into that
-    particular ledger. Most of the operations on a ledger are concerned
-    with the state map.
-
-    This can hold just the header, a partial set of data, or the entire set
-    of data. It all depends on what is in the corresponding SHAMap entry.
-    Various functions are provided to populate or depopulate the caches that
-    the object holds references to.
-
-    Ledgers are constructed as either mutable or immutable.
-
-    1) If you are the sole owner of a mutable ledger, you can do whatever you
-    want with no need for locks.
-
-    2) If you have an immutable ledger, you cannot ever change it, so no need
-    for locks.
-
-    3) Mutable ledgers cannot be shared.
-
-    @note Presented to clients as ReadView
-    @note Calls virtuals in the constructor, so marked as final
-*/
+/**
+ * Holds a ledger.
+ *
+ * The ledger is composed of two SHAMaps. The state map holds all of the
+ * ledger entries such as account roots and order books. The tx map holds
+ * all of the transactions and associated metadata that made it into that
+ * particular ledger. Most of the operations on a ledger are concerned
+ * with the state map.
+ *
+ * This can hold just the header, a partial set of data, or the entire set
+ * of data. It all depends on what is in the corresponding SHAMap entry.
+ * Various functions are provided to populate or depopulate the caches that
+ * the object holds references to.
+ *
+ * Ledgers are constructed as either mutable or immutable.
+ *
+ * 1) If you are the sole owner of a mutable ledger, you can do whatever you
+ * want with no need for locks.
+ *
+ * 2) If you have an immutable ledger, you cannot ever change it, so no need
+ * for locks.
+ *
+ * 3) Mutable ledgers cannot be shared.
+ *
+ * @note Presented to clients as ReadView
+ * @note Calls virtuals in the constructor, so marked as final
+ */
 class Ledger final : public std::enable_shared_from_this<Ledger>,
                      public DigestAwareReadView,
                      public TxsRawView,
@@ -82,20 +83,21 @@ public:
     Ledger&
     operator=(Ledger&&) = delete;
 
-    /** Create the Genesis ledger.
-
-        The Genesis ledger contains a single account whose
-        AccountID is generated with a Generator using the seed
-        computed from the string "masterpassphrase" and ordinal
-        zero.
-
-        The account has an XRP balance equal to the total amount
-        of XRP in the system. No more XRP than the amount which
-        starts in this account can ever exist, with amounts
-        used to pay fees being destroyed.
-
-        Amendments specified are enabled in the genesis ledger
-    */
+    /**
+     * Create the Genesis ledger.
+     *
+     * The Genesis ledger contains a single account whose
+     * AccountID is generated with a Generator using the seed
+     * computed from the string "masterpassphrase" and ordinal
+     * zero.
+     *
+     * The account has an XRP balance equal to the total amount
+     * of XRP in the system. No more XRP than the amount which
+     * starts in this account can ever exist, with amounts
+     * used to pay fees being destroyed.
+     *
+     * Amendments specified are enabled in the genesis ledger
+     */
     Ledger(
         CreateGenesisT,
         Rules rules,
@@ -105,13 +107,14 @@ public:
 
     Ledger(LedgerHeader const& info, Rules rules, Family& family);
 
-    /** Used for ledgers loaded from JSON files
-
-        @param acquire If true, acquires the ledger if not found locally
-
-        @note The fees parameter provides default values, but setup() may
-              override them from the ledger state if fee-related SLEs exist.
-    */
+    /**
+     * Used for ledgers loaded from JSON files
+     *
+     * @param acquire If true, acquires the ledger if not found locally
+     *
+     * @note The fees parameter provides default values, but setup() may
+     *       override them from the ledger state if fee-related SLEs exist.
+     */
     Ledger(
         LedgerHeader const& info,
         bool& loaded,
@@ -121,12 +124,13 @@ public:
         Family& family,
         beast::Journal j);
 
-    /** Create a new ledger following a previous ledger
-
-        The ledger will have the sequence number that
-        follows previous, and have
-        parentCloseTime == previous.closeTime.
-    */
+    /**
+     * Create a new ledger following a previous ledger
+     *
+     * The ledger will have the sequence number that
+     * follows previous, and have
+     * parentCloseTime == previous.closeTime.
+     */
     Ledger(Ledger const& previous, NetClock::time_point closeTime);
 
     // used for database ledgers
@@ -369,11 +373,15 @@ public:
     void
     updateNegativeUNL();
 
-    /** Returns true if the ledger is a flag ledger */
+    /**
+     * Returns true if the ledger is a flag ledger
+     */
     bool
     isFlagLedger() const;
 
-    /** Returns true if the ledger directly precedes a flag ledger */
+    /**
+     * Returns true if the ledger directly precedes a flag ledger
+     */
     bool
     isVotingLedger() const;
 
@@ -387,23 +395,25 @@ private:
     bool
     setup();
 
-    /** @brief Deserialize a SHAMapItem containing a single STTx.
+    /**
+     * @brief Deserialize a SHAMapItem containing a single STTx.
      *
      * @param item The SHAMapItem to deserialize.
      * @return A shared pointer to the deserialized transaction.
-     * @throw May throw on deserialization error.
+     * @throws May throw on deserialization error.
      */
     static std::shared_ptr<STTx const>
     deserializeTx(SHAMapItem const& item);
 
-    /** @brief Deserialize a SHAMapItem containing STTx + STObject metadata.
+    /**
+     * @brief Deserialize a SHAMapItem containing STTx + STObject metadata.
      *
      * The SHAMapItem must contain two variable length serialization objects.
      *
      * @param item The SHAMapItem to deserialize.
      * @return A pair containing shared pointers to the deserialized transaction
      *         and metadata.
-     * @throw May throw on deserialization error.
+     * @throws May throw on deserialization error.
      */
     static std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>>
     deserializeTxPlusMeta(SHAMapItem const& item);
@@ -425,7 +435,9 @@ private:
     beast::Journal j_;
 };
 
-/** A ledger wrapped in a CachedView. */
+/**
+ * A ledger wrapped in a CachedView.
+ */
 using CachedLedger = CachedView<Ledger>;
 
 }  // namespace xrpl
diff --git a/include/xrpl/ledger/LedgerTiming.h b/include/xrpl/ledger/LedgerTiming.h
index a97e229046..77254a434b 100644
--- a/include/xrpl/ledger/LedgerTiming.h
+++ b/include/xrpl/ledger/LedgerTiming.h
@@ -8,11 +8,12 @@
 
 namespace xrpl {
 
-/**  Possible ledger close time resolutions.
-
-    Values should not be duplicated.
-    @see getNextLedgerTimeResolution
-*/
+/**
+ * Possible ledger close time resolutions.
+ *
+ * Values should not be duplicated.
+ * @see getNextLedgerTimeResolution
+ */
 constexpr std::chrono::seconds kLedgerPossibleTimeResolutions[] = {
     std::chrono::seconds{10},
     std::chrono::seconds{20},
@@ -21,41 +22,50 @@ constexpr std::chrono::seconds kLedgerPossibleTimeResolutions[] = {
     std::chrono::seconds{90},
     std::chrono::seconds{120}};
 
-//! Initial resolution of ledger close time.
+/**
+ * Initial resolution of ledger close time.
+ */
 constexpr auto kLedgerDefaultTimeResolution = kLedgerPossibleTimeResolutions[2];
 
-//! Close time resolution in genesis ledger
+/**
+ * Close time resolution in genesis ledger
+ */
 constexpr auto kLedgerGenesisTimeResolution = kLedgerPossibleTimeResolutions[0];
 
-//! How often we increase the close time resolution (in numbers of ledgers)
+/**
+ * How often we increase the close time resolution (in numbers of ledgers)
+ */
 constexpr auto kIncreaseLedgerTimeResolutionEvery = 8;
 
-//! How often we decrease the close time resolution (in numbers of ledgers)
+/**
+ * How often we decrease the close time resolution (in numbers of ledgers)
+ */
 constexpr auto kDecreaseLedgerTimeResolutionEvery = 1;
 
-/** Calculates the close time resolution for the specified ledger.
-
-    The XRPL protocol uses binning to represent time intervals using only one
-    timestamp. This allows servers to derive a common time for the next ledger,
-    without the need for perfectly synchronized clocks.
-    The time resolution (i.e. the size of the intervals) is adjusted dynamically
-    based on what happened in the last ledger, to try to avoid disagreements.
-
-    @param previousResolution the resolution used for the prior ledger
-    @param previousAgree whether consensus agreed on the close time of the prior
-    ledger
-    @param ledgerSeq the sequence number of the new ledger
-
-    @pre previousResolution must be a valid bin
-         from @ref kLedgerPossibleTimeResolutions
-
-    @tparam Rep Type representing number of ticks in std::chrono::duration
-    @tparam Period An std::ratio representing tick period in
-                   std::chrono::duration
-    @tparam Seq Unsigned integer-like type corresponding to the ledger sequence
-                number. It should be comparable to 0 and support modular
-                division. Built-in and tagged_integers are supported.
-*/
+/**
+ * Calculates the close time resolution for the specified ledger.
+ *
+ * The XRPL protocol uses binning to represent time intervals using only one
+ * timestamp. This allows servers to derive a common time for the next ledger,
+ * without the need for perfectly synchronized clocks.
+ * The time resolution (i.e. the size of the intervals) is adjusted dynamically
+ * based on what happened in the last ledger, to try to avoid disagreements.
+ *
+ * @tparam Rep Type representing number of ticks in std::chrono::duration
+ * @tparam Period An std::ratio representing tick period in
+ *                std::chrono::duration
+ * @tparam Seq Unsigned integer-like type corresponding to the ledger sequence
+ *             number. It should be comparable to 0 and support modular
+ *             division. Built-in and tagged_integers are supported.
+ *
+ * @param previousResolution the resolution used for the prior ledger
+ * @param previousAgree whether consensus agreed on the close time of the prior
+ * ledger
+ * @param ledgerSeq the sequence number of the new ledger
+ *
+ * @pre previousResolution must be a valid bin
+ *      from @ref kLedgerPossibleTimeResolutions
+ */
 template <class Rep, class Period, class Seq>
 std::chrono::duration<Rep, Period>
 getNextLedgerTimeResolution(
@@ -98,13 +108,14 @@ getNextLedgerTimeResolution(
     return previousResolution;
 }
 
-/** Calculates the close time for a ledger, given a close time resolution.
-
-    @param closeTime The time to be rounded
-    @param closeResolution The resolution
-    @return @b closeTime rounded to the nearest multiple of @b closeResolution.
-    Rounds up if @b closeTime is midway between multiples of @b closeResolution.
-*/
+/**
+ * Calculates the close time for a ledger, given a close time resolution.
+ *
+ * @param closeTime The time to be rounded
+ * @param closeResolution The resolution
+ * @return @b closeTime rounded to the nearest multiple of @b closeResolution.
+ * Rounds up if @b closeTime is midway between multiples of @b closeResolution.
+ */
 template <class Clock, class Duration, class Rep, class Period>
 std::chrono::time_point<Clock, Duration>
 roundCloseTime(
@@ -119,15 +130,16 @@ roundCloseTime(
     return closeTime - (closeTime.time_since_epoch() % closeResolution);
 }
 
-/** Calculate the effective ledger close time
-
-    After adjusting the ledger close time based on the current resolution, also
-    ensure it is sufficiently separated from the prior close time.
-
-    @param closeTime The raw ledger close time
-    @param resolution The current close time resolution
-    @param priorCloseTime The close time of the prior ledger
-*/
+/**
+ * Calculate the effective ledger close time
+ *
+ * After adjusting the ledger close time based on the current resolution, also
+ * ensure it is sufficiently separated from the prior close time.
+ *
+ * @param closeTime The raw ledger close time
+ * @param resolution The current close time resolution
+ * @param priorCloseTime The close time of the prior ledger
+ */
 template <class Clock, class Duration, class Rep, class Period>
 std::chrono::time_point<Clock, Duration>
 effCloseTime(
diff --git a/include/xrpl/ledger/OpenView.h b/include/xrpl/ledger/OpenView.h
index 875909715c..3f8e950b02 100644
--- a/include/xrpl/ledger/OpenView.h
+++ b/include/xrpl/ledger/OpenView.h
@@ -25,21 +25,23 @@
 
 namespace xrpl {
 
-/** Open ledger construction tag.
-
-    Views constructed with this tag will have the
-    rules of open ledgers applied during transaction
-    processing.
+/**
+ * Open ledger construction tag.
+ *
+ * Views constructed with this tag will have the
+ * rules of open ledgers applied during transaction
+ * processing.
  */
 inline constexpr struct OpenLedgerT
 {
     explicit constexpr OpenLedgerT() = default;
 } kOpenLedger{};
 
-/** Batch view construction tag.
-
-    Views constructed with this tag are part of a stack of views
-    used during batch transaction application.
+/**
+ * Batch view construction tag.
+ *
+ * Views constructed with this tag are part of a stack of views
+ * used during batch transaction application.
  */
 inline constexpr struct BatchViewT
 {
@@ -48,10 +50,11 @@ inline constexpr struct BatchViewT
 
 //------------------------------------------------------------------------------
 
-/** Writable ledger view that accumulates state and tx changes.
-
-    @note Presented as ReadView to clients.
-*/
+/**
+ * Writable ledger view that accumulates state and tx changes.
+ *
+ * @note Presented as ReadView to clients.
+ */
 class OpenView final : public ReadView, public TxsRawView
 {
 private:
@@ -95,7 +98,9 @@ private:
     detail::RawStateTable items_;
     std::shared_ptr<void const> hold_;
 
-    /// In batch mode, the number of transactions already executed.
+    /**
+     * In batch mode, the number of transactions already executed.
+     */
     std::size_t baseTxCount_ = 0;
 
     bool open_ = true;
@@ -109,40 +114,42 @@ public:
 
     OpenView(OpenView&&) = default;
 
-    /** Construct a shallow copy.
-
-        Effects:
-
-            Creates a new object with a copy of
-            the modification state table.
-
-        The objects managed by shared pointers are
-        not duplicated but shared between instances.
-        Since the SLEs are immutable, calls on the
-        RawView interface cannot break invariants.
-    */
+    /**
+     * Construct a shallow copy.
+     *
+     * Effects:
+     *
+     *     Creates a new object with a copy of
+     *     the modification state table.
+     *
+     * The objects managed by shared pointers are
+     * not duplicated but shared between instances.
+     * Since the SLEs are immutable, calls on the
+     * RawView interface cannot break invariants.
+     */
     OpenView(OpenView const&);
 
-    /** Construct an open ledger view.
-
-        Effects:
-
-            The sequence number is set to the
-            sequence number of parent plus one.
-
-            The parentCloseTime is set to the
-            closeTime of parent.
-
-            If `hold` is not nullptr, retains
-            ownership of a copy of `hold` until
-            the MetaView is destroyed.
-
-            Calls to rules() will return the
-            rules provided on construction.
-
-        The tx list starts empty and will contain
-        all newly inserted tx.
-    */
+    /**
+     * Construct an open ledger view.
+     *
+     * Effects:
+     *
+     *     The sequence number is set to the
+     *     sequence number of parent plus one.
+     *
+     *     The parentCloseTime is set to the
+     *     closeTime of parent.
+     *
+     *     If `hold` is not nullptr, retains
+     *     ownership of a copy of `hold` until
+     *     the MetaView is destroyed.
+     *
+     *     Calls to rules() will return the
+     *     rules provided on construction.
+     *
+     * The tx list starts empty and will contain
+     * all newly inserted tx.
+     */
     OpenView(
         OpenLedgerT,
         ReadView const* base,
@@ -159,35 +166,41 @@ public:
         baseTxCount_ = base.txCount();
     }
 
-    /** Construct a new last closed ledger.
-
-        Effects:
-
-            The LedgerHeader is copied from the base.
-
-            The rules are inherited from the base.
-
-        The tx list starts empty and will contain
-        all newly inserted tx.
-    */
+    /**
+     * Construct a new last closed ledger.
+     *
+     * Effects:
+     *
+     *     The LedgerHeader is copied from the base.
+     *
+     *     The rules are inherited from the base.
+     *
+     * The tx list starts empty and will contain
+     * all newly inserted tx.
+     */
     OpenView(ReadView const* base, std::shared_ptr<void const> hold = nullptr);
 
-    /** Returns true if this reflects an open ledger. */
+    /**
+     * Returns true if this reflects an open ledger.
+     */
     bool
     open() const override
     {
         return open_;
     }
 
-    /** Return the number of tx inserted since creation.
-
-        This is used to set the "apply ordinal"
-        when calculating transaction metadata.
-    */
+    /**
+     * Return the number of tx inserted since creation.
+     *
+     * This is used to set the "apply ordinal"
+     * when calculating transaction metadata.
+     */
     std::size_t
     txCount() const;
 
-    /** Apply changes. */
+    /**
+     * Apply changes.
+     */
     void
     apply(TxsRawView& to) const;
 
diff --git a/include/xrpl/ledger/OrderBookDB.h b/include/xrpl/ledger/OrderBookDB.h
index a44183900c..96dc94b1f4 100644
--- a/include/xrpl/ledger/OrderBookDB.h
+++ b/include/xrpl/ledger/OrderBookDB.h
@@ -14,85 +14,92 @@
 
 namespace xrpl {
 
-/** Tracks order books in the ledger.
-
-    This interface provides access to order book information, including:
-    - Which order books exist in the ledger
-    - Querying order books by issue
-    - Managing order book subscriptions
-
-    The order book database is updated as ledgers are accepted and provides
-    efficient lookup of order book information for pathfinding and client
-    subscriptions.
-*/
+/**
+ * Tracks order books in the ledger.
+ *
+ * This interface provides access to order book information, including:
+ * - Which order books exist in the ledger
+ * - Querying order books by issue
+ * - Managing order book subscriptions
+ *
+ * The order book database is updated as ledgers are accepted and provides
+ * efficient lookup of order book information for pathfinding and client
+ * subscriptions.
+ */
 class OrderBookDB
 {
 public:
     virtual ~OrderBookDB() = default;
 
-    /** Initialize or update the order book database with a new ledger.
-
-        This method should be called when a new ledger is accepted to update
-        the order book database with the current state of all order books.
-
-        @param ledger The ledger to scan for order books
-    */
+    /**
+     * Initialize or update the order book database with a new ledger.
+     *
+     * This method should be called when a new ledger is accepted to update
+     * the order book database with the current state of all order books.
+     *
+     * @param ledger The ledger to scan for order books
+     */
     virtual void
     setup(std::shared_ptr<ReadView const> const& ledger) = 0;
 
-    /** Add an order book to track.
-
-        @param book The order book to add
-    */
+    /**
+     * Add an order book to track.
+     *
+     * @param book The order book to add
+     */
     virtual void
     addOrderBook(Book const& book) = 0;
 
-    /** Get all order books that want a specific issue.
-
-        Returns a list of all order books where the taker pays the specified
-        issue. This is useful for pathfinding to find all possible next hops
-        from a given currency.
-
-        @param asset The asset to search for
-        @param domain Optional domain restriction for the order book
-        @return Vector of books that want this issue
-    */
+    /**
+     * Get all order books that want a specific issue.
+     *
+     * Returns a list of all order books where the taker pays the specified
+     * issue. This is useful for pathfinding to find all possible next hops
+     * from a given currency.
+     *
+     * @param asset The asset to search for
+     * @param domain Optional domain restriction for the order book
+     * @return Vector of books that want this issue
+     */
     virtual std::vector<Book>
     getBooksByTakerPays(Asset const& asset, std::optional<Domain> const& domain = std::nullopt) = 0;
 
-    /** Get the count of order books that want a specific issue.
-
-        @param asset The asset to search for
-        @param domain Optional domain restriction for the order book
-        @return Number of books that want this issue
-    */
+    /**
+     * Get the count of order books that want a specific issue.
+     *
+     * @param asset The asset to search for
+     * @param domain Optional domain restriction for the order book
+     * @return Number of books that want this issue
+     */
     virtual int
     getBookSize(Asset const& asset, std::optional<Domain> const& domain = std::nullopt) = 0;
 
-    /** Check if an order book to XRP exists for the given issue.
-
-        @param asset The asset to check
-        @param domain Optional domain restriction for the order book
-        @return true if a book from this issue to XRP exists
-    */
+    /**
+     * Check if an order book to XRP exists for the given issue.
+     *
+     * @param asset The asset to check
+     * @param domain Optional domain restriction for the order book
+     * @return true if a book from this issue to XRP exists
+     */
     virtual bool
     isBookToXRP(Asset const& asset, std::optional<Domain> const& domain = std::nullopt) = 0;
 };
 
-/** Extract the set of books affected by a transaction.
+/**
+ * Extract the set of books affected by a transaction.
  *
- *  Walks the transaction's metadata nodes and collects every order book
- *  whose offers were created, modified, or deleted. Used by NetworkOPs to
- *  fan transaction notifications out to book subscribers.
+ * Walks the transaction's metadata nodes and collects every order book
+ * whose offers were created, modified, or deleted. Used by NetworkOPs to
+ * fan transaction notifications out to book subscribers.
  *
- *  @param alTx The accepted ledger transaction to inspect.
- *  @param j Journal used to log per-node parsing failures. Inspecting an
- *           offer node can throw if a required field is missing; in that
- *           case the bad node is skipped and a warn-level message is
- *           emitted via @p j. Other affected books in the same transaction
- *           are still returned.
- *  @return The set of books whose offers were created, modified, or
- *          deleted. May be empty for non-offer transactions.
+ * @param alTx The accepted ledger transaction to inspect.
+ * @param j Journal used to log per-node parsing failures. Inspecting an
+ *          offer node can throw if a required field is missing; in that
+ *          case the bad node is skipped and a warn-level message is
+ *          emitted via @p j. Other affected books in the same transaction
+ *          are still returned.
+ * @return The set of books whose offers were created, modified, or
+ *         deleted. May be empty for non-offer transactions.
  */
 hash_set<Book>
 affectedBooks(AcceptedLedgerTx const& alTx, beast::Journal const& j);
diff --git a/include/xrpl/ledger/PaymentSandbox.h b/include/xrpl/ledger/PaymentSandbox.h
index 8afe21b397..e725bdd556 100644
--- a/include/xrpl/ledger/PaymentSandbox.h
+++ b/include/xrpl/ledger/PaymentSandbox.h
@@ -132,18 +132,19 @@ private:
 
 //------------------------------------------------------------------------------
 
-/** A wrapper which makes credits unavailable to balances.
-
-    This is used for payments and pathfinding, so that consuming
-    liquidity from a path never causes portions of that path or
-    other paths to gain liquidity.
-
-    The behavior of certain free functions in the ApplyView API
-    will change via the balanceHook and creditHook overrides
-    of PaymentSandbox.
-
-    @note Presented as ApplyView to clients
-*/
+/**
+ * A wrapper which makes credits unavailable to balances.
+ *
+ * This is used for payments and pathfinding, so that consuming
+ * liquidity from a path never causes portions of that path or
+ * other paths to gain liquidity.
+ *
+ * The behavior of certain free functions in the ApplyView API
+ * will change via the balanceHook and creditHook overrides
+ * of PaymentSandbox.
+ *
+ * @note Presented as ApplyView to clients
+ */
 class PaymentSandbox final : public detail::ApplyViewBase
 {
 public:
@@ -164,16 +165,17 @@ public:
     {
     }
 
-    /** Construct on top of existing PaymentSandbox.
-
-        The changes are pushed to the parent when
-        apply() is called.
-
-        @param parent A non-null pointer to the parent.
-
-        @note A pointer is used to prevent confusion
-              with copy construction.
-    */
+    /**
+     * Construct on top of existing PaymentSandbox.
+     *
+     * The changes are pushed to the parent when
+     * apply() is called.
+     *
+     * @param parent A non-null pointer to the parent.
+     *
+     * @note A pointer is used to prevent confusion
+     *       with copy construction.
+     */
     // VFALCO If we are constructing on top of a PaymentSandbox,
     //        or a PaymentSandbox-derived class, we MUST go through
     //        one of these constructors or invariants will be broken.
@@ -225,12 +227,13 @@ public:
     [[nodiscard]] OwnerCounts
     ownerCountHook(AccountID const& account, OwnerCounts const& count) const override;
 
-    /** Apply changes to base view.
-
-        `to` must contain contents identical to the parent
-        view passed upon construction, else undefined
-        behavior will result.
-    */
+    /**
+     * Apply changes to base view.
+     *
+     * `to` must contain contents identical to the parent
+     * view passed upon construction, else undefined
+     * behavior will result.
+     */
     /** @{ */
     void
     apply(RawView& to);
diff --git a/include/xrpl/ledger/PendingSaves.h b/include/xrpl/ledger/PendingSaves.h
index a18292df68..723ae1aef1 100644
--- a/include/xrpl/ledger/PendingSaves.h
+++ b/include/xrpl/ledger/PendingSaves.h
@@ -8,12 +8,13 @@
 
 namespace xrpl {
 
-/** Keeps track of which ledgers haven't been fully saved.
-
-    During the ledger building process this collection will keep
-    track of those ledgers that are being built but have not yet
-    been completely written.
-*/
+/**
+ * Keeps track of which ledgers haven't been fully saved.
+ *
+ * During the ledger building process this collection will keep
+ * track of those ledgers that are being built but have not yet
+ * been completely written.
+ */
 class PendingSaves
 {
 private:
@@ -22,12 +23,13 @@ private:
     std::condition_variable await_;
 
 public:
-    /** Start working on a ledger
-
-        This is called prior to updating the SQLite indexes.
-
-        @return 'true' if work should be done
-    */
+    /**
+     * Start working on a ledger
+     *
+     * This is called prior to updating the SQLite indexes.
+     *
+     * @return 'true' if work should be done
+     */
     bool
     startWork(LedgerIndex seq)
     {
@@ -45,12 +47,13 @@ public:
         return true;
     }
 
-    /** Finish working on a ledger
-
-        This is called after updating the SQLite indexes.
-        The tracking of the work in progress is removed and
-        threads awaiting completion are notified.
-    */
+    /**
+     * Finish working on a ledger
+     *
+     * This is called after updating the SQLite indexes.
+     * The tracking of the work in progress is removed and
+     * threads awaiting completion are notified.
+     */
     void
     finishWork(LedgerIndex seq)
     {
@@ -60,7 +63,9 @@ public:
         await_.notify_all();
     }
 
-    /** Return `true` if a ledger is in the progress of being saved. */
+    /**
+     * Return `true` if a ledger is in the progress of being saved.
+     */
     bool
     pending(LedgerIndex seq)
     {
@@ -68,14 +73,15 @@ public:
         return map_.contains(seq);
     }
 
-    /** Check if a ledger should be dispatched
-
-        Called to determine whether work should be done or
-        dispatched. If work is already in progress and the
-        call is synchronous, wait for work to be completed.
-
-        @return 'true' if work should be done or dispatched
-    */
+    /**
+     * Check if a ledger should be dispatched
+     *
+     * Called to determine whether work should be done or
+     * dispatched. If work is already in progress and the
+     * call is synchronous, wait for work to be completed.
+     *
+     * @return 'true' if work should be done or dispatched
+     */
     bool
     shouldWork(LedgerIndex seq, bool isSynchronous)
     {
@@ -108,12 +114,13 @@ public:
         } while (true);
     }
 
-    /** Get a snapshot of the pending saves
-
-        Each entry in the returned map corresponds to a ledger
-        that is in progress or dispatched. The boolean indicates
-        whether work is currently in progress.
-    */
+    /**
+     * Get a snapshot of the pending saves
+     *
+     * Each entry in the returned map corresponds to a ledger
+     * that is in progress or dispatched. The boolean indicates
+     * whether work is currently in progress.
+     */
     std::map<LedgerIndex, bool>
     getSnapshot() const
     {
diff --git a/include/xrpl/ledger/RawView.h b/include/xrpl/ledger/RawView.h
index ac2674226f..b94a7aab27 100644
--- a/include/xrpl/ledger/RawView.h
+++ b/include/xrpl/ledger/RawView.h
@@ -9,10 +9,11 @@
 
 namespace xrpl {
 
-/** Interface for ledger entry changes.
-
-    Subclasses allow raw modification of ledger entries.
-*/
+/**
+ * Interface for ledger entry changes.
+ *
+ * Subclasses allow raw modification of ledger entries.
+ */
 class RawView
 {
 public:
@@ -22,66 +23,72 @@ public:
     RawView&
     operator=(RawView const&) = delete;
 
-    /** Delete an existing state item.
-
-        The SLE is provided so the implementation
-        can calculate metadata.
-    */
+    /**
+     * Delete an existing state item.
+     *
+     * The SLE is provided so the implementation
+     * can calculate metadata.
+     */
     virtual void
     rawErase(SLE::ref sle) = 0;
 
-    /** Unconditionally insert a state item.
-
-        Requirements:
-            The key must not already exist.
-
-        Effects:
-
-            The key is associated with the SLE.
-
-        @note The key is taken from the SLE
-    */
+    /**
+     * Unconditionally insert a state item.
+     *
+     * Requirements:
+     *     The key must not already exist.
+     *
+     * Effects:
+     *
+     *     The key is associated with the SLE.
+     *
+     * @note The key is taken from the SLE
+     */
     virtual void
     rawInsert(SLE::ref sle) = 0;
 
-    /** Unconditionally replace a state item.
-
-        Requirements:
-
-            The key must exist.
-
-        Effects:
-
-            The key is associated with the SLE.
-
-        @note The key is taken from the SLE
-    */
+    /**
+     * Unconditionally replace a state item.
+     *
+     * Requirements:
+     *
+     *     The key must exist.
+     *
+     * Effects:
+     *
+     *     The key is associated with the SLE.
+     *
+     * @note The key is taken from the SLE
+     */
     virtual void
     rawReplace(SLE::ref sle) = 0;
 
-    /** Destroy XRP.
-
-        This is used to pay for transaction fees.
-    */
+    /**
+     * Destroy XRP.
+     *
+     * This is used to pay for transaction fees.
+     */
     virtual void
     rawDestroyXRP(XRPAmount const& fee) = 0;
 };
 
 //------------------------------------------------------------------------------
 
-/** Interface for changing ledger entries with transactions.
-
-    Allows raw modification of ledger entries and insertion
-    of transactions into the transaction map.
-*/
+/**
+ * Interface for changing ledger entries with transactions.
+ *
+ * Allows raw modification of ledger entries and insertion
+ * of transactions into the transaction map.
+ */
 class TxsRawView : public RawView
 {
 public:
-    /** Add a transaction to the tx map.
-
-        Closed ledgers must have metadata,
-        while open ledgers omit metadata.
-    */
+    /**
+     * Add a transaction to the tx map.
+     *
+     * Closed ledgers must have metadata,
+     * while open ledgers omit metadata.
+     */
     virtual void
     rawTxInsert(
         ReadView::key_type const& key,
diff --git a/include/xrpl/ledger/ReadView.h b/include/xrpl/ledger/ReadView.h
index da92e0b510..d0010b6030 100644
--- a/include/xrpl/ledger/ReadView.h
+++ b/include/xrpl/ledger/ReadView.h
@@ -30,12 +30,13 @@ namespace xrpl {
 
 //------------------------------------------------------------------------------
 
-/** A view into a ledger.
-
-    This interface provides read access to state
-    and transaction items. There is no checkpointing
-    or calculation of metadata.
-*/
+/**
+ * A view into a ledger.
+ *
+ * This interface provides read access to state
+ * and transaction items. There is no checkpointing
+ * or calculation of metadata.
+ */
 class ReadView
 {
 public:
@@ -86,72 +87,87 @@ public:
     {
     }
 
-    /** Returns information about the ledger. */
+    /**
+     * Returns information about the ledger.
+     */
     [[nodiscard]] virtual LedgerHeader const&
     header() const = 0;
 
-    /** Returns true if this reflects an open ledger. */
+    /**
+     * Returns true if this reflects an open ledger.
+     */
     [[nodiscard]] virtual bool
     open() const = 0;
 
-    /** Returns the close time of the previous ledger. */
+    /**
+     * Returns the close time of the previous ledger.
+     */
     [[nodiscard]] NetClock::time_point
     parentCloseTime() const
     {
         return header().parentCloseTime;
     }
 
-    /** Returns the sequence number of the base ledger. */
+    /**
+     * Returns the sequence number of the base ledger.
+     */
     [[nodiscard]] LedgerIndex
     seq() const
     {
         return header().seq;
     }
 
-    /** Returns the fees for the base ledger. */
+    /**
+     * Returns the fees for the base ledger.
+     */
     [[nodiscard]] virtual Fees const&
     fees() const = 0;
 
-    /** Returns the tx processing rules. */
+    /**
+     * Returns the tx processing rules.
+     */
     [[nodiscard]] virtual Rules const&
     rules() const = 0;
 
-    /** Determine if a state item exists.
-
-        @note This can be more efficient than calling read.
-
-        @return `true` if a SLE is associated with the
-                specified key.
-    */
+    /**
+     * Determine if a state item exists.
+     *
+     * @note This can be more efficient than calling read.
+     *
+     * @return `true` if a SLE is associated with the
+     *         specified key.
+     */
     [[nodiscard]] virtual bool
     exists(Keylet const& k) const = 0;
 
-    /** Return the key of the next state item.
-
-        This returns the key of the first state item
-        whose key is greater than the specified key. If
-        no such key is present, std::nullopt is returned.
-
-        If `last` is engaged, returns std::nullopt when
-        the key returned would be outside the open
-        interval (key, last).
-    */
+    /**
+     * Return the key of the next state item.
+     *
+     * This returns the key of the first state item
+     * whose key is greater than the specified key. If
+     * no such key is present, std::nullopt is returned.
+     *
+     * If `last` is engaged, returns std::nullopt when
+     * the key returned would be outside the open
+     * interval (key, last).
+     */
     [[nodiscard]] virtual std::optional<key_type>
     succ(key_type const& key, std::optional<key_type> const& last = std::nullopt) const = 0;
 
-    /** Return the state item associated with a key.
-
-        Effects:
-            If the key exists, gives the caller ownership
-            of the non-modifiable corresponding SLE.
-
-        @note While the returned SLE is `const` from the
-              perspective of the caller, it can be changed
-              by other callers through raw operations.
-
-        @return `nullptr` if the key is not present or
-                if the type does not match.
-    */
+    /**
+     * Return the state item associated with a key.
+     *
+     * Effects:
+     *     If the key exists, gives the caller ownership
+     *     of the non-modifiable corresponding SLE.
+     *
+     * @note While the returned SLE is `const` from the
+     *       perspective of the caller, it can be changed
+     *       by other callers through raw operations.
+     *
+     * @return `nullptr` if the key is not present or
+     *         if the type does not match.
+     */
     [[nodiscard]] virtual SLE::const_pointer
     read(Keylet const& k) const = 0;
 
@@ -217,22 +233,24 @@ public:
     [[nodiscard]] virtual std::unique_ptr<TxsType::iter_base>
     txsEnd() const = 0;
 
-    /** Returns `true` if a tx exists in the tx map.
-
-        A tx exists in the map if it is part of the
-        base ledger, or if it is a newly inserted tx.
-    */
+    /**
+     * Returns `true` if a tx exists in the tx map.
+     *
+     * A tx exists in the map if it is part of the
+     * base ledger, or if it is a newly inserted tx.
+     */
     [[nodiscard]] virtual bool
     txExists(key_type const& key) const = 0;
 
-    /** Read a transaction from the tx map.
-
-        If the view represents an open ledger,
-        the metadata object will be empty.
-
-        @return A pair of nullptr if the
-                key is not found in the tx map.
-    */
+    /**
+     * Read a transaction from the tx map.
+     *
+     * If the view represents an open ledger,
+     * the metadata object will be empty.
+     *
+     * @return A pair of nullptr if the
+     *         key is not found in the tx map.
+     */
     [[nodiscard]] virtual tx_type
     txRead(key_type const& key) const = 0;
 
@@ -240,11 +258,12 @@ public:
     // Memberspaces
     //
 
-    /** Iterable range of ledger state items.
-
-        @note Visiting each state entry in the ledger can
-              become quite expensive as the ledger grows.
-    */
+    /**
+     * Iterable range of ledger state items.
+     *
+     * @note Visiting each state entry in the ledger can
+     *       become quite expensive as the ledger grows.
+     */
     SlesType sles;
 
     // The range of transactions
@@ -253,7 +272,9 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** ReadView that associates keys with digests. */
+/**
+ * ReadView that associates keys with digests.
+ */
 class DigestAwareReadView : public ReadView
 {
 public:
@@ -262,10 +283,11 @@ public:
     DigestAwareReadView() = default;
     DigestAwareReadView(DigestAwareReadView const&) = default;
 
-    /** Return the digest associated with the key.
-
-        @return std::nullopt if the item does not exist.
-    */
+    /**
+     * Return the digest associated with the key.
+     *
+     * @return std::nullopt if the item does not exist.
+     */
     [[nodiscard]] virtual std::optional<digest_type>
     digest(key_type const& key) const = 0;
 };
diff --git a/include/xrpl/ledger/Sandbox.h b/include/xrpl/ledger/Sandbox.h
index ca8838631f..fd48e339eb 100644
--- a/include/xrpl/ledger/Sandbox.h
+++ b/include/xrpl/ledger/Sandbox.h
@@ -7,12 +7,13 @@
 
 namespace xrpl {
 
-/** Discardable, editable view to a ledger.
-
-    The sandbox inherits the flags of the base.
-
-    @note Presented as ApplyView to clients.
-*/
+/**
+ * Discardable, editable view to a ledger.
+ *
+ * The sandbox inherits the flags of the base.
+ *
+ * @note Presented as ApplyView to clients.
+ */
 class Sandbox : public detail::ApplyViewBase
 {
 public:
diff --git a/include/xrpl/ledger/View.h b/include/xrpl/ledger/View.h
index 7fad61d407..768e518008 100644
--- a/include/xrpl/ledger/View.h
+++ b/include/xrpl/ledger/View.h
@@ -35,26 +35,27 @@ enum class SkipEntry : bool { No = false, Yes };
 //
 //------------------------------------------------------------------------------
 
-/** Determines whether the given expiration time has passed.
-
-    In the XRP Ledger, expiration times are defined as the number of whole
-    seconds after the "XRPL epoch" which, for historical reasons, is set
-    to January 1, 2000 (00:00 UTC).
-
-    This is like the way the Unix epoch works, except the XRPL epoch is
-    precisely 946,684,800 seconds after the Unix Epoch.
-
-    See https://xrpl.org/basic-data-types.html#specifying-time
-
-    Expiration is defined in terms of the close time of the parent ledger,
-    because we definitively know the time that it closed (since consensus
-    agrees on time) but we do not know the closing time of the ledger that
-    is under construction.
-
-    @param view The ledger whose parent time is used as the clock.
-    @param exp The optional expiration time we want to check.
-
-    @returns `true` if `exp` is in the past; `false` otherwise.
+/**
+ * Determines whether the given expiration time has passed.
+ *
+ * In the XRP Ledger, expiration times are defined as the number of whole
+ * seconds after the "XRPL epoch" which, for historical reasons, is set
+ * to January 1, 2000 (00:00 UTC).
+ *
+ * This is like the way the Unix epoch works, except the XRPL epoch is
+ * precisely 946,684,800 seconds after the Unix Epoch.
+ *
+ * See https://xrpl.org/basic-data-types.html#specifying-time
+ *
+ * Expiration is defined in terms of the close time of the parent ledger,
+ * because we definitively know the time that it closed (since consensus
+ * agrees on time) but we do not know the closing time of the ledger that
+ * is under construction.
+ *
+ * @param view The ledger whose parent time is used as the clock.
+ * @param exp The optional expiration time we want to check.
+ *
+ * @return `true` if `exp` is in the past; `false` otherwise.
  */
 [[nodiscard]] bool
 hasExpired(ReadView const& view, std::optional<std::uint32_t> const& exp);
@@ -83,41 +84,44 @@ using majorityAmendments_t = std::map<uint256, NetClock::time_point>;
 [[nodiscard]] majorityAmendments_t
 getMajorityAmendments(ReadView const& view);
 
-/** Return the hash of a ledger by sequence.
-    The hash is retrieved by looking up the "skip list"
-    in the passed ledger. As the skip list is limited
-    in size, if the requested ledger sequence number is
-    out of the range of ledgers represented in the skip
-    list, then std::nullopt is returned.
-    @return The hash of the ledger with the
-            given sequence number or std::nullopt.
-*/
+/**
+ * Return the hash of a ledger by sequence.
+ * The hash is retrieved by looking up the "skip list"
+ * in the passed ledger. As the skip list is limited
+ * in size, if the requested ledger sequence number is
+ * out of the range of ledgers represented in the skip
+ * list, then std::nullopt is returned.
+ * @return The hash of the ledger with the
+ *         given sequence number or std::nullopt.
+ */
 [[nodiscard]] std::optional<uint256>
 hashOfSeq(ReadView const& ledger, LedgerIndex seq, beast::Journal journal);
 
-/** Find a ledger index from which we could easily get the requested ledger
-
-    The index that we return should meet two requirements:
-        1) It must be the index of a ledger that has the hash of the ledger
-            we are looking for. This means that its sequence must be equal to
-            greater than the sequence that we want but not more than 256 greater
-            since each ledger contains the hashes of the 256 previous ledgers.
-
-        2) Its hash must be easy for us to find. This means it must be 0 mod 256
-            because every such ledger is permanently enshrined in a LedgerHashes
-            page which we can easily retrieve via the skip list.
-*/
+/**
+ * Find a ledger index from which we could easily get the requested ledger
+ *
+ * The index that we return should meet two requirements:
+ *     1) It must be the index of a ledger that has the hash of the ledger
+ *         we are looking for. This means that its sequence must be equal to
+ *         greater than the sequence that we want but not more than 256 greater
+ *         since each ledger contains the hashes of the 256 previous ledgers.
+ *
+ *     2) Its hash must be easy for us to find. This means it must be 0 mod 256
+ *         because every such ledger is permanently enshrined in a LedgerHashes
+ *         page which we can easily retrieve via the skip list.
+ */
 inline LedgerIndex
 getCandidateLedger(LedgerIndex requested)
 {
     return (requested + 255) & (~255);
 }
 
-/** Return false if the test ledger is provably incompatible
-    with the valid ledger, that is, they could not possibly
-    both be valid. Use the first form if you have both ledgers,
-    use the second form if you have not acquired the valid ledger yet
-*/
+/**
+ * Return false if the test ledger is provably incompatible
+ * with the valid ledger, that is, they could not possibly
+ * both be valid. Use the first form if you have both ledgers,
+ * use the second form if you have not acquired the valid ledger yet
+ */
 [[nodiscard]] bool
 areCompatible(
     ReadView const& validLedger,
@@ -146,7 +150,8 @@ dirLink(
     SLE::pointer& object,
     SF_UINT64 const& node = sfOwnerNode);
 
-/** Checks that can withdraw funds from an object to itself or a destination.
+/**
+ * Checks that can withdraw funds from an object to itself or a destination.
  *
  * The receiver may be either the submitting account (sfAccount) or a different
  * destination account (sfDestination).
@@ -169,7 +174,8 @@ canWithdraw(
     STAmount const& amount,
     bool hasDestinationTag);
 
-/** Checks that can withdraw funds from an object to itself or a destination.
+/**
+ * Checks that can withdraw funds from an object to itself or a destination.
  *
  * The receiver may be either the submitting account (sfAccount) or a different
  * destination account (sfDestination).
@@ -191,7 +197,8 @@ canWithdraw(
     STAmount const& amount,
     bool hasDestinationTag);
 
-/** Checks that can withdraw funds from an object to itself or a destination.
+/**
+ * Checks that can withdraw funds from an object to itself or a destination.
  *
  * The receiver may be either the submitting account (sfAccount) or a different
  * destination account (sfDestination).
@@ -218,13 +225,15 @@ doWithdraw(
     STAmount const& amount,
     beast::Journal j);
 
-/** Deleter function prototype. Returns the status of the entry deletion
+/**
+ * Deleter function prototype. Returns the status of the entry deletion
  * (if should not be skipped) and if the entry should be skipped. The status
  * is always tesSUCCESS if the entry should be skipped.
  */
 using EntryDeleter =
     std::function<std::pair<TER, SkipEntry>(LedgerEntryType, uint256 const&, SLE::pointer&)>;
-/** Cleanup owner directory entries on account delete.
+/**
+ * Cleanup owner directory entries on account delete.
  * Used for a regular and AMM accounts deletion. The caller
  * has to provide the deleter function, which handles details of
  * specific account-owned object deletion.
@@ -239,12 +248,13 @@ cleanupOnAccountDelete(
     beast::Journal j,
     std::optional<std::uint16_t> maxNodesToDelete = std::nullopt);
 
-/** Has the specified time passed?
-
-    @param now  the current time
-    @param mark the cutoff point
-    @return true if \a now refers to a time strictly after \a mark, else false.
-*/
+/**
+ * Has the specified time passed?
+ *
+ * @param now  the current time
+ * @param mark the cutoff point
+ * @return true if \a now refers to a time strictly after \a mark, else false.
+ */
 bool
 after(NetClock::time_point now, std::uint32_t mark);
 
diff --git a/include/xrpl/ledger/helpers/AMMHelpers.h b/include/xrpl/ledger/helpers/AMMHelpers.h
index c6a2053010..7d41bfce81 100644
--- a/include/xrpl/ledger/helpers/AMMHelpers.h
+++ b/include/xrpl/ledger/helpers/AMMHelpers.h
@@ -53,7 +53,8 @@ enum class IsDeposit : bool { No = false, Yes = true };
 
 inline Number const kAMMInvariantRelativeTolerance{1, -11};
 
-/** Calculate LP Tokens given AMM pool reserves.
+/**
+ * Calculate LP Tokens given AMM pool reserves.
  * @param asset1 AMM one side of the pool reserve
  * @param asset2 AMM another side of the pool reserve
  * @return LP Tokens as IOU
@@ -61,7 +62,8 @@ inline Number const kAMMInvariantRelativeTolerance{1, -11};
 STAmount
 ammLPTokens(STAmount const& asset1, STAmount const& asset2, Asset const& lptIssue);
 
-/** Calculate LP Tokens given asset's deposit amount.
+/**
+ * Calculate LP Tokens given asset's deposit amount.
  * @param asset1Balance current AMM asset1 balance
  * @param asset1Deposit requested asset1 deposit amount
  * @param lptAMMBalance AMM LPT balance
@@ -75,10 +77,11 @@ lpTokensOut(
     STAmount const& lptAMMBalance,
     std::uint16_t tfee);
 
-/** Calculate asset deposit given LP Tokens.
+/**
+ * Calculate asset deposit given LP Tokens.
  * @param asset1Balance current AMM asset1 balance
- * @param lpTokens LP Tokens
  * @param lptAMMBalance AMM LPT balance
+ * @param lpTokens LP Tokens
  * @param tfee trading fee in basis points
  * @return
  */
@@ -89,7 +92,8 @@ ammAssetIn(
     STAmount const& lpTokens,
     std::uint16_t tfee);
 
-/** Calculate LP Tokens given asset's withdraw amount. Return 0
+/**
+ * Calculate LP Tokens given asset's withdraw amount. Return 0
  * if can't calculate.
  * @param asset1Balance current AMM asset1 balance
  * @param asset1Withdraw requested asset1 withdraw amount
@@ -104,7 +108,8 @@ lpTokensIn(
     STAmount const& lptAMMBalance,
     std::uint16_t tfee);
 
-/** Calculate asset withdrawal by tokens
+/**
+ * Calculate asset withdrawal by tokens
  * @param assetBalance balance of the asset being withdrawn
  * @param lptAMMBalance total AMM Tokens balance
  * @param lpTokens LP Tokens balance
@@ -118,7 +123,8 @@ ammAssetOut(
     STAmount const& lpTokens,
     std::uint16_t tfee);
 
-/** Check if the relative distance between the qualities
+/**
+ * Check if the relative distance between the qualities
  * is within the requested distance.
  * @param calcQuality calculated quality
  * @param reqQuality requested quality
@@ -137,7 +143,8 @@ withinRelativeDistance(Quality const& calcQuality, Quality const& reqQuality, Nu
     return ((min.rate() - max.rate()) / min.rate()) < dist;
 }
 
-/** Check if the relative distance between the amounts
+/**
+ * Check if the relative distance between the amounts
  * is within the requested distance.
  * @param calc calculated amount
  * @param req requested amount
@@ -158,13 +165,15 @@ withinRelativeDistance(Amt const& calc, Amt const& req, Number const& dist)
     return ((max - min) / max) < dist;
 }
 
-/** Solve quadratic equation to find takerGets or takerPays. Round
+/**
+ * Solve quadratic equation to find takerGets or takerPays. Round
  * to minimize the amount in order to maximize the quality.
  */
 std::optional<Number>
 solveQuadraticEqSmallest(Number const& a, Number const& b, Number const& c);
 
-/** Generate AMM offer starting with takerGets when AMM pool
+/**
+ * Generate AMM offer starting with takerGets when AMM pool
  * from the payment perspective is IOU(in)/XRP(out)
  * Equations:
  * Spot Price Quality after the offer is consumed:
@@ -231,7 +240,8 @@ getAMMOfferStartWithTakerGets(
     return amounts;
 }
 
-/** Generate AMM offer starting with takerPays when AMM pool
+/**
+ * Generate AMM offer starting with takerPays when AMM pool
  * from the payment perspective is XRP(in)/IOU(out) or IOU(in)/IOU(out).
  * Equations:
  * Spot Price Quality after the offer is consumed:
@@ -298,7 +308,8 @@ getAMMOfferStartWithTakerPays(
     return amounts;
 }
 
-/**   Generate AMM offer so that either updated Spot Price Quality (SPQ)
+/**
+ * Generate AMM offer so that either updated Spot Price Quality (SPQ)
  * is equal to LOB quality (in this case AMM offer quality is
  * better than LOB quality) or AMM offer is equal to LOB quality
  * (in this case SPQ is better than LOB quality).
@@ -415,7 +426,8 @@ changeSpotPriceQuality(
     return amounts;
 }
 
-/** AMM pool invariant - the product (A * B) after swap in/out has to remain
+/**
+ * AMM pool invariant - the product (A * B) after swap in/out has to remain
  * at least the same: (A + in) * (B - out) >= A * B
  * XRP round-off may result in a smaller product after swap in/out.
  * To address this:
@@ -427,7 +439,8 @@ changeSpotPriceQuality(
  *     value is increased.
  */
 
-/** Swap assetIn into the pool and swap out a proportional amount
+/**
+ * Swap assetIn into the pool and swap out a proportional amount
  * of the other asset. Implements AMM Swap in.
  * @see [XLS30d:AMM
  * Swap](https://github.com/XRPLF/XRPL-Standards/discussions/78)
@@ -493,7 +506,8 @@ swapAssetIn(TAmounts<TIn, TOut> const& pool, TIn const& assetIn, std::uint16_t t
         Number::RoundingMode::Downward);
 }
 
-/** Swap assetOut out of the pool and swap in a proportional amount
+/**
+ * Swap assetOut out of the pool and swap in a proportional amount
  * of the other asset. Implements AMM Swap out.
  * @see [XLS30d:AMM
  * Swap](https://github.com/XRPLF/XRPL-Standards/discussions/78)
@@ -559,12 +573,14 @@ swapAssetOut(TAmounts<TIn, TOut> const& pool, TOut const& assetOut, std::uint16_
         Number::RoundingMode::Upward);
 }
 
-/** Return square of n.
+/**
+ * Return square of n.
  */
 Number
 square(Number const& n);
 
-/** Adjust LP tokens to deposit/withdraw.
+/**
+ * Adjust LP tokens to deposit/withdraw.
  * Amount type keeps 16 digits. Maintaining the LP balance by adding
  * deposited tokens or subtracting withdrawn LP tokens from LP balance
  * results in losing precision in LP balance. I.e. the resulting LP balance
@@ -578,7 +594,8 @@ square(Number const& n);
 STAmount
 adjustLPTokens(STAmount const& lptAMMBalance, STAmount const& lpTokens, IsDeposit isDeposit);
 
-/** Calls adjustLPTokens() and adjusts deposit or withdraw amounts if
+/**
+ * Calls adjustLPTokens() and adjusts deposit or withdraw amounts if
  * the adjusted LP tokens are less than the provided LP tokens.
  * @param amountBalance asset1 pool balance
  * @param amount asset1 to deposit or withdraw
@@ -599,7 +616,8 @@ adjustAmountsByLPTokens(
     std::uint16_t tfee,
     IsDeposit isDeposit);
 
-/** Positive solution for quadratic equation:
+/**
+ * Positive solution for quadratic equation:
  * x = (-b + sqrt(b**2 + 4*a*c))/(2*a)
  */
 Number
@@ -630,7 +648,8 @@ getAssetRounding(IsDeposit isDeposit)
 
 }  // namespace detail
 
-/** Round AMM equal deposit/withdrawal amount. Deposit/withdrawal formulas
+/**
+ * Round AMM equal deposit/withdrawal amount. Deposit/withdrawal formulas
  * calculate the amount as a fractional value of the pool balance. The rounding
  * takes place on the last step of multiplying the balance by the fraction if
  * AMMv1_3 is enabled.
@@ -654,7 +673,8 @@ getRoundedAsset(Rules const& rules, STAmount const& balance, A const& frac, IsDe
     return multiply(balance, frac, rm);
 }
 
-/** Round AMM single deposit/withdrawal amount.
+/**
+ * Round AMM single deposit/withdrawal amount.
  * The lambda's are used to delay evaluation until the function
  * is executed so that the calculation is not done twice. noRoundCb() is
  * called if AMMv1_3 is disabled. Otherwise, the rounding is set and
@@ -671,7 +691,8 @@ getRoundedAsset(
     std::function<Number()> const& productCb,
     IsDeposit isDeposit);
 
-/** Round AMM deposit/withdrawal LPToken amount. Deposit/withdrawal formulas
+/**
+ * Round AMM deposit/withdrawal LPToken amount. Deposit/withdrawal formulas
  * calculate the lptokens as a fractional value of the AMM total lptokens.
  * The rounding takes place on the last step of multiplying the balance by
  * the fraction if AMMv1_3 is enabled. The tokens are then
@@ -685,7 +706,8 @@ getRoundedLPTokens(
     Number const& frac,
     IsDeposit isDeposit);
 
-/** Round AMM single deposit/withdrawal LPToken amount.
+/**
+ * Round AMM single deposit/withdrawal LPToken amount.
  * The lambda's are used to delay evaluation until the function is executed
  * so that the calculations are not done twice.
  * noRoundCb() is called if AMMv1_3 is disabled. Otherwise, the rounding is set
@@ -732,7 +754,8 @@ adjustAssetOutByTokens(
     STAmount const& tokens,
     std::uint16_t tfee);
 
-/** Find a fraction of tokens after the tokens are adjusted. The fraction
+/**
+ * Find a fraction of tokens after the tokens are adjusted. The fraction
  * is used to adjust equal deposit/withdraw amount.
  */
 Number
@@ -742,7 +765,8 @@ adjustFracByTokens(
     STAmount const& tokens,
     Number const& frac);
 
-/** Get AMM pool balances.
+/**
+ * Get AMM pool balances.
  */
 std::pair<STAmount, STAmount>
 ammPoolHolds(
@@ -754,7 +778,8 @@ ammPoolHolds(
     AuthHandling authHandling,
     beast::Journal const j);
 
-/** Check AMM pool product invariant after an AMM operation that changes LP tokens
+/**
+ * Check AMM pool product invariant after an AMM operation that changes LP tokens
  * (deposit/withdraw/clawback) from an already calculated pool product mean.
  * Returns tecPRECISION_LOSS if poolProductMean < newLPTokenBalance beyond the
  * invariant tolerance,
@@ -763,7 +788,8 @@ ammPoolHolds(
 TER
 checkAMMPrecisionLoss(Number const& poolProductMean, STAmount const& newLPTokenBalance);
 
-/** Check AMM pool product invariant after an AMM operation that changes LP tokens
+/**
+ * Check AMM pool product invariant after an AMM operation that changes LP tokens
  * (deposit/withdraw/clawback).
  * Returns tecPRECISION_LOSS if sqrt(asset1 * asset2) < newLPTokenBalance beyond
  * the invariant tolerance,
@@ -778,7 +804,8 @@ checkAMMPrecisionLoss(
     STAmount const& newLPTokenBalance,
     beast::Journal const j);
 
-/** Get AMM pool and LP token balances. If both optIssue are
+/**
+ * Get AMM pool and LP token balances. If both optIssue are
  * provided then they are used as the AMM token pair issues.
  * Otherwise the missing issues are fetched from ammSle.
  */
@@ -792,7 +819,8 @@ ammHolds(
     AuthHandling authHandling,
     beast::Journal const j);
 
-/** Get the balance of LP tokens.
+/**
+ * Get the balance of LP tokens.
  */
 STAmount
 ammLPHolds(
@@ -810,25 +838,29 @@ ammLPHolds(
     AccountID const& lpAccount,
     beast::Journal const j);
 
-/** Get AMM trading fee for the given account. The fee is discounted
+/**
+ * Get AMM trading fee for the given account. The fee is discounted
  * if the account is the auction slot owner or one of the slot's authorized
  * accounts.
  */
 std::uint16_t
 getTradingFee(ReadView const& view, SLE const& ammSle, AccountID const& account);
 
-/** Returns total amount held by AMM for the given token.
+/**
+ * Returns total amount held by AMM for the given token.
  */
 STAmount
 ammAccountHolds(ReadView const& view, AccountID const& ammAccountID, Asset const& asset);
 
-/** Delete trustlines to AMM. If all trustlines are deleted then
+/**
+ * Delete trustlines to AMM. If all trustlines are deleted then
  * AMM object and account are deleted. Otherwise tecINCOMPLETE is returned.
  */
 TER
 deleteAMMAccount(Sandbox& view, Asset const& asset, Asset const& asset2, beast::Journal j);
 
-/** Initialize Auction and Voting slots and set the trading/discounted fee.
+/**
+ * Initialize Auction and Voting slots and set the trading/discounted fee.
  */
 void
 initializeFeeAuctionVote(
@@ -838,14 +870,16 @@ initializeFeeAuctionVote(
     Asset const& lptAsset,
     std::uint16_t tfee);
 
-/** Return true if the Liquidity Provider is the only AMM provider, false
+/**
+ * Return true if the Liquidity Provider is the only AMM provider, false
  * otherwise. Return tecINTERNAL if encountered an unexpected condition,
  * for instance Liquidity Provider has more than one LPToken trustline.
  */
 std::expected<bool, TER>
 isOnlyLiquidityProvider(ReadView const& view, Issue const& ammIssue, AccountID const& lpAccount);
 
-/** Due to rounding, the LPTokenBalance of the last LP might
+/**
+ * Due to rounding, the LPTokenBalance of the last LP might
  * not match the LP's trustline balance. If it's within the tolerance,
  * update LPTokenBalance to match the LP's trustline balance.
  */
diff --git a/include/xrpl/ledger/helpers/AccountRootHelpers.h b/include/xrpl/ledger/helpers/AccountRootHelpers.h
index ae8cf53f2f..350fc6ca85 100644
--- a/include/xrpl/ledger/helpers/AccountRootHelpers.h
+++ b/include/xrpl/ledger/helpers/AccountRootHelpers.h
@@ -20,27 +20,29 @@
 
 namespace xrpl {
 
-/** Check if the issuer has the global freeze flag set.
-    @param issuer The account to check
-    @return true if the account has global freeze set
-*/
+/**
+ * Check if the issuer has the global freeze flag set.
+ * @param issuer The account to check
+ * @return true if the account has global freeze set
+ */
 [[nodiscard]] bool
 isGlobalFrozen(ReadView const& view, AccountID const& issuer);
 
-/** Calculate liquid XRP balance for an account.
+/**
+ * Calculate liquid XRP balance for an account.
  *
- *  This function may be used to calculate the amount of XRP that
- *  the holder is able to freely spend. It subtracts reserve requirements.
+ * This function may be used to calculate the amount of XRP that
+ * the holder is able to freely spend. It subtracts reserve requirements.
  *
- *  ownerCountAdj adjusts the owner count in case the caller calculates
- *  before ledger entries are added or removed. Positive to add, negative
- *  to subtract.
+ * ownerCountAdj adjusts the owner count in case the caller calculates
+ * before ledger entries are added or removed. Positive to add, negative
+ * to subtract.
  *
- *  @param view The ledger view to read from
- *  @param id The account ID to check
- *  @param ownerCountAdj Positive to add to count, negative to reduce count
- *  @param j Journal for logging
- *  @return The liquid XRP amount available to the account
+ * @param view The ledger view to read from
+ * @param id The account ID to check
+ * @param ownerCountAdj Positive to add to count, negative to reduce count
+ * @param j Journal for logging
+ * @return The liquid XRP amount available to the account
  */
 [[nodiscard]] XRPAmount
 xrpLiquid(ReadView const& view, AccountID const& id, std::int32_t ownerCountAdj, beast::Journal j);
@@ -51,32 +53,34 @@ struct Adjustment
     std::int32_t accountCountDelta = 0;
 };
 
-/** Returns the account reserve, in drops.
+/**
+ * Returns the account reserve, in drops.
  *
- *  Actual owner count can be adjusted by delta in ownerCountAdj
- *  Actual reserve count can be adjusted by delta in accountCountAdj
- *  The reserve is calculated as:
- *  (ownerCount + "sponsoring object count" - "sponsored object count" + additionalOwnerCount) *
- *  increment + (1 if not sponsored account + sponsoringAccountCount) * "reserve base"
+ * Actual owner count can be adjusted by delta in ownerCountAdj
+ * Actual reserve count can be adjusted by delta in accountCountAdj
+ * The reserve is calculated as:
+ * (ownerCount + "sponsoring object count" - "sponsored object count" + additionalOwnerCount) *
+ * increment + (1 if not sponsored account + sponsoringAccountCount) * "reserve base"
  *
- *  @param view The ledger view to read from
- *  @param sle The ledger entry for the account
- *  @param j Journal for logging
- *  @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
+ * @param view The ledger view to read from
+ * @param sle The ledger entry for the account
+ * @param j Journal for logging
+ * @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
  * subtract.
- *  @return The account reserve amount in drops
+ * @return The account reserve amount in drops
  */
 [[nodiscard]] XRPAmount
 accountReserve(ReadView const& view, SLE::const_ref sle, beast::Journal j, Adjustment adj = {});
 
-/** Convenience overload that accepts AccountID instead of SLE.
+/**
+ * Convenience overload that accepts AccountID instead of SLE.
  *
- *  @param view The ledger view to read from
- *  @param id The account ID
- *  @param j Journal for logging
- *  @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
+ * @param view The ledger view to read from
+ * @param id The account ID
+ * @param j Journal for logging
+ * @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
  * subtract.
- *  @return The account reserve amount in drops
+ * @return The account reserve amount in drops
  */
 [[nodiscard]] inline XRPAmount
 accountReserve(ReadView const& view, AccountID const& id, beast::Journal j, Adjustment adj = {})
@@ -84,19 +88,20 @@ accountReserve(ReadView const& view, AccountID const& id, beast::Journal j, Adju
     return accountReserve(view, view.read(keylet::account(id)), j, adj);
 }
 
-/** Check if an account has sufficient reserve.
+/**
+ * Check if an account has sufficient reserve.
  *
- *  @param view The ledger view to read from
- *  @param tx The transaction being processed
- *  @param accSle The account's ledger entry
- *  @param accBalance The account's balance
- *  @param sponsorSle The sponsor's ledger entry (if applicable)
- *  @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
+ * @param view The ledger view to read from
+ * @param tx The transaction being processed
+ * @param accSle The account's ledger entry
+ * @param accBalance The account's balance
+ * @param sponsorSle The sponsor's ledger entry (if applicable)
+ * @param adj Adjustment to the owner/account count (default: 0/0). Positive to add, negative to
  * subtract.
- *  @param j Journal for logging (default: null sink)
- *  @param insufReserveCode The transaction result code to return if the reserve is insufficient
- *  (default: tecINSUFFICIENT_RESERVE).
- *  @return Transaction result code
+ * @param j Journal for logging (default: null sink)
+ * @param insufReserveCode The transaction result code to return if the reserve is insufficient
+ * (default: tecINSUFFICIENT_RESERVE).
+ * @return Transaction result code
  */
 [[nodiscard]] TER
 checkReserve(
@@ -108,21 +113,22 @@ checkReserve(
     beast::Journal j,
     TER insufReserveCode = tecINSUFFICIENT_RESERVE);
 
-/** Check if an account has sufficient reserve, deriving the sponsor internally.
+/**
+ * Check if an account has sufficient reserve, deriving the sponsor internally.
  *
- *  Equivalent to the overload above, but resolves the sponsor via
- *  getEffectiveTxReserveSponsor(ctx, accSle) instead of taking it explicitly. Use this
- *  in the common case where the sponsor is simply the transaction's reserve
- *  sponsor for accSle. Callers that must force the account's-own-reserve branch
- *  (passing a null sponsor) or supply a different sponsor should use the
- *  explicit overload above.
+ * Equivalent to the overload above, but resolves the sponsor via
+ * getEffectiveTxReserveSponsor(ctx, accSle) instead of taking it explicitly. Use this
+ * in the common case where the sponsor is simply the transaction's reserve
+ * sponsor for accSle. Callers that must force the account's-own-reserve branch
+ * (passing a null sponsor) or supply a different sponsor should use the
+ * explicit overload above.
  *
- *  @param ctx The apply-view context (view + tx)
- *  @param accSle The account's ledger entry
- *  @param accBalance The account's balance
- *  @param adj Reserve adjustments (owner/account count deltas)
- *  @param j Journal for logging (default: null sink)
- *  @return Transaction result code
+ * @param ctx The apply-view context (view + tx)
+ * @param accSle The account's ledger entry
+ * @param accBalance The account's balance
+ * @param adj Reserve adjustments (owner/account count deltas)
+ * @param j Journal for logging (default: null sink)
+ * @return Transaction result code
  */
 [[nodiscard]] TER
 checkReserve(
@@ -132,29 +138,31 @@ checkReserve(
     Adjustment adj,
     beast::Journal j = beast::Journal{beast::Journal::getNullSink()});
 
-/** Return number of the objects which reserve is covered by the account(sle) (so called "owner
- *  count"). Actual owner count can be adjusted by delta in ownerCountAdj.
+/**
+ * Return number of the objects which reserve is covered by the account(sle) (so called "owner
+ * count"). Actual owner count can be adjusted by delta in ownerCountAdj.
  *
- *  @param sle The account's ledger entry
- *  @param j Journal for logging
- *  @param ownerCountAdj Adjustment to the owner count (default: 0)
- *  @return The adjusted owner count
+ * @param sle The account's ledger entry
+ * @param j Journal for logging
+ * @param ownerCountAdj Adjustment to the owner count (default: 0)
+ * @return The adjusted owner count
  */
 std::uint32_t
 ownerCount(SLE::const_ref sle, beast::Journal j, std::int32_t ownerCountAdj = 0);
 
-/** Increase owner-count fields when the caller supplies the sponsor.
+/**
+ * Increase owner-count fields when the caller supplies the sponsor.
  *
- *  This helper does not create a ledger object. It updates reserve accounting
- *  after the caller has created/updated an object.
- *  If sponsorSle is provided, this also adjusts the account's sponsored count
- *  and the sponsor's sponsoring count.
+ * This helper does not create a ledger object. It updates reserve accounting
+ * after the caller has created/updated an object.
+ * If sponsorSle is provided, this also adjusts the account's sponsored count
+ * and the sponsor's sponsoring count.
  *
- *  @param view The apply view for making changes
- *  @param accountSle The account's ledger entry
- *  @param sponsorSle The sponsor's ledger entry (if applicable)
- *  @param count Amount to add to the owner count
- *  @param j Journal for logging
+ * @param view The apply view for making changes
+ * @param accountSle The account's ledger entry
+ * @param sponsorSle The sponsor's ledger entry (if applicable)
+ * @param count Amount to add to the owner count
+ * @param j Journal for logging
  */
 void
 increaseOwnerCount(
@@ -164,18 +172,19 @@ increaseOwnerCount(
     std::uint32_t count,
     beast::Journal j);
 
-/** Increase owner-count fields, deriving the tx reserve sponsor internally.
+/**
+ * Increase owner-count fields, deriving the tx reserve sponsor internally.
  *
- *  Equivalent to the overload above, but resolves the sponsor via
- *  getEffectiveTxReserveSponsor(ctx, accountSle) instead of taking it explicitly. Use
- *  this when the sponsor is the transaction's reserve sponsor for accountSle
- *  (the common create path). Deletion paths, which derive the sponsor from an
- *  object's sfSponsor field, should keep using the explicit overload.
+ * Equivalent to the overload above, but resolves the sponsor via
+ * getEffectiveTxReserveSponsor(ctx, accountSle) instead of taking it explicitly. Use
+ * this when the sponsor is the transaction's reserve sponsor for accountSle
+ * (the common create path). Deletion paths, which derive the sponsor from an
+ * object's sfSponsor field, should keep using the explicit overload.
  *
- *  @param ctx The apply-view context (view + tx)
- *  @param accountSle The account's ledger entry
- *  @param count Amount to add to the owner count
- *  @param j Journal for logging
+ * @param ctx The apply-view context (view + tx)
+ * @param accountSle The account's ledger entry
+ * @param count Amount to add to the owner count
+ * @param j Journal for logging
  */
 void
 increaseOwnerCount(
@@ -184,13 +193,14 @@ increaseOwnerCount(
     std::uint32_t count,
     beast::Journal j);
 
-/** Convenience overload that accepts AccountID instead of SLE references.
+/**
+ * Convenience overload that accepts AccountID instead of SLE references.
  *
- *  @param view The apply view for making changes
- *  @param account The account ID
- *  @param sponsor The optional sponsor account ID
- *  @param count Amount to add to the owner count
- *  @param j Journal for logging
+ * @param view The apply view for making changes
+ * @param account The account ID
+ * @param sponsor The optional sponsor account ID
+ * @param count Amount to add to the owner count
+ * @param j Journal for logging
  */
 inline void
 increaseOwnerCount(
@@ -208,18 +218,19 @@ increaseOwnerCount(
         j);
 }
 
-/** Decrease owner-count fields when the caller supplies the sponsor.
+/**
+ * Decrease owner-count fields when the caller supplies the sponsor.
  *
- *  This helper does not delete a ledger object. It updates reserve accounting
- *  after the caller has removed an owner-counted reserve, or for special
- *  owner-count changes whose sponsor cannot be derived from an object's
- *  sfSponsor field.
+ * This helper does not delete a ledger object. It updates reserve accounting
+ * after the caller has removed an owner-counted reserve, or for special
+ * owner-count changes whose sponsor cannot be derived from an object's
+ * sfSponsor field.
  *
- *  @param view The apply view for making changes
- *  @param accountSle The account's ledger entry
- *  @param sponsorSle The sponsor's ledger entry (if applicable)
- *  @param count Amount to remove from the owner count
- *  @param j Journal for logging
+ * @param view The apply view for making changes
+ * @param accountSle The account's ledger entry
+ * @param sponsorSle The sponsor's ledger entry (if applicable)
+ * @param count Amount to remove from the owner count
+ * @param j Journal for logging
  */
 void
 decreaseOwnerCount(
@@ -229,13 +240,14 @@ decreaseOwnerCount(
     std::uint32_t count,
     beast::Journal j);
 
-/** Convenience overload that accepts AccountID instead of SLE references.
+/**
+ * Convenience overload that accepts AccountID instead of SLE references.
  *
- *  @param view The apply view for making changes
- *  @param account The account ID
- *  @param sponsor The optional sponsor account ID
- *  @param count Amount to remove from the owner count
- *  @param j Journal for logging
+ * @param view The apply view for making changes
+ * @param account The account ID
+ * @param sponsor The optional sponsor account ID
+ * @param count Amount to remove from the owner count
+ * @param j Journal for logging
  */
 inline void
 decreaseOwnerCount(
@@ -253,18 +265,19 @@ decreaseOwnerCount(
         j);
 }
 
-/** Decrease owner-count fields for an existing ledger object.
+/**
+ * Decrease owner-count fields for an existing ledger object.
  *
- *  This helper derives the reserve sponsor from objectSle's sfSponsor field,
- *  then updates the same owner-count fields as decreaseOwnerCount. Use this
- *  when removing an existing object whose reserve sponsor is stored on that
- *  object.
+ * This helper derives the reserve sponsor from objectSle's sfSponsor field,
+ * then updates the same owner-count fields as decreaseOwnerCount. Use this
+ * when removing an existing object whose reserve sponsor is stored on that
+ * object.
  *
- *  @param view The apply view for making changes
- *  @param accountSle The account's ledger entry
- *  @param objectSle The object's ledger entry
- *  @param count Amount to remove from the owner count
- *  @param j Journal for logging
+ * @param view The apply view for making changes
+ * @param accountSle The account's ledger entry
+ * @param objectSle The object's ledger entry
+ * @param count Amount to remove from the owner count
+ * @param j Journal for logging
  */
 void
 decreaseOwnerCountForObject(
@@ -274,13 +287,14 @@ decreaseOwnerCountForObject(
     std::uint32_t count,
     beast::Journal j);
 
-/** Convenience overload that accepts AccountID instead of account SLE reference.
+/**
+ * Convenience overload that accepts AccountID instead of account SLE reference.
  *
- *  @param view The apply view for making changes
- *  @param account The account ID
- *  @param objectSle The object's ledger entry
- *  @param count Amount to remove from the owner count
- *  @param j Journal for logging
+ * @param view The apply view for making changes
+ * @param account The account ID
+ * @param objectSle The object's ledger entry
+ * @param count Amount to remove from the owner count
+ * @param j Journal for logging
  */
 inline void
 decreaseOwnerCountForObject(
@@ -294,19 +308,20 @@ decreaseOwnerCountForObject(
     decreaseOwnerCountForObject(view, accountSle, objectSle, count, j);
 }
 
-/** Adjust a LoanBroker's owner count.
+/**
+ * Adjust a LoanBroker's owner count.
  *
- *  A LoanBroker's sfOwnerCount tracks the number of outstanding loans on
- *  that broker; it is not a reserve-backed owner count and is distinct
- *  from the broker's pseudo-account's owner count. Loans can never carry a
- *  reserve sponsor (LoanSet rejects reserve sponsorship at preflight), so
- *  this never involves sponsor accounting and never invokes the
- *  ownerCountHook used for ACCOUNT_ROOT reserve tracking.
+ * A LoanBroker's sfOwnerCount tracks the number of outstanding loans on
+ * that broker; it is not a reserve-backed owner count and is distinct
+ * from the broker's pseudo-account's owner count. Loans can never carry a
+ * reserve sponsor (LoanSet rejects reserve sponsorship at preflight), so
+ * this never involves sponsor accounting and never invokes the
+ * ownerCountHook used for ACCOUNT_ROOT reserve tracking.
  *
- *  @param view The apply view for making changes
- *  @param brokerSle The LoanBroker's ledger entry
- *  @param delta Amount to add (positive) or remove (negative) from the count
- *  @param j Journal for logging
+ * @param view The apply view for making changes
+ * @param brokerSle The LoanBroker's ledger entry
+ * @param delta Amount to add (positive) or remove (negative) from the count
+ * @param j Journal for logging
  */
 void
 adjustLoanBrokerOwnerCount(
@@ -315,7 +330,8 @@ adjustLoanBrokerOwnerCount(
     std::int32_t delta,
     beast::Journal j);
 
-/** Returns IOU issuer transfer fee as Rate. Rate specifies
+/**
+ * Returns IOU issuer transfer fee as Rate. Rate specifies
  * the fee as fractions of 1 billion. For example, 1% transfer rate
  * is represented as 1,010,000,000.
  * @param issuer The IOU issuer
@@ -323,35 +339,40 @@ adjustLoanBrokerOwnerCount(
 [[nodiscard]] Rate
 transferRate(ReadView const& view, AccountID const& issuer);
 
-/** Generate a pseudo-account address from a pseudo owner key.
-    @param pseudoOwnerKey The key to generate the address from
-    @return The generated account ID
-*/
+/**
+ * Generate a pseudo-account address from a pseudo owner key.
+ * @param pseudoOwnerKey The key to generate the address from
+ * @return The generated account ID
+ */
 AccountID
 pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey);
 
-/** Returns the list of fields that define an ACCOUNT_ROOT as a pseudo-account
-    if set.
-
-    The list is constructed during initialization and is const after that.
-    Pseudo-account designator fields MUST be maintained by including the
-    SField::sMD_PseudoAccount flag in the SField definition.
-*/
+/**
+ * Returns the list of fields that define an ACCOUNT_ROOT as a pseudo-account
+ * if set.
+ *
+ * The list is constructed during initialization and is const after that.
+ * Pseudo-account designator fields MUST be maintained by including the
+ * SField::sMD_PseudoAccount flag in the SField definition.
+ */
 [[nodiscard]] std::vector<SField const*> const&
 getPseudoAccountFields();
 
-/** Returns true if and only if sleAcct is a pseudo-account or specific
-    pseudo-accounts in pseudoFieldFilter.
-
-    Returns false if sleAcct is:
-    - NOT a pseudo-account OR
-    - NOT a ltACCOUNT_ROOT OR
-    - null pointer
-*/
+/**
+ * Returns true if and only if sleAcct is a pseudo-account or specific
+ * pseudo-accounts in pseudoFieldFilter.
+ *
+ * Returns false if sleAcct is:
+ * - NOT a pseudo-account OR
+ * - NOT a ltACCOUNT_ROOT OR
+ * - null pointer
+ */
 [[nodiscard]] bool
 isPseudoAccount(SLE::const_pointer sleAcct, std::set<SField const*> const& pseudoFieldFilter = {});
 
-/** Convenience overload that reads the account from the view. */
+/**
+ * Convenience overload that reads the account from the view.
+ */
 [[nodiscard]] inline bool
 isPseudoAccount(
     ReadView const& view,
@@ -372,11 +393,12 @@ isPseudoAccount(
 [[nodiscard]] std::expected<SLE::pointer, TER>
 createPseudoAccount(ApplyView& view, uint256 const& pseudoOwnerKey, SField const& ownerField);
 
-/** Checks the destination and tag.
-
-   - Checks that the SLE is not null.
-   - If the SLE requires a destination tag, checks that there is a tag.
-*/
+/**
+ * Checks the destination and tag.
+ *
+ * - Checks that the SLE is not null.
+ * - If the SLE requires a destination tag, checks that there is a tag.
+ */
 [[nodiscard]] TER
 checkDestinationAndTag(SLE::const_ref toSle, bool hasDestinationTag);
 
diff --git a/include/xrpl/ledger/helpers/DirectoryHelpers.h b/include/xrpl/ledger/helpers/DirectoryHelpers.h
index a95b9bc95a..25085c4252 100644
--- a/include/xrpl/ledger/helpers/DirectoryHelpers.h
+++ b/include/xrpl/ledger/helpers/DirectoryHelpers.h
@@ -95,19 +95,20 @@ internalDirFirst(
 }  // namespace detail
 
 /** @{ */
-/** Returns the first entry in the directory, advancing the index
-
-    @deprecated These are legacy function that are considered deprecated
-                and will soon be replaced with an iterator-based model
-                that is easier to use. You should not use them in new code.
-
-    @param view The view against which to operate
-    @param root The root (i.e. first page) of the directory to iterate
-    @param page The current page
-    @param index The index inside the current page
-    @param entry The entry at the current index
-
-    @return true if the directory isn't empty; false otherwise
+/**
+ * Returns the first entry in the directory, advancing the index
+ *
+ * @deprecated These are legacy function that are considered deprecated
+ *             and will soon be replaced with an iterator-based model
+ *             that is easier to use. You should not use them in new code.
+ *
+ * @param view The view against which to operate
+ * @param root The root (i.e. first page) of the directory to iterate
+ * @param page The current page
+ * @param index The index inside the current page
+ * @param entry The entry at the current index
+ *
+ * @return true if the directory isn't empty; false otherwise
  */
 bool
 cdirFirst(
@@ -127,19 +128,20 @@ dirFirst(
 /** @} */
 
 /** @{ */
-/** Returns the next entry in the directory, advancing the index
-
-    @deprecated These are legacy function that are considered deprecated
-                and will soon be replaced with an iterator-based model
-                that is easier to use. You should not use them in new code.
-
-    @param view The view against which to operate
-    @param root The root (i.e. first page) of the directory to iterate
-    @param page The current page
-    @param index The index inside the current page
-    @param entry The entry at the current index
-
-    @return true if the directory isn't empty; false otherwise
+/**
+ * Returns the next entry in the directory, advancing the index
+ *
+ * @deprecated These are legacy function that are considered deprecated
+ *             and will soon be replaced with an iterator-based model
+ *             that is easier to use. You should not use them in new code.
+ *
+ * @param view The view against which to operate
+ * @param root The root (i.e. first page) of the directory to iterate
+ * @param page The current page
+ * @param index The index inside the current page
+ * @param entry The entry at the current index
+ *
+ * @return true if the directory isn't empty; false otherwise
  */
 bool
 cdirNext(
@@ -158,16 +160,19 @@ dirNext(
     uint256& entry);
 /** @} */
 
-/** Iterate all items in the given directory. */
+/**
+ * Iterate all items in the given directory.
+ */
 void
 forEachItem(ReadView const& view, Keylet const& root, std::function<void(SLE::const_ref)> const& f);
 
-/** Iterate all items after an item in the given directory.
-    @param after The key of the item to start after
-    @param hint The directory page containing `after`
-    @param limit The maximum number of items to return
-    @return `false` if the iteration failed
-*/
+/**
+ * Iterate all items after an item in the given directory.
+ * @param after The key of the item to start after
+ * @param hint The directory page containing `after`
+ * @param limit The maximum number of items to return
+ * @return `false` if the iteration failed
+ */
 bool
 forEachItemAfter(
     ReadView const& view,
@@ -177,19 +182,22 @@ forEachItemAfter(
     unsigned int limit,
     std::function<bool(SLE::const_ref)> const& f);
 
-/** Iterate all items in an account's owner directory. */
+/**
+ * Iterate all items in an account's owner directory.
+ */
 inline void
 forEachItem(ReadView const& view, AccountID const& id, std::function<void(SLE::const_ref)> const& f)
 {
     forEachItem(view, keylet::ownerDir(id), f);
 }
 
-/** Iterate all items after an item in an owner directory.
-    @param after The key of the item to start after
-    @param hint The directory page containing `after`
-    @param limit The maximum number of items to return
-    @return `false` if the iteration failed
-*/
+/**
+ * Iterate all items after an item in an owner directory.
+ * @param after The key of the item to start after
+ * @param hint The directory page containing `after`
+ * @param limit The maximum number of items to return
+ * @return `false` if the iteration failed
+ */
 inline bool
 forEachItemAfter(
     ReadView const& view,
@@ -202,13 +210,16 @@ forEachItemAfter(
     return forEachItemAfter(view, keylet::ownerDir(id), after, hint, limit, f);
 }
 
-/** Returns `true` if the directory is empty
-    @param key The key of the directory
-*/
+/**
+ * Returns `true` if the directory is empty
+ * @param key The key of the directory
+ */
 [[nodiscard]] bool
 dirIsEmpty(ReadView const& view, Keylet const& k);
 
-/** Returns a function that sets the owner on a directory SLE */
+/**
+ * Returns a function that sets the owner on a directory SLE
+ */
 [[nodiscard]] std::function<void(SLE::ref)>
 describeOwnerDir(AccountID const& account);
 
diff --git a/include/xrpl/ledger/helpers/LendingHelpers.h b/include/xrpl/ledger/helpers/LendingHelpers.h
index 873abae272..e2605e9ab7 100644
--- a/include/xrpl/ledger/helpers/LendingHelpers.h
+++ b/include/xrpl/ledger/helpers/LendingHelpers.h
@@ -63,7 +63,9 @@ static constexpr std::uint32_t kSecondsInYear = 365 * 24 * 60 * 60;
 Number
 loanPeriodicRate(TenthBips32 interestRate, std::uint32_t paymentInterval);
 
-/// Ensure the periodic payment is always rounded consistently
+/**
+ * Ensure the periodic payment is always rounded consistently
+ */
 inline Number
 roundPeriodicPayment(Asset const& asset, Number const& periodicPayment, std::int32_t scale)
 {
@@ -127,7 +129,8 @@ struct LoanPaymentParts
     operator==(LoanPaymentParts const& other) const;
 };
 
-/** This structure captures the parts of a loan state.
+/**
+ * This structure captures the parts of a loan state.
  *
  *  Whether the values are theoretical (unrounded) or rounded will depend on how
  * it was computed.
@@ -324,12 +327,14 @@ struct PaymentComponents
     // - extra: An additional payment beyond the regular schedule (overpayment)
     PaymentSpecialCase specialCase = PaymentSpecialCase::None;
 
-    // Calculates the tracked interest portion of this payment.
-    // This is derived from the other components as:
-    // trackedValueDelta - trackedPrincipalDelta - trackedManagementFeeDelta
-    //
-    // @return The amount of tracked interest included in this payment that
-    //         will be paid to the vault.
+    /**
+     * Calculates the tracked interest portion of this payment.
+     * This is derived from the other components as:
+     * trackedValueDelta - trackedPrincipalDelta - trackedManagementFeeDelta
+     *
+     * @return The amount of tracked interest included in this payment that
+     *         will be paid to the vault.
+     */
     [[nodiscard]] Number
     trackedInterestPart() const;
 };
@@ -401,7 +406,8 @@ struct LoanStateDeltas
     // The difference in management fee outstanding between two loan states.
     Number managementFee;
 
-    /* Calculates the total change across all components.
+    /**
+     * Calculates the total change across all components.
      * @return The sum of principal, interest, and management fee deltas.
      */
     [[nodiscard]] Number
diff --git a/include/xrpl/ledger/helpers/MPTokenHelpers.h b/include/xrpl/ledger/helpers/MPTokenHelpers.h
index 8a2a4a5b84..5418e5b26a 100644
--- a/include/xrpl/ledger/helpers/MPTokenHelpers.h
+++ b/include/xrpl/ledger/helpers/MPTokenHelpers.h
@@ -29,15 +29,17 @@ namespace xrpl {
 [[nodiscard]] bool
 isGlobalFrozen(ReadView const& view, MPTIssue const& mptIssue);
 
-/** Returns true if @p account's MPToken for @p mptIssue carries the
- *  individual-lock flag (lsfMPTLocked).
+/**
+ * Returns true if @p account's MPToken for @p mptIssue carries the
+ * individual-lock flag (lsfMPTLocked).
  *
- *  @warning This checks only the raw per-holder lock bit.  It does **not**
- *  perform the transitive vault pseudo-account check: if @p mptIssue is a
- *  vault share whose underlying asset is frozen, this function returns false.
- *  Call @ref isFrozen instead when determining whether an account may send or
- *  receive tokens — it combines isIndividualFrozen, isGlobalFrozen, and
- *  isVaultPseudoAccountFrozen into a single complete check. */
+ * @warning This checks only the raw per-holder lock bit.  It does **not**
+ * perform the transitive vault pseudo-account check: if @p mptIssue is a
+ * vault share whose underlying asset is frozen, this function returns false.
+ * Call @ref isFrozen instead when determining whether an account may send or
+ * receive tokens — it combines isIndividualFrozen, isGlobalFrozen, and
+ * isVaultPseudoAccountFrozen into a single complete check.
+ */
 [[nodiscard]] bool
 isIndividualFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue);
 
@@ -61,7 +63,8 @@ isAnyFrozen(
 //
 //------------------------------------------------------------------------------
 
-/** Returns MPT transfer fee as Rate. Rate specifies
+/**
+ * Returns MPT transfer fee as Rate. Rate specifies
  * the fee as fractions of 1 billion. For example, 1% transfer rate
  * is represented as 1,010,000,000.
  * @param issuanceID MPTokenIssuanceID of MPTTokenIssuance object
@@ -94,7 +97,8 @@ authorizeMPToken(
     std::uint32_t flags = 0,
     std::optional<AccountID> holderID = std::nullopt);
 
-/** Check if the account lacks required authorization for MPT.
+/**
+ * Check if the account lacks required authorization for MPT.
  *
  * requireAuth check is recursive for MPT shares in a vault, descending to
  * assets in the vault, up to maxAssetCheckDepth recursion depth. This is
@@ -109,7 +113,8 @@ requireAuth(
     AuthType authType = AuthType::Legacy,
     std::uint8_t depth = 0);
 
-/** Enforce account has MPToken to match its authorization.
+/**
+ * Enforce account has MPToken to match its authorization.
  *
  *   Called from doApply - it will check for expired (and delete if found any)
  *   credentials matching DomainID set in MPTokenIssuance. Must be called if
@@ -123,44 +128,46 @@ enforceMPTokenAuthorization(
     XRPAmount const& priorBalance,
     beast::Journal j);
 
-/** Resolve the underlying asset of a vault share.
+/**
+ * Resolve the underlying asset of a vault share.
  *
- *  Reads sfReferenceHolding from @p sleShareIssuance to determine which
- *  asset the vault wraps. @p sleHolding must be the SLE that
- *  sfReferenceHolding points to — either an ltMPTOKEN (returns its
- *  MPTIssue) or an ltRIPPLE_STATE (returns its low/high Issue).
+ * Reads sfReferenceHolding from @p sleShareIssuance to determine which
+ * asset the vault wraps. @p sleHolding must be the SLE that
+ * sfReferenceHolding points to — either an ltMPTOKEN (returns its
+ * MPTIssue) or an ltRIPPLE_STATE (returns its low/high Issue).
  *
- *  @pre Both SLEs must exist and @p sleHolding must be of type ltMPTOKEN
- *       or ltRIPPLE_STATE. Passing any other type is undefined behaviour.
- *  @param sleShareIssuance  MPTokenIssuance SLE for the vault share token.
- *  @param sleHolding        SLE referenced by sfReferenceHolding.
- *  @return The underlying Asset (MPTIssue or Issue).
+ * @pre Both SLEs must exist and @p sleHolding must be of type ltMPTOKEN
+ *      or ltRIPPLE_STATE. Passing any other type is undefined behaviour.
+ * @param sleShareIssuance  MPTokenIssuance SLE for the vault share token.
+ * @param sleHolding        SLE referenced by sfReferenceHolding.
+ * @return The underlying Asset (MPTIssue or Issue).
  */
 [[nodiscard]] Asset
 assetOfHolding(SLE const& sleShareIssuance, SLE const& sleHolding);
 
-/** Check whether @p to may receive the given MPT from @p from.
+/**
+ * Check whether @p to may receive the given MPT from @p from.
  *
- *  The check passes when any of the following is true:
- *  - @p waive is WaiveMPTCanTransfer::Yes (recovery-path exemption), or
- *  - @p from or @p to is the issuer, or
- *  - lsfMPTCanTransfer is set on the MPTokenIssuance.
+ * The check passes when any of the following is true:
+ * - @p waive is WaiveMPTCanTransfer::Yes (recovery-path exemption), or
+ * - @p from or @p to is the issuer, or
+ * - lsfMPTCanTransfer is set on the MPTokenIssuance.
  *
- *  For vault shares (MPTokenIssuances that carry sfReferenceHolding) the
- *  check recurses into the underlying asset's transferability. This
- *  recursion is defensive; vault-of-vault-shares is rejected at vault
- *  creation, so in practice depth never exceeds 1.
+ * For vault shares (MPTokenIssuances that carry sfReferenceHolding) the
+ * check recurses into the underlying asset's transferability. This
+ * recursion is defensive; vault-of-vault-shares is rejected at vault
+ * creation, so in practice depth never exceeds 1.
  *
- *  @param view      Ledger state to read from.
- *  @param mptIssue  The MPT issuance being transferred.
- *  @param from      Sending account.
- *  @param to        Receiving account.
- *  @param waive     WaiveMPTCanTransfer::Yes skips the lsfMPTCanTransfer
- *                   check. Use for recovery paths (e.g. unwinding SAV or
- *                   Lending Protocol positions after an issuer revokes
- *                   transferability).
- *  @param depth     Recursion depth; bounded at kMaxAssetCheckDepth.
- *  @return tesSUCCESS if the transfer is allowed, tecNO_AUTH otherwise.
+ * @param view      Ledger state to read from.
+ * @param mptIssue  The MPT issuance being transferred.
+ * @param from      Sending account.
+ * @param to        Receiving account.
+ * @param waive     WaiveMPTCanTransfer::Yes skips the lsfMPTCanTransfer
+ *                  check. Use for recovery paths (e.g. unwinding SAV or
+ *                  Lending Protocol positions after an issuer revokes
+ *                  transferability).
+ * @param depth     Recursion depth; bounded at kMaxAssetCheckDepth.
+ * @return tesSUCCESS if the transfer is allowed, tecNO_AUTH otherwise.
  */
 [[nodiscard]] TER
 canTransfer(
@@ -171,22 +178,24 @@ canTransfer(
     WaiveMPTCanTransfer waive = WaiveMPTCanTransfer::No,
     std::uint8_t depth = 0);
 
-/** Check whether @p asset may be traded on the DEX.
+/**
+ * Check whether @p asset may be traded on the DEX.
  *
- *  For IOU assets the check delegates to the existing offer/AMM freeze
- *  logic. For MPT assets it checks lsfMPTCanTrade on the MPTokenIssuance.
- *  Vault shares recurse into the underlying asset's tradability via
- *  sfReferenceHolding; depth is bounded at kMaxAssetCheckDepth.
+ * For IOU assets the check delegates to the existing offer/AMM freeze
+ * logic. For MPT assets it checks lsfMPTCanTrade on the MPTokenIssuance.
+ * Vault shares recurse into the underlying asset's tradability via
+ * sfReferenceHolding; depth is bounded at kMaxAssetCheckDepth.
  *
- *  @param view   Ledger state to read from.
- *  @param asset  The asset to check.
- *  @param depth  Recursion depth; bounded at kMaxAssetCheckDepth.
- *  @return tesSUCCESS if trading is allowed, tecNO_PERMISSION otherwise.
+ * @param view   Ledger state to read from.
+ * @param asset  The asset to check.
+ * @param depth  Recursion depth; bounded at kMaxAssetCheckDepth.
+ * @return tesSUCCESS if trading is allowed, tecNO_PERMISSION otherwise.
  */
 [[nodiscard]] TER
 canTrade(ReadView const& view, Asset const& asset, std::uint8_t depth = 0);
 
-/** Convenience to combine canTrade/Transfer. Returns tesSUCCESS if Asset is Issue.
+/**
+ * Convenience to combine canTrade/Transfer. Returns tesSUCCESS if Asset is Issue.
  */
 [[nodiscard]] TER
 canMPTTradeAndTransfer(
@@ -272,7 +281,8 @@ availableMPTAmount(SLE const& sleIssuance);
 std::int64_t
 availableMPTAmount(ReadView const& view, MPTID const& mptID);
 
-/** Checks for two types of OutstandingAmount overflow during a send operation.
+/**
+ * Checks for two types of OutstandingAmount overflow during a send operation.
  * 1.  **Direct directSendNoFee (Overflow: No):** A true overflow check when
  * `OutstandingAmount > MaximumAmount`. This threshold is used for direct
  * directSendNoFee transactions that bypass the payment engine.
@@ -297,7 +307,8 @@ isMPTOverflow(
 [[nodiscard]] STAmount
 issuerFundsToSelfIssue(ReadView const& view, MPTIssue const& issue);
 
-/** Facilitate tracking of MPT sold by an issuer owning MPT sell offer.
+/**
+ * Facilitate tracking of MPT sold by an issuer owning MPT sell offer.
  * See ApplyView::issuerSelfDebitHookMPT().
  */
 void
diff --git a/include/xrpl/ledger/helpers/NFTokenHelpers.h b/include/xrpl/ledger/helpers/NFTokenHelpers.h
index 1c4d395fbe..d9d195c559 100644
--- a/include/xrpl/ledger/helpers/NFTokenHelpers.h
+++ b/include/xrpl/ledger/helpers/NFTokenHelpers.h
@@ -24,19 +24,25 @@
 
 namespace xrpl::nft {
 
-/** Delete up to a specified number of offers from the specified token offer
- * directory. */
+/**
+ * Delete up to a specified number of offers from the specified token offer
+ * directory.
+ */
 std::size_t
 removeTokenOffersWithLimit(
     ApplyView& view,
     Keylet const& directory,
     std::size_t maxDeletableOffers);
 
-/** Finds the specified token in the owner's token directory. */
+/**
+ * Finds the specified token in the owner's token directory.
+ */
 std::optional<STObject>
 findToken(ReadView const& view, AccountID const& owner, uint256 const& nftokenID);
 
-/** Finds the token in the owner's token directory.  Returns token and page. */
+/**
+ * Finds the token in the owner's token directory.  Returns token and page.
+ */
 struct TokenAndPage
 {
     STObject token;
@@ -49,33 +55,39 @@ struct TokenAndPage
 std::optional<TokenAndPage>
 findTokenAndPage(ApplyView& view, AccountID const& owner, uint256 const& nftokenID);
 
-/** Insert the token in the owner's token directory. */
+/**
+ * Insert the token in the owner's token directory.
+ */
 TER
 insertToken(ApplyView& view, AccountID owner, STObject&& nft);
 
-/** Remove the token from the owner's token directory. */
+/**
+ * Remove the token from the owner's token directory.
+ */
 TER
 removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID);
 
 TER
 removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID, SLE::ref page);
 
-/** Deletes the given token offer.
-
-    An offer is tracked in two separate places:
-        - The token's 'buy' directory, if it's a buy offer; or
-        - The token's 'sell' directory, if it's a sell offer; and
-        - The owner directory of the account that placed the offer.
-
-    The offer also consumes one incremental reserve.
+/**
+ * Deletes the given token offer.
+ *
+ * An offer is tracked in two separate places:
+ *     - The token's 'buy' directory, if it's a buy offer; or
+ *     - The token's 'sell' directory, if it's a sell offer; and
+ *     - The owner directory of the account that placed the offer.
+ *
+ * The offer also consumes one incremental reserve.
  */
 bool
 deleteTokenOffer(ApplyView& view, SLE::ref offer);
 
-/** Repairs the links in an NFTokenPage directory.
-
-    Returns true if a repair took place, otherwise false.
-*/
+/**
+ * Repairs the links in an NFTokenPage directory.
+ *
+ * Returns true if a repair took place, otherwise false.
+ */
 bool
 repairNFTokenDirectoryLinks(ApplyView& view, AccountID const& owner);
 
@@ -89,7 +101,9 @@ changeTokenURI(
     uint256 const& nftokenID,
     std::optional<xrpl::Slice> const& uri);
 
-/** Preflight checks shared by NFTokenCreateOffer and NFTokenMint */
+/**
+ * Preflight checks shared by NFTokenCreateOffer and NFTokenMint
+ */
 NotTEC
 tokenOfferCreatePreflight(
     AccountID const& acctID,
@@ -101,7 +115,9 @@ tokenOfferCreatePreflight(
     std::optional<AccountID> const& owner = std::nullopt,
     std::uint32_t txFlags = tfSellNFToken);
 
-/** Preclaim checks shared by NFTokenCreateOffer and NFTokenMint */
+/**
+ * Preclaim checks shared by NFTokenCreateOffer and NFTokenMint
+ */
 TER
 tokenOfferCreatePreclaim(
     ReadView const& view,
@@ -115,7 +131,9 @@ tokenOfferCreatePreclaim(
     std::optional<AccountID> const& owner = std::nullopt,
     std::uint32_t txFlags = tfSellNFToken);
 
-/** doApply implementation shared by NFTokenCreateOffer and NFTokenMint */
+/**
+ * doApply implementation shared by NFTokenCreateOffer and NFTokenMint
+ */
 TER
 tokenOfferCreateApply(
     ApplyView& view,
diff --git a/include/xrpl/ledger/helpers/OfferHelpers.h b/include/xrpl/ledger/helpers/OfferHelpers.h
index fc863dff0a..524288ea33 100644
--- a/include/xrpl/ledger/helpers/OfferHelpers.h
+++ b/include/xrpl/ledger/helpers/OfferHelpers.h
@@ -7,18 +7,19 @@
 
 namespace xrpl {
 
-/** Delete an offer.
-
-    Requirements:
-        The offer must exist.
-        The caller must have already checked permissions.
-
-    @param view The ApplyView to modify.
-    @param sle The offer to delete.
-    @param j Journal for logging.
-
-    @return tesSUCCESS on success, otherwise an error code.
-*/
+/**
+ * Delete an offer.
+ *
+ * Requirements:
+ *     The offer must exist.
+ *     The caller must have already checked permissions.
+ *
+ * @param view The ApplyView to modify.
+ * @param sle The offer to delete.
+ * @param j Journal for logging.
+ *
+ * @return tesSUCCESS on success, otherwise an error code.
+ */
 // [[nodiscard]] // nodiscard commented out so Flow, BookTip and others compile.
 TER
 offerDelete(ApplyView& view, SLE::ref sle, beast::Journal j);
diff --git a/include/xrpl/ledger/helpers/PaymentChannelHelpers.h b/include/xrpl/ledger/helpers/PaymentChannelHelpers.h
index 6e8cd17f7f..5e1f590c58 100644
--- a/include/xrpl/ledger/helpers/PaymentChannelHelpers.h
+++ b/include/xrpl/ledger/helpers/PaymentChannelHelpers.h
@@ -12,37 +12,40 @@
 
 namespace xrpl {
 
-/** Close a payment channel and return its remaining funds to the channel owner.
+/**
+ * Close a payment channel and return its remaining funds to the channel owner.
  *
- *  @param slep  The SLE for the PayChannel object to close.
- *  @param view  The apply view in which ledger state modifications are made.
- *  @param key   The ledger key identifying the PayChannel entry.
- *  @param j     Journal used for fatal-level diagnostic messages.
- *  @return      tesSUCCESS on success; tefBAD_LEDGER if a directory removal
- *               fails; tefINTERNAL if the source account SLE cannot be found.
+ * @param slep  The SLE for the PayChannel object to close.
+ * @param view  The apply view in which ledger state modifications are made.
+ * @param key   The ledger key identifying the PayChannel entry.
+ * @param j     Journal used for fatal-level diagnostic messages.
+ * @return      tesSUCCESS on success; tefBAD_LEDGER if a directory removal
+ *              fails; tefINTERNAL if the source account SLE cannot be found.
  */
 TER
 closeChannel(SLE::ref slep, ApplyView& view, uint256 const& key, beast::Journal j);
 
-/** Add two uint32_t values with saturation at UINT32_MAX.
+/**
+ * Add two uint32_t values with saturation at UINT32_MAX.
  *
- *  @param rules  The current ledger rules used to check amendment status.
- *  @param lhs    Left-hand operand.
- *  @param rhs    Right-hand operand.
- *  @return       @p lhs + @p rhs, saturated at UINT32_MAX when the amendment
- *                is active.
+ * @param rules  The current ledger rules used to check amendment status.
+ * @param lhs    Left-hand operand.
+ * @param rhs    Right-hand operand.
+ * @return       @p lhs + @p rhs, saturated at UINT32_MAX when the amendment
+ *               is active.
  */
 uint32_t
 saturatingAdd(Rules const& rules, uint32_t const lhs, uint32_t const rhs);
 
-/** Determine whether a payment channel time field represents an expired time.
+/**
+ * Determine whether a payment channel time field represents an expired time.
  *
- *  @param view       The apply view providing the parent close time and rules.
- *  @param timeField  The optional expiry timestamp (seconds since the XRP
- *                    Ledger epoch).  If empty, the function returns false.
- *  @return           @c true if @p timeField is set and the indicated time is
- *                    in the past relative to the view's parent close time;
- *                    @c false otherwise.
+ * @param view       The apply view providing the parent close time and rules.
+ * @param timeField  The optional expiry timestamp (seconds since the XRP
+ *                   Ledger epoch).  If empty, the function returns false.
+ * @return           @c true if @p timeField is set and the indicated time is
+ *                   in the past relative to the view's parent close time;
+ *                   @c false otherwise.
  */
 bool
 isChannelExpired(ApplyView const& view, std::optional<std::uint32_t> timeField);
diff --git a/include/xrpl/ledger/helpers/RippleStateHelpers.h b/include/xrpl/ledger/helpers/RippleStateHelpers.h
index 398ec86bb7..a0508d074f 100644
--- a/include/xrpl/ledger/helpers/RippleStateHelpers.h
+++ b/include/xrpl/ledger/helpers/RippleStateHelpers.h
@@ -31,13 +31,14 @@ namespace xrpl {
 //
 //------------------------------------------------------------------------------
 
-/** Calculate the maximum amount of IOUs that an account can hold
-    @param view the ledger to check against.
-    @param account the account of interest.
-    @param issuer the issuer of the IOU.
-    @param currency the IOU to check.
-    @return The maximum amount that can be held.
-*/
+/**
+ * Calculate the maximum amount of IOUs that an account can hold
+ * @param view the ledger to check against.
+ * @param account the account of interest.
+ * @param issuer the issuer of the IOU.
+ * @param currency the IOU to check.
+ * @return The maximum amount that can be held.
+ */
 /** @{ */
 STAmount
 creditLimit(
@@ -50,12 +51,13 @@ IOUAmount
 creditLimit2(ReadView const& v, AccountID const& acc, AccountID const& iss, Currency const& cur);
 /** @} */
 
-/** Returns the amount of IOUs issued by issuer that are held by an account
-    @param view the ledger to check against.
-    @param account the account of interest.
-    @param issuer the issuer of the IOU.
-    @param currency the IOU to check.
-*/
+/**
+ * Returns the amount of IOUs issued by issuer that are held by an account
+ * @param view the ledger to check against.
+ * @param account the account of interest.
+ * @param issuer the issuer of the IOU.
+ * @param currency the IOU to check.
+ */
 /** @{ */
 STAmount
 creditBalance(
@@ -134,10 +136,11 @@ checkDeepFrozen(ReadView const& view, AccountID const& account, Issue const& iss
 //
 //------------------------------------------------------------------------------
 
-/** Create a trust line
-
-    This can set an initial balance.
-*/
+/**
+ * Create a trust line
+ *
+ * This can set an initial balance.
+ */
 [[nodiscard]] TER
 trustCreate(
     ApplyView& view,
@@ -196,7 +199,8 @@ redeemIOU(
 //
 //------------------------------------------------------------------------------
 
-/** Check if the account lacks required authorization.
+/**
+ * Check if the account lacks required authorization.
  *
  * Return tecNO_AUTH or tecNO_LINE if it does
  * and tesSUCCESS otherwise.
@@ -220,7 +224,8 @@ requireAuth(
     AccountID const& account,
     AuthType authType = AuthType::Legacy);
 
-/** Check if the destination account is allowed
+/**
+ * Check if the destination account is allowed
  *  to receive IOU. Return terNO_RIPPLE if rippling is
  *  disabled on both sides and tesSUCCESS otherwise.
  */
@@ -233,8 +238,10 @@ canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, Acc
 //
 //------------------------------------------------------------------------------
 
-/// Any transactors that call addEmptyHolding() in doApply must call
-/// canAddHolding() in preflight with the same View and Asset
+/**
+ * Any transactors that call addEmptyHolding() in doApply must call
+ * canAddHolding() in preflight with the same View and Asset
+ */
 [[nodiscard]] TER
 addEmptyHolding(
     ApplyViewContext ctx,
@@ -250,7 +257,8 @@ removeEmptyHolding(
     Issue const& issue,
     beast::Journal journal);
 
-/** Delete trustline to AMM. The passed `sle` must be obtained from a prior
+/**
+ * Delete trustline to AMM. The passed `sle` must be obtained from a prior
  * call to view.peek(). Fail if neither side of the trustline is AMM or
  * if ammAccountID is seated and is not one of the trustline's side.
  */
@@ -261,7 +269,8 @@ deleteAMMTrustLine(
     std::optional<AccountID> const& ammAccountID,
     beast::Journal j);
 
-/** Delete AMMs MPToken. The passed `sle` must be obtained from a prior
+/**
+ * Delete AMMs MPToken. The passed `sle` must be obtained from a prior
  * call to view.peek().
  */
 [[nodiscard]] TER
diff --git a/include/xrpl/ledger/helpers/SponsorHelpers.h b/include/xrpl/ledger/helpers/SponsorHelpers.h
index fd2315b024..98bf419140 100644
--- a/include/xrpl/ledger/helpers/SponsorHelpers.h
+++ b/include/xrpl/ledger/helpers/SponsorHelpers.h
@@ -16,22 +16,27 @@
 
 namespace xrpl {
 
-/** Whether the given transaction type may use reserve sponsorship (v1).
+/**
+ * Whether the given transaction type may use reserve sponsorship (v1).
  *
- *  Reserve sponsorship is restricted to an explicit allow-list of transaction
- *  types; all others reject spfSponsorReserve at preflight.
+ * Reserve sponsorship is restricted to an explicit allow-list of transaction
+ * types; all others reject spfSponsorReserve at preflight.
  */
 bool
 isReserveSponsorAllowed(TxType txType);
 
-/** Whether the transaction's fee is sponsored (sfSponsor present + spfSponsorFee set). */
+/**
+ * Whether the transaction's fee is sponsored (sfSponsor present + spfSponsorFee set).
+ */
 inline bool
 isFeeSponsored(STTx const& tx)
 {
     return tx.isFieldPresent(sfSponsor) && ((tx.getFieldU32(sfSponsorFlags) & spfSponsorFee) != 0u);
 }
 
-/** Whether the transaction's reserve is sponsored (sfSponsor present + spfSponsorReserve set). */
+/**
+ * Whether the transaction's reserve is sponsored (sfSponsor present + spfSponsorReserve set).
+ */
 inline bool
 isReserveSponsored(STTx const& tx)
 {
@@ -39,61 +44,68 @@ isReserveSponsored(STTx const& tx)
         ((tx.getFieldU32(sfSponsorFlags) & spfSponsorReserve) != 0u);
 }
 
-/** Return the AccountID of the transaction's reserve sponsor, or nullopt if unsponsored. */
+/**
+ * Return the AccountID of the transaction's reserve sponsor, or nullopt if unsponsored.
+ */
 std::optional<AccountID>
 getTxReserveSponsorID(STTx const& tx);
 
-/** Return a mutable SLE for the transaction's reserve sponsor account.
+/**
+ * Return a mutable SLE for the transaction's reserve sponsor account.
  *
- *  @param ctx The apply-view context (view + tx)
- *  @return The sponsor account SLE, a null pointer if the tx is not
- *          reserve-sponsored, or tecINTERNAL if the sponsor account cannot
- *          be loaded (an already-checked invariant).
+ * @param ctx The apply-view context (view + tx)
+ * @return The sponsor account SLE, a null pointer if the tx is not
+ *         reserve-sponsored, or tecINTERNAL if the sponsor account cannot
+ *         be loaded (an already-checked invariant).
  */
 std::expected<SLE::pointer, TER>
 getTxReserveSponsor(ApplyViewContext ctx);
 
-/** Return a read-only SLE for the transaction's reserve sponsor account.
+/**
+ * Return a read-only SLE for the transaction's reserve sponsor account.
  *
- *  @param view The ledger read view
- *  @param tx   The transaction to inspect
- *  @return The sponsor account SLE, a null pointer if the tx is not
- *          reserve-sponsored, or tecINTERNAL if the sponsor account cannot
- *          be loaded (an already-checked invariant).
+ * @param view The ledger read view
+ * @param tx   The transaction to inspect
+ * @return The sponsor account SLE, a null pointer if the tx is not
+ *         reserve-sponsored, or tecINTERNAL if the sponsor account cannot
+ *         be loaded (an already-checked invariant).
  */
 std::expected<SLE::const_pointer, TER>
 getTxReserveSponsor(ReadView const& view, STTx const& tx);
 
-/** The transaction's reserve sponsor for the given account, if applicable.
+/**
+ * The transaction's reserve sponsor for the given account, if applicable.
  *
- *  A reserve sponsor only covers the transaction submitter's own objects, so
- *  this returns the tx reserve sponsor SLE only when accountSle is the tx's own
- *  (non-pseudo) account; otherwise it returns a null sponsor pointer. This is
- *  the single source of truth for the "sponsor applies to tx.Account only" rule
- *  that the sponsor-deriving helper overloads in AccountRootHelpers rely on.
+ * A reserve sponsor only covers the transaction submitter's own objects, so
+ * this returns the tx reserve sponsor SLE only when accountSle is the tx's own
+ * (non-pseudo) account; otherwise it returns a null sponsor pointer. This is
+ * the single source of truth for the "sponsor applies to tx.Account only" rule
+ * that the sponsor-deriving helper overloads in AccountRootHelpers rely on.
  *
- *  @param ctx The apply-view context (view + tx)
- *  @param accountSle The account whose sponsor is being resolved
- *  @return The sponsor SLE (nullptr if unsponsored), or tecINTERNAL if the
- *          sponsor account cannot be loaded (an already-checked invariant)
+ * @param ctx The apply-view context (view + tx)
+ * @param accountSle The account whose sponsor is being resolved
+ * @return The sponsor SLE (nullptr if unsponsored), or tecINTERNAL if the
+ *         sponsor account cannot be loaded (an already-checked invariant)
  */
 [[nodiscard]] std::expected<SLE::pointer, TER>
 getEffectiveTxReserveSponsor(ApplyViewContext ctx, SLE::const_ref accountSle);
 
-/** Return the AccountID stored in the given sponsor field of a ledger entry, or nullopt if absent.
+/**
+ * Return the AccountID stored in the given sponsor field of a ledger entry, or nullopt if absent.
  */
 std::optional<AccountID>
 getLedgerEntryReserveSponsorID(SLE::const_ref sle, SF_ACCOUNT const& field = sfSponsor);
 
-/** Return a mutable SLE for the reserve sponsor recorded on a ledger entry.
+/**
+ * Return a mutable SLE for the reserve sponsor recorded on a ledger entry.
  *
- *  Reads the sponsor AccountID from @p field on @p sle and peeks the
- *  corresponding account root in @p view.
+ * Reads the sponsor AccountID from @p field on @p sle and peeks the
+ * corresponding account root in @p view.
  *
- *  @param view  The mutable apply view
- *  @param sle   The ledger entry whose sponsor field is inspected
- *  @param field The field that holds the sponsor AccountID (defaults to sfSponsor)
- *  @return The sponsor account SLE, or a null pointer if the entry is unsponsored.
+ * @param view  The mutable apply view
+ * @param sle   The ledger entry whose sponsor field is inspected
+ * @param field The field that holds the sponsor AccountID (defaults to sfSponsor)
+ * @return The sponsor account SLE, or a null pointer if the entry is unsponsored.
  */
 SLE::pointer
 getLedgerEntryReserveSponsor(
@@ -101,16 +113,17 @@ getLedgerEntryReserveSponsor(
     SLE::const_ref sle,
     SF_ACCOUNT const& field = sfSponsor);
 
-/** Stamp a reserve sponsor onto a ledger entry using an explicit sponsor SLE.
+/**
+ * Stamp a reserve sponsor onto a ledger entry using an explicit sponsor SLE.
  *
- *  Sets @p field on @p sle to the AccountID from @p sponsorSle. A no-op when
- *  @p sponsorSle is null (unsponsored). For RippleState entries the field must
- *  be sfHighSponsor or sfLowSponsor; for all other entry types it must be
- *  sfSponsor.
+ * Sets @p field on @p sle to the AccountID from @p sponsorSle. A no-op when
+ * @p sponsorSle is null (unsponsored). For RippleState entries the field must
+ * be sfHighSponsor or sfLowSponsor; for all other entry types it must be
+ * sfSponsor.
  *
- *  @param sle       The ledger entry to stamp
- *  @param sponsorSle The sponsor's account root SLE (null → no-op)
- *  @param field     The sponsor field to set (defaults to sfSponsor)
+ * @param sle       The ledger entry to stamp
+ * @param sponsorSle The sponsor's account root SLE (null → no-op)
+ * @param field     The sponsor field to set (defaults to sfSponsor)
  */
 void
 addSponsorToLedgerEntry(
@@ -118,65 +131,72 @@ addSponsorToLedgerEntry(
     SLE::const_ref sponsorSle,
     SF_ACCOUNT const& field = sfSponsor);
 
-/** Stamp the transaction's reserve sponsor onto a newly-created ledger entry.
+/**
+ * Stamp the transaction's reserve sponsor onto a newly-created ledger entry.
  *
- *  Equivalent to the overload above, but resolves the sponsor via
- *  getTxReserveSponsor(ctx) instead of taking it explicitly. A no-op when the
- *  transaction is not reserve-sponsored. The entry is assumed to be owned by
- *  the transaction submitter, which is the only account a tx reserve sponsor
- *  can cover.
+ * Equivalent to the overload above, but resolves the sponsor via
+ * getTxReserveSponsor(ctx) instead of taking it explicitly. A no-op when the
+ * transaction is not reserve-sponsored. The entry is assumed to be owned by
+ * the transaction submitter, which is the only account a tx reserve sponsor
+ * can cover.
  */
 void
 addSponsorToLedgerEntry(ApplyViewContext ctx, SLE::ref sle, SF_ACCOUNT const& field = sfSponsor);
 
-/** Remove the reserve sponsor field from a ledger entry.
+/**
+ * Remove the reserve sponsor field from a ledger entry.
  *
- *  A no-op when @p field is not present on @p sle. For RippleState entries
- *  the field must be sfHighSponsor or sfLowSponsor; for all other entry types
- *  it must be sfSponsor.
+ * A no-op when @p field is not present on @p sle. For RippleState entries
+ * the field must be sfHighSponsor or sfLowSponsor; for all other entry types
+ * it must be sfSponsor.
  *
- *  @param sle   The ledger entry to modify
- *  @param field The sponsor field to clear (defaults to sfSponsor)
+ * @param sle   The ledger entry to modify
+ * @param field The sponsor field to clear (defaults to sfSponsor)
  */
 void
 removeSponsorFromLedgerEntry(SLE::ref sle, SF_ACCOUNT const& field = sfSponsor);
 
-/** Whether @p account is the owner of a ledger entry for sponsorship purposes.
+/**
+ * Whether @p account is the owner of a ledger entry for sponsorship purposes.
  *
- *  Ownership rules vary by entry type. For RippleState entries the owner is
- *  whichever side of the trust line holds the reserve. For credentials, the
- *  owner is the subject once accepted and the issuer before acceptance.
+ * Ownership rules vary by entry type. For RippleState entries the owner is
+ * whichever side of the trust line holds the reserve. For credentials, the
+ * owner is the subject once accepted and the issuer before acceptance.
  *
- *  @param view    The ledger read view (used for SignerList lookup)
- *  @param sle     The ledger entry whose owner is checked
- *  @param account The candidate account to match against
- *  @return true if @p account owns @p sle, false otherwise.
+ * @param view    The ledger read view (used for SignerList lookup)
+ * @param sle     The ledger entry whose owner is checked
+ * @param account The candidate account to match against
+ * @return true if @p account owns @p sle, false otherwise.
  */
 bool
 isLedgerEntryOwner(ReadView const& view, SLE const& sle, AccountID const& account);
 
-/** Whether this ledger entry type can have a reserve sponsor attached to it. */
+/**
+ * Whether this ledger entry type can have a reserve sponsor attached to it.
+ */
 bool
 isLedgerEntrySupportedBySponsorship(SLE const& sle);
 
-/** Return the number of owner-count units the ledger entry consumes.
+/**
+ * Return the number of owner-count units the ledger entry consumes.
  *
- *  Most entries cost 1. Exceptions: Oracles scale with their price-data series
- *  size, Vaults cost 2 (vault + pseudo-account), and legacy SignerList entries
- *  (pre-MultiSignReserve) cost 2 + signer count.
+ * Most entries cost 1. Exceptions: Oracles scale with their price-data series
+ * size, Vaults cost 2 (vault + pseudo-account), and legacy SignerList entries
+ * (pre-MultiSignReserve) cost 2 + signer count.
  */
 std::uint32_t
 getLedgerEntryOwnerCount(SLE const& sle);
 
-/** Return the SField used to store the reserve sponsor for @p owner on @p sle.
+/**
+ * Return the SField used to store the reserve sponsor for @p owner on @p sle.
  *
- *  For most entry types this is sfSponsor. RippleState entries use
- *  sfHighSponsor or sfLowSponsor depending on which side of the trust line
- *  @p owner holds.
+ * For most entry types this is sfSponsor. RippleState entries use
+ * sfHighSponsor or sfLowSponsor depending on which side of the trust line
+ * @p owner holds.
  *
- *  @param sle   The ledger entry
- *  @param owner The account whose sponsor field is needed
- *  @return sfHighSponsor, sfLowSponsor, or sfSponsor as appropriate.
+ * @param sle   The ledger entry
+ * @param owner The account whose sponsor field is needed
+ * @return sfHighSponsor, sfLowSponsor, or sfSponsor as appropriate.
  */
 SF_ACCOUNT const&
 getLedgerEntrySponsorField(SLE const& sle, AccountID const& owner);
diff --git a/include/xrpl/ledger/helpers/TokenHelpers.h b/include/xrpl/ledger/helpers/TokenHelpers.h
index 33d9761d84..501101136a 100644
--- a/include/xrpl/ledger/helpers/TokenHelpers.h
+++ b/include/xrpl/ledger/helpers/TokenHelpers.h
@@ -28,21 +28,30 @@ namespace xrpl {
 //
 //------------------------------------------------------------------------------
 
-/** Controls the treatment of frozen account balances */
+/**
+ * Controls the treatment of frozen account balances
+ */
 enum class FreezeHandling { IgnoreFreeze, ZeroIfFrozen };
 
-/** Controls the treatment of unauthorized MPT balances */
+/**
+ * Controls the treatment of unauthorized MPT balances
+ */
 enum class AuthHandling { IgnoreAuth, ZeroIfUnauthorized };
 
-/** Controls whether to include the account's full spendable balance */
+/**
+ * Controls whether to include the account's full spendable balance
+ */
 enum class SpendableHandling { SimpleBalance, FullBalance };
 
 enum class WaiveTransferFee : bool { No = false, Yes };
 
-/** Controls whether accountSend is allowed to overflow OutstandingAmount **/
+/**
+ * Controls whether accountSend is allowed to overflow OutstandingAmount *
+ */
 enum class AllowMPTOverflow : bool { No = false, Yes };
 
-/** Controls whether canTransfer enforces lsfMPTCanTransfer on MPTs.
+/**
+ * Controls whether canTransfer enforces lsfMPTCanTransfer on MPTs.
  *
  *  Default is No (enforce). Use Yes at call sites that must remain available
  *  even when an MPT issuer has cleared lsfMPTCanTransfer - for example,
@@ -81,9 +90,9 @@ isIndividualFrozen(ReadView const& view, AccountID const& account, Asset const&
 checkIndividualFrozen(ReadView const& view, AccountID const& account, Asset const& asset);
 
 /**
- *   isFrozen check is recursive for MPT shares in a vault, descending to
- *   assets in the vault, up to maxAssetCheckDepth recursion depth. This is
- *   purely defensive, as we currently do not allow such vaults to be created.
+ * isFrozen check is recursive for MPT shares in a vault, descending to
+ * assets in the vault, up to maxAssetCheckDepth recursion depth. This is
+ * purely defensive, as we currently do not allow such vaults to be created.
  */
 [[nodiscard]] bool
 isFrozen(
@@ -122,9 +131,9 @@ isDeepFrozen(
     std::uint8_t depth = 0);
 
 /**
- *   isFrozen check is recursive for MPT shares in a vault, descending to
- *   assets in the vault, up to maxAssetCheckDepth recursion depth. This is
- *   purely defensive, as we currently do not allow such vaults to be created.
+ * isFrozen check is recursive for MPT shares in a vault, descending to
+ * assets in the vault, up to maxAssetCheckDepth recursion depth. This is
+ * purely defensive, as we currently do not allow such vaults to be created.
  */
 [[nodiscard]] bool
 isDeepFrozen(
@@ -285,7 +294,8 @@ accountFunds(
     AuthHandling authHandling,
     beast::Journal j);
 
-/** Returns the transfer fee as Rate based on the type of token
+/**
+ * Returns the transfer fee as Rate based on the type of token
  * @param view The ledger view
  * @param amount The amount to transfer
  */
@@ -350,7 +360,8 @@ canTransfer(
 // --> bCheckIssuer : normally require issuer to be involved.
 // [[nodiscard]] // nodiscard commented out so DirectStep.cpp compiles.
 
-/** Calls static directSendNoFeeIOU if saAmount represents Issue.
+/**
+ * Calls static directSendNoFeeIOU if saAmount represents Issue.
  * Calls static directSendNoFeeMPT if saAmount represents MPTIssue.
  */
 TER
@@ -362,7 +373,8 @@ directSendNoFee(
     bool bCheckIssuer,
     beast::Journal j);
 
-/** Calls static accountSendIOU if saAmount represents Issue.
+/**
+ * Calls static accountSendIOU if saAmount represents Issue.
  * Calls static accountSendMPT if saAmount represents MPTIssue.
  */
 [[nodiscard]] TER
@@ -377,7 +389,8 @@ accountSend(
     AllowMPTOverflow allowOverflow = AllowMPTOverflow::No);
 
 using MultiplePaymentDestinations = std::vector<std::pair<AccountID, Number>>;
-/** Like accountSend, except one account is sending multiple payments (with the
+/**
+ * Like accountSend, except one account is sending multiple payments (with the
  *  same asset!) simultaneously
  *
  * Calls static accountSendMultiIOU if saAmount represents Issue.
diff --git a/include/xrpl/ledger/helpers/VaultHelpers.h b/include/xrpl/ledger/helpers/VaultHelpers.h
index 2344b4de77..1bd1663314 100644
--- a/include/xrpl/ledger/helpers/VaultHelpers.h
+++ b/include/xrpl/ledger/helpers/VaultHelpers.h
@@ -9,57 +9,63 @@
 
 namespace xrpl {
 
-/** From the perspective of a vault, return the number of shares to give
-    depositor when they offer a fixed amount of assets. Note, since shares are
-    MPT, this number is integral and always truncated in this calculation.
-
-    @param vault The vault SLE.
-    @param issuance The MPTokenIssuance SLE for the vault's shares.
-    @param assets The amount of assets to convert.
-
-    @return The number of shares, or nullopt on error.
-*/
+/**
+ * From the perspective of a vault, return the number of shares to give
+ * depositor when they offer a fixed amount of assets. Note, since shares are
+ * MPT, this number is integral and always truncated in this calculation.
+ *
+ * @param vault The vault SLE.
+ * @param issuance The MPTokenIssuance SLE for the vault's shares.
+ * @param assets The amount of assets to convert.
+ *
+ * @return The number of shares, or nullopt on error.
+ */
 [[nodiscard]] std::optional<STAmount>
 assetsToSharesDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount const& assets);
 
-/** From the perspective of a vault, return the number of assets to take from
-    depositor when they receive a fixed amount of shares. Note, since shares are
-    MPT, they are always an integral number.
-
-    @param vault The vault SLE.
-    @param issuance The MPTokenIssuance SLE for the vault's shares.
-    @param shares The amount of shares to convert.
-
-    @return The number of assets, or nullopt on error.
-*/
+/**
+ * From the perspective of a vault, return the number of assets to take from
+ * depositor when they receive a fixed amount of shares. Note, since shares are
+ * MPT, they are always an integral number.
+ *
+ * @param vault The vault SLE.
+ * @param issuance The MPTokenIssuance SLE for the vault's shares.
+ * @param shares The amount of shares to convert.
+ *
+ * @return The number of assets, or nullopt on error.
+ */
 [[nodiscard]] std::optional<STAmount>
 sharesToAssetsDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount const& shares);
 
-/** Controls whether to truncate shares instead of rounding. */
+/**
+ * Controls whether to truncate shares instead of rounding.
+ */
 enum class TruncateShares : bool { No = false, Yes = true };
 
-/** Controls whether the withdraw conversion helpers
-    (assetsToSharesWithdraw and sharesToAssetsWithdraw) subtract
-    sfLossUnrealized from sfAssetsTotal before computing the exchange rate.
-    The default (No) applies the standard discounted rate; Yes is used when
-    the redeemer is the sole remaining shareholder.
-*/
+/**
+ * Controls whether the withdraw conversion helpers
+ * (assetsToSharesWithdraw and sharesToAssetsWithdraw) subtract
+ * sfLossUnrealized from sfAssetsTotal before computing the exchange rate.
+ * The default (No) applies the standard discounted rate; Yes is used when
+ * the redeemer is the sole remaining shareholder.
+ */
 enum class WaiveUnrealizedLoss : bool { No = false, Yes = true };
 
-/** From the perspective of a vault, return the number of shares to demand from
-    the depositor when they ask to withdraw a fixed amount of assets. Since
-    shares are MPT this number is integral, and it will be rounded to nearest
-    unless explicitly requested to be truncated instead.
-
-    @param vault The vault SLE.
-    @param issuance The MPTokenIssuance SLE for the vault's shares.
-    @param assets The amount of assets to convert.
-    @param truncate Whether to truncate instead of rounding.
-    @param waive Whether to waive the unrealized-loss discount when computing
-                 the exchange rate.
-
-    @return The number of shares, or nullopt on error.
-*/
+/**
+ * From the perspective of a vault, return the number of shares to demand from
+ * the depositor when they ask to withdraw a fixed amount of assets. Since
+ * shares are MPT this number is integral, and it will be rounded to nearest
+ * unless explicitly requested to be truncated instead.
+ *
+ * @param vault The vault SLE.
+ * @param issuance The MPTokenIssuance SLE for the vault's shares.
+ * @param assets The amount of assets to convert.
+ * @param truncate Whether to truncate instead of rounding.
+ * @param waive Whether to waive the unrealized-loss discount when computing
+ *              the exchange rate.
+ *
+ * @return The number of shares, or nullopt on error.
+ */
 [[nodiscard]] std::optional<STAmount>
 assetsToSharesWithdraw(
     SLE::const_ref vault,
@@ -68,18 +74,19 @@ assetsToSharesWithdraw(
     TruncateShares truncate = TruncateShares::No,
     WaiveUnrealizedLoss waive = WaiveUnrealizedLoss::No);
 
-/** From the perspective of a vault, return the number of assets to give the
-    depositor when they redeem a fixed amount of shares. Note, since shares are
-    MPT, they are always an integral number.
-
-    @param vault The vault SLE.
-    @param issuance The MPTokenIssuance SLE for the vault's shares.
-    @param shares The amount of shares to convert.
-    @param waive Whether to waive (i.e. not subtract) the vault's unrealized
-                 loss when computing the exchange rate.
-
-    @return The number of assets, or nullopt on error.
-*/
+/**
+ * From the perspective of a vault, return the number of assets to give the
+ * depositor when they redeem a fixed amount of shares. Note, since shares are
+ * MPT, they are always an integral number.
+ *
+ * @param vault The vault SLE.
+ * @param issuance The MPTokenIssuance SLE for the vault's shares.
+ * @param shares The amount of shares to convert.
+ * @param waive Whether to waive (i.e. not subtract) the vault's unrealized
+ *              loss when computing the exchange rate.
+ *
+ * @return The number of assets, or nullopt on error.
+ */
 [[nodiscard]] std::optional<STAmount>
 sharesToAssetsWithdraw(
     SLE::const_ref vault,
@@ -87,15 +94,16 @@ sharesToAssetsWithdraw(
     STAmount const& shares,
     WaiveUnrealizedLoss waive = WaiveUnrealizedLoss::No);
 
-/** Returns true iff `account` holds all of the vault's outstanding shares —
-    i.e. is the sole remaining shareholder. Returns false if the account
-    holds no shares or fewer than the total outstanding.
-
-    @param view The ledger view.
-    @param account The candidate sole shareholder.
-    @param issuance The MPTokenIssuance SLE for the vault's shares; provides
-                    both the share MPTID and the outstanding-amount total.
-*/
+/**
+ * Returns true iff `account` holds all of the vault's outstanding shares —
+ * i.e. is the sole remaining shareholder. Returns false if the account
+ * holds no shares or fewer than the total outstanding.
+ *
+ * @param view The ledger view.
+ * @param account The candidate sole shareholder.
+ * @param issuance The MPTokenIssuance SLE for the vault's shares; provides
+ *                 both the share MPTID and the outstanding-amount total.
+ */
 [[nodiscard]] bool
 isSoleShareholder(ReadView const& view, AccountID const& account, SLE::const_ref issuance);
 
diff --git a/include/xrpl/net/HTTPClient.h b/include/xrpl/net/HTTPClient.h
index 7ed9b35b9b..752afac9c4 100644
--- a/include/xrpl/net/HTTPClient.h
+++ b/include/xrpl/net/HTTPClient.h
@@ -14,7 +14,8 @@
 
 namespace xrpl {
 
-/** Provides an asynchronous HTTP client implementation with optional SSL.
+/**
+ * Provides an asynchronous HTTP client implementation with optional SSL.
  */
 class HTTPClient
 {
@@ -30,14 +31,15 @@ public:
         bool sslVerify,
         beast::Journal j);
 
-    /** Destroys the global SSL context created by initializeSSLContext().
+    /**
+     * Destroys the global SSL context created by initializeSSLContext().
      *
-     *  This releases the underlying boost::asio::ssl::context and any
-     *  associated OpenSSL resources. Must not be called while any
-     *  HTTPClient requests are in flight.
+     * This releases the underlying boost::asio::ssl::context and any
+     * associated OpenSSL resources. Must not be called while any
+     * HTTPClient requests are in flight.
      *
-     *  @note Currently only called from tests during teardown. In production,
-     *        the SSL context lives for the lifetime of the process.
+     * @note Currently only called from tests during teardown. In production,
+     *       the SSL context lives for the lifetime of the process.
      */
     static void
     cleanupSSLContext();
diff --git a/include/xrpl/net/RegisterSSLCerts.h b/include/xrpl/net/RegisterSSLCerts.h
index 5cc9934638..004f893515 100644
--- a/include/xrpl/net/RegisterSSLCerts.h
+++ b/include/xrpl/net/RegisterSSLCerts.h
@@ -5,13 +5,14 @@
 #include <boost/asio/ssl/context.hpp>
 
 namespace xrpl {
-/** Register default SSL certificates.
-
-    Register the system default SSL root certificates. On linux/mac,
-    this just calls asio's `set_default_verify_paths` to look in standard
-    operating system locations. On windows, it uses the OS certificate
-    store accessible via CryptoAPI.
-*/
+/**
+ * Register default SSL certificates.
+ *
+ * Register the system default SSL root certificates. On linux/mac,
+ * this just calls asio's `set_default_verify_paths` to look in standard
+ * operating system locations. On windows, it uses the OS certificate
+ * store accessible via CryptoAPI.
+ */
 void
 registerSSLCerts(boost::asio::ssl::context&, boost::system::error_code&, beast::Journal j);
 
diff --git a/include/xrpl/nodestore/Backend.h b/include/xrpl/nodestore/Backend.h
index 29c4a8b526..564a874c5e 100644
--- a/include/xrpl/nodestore/Backend.h
+++ b/include/xrpl/nodestore/Backend.h
@@ -15,33 +15,37 @@
 
 namespace xrpl::NodeStore {
 
-/** A backend used for the NodeStore.
-
-    The NodeStore uses a swappable backend so that other database systems
-    can be tried. Different databases may offer various features such
-    as improved performance, fault tolerant or distributed storage, or
-    all in-memory operation.
-
-    A given instance of a backend is fixed to a particular key size.
-*/
+/**
+ * A backend used for the NodeStore.
+ *
+ * The NodeStore uses a swappable backend so that other database systems
+ * can be tried. Different databases may offer various features such
+ * as improved performance, fault tolerant or distributed storage, or
+ * all in-memory operation.
+ *
+ * A given instance of a backend is fixed to a particular key size.
+ */
 class Backend
 {
 public:
-    /** Destroy the backend.
-
-        All open files are closed and flushed. If there are batched writes
-        or other tasks scheduled, they will be completed before this call
-        returns.
-    */
+    /**
+     * Destroy the backend.
+     *
+     * All open files are closed and flushed. If there are batched writes
+     * or other tasks scheduled, they will be completed before this call
+     * returns.
+     */
     virtual ~Backend() = default;
 
-    /** Get the human-readable name of this backend.
-        This is used for diagnostic output.
-    */
+    /**
+     * Get the human-readable name of this backend.
+     * This is used for diagnostic output.
+     */
     virtual std::string
     getName() = 0;
 
-    /** Get the block size for backends that support it
+    /**
+     * Get the block size for backends that support it
      */
     [[nodiscard]] virtual std::optional<std::size_t>
     getBlockSize() const
@@ -49,25 +53,28 @@ public:
         return std::nullopt;
     }
 
-    /** Open the backend.
-        @param createIfMissing Create the database files if necessary.
-        This allows the caller to catch exceptions.
-    */
+    /**
+     * Open the backend.
+     * @param createIfMissing Create the database files if necessary.
+     * This allows the caller to catch exceptions.
+     */
     virtual void
     open(bool createIfMissing = true) = 0;
 
-    /** Returns true is the database is open.
+    /**
+     * Returns true is the database is open.
      */
     virtual bool
     isOpen() = 0;
 
-    /** Open the backend.
-        @param createIfMissing Create the database files if necessary.
-        @param appType Deterministic appType used to create a backend.
-        @param uid Deterministic uid used to create a backend.
-        @param salt Deterministic salt used to create a backend.
-        @throws std::runtime_error is function is called not for NuDB backend.
-    */
+    /**
+     * Open the backend.
+     * @param createIfMissing Create the database files if necessary.
+     * @param appType Deterministic appType used to create a backend.
+     * @param uid Deterministic uid used to create a backend.
+     * @param salt Deterministic salt used to create a backend.
+     * @throws std::runtime_error is function is called not for NuDB backend.
+     */
     virtual void
     open(bool createIfMissing, uint64_t appType, uint64_t uid, uint64_t salt)
     {
@@ -75,60 +82,70 @@ public:
             "Deterministic appType/uid/salt not supported by backend " + getName());
     }
 
-    /** Close the backend.
-        This allows the caller to catch exceptions.
-    */
+    /**
+     * Close the backend.
+     * This allows the caller to catch exceptions.
+     */
     virtual void
     close() = 0;
 
-    /** Fetch a single object.
-        If the object is not found or an error is encountered, the
-        result will indicate the condition.
-        @note This will be called concurrently.
-        @param hash The hash of the object.
-        @param pObject [out] The created object if successful.
-        @return The result of the operation.
-    */
+    /**
+     * Fetch a single object.
+     * If the object is not found or an error is encountered, the
+     * result will indicate the condition.
+     * @note This will be called concurrently.
+     * @param hash The hash of the object.
+     * @param pObject [out] The created object if successful.
+     * @return The result of the operation.
+     */
     virtual Status
     fetch(uint256 const& hash, std::shared_ptr<NodeObject>* pObject) = 0;
 
-    /** Store a single object.
-        Depending on the implementation this may happen immediately
-        or deferred using a scheduled task.
-        @note This will be called concurrently.
-        @param object The object to store.
-    */
+    /**
+     * Store a single object.
+     * Depending on the implementation this may happen immediately
+     * or deferred using a scheduled task.
+     * @note This will be called concurrently.
+     * @param object The object to store.
+     */
     virtual void
     store(std::shared_ptr<NodeObject> const& object) = 0;
 
-    /** Store a group of objects.
-        @note This function will not be called concurrently with
-              itself or @ref store.
-    */
+    /**
+     * Store a group of objects.
+     * @note This function will not be called concurrently with
+     *       itself or @ref store.
+     */
     virtual void
     storeBatch(Batch const& batch) = 0;
 
     virtual void
     sync() = 0;
 
-    /** Visit every object in the database
-        This is usually called during import.
-        @note This routine will not be called concurrently with itself
-              or other methods.
-        @see import
-    */
+    /**
+     * Visit every object in the database
+     * This is usually called during import.
+     * @note This routine will not be called concurrently with itself
+     *       or other methods.
+     * @see import
+     */
     virtual void
     forEach(std::function<void(std::shared_ptr<NodeObject>)> f) = 0;
 
-    /** Estimate the number of write operations pending. */
+    /**
+     * Estimate the number of write operations pending.
+     */
     virtual int
     getWriteLoad() = 0;
 
-    /** Remove contents on disk upon destruction. */
+    /**
+     * Remove contents on disk upon destruction.
+     */
     virtual void
     setDeletePath() = 0;
 
-    /** Perform consistency checks on database.
+    /**
+     * Perform consistency checks on database.
      *
      * This method is implemented only by NuDBBackend. It is not yet called
      * anywhere, but it might be a good idea to one day call it at startup to
@@ -139,7 +156,9 @@ public:
     {
     }
 
-    /** Returns the number of file descriptors the backend expects to need. */
+    /**
+     * Returns the number of file descriptors the backend expects to need.
+     */
     [[nodiscard]] virtual int
     fdRequired() const = 0;
 };
diff --git a/include/xrpl/nodestore/Database.h b/include/xrpl/nodestore/Database.h
index 49002ee301..96ba91bd76 100644
--- a/include/xrpl/nodestore/Database.h
+++ b/include/xrpl/nodestore/Database.h
@@ -27,100 +27,109 @@ class Section;
 
 namespace xrpl::NodeStore {
 
-/** Persistency layer for NodeObject
-
-    A Node is a ledger object which is uniquely identified by a key, which is
-    the 256-bit hash of the body of the node. The payload is a variable length
-    block of serialized data.
-
-    All ledger data is stored as node objects and as such, needs to be persisted
-    between launches. Furthermore, since the set of node objects will in
-    general be larger than the amount of available memory, purged node objects
-    which are later accessed must be retrieved from the node store.
-
-    @see NodeObject
-*/
+/**
+ * Persistency layer for NodeObject
+ *
+ * A Node is a ledger object which is uniquely identified by a key, which is
+ * the 256-bit hash of the body of the node. The payload is a variable length
+ * block of serialized data.
+ *
+ * All ledger data is stored as node objects and as such, needs to be persisted
+ * between launches. Furthermore, since the set of node objects will in
+ * general be larger than the amount of available memory, purged node objects
+ * which are later accessed must be retrieved from the node store.
+ *
+ * @see NodeObject
+ */
 class Database
 {
 public:
     Database() = delete;
 
-    /** Construct the node store.
-
-        @param scheduler The scheduler to use for performing asynchronous tasks.
-        @param readThreads The number of asynchronous read threads to create.
-        @param config The configuration settings
-        @param journal Destination for logging output.
-    */
+    /**
+     * Construct the node store.
+     *
+     * @param scheduler The scheduler to use for performing asynchronous tasks.
+     * @param readThreads The number of asynchronous read threads to create.
+     * @param config The configuration settings
+     * @param journal Destination for logging output.
+     */
     Database(Scheduler& scheduler, int readThreads, Section const& config, beast::Journal j);
 
-    /** Destroy the node store.
-        All pending operations are completed, pending writes flushed,
-        and files closed before this returns.
-    */
+    /**
+     * Destroy the node store.
+     * All pending operations are completed, pending writes flushed,
+     * and files closed before this returns.
+     */
     virtual ~Database();
 
-    /** Retrieve the name associated with this backend.
-        This is used for diagnostics and may not reflect the actual path
-        or paths used by the underlying backend.
-    */
+    /**
+     * Retrieve the name associated with this backend.
+     * This is used for diagnostics and may not reflect the actual path
+     * or paths used by the underlying backend.
+     */
     virtual std::string
     getName() const = 0;
 
-    /** Import objects from another database. */
+    /**
+     * Import objects from another database.
+     */
     virtual void
     importDatabase(Database& source) = 0;
 
-    /** Retrieve the estimated number of pending write operations.
-        This is used for diagnostics.
-    */
+    /**
+     * Retrieve the estimated number of pending write operations.
+     * This is used for diagnostics.
+     */
     virtual std::int32_t
     getWriteLoad() const = 0;
 
-    /** Store the object.
-
-        The caller's Blob parameter is overwritten.
-
-        @param type The type of object.
-        @param data The payload of the object. The caller's
-                    variable is overwritten.
-        @param hash The 256-bit hash of the payload data.
-        @param ledgerSeq The sequence of the ledger the object belongs to.
-
-        @return `true` if the object was stored?
-    */
+    /**
+     * Store the object.
+     *
+     * The caller's Blob parameter is overwritten.
+     *
+     * @param type The type of object.
+     * @param data The payload of the object. The caller's
+     *             variable is overwritten.
+     * @param hash The 256-bit hash of the payload data.
+     * @param ledgerSeq The sequence of the ledger the object belongs to.
+     *
+     * @return `true` if the object was stored?
+     */
     virtual void
     store(NodeObjectType type, Blob&& data, uint256 const& hash, std::uint32_t ledgerSeq) = 0;
 
-    /* Check if two ledgers are in the same database
-
-        If these two sequence numbers map to the same database,
-        the result of a fetch with either sequence number would
-        be identical.
-
-        @param s1 The first sequence number
-        @param s2 The second sequence number
-
-        @return 'true' if both ledgers would be in the same DB
-
-    */
+    /**
+     * Check if two ledgers are in the same database
+     *
+     * If these two sequence numbers map to the same database,
+     * the result of a fetch with either sequence number would
+     * be identical.
+     *
+     * @param s1 The first sequence number
+     * @param s2 The second sequence number
+     *
+     * @return 'true' if both ledgers would be in the same DB
+     */
     virtual bool
     isSameDB(std::uint32_t s1, std::uint32_t s2) = 0;
 
     virtual void
     sync() = 0;
 
-    /** Fetch a node object.
-        If the object is known to be not in the database, isn't found in the
-        database during the fetch, or failed to load correctly during the fetch,
-        `nullptr` is returned.
-
-        @note This can be called concurrently.
-        @param hash The key of the object to retrieve.
-        @param ledgerSeq The sequence of the ledger where the object is stored.
-        @param fetchType the type of fetch, synchronous or asynchronous.
-        @return The object, or nullptr if it couldn't be retrieved.
-    */
+    /**
+     * Fetch a node object.
+     * If the object is known to be not in the database, isn't found in the
+     * database during the fetch, or failed to load correctly during the fetch,
+     * `nullptr` is returned.
+     *
+     * @note This can be called concurrently.
+     * @param hash The key of the object to retrieve.
+     * @param ledgerSeq The sequence of the ledger where the object is stored.
+     * @param fetchType the type of fetch, synchronous or asynchronous.
+     * @return The object, or nullptr if it couldn't be retrieved.
+     */
     std::shared_ptr<NodeObject>
     fetchNodeObject(
         uint256 const& hash,
@@ -128,29 +137,33 @@ public:
         FetchType fetchType = FetchType::Synchronous,
         bool duplicate = false);
 
-    /** Fetch an object without waiting.
-        If I/O is required to determine whether or not the object is present,
-        `false` is returned. Otherwise, `true` is returned and `object` is set
-        to refer to the object, or `nullptr` if the object is not present.
-        If I/O is required, the I/O is scheduled and `true` is returned
-
-        @note This can be called concurrently.
-        @param hash The key of the object to retrieve
-        @param ledgerSeq The sequence of the ledger where the
-                object is stored.
-        @param callback Callback function when read completes
-    */
+    /**
+     * Fetch an object without waiting.
+     * If I/O is required to determine whether or not the object is present,
+     * `false` is returned. Otherwise, `true` is returned and `object` is set
+     * to refer to the object, or `nullptr` if the object is not present.
+     * If I/O is required, the I/O is scheduled and `true` is returned
+     *
+     * @note This can be called concurrently.
+     * @param hash The key of the object to retrieve
+     * @param ledgerSeq The sequence of the ledger where the
+     *         object is stored.
+     * @param callback Callback function when read completes
+     */
     virtual void
     asyncFetch(
         uint256 const& hash,
         std::uint32_t ledgerSeq,
         std::function<void(std::shared_ptr<NodeObject> const&)>&& callback);
 
-    /** Remove expired entries from the positive and negative caches. */
+    /**
+     * Remove expired entries from the positive and negative caches.
+     */
     virtual void
     sweep() = 0;
 
-    /** Gather statistics pertaining to read and write activities.
+    /**
+     * Gather statistics pertaining to read and write activities.
      *
      * @param obj Json object reference into which to place counters.
      */
@@ -187,7 +200,9 @@ public:
     void
     getCountsJson(json::Value& obj);
 
-    /** Returns the number of file descriptors the database expects to need */
+    /**
+     * Returns the number of file descriptors the database expects to need
+     */
     int
     fdRequired() const
     {
@@ -200,7 +215,8 @@ public:
     bool
     isStopping() const;
 
-    /** @return The earliest ledger sequence allowed
+    /**
+     * @return The earliest ledger sequence allowed
      */
     [[nodiscard]] std::uint32_t
     earliestLedgerSeq() const noexcept
@@ -277,13 +293,14 @@ private:
         FetchReport& fetchReport,
         bool duplicate) = 0;
 
-    /** Visit every object in the database
-        This is usually called during import.
-
-        @note This routine will not be called concurrently with itself
-                or other methods.
-        @see import
-    */
+    /**
+     * Visit every object in the database
+     * This is usually called during import.
+     *
+     * @note This routine will not be called concurrently with itself
+     *       or other methods.
+     * @see import
+     */
     virtual void
     forEach(std::function<void(std::shared_ptr<NodeObject>)> f) = 0;
 
diff --git a/include/xrpl/nodestore/DatabaseRotating.h b/include/xrpl/nodestore/DatabaseRotating.h
index 69eb31261d..1c5bb0efaf 100644
--- a/include/xrpl/nodestore/DatabaseRotating.h
+++ b/include/xrpl/nodestore/DatabaseRotating.h
@@ -28,13 +28,14 @@ public:
     {
     }
 
-    /** Rotates the backends.
-
-        @param newBackend New writable backend
-        @param f A function executed after the rotation outside of lock. The
-       values passed to f will be the new backend database names _after_
-       rotation.
-    */
+    /**
+     * Rotates the backends.
+     *
+     * @param newBackend New writable backend
+     * @param f A function executed after the rotation outside of lock. The
+     * values passed to f will be the new backend database names _after_
+     * rotation.
+     */
     virtual void
     rotate(
         std::unique_ptr<NodeStore::Backend>&& newBackend,
diff --git a/include/xrpl/nodestore/DummyScheduler.h b/include/xrpl/nodestore/DummyScheduler.h
index f626115786..49b0d37462 100644
--- a/include/xrpl/nodestore/DummyScheduler.h
+++ b/include/xrpl/nodestore/DummyScheduler.h
@@ -5,7 +5,9 @@
 
 namespace xrpl::NodeStore {
 
-/** Simple NodeStore Scheduler that just performs the tasks synchronously. */
+/**
+ * Simple NodeStore Scheduler that just performs the tasks synchronously.
+ */
 class DummyScheduler : public Scheduler
 {
 public:
diff --git a/include/xrpl/nodestore/Factory.h b/include/xrpl/nodestore/Factory.h
index e79ae3e05d..a18023a8a8 100644
--- a/include/xrpl/nodestore/Factory.h
+++ b/include/xrpl/nodestore/Factory.h
@@ -16,24 +16,29 @@ class Section;
 
 namespace xrpl::NodeStore {
 
-/** Base class for backend factories. */
+/**
+ * Base class for backend factories.
+ */
 class Factory
 {
 public:
     virtual ~Factory() = default;
 
-    /** Retrieve the name of this factory. */
+    /**
+     * Retrieve the name of this factory.
+     */
     [[nodiscard]] virtual std::string
     getName() const = 0;
 
-    /** Create an instance of this factory's backend.
-
-        @param keyBytes The fixed number of bytes per key.
-        @param parameters A set of key/value configuration pairs.
-        @param burstSize Backend burst size in bytes.
-        @param scheduler The scheduler to use for running tasks.
-        @return A pointer to the Backend object.
-    */
+    /**
+     * Create an instance of this factory's backend.
+     *
+     * @param keyBytes The fixed number of bytes per key.
+     * @param parameters A set of key/value configuration pairs.
+     * @param burstSize Backend burst size in bytes.
+     * @param scheduler The scheduler to use for running tasks.
+     * @return A pointer to the Backend object.
+     */
     virtual std::unique_ptr<Backend>
     createInstance(
         size_t keyBytes,
@@ -42,15 +47,16 @@ public:
         Scheduler& scheduler,
         beast::Journal journal) = 0;
 
-    /** Create an instance of this factory's backend.
-
-        @param keyBytes The fixed number of bytes per key.
-        @param parameters A set of key/value configuration pairs.
-        @param burstSize Backend burst size in bytes.
-        @param scheduler The scheduler to use for running tasks.
-        @param context The context used by database.
-        @return A pointer to the Backend object.
-    */
+    /**
+     * Create an instance of this factory's backend.
+     *
+     * @param keyBytes The fixed number of bytes per key.
+     * @param parameters A set of key/value configuration pairs.
+     * @param burstSize Backend burst size in bytes.
+     * @param scheduler The scheduler to use for running tasks.
+     * @param context The context used by database.
+     * @return A pointer to the Backend object.
+     */
     virtual std::unique_ptr<Backend>
     createInstance(
         size_t keyBytes,
diff --git a/include/xrpl/nodestore/Manager.h b/include/xrpl/nodestore/Manager.h
index f813412846..54d99fe94b 100644
--- a/include/xrpl/nodestore/Manager.h
+++ b/include/xrpl/nodestore/Manager.h
@@ -12,7 +12,9 @@
 
 namespace xrpl::NodeStore {
 
-/** Singleton for managing NodeStore factories and back ends. */
+/**
+ * Singleton for managing NodeStore factories and back ends.
+ */
 class Manager
 {
 public:
@@ -22,26 +24,35 @@ public:
     Manager&
     operator=(Manager const&) = delete;
 
-    /** Returns the instance of the manager singleton. */
+    /**
+     * Returns the instance of the manager singleton.
+     */
     static Manager&
     instance();
 
-    /** Add a factory. */
+    /**
+     * Add a factory.
+     */
     virtual void
     insert(Factory& factory) = 0;
 
-    /** Remove a factory. */
+    /**
+     * Remove a factory.
+     */
     virtual void
     erase(Factory& factory) = 0;
 
-    /** Return a pointer to the matching factory if it exists.
-        @param  name The name to match, performed case-insensitive.
-        @return `nullptr` if a match was not found.
-    */
+    /**
+     * Return a pointer to the matching factory if it exists.
+     * @param  name The name to match, performed case-insensitive.
+     * @return `nullptr` if a match was not found.
+     */
     virtual Factory*
     find(std::string const& name) = 0;
 
-    /** Create a backend. */
+    /**
+     * Create a backend.
+     */
     virtual std::unique_ptr<Backend>
     makeBackend(
         Section const& parameters,
@@ -49,34 +60,35 @@ public:
         Scheduler& scheduler,
         beast::Journal journal) = 0;
 
-    /** Construct a NodeStore database.
-
-        The parameters are key value pairs passed to the backend. The
-        'type' key must exist, it defines the choice of backend. Most
-        backends also require a 'path' field.
-
-        Some choices for 'type' are:
-            HyperLevelDB, LevelDBFactory, SQLite, MDB
-
-        If the fastBackendParameter is omitted or empty, no ephemeral database
-        is used. If the scheduler parameter is omitted or unspecified, a
-        synchronous scheduler is used which performs all tasks immediately on
-        the caller's thread.
-
-        @note If the database cannot be opened or created, an exception is
-       thrown.
-
-        @param name A diagnostic label for the database.
-        @param burstSize Backend burst size in bytes.
-        @param scheduler The scheduler to use for performing asynchronous tasks.
-        @param readThreads The number of async read threads to create
-        @param backendParameters The parameter string for the persistent
-       backend.
-        @param fastBackendParameters [optional] The parameter string for the
-       ephemeral backend.
-
-        @return The opened database.
-    */
+    /**
+     * Construct a NodeStore database.
+     *
+     * The parameters are key value pairs passed to the backend. The
+     * 'type' key must exist, it defines the choice of backend. Most
+     * backends also require a 'path' field.
+     *
+     * Some choices for 'type' are:
+     *     HyperLevelDB, LevelDBFactory, SQLite, MDB
+     *
+     * If the fastBackendParameter is omitted or empty, no ephemeral database
+     * is used. If the scheduler parameter is omitted or unspecified, a
+     * synchronous scheduler is used which performs all tasks immediately on
+     * the caller's thread.
+     *
+     * @note If the database cannot be opened or created, an exception is
+     * thrown.
+     *
+     * @param name A diagnostic label for the database.
+     * @param burstSize Backend burst size in bytes.
+     * @param scheduler The scheduler to use for performing asynchronous tasks.
+     * @param readThreads The number of async read threads to create
+     * @param backendParameters The parameter string for the persistent
+     * backend.
+     * @param fastBackendParameters [optional] The parameter string for the
+     * ephemeral backend.
+     *
+     * @return The opened database.
+     */
     virtual std::unique_ptr<Database>
     makeDatabase(
         std::size_t burstSize,
diff --git a/include/xrpl/nodestore/NodeObject.h b/include/xrpl/nodestore/NodeObject.h
index 3f3b75d5f8..b96d65fa12 100644
--- a/include/xrpl/nodestore/NodeObject.h
+++ b/include/xrpl/nodestore/NodeObject.h
@@ -12,7 +12,9 @@
 
 namespace xrpl {
 
-/** The types of node objects. */
+/**
+ * The types of node objects.
+ */
 enum class NodeObjectType : std::uint32_t {
     Unknown = 0,
     Ledger = 1,
@@ -21,15 +23,16 @@ enum class NodeObjectType : std::uint32_t {
     Dummy = 512  // an invalid or missing object
 };
 
-/** A simple object that the Ledger uses to store entries.
-    NodeObjects are comprised of a type, a hash, and a blob.
-    They can be uniquely identified by the hash, which is a half-SHA512 of
-    the blob. The blob is a variable length block of serialized data. The
-    type identifies what the blob contains.
-
-    @note No checking is performed to make sure the hash matches the data.
-    @see SHAMap
-*/
+/**
+ * A simple object that the Ledger uses to store entries.
+ * NodeObjects are comprised of a type, a hash, and a blob.
+ * They can be uniquely identified by the hash, which is a half-SHA512 of
+ * the blob. The blob is a variable length block of serialized data. The
+ * type identifies what the blob contains.
+ *
+ * @note No checking is performed to make sure the hash matches the data.
+ * @see SHAMap
+ */
 class NodeObject : public CountedObject<NodeObject>
 {
 public:
@@ -48,29 +51,36 @@ public:
     // This constructor is private, use createObject instead.
     NodeObject(NodeObjectType type, Blob&& data, uint256 const& hash, PrivateAccess);
 
-    /** Create an object from fields.
-
-        The caller's variable is modified during this call. The
-        underlying storage for the Blob is taken over by the NodeObject.
-
-        @param type The type of object.
-        @param ledgerIndex The ledger in which this object appears.
-        @param data A buffer containing the payload. The caller's variable
-                    is overwritten.
-        @param hash The 256-bit hash of the payload data.
-    */
+    /**
+     * Create an object from fields.
+     *
+     * The caller's variable is modified during this call. The
+     * underlying storage for the Blob is taken over by the NodeObject.
+     *
+     * @param type The type of object.
+     * @param ledgerIndex The ledger in which this object appears.
+     * @param data A buffer containing the payload. The caller's variable
+     *             is overwritten.
+     * @param hash The 256-bit hash of the payload data.
+     */
     static std::shared_ptr<NodeObject>
     createObject(NodeObjectType type, Blob&& data, uint256 const& hash);
 
-    /** Returns the type of this object. */
+    /**
+     * Returns the type of this object.
+     */
     [[nodiscard]] NodeObjectType
     getType() const;
 
-    /** Returns the hash of the data. */
+    /**
+     * Returns the hash of the data.
+     */
     [[nodiscard]] uint256 const&
     getHash() const;
 
-    /** Returns the underlying data. */
+    /**
+     * Returns the underlying data.
+     */
     [[nodiscard]] Blob const&
     getData() const;
 
diff --git a/include/xrpl/nodestore/Scheduler.h b/include/xrpl/nodestore/Scheduler.h
index 588ff19bdc..5d93a80eaa 100644
--- a/include/xrpl/nodestore/Scheduler.h
+++ b/include/xrpl/nodestore/Scheduler.h
@@ -8,7 +8,9 @@ namespace xrpl::NodeStore {
 
 enum class FetchType { Synchronous, Async };
 
-/** Contains information about a fetch operation. */
+/**
+ * Contains information about a fetch operation.
+ */
 struct FetchReport
 {
     explicit FetchReport(FetchType fetchType) : fetchType(fetchType)
@@ -20,7 +22,9 @@ struct FetchReport
     bool wasFound = false;
 };
 
-/** Contains information about a batch write operation. */
+/**
+ * Contains information about a batch write operation.
+ */
 struct BatchWriteReport
 {
     explicit BatchWriteReport() = default;
@@ -29,36 +33,40 @@ struct BatchWriteReport
     int writeCount;
 };
 
-/** Scheduling for asynchronous backend activity
-
-    For improved performance, a backend has the option of performing writes
-    in batches. These writes can be scheduled using the provided scheduler
-    object.
-
-    @see BatchWriter
-*/
+/**
+ * Scheduling for asynchronous backend activity
+ *
+ * For improved performance, a backend has the option of performing writes
+ * in batches. These writes can be scheduled using the provided scheduler
+ * object.
+ *
+ * @see BatchWriter
+ */
 class Scheduler
 {
 public:
     virtual ~Scheduler() = default;
 
-    /** Schedules a task.
-        Depending on the implementation, the task may be invoked either on
-        the current thread of execution, or an unspecified
-       implementation-defined foreign thread.
-    */
+    /**
+     * Schedules a task.
+     *  Depending on the implementation, the task may be invoked either on
+     *  the current thread of execution, or an unspecified
+     * implementation-defined foreign thread.
+     */
     virtual void
     scheduleTask(Task& task) = 0;
 
-    /** Reports completion of a fetch
-        Allows the scheduler to monitor the node store's performance
-    */
+    /**
+     * Reports completion of a fetch
+     * Allows the scheduler to monitor the node store's performance
+     */
     virtual void
     onFetch(FetchReport const& report) = 0;
 
-    /** Reports the completion of a batch write
-        Allows the scheduler to monitor the node store's performance
-    */
+    /**
+     * Reports the completion of a batch write
+     * Allows the scheduler to monitor the node store's performance
+     */
     virtual void
     onBatchWrite(BatchWriteReport const& report) = 0;
 };
diff --git a/include/xrpl/nodestore/Task.h b/include/xrpl/nodestore/Task.h
index 0695970a68..59fe648476 100644
--- a/include/xrpl/nodestore/Task.h
+++ b/include/xrpl/nodestore/Task.h
@@ -2,14 +2,17 @@
 
 namespace xrpl::NodeStore {
 
-/** Derived classes perform scheduled tasks. */
+/**
+ * Derived classes perform scheduled tasks.
+ */
 struct Task
 {
     virtual ~Task() = default;
 
-    /** Performs the task.
-        The call may take place on a foreign thread.
-    */
+    /**
+     * Performs the task.
+     * The call may take place on a foreign thread.
+     */
     virtual void
     performScheduledTask() = 0;
 };
diff --git a/include/xrpl/nodestore/Types.h b/include/xrpl/nodestore/Types.h
index eaee82c99e..872d948a36 100644
--- a/include/xrpl/nodestore/Types.h
+++ b/include/xrpl/nodestore/Types.h
@@ -18,7 +18,9 @@ static constexpr auto kBatchWritePreallocationSize = 256;
 //
 static constexpr auto kBatchWriteLimitSize = 65536;
 
-/** Return codes from Backend operations. */
+/**
+ * Return codes from Backend operations.
+ */
 enum class Status {
     Ok = 0,
     NotFound = 1,
@@ -29,7 +31,9 @@ enum class Status {
     CustomCode = 100
 };
 
-/** A batch of NodeObjects to write at once. */
+/**
+ * A batch of NodeObjects to write at once.
+ */
 using Batch = std::vector<std::shared_ptr<NodeObject>>;
 
 }  // namespace xrpl::NodeStore
diff --git a/include/xrpl/nodestore/detail/BatchWriter.h b/include/xrpl/nodestore/detail/BatchWriter.h
index 7fa23bcb3e..b89df0da14 100644
--- a/include/xrpl/nodestore/detail/BatchWriter.h
+++ b/include/xrpl/nodestore/detail/BatchWriter.h
@@ -11,18 +11,21 @@
 
 namespace xrpl::NodeStore {
 
-/** Batch-writing assist logic.
-
-    The batch writes are performed with a scheduled task. Use of the
-    class it not required. A backend can implement its own write batching,
-    or skip write batching if doing so yields a performance benefit.
-
-    @see Scheduler
-*/
+/**
+ * Batch-writing assist logic.
+ *
+ * The batch writes are performed with a scheduled task. Use of the
+ * class it not required. A backend can implement its own write batching,
+ * or skip write batching if doing so yields a performance benefit.
+ *
+ * @see Scheduler
+ */
 class BatchWriter : private Task
 {
 public:
-    /** This callback does the actual writing. */
+    /**
+     * This callback does the actual writing.
+     */
     struct Callback
     {
         virtual ~Callback() = default;
@@ -35,24 +38,30 @@ public:
         writeBatch(Batch const& batch) = 0;
     };
 
-    /** Create a batch writer. */
+    /**
+     * Create a batch writer.
+     */
     BatchWriter(Callback& callback, Scheduler& scheduler);
 
-    /** Destroy a batch writer.
-
-        Anything pending in the batch is written out before this returns.
-    */
+    /**
+     * Destroy a batch writer.
+     *
+     * Anything pending in the batch is written out before this returns.
+     */
     ~BatchWriter() override;
 
-    /** Store the object.
-
-        This will add to the batch and initiate a scheduled task to
-        write the batch out.
-    */
+    /**
+     * Store the object.
+     *
+     * This will add to the batch and initiate a scheduled task to
+     * write the batch out.
+     */
     void
     store(std::shared_ptr<NodeObject> const& object);
 
-    /** Get an estimate of the amount of writing I/O pending. */
+    /**
+     * Get an estimate of the amount of writing I/O pending.
+     */
     int
     getWriteLoad();
 
diff --git a/include/xrpl/nodestore/detail/DecodedBlob.h b/include/xrpl/nodestore/detail/DecodedBlob.h
index 02ccd5787a..d0cc5e3404 100644
--- a/include/xrpl/nodestore/detail/DecodedBlob.h
+++ b/include/xrpl/nodestore/detail/DecodedBlob.h
@@ -6,30 +6,37 @@
 
 namespace xrpl::NodeStore {
 
-/** Parsed key/value blob into NodeObject components.
-
-    This will extract the information required to construct a NodeObject. It
-    also does consistency checking and returns the result, so it is possible
-    to determine if the data is corrupted without throwing an exception. Not
-    all forms of corruption are detected so further analysis will be needed
-    to eliminate false negatives.
-
-    @note This defines the database format of a NodeObject!
-*/
+/**
+ * Parsed key/value blob into NodeObject components.
+ *
+ * This will extract the information required to construct a NodeObject. It
+ * also does consistency checking and returns the result, so it is possible
+ * to determine if the data is corrupted without throwing an exception. Not
+ * all forms of corruption are detected so further analysis will be needed
+ * to eliminate false negatives.
+ *
+ * @note This defines the database format of a NodeObject!
+ */
 class DecodedBlob
 {
 public:
-    /** Construct the decoded blob from raw data. */
+    /**
+     * Construct the decoded blob from raw data.
+     */
     DecodedBlob(void const* key, void const* value, int valueBytes);
 
-    /** Determine if the decoding was successful. */
+    /**
+     * Determine if the decoding was successful.
+     */
     [[nodiscard]] bool
     wasOk() const noexcept
     {
         return success_;
     }
 
-    /** Create a NodeObject from this data. */
+    /**
+     * Create a NodeObject from this data.
+     */
     std::shared_ptr<NodeObject>
     createObject();
 
diff --git a/include/xrpl/nodestore/detail/EncodedBlob.h b/include/xrpl/nodestore/detail/EncodedBlob.h
index 3982ab1b95..d668cdccd8 100644
--- a/include/xrpl/nodestore/detail/EncodedBlob.h
+++ b/include/xrpl/nodestore/detail/EncodedBlob.h
@@ -14,47 +14,54 @@
 
 namespace xrpl::NodeStore {
 
-/** Convert a NodeObject from in-memory to database format.
-
-    The (suboptimal) database format consists of:
-
-    - 8 prefix bytes which will typically be 0, but don't assume that's the
-      case; earlier versions of the code would use these bytes to store the
-      ledger index either once or twice.
-    - A single byte denoting the type of the object.
-    - The payload.
-
-    @note This class is typically instantiated on the stack, so the size of
-          the object does not matter as much as it normally would since the
-          allocation is, effectively, free.
-
-          We leverage that fact to preallocate enough memory to handle most
-          payloads as part of this object, eliminating the need for dynamic
-          allocation. As of this writing ~94% of objects require fewer than
-          1024 payload bytes.
+/**
+ * Convert a NodeObject from in-memory to database format.
+ *
+ * The (suboptimal) database format consists of:
+ *
+ * - 8 prefix bytes which will typically be 0, but don't assume that's the
+ *   case; earlier versions of the code would use these bytes to store the
+ *   ledger index either once or twice.
+ * - A single byte denoting the type of the object.
+ * - The payload.
+ *
+ * @note This class is typically instantiated on the stack, so the size of
+ *       the object does not matter as much as it normally would since the
+ *       allocation is, effectively, free.
+ *
+ *       We leverage that fact to preallocate enough memory to handle most
+ *       payloads as part of this object, eliminating the need for dynamic
+ *       allocation. As of this writing ~94% of objects require fewer than
+ *       1024 payload bytes.
  */
 
 class EncodedBlob
 {
-    /** The 32-byte key of the serialized object. */
+    /**
+     * The 32-byte key of the serialized object.
+     */
     std::array<std::uint8_t, 32> key_{};
 
-    /** A pre-allocated buffer for the serialized object.
-
-         The buffer is large enough for the 9 byte prefix and at least
-         1024 more bytes. The precise size is calculated automatically
-         at compile time so as to avoid wasting space on padding bytes.
+    /**
+     * A pre-allocated buffer for the serialized object.
+     *
+     * The buffer is large enough for the 9 byte prefix and at least
+     * 1024 more bytes. The precise size is calculated automatically
+     * at compile time so as to avoid wasting space on padding bytes.
      */
     std::array<std::uint8_t, boost::alignment::align_up(9 + 1024, alignof(std::uint32_t))>
         payload_{};
 
-    /** The size of the serialized data. */
+    /**
+     * The size of the serialized data.
+     */
     std::uint32_t size_;
 
-    /** A pointer to the serialized data.
-
-        This may point to the pre-allocated buffer (if it is sufficiently
-        large) or to a dynamically allocated buffer.
+    /**
+     * A pointer to the serialized data.
+     *
+     * This may point to the pre-allocated buffer (if it is sufficiently
+     * large) or to a dynamically allocated buffer.
      */
     std::uint8_t* const ptr_;
 
diff --git a/include/xrpl/protocol/AMMCore.h b/include/xrpl/protocol/AMMCore.h
index c4fccd029a..a3666c7960 100644
--- a/include/xrpl/protocol/AMMCore.h
+++ b/include/xrpl/protocol/AMMCore.h
@@ -33,17 +33,20 @@ class STObject;
 class STAmount;
 class Rules;
 
-/** Calculate Liquidity Provider Token (LPT) Currency.
+/**
+ * Calculate Liquidity Provider Token (LPT) Currency.
  */
 Currency
 ammLPTCurrency(Asset const& asset1, Asset const& asset2);
 
-/** Calculate LPT Issue from AMM asset pair.
+/**
+ * Calculate LPT Issue from AMM asset pair.
  */
 Issue
 ammLPTIssue(Asset const& asset1, Asset const& asset2, AccountID const& ammAccountID);
 
-/** Validate the amount.
+/**
+ * Validate the amount.
  * If validZero is false and amount is beast::zero then invalid amount.
  * Return error code if invalid amount.
  * If pair then validate amount's issue matches one of the pair's issue.
@@ -65,17 +68,20 @@ invalidAMMAssetPair(
     Asset const& asset2,
     std::optional<std::pair<Asset, Asset>> const& pair = std::nullopt);
 
-/** Get time slot of the auction slot.
+/**
+ * Get time slot of the auction slot.
  */
 std::optional<std::uint8_t>
 ammAuctionTimeSlot(std::uint64_t current, STObject const& auctionSlot);
 
-/** Return true if required AMM amendment is enabled
+/**
+ * Return true if required AMM amendment is enabled
  */
 bool
 ammEnabled(Rules const&);
 
-/** Convert to the fee from the basis points
+/**
+ * Convert to the fee from the basis points
  * @param tfee  trading fee in {0, 1000}
  * 1 = 1/10bps or 0.001%, 1000 = 1%
  */
@@ -85,7 +91,8 @@ getFee(std::uint16_t tfee)
     return Number{tfee} / kAuctionSlotFeeScaleFactor;
 }
 
-/** Get fee multiplier (1 - tfee)
+/**
+ * Get fee multiplier (1 - tfee)
  * @tfee trading fee in basis points
  */
 inline Number
@@ -94,7 +101,8 @@ feeMult(std::uint16_t tfee)
     return 1 - getFee(tfee);
 }
 
-/** Get fee multiplier (1 - tfee / 2)
+/**
+ * Get fee multiplier (1 - tfee / 2)
  * @tfee trading fee in basis points
  */
 inline Number
diff --git a/include/xrpl/protocol/AccountID.h b/include/xrpl/protocol/AccountID.h
index a7d49246ca..ab3c5a996b 100644
--- a/include/xrpl/protocol/AccountID.h
+++ b/include/xrpl/protocol/AccountID.h
@@ -28,43 +28,53 @@ public:
 
 }  // namespace detail
 
-/** A 160-bit unsigned that uniquely identifies an account. */
+/**
+ * A 160-bit unsigned that uniquely identifies an account.
+ */
 using AccountID = BaseUInt<160, detail::AccountIDTag>;
 
-/** Convert AccountID to base58 checked string */
+/**
+ * Convert AccountID to base58 checked string
+ */
 std::string
 toBase58(AccountID const& v);
 
-/** Parse AccountID from checked, base58 string.
-    @return std::nullopt if a parse error occurs
-*/
+/**
+ * Parse AccountID from checked, base58 string.
+ * @return std::nullopt if a parse error occurs
+ */
 template <>
 std::optional<AccountID>
 parseBase58(std::string const& s);
 
-/** Compute AccountID from public key.
-
-    The account ID is computed as the 160-bit hash of the
-    public key data. This excludes the version byte and
-    guard bytes included in the base58 representation.
-
-*/
+/**
+ * Compute AccountID from public key.
+ *
+ * The account ID is computed as the 160-bit hash of the
+ * public key data. This excludes the version byte and
+ * guard bytes included in the base58 representation.
+ */
 // VFALCO In PublicKey.h for now
 // AccountID
 // calcAccountID (PublicKey const& pk);
 
-/** A special account that's used as the "issuer" for XRP. */
+/**
+ * A special account that's used as the "issuer" for XRP.
+ */
 AccountID const&
 xrpAccount();
 
-/** A placeholder for empty accounts. */
+/**
+ * A placeholder for empty accounts.
+ */
 AccountID const&
 noAccount();
 
-/** Convert hex or base58 string to AccountID.
-
-    @return `true` if the parsing was successful.
-*/
+/**
+ * Convert hex or base58 string to AccountID.
+ *
+ * @return `true` if the parsing was successful.
+ */
 // DEPRECATED
 bool
 toIssuer(AccountID&, std::string const&);
@@ -91,17 +101,18 @@ operator<<(std::ostream& os, AccountID const& x)
     return os;
 }
 
-/** Initialize the global cache used to map AccountID to base58 conversions.
-
-    The cache is optional and need not be initialized. But because conversion
-    is expensive (it requires a SHA-256 operation) in most cases the overhead
-    of the cache is worth the benefit.
-
-    @param count The number of entries the cache should accommodate. Zero will
-                 disable the cache, releasing any memory associated with it.
-
-    @note The function will only initialize the cache the first time it is
-          invoked. Subsequent invocations do nothing.
+/**
+ * Initialize the global cache used to map AccountID to base58 conversions.
+ *
+ * The cache is optional and need not be initialized. But because conversion
+ * is expensive (it requires a SHA-256 operation) in most cases the overhead
+ * of the cache is worth the benefit.
+ *
+ * @param count The number of entries the cache should accommodate. Zero will
+ *              disable the cache, releasing any memory associated with it.
+ *
+ * @note The function will only initialize the cache the first time it is
+ *       invoked. Subsequent invocations do nothing.
  */
 void
 initAccountIdCache(std::size_t count);
diff --git a/include/xrpl/protocol/Asset.h b/include/xrpl/protocol/Asset.h
index 2bf24b19fe..8e9c09eb89 100644
--- a/include/xrpl/protocol/Asset.h
+++ b/include/xrpl/protocol/Asset.h
@@ -62,7 +62,8 @@ private:
 public:
     Asset() = default;
 
-    /** Conversions to Asset are implicit and conversions to specific issue
+    /**
+     * Conversions to Asset are implicit and conversions to specific issue
      *  type are explicit. This design facilitates the use of Asset.
      */
     Asset(Issue const& issue) : issue_(issue)
@@ -149,7 +150,8 @@ public:
     friend constexpr bool
     operator==(BadAsset const& lhs, Asset const& rhs);
 
-    /** Return true if both assets refer to the same currency (regardless of
+    /**
+     * Return true if both assets refer to the same currency (regardless of
      * issuer) or MPT issuance. Otherwise return false.
      */
     friend constexpr bool
diff --git a/include/xrpl/protocol/Book.h b/include/xrpl/protocol/Book.h
index 92d1353929..a83eb41b24 100644
--- a/include/xrpl/protocol/Book.h
+++ b/include/xrpl/protocol/Book.h
@@ -19,10 +19,11 @@
 
 namespace xrpl {
 
-/** Specifies an order book.
-    The order book is a pair of Issues called in and out.
-    @see Issue.
-*/
+/**
+ * Specifies an order book.
+ * The order book is a pair of Issues called in and out.
+ * @see Issue.
+ */
 class Book final : public CountedObject<Book>
 {
 public:
@@ -60,7 +61,9 @@ hash_append(Hasher& h, Book const& b)
 Book
 reversed(Book const& book);
 
-/** Equality comparison. */
+/**
+ * Equality comparison.
+ */
 /** @{ */
 [[nodiscard]] constexpr bool
 operator==(Book const& lhs, Book const& rhs)
@@ -69,7 +72,9 @@ operator==(Book const& lhs, Book const& rhs)
 }
 /** @} */
 
-/** Strict weak ordering. */
+/**
+ * Strict weak ordering.
+ */
 /** @{ */
 [[nodiscard]] constexpr std::weak_ordering
 operator<=>(Book const& lhs, Book const& rhs)
diff --git a/include/xrpl/protocol/BuildInfo.h b/include/xrpl/protocol/BuildInfo.h
index a60c37e714..18ba20f23c 100644
--- a/include/xrpl/protocol/BuildInfo.h
+++ b/include/xrpl/protocol/BuildInfo.h
@@ -4,74 +4,83 @@
 #include <string>
 #include <string_view>
 
-/** Versioning information for this build. */
+/**
+ * Versioning information for this build.
+ */
 // VFALCO The namespace is deprecated
 namespace xrpl::BuildInfo {
 
-/** Server version.
-    Follows the Semantic Versioning Specification:
-    http://semver.org/
-*/
+/**
+ * Server version.
+ * Follows the Semantic Versioning Specification:
+ * http://semver.org/
+ */
 std::string const&
 getVersionString();
 
-/** Full server version string.
-    This includes the name of the server. It is used in the peer
-    protocol hello message and also the headers of some HTTP replies.
-*/
+/**
+ * Full server version string.
+ * This includes the name of the server. It is used in the peer
+ * protocol hello message and also the headers of some HTTP replies.
+ */
 std::string const&
 getFullVersionString();
 
-/** Encode an arbitrary server software version in a 64-bit integer.
-
-    The general format is:
-
-    ........-........-........-........-........-........-........-........
-    XXXXXXXX-XXXXXXXX-YYYYYYYY-YYYYYYYY-YYYYYYYY-YYYYYYYY-YYYYYYYY-YYYYYYYY
-
-    X: 16 bits identifying the particular implementation
-    Y: 48 bits of data specific to the implementation
-
-    The xrpld-specific format (implementation ID is: 0x18 0x3B) is:
-
-    00011000-00111011-MMMMMMMM-mmmmmmmm-pppppppp-TTNNNNNN-00000000-00000000
-
-        M: 8-bit major version (0-255)
-        m: 8-bit minor version (0-255)
-        p: 8-bit patch version (0-255)
-        T: 11 if neither an RC nor a beta
-           10 if an RC
-           01 if a beta
-        N: 6-bit rc/beta number (1-63)
-
-    @param the version string
-    @return the encoded version in a 64-bit integer
-*/
+/**
+ * Encode an arbitrary server software version in a 64-bit integer.
+ *
+ * The general format is:
+ *
+ * ........-........-........-........-........-........-........-........
+ * XXXXXXXX-XXXXXXXX-YYYYYYYY-YYYYYYYY-YYYYYYYY-YYYYYYYY-YYYYYYYY-YYYYYYYY
+ *
+ * X: 16 bits identifying the particular implementation
+ * Y: 48 bits of data specific to the implementation
+ *
+ * The xrpld-specific format (implementation ID is: 0x18 0x3B) is:
+ *
+ * 00011000-00111011-MMMMMMMM-mmmmmmmm-pppppppp-TTNNNNNN-00000000-00000000
+ *
+ *     M: 8-bit major version (0-255)
+ *     m: 8-bit minor version (0-255)
+ *     p: 8-bit patch version (0-255)
+ *     T: 11 if neither an RC nor a beta
+ *        10 if an RC
+ *        01 if a beta
+ *     N: 6-bit rc/beta number (1-63)
+ *
+ * @param the version string
+ * @return the encoded version in a 64-bit integer
+ */
 std::uint64_t
 encodeSoftwareVersion(std::string_view versionStr);
 
-/** Returns this server's version packed in a 64-bit integer. */
+/**
+ * Returns this server's version packed in a 64-bit integer.
+ */
 std::uint64_t
 getEncodedVersion();
 
-/** Check if the encoded software version is an xrpld software version.
-
-    @param version another node's encoded software version
-    @return true if the version is an xrpld software version, false otherwise
-*/
+/**
+ * Check if the encoded software version is an xrpld software version.
+ *
+ * @param version another node's encoded software version
+ * @return true if the version is an xrpld software version, false otherwise
+ */
 bool
 isXrpldVersion(std::uint64_t version);
 
-/** Check if the version is newer than the local node's xrpld software
-    version.
-
-    @param version another node's encoded software version
-    @return true if the version is newer than the local node's xrpld software
-        version, false otherwise.
-
-    @note This function only understands version numbers that are generated by
-        xrpld. Please see the encodeSoftwareVersion() function for detail.
-*/
+/**
+ * Check if the version is newer than the local node's xrpld software
+ * version.
+ *
+ * @param version another node's encoded software version
+ * @return true if the version is newer than the local node's xrpld software
+ *     version, false otherwise.
+ *
+ * @note This function only understands version numbers that are generated by
+ *     xrpld. Please see the encodeSoftwareVersion() function for detail.
+ */
 bool
 isNewerVersion(std::uint64_t version);
 
diff --git a/include/xrpl/protocol/ConfidentialTransfer.h b/include/xrpl/protocol/ConfidentialTransfer.h
index 325117eed4..ecf7970aba 100644
--- a/include/xrpl/protocol/ConfidentialTransfer.h
+++ b/include/xrpl/protocol/ConfidentialTransfer.h
@@ -28,7 +28,9 @@ namespace xrpl {
  */
 struct ConfidentialRecipient
 {
-    /** @brief The recipient's ElGamal public key (size=xrpl::kEcPubKeyLength). */
+    /**
+     * @brief The recipient's ElGamal public key (size=xrpl::kEcPubKeyLength).
+     */
     Slice publicKey;
 
     /**
@@ -44,10 +46,14 @@ struct ConfidentialRecipient
  */
 struct EcPair
 {
-    /** @brief First ElGamal ciphertext component. */
+    /**
+     * @brief First ElGamal ciphertext component.
+     */
     secp256k1_pubkey c1;
 
-    /** @brief Second ElGamal ciphertext component. */
+    /**
+     * @brief Second ElGamal ciphertext component.
+     */
     secp256k1_pubkey c2;
 };
 
diff --git a/include/xrpl/protocol/ErrorCodes.h b/include/xrpl/protocol/ErrorCodes.h
index 38b8bc6d76..8ac7c8c58f 100644
--- a/include/xrpl/protocol/ErrorCodes.h
+++ b/include/xrpl/protocol/ErrorCodes.h
@@ -147,10 +147,11 @@ enum ErrorCodeI {
     RpcLast = RpcUnexpectedLedgerType  // rpcLAST should always equal the last code.
 };
 
-/** Codes returned in the `warnings` array of certain RPC commands.
-
-    These values need to remain stable.
-*/
+/**
+ * Codes returned in the `warnings` array of certain RPC commands.
+ *
+ * These values need to remain stable.
+ */
 // Protocol-wide, 50+ files
 // NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
 enum WarningCodeI {
@@ -168,7 +169,9 @@ enum WarningCodeI {
 
 namespace RPC {
 
-/** Maps an rpc error code to its token, default message, and HTTP status. */
+/**
+ * Maps an rpc error code to its token, default message, and HTTP status.
+ */
 struct ErrorInfo
 {
     // Default ctor needed to produce an empty std::array during constexpr eval.
@@ -193,11 +196,15 @@ struct ErrorInfo
     int httpStatus;
 };
 
-/** Returns an ErrorInfo that reflects the error code. */
+/**
+ * Returns an ErrorInfo that reflects the error code.
+ */
 ErrorInfo const&
 getErrorInfo(ErrorCodeI code);
 
-/** Add or update the json update to reflect the error code. */
+/**
+ * Add or update the json update to reflect the error code.
+ */
 /** @{ */
 void
 injectError(ErrorCodeI code, json::Value& json);
@@ -206,7 +213,9 @@ void
 injectError(ErrorCodeI code, std::string const& message, json::Value& json);
 /** @} */
 
-/** Returns a new json object that reflects the error code. */
+/**
+ * Returns a new json object that reflects the error code.
+ */
 /** @{ */
 json::Value
 makeError(ErrorCodeI code);
@@ -214,7 +223,9 @@ json::Value
 makeError(ErrorCodeI code, std::string const& message);
 /** @} */
 
-/** Returns a new json object that indicates invalid parameters. */
+/**
+ * Returns a new json object that indicates invalid parameters.
+ */
 /** @{ */
 inline json::Value
 makeParamError(std::string const& message)
@@ -314,17 +325,23 @@ notValidatorError()
 
 /** @} */
 
-/** Returns `true` if the json contains an rpc error specification. */
+/**
+ * Returns `true` if the json contains an rpc error specification.
+ */
 bool
 containsError(json::Value const& json);
 
-/** Returns http status that corresponds to the error code. */
+/**
+ * Returns http status that corresponds to the error code.
+ */
 int
 errorCodeHttpStatus(ErrorCodeI code);
 
 }  // namespace RPC
 
-/** Returns a single string with the contents of an RPC error. */
+/**
+ * Returns a single string with the contents of an RPC error.
+ */
 std::string
 rpcErrorString(json::Value const& jv);
 
diff --git a/include/xrpl/protocol/Feature.h b/include/xrpl/protocol/Feature.h
index 927fde542a..f15b7e2d3f 100644
--- a/include/xrpl/protocol/Feature.h
+++ b/include/xrpl/protocol/Feature.h
@@ -112,7 +112,9 @@ validFeatureName(auto fn) -> bool
 enum class VoteBehavior : int { Obsolete = -1, DefaultNo = 0, DefaultYes = 1 };
 enum class AmendmentSupport : int { Retired = -1, Supported = 0, Unsupported = 1 };
 
-/** All amendments libxrpl knows about. */
+/**
+ * All amendments libxrpl knows about.
+ */
 std::map<std::string, AmendmentSupport> const&
 allAmendments();
 
@@ -152,23 +154,27 @@ static constexpr std::size_t kNumFeatures =
 #undef XRPL_FEATURE
 #pragma pop_macro("XRPL_FEATURE")
 
-/** Amendments that this server supports and the default voting behavior.
-   Whether they are enabled depends on the Rules defined in the validated
-   ledger */
+/**
+ * Amendments that this server supports and the default voting behavior.
+ * Whether they are enabled depends on the Rules defined in the validated
+ * ledger
+ */
 std::map<std::string, VoteBehavior> const&
 supportedAmendments();
 
-/** Amendments that this server won't vote for by default.
-
-    This function is only used in unit tests.
-*/
+/**
+ * Amendments that this server won't vote for by default.
+ *
+ * This function is only used in unit tests.
+ */
 std::size_t
 numDownVotedAmendments();
 
-/** Amendments that this server will vote for by default.
-
-    This function is only used in unit tests.
-*/
+/**
+ * Amendments that this server will vote for by default.
+ *
+ * This function is only used in unit tests.
+ */
 std::size_t
 numUpVotedAmendments();
 
diff --git a/include/xrpl/protocol/Fees.h b/include/xrpl/protocol/Fees.h
index 2f9159cd9b..fdfadcd8fd 100644
--- a/include/xrpl/protocol/Fees.h
+++ b/include/xrpl/protocol/Fees.h
@@ -10,20 +10,27 @@ namespace xrpl {
 // This was the reference fee units used in the old fee calculation.
 inline constexpr std::uint32_t kFeeUnitsDeprecated = 10;
 
-/** Reflects the fee settings for a particular ledger.
-
-    The fees are always the same for any transactions applied
-    to a ledger. Changes to fees occur in between ledgers.
-*/
+/**
+ * Reflects the fee settings for a particular ledger.
+ *
+ * The fees are always the same for any transactions applied
+ * to a ledger. Changes to fees occur in between ledgers.
+ */
 struct Fees
 {
-    /** @brief Cost of a reference transaction in drops. */
+    /**
+     * @brief Cost of a reference transaction in drops.
+     */
     XRPAmount base{0};
 
-    /** @brief Minimum XRP an account must hold to exist on the ledger. */
+    /**
+     * @brief Minimum XRP an account must hold to exist on the ledger.
+     */
     XRPAmount reserve{0};
 
-    /** @brief Additional XRP reserve required per owned ledger object. */
+    /**
+     * @brief Additional XRP reserve required per owned ledger object.
+     */
     XRPAmount increment{0};
 
     explicit Fees() = default;
@@ -36,11 +43,12 @@ struct Fees
     {
     }
 
-    /** Returns the account reserve given the owner count, in drops.
-
-        The reserve is calculated as the reserve base times the number of accounts plus the reserve
-        increment times the number of increments.
-    */
+    /**
+     * Returns the account reserve given the owner count, in drops.
+     *
+     * The reserve is calculated as the reserve base times the number of accounts plus the reserve
+     * increment times the number of increments.
+     */
     [[nodiscard]] XRPAmount
     accountReserve(std::uint32_t ownerCount, std::uint32_t accountCount) const
     {
diff --git a/include/xrpl/protocol/HashPrefix.h b/include/xrpl/protocol/HashPrefix.h
index 1b05d450a1..9d4471d05c 100644
--- a/include/xrpl/protocol/HashPrefix.h
+++ b/include/xrpl/protocol/HashPrefix.h
@@ -17,55 +17,80 @@ makeHashPrefix(char a, char b, char c)
 
 }  // namespace detail
 
-/** Prefix for hashing functions.
-
-    These prefixes are inserted before the source material used to generate
-    various hashes. This is done to put each hash in its own "space." This way,
-    two different types of objects with the same binary data will produce
-    different hashes.
-
-    Each prefix is a 4-byte value with the last byte set to zero and the first
-    three bytes formed from the ASCII equivalent of some arbitrary string. For
-    example "TXN".
-
-    @note Hash prefixes are part of the protocol; you cannot, arbitrarily,
-          change the type or the value of any of these without causing breakage.
-*/
+/**
+ * Prefix for hashing functions.
+ *
+ * These prefixes are inserted before the source material used to generate
+ * various hashes. This is done to put each hash in its own "space." This way,
+ * two different types of objects with the same binary data will produce
+ * different hashes.
+ *
+ * Each prefix is a 4-byte value with the last byte set to zero and the first
+ * three bytes formed from the ASCII equivalent of some arbitrary string. For
+ * example "TXN".
+ *
+ * @note Hash prefixes are part of the protocol; you cannot, arbitrarily,
+ *       change the type or the value of any of these without causing breakage.
+ */
 enum class HashPrefix : std::uint32_t {
-    /** transaction plus signature to give transaction ID */
+    /**
+     * transaction plus signature to give transaction ID
+     */
     TransactionId = detail::makeHashPrefix('T', 'X', 'N'),
 
-    /** transaction plus metadata */
+    /**
+     * transaction plus metadata
+     */
     TxNode = detail::makeHashPrefix('S', 'N', 'D'),
 
-    /** account state */
+    /**
+     * account state
+     */
     LeafNode = detail::makeHashPrefix('M', 'L', 'N'),
 
-    /** inner node in V1 tree */
+    /**
+     * inner node in V1 tree
+     */
     InnerNode = detail::makeHashPrefix('M', 'I', 'N'),
 
-    /** ledger master data for signing */
+    /**
+     * ledger master data for signing
+     */
     LedgerMaster = detail::makeHashPrefix('L', 'W', 'R'),
 
-    /** inner transaction to sign */
+    /**
+     * inner transaction to sign
+     */
     TxSign = detail::makeHashPrefix('S', 'T', 'X'),
 
-    /** inner transaction to multi-sign */
+    /**
+     * inner transaction to multi-sign
+     */
     TxMultiSign = detail::makeHashPrefix('S', 'M', 'T'),
 
-    /** validation for signing */
+    /**
+     * validation for signing
+     */
     Validation = detail::makeHashPrefix('V', 'A', 'L'),
 
-    /** proposal for signing */
+    /**
+     * proposal for signing
+     */
     Proposal = detail::makeHashPrefix('P', 'R', 'P'),
 
-    /** Manifest */
+    /**
+     * Manifest
+     */
     Manifest = detail::makeHashPrefix('M', 'A', 'N'),
 
-    /** Payment Channel Claim */
+    /**
+     * Payment Channel Claim
+     */
     PaymentChannelClaim = detail::makeHashPrefix('C', 'L', 'M'),
 
-    /** Batch */
+    /**
+     * Batch
+     */
     Batch = detail::makeHashPrefix('B', 'C', 'H'),
 };
 
diff --git a/include/xrpl/protocol/IOUAmount.h b/include/xrpl/protocol/IOUAmount.h
index 186ce054f1..060ad3d828 100644
--- a/include/xrpl/protocol/IOUAmount.h
+++ b/include/xrpl/protocol/IOUAmount.h
@@ -11,16 +11,17 @@
 
 namespace xrpl {
 
-/** Floating point representation of amounts with high dynamic range
-
-    Amounts are stored as a normalized signed mantissa and an exponent. The
-    range of the normalized exponent is [-96,80] and the range of the absolute
-    value of the normalized mantissa is [1000000000000000, 9999999999999999].
-
-    Arithmetic operations can throw std::overflow_error during normalization
-    if the amount exceeds the largest representable amount, but underflows
-    will silently truncate to zero.
-*/
+/**
+ * Floating point representation of amounts with high dynamic range
+ *
+ * Amounts are stored as a normalized signed mantissa and an exponent. The
+ * range of the normalized exponent is [-96,80] and the range of the absolute
+ * value of the normalized mantissa is [1000000000000000, 9999999999999999].
+ *
+ * Arithmetic operations can throw std::overflow_error during normalization
+ * if the amount exceeds the largest representable amount, but underflows
+ * will silently truncate to zero.
+ */
 class IOUAmount : private boost::totally_ordered<IOUAmount>, private boost::additive<IOUAmount>
 {
 private:
@@ -29,12 +30,13 @@ private:
     mantissa_type mantissa_{};
     exponent_type exponent_{};
 
-    /** Adjusts the mantissa and exponent to the proper range.
-
-        This can throw if the amount cannot be normalized, or is larger than
-        the largest value that can be represented as an IOU amount. Amounts
-        that are too small to be represented normalize to 0.
-    */
+    /**
+     * Adjusts the mantissa and exponent to the proper range.
+     *
+     * This can throw if the amount cannot be normalized, or is larger than
+     * the largest value that can be represented as an IOU amount. Amounts
+     * that are too small to be represented normalize to 0.
+     */
     void
     normalize();
 
@@ -66,11 +68,15 @@ public:
     bool
     operator<(IOUAmount const& other) const;
 
-    /** Returns true if the amount is not zero */
+    /**
+     * Returns true if the amount is not zero
+     */
     explicit
     operator bool() const noexcept;
 
-    /** Return the sign of the amount */
+    /**
+     * Return the sign of the amount
+     */
     [[nodiscard]] int
     signum() const noexcept;
 
diff --git a/include/xrpl/protocol/Indexes.h b/include/xrpl/protocol/Indexes.h
index 79ecd05ad5..5a76119649 100644
--- a/include/xrpl/protocol/Indexes.h
+++ b/include/xrpl/protocol/Indexes.h
@@ -24,74 +24,90 @@
 namespace xrpl {
 
 class SeqProxy;
-/** Keylet computation functions.
-
-    Entries in the ledger are located using 256-bit locators. The locators are
-    calculated using a wide range of parameters specific to the entry whose
-    locator we are calculating (e.g. an account's locator is derived from the
-    account's address, whereas the locator for an offer is derived from the
-    account and the offer sequence.)
-
-    To enhance type safety during lookup and make the code more robust, we use
-    keylets, which contain not only the locator of the object but also the type
-    of the object being referenced.
-
-    These functions each return a type-specific keylet.
-*/
+/**
+ * Keylet computation functions.
+ *
+ * Entries in the ledger are located using 256-bit locators. The locators are
+ * calculated using a wide range of parameters specific to the entry whose
+ * locator we are calculating (e.g. an account's locator is derived from the
+ * account's address, whereas the locator for an offer is derived from the
+ * account and the offer sequence.)
+ *
+ * To enhance type safety during lookup and make the code more robust, we use
+ * keylets, which contain not only the locator of the object but also the type
+ * of the object being referenced.
+ *
+ * These functions each return a type-specific keylet.
+ */
 namespace keylet {
 
-/** AccountID root */
+/**
+ * AccountID root
+ */
 Keylet
 account(AccountID const& id) noexcept;
 
-/** The index of the amendment table */
+/**
+ * The index of the amendment table
+ */
 Keylet const&
 amendments() noexcept;
 
-/** Any item that can be in an owner dir. */
+/**
+ * Any item that can be in an owner dir.
+ */
 Keylet
 child(uint256 const& key) noexcept;
 
-/** The index of the "short" skip list
-
-    The "short" skip list is a node (at a fixed index) that holds the hashes
-    of ledgers since the last flag ledger. It will contain, at most, 256 hashes.
-*/
+/**
+ * The index of the "short" skip list
+ *
+ * The "short" skip list is a node (at a fixed index) that holds the hashes
+ * of ledgers since the last flag ledger. It will contain, at most, 256 hashes.
+ */
 Keylet const&
 skip() noexcept;
 
-/** The index of the long skip for a particular ledger range.
-
-    The "long" skip list is a node that holds the hashes of (up to) 256 flag
-    ledgers.
-
-    It can be used to efficiently skip back to any ledger using only two hops:
-    the first hop gets the "long" skip list for the ledger it wants to retrieve
-    and uses it to get the hash of the flag ledger whose short skip list will
-    contain the hash of the requested ledger.
-*/
+/**
+ * The index of the long skip for a particular ledger range.
+ *
+ * The "long" skip list is a node that holds the hashes of (up to) 256 flag
+ * ledgers.
+ *
+ * It can be used to efficiently skip back to any ledger using only two hops:
+ * the first hop gets the "long" skip list for the ledger it wants to retrieve
+ * and uses it to get the hash of the flag ledger whose short skip list will
+ * contain the hash of the requested ledger.
+ */
 Keylet
 skip(LedgerIndex ledger) noexcept;
 
-/** The (fixed) index of the object containing the ledger fees. */
+/**
+ * The (fixed) index of the object containing the ledger fees.
+ */
 Keylet const&
 feeSettings() noexcept;
 
-/** The (fixed) index of the object containing the ledger negativeUNL. */
+/**
+ * The (fixed) index of the object containing the ledger negativeUNL.
+ */
 Keylet const&
 negativeUNL() noexcept;
 
-/** The beginning of an order book */
+/**
+ * The beginning of an order book
+ */
 Keylet
 book(Book const& b);
 
-/** The index of a trust line for a given currency
-
-    Note that a trustline is *shared* between two accounts (commonly referred
-    to as the issuer and the holder); if Alice sets up a trust line to Bob for
-    BTC, and Bob trusts Alice for BTC, here is only a single BTC trust line
-    between them.
-*/
+/**
+ * The index of a trust line for a given currency
+ *
+ * Note that a trustline is *shared* between two accounts (commonly referred
+ * to as the issuer and the holder); if Alice sets up a trust line to Bob for
+ * BTC, and Bob trusts Alice for BTC, here is only a single BTC trust line
+ * between them.
+ */
 /** @{ */
 Keylet
 trustLine(AccountID const& id0, AccountID const& id1, Currency const& currency) noexcept;
@@ -103,7 +119,9 @@ trustLine(AccountID const& id, Issue const& issue) noexcept
 }
 /** @} */
 
-/** An offer from an account */
+/**
+ * An offer from an account
+ */
 /** @{ */
 Keylet
 offer(AccountID const& id, std::uint32_t seq) noexcept;
@@ -115,15 +133,21 @@ offer(uint256 const& key) noexcept
 }
 /** @} */
 
-/** The initial directory page for a specific quality */
+/**
+ * The initial directory page for a specific quality
+ */
 Keylet
 quality(Keylet const& k, std::uint64_t q) noexcept;
 
-/** The directory for the next lower quality */
+/**
+ * The directory for the next lower quality
+ */
 Keylet
 next(Keylet const& k);
 
-/** A ticket belonging to an account */
+/**
+ * A ticket belonging to an account
+ */
 /** @{ */
 Keylet
 ticket(AccountID const& id, std::uint32_t ticketSeq);
@@ -138,15 +162,21 @@ ticket(uint256 const& key)
 }
 /** @} */
 
-/** A SignerList */
+/**
+ * A SignerList
+ */
 Keylet
 signerList(AccountID const& account) noexcept;
 
-/** A Sponsorship */
+/**
+ * A Sponsorship
+ */
 Keylet
 sponsorship(AccountID const& sponsor, AccountID const& sponsee) noexcept;
 
-/** A Check */
+/**
+ * A Check
+ */
 /** @{ */
 Keylet
 check(AccountID const& id, std::uint32_t seq) noexcept;
@@ -158,7 +188,9 @@ check(uint256 const& key) noexcept
 }
 /** @} */
 
-/** A DepositPreauth */
+/**
+ * A DepositPreauth
+ */
 /** @{ */
 Keylet
 depositPreauth(AccountID const& owner, AccountID const& preauthorized) noexcept;
@@ -177,15 +209,21 @@ depositPreauth(uint256 const& key) noexcept
 
 //------------------------------------------------------------------------------
 
-/** Any ledger entry */
+/**
+ * Any ledger entry
+ */
 Keylet
 unchecked(uint256 const& key) noexcept;
 
-/** The root page of an account's directory */
+/**
+ * The root page of an account's directory
+ */
 Keylet
 ownerDir(AccountID const& id) noexcept;
 
-/** A page in a directory */
+/**
+ * A page in a directory
+ */
 /** @{ */
 Keylet
 page(uint256 const& root, std::uint64_t index = 0) noexcept;
@@ -198,27 +236,36 @@ page(Keylet const& root, std::uint64_t index = 0) noexcept
 }
 /** @} */
 
-/** An escrow entry */
+/**
+ * An escrow entry
+ */
 Keylet
 escrow(AccountID const& src, std::uint32_t seq) noexcept;
 
-/** A PaymentChannel */
+/**
+ * A PaymentChannel
+ */
 Keylet
 payChannel(AccountID const& src, AccountID const& dst, std::uint32_t seq) noexcept;
 
-/** NFT page keylets
-
-    Unlike objects whose ledger identifiers are produced by hashing data,
-    NFT page identifiers are composite identifiers, consisting of the owner's
-    160-bit AccountID, followed by a 96-bit value that determines which NFT
-    tokens are candidates for that page.
+/**
+ * NFT page keylets
+ *
+ * Unlike objects whose ledger identifiers are produced by hashing data,
+ * NFT page identifiers are composite identifiers, consisting of the owner's
+ * 160-bit AccountID, followed by a 96-bit value that determines which NFT
+ * tokens are candidates for that page.
  */
 /** @{ */
-/** A keylet for the owner's first possible NFT page. */
+/**
+ * A keylet for the owner's first possible NFT page.
+ */
 Keylet
 nftokenPageMin(AccountID const& owner);
 
-/** A keylet for the owner's last possible NFT page. */
+/**
+ * A keylet for the owner's last possible NFT page.
+ */
 Keylet
 nftokenPageMax(AccountID const& owner);
 
@@ -226,7 +273,9 @@ Keylet
 nftokenPage(Keylet const& k, uint256 const& token);
 /** @} */
 
-/** An offer from an account to buy or sell an NFT */
+/**
+ * An offer from an account to buy or sell an NFT
+ */
 Keylet
 nftokenOffer(AccountID const& owner, std::uint32_t seq);
 
@@ -236,22 +285,30 @@ nftokenOffer(uint256 const& offer)
     return {ltNFTOKEN_OFFER, offer};
 }
 
-/** The directory of buy offers for the specified NFT */
+/**
+ * The directory of buy offers for the specified NFT
+ */
 Keylet
 nftBuys(uint256 const& id) noexcept;
 
-/** The directory of sell offers for the specified NFT */
+/**
+ * The directory of sell offers for the specified NFT
+ */
 Keylet
 nftSells(uint256 const& id) noexcept;
 
-/** AMM entry */
+/**
+ * AMM entry
+ */
 Keylet
 amm(Asset const& issue1, Asset const& issue2) noexcept;
 
 Keylet
 amm(uint256 const& amm) noexcept;
 
-/** A keylet for Delegate object */
+/**
+ * A keylet for Delegate object
+ */
 Keylet
 delegate(AccountID const& account, AccountID const& authorizedAccount) noexcept;
 
diff --git a/include/xrpl/protocol/InnerObjectFormats.h b/include/xrpl/protocol/InnerObjectFormats.h
index c8312c3701..7364e83cfd 100644
--- a/include/xrpl/protocol/InnerObjectFormats.h
+++ b/include/xrpl/protocol/InnerObjectFormats.h
@@ -6,14 +6,16 @@
 
 namespace xrpl {
 
-/** Manages the list of known inner object formats.
+/**
+ * Manages the list of known inner object formats.
  */
 class InnerObjectFormats : public KnownFormats<int, InnerObjectFormats>
 {
 private:
-    /** Create the object.
-        This will load the object with all the known inner object formats.
-    */
+    /**
+     * Create the object.
+     * This will load the object with all the known inner object formats.
+     */
     InnerObjectFormats();
 
 public:
diff --git a/include/xrpl/protocol/Issue.h b/include/xrpl/protocol/Issue.h
index a4980404cd..5cd8731609 100644
--- a/include/xrpl/protocol/Issue.h
+++ b/include/xrpl/protocol/Issue.h
@@ -10,9 +10,10 @@
 
 namespace xrpl {
 
-/** A currency issued by an account.
-    @see Currency, AccountID, Issue, Book
-*/
+/**
+ * A currency issued by an account.
+ * @see Currency, AccountID, Issue, Book
+ */
 class Issue
 {
 public:
@@ -70,7 +71,9 @@ hash_append(Hasher& h, Issue const& r)
     hash_append(h, r.currency, r.account);
 }
 
-/** Equality comparison. */
+/**
+ * Equality comparison.
+ */
 /** @{ */
 [[nodiscard]] constexpr bool
 operator==(Issue const& lhs, Issue const& rhs)
@@ -79,7 +82,9 @@ operator==(Issue const& lhs, Issue const& rhs)
 }
 /** @} */
 
-/** Strict weak ordering. */
+/**
+ * Strict weak ordering.
+ */
 /** @{ */
 [[nodiscard]] constexpr std::weak_ordering
 operator<=>(Issue const& lhs, Issue const& rhs)
@@ -96,7 +101,9 @@ operator<=>(Issue const& lhs, Issue const& rhs)
 
 //------------------------------------------------------------------------------
 
-/** Returns an asset specifier that represents XRP. */
+/**
+ * Returns an asset specifier that represents XRP.
+ */
 inline Issue const&
 xrpIssue()
 {
@@ -104,7 +111,9 @@ xrpIssue()
     return kIssue;
 }
 
-/** Returns an asset specifier that represents no account and currency. */
+/**
+ * Returns an asset specifier that represents no account and currency.
+ */
 inline Issue const&
 noIssue()
 {
diff --git a/include/xrpl/protocol/Keylet.h b/include/xrpl/protocol/Keylet.h
index 19704e2a11..48d494f564 100644
--- a/include/xrpl/protocol/Keylet.h
+++ b/include/xrpl/protocol/Keylet.h
@@ -7,14 +7,15 @@ namespace xrpl {
 
 class STLedgerEntry;
 
-/** A pair of SHAMap key and LedgerEntryType.
-
-    A Keylet identifies both a key in the state map
-    and its ledger entry type.
-
-    @note Keylet is a portmanteau of the words key
-          and LET, an acronym for LedgerEntryType.
-*/
+/**
+ * A pair of SHAMap key and LedgerEntryType.
+ *
+ * A Keylet identifies both a key in the state map
+ * and its ledger entry type.
+ *
+ * @note Keylet is a portmanteau of the words key
+ *       and LET, an acronym for LedgerEntryType.
+ */
 struct Keylet
 {
     uint256 key;
@@ -24,7 +25,9 @@ struct Keylet
     {
     }
 
-    /** Returns true if the SLE matches the type */
+    /**
+     * Returns true if the SLE matches the type
+     */
     [[nodiscard]] bool
     check(STLedgerEntry const&) const;
 };
diff --git a/include/xrpl/protocol/KnownFormats.h b/include/xrpl/protocol/KnownFormats.h
index c31e28c37d..385feb2c27 100644
--- a/include/xrpl/protocol/KnownFormats.h
+++ b/include/xrpl/protocol/KnownFormats.h
@@ -15,18 +15,20 @@
 
 namespace xrpl {
 
-/** Manages a list of known formats.
-
-    Each format has a name, an associated KeyType (typically an enumeration),
-    and a predefined @ref SOElement.
-
-    @tparam KeyType The type of key identifying the format.
-*/
+/**
+ * Manages a list of known formats.
+ *
+ * Each format has a name, an associated KeyType (typically an enumeration),
+ * and a predefined @ref SOElement.
+ *
+ * @tparam KeyType The type of key identifying the format.
+ */
 template <class KeyType, class Derived>
 class KnownFormats
 {
 public:
-    /** A known format.
+    /**
+     * A known format.
      */
     class Item
     {
@@ -46,7 +48,8 @@ public:
                 "KnownFormats KeyType must be integral or enum.");
         }
 
-        /** Retrieve the name of the format.
+        /**
+         * Retrieve the name of the format.
          */
         [[nodiscard]] std::string const&
         getName() const
@@ -54,7 +57,8 @@ public:
             return name_;
         }
 
-        /** Retrieve the transaction type this format represents.
+        /**
+         * Retrieve the transaction type this format represents.
          */
         [[nodiscard]] KeyType
         getType() const
@@ -74,32 +78,35 @@ public:
         KeyType const type_;
     };
 
-    /** Create the known formats object.
-
-        Derived classes will load the object with all the known formats.
-    */
+    /**
+     * Create the known formats object.
+     *
+     * Derived classes will load the object with all the known formats.
+     */
 private:
     KnownFormats() : name_(beast::typeName<Derived>())
     {
     }
 
 public:
-    /** Destroy the known formats object.
-
-        The defined formats are deleted.
-    */
+    /**
+     * Destroy the known formats object.
+     *
+     * The defined formats are deleted.
+     */
     virtual ~KnownFormats() = default;
     KnownFormats(KnownFormats const&) = delete;
     KnownFormats&
     operator=(KnownFormats const&) = delete;
 
-    /** Retrieve the type for a format specified by name.
-
-        If the format name is unknown, an exception is thrown.
-
-        @param  name The name of the type.
-        @return      The type.
-    */
+    /**
+     * Retrieve the type for a format specified by name.
+     *
+     * If the format name is unknown, an exception is thrown.
+     *
+     * @param  name The name of the type.
+     * @return      The type.
+     */
     [[nodiscard]] KeyType
     findTypeByName(std::string const& name) const
     {
@@ -110,7 +117,8 @@ public:
             name.substr(0, std::min(name.size(), std::size_t(32))) + "'");
     }
 
-    /** Retrieve a format based on its type.
+    /**
+     * Retrieve a format based on its type.
      */
     [[nodiscard]] Item const*
     findByType(KeyType type) const
@@ -135,7 +143,8 @@ public:
     }
 
 protected:
-    /** Retrieve a format based on its name.
+    /**
+     * Retrieve a format based on its name.
      */
     [[nodiscard]] Item const*
     findByName(std::string const& name) const
@@ -146,15 +155,16 @@ protected:
         return itr->second;
     }
 
-    /** Add a new format.
-
-        @param name The name of this format.
-        @param type The type of this format.
-        @param uniqueFields A std::vector of unique fields
-        @param commonFields A std::vector of common fields
-
-        @return The created format.
-    */
+    /**
+     * Add a new format.
+     *
+     * @param name The name of this format.
+     * @param type The type of this format.
+     * @param uniqueFields A std::vector of unique fields
+     * @param commonFields A std::vector of common fields
+     *
+     * @return The created format.
+     */
     Item const&
     add(char const* name,
         KeyType type,
diff --git a/include/xrpl/protocol/LedgerFormats.h b/include/xrpl/protocol/LedgerFormats.h
index 142e5763be..7c504f6bdd 100644
--- a/include/xrpl/protocol/LedgerFormats.h
+++ b/include/xrpl/protocol/LedgerFormats.h
@@ -12,28 +12,29 @@
 #include <vector>
 
 namespace xrpl {
-/** Identifiers for on-ledger objects.
-
-    Each ledger object requires a unique type identifier, which is stored within the object itself;
-   this makes it possible to iterate the entire ledger and determine each object's type and verify
-   that the object you retrieved from a given hash matches the expected type.
-
-    @warning Since these values are stored inside objects stored on the ledger they are part of the
-   protocol.
-   **Changing them should be avoided because without special handling, this will result in a hard
-   fork.**
-
-    @note Values outside this range may be used internally by the code for various purposes, but
-   attempting to use such values to identify on-ledger objects will result in an invariant failure.
-
-    @note When retiring types, the specific values should not be removed but should be marked as
-   [[deprecated]]. This is to avoid accidental reuse of identifiers.
-
-    @todo The C++ language does not enable checking for duplicate values here.
-          If it becomes possible then we should do this.
-
-    @ingroup protocol
-*/
+/**
+ * Identifiers for on-ledger objects.
+ *
+ * Each ledger object requires a unique type identifier, which is stored within the object itself;
+ * this makes it possible to iterate the entire ledger and determine each object's type and verify
+ * that the object you retrieved from a given hash matches the expected type.
+ *
+ * @warning Since these values are stored inside objects stored on the ledger they are part of the
+ * protocol.
+ * **Changing them should be avoided because without special handling, this will result in a hard
+ * fork.**
+ *
+ * @note Values outside this range may be used internally by the code for various purposes, but
+ * attempting to use such values to identify on-ledger objects will result in an invariant failure.
+ *
+ * @note When retiring types, the specific values should not be removed but should be marked as
+ * [[deprecated]]. This is to avoid accidental reuse of identifiers.
+ *
+ * @todo The C++ language does not enable checking for duplicate values here.
+ *       If it becomes possible then we should do this.
+ *
+ * @ingroup protocol
+ */
 // Protocol-critical, hundreds of usages
 // NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
 enum LedgerEntryType : std::uint16_t {
@@ -49,66 +50,72 @@ enum LedgerEntryType : std::uint16_t {
 #pragma pop_macro("LEDGER_ENTRY")
 
     //---------------------------------------------------------------------------
-    /** A special type, matching any ledger entry type.
-
-        The value does not represent a concrete type, but rather is used in contexts where the
-       specific type of a ledger object is unimportant, unknown or unavailable.
-
-        Objects with this special type cannot be created or stored on the ledger.
-
-        \sa keylet::unchecked
-    */
+    /**
+     * A special type, matching any ledger entry type.
+     *
+     * The value does not represent a concrete type, but rather is used in contexts where the
+     * specific type of a ledger object is unimportant, unknown or unavailable.
+     *
+     * Objects with this special type cannot be created or stored on the ledger.
+     *
+     * @see keylet::unchecked
+     */
     ltANY = 0,
 
-    /** A special type, matching any ledger type except directory nodes.
-
-        The value does not represent a concrete type, but rather is used in contexts where the
-       ledger object must not be a directory node but its specific type is otherwise unimportant,
-       unknown or unavailable.
-
-        Objects with this special type cannot be created or stored on the ledger.
-
-        \sa keylet::child
+    /**
+     * A special type, matching any ledger type except directory nodes.
+     *
+     * The value does not represent a concrete type, but rather is used in contexts where the
+     * ledger object must not be a directory node but its specific type is otherwise unimportant,
+     * unknown or unavailable.
+     *
+     * Objects with this special type cannot be created or stored on the ledger.
+     *
+     * @see keylet::child
      */
     ltCHILD = 0x1CD2,
 
     //---------------------------------------------------------------------------
-    /** A legacy, deprecated type.
-
-        \deprecated **This object type is not supported and should not be used.**
-                    Support for this type of object was never implemented.
-                    No objects of this type were ever created.
+    /**
+     * A legacy, deprecated type.
+     *
+     * @deprecated **This object type is not supported and should not be used.**
+     *             Support for this type of object was never implemented.
+     *             No objects of this type were ever created.
      */
     ltNICKNAME [[deprecated("This object type is not supported and should not be used.")]] = 0x006e,
 
-    /** A legacy, deprecated type.
-
-        \deprecated **This object type is not supported and should not be used.**
-                    Support for this type of object was never implemented.
-                    No objects of this type were ever created.
+    /**
+     * A legacy, deprecated type.
+     *
+     * @deprecated **This object type is not supported and should not be used.**
+     *             Support for this type of object was never implemented.
+     *             No objects of this type were ever created.
      */
     ltCONTRACT [[deprecated("This object type is not supported and should not be used.")]] = 0x0063,
 
-    /** A legacy, deprecated type.
-
-        \deprecated **This object type is not supported and should not be used.**
-                    Support for this type of object was never implemented.
-                    No objects of this type were ever created.
+    /**
+     * A legacy, deprecated type.
+     *
+     * @deprecated **This object type is not supported and should not be used.**
+     *             Support for this type of object was never implemented.
+     *             No objects of this type were ever created.
      */
     ltGENERATOR_MAP [[deprecated("This object type is not supported and should not be used.")]] =
         0x0067,
 };
 
-/** Ledger object flags.
-
-    These flags are specified in ledger objects and modify their behavior.
-
-    @warning Ledger object flags form part of the protocol.
-    **Changing them should be avoided because without special handling, this will result in a hard
-   fork.**
-
-    @ingroup protocol
-*/
+/**
+ * Ledger object flags.
+ *
+ * These flags are specified in ledger objects and modify their behavior.
+ *
+ * @warning Ledger object flags form part of the protocol.
+ * **Changing them should be avoided because without special handling, this will result in a hard
+ * fork.**
+ *
+ * @ingroup protocol
+ */
 #pragma push_macro("XMACRO")
 #pragma push_macro("TO_VALUE")
 #pragma push_macro("VALUE_TO_MAP")
@@ -289,14 +296,16 @@ getAllLedgerFlags()
 
 //------------------------------------------------------------------------------
 
-/** Holds the list of known ledger entry formats.
+/**
+ * Holds the list of known ledger entry formats.
  */
 class LedgerFormats : public KnownFormats<LedgerEntryType, LedgerFormats>
 {
 private:
-    /** Create the object.
-        This will load the object with all the known ledger formats.
-    */
+    /**
+     * Create the object.
+     * This will load the object with all the known ledger formats.
+     */
     LedgerFormats();
 
 public:
diff --git a/include/xrpl/protocol/LedgerHeader.h b/include/xrpl/protocol/LedgerHeader.h
index df8f314c5f..d169e53e2c 100644
--- a/include/xrpl/protocol/LedgerHeader.h
+++ b/include/xrpl/protocol/LedgerHeader.h
@@ -12,7 +12,9 @@
 
 namespace xrpl {
 
-/** Information about the notional ledger backing the view. */
+/**
+ * Information about the notional ledger backing the view.
+ */
 struct LedgerHeader
 {
     explicit LedgerHeader() = default;
@@ -67,15 +69,21 @@ getCloseAgree(LedgerHeader const& info)
 void
 addRaw(LedgerHeader const&, Serializer&, bool includeHash = false);
 
-/** Deserialize a ledger header from a byte array. */
+/**
+ * Deserialize a ledger header from a byte array.
+ */
 LedgerHeader
 deserializeHeader(Slice data, bool hasHash = false);
 
-/** Deserialize a ledger header (prefixed with 4 bytes) from a byte array. */
+/**
+ * Deserialize a ledger header (prefixed with 4 bytes) from a byte array.
+ */
 LedgerHeader
 deserializePrefixedHeader(Slice data, bool hasHash = false);
 
-/** Calculate the hash of a ledger header. */
+/**
+ * Calculate the hash of a ledger header.
+ */
 uint256
 calculateLedgerHash(LedgerHeader const& info);
 
diff --git a/include/xrpl/protocol/LedgerShortcut.h b/include/xrpl/protocol/LedgerShortcut.h
index 68c31c4c3c..037621121d 100644
--- a/include/xrpl/protocol/LedgerShortcut.h
+++ b/include/xrpl/protocol/LedgerShortcut.h
@@ -9,13 +9,19 @@ namespace xrpl {
  * without needing to specify their exact hash or sequence number.
  */
 enum class LedgerShortcut {
-    /** The current working ledger (open, not yet closed) */
+    /**
+     * The current working ledger (open, not yet closed)
+     */
     Current,
 
-    /** The most recently closed ledger (may not be validated) */
+    /**
+     * The most recently closed ledger (may not be validated)
+     */
     Closed,
 
-    /** The most recently validated ledger */
+    /**
+     * The most recently validated ledger
+     */
     Validated
 };
 
diff --git a/include/xrpl/protocol/MPTAmount.h b/include/xrpl/protocol/MPTAmount.h
index 329d83610e..462092f7dd 100644
--- a/include/xrpl/protocol/MPTAmount.h
+++ b/include/xrpl/protocol/MPTAmount.h
@@ -60,7 +60,9 @@ public:
     bool
     operator<(MPTAmount const& other) const;
 
-    /** Returns true if the amount is not zero */
+    /**
+     * Returns true if the amount is not zero
+     */
     explicit constexpr
     operator bool() const noexcept;
 
@@ -69,14 +71,17 @@ public:
         return value();
     }
 
-    /** Return the sign of the amount */
+    /**
+     * Return the sign of the amount
+     */
     [[nodiscard]] constexpr int
     signum() const noexcept;
 
-    /** Returns the underlying value. Code SHOULD NOT call this
-        function unless the type has been abstracted away,
-        e.g. in a templated function.
-    */
+    /**
+     * Returns the underlying value. Code SHOULD NOT call this
+     * function unless the type has been abstracted away,
+     * e.g. in a templated function.
+     */
     [[nodiscard]] constexpr value_type
     value() const;
 
@@ -100,14 +105,18 @@ MPTAmount::operator=(beast::Zero)
     return *this;
 }
 
-/** Returns true if the amount is not zero */
+/**
+ * Returns true if the amount is not zero
+ */
 constexpr MPTAmount::
 operator bool() const noexcept
 {
     return value_ != 0;
 }
 
-/** Return the sign of the amount */
+/**
+ * Return the sign of the amount
+ */
 constexpr int
 MPTAmount::signum() const noexcept
 {
@@ -116,10 +125,11 @@ MPTAmount::signum() const noexcept
     return (value_ != 0) ? 1 : 0;
 }
 
-/** Returns the underlying value. Code SHOULD NOT call this
-    function unless the type has been abstracted away,
-    e.g. in a templated function.
-*/
+/**
+ * Returns the underlying value. Code SHOULD NOT call this
+ * function unless the type has been abstracted away,
+ * e.g. in a templated function.
+ */
 constexpr MPTAmount::value_type
 MPTAmount::value() const
 {
diff --git a/include/xrpl/protocol/MPTIssue.h b/include/xrpl/protocol/MPTIssue.h
index 0c495aa57f..7f473da6a2 100644
--- a/include/xrpl/protocol/MPTIssue.h
+++ b/include/xrpl/protocol/MPTIssue.h
@@ -82,7 +82,8 @@ operator<=>(MPTIssue const& lhs, MPTIssue const& rhs)
     return lhs.mptID_ <=> rhs.mptID_;
 }
 
-/** MPT is a non-native token.
+/**
+ * MPT is a non-native token.
  */
 inline bool
 isXRP(MPTID const&)
diff --git a/include/xrpl/protocol/NFTSyntheticSerializer.h b/include/xrpl/protocol/NFTSyntheticSerializer.h
index a1d8bce985..bef05b9a8f 100644
--- a/include/xrpl/protocol/NFTSyntheticSerializer.h
+++ b/include/xrpl/protocol/NFTSyntheticSerializer.h
@@ -9,10 +9,9 @@
 namespace xrpl::RPC {
 
 /**
-   Adds common synthetic fields to transaction-related JSON responses
-
-   @{
+ * Adds common synthetic fields to transaction-related JSON responses
  */
+/** @{ */
 void
 insertNFTSyntheticInJson(json::Value&, std::shared_ptr<STTx const> const&, TxMeta const&);
 /** @} */
diff --git a/include/xrpl/protocol/NFTokenID.h b/include/xrpl/protocol/NFTokenID.h
index f61c6bd5cb..b1b994eabd 100644
--- a/include/xrpl/protocol/NFTokenID.h
+++ b/include/xrpl/protocol/NFTokenID.h
@@ -12,13 +12,13 @@
 namespace xrpl {
 
 /**
-   Add a `nftoken_ids` field to the `meta` output parameter.
-   The field is only added to successful NFTokenMint, NFTokenAcceptOffer,
-   and NFTokenCancelOffer transactions.
-
-   Helper functions are not static because they can be used by Clio.
-   @{
+ * Add a `nftoken_ids` field to the `meta` output parameter.
+ * The field is only added to successful NFTokenMint, NFTokenAcceptOffer,
+ * and NFTokenCancelOffer transactions.
+ *
+ * Helper functions are not static because they can be used by Clio.
  */
+/** @{ */
 bool
 canHaveNFTokenID(std::shared_ptr<STTx const> const& serializedTx, TxMeta const& transactionMeta);
 
diff --git a/include/xrpl/protocol/NFTokenOfferID.h b/include/xrpl/protocol/NFTokenOfferID.h
index c4a80356bf..4810f7932a 100644
--- a/include/xrpl/protocol/NFTokenOfferID.h
+++ b/include/xrpl/protocol/NFTokenOfferID.h
@@ -11,12 +11,12 @@
 namespace xrpl {
 
 /**
-   Add an `offer_id` field to the `meta` output parameter.
-   The field is only added to successful NFTokenCreateOffer transactions.
-
-   Helper functions are not static because they can be used by Clio.
-   @{
+ * Add an `offer_id` field to the `meta` output parameter.
+ * The field is only added to successful NFTokenCreateOffer transactions.
+ *
+ * Helper functions are not static because they can be used by Clio.
  */
+/** @{ */
 bool
 canHaveNFTokenOfferID(
     std::shared_ptr<STTx const> const& serializedTx,
diff --git a/include/xrpl/protocol/Protocol.h b/include/xrpl/protocol/Protocol.h
index f802cfe058..e83e1c97b6 100644
--- a/include/xrpl/protocol/Protocol.h
+++ b/include/xrpl/protocol/Protocol.h
@@ -14,64 +14,88 @@
 
 namespace xrpl {
 
-/** Protocol specific constants.
-
-    This information is, implicitly, part of the protocol.
-
-    @note Changing these values without adding code to the
-          server to detect "pre-change" and "post-change"
-          will result in a hard fork.
-
-    @ingroup protocol
-*/
-/** Smallest legal byte size of a transaction. */
+/**
+ * Protocol specific constants.
+ *
+ * This information is, implicitly, part of the protocol.
+ *
+ * @note Changing these values without adding code to the
+ *       server to detect "pre-change" and "post-change"
+ *       will result in a hard fork.
+ *
+ * @ingroup protocol
+ */
+/**
+ * Smallest legal byte size of a transaction.
+ */
 constexpr std::size_t kTxMinSizeBytes = 32;
 
-/** Largest legal byte size of a transaction. */
+/**
+ * Largest legal byte size of a transaction.
+ */
 constexpr std::size_t kTxMaxSizeBytes = megabytes(1);
 
-/** The maximum number of unfunded offers to delete at once */
+/**
+ * The maximum number of unfunded offers to delete at once
+ */
 constexpr std::size_t kUnfundedOfferRemoveLimit = 1000;
 
-/** The maximum number of expired offers to delete at once */
+/**
+ * The maximum number of expired offers to delete at once
+ */
 constexpr std::size_t kExpiredOfferRemoveLimit = 256;
 
-/** The maximum number of metadata entries allowed in one transaction */
+/**
+ * The maximum number of metadata entries allowed in one transaction
+ */
 constexpr std::size_t kOversizeMetaDataCap = 5200;
 
-/** The maximum number of entries per directory page */
+/**
+ * The maximum number of entries per directory page
+ */
 constexpr std::size_t kDirNodeMaxEntries = 32;
 
-/** The maximum number of pages allowed in a directory
-
-    Made obsolete by fixDirectoryLimit amendment.
-*/
+/**
+ * The maximum number of pages allowed in a directory
+ *
+ * Made obsolete by fixDirectoryLimit amendment.
+ */
 constexpr std::uint64_t kDirNodeMaxPages = 262144;
 
-/** The maximum number of items in an NFT page */
+/**
+ * The maximum number of items in an NFT page
+ */
 constexpr std::size_t kDirMaxTokensPerPage = 32;
 
-/** The maximum number of owner directory entries for account to be deletable */
+/**
+ * The maximum number of owner directory entries for account to be deletable
+ */
 constexpr std::size_t kMaxDeletableDirEntries = 1000;
 
-/** The maximum number of token offers that can be canceled at once */
+/**
+ * The maximum number of token offers that can be canceled at once
+ */
 constexpr std::size_t kMaxTokenOfferCancelCount = 500;
 
-/** The maximum number of offers in an offer directory for NFT to be burnable */
+/**
+ * The maximum number of offers in an offer directory for NFT to be burnable
+ */
 constexpr std::size_t kMaxDeletableTokenOfferEntries = 500;
 
-/** The maximum token transfer fee allowed.
-
-    Token transfer fees can range from 0% to 50% and are specified in tenths of
-    a basis point; that is a value of 1000 represents a transfer fee of 1% and
-    a value of 10000 represents a transfer fee of 10%.
-
-    Note that for extremely low transfer fees values, it is possible that the
-    calculated fee will be 0.
+/**
+ * The maximum token transfer fee allowed.
+ *
+ * Token transfer fees can range from 0% to 50% and are specified in tenths of
+ * a basis point; that is a value of 1000 represents a transfer fee of 1% and
+ * a value of 10000 represents a transfer fee of 10%.
+ *
+ * Note that for extremely low transfer fees values, it is possible that the
+ * calculated fee will be 0.
  */
 constexpr std::uint16_t kMaxTransferFee = 50000;
 
-/** There are 10,000 basis points (bips) in 100%.
+/**
+ * There are 10,000 basis points (bips) in 100%.
  *
  * Basis points represent 0.01%.
  *
@@ -116,36 +140,41 @@ tenthBipsOfValue(T value, TenthBips<TBips> bips)
 }
 
 namespace Lending {
-/** The maximum management fee rate allowed by a loan broker in 1/10 bips.
-
-    Valid values are between 0 and 10% inclusive.
-*/
+/**
+ * The maximum management fee rate allowed by a loan broker in 1/10 bips.
+ *
+ * Valid values are between 0 and 10% inclusive.
+ */
 constexpr TenthBips16 kMaxManagementFeeRate(
     unsafeCast<std::uint16_t>(percentageToTenthBips(10).value()));
 static_assert(kMaxManagementFeeRate == TenthBips16(std::uint16_t(10'000u)));
 
-/** The maximum coverage rate required of a loan broker in 1/10 bips.
-
-    Valid values are between 0 and 100% inclusive.
-*/
+/**
+ * The maximum coverage rate required of a loan broker in 1/10 bips.
+ *
+ * Valid values are between 0 and 100% inclusive.
+ */
 constexpr TenthBips32 kMaxCoverRate = percentageToTenthBips(100);
 static_assert(kMaxCoverRate == TenthBips32(100'000u));
 
-/** The maximum overpayment fee on a loan in 1/10 bips.
-*
-    Valid values are between 0 and 100% inclusive.
-*/
+/**
+ * The maximum overpayment fee on a loan in 1/10 bips.
+ *
+ * Valid values are between 0 and 100% inclusive.
+ */
 constexpr TenthBips32 kMaxOverpaymentFee = percentageToTenthBips(100);
 static_assert(kMaxOverpaymentFee == TenthBips32(100'000u));
 
-/** Annualized interest rate of the Loan in 1/10 bips.
+/**
+ * Annualized interest rate of the Loan in 1/10 bips.
  *
  * Valid values are between 0 and 100% inclusive.
  */
 constexpr TenthBips32 kMaxInterestRate = percentageToTenthBips(100);
 static_assert(kMaxInterestRate == TenthBips32(100'000u));
 
-/** The maximum premium added to the interest rate for late payments on a loan
+/**
+ * The maximum premium added to the interest rate for late payments on a loan
  * in 1/10 bips.
  *
  * Valid values are between 0 and 100% inclusive.
@@ -153,7 +182,8 @@ static_assert(kMaxInterestRate == TenthBips32(100'000u));
 constexpr TenthBips32 kMaxLateInterestRate = percentageToTenthBips(100);
 static_assert(kMaxLateInterestRate == TenthBips32(100'000u));
 
-/** The maximum close interest rate charged for repaying a loan early in 1/10
+/**
+ * The maximum close interest rate charged for repaying a loan early in 1/10
  * bips.
  *
  * Valid values are between 0 and 100% inclusive.
@@ -161,7 +191,8 @@ static_assert(kMaxLateInterestRate == TenthBips32(100'000u));
 constexpr TenthBips32 kMaxCloseInterestRate = percentageToTenthBips(100);
 static_assert(kMaxCloseInterestRate == TenthBips32(100'000u));
 
-/** The maximum overpayment interest rate charged on loan overpayments in 1/10
+/**
+ * The maximum overpayment interest rate charged on loan overpayments in 1/10
  * bips.
  *
  * Valid values are between 0 and 100% inclusive.
@@ -169,7 +200,8 @@ static_assert(kMaxCloseInterestRate == TenthBips32(100'000u));
 constexpr TenthBips32 kMaxOverpaymentInterestRate = percentageToTenthBips(100);
 static_assert(kMaxOverpaymentInterestRate == TenthBips32(100'000u));
 
-/** LoanPay transaction cost will be one base fee per X combined payments
+/**
+ * LoanPay transaction cost will be one base fee per X combined payments
  *
  * The number of payments is estimated based on the Amount paid and the Loan's
  * Fixed Payment size. Overpayments (indicated with the tfLoanOverpayment flag)
@@ -180,7 +212,8 @@ static_assert(kMaxOverpaymentInterestRate == TenthBips32(100'000u));
  */
 static constexpr int kLoanPaymentsPerFeeIncrement = 5;
 
-/** Maximum number of combined payments that a LoanPay transaction will process
+/**
+ * Maximum number of combined payments that a LoanPay transaction will process
  *
  * This limit is enforced during the loan payment process, and thus is not
  * estimated. If the limit is hit, no further payments or overpayments will be
@@ -205,173 +238,267 @@ static constexpr int kLoanPaymentsPerFeeIncrement = 5;
 static constexpr int kLoanMaximumPaymentsPerTransaction = 100;
 }  // namespace Lending
 
-/** The maximum length of a URI inside an NFT */
+/**
+ * The maximum length of a URI inside an NFT
+ */
 constexpr std::size_t kMaxTokenUriLength = 256;
 
-/** The maximum length of a Data element inside a DID */
+/**
+ * The maximum length of a Data element inside a DID
+ */
 constexpr std::size_t kMaxDidDocumentLength = 256;
 
-/** The maximum length of a URI inside a DID */
+/**
+ * The maximum length of a URI inside a DID
+ */
 constexpr std::size_t kMaxDidUriLength = 256;
 
-/** The maximum length of an Attestation inside a DID */
+/**
+ * The maximum length of an Attestation inside a DID
+ */
 constexpr std::size_t kMaxDidDataLength = 256;
 
-/** The maximum length of a domain */
+/**
+ * The maximum length of a domain
+ */
 constexpr std::size_t kMaxDomainLength = 256;
 
-/** The maximum length of a URI inside a Credential */
+/**
+ * The maximum length of a URI inside a Credential
+ */
 constexpr std::size_t kMaxCredentialUriLength = 256;
 
-/** The maximum length of a CredentialType inside a Credential */
+/**
+ * The maximum length of a CredentialType inside a Credential
+ */
 constexpr std::size_t kMaxCredentialTypeLength = 64;
 
-/** The maximum number of credentials can be passed in array */
+/**
+ * The maximum number of credentials can be passed in array
+ */
 constexpr std::size_t kMaxCredentialsArraySize = 8;
 
-/** The maximum number of credentials can be passed in array for permissioned
- * domain */
+/**
+ * The maximum number of credentials can be passed in array for permissioned
+ * domain
+ */
 constexpr std::size_t kMaxPermissionedDomainCredentialsArraySize = 10;
 
-/** The maximum length of MPTokenMetadata */
+/**
+ * The maximum length of MPTokenMetadata
+ */
 constexpr std::size_t kMaxMpTokenMetadataLength = 1024;
 
-/** The maximum amount of MPTokenIssuance */
+/**
+ * The maximum amount of MPTokenIssuance
+ */
 constexpr std::uint64_t kMaxMpTokenAmount = 0x7FFF'FFFF'FFFF'FFFFull;
 static_assert(Number::kMaxRep >= kMaxMpTokenAmount);
 
-/** The maximum length of Data payload */
+/**
+ * The maximum length of Data payload
+ */
 constexpr std::size_t kMaxDataPayloadLength = 256;
 
-/** Vault withdrawal policies */
+/**
+ * Vault withdrawal policies
+ */
 constexpr std::uint8_t kVaultStrategyFirstComeFirstServe = 1;
 
-/** Default IOU scale factor for a Vault */
+/**
+ * Default IOU scale factor for a Vault
+ */
 constexpr std::uint8_t kVaultDefaultIouScale = 6;
-/** Maximum scale factor for a Vault. The number is chosen to ensure that
-1 IOU can be always converted to shares.
-10^19 > maxMPTokenAmount (2^64-1) > 10^18 */
+/**
+ * Maximum scale factor for a Vault. The number is chosen to ensure that
+ * 1 IOU can be always converted to shares.
+ * 10^19 > maxMPTokenAmount (2^64-1) > 10^18
+ */
 constexpr std::uint8_t kVaultMaximumIouScale = 18;
 
-/** Maximum recursion depth for vault shares being put as an asset inside
- * another vault; counted from 0 */
+/**
+ * Maximum recursion depth for vault shares being put as an asset inside
+ * another vault; counted from 0
+ */
 constexpr std::uint8_t kMaxAssetCheckDepth = 5;
 
-/** A ledger index. */
+/**
+ * A ledger index.
+ */
 using LedgerIndex = std::uint32_t;
 
 constexpr std::uint32_t kFlagLedgerInterval = 256;
 
-/** Returns true if the given ledgerIndex is a voting ledgerIndex */
+/**
+ * Returns true if the given ledgerIndex is a voting ledgerIndex
+ */
 bool
 isVotingLedger(LedgerIndex seq);
 
-/** Returns true if the given ledgerIndex is a flag ledgerIndex */
+/**
+ * Returns true if the given ledgerIndex is a flag ledgerIndex
+ */
 bool
 isFlagLedger(LedgerIndex seq);
 
-/** A transaction identifier.
-    The value is computed as the hash of the
-    canonicalized, serialized transaction object.
-*/
+/**
+ * A transaction identifier.
+ * The value is computed as the hash of the
+ * canonicalized, serialized transaction object.
+ */
 using TxID = uint256;
 
-/** The maximum number of trustlines to delete as part of AMM account
+/**
+ * The maximum number of trustlines to delete as part of AMM account
  * deletion cleanup.
  */
 constexpr std::uint16_t kMaxDeletableAmmTrustLines = 512;
 
-/** The maximum length of a URI inside an Oracle */
+/**
+ * The maximum length of a URI inside an Oracle
+ */
 constexpr std::size_t kMaxOracleUri = 256;
 
-/** The maximum length of a Provider inside an Oracle */
+/**
+ * The maximum length of a Provider inside an Oracle
+ */
 constexpr std::size_t kMaxOracleProvider = 256;
 
-/** The maximum size of a data series array inside an Oracle */
+/**
+ * The maximum size of a data series array inside an Oracle
+ */
 constexpr std::size_t kMaxOracleDataSeries = 10;
 
-/** The maximum length of a SymbolClass inside an Oracle */
+/**
+ * The maximum length of a SymbolClass inside an Oracle
+ */
 constexpr std::size_t kMaxOracleSymbolClass = 16;
 
-/** The maximum allowed time difference between lastUpdateTime and the time
-    of the last closed ledger
-*/
+/**
+ * The maximum allowed time difference between lastUpdateTime and the time
+ * of the last closed ledger
+ */
 constexpr std::size_t kMaxLastUpdateTimeDelta = 300;
 
-/** The maximum price scaling factor
+/**
+ * The maximum price scaling factor
  */
 constexpr std::size_t kMaxPriceScale = 20;
 
-/** The maximum percentage of outliers to trim
+/**
+ * The maximum percentage of outliers to trim
  */
 constexpr std::size_t kMaxTrim = 25;
 
-/** The maximum number of delegate permissions an account can grant
+/**
+ * The maximum number of delegate permissions an account can grant
  */
 constexpr std::size_t kPermissionMaxSize = 10;
 
-/** The maximum number of transactions that can be in a batch. */
+/**
+ * The maximum number of transactions that can be in a batch.
+ */
 constexpr std::size_t kMaxBatchTxCount = 8;
 
-/** The maximum number of batch signers. */
+/**
+ * The maximum number of batch signers.
+ */
 constexpr std::size_t kMaxBatchSigners = kMaxBatchTxCount * 3;
 
-/** Length of a secp256k1 scalar in bytes. */
+/**
+ * Length of a secp256k1 scalar in bytes.
+ */
 constexpr std::size_t kEcScalarLength = kMPT_SCALAR_SIZE;
 
-/** Length of EC point (compressed) */
+/**
+ * Length of EC point (compressed)
+ */
 constexpr std::size_t kCompressedEcPointLength = 33;
 
-/** Length of one compressed EC point component in an EC ElGamal ciphertext. */
+/**
+ * Length of one compressed EC point component in an EC ElGamal ciphertext.
+ */
 constexpr std::size_t kEcCiphertextComponentLength = kMPT_ELGAMAL_CIPHER_SIZE;
 
-/** EC ElGamal ciphertext length: two compressed EC points concatenated. */
+/**
+ * EC ElGamal ciphertext length: two compressed EC points concatenated.
+ */
 constexpr std::size_t kEcGamalEncryptedTotalLength = kMPT_ELGAMAL_TOTAL_SIZE;
 
-/** Length of EC public key (compressed) */
+/**
+ * Length of EC public key (compressed)
+ */
 constexpr std::size_t kEcPubKeyLength = kMPT_PUBKEY_SIZE;
 
-/** Length of EC private key in bytes */
+/**
+ * Length of EC private key in bytes
+ */
 constexpr std::size_t kEcPrivKeyLength = kMPT_PRIVKEY_SIZE;
 
-/** Length of the EC blinding factor in bytes */
+/**
+ * Length of the EC blinding factor in bytes
+ */
 constexpr std::size_t kEcBlindingFactorLength = kMPT_BLINDING_FACTOR_SIZE;
 
-/** Length of Schnorr ZKProof for public key registration (compact form) in bytes */
+/**
+ * Length of Schnorr ZKProof for public key registration (compact form) in bytes
+ */
 constexpr std::size_t kEcSchnorrProofLength = kMPT_SCHNORR_PROOF_SIZE;
 
-/** Length of Pedersen Commitment (compressed) */
+/**
+ * Length of Pedersen Commitment (compressed)
+ */
 constexpr std::size_t kEcPedersenCommitmentLength = kMPT_PEDERSEN_COMMIT_SIZE;
 
-/** Length of single bulletproof (range proof for 1 commitment) in bytes */
+/**
+ * Length of single bulletproof (range proof for 1 commitment) in bytes
+ */
 constexpr std::size_t kEcSingleBulletproofLength = kMPT_SINGLE_BULLETPROOF_SIZE;
 
-/** Length of double bulletproof (range proof for 2 commitments) in bytes */
+/**
+ * Length of double bulletproof (range proof for 2 commitments) in bytes
+ */
 constexpr std::size_t kEcDoubleBulletproofLength = kMPT_DOUBLE_BULLETPROOF_SIZE;
 
-/** Length of the compact sigma proof component for ConfidentialMPTSend. */
+/**
+ * Length of the compact sigma proof component for ConfidentialMPTSend.
+ */
 constexpr std::size_t kEcSendSigmaProofLength = SECP256K1_COMPACT_STANDARD_PROOF_SIZE;
 
-/**  192 bytes compact sigma proof + 754 bytes double bulletproof. */
+/**
+ * 192 bytes compact sigma proof + 754 bytes double bulletproof.
+ */
 constexpr std::size_t kEcSendProofLength = kEcSendSigmaProofLength + kEcDoubleBulletproofLength;
 
-/** Length of the compact sigma proof component for ConfidentialMPTConvertBack. */
+/**
+ * Length of the compact sigma proof component for ConfidentialMPTConvertBack.
+ */
 constexpr std::size_t kEcConvertBackSigmaProofLength = SECP256K1_COMPACT_CONVERTBACK_PROOF_SIZE;
 
-/**  128 bytes compact sigma proof + 688 bytes single bulletproof. */
+/**
+ * 128 bytes compact sigma proof + 688 bytes single bulletproof.
+ */
 constexpr std::size_t kEcConvertBackProofLength =
     kEcConvertBackSigmaProofLength + kEcSingleBulletproofLength;
 
-/** Length of the ZKProof for ConfidentialMPTClawback. */
+/**
+ * Length of the ZKProof for ConfidentialMPTClawback.
+ */
 constexpr std::size_t kEcClawbackProofLength = SECP256K1_COMPACT_CLAWBACK_PROOF_SIZE;
 
-/** Extra base fee multiplier charged to confidential MPT transactions. */
+/**
+ * Extra base fee multiplier charged to confidential MPT transactions.
+ */
 constexpr std::uint32_t kConfidentialFeeMultiplier = 9;
 
-/** Compressed EC point prefix for even y-coordinate */
+/**
+ * Compressed EC point prefix for even y-coordinate
+ */
 constexpr std::uint8_t kEcCompressedPrefixEvenY = 0x02;
 
-/** Compressed EC point prefix for odd y-coordinate */
+/**
+ * Compressed EC point prefix for odd y-coordinate
+ */
 constexpr std::uint8_t kEcCompressedPrefixOddY = 0x03;
 
 }  // namespace xrpl
diff --git a/include/xrpl/protocol/PublicKey.h b/include/xrpl/protocol/PublicKey.h
index 13db17fc6e..98301af487 100644
--- a/include/xrpl/protocol/PublicKey.h
+++ b/include/xrpl/protocol/PublicKey.h
@@ -26,28 +26,29 @@
 
 namespace xrpl {
 
-/** A public key.
-
-    Public keys are used in the public-key cryptography
-    system used to verify signatures attached to messages.
-
-    The format of the public key is XRPL specific,
-    information needed to determine the cryptosystem
-    parameters used is stored inside the key.
-
-    As of this writing two systems are supported:
-
-        secp256k1
-        ed25519
-
-    secp256k1 public keys consist of a 33 byte
-    compressed public key, with the lead byte equal
-    to 0x02 or 0x03.
-
-    The ed25519 public keys consist of a 1 byte
-    prefix constant 0xED, followed by 32 bytes of
-    public key data.
-*/
+/**
+ * A public key.
+ *
+ * Public keys are used in the public-key cryptography
+ * system used to verify signatures attached to messages.
+ *
+ * The format of the public key is XRPL specific,
+ * information needed to determine the cryptosystem
+ * parameters used is stored inside the key.
+ *
+ * As of this writing two systems are supported:
+ *
+ *     secp256k1
+ *     ed25519
+ *
+ * secp256k1 public keys consist of a 33 byte
+ * compressed public key, with the lead byte equal
+ * to 0x02 or 0x03.
+ *
+ * The ed25519 public keys consist of a 1 byte
+ * prefix constant 0xED, followed by 32 bytes of
+ * public key data.
+ */
 class PublicKey
 {
 protected:
@@ -66,11 +67,12 @@ public:
     PublicKey&
     operator=(PublicKey const& other);
 
-    /** Create a public key.
-
-        Preconditions:
-            publicKeyType(slice) != std::nullopt
-    */
+    /**
+     * Create a public key.
+     *
+     * Preconditions:
+     *     publicKeyType(slice) != std::nullopt
+     */
     explicit PublicKey(Slice const& slice);
 
     [[nodiscard]] std::uint8_t const*
@@ -121,7 +123,8 @@ public:
     }
 };
 
-/** Print the public key to a stream.
+/**
+ * Print the public key to a stream.
  */
 std::ostream&
 operator<<(std::ostream& os, PublicKey const& pk);
@@ -180,39 +183,41 @@ parseBase58(TokenType type, std::string const& s);
 
 enum class ECDSACanonicality { Canonical, FullyCanonical };
 
-/** Determines the canonicality of a signature.
-
-    A canonical signature is in its most reduced form.
-    For example the R and S components do not contain
-    additional leading zeroes. However, even in
-    canonical form, (R,S) and (R,G-S) are both
-    valid signatures for message M.
-
-    Therefore, to prevent malleability attacks we
-    define a fully canonical signature as one where:
-
-        R < G - S
-
-    where G is the curve order.
-
-    This routine returns std::nullopt if the format
-    of the signature is invalid (for example, the
-    points are encoded incorrectly).
-
-    @return std::nullopt if the signature fails
-            validity checks.
-
-    @note Only the format of the signature is checked,
-          no verification cryptography is performed.
-*/
+/**
+ * Determines the canonicality of a signature.
+ *
+ * A canonical signature is in its most reduced form.
+ * For example the R and S components do not contain
+ * additional leading zeroes. However, even in
+ * canonical form, (R,S) and (R,G-S) are both
+ * valid signatures for message M.
+ *
+ * Therefore, to prevent malleability attacks we
+ * define a fully canonical signature as one where:
+ *
+ *     R < G - S
+ *
+ * where G is the curve order.
+ *
+ * This routine returns std::nullopt if the format
+ * of the signature is invalid (for example, the
+ * points are encoded incorrectly).
+ *
+ * @return std::nullopt if the signature fails
+ *         validity checks.
+ *
+ * @note Only the format of the signature is checked,
+ *       no verification cryptography is performed.
+ */
 std::optional<ECDSACanonicality>
 ecdsaCanonicality(Slice const& sig);
 
-/** Returns the type of public key.
-
-    @return std::nullopt If the public key does not
-            represent a known type.
-*/
+/**
+ * Returns the type of public key.
+ *
+ * @return std::nullopt If the public key does not
+ *         represent a known type.
+ */
 /** @{ */
 [[nodiscard]] std::optional<KeyType>
 publicKeyType(Slice const& slice);
@@ -224,7 +229,9 @@ publicKeyType(PublicKey const& publicKey)
 }
 /** @} */
 
-/** Verify a secp256k1 signature on the digest of a message. */
+/**
+ * Verify a secp256k1 signature on the digest of a message.
+ */
 [[nodiscard]] bool
 verifyDigest(
     PublicKey const& publicKey,
@@ -232,14 +239,17 @@ verifyDigest(
     Slice const& sig,
     bool mustBeFullyCanonical = true) noexcept;
 
-/** Verify a signature on a message.
-    With secp256k1 signatures, the data is first hashed with
-    SHA512-Half, and the resulting digest is signed.
-*/
+/**
+ * Verify a signature on a message.
+ * With secp256k1 signatures, the data is first hashed with
+ * SHA512-Half, and the resulting digest is signed.
+ */
 [[nodiscard]] bool
 verify(PublicKey const& publicKey, Slice const& m, Slice const& sig) noexcept;
 
-/** Calculate the 160-bit node ID from a node public key. */
+/**
+ * Calculate the 160-bit node ID from a node public key.
+ */
 NodeID
 calcNodeID(PublicKey const&);
 
diff --git a/include/xrpl/protocol/Quality.h b/include/xrpl/protocol/Quality.h
index de61d79ca5..3475efa977 100644
--- a/include/xrpl/protocol/Quality.h
+++ b/include/xrpl/protocol/Quality.h
@@ -14,15 +14,16 @@
 
 namespace xrpl {
 
-/** Represents a pair of input and output currencies.
-
-    The input currency can be converted to the output
-    currency by multiplying by the rate, represented by
-    Quality.
-
-    For offers, "in" is always TakerPays and "out" is
-    always TakerGets.
-*/
+/**
+ * Represents a pair of input and output currencies.
+ *
+ * The input currency can be converted to the output
+ * currency by multiplying by the rate, represented by
+ * Quality.
+ *
+ * For offers, "in" is always TakerPays and "out" is
+ * always TakerGets.
+ */
 template <class In, class Out>
 struct TAmounts
 {
@@ -36,7 +37,9 @@ struct TAmounts
     {
     }
 
-    /** Returns `true` if either quantity is not positive. */
+    /**
+     * Returns `true` if either quantity is not positive.
+     */
     [[nodiscard]] bool
     empty() const noexcept
     {
@@ -84,11 +87,12 @@ operator!=(TAmounts<In, Out> const& lhs, TAmounts<In, Out> const& rhs) noexcept
 // XRPL specific constant used for parsing qualities and other things
 #define QUALITY_ONE 1'000'000'000
 
-/** Represents the logical ratio of output currency to input currency.
-    Internally this is stored using a custom floating point representation,
-    as the inverse of the ratio, so that quality will be descending in
-    a sequence of actual values that represent qualities.
-*/
+/**
+ * Represents the logical ratio of output currency to input currency.
+ * Internally this is stored using a custom floating point representation,
+ * as the inverse of the ratio, so that quality will be descending in
+ * a sequence of actual values that represent qualities.
+ */
 class Quality
 {
 public:
@@ -109,26 +113,36 @@ private:
 public:
     Quality() = default;
 
-    /** Create a quality from the integer encoding of an STAmount */
+    /**
+     * Create a quality from the integer encoding of an STAmount
+     */
     explicit Quality(std::uint64_t value);
 
-    /** Create a quality from the ratio of two amounts. */
+    /**
+     * Create a quality from the ratio of two amounts.
+     */
     explicit Quality(Amounts const& amount);
 
-    /** Create a quality from the ratio of two amounts. */
+    /**
+     * Create a quality from the ratio of two amounts.
+     */
     template <class In, class Out>
     explicit Quality(TAmounts<In, Out> const& amount)
         : Quality(Amounts(toSTAmount(amount.in), toSTAmount(amount.out)))
     {
     }
 
-    /** Create a quality from the ratio of two amounts. */
+    /**
+     * Create a quality from the ratio of two amounts.
+     */
     template <class In, class Out>
     Quality(Out const& out, In const& in) : Quality(Amounts(toSTAmount(in), toSTAmount(out)))
     {
     }
 
-    /** Advances to the next higher quality level. */
+    /**
+     * Advances to the next higher quality level.
+     */
     /** @{ */
     Quality&
     operator++();
@@ -137,7 +151,9 @@ public:
     operator++(int);
     /** @} */
 
-    /** Advances to the next lower quality level. */
+    /**
+     * Advances to the next lower quality level.
+     */
     /** @{ */
     Quality&
     operator--();
@@ -146,23 +162,27 @@ public:
     operator--(int);
     /** @} */
 
-    /** Returns the quality as STAmount. */
+    /**
+     * Returns the quality as STAmount.
+     */
     [[nodiscard]] STAmount
     rate() const
     {
         return amountFromQuality(value_);
     }
 
-    /** Returns the quality rounded up to the specified number
-        of decimal digits.
-    */
+    /**
+     * Returns the quality rounded up to the specified number
+     * of decimal digits.
+     */
     [[nodiscard]] Quality
     round(int tickSize) const;
 
-    /** Returns the scaled amount with in capped.
-        Math is avoided if the result is exact. The output is clamped
-        to prevent money creation.
-    */
+    /**
+     * Returns the scaled amount with in capped.
+     * Math is avoided if the result is exact. The output is clamped
+     * to prevent money creation.
+     */
     [[nodiscard]] Amounts
     ceilIn(Amounts const& amount, STAmount const& limit) const;
 
@@ -180,10 +200,11 @@ public:
     [[nodiscard]] TAmounts<In, Out>
     ceilInStrict(TAmounts<In, Out> const& amount, In const& limit, bool roundUp) const;
 
-    /** Returns the scaled amount with out capped.
-        Math is avoided if the result is exact. The input is clamped
-        to prevent money creation.
-    */
+    /**
+     * Returns the scaled amount with out capped.
+     * Math is avoided if the result is exact. The input is clamped
+     * to prevent money creation.
+     */
     [[nodiscard]] Amounts
     ceilOut(Amounts const& amount, STAmount const& limit) const;
 
@@ -215,10 +236,11 @@ private:
         Round... round) const;
 
 public:
-    /** Returns `true` if lhs is lower quality than `rhs`.
-        Lower quality means the taker receives a worse deal.
-        Higher quality is better for the taker.
-    */
+    /**
+     * Returns `true` if lhs is lower quality than `rhs`.
+     * Lower quality means the taker receives a worse deal.
+     * Higher quality is better for the taker.
+     */
     friend bool
     operator<(Quality const& lhs, Quality const& rhs) noexcept
     {
@@ -357,10 +379,11 @@ Quality::ceilOutStrict(TAmounts<In, Out> const& amount, Out const& limit, bool r
     return ceilTAmountsHelper(amount, limit, amount.out, kCeilOutFnPtr, roundUp);
 }
 
-/** Calculate the quality of a two-hop path given the two hops.
-    @param lhs  The first leg of the path: input to intermediate.
-    @param rhs  The second leg of the path: intermediate to output.
-*/
+/**
+ * Calculate the quality of a two-hop path given the two hops.
+ * @param lhs  The first leg of the path: input to intermediate.
+ * @param rhs  The second leg of the path: intermediate to output.
+ */
 Quality
 composedQuality(Quality const& lhs, Quality const& rhs);
 
diff --git a/include/xrpl/protocol/QualityFunction.h b/include/xrpl/protocol/QualityFunction.h
index 7830519deb..128b37ce12 100644
--- a/include/xrpl/protocol/QualityFunction.h
+++ b/include/xrpl/protocol/QualityFunction.h
@@ -12,7 +12,8 @@
 
 namespace xrpl {
 
-/** Average quality of a path as a function of `out`: q(out) = m * out + b,
+/**
+ * Average quality of a path as a function of `out`: q(out) = m * out + b,
  * where m = -1 / poolGets, b = poolPays / poolGets. If CLOB offer then
  * `m` is equal to 0 `b` is equal to the offer's quality. The function
  * is derived by substituting `in` in q = out / in with the swap out formula
@@ -45,19 +46,22 @@ public:
     template <typename TIn, typename TOut>
     QualityFunction(TAmounts<TIn, TOut> const& amounts, std::uint32_t tfee, AMMTag);
 
-    /** Combines QF with the next step QF
+    /**
+     * Combines QF with the next step QF
      */
     void
     combine(QualityFunction const& qf);
 
-    /** Find output to produce the requested
+    /**
+     * Find output to produce the requested
      * average quality.
      * @param quality requested average quality (quality limit)
      */
     std::optional<Number>
     outFromAvgQ(Quality const& quality);
 
-    /** Return true if the quality function is constant
+    /**
+     * Return true if the quality function is constant
      */
     [[nodiscard]] bool
     isConst() const
diff --git a/include/xrpl/protocol/Rate.h b/include/xrpl/protocol/Rate.h
index b8b04c8fb9..048787cab5 100644
--- a/include/xrpl/protocol/Rate.h
+++ b/include/xrpl/protocol/Rate.h
@@ -10,12 +10,13 @@
 
 namespace xrpl {
 
-/** Represents a transfer rate
-
-    Transfer rates are specified as fractions of 1 billion.
-    For example, a transfer rate of 1% is represented as
-    1,010,000,000.
-*/
+/**
+ * Represents a transfer rate
+ *
+ * Transfer rates are specified as fractions of 1 billion.
+ * For example, a transfer rate of 1% is represented as
+ * 1,010,000,000.
+ */
 struct Rate : private boost::totally_ordered<Rate>
 {
     std::uint32_t value;
@@ -65,13 +66,17 @@ STAmount
 divideRound(STAmount const& amount, Rate const& rate, Asset const& asset, bool roundUp);
 
 namespace nft {
-/** Given a transfer fee (in basis points) convert it to a transfer rate. */
+/**
+ * Given a transfer fee (in basis points) convert it to a transfer rate.
+ */
 Rate
 transferFeeAsRate(std::uint16_t fee);
 
 }  // namespace nft
 
-/** A transfer rate signifying a 1:1 exchange */
+/**
+ * A transfer rate signifying a 1:1 exchange
+ */
 extern Rate const kParityRate;
 
 }  // namespace xrpl
diff --git a/include/xrpl/protocol/Rules.h b/include/xrpl/protocol/Rules.h
index da2031650f..2c2136b6e8 100644
--- a/include/xrpl/protocol/Rules.h
+++ b/include/xrpl/protocol/Rules.h
@@ -11,7 +11,8 @@
 
 namespace xrpl {
 
-/** Check whether a feature is enabled in the current ledger rules
+/**
+ * Check whether a feature is enabled in the current ledger rules
  *
  * @param feature The feature to be tested.
  * @param resultIfNoRules What to return if called from outside a Transactor context.
@@ -19,7 +20,8 @@ namespace xrpl {
 bool
 isFeatureEnabled(uint256 const& feature, bool resultIfNoRules);
 
-/** Check whether a feature is enabled in the current ledger rules
+/**
+ * Check whether a feature is enabled in the current ledger rules
  *
  * @param feature The feature to be tested.
  *
@@ -31,7 +33,9 @@ isFeatureEnabled(uint256 const& feature);
 
 class DigestAwareReadView;
 
-/** Rules controlling protocol behavior. */
+/**
+ * Rules controlling protocol behavior.
+ */
 class Rules
 {
 private:
@@ -54,11 +58,12 @@ public:
 
     Rules() = delete;
 
-    /** Construct an empty rule set.
-
-        These are the rules reflected by
-        the genesis ledger.
-    */
+    /**
+     * Construct an empty rule set.
+     *
+     * These are the rules reflected by
+     * the genesis ledger.
+     */
     explicit Rules(std::unordered_set<uint256, beast::Uhash<>> const& presets);
 
 private:
@@ -80,14 +85,17 @@ private:
     presets() const;
 
 public:
-    /** Returns `true` if a feature is enabled. */
+    /**
+     * Returns `true` if a feature is enabled.
+     */
     [[nodiscard]] bool
     enabled(uint256 const& feature) const;
 
-    /** Returns `true` if two rule sets are identical.
-
-        @note This is for diagnostics.
-    */
+    /**
+     * Returns `true` if two rule sets are identical.
+     *
+     * @note This is for diagnostics.
+     */
     bool
     operator==(Rules const&) const;
 
@@ -101,7 +109,8 @@ getCurrentTransactionRules();
 void
 setCurrentTransactionRules(std::optional<Rules> r);
 
-/** RAII class to set and restore the current transaction rules
+/**
+ * RAII class to set and restore the current transaction rules
  */
 class CurrentTransactionRulesGuard
 {
diff --git a/include/xrpl/protocol/SField.h b/include/xrpl/protocol/SField.h
index d97bcb0a1d..21ab7813f9 100644
--- a/include/xrpl/protocol/SField.h
+++ b/include/xrpl/protocol/SField.h
@@ -117,16 +117,17 @@ fieldCode(int id, int index)
     return (id << 16) | index;
 }
 
-/** Identifies fields.
-
-    Fields are necessary to tag data in signed transactions so that
-    the binary format of the transaction can be canonicalized.  All
-    SFields are created at compile time.
-
-    Each SField, once constructed, lives until program termination, and there
-    is only one instance per fieldType/fieldValue pair which serves the
-    entire application.
-*/
+/**
+ * Identifies fields.
+ *
+ * Fields are necessary to tag data in signed transactions so that
+ * the binary format of the transaction can be canonicalized.  All
+ * SFields are created at compile time.
+ *
+ * Each SField, once constructed, lives until program termination, and there
+ * is only one instance per fieldType/fieldValue pair which serves the
+ * entire application.
+ */
 class SField
 {
 public:
@@ -299,7 +300,9 @@ private:
     static std::unordered_map<std::string, SField const*> knownNameToField;
 };
 
-/** A field with a type known at compile time. */
+/**
+ * A field with a type known at compile time.
+ */
 template <class T>
 struct TypedField : SField
 {
@@ -309,7 +312,9 @@ struct TypedField : SField
     explicit TypedField(PrivateAccessTagT pat, Args&&... args);
 };
 
-/** Indicate std::optional field semantics. */
+/**
+ * Indicate std::optional field semantics.
+ */
 template <class T>
 struct OptionaledField
 {
diff --git a/include/xrpl/protocol/SOTemplate.h b/include/xrpl/protocol/SOTemplate.h
index 682a7c655e..cb24ee315a 100644
--- a/include/xrpl/protocol/SOTemplate.h
+++ b/include/xrpl/protocol/SOTemplate.h
@@ -12,7 +12,9 @@
 
 namespace xrpl {
 
-/** Kind of element in each entry of an SOTemplate. */
+/**
+ * Kind of element in each entry of an SOTemplate.
+ */
 // 2026 usages, 129 files
 // NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
 enum SOEStyle {
@@ -25,13 +27,17 @@ enum SOEStyle {
 };
 
 // Part of a Python-parsed DSL (transactions.macro); bare enumerator names required by the parser
-/** Amount fields that can support MPT */
+/**
+ * Amount fields that can support MPT
+ */
 // NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
 enum SOETxMPTIssue { SoeMptNone, SoeMptSupported, SoeMptNotSupported };
 
 //------------------------------------------------------------------------------
 
-/** An element in a SOTemplate. */
+/**
+ * An element in a SOTemplate.
+ */
 class SOElement
 {
     // Use std::reference_wrapper so SOElement can be stored in a std::vector.
@@ -90,10 +96,11 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** Defines the fields and their attributes within a STObject.
-    Each subclass of SerializedObject will provide its own template
-    describing the available fields and their metadata attributes.
-*/
+/**
+ * Defines the fields and their attributes within a STObject.
+ * Each subclass of SerializedObject will provide its own template
+ * describing the available fields and their metadata attributes.
+ */
 class SOTemplate
 {
 public:
@@ -103,14 +110,16 @@ public:
     SOTemplate&
     operator=(SOTemplate&& other) = default;
 
-    /** Create a template populated with all fields.
-        After creating the template fields cannot be added, modified, or removed.
-    */
+    /**
+     * Create a template populated with all fields.
+     * After creating the template fields cannot be added, modified, or removed.
+     */
     SOTemplate(std::vector<SOElement> uniqueFields, std::vector<SOElement> commonFields = {});
 
-    /** Create a template populated with all fields.
-        Note: Defers to the vector constructor above.
-    */
+    /**
+     * Create a template populated with all fields.
+     * Note: Defers to the vector constructor above.
+     */
     SOTemplate(
         std::initializer_list<SOElement> uniqueFields,
         std::initializer_list<SOElement> commonFields = {});
@@ -140,14 +149,18 @@ public:
         return end();
     }
 
-    /** The number of entries in this template */
+    /**
+     * The number of entries in this template
+     */
     [[nodiscard]] std::size_t
     size() const
     {
         return elements_.size();
     }
 
-    /** Retrieve the position of a named field. */
+    /**
+     * Retrieve the position of a named field.
+     */
     [[nodiscard]] int
     getIndex(SField const&) const;
 
diff --git a/include/xrpl/protocol/STAmount.h b/include/xrpl/protocol/STAmount.h
index 5e53a85129..cc80481582 100644
--- a/include/xrpl/protocol/STAmount.h
+++ b/include/xrpl/protocol/STAmount.h
@@ -190,7 +190,9 @@ public:
     [[nodiscard]] int
     signum() const noexcept;
 
-    /** Returns a zero value with the same issuer and currency. */
+    /**
+     * Returns a zero value with the same issuer and currency.
+     */
     [[nodiscard]] STAmount
     zeroed() const;
 
@@ -255,7 +257,9 @@ public:
     void
     clear(Asset const& asset);
 
-    /** Set the Issue for this amount. */
+    /**
+     * Set the Issue for this amount.
+     */
     void
     setIssue(Asset const& asset);
 
@@ -704,7 +708,8 @@ divRoundStrict(STAmount const& v1, STAmount const& v2, Asset const& asset, bool
 std::uint64_t
 getRate(STAmount const& offerOut, STAmount const& offerIn);
 
-/** Round an arbitrary precision Amount to the precision of an STAmount that has
+/**
+ * Round an arbitrary precision Amount to the precision of an STAmount that has
  * a given exponent.
  *
  * This is used to ensure that calculations involving IOU amounts do not collect
@@ -714,7 +719,6 @@ getRate(STAmount const& offerOut, STAmount const& offerIn);
  * @param scale An exponent value to establish the precision limit of
  *     `value`. Should be larger than `value.exponent()`.
  * @param rounding Optional Number rounding mode
- *
  */
 [[nodiscard]] STAmount
 roundToScale(
@@ -722,7 +726,8 @@ roundToScale(
     std::int32_t scale,
     Number::RoundingMode rounding = Number::getround());
 
-/** Round an arbitrary precision Number IN PLACE to the precision of a given
+/**
+ * Round an arbitrary precision Number IN PLACE to the precision of a given
  * Asset.
  *
  * This is used to ensure that calculations do not collect dust for IOUs, or
@@ -738,7 +743,8 @@ roundToAsset(A const& asset, Number& value)
     value = STAmount{asset, value};
 }
 
-/** Round an arbitrary precision Number to the precision of a given Asset.
+/**
+ * Round an arbitrary precision Number to the precision of a given Asset.
  *
  * This is used to ensure that calculations do not collect dust beyond specified
  * scale for IOUs, or fractional amounts for the integral types XRP and MPT.
@@ -780,7 +786,8 @@ canAdd(STAmount const& amt1, STAmount const& amt2);
 bool
 canSubtract(STAmount const& amt1, STAmount const& amt2);
 
-/** Get the scale of a Number for a given asset.
+/**
+ * Get the scale of a Number for a given asset.
  *
  * "scale" is similar to "exponent", but from the perspective of STAmount, which has different rules
  * and mantissa ranges for determining the exponent than Number.
diff --git a/include/xrpl/protocol/STBase.h b/include/xrpl/protocol/STBase.h
index 341c80edd7..acc5500a57 100644
--- a/include/xrpl/protocol/STBase.h
+++ b/include/xrpl/protocol/STBase.h
@@ -15,7 +15,9 @@
 
 namespace xrpl {
 
-/// Note, should be treated as flags that can be | and &
+/**
+ * Note, should be treated as flags that can be | and &
+ */
 struct JsonOptions
 {
     using underlying_t = unsigned int;
@@ -53,22 +55,28 @@ struct JsonOptions
     [[nodiscard]] constexpr auto friend
     operator!=(JsonOptions lh, JsonOptions rh) noexcept -> bool = default;
 
-    /// Returns JsonOptions union of lh and rh
+    /**
+     * Returns JsonOptions union of lh and rh
+     */
     [[nodiscard]] constexpr JsonOptions friend
     operator|(JsonOptions lh, JsonOptions rh) noexcept
     {
         return {lh.value | rh.value};
     }
 
-    /// Returns JsonOptions intersection of lh and rh
+    /**
+     * Returns JsonOptions intersection of lh and rh
+     */
     [[nodiscard]] constexpr JsonOptions friend
     operator&(JsonOptions lh, JsonOptions rh) noexcept
     {
         return {lh.value & rh.value};
     }
 
-    /// Returns JsonOptions binary negation, can be used with & (above) for set
-    /// difference e.g. `(options & ~JsonOptions::kIncludeDate)`
+    /**
+     * Returns JsonOptions binary negation, can be used with & (above) for set
+     * difference e.g. `(options & ~JsonOptions::kIncludeDate)`
+     */
     [[nodiscard]] constexpr JsonOptions friend
     operator~(JsonOptions v) noexcept
     {
@@ -103,19 +111,20 @@ class STVar;
 
 //------------------------------------------------------------------------------
 
-/** A type which can be exported to a well known binary format.
-
-    A STBase:
-        - Always a field
-        - Can always go inside an eligible enclosing STBase
-            (such as STArray)
-        - Has a field name
-
-    Like JSON, a SerializedObject is a basket which has rules
-    on what it can hold.
-
-    @note "ST" stands for "Serialized Type."
-*/
+/**
+ * A type which can be exported to a well known binary format.
+ *
+ * A STBase:
+ *     - Always a field
+ *     - Can always go inside an eligible enclosing STBase
+ *         (such as STArray)
+ *     - Has a field name
+ *
+ * Like JSON, a SerializedObject is a basket which has rules
+ * on what it can hold.
+ *
+ * @note "ST" stands for "Serialized Type."
+ */
 class STBase
 {
     SField const* fName_;
@@ -162,9 +171,10 @@ public:
     [[nodiscard]] virtual bool
     isDefault() const;
 
-    /** A STBase is a field.
-        This sets the name.
-    */
+    /**
+     * A STBase is a field.
+     * This sets the name.
+     */
     void
     setFName(SField const& n);
 
diff --git a/include/xrpl/protocol/STExchange.h b/include/xrpl/protocol/STExchange.h
index a9c1f57bd8..ad5bd4c012 100644
--- a/include/xrpl/protocol/STExchange.h
+++ b/include/xrpl/protocol/STExchange.h
@@ -18,7 +18,9 @@
 
 namespace xrpl {
 
-/** Convert between serialized type U and C++ type T. */
+/**
+ * Convert between serialized type U and C++ type T.
+ */
 template <class U, class T>
 struct STExchange;
 
@@ -90,7 +92,9 @@ struct STExchange<STBlob, Buffer>
 
 //------------------------------------------------------------------------------
 
-/** Return the value of a field in an STObject as a given type. */
+/**
+ * Return the value of a field in an STObject as a given type.
+ */
 /** @{ */
 template <class T, class U>
 std::optional<T>
@@ -119,7 +123,9 @@ get(STObject const& st, TypedField<U> const& f)
 }
 /** @} */
 
-/** Set a field value in an STObject. */
+/**
+ * Set a field value in an STObject.
+ */
 template <class U, class T>
 void
 set(STObject& st, TypedField<U> const& f, T&& t)
@@ -127,7 +133,9 @@ set(STObject& st, TypedField<U> const& f, T&& t)
     st.set(STExchange<U, std::decay_t<T>>::set(f, std::forward<T>(t)));
 }
 
-/** Set a blob field using an init function. */
+/**
+ * Set a blob field using an init function.
+ */
 template <class Init>
 void
 set(STObject& st, TypedField<STBlob> const& f, std::size_t size, Init&& init)
@@ -135,7 +143,9 @@ set(STObject& st, TypedField<STBlob> const& f, std::size_t size, Init&& init)
     st.set(std::make_unique<STBlob>(f, size, init));
 }
 
-/** Set a blob field from data. */
+/**
+ * Set a blob field from data.
+ */
 template <class = void>
 void
 set(STObject& st, TypedField<STBlob> const& f, void const* data, std::size_t size)
@@ -143,7 +153,9 @@ set(STObject& st, TypedField<STBlob> const& f, void const* data, std::size_t siz
     st.set(std::make_unique<STBlob>(f, data, size));
 }
 
-/** Remove a field in an STObject. */
+/**
+ * Remove a field in an STObject.
+ */
 template <class U>
 void
 erase(STObject& st, TypedField<U> const& f)
diff --git a/include/xrpl/protocol/STLedgerEntry.h b/include/xrpl/protocol/STLedgerEntry.h
index a5f449f99c..8731488adb 100644
--- a/include/xrpl/protocol/STLedgerEntry.h
+++ b/include/xrpl/protocol/STLedgerEntry.h
@@ -33,7 +33,9 @@ public:
     using const_pointer = std::shared_ptr<STLedgerEntry const>;
     using const_ref = std::shared_ptr<STLedgerEntry const> const&;
 
-    /** Create an empty object with the given key and type. */
+    /**
+     * Create an empty object with the given key and type.
+     */
     explicit STLedgerEntry(Keylet const& k);
     STLedgerEntry(LedgerEntryType type, uint256 const& key);
     STLedgerEntry(SerialIter& sit, uint256 const& index);
@@ -52,10 +54,11 @@ public:
     [[nodiscard]] json::Value
     getJson(JsonOptions options = JsonOptions::Values::None) const override;
 
-    /** Returns the 'key' (or 'index') of this item.
-        The key identifies this entry's position in
-        the SHAMap associative container.
-    */
+    /**
+     * Returns the 'key' (or 'index') of this item.
+     * The key identifies this entry's position in
+     * the SHAMap associative container.
+     */
     [[nodiscard]] uint256 const&
     key() const;
 
@@ -105,10 +108,11 @@ inline STLedgerEntry::STLedgerEntry(
 {
 }
 
-/** Returns the 'key' (or 'index') of this item.
-    The key identifies this entry's position in
-    the SHAMap associative container.
-*/
+/**
+ * Returns the 'key' (or 'index') of this item.
+ * The key identifies this entry's position in
+ * the SHAMap associative container.
+ */
 inline uint256 const&
 STLedgerEntry::key() const
 {
diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index 9abf56e91b..a1cdff22e0 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -229,8 +229,10 @@ public:
     [[nodiscard]] AccountID
     getAccountID(SField const& field) const;
 
-    /** The account responsible for the authorization: the delegate when
-        sfDelegate is present, otherwise the account. */
+    /**
+     * The account responsible for the authorization: the delegate when
+     * sfDelegate is present, otherwise the account.
+     */
     [[nodiscard]] AccountID
     getInitiator() const;
 
@@ -252,103 +254,112 @@ public:
     [[nodiscard]] STNumber const&
     getFieldNumber(SField const& field) const;
 
-    /** Get the value of a field.
-        @param A TypedField built from an SField value representing the desired
-            object field. In typical use, the TypedField will be implicitly
-            constructed.
-        @return The value of the specified field.
-        @throws STObject::FieldErr if the field is not present.
-    */
+    /**
+     * Get the value of a field.
+     * @param A TypedField built from an SField value representing the desired
+     *     object field. In typical use, the TypedField will be implicitly
+     *     constructed.
+     * @return The value of the specified field.
+     * @throws STObject::FieldErr if the field is not present.
+     */
     template <class T>
     T::value_type
     operator[](TypedField<T> const& f) const;
 
-    /** Get the value of a field as a std::optional
-
-        @param An OptionaledField built from an SField value representing the
-           desired object field. In typical use, the OptionaledField will be
-           constructed by using the ~ operator on an SField.
-        @return std::nullopt if the field is not present, else the value of
-           the specified field.
-    */
+    /**
+     * Get the value of a field as a std::optional
+     *
+     * @param An OptionaledField built from an SField value representing the
+     *    desired object field. In typical use, the OptionaledField will be
+     *    constructed by using the ~ operator on an SField.
+     * @return std::nullopt if the field is not present, else the value of
+     *    the specified field.
+     */
     template <class T>
     std::optional<std::decay_t<typename T::value_type>>
     operator[](OptionaledField<T> const& of) const;
 
-    /** Get a modifiable field value.
-        @param A TypedField built from an SField value representing the desired
-            object field. In typical use, the TypedField will be implicitly
-            constructed.
-        @return A modifiable reference to the value of the specified field.
-        @throws STObject::FieldErr if the field is not present.
-    */
+    /**
+     * Get a modifiable field value.
+     * @param A TypedField built from an SField value representing the desired
+     *     object field. In typical use, the TypedField will be implicitly
+     *     constructed.
+     * @return A modifiable reference to the value of the specified field.
+     * @throws STObject::FieldErr if the field is not present.
+     */
     template <class T>
     ValueProxy<T>
     operator[](TypedField<T> const& f);
 
-    /** Return a modifiable field value as std::optional
-
-        @param An OptionaledField built from an SField value representing the
-            desired object field. In typical use, the OptionaledField will be
-            constructed by using the ~ operator on an SField.
-        @return Transparent proxy object to an `optional` holding a modifiable
-            reference to the value of the specified field. Returns
-            std::nullopt if the field is not present.
-    */
+    /**
+     * Return a modifiable field value as std::optional
+     *
+     * @param An OptionaledField built from an SField value representing the
+     *     desired object field. In typical use, the OptionaledField will be
+     *     constructed by using the ~ operator on an SField.
+     * @return Transparent proxy object to an `optional` holding a modifiable
+     *     reference to the value of the specified field. Returns
+     *     std::nullopt if the field is not present.
+     */
     template <class T>
     OptionalProxy<T>
     operator[](OptionaledField<T> const& of);
 
-    /** Get the value of a field.
-        @param A TypedField built from an SField value representing the desired
-            object field. In typical use, the TypedField will be implicitly
-            constructed.
-        @return The value of the specified field.
-        @throws STObject::FieldErr if the field is not present.
-    */
+    /**
+     * Get the value of a field.
+     * @param A TypedField built from an SField value representing the desired
+     *     object field. In typical use, the TypedField will be implicitly
+     *     constructed.
+     * @return The value of the specified field.
+     * @throws STObject::FieldErr if the field is not present.
+     */
     template <class T>
     [[nodiscard]] T::value_type
     at(TypedField<T> const& f) const;
 
-    /** Get the value of a field as std::optional
-
-        @param An OptionaledField built from an SField value representing the
-           desired object field. In typical use, the OptionaledField will be
-           constructed by using the ~ operator on an SField.
-        @return std::nullopt if the field is not present, else the value of
-           the specified field.
-    */
+    /**
+     * Get the value of a field as std::optional
+     *
+     * @param An OptionaledField built from an SField value representing the
+     *    desired object field. In typical use, the OptionaledField will be
+     *    constructed by using the ~ operator on an SField.
+     * @return std::nullopt if the field is not present, else the value of
+     *    the specified field.
+     */
     template <class T>
     [[nodiscard]] std::optional<std::decay_t<typename T::value_type>>
     at(OptionaledField<T> const& of) const;
 
-    /** Get a modifiable field value.
-        @param A TypedField built from an SField value representing the desired
-            object field. In typical use, the TypedField will be implicitly
-            constructed.
-        @return A modifiable reference to the value of the specified field.
-        @throws STObject::FieldErr if the field is not present.
-    */
+    /**
+     * Get a modifiable field value.
+     * @param A TypedField built from an SField value representing the desired
+     *     object field. In typical use, the TypedField will be implicitly
+     *     constructed.
+     * @return A modifiable reference to the value of the specified field.
+     * @throws STObject::FieldErr if the field is not present.
+     */
     template <class T>
     ValueProxy<T>
     at(TypedField<T> const& f);
 
-    /** Return a modifiable field value as std::optional
-
-        @param An OptionaledField built from an SField value representing the
-            desired object field. In typical use, the OptionaledField will be
-            constructed by using the ~ operator on an SField.
-        @return Transparent proxy object to an `optional` holding a modifiable
-            reference to the value of the specified field. Returns
-            std::nullopt if the field is not present.
-    */
+    /**
+     * Return a modifiable field value as std::optional
+     *
+     * @param An OptionaledField built from an SField value representing the
+     *     desired object field. In typical use, the OptionaledField will be
+     *     constructed by using the ~ operator on an SField.
+     * @return Transparent proxy object to an `optional` holding a modifiable
+     *     reference to the value of the specified field. Returns
+     *     std::nullopt if the field is not present.
+     */
     template <class T>
     OptionalProxy<T>
     at(OptionaledField<T> const& of);
 
-    /** Set a field.
-        if the field already exists, it is replaced.
-    */
+    /**
+     * Set a field.
+     * if the field already exists, it is replaced.
+     */
     void
     set(std::unique_ptr<STBase> v);
 
@@ -503,8 +514,10 @@ public:
     value_type
     operator*() const;
 
-    /// Do not use operator->() unless the field is required, or you've checked
-    /// that it's set.
+    /**
+     * Do not use operator->() unless the field is required, or you've checked
+     * that it's set.
+     */
     T const*
     operator->() const;
 
@@ -604,17 +617,20 @@ public:
     OptionalProxy&
     operator=(OptionalProxy const&) = delete;
 
-    /** Returns `true` if the field is set.
-
-        Fields with soeDEFAULT and set to the
-        default value will return `true`
-    */
+    /**
+     * Returns `true` if the field is set.
+     *
+     * Fields with soeDEFAULT and set to the
+     * default value will return `true`
+     */
     explicit
     operator bool() const noexcept;
 
     operator optional_type() const;
 
-    /** Explicit conversion to std::optional */
+    /**
+     * Explicit conversion to std::optional
+     */
     optional_type
     operator~() const;
 
@@ -761,8 +777,10 @@ STObject::Proxy<T>::operator*() const -> value_type
     return this->value();
 }
 
-/// Do not use operator->() unless the field is required, or you've checked that
-/// it's set.
+/**
+ * Do not use operator->() unless the field is required, or you've checked that
+ * it's set.
+ */
 template <class T>
 T const*
 STObject::Proxy<T>::operator->() const
diff --git a/include/xrpl/protocol/STParsedJSON.h b/include/xrpl/protocol/STParsedJSON.h
index 1eeecc8b9e..7189e0ec89 100644
--- a/include/xrpl/protocol/STParsedJSON.h
+++ b/include/xrpl/protocol/STParsedJSON.h
@@ -9,26 +9,33 @@
 
 namespace xrpl {
 
-/** Maximum JSON object nesting depth permitted during parsing. */
+/**
+ * Maximum JSON object nesting depth permitted during parsing.
+ */
 inline constexpr std::size_t kMaxParsedJsonDepth = 64;
 
-/** Maximum number of elements permitted in any JSON array field during parsing.
-    Requests exceeding this limit are rejected with an invalidParams error. */
+/**
+ * Maximum number of elements permitted in any JSON array field during parsing.
+ * Requests exceeding this limit are rejected with an invalidParams error.
+ */
 inline constexpr std::size_t kMaxParsedJsonArraySize = 512;
 
-/** Holds the serialized result of parsing an input JSON object.
-    This does validation and checking on the provided JSON.
-*/
+/**
+ * Holds the serialized result of parsing an input JSON object.
+ * This does validation and checking on the provided JSON.
+ */
 class STParsedJSONObject
 {
 public:
-    /** Parses and creates an STParsedJSON object.
-        The result of the parsing is stored in object and error.
-        Exceptions:
-            Does not throw.
-        @param name The name of the JSON field, used in diagnostics.
-        @param json The JSON-RPC to parse.
-    */
+    /**
+     * Parses and creates an STParsedJSON object.
+     * The result of the parsing is stored in object and error.
+     *
+     * @note Does not throw.
+     *
+     * @param name The name of the JSON field, used in diagnostics.
+     * @param json The JSON-RPC to parse.
+     */
     STParsedJSONObject(std::string const& name, json::Value const& json);
 
     STParsedJSONObject() = delete;
@@ -37,10 +44,14 @@ public:
     operator=(STParsedJSONObject const&) = delete;
     ~STParsedJSONObject() = default;
 
-    /** The STObject if the parse was successful. */
+    /**
+     * The STObject if the parse was successful.
+     */
     std::optional<STObject> object;
 
-    /** On failure, an appropriate set of error values. */
+    /**
+     * On failure, an appropriate set of error values.
+     */
     json::Value error;
 };
 
diff --git a/include/xrpl/protocol/STTakesAsset.h b/include/xrpl/protocol/STTakesAsset.h
index 70bafd0e91..95667e4868 100644
--- a/include/xrpl/protocol/STTakesAsset.h
+++ b/include/xrpl/protocol/STTakesAsset.h
@@ -7,7 +7,8 @@
 
 namespace xrpl {
 
-/** Intermediate class for any STBase-derived class to store an Asset.
+/**
+ * Intermediate class for any STBase-derived class to store an Asset.
  *
  * In the class definition, this class should be specified as a base class
  * _instead_ of STBase.
@@ -41,7 +42,8 @@ STTakesAsset::associateAsset(Asset const& a)
 
 class STLedgerEntry;
 
-/** Associate an Asset with all sMD_NeedsAsset fields in a ledger entry.
+/**
+ * Associate an Asset with all sMD_NeedsAsset fields in a ledger entry.
  *
  * This function iterates over all fields in the given ledger entry. For each
  * field that is set and has the SField::sMD_NeedsAsset metadata flag, it calls
@@ -54,7 +56,6 @@ class STLedgerEntry;
  *
  * @param sle The ledger entry whose fields will be updated.
  * @param asset The Asset to associate with the relevant fields.
- *
  */
 void
 associateAsset(STLedgerEntry& sle, Asset const& asset);
diff --git a/include/xrpl/protocol/STTx.h b/include/xrpl/protocol/STTx.h
index 5d5424e623..989bd11c10 100644
--- a/include/xrpl/protocol/STTx.h
+++ b/include/xrpl/protocol/STTx.h
@@ -55,12 +55,13 @@ public:
     explicit STTx(SerialIter&& sit);
     explicit STTx(STObject&& object);
 
-    /** Constructs a transaction.
-
-        The returned transaction will have the specified type and
-        any fields that the callback function adds to the object
-        that's passed in.
-    */
+    /**
+     * Constructs a transaction.
+     *
+     * The returned transaction will have the specified type and
+     * any fields that the callback function adds to the object
+     * that's passed in.
+     */
     STTx(TxType type, std::function<void(STObject&)> assembler);
 
     // STObject functions.
@@ -92,7 +93,9 @@ public:
     [[nodiscard]] SeqProxy
     getSeqProxy() const;
 
-    /** Returns the first non-zero value of (Sequence, TicketSequence). */
+    /**
+     * Returns the first non-zero value of (Sequence, TicketSequence).
+     */
     [[nodiscard]] std::uint32_t
     getSeqValue() const;
 
@@ -114,10 +117,11 @@ public:
         SecretKey const& secretKey,
         std::optional<std::reference_wrapper<SField const>> signatureTarget = {});
 
-    /** Check the signature.
-        @param rules The current ledger rules.
-        @return `true` if valid signature. If invalid, the error message string.
-    */
+    /**
+     * Check the signature.
+     * @param rules The current ledger rules.
+     * @return `true` if valid signature. If invalid, the error message string.
+     */
     [[nodiscard]] std::expected<void, std::string>
     checkSign(Rules const& rules) const;
 
@@ -145,12 +149,13 @@ public:
     getFeePayerID() const;
 
 private:
-    /** Check the signature.
-        @param rules The current ledger rules.
-        @param sigObject Reference to object that contains the signature fields.
-            Will be *this more often than not.
-        @return `true` if valid signature. If invalid, the error message string.
-    */
+    /**
+     * Check the signature.
+     * @param rules The current ledger rules.
+     * @param sigObject Reference to object that contains the signature fields.
+     *     Will be *this more often than not.
+     * @return `true` if valid signature. If invalid, the error message string.
+     */
     [[nodiscard]] std::expected<void, std::string>
     checkSign(Rules const& rules, STObject const& sigObject) const;
 
@@ -181,17 +186,20 @@ private:
 bool
 passesLocalChecks(STObject const& st, std::string&);
 
-/** Sterilize a transaction.
-
-    The transaction is serialized and then deserialized,
-    ensuring that all equivalent transactions are in canonical
-    form. This also ensures that program metadata such as
-    the transaction's digest, are all computed.
-*/
+/**
+ * Sterilize a transaction.
+ *
+ * The transaction is serialized and then deserialized,
+ * ensuring that all equivalent transactions are in canonical
+ * form. This also ensures that program metadata such as
+ * the transaction's digest, are all computed.
+ */
 std::shared_ptr<STTx const>
 sterilize(STTx const& stx);
 
-/** Check whether a transaction is a pseudo-transaction */
+/**
+ * Check whether a transaction is a pseudo-transaction
+ */
 bool
 isPseudoTx(STObject const& tx);
 
diff --git a/include/xrpl/protocol/STValidation.h b/include/xrpl/protocol/STValidation.h
index 67a6594419..444fdfa600 100644
--- a/include/xrpl/protocol/STValidation.h
+++ b/include/xrpl/protocol/STValidation.h
@@ -54,30 +54,32 @@ class STValidation final : public STObject, public CountedObject<STValidation>
     NetClock::time_point seenTime_;
 
 public:
-    /** Construct a STValidation from a peer from serialized data.
-
-        @param sit Iterator over serialized data
-        @param lookupNodeID Invocable with signature
-                               NodeID(PublicKey const&)
-                            used to find the Node ID based on the public key
-                            that signed the validation. For manifest based
-                            validators, this should be the NodeID of the master
-                            public key.
-        @param checkSignature Whether to verify the data was signed properly
-
-        @note Throws if the object is not valid
-    */
+    /**
+     * Construct a STValidation from a peer from serialized data.
+     *
+     * @param sit Iterator over serialized data
+     * @param lookupNodeID Invocable with signature
+     *                        NodeID(PublicKey const&)
+     *                     used to find the Node ID based on the public key
+     *                     that signed the validation. For manifest based
+     *                     validators, this should be the NodeID of the master
+     *                     public key.
+     * @param checkSignature Whether to verify the data was signed properly
+     *
+     * @note Throws if the object is not valid
+     */
     template <class LookupNodeID>
     STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, bool checkSignature);
 
-    /** Construct, sign and trust a new STValidation issued by this node.
-
-        @param signTime When the validation is signed
-        @param publicKey The current signing public key
-        @param secretKey The current signing secret key
-        @param nodeID ID corresponding to node's public master key
-        @param f callback function to "fill" the validation with necessary data
-    */
+    /**
+     * Construct, sign and trust a new STValidation issued by this node.
+     *
+     * @param signTime When the validation is signed
+     * @param publicKey The current signing public key
+     * @param secretKey The current signing secret key
+     * @param nodeID ID corresponding to node's public master key
+     * @param f callback function to "fill" the validation with necessary data
+     */
     template <typename F>
     STValidation(
         NetClock::time_point signTime,
@@ -183,14 +185,15 @@ STValidation::STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, bool ch
     XRPL_ASSERT(nodeID_.isNonZero(), "xrpl::STValidation::STValidation(SerialIter) : nonzero node");
 }
 
-/** Construct, sign and trust a new STValidation issued by this node.
-
-    @param signTime When the validation is signed
-    @param publicKey The current signing public key
-    @param secretKey The current signing secret key
-    @param nodeID ID corresponding to node's public master key
-    @param f callback function to "fill" the validation with necessary data
-*/
+/**
+ * Construct, sign and trust a new STValidation issued by this node.
+ *
+ * @param signTime When the validation is signed
+ * @param publicKey The current signing public key
+ * @param secretKey The current signing secret key
+ * @param nodeID ID corresponding to node's public master key
+ * @param f callback function to "fill" the validation with necessary data
+ */
 template <typename F>
 STValidation::STValidation(
     NetClock::time_point signTime,
diff --git a/include/xrpl/protocol/STVector256.h b/include/xrpl/protocol/STVector256.h
index 46a1abc713..5a8418fef5 100644
--- a/include/xrpl/protocol/STVector256.h
+++ b/include/xrpl/protocol/STVector256.h
@@ -50,7 +50,9 @@ public:
     void
     setValue(STVector256 const& v);
 
-    /** Retrieve a copy of the vector we contain */
+    /**
+     * Retrieve a copy of the vector we contain
+     */
     explicit
     operator std::vector<uint256>() const;
 
@@ -138,7 +140,9 @@ STVector256::setValue(STVector256 const& v)
     value_ = v.value_;
 }
 
-/** Retrieve a copy of the vector we contain */
+/**
+ * Retrieve a copy of the vector we contain
+ */
 inline STVector256::
 operator std::vector<uint256>() const
 {
diff --git a/include/xrpl/protocol/SecretKey.h b/include/xrpl/protocol/SecretKey.h
index 8a0d917ab4..6d353acac0 100644
--- a/include/xrpl/protocol/SecretKey.h
+++ b/include/xrpl/protocol/SecretKey.h
@@ -17,7 +17,9 @@
 
 namespace xrpl {
 
-/** A secret key. */
+/**
+ * A secret key.
+ */
 class SecretKey
 {
 public:
@@ -56,11 +58,12 @@ public:
         return sizeof(buf_);
     }
 
-    /** Convert the secret key to a hexadecimal string.
-
-        @note The operator<< function is deliberately omitted
-        to avoid accidental exposure of secret key material.
-    */
+    /**
+     * Convert the secret key to a hexadecimal string.
+     *
+     * @note The operator<< function is deliberately omitted
+     * to avoid accidental exposure of secret key material.
+     */
     [[nodiscard]] std::string
     toString() const;
 
@@ -97,7 +100,9 @@ operator!=(SecretKey const& lhs, SecretKey const& rhs) = delete;
 
 //------------------------------------------------------------------------------
 
-/** Parse a secret key */
+/**
+ * Parse a secret key
+ */
 template <>
 std::optional<SecretKey>
 parseBase58(TokenType type, std::string const& s);
@@ -108,38 +113,48 @@ toBase58(TokenType type, SecretKey const& sk)
     return encodeBase58Token(type, sk.data(), sk.size());
 }
 
-/** Create a secret key using secure random numbers. */
+/**
+ * Create a secret key using secure random numbers.
+ */
 SecretKey
 randomSecretKey();
 
-/** Generate a new secret key deterministically. */
+/**
+ * Generate a new secret key deterministically.
+ */
 SecretKey
 generateSecretKey(KeyType type, Seed const& seed);
 
-/** Derive the public key from a secret key. */
+/**
+ * Derive the public key from a secret key.
+ */
 PublicKey
 derivePublicKey(KeyType type, SecretKey const& sk);
 
-/** Generate a key pair deterministically.
-
-    This algorithm is specific to the XRPL:
-
-    For secp256k1 key pairs, the seed is converted
-    to a Generator and used to compute the key pair
-    corresponding to ordinal 0 for the generator.
-*/
+/**
+ * Generate a key pair deterministically.
+ *
+ * This algorithm is specific to the XRPL:
+ *
+ * For secp256k1 key pairs, the seed is converted
+ * to a Generator and used to compute the key pair
+ * corresponding to ordinal 0 for the generator.
+ */
 std::pair<PublicKey, SecretKey>
 generateKeyPair(KeyType type, Seed const& seed);
 
-/** Create a key pair using secure random numbers. */
+/**
+ * Create a key pair using secure random numbers.
+ */
 std::pair<PublicKey, SecretKey>
 randomKeyPair(KeyType type);
 
-/** Generate a signature for a message digest.
-    This can only be used with secp256k1 since Ed25519's
-    security properties come, in part, from how the message
-    is hashed.
-*/
+/**
+ * Generate a signature for a message digest.
+ * This can only be used with secp256k1 since Ed25519's
+ * security properties come, in part, from how the message
+ * is hashed.
+ */
 /** @{ */
 Buffer
 signDigest(PublicKey const& pk, SecretKey const& sk, uint256 const& digest);
@@ -151,10 +166,11 @@ signDigest(KeyType type, SecretKey const& sk, uint256 const& digest)
 }
 /** @} */
 
-/** Generate a signature for a message.
-    With secp256k1 signatures, the data is first hashed with
-    SHA512-Half, and the resulting digest is signed.
-*/
+/**
+ * Generate a signature for a message.
+ * With secp256k1 signatures, the data is first hashed with
+ * SHA512-Half, and the resulting digest is signed.
+ */
 /** @{ */
 Buffer
 sign(PublicKey const& pk, SecretKey const& sk, Slice const& message);
diff --git a/include/xrpl/protocol/Seed.h b/include/xrpl/protocol/Seed.h
index a669f52079..4ccdd6707f 100644
--- a/include/xrpl/protocol/Seed.h
+++ b/include/xrpl/protocol/Seed.h
@@ -12,7 +12,9 @@
 
 namespace xrpl {
 
-/** Seeds are used to generate deterministic secret keys. */
+/**
+ * Seeds are used to generate deterministic secret keys.
+ */
 class Seed
 {
 private:
@@ -27,12 +29,15 @@ public:
     Seed&
     operator=(Seed const&) = default;
 
-    /** Destroy the seed.
-        The buffer will first be securely erased.
-    */
+    /**
+     * Destroy the seed.
+     * The buffer will first be securely erased.
+     */
     ~Seed();
 
-    /** Construct a seed */
+    /**
+     * Construct a seed
+     */
     /** @{ */
     explicit Seed(Slice const& slice);
     explicit Seed(uint128 const& seed);
@@ -77,42 +82,52 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** Create a seed using secure random numbers. */
+/**
+ * Create a seed using secure random numbers.
+ */
 Seed
 randomSeed();
 
-/** Generate a seed deterministically.
-
-    The algorithm is specific to the XRPL:
-
-        The seed is calculated as the first 128 bits
-        of the SHA512-Half of the string text excluding
-        any terminating null.
-
-    @note This will not attempt to determine the format of
-          the string (e.g. hex or base58).
-*/
+/**
+ * Generate a seed deterministically.
+ *
+ * The algorithm is specific to the XRPL:
+ *
+ *     The seed is calculated as the first 128 bits
+ *     of the SHA512-Half of the string text excluding
+ *     any terminating null.
+ *
+ * @note This will not attempt to determine the format of
+ *       the string (e.g. hex or base58).
+ */
 Seed
 generateSeed(std::string const& passPhrase);
 
-/** Parse a Base58 encoded string into a seed */
+/**
+ * Parse a Base58 encoded string into a seed
+ */
 template <>
 std::optional<Seed>
 parseBase58(std::string const& s);
 
-/** Attempt to parse a string as a seed.
-
-    @param str the string to parse
-    @param rfc1751 true if we should attempt RFC1751 style parsing (deprecated)
- * */
+/**
+ * Attempt to parse a string as a seed.
+ *
+ * @param str the string to parse
+ * @param rfc1751 true if we should attempt RFC1751 style parsing (deprecated)
+ */
 std::optional<Seed>
 parseGenericSeed(std::string const& str, bool rfc1751 = true);
 
-/** Encode a Seed in RFC1751 format */
+/**
+ * Encode a Seed in RFC1751 format
+ */
 std::string
 seedAs1751(Seed const& seed);
 
-/** Format a seed as a Base58 string */
+/**
+ * Format a seed as a Base58 string
+ */
 inline std::string
 toBase58(Seed const& seed)
 {
diff --git a/include/xrpl/protocol/SeqProxy.h b/include/xrpl/protocol/SeqProxy.h
index be040cceec..e6a97be0e7 100644
--- a/include/xrpl/protocol/SeqProxy.h
+++ b/include/xrpl/protocol/SeqProxy.h
@@ -5,33 +5,34 @@
 
 namespace xrpl {
 
-/** A type that represents either a sequence value or a ticket value.
-
-  We use the value() of a SeqProxy in places where a sequence was used
-  before.  An example of this is the sequence of an Offer stored in the
-  ledger.  We do the same thing with the in-ledger identifier of a
-  Check, Payment Channel, and Escrow.
-
-  Why is this safe?  If we use the SeqProxy::value(), how do we know that
-  each ledger entry will be unique?
-
-  There are two components that make this safe:
-
-  1. A "TicketCreate" transaction carefully avoids creating a ticket
-     that corresponds with an already used Sequence or Ticket value.
-     The transactor does this by referring to the account root's
-     sequence number.  Creating the ticket advances the account root's
-     sequence number so the same ticket (or sequence) value cannot be
-     used again.
-
-  2. When a "TicketCreate" transaction creates a batch of tickets it advances
-     the account root sequence to one past the largest created ticket.
-
-     Therefore all tickets in a batch other than the first may never have
-     the same value as a sequence on that same account.  And since a ticket
-     may only be used once there will never be any duplicates within this
-     account.
-*/
+/**
+ * A type that represents either a sequence value or a ticket value.
+ *
+ * We use the value() of a SeqProxy in places where a sequence was used
+ * before.  An example of this is the sequence of an Offer stored in the
+ * ledger.  We do the same thing with the in-ledger identifier of a
+ * Check, Payment Channel, and Escrow.
+ *
+ * Why is this safe?  If we use the SeqProxy::value(), how do we know that
+ * each ledger entry will be unique?
+ *
+ * There are two components that make this safe:
+ *
+ * 1. A "TicketCreate" transaction carefully avoids creating a ticket
+ *    that corresponds with an already used Sequence or Ticket value.
+ *    The transactor does this by referring to the account root's
+ *    sequence number.  Creating the ticket advances the account root's
+ *    sequence number so the same ticket (or sequence) value cannot be
+ *    used again.
+ *
+ * 2. When a "TicketCreate" transaction creates a batch of tickets it advances
+ *    the account root sequence to one past the largest created ticket.
+ *
+ *    Therefore all tickets in a batch other than the first may never have
+ *    the same value as a sequence on that same account.  And since a ticket
+ *    may only be used once there will never be any duplicates within this
+ *    account.
+ */
 class SeqProxy
 {
 public:
@@ -51,7 +52,9 @@ public:
     SeqProxy&
     operator=(SeqProxy const& other) = default;
 
-    /** Factory function to return a sequence-based SeqProxy */
+    /**
+     * Factory function to return a sequence-based SeqProxy
+     */
     static constexpr SeqProxy
     sequence(std::uint32_t v)
     {
diff --git a/include/xrpl/protocol/Sign.h b/include/xrpl/protocol/Sign.h
index 18f085352d..fad2c35c9e 100644
--- a/include/xrpl/protocol/Sign.h
+++ b/include/xrpl/protocol/Sign.h
@@ -11,17 +11,18 @@
 
 namespace xrpl {
 
-/** Sign an STObject
-
-    @param st Object to sign
-    @param prefix Prefix to insert before serialized object when hashing
-    @param type Signing key type used to derive public key
-    @param sk Signing secret key
-    @param sigField Field in which to store the signature on the object.
-    If not specified the value defaults to `sfSignature`.
-
-    @note If a signature already exists, it is overwritten.
-*/
+/**
+ * Sign an STObject
+ *
+ * @param st Object to sign
+ * @param prefix Prefix to insert before serialized object when hashing
+ * @param type Signing key type used to derive public key
+ * @param sk Signing secret key
+ * @param sigField Field in which to store the signature on the object.
+ * If not specified the value defaults to `sfSignature`.
+ *
+ * @note If a signature already exists, it is overwritten.
+ */
 void
 sign(
     STObject& st,
@@ -30,14 +31,15 @@ sign(
     SecretKey const& sk,
     SF_VL const& sigField = sfSignature);
 
-/** Returns `true` if STObject contains valid signature
-
-    @param st Signed object
-    @param prefix Prefix inserted before serialized object when hashing
-    @param pk Public key for verifying signature
-    @param sigField Object's field containing the signature.
-    If not specified the value defaults to `sfSignature`.
-*/
+/**
+ * Returns `true` if STObject contains valid signature
+ *
+ * @param st Signed object
+ * @param prefix Prefix inserted before serialized object when hashing
+ * @param pk Public key for verifying signature
+ * @param sigField Object's field containing the signature.
+ * If not specified the value defaults to `sfSignature`.
+ */
 bool
 verify(
     STObject const& st,
@@ -45,22 +47,25 @@ verify(
     PublicKey const& pk,
     SF_VL const& sigField = sfSignature);
 
-/** Return a Serializer suitable for computing a multisigning TxnSignature. */
+/**
+ * Return a Serializer suitable for computing a multisigning TxnSignature.
+ */
 Serializer
 buildMultiSigningData(STObject const& obj, AccountID const& signingID);
 
-/** Break the multi-signing hash computation into 2 parts for optimization.
-
-    We can optimize verifying multiple multisignatures by splitting the
-    data building into two parts;
-     o A large part that is shared by all of the computations.
-     o A small part that is unique to each signer in the multisignature.
-
-    The following methods support that optimization:
-     1. startMultiSigningData provides the large part which can be shared.
-     2. finishMultiSigningData caps the passed in serializer with each
-        signer's unique data.
-*/
+/**
+ * Break the multi-signing hash computation into 2 parts for optimization.
+ *
+ * We can optimize verifying multiple multisignatures by splitting the
+ * data building into two parts;
+ *  o A large part that is shared by all of the computations.
+ *  o A small part that is unique to each signer in the multisignature.
+ *
+ * The following methods support that optimization:
+ *  1. startMultiSigningData provides the large part which can be shared.
+ *  2. finishMultiSigningData caps the passed in serializer with each
+ *     signer's unique data.
+ */
 Serializer
 startMultiSigningData(STObject const& obj);
 
diff --git a/include/xrpl/protocol/SystemParameters.h b/include/xrpl/protocol/SystemParameters.h
index b31dd0cd42..6ca36c8d9a 100644
--- a/include/xrpl/protocol/SystemParameters.h
+++ b/include/xrpl/protocol/SystemParameters.h
@@ -21,22 +21,30 @@ systemName()
     return kName;
 }
 
-/** Configure the native currency. */
+/**
+ * Configure the native currency.
+ */
 
-/** Number of drops in the genesis account. */
+/**
+ * Number of drops in the genesis account.
+ */
 constexpr XRPAmount kInitialXrp{100'000'000'000 * kDropsPerXrp};
 static_assert(kInitialXrp.drops() == 100'000'000'000'000'000);
 static_assert(Number::kMaxRep >= kInitialXrp.drops());
 
-/** Returns true if the amount does not exceed the initial XRP in existence. */
+/**
+ * Returns true if the amount does not exceed the initial XRP in existence.
+ */
 inline bool
 isLegalAmount(XRPAmount const& amount)
 {
     return amount <= kInitialXrp;
 }
 
-/** Returns true if the absolute value of the amount does not exceed the initial
- * XRP in existence. */
+/**
+ * Returns true if the absolute value of the amount does not exceed the initial
+ * XRP in existence.
+ */
 inline bool
 isLegalAmountSigned(XRPAmount const& amount)
 {
@@ -51,20 +59,30 @@ systemCurrencyCode()
     return kCode;
 }
 
-/** The XRP ledger network's earliest allowed sequence */
+/**
+ * The XRP ledger network's earliest allowed sequence
+ */
 static constexpr std::uint32_t kXrpLedgerEarliestSeq{32570u};
 
-/** The XRP Ledger mainnet's earliest ledger with a FeeSettings object. Only
- * used in asserts and tests. */
+/**
+ * The XRP Ledger mainnet's earliest ledger with a FeeSettings object. Only
+ * used in asserts and tests.
+ */
 static constexpr std::uint32_t kXrpLedgerEarliestFees{562177u};
 
-/** The minimum amount of support an amendment should have. */
+/**
+ * The minimum amount of support an amendment should have.
+ */
 constexpr std::ratio<80, 100> kAmendmentMajorityCalcThreshold;
 
-/** The minimum amount of time an amendment must hold a majority */
+/**
+ * The minimum amount of time an amendment must hold a majority
+ */
 constexpr std::chrono::seconds const kDefaultAmendmentMajorityTime = weeks{2};
 
 }  // namespace xrpl
 
-/** Default peer port (IANA registered) */
+/**
+ * Default peer port (IANA registered)
+ */
 inline constexpr std::uint16_t kDefaultPeerPort{2459};
diff --git a/include/xrpl/protocol/TxFlags.h b/include/xrpl/protocol/TxFlags.h
index 1d4f33a39d..0afdebb898 100644
--- a/include/xrpl/protocol/TxFlags.h
+++ b/include/xrpl/protocol/TxFlags.h
@@ -12,29 +12,30 @@
 
 namespace xrpl {
 
-/** Transaction flags.
-
-    These flags are specified in a transaction's 'Flags' field and modify
-    the behavior of that transaction.
-
-    There are two types of flags:
-
-        (1) Universal flags: these are flags which apply to, and are interpreted the same way by,
-            all transactions, except, perhaps, to special pseudo-transactions.
-
-        (2) Tx-Specific flags: these are flags which are interpreted according to the type of the
-            transaction being executed. That is, the same numerical flag value may have different
-            effects, depending on the transaction being executed.
-
-    @note The universal transaction flags occupy the high-order 8 bits.
-          The tx-specific flags occupy the remaining 24 bits.
-
-    @warning Transaction flags form part of the protocol.
-             **Changing them should be avoided because without special handling, this will result in
-             a hard fork.**
-
-    @ingroup protocol
-*/
+/**
+ * Transaction flags.
+ *
+ * These flags are specified in a transaction's 'Flags' field and modify
+ * the behavior of that transaction.
+ *
+ * There are two types of flags:
+ *
+ *     (1) Universal flags: these are flags which apply to, and are interpreted the same way by,
+ *         all transactions, except, perhaps, to special pseudo-transactions.
+ *
+ *     (2) Tx-Specific flags: these are flags which are interpreted according to the type of the
+ *         transaction being executed. That is, the same numerical flag value may have different
+ *         effects, depending on the transaction being executed.
+ *
+ * @note The universal transaction flags occupy the high-order 8 bits.
+ *       The tx-specific flags occupy the remaining 24 bits.
+ *
+ * @warning Transaction flags form part of the protocol.
+ *          **Changing them should be avoided because without special handling, this will result in
+ *          a hard fork.**
+ *
+ * @ingroup protocol
+ */
 
 using FlagValue = std::uint32_t;
 
diff --git a/include/xrpl/protocol/TxFormats.h b/include/xrpl/protocol/TxFormats.h
index 36eb6d0889..8fb32c93cb 100644
--- a/include/xrpl/protocol/TxFormats.h
+++ b/include/xrpl/protocol/TxFormats.h
@@ -8,34 +8,36 @@
 
 namespace xrpl {
 
-/** Transaction type identifiers.
-
-    These are part of the binary message format.
-
-    @ingroup protocol
-*/
-/** Transaction type identifiers
-
-    Each ledger object requires a unique type identifier, which is stored
-    within the object itself; this makes it possible to iterate the entire
-    ledger and determine each object's type and verify that the object you
-    retrieved from a given hash matches the expected type.
-
-    @warning Since these values are included in transactions, which are signed
-             objects, and used by the code to determine the type of transaction
-             being invoked, they are part of the protocol. **Changing them
-             should be avoided because without special handling, this will
-             result in a hard fork.**
-
-    @note When retiring types, the specific values should not be removed but
-          should be marked as [[deprecated]]. This is to avoid accidental
-          reuse of identifiers.
-
-    @todo The C++ language does not enable checking for duplicate values
-          here. If it becomes possible then we should do this.
-
-    @ingroup protocol
-*/
+/**
+ * Transaction type identifiers.
+ *
+ * These are part of the binary message format.
+ *
+ * @ingroup protocol
+ */
+/**
+ * Transaction type identifiers
+ *
+ * Each ledger object requires a unique type identifier, which is stored
+ * within the object itself; this makes it possible to iterate the entire
+ * ledger and determine each object's type and verify that the object you
+ * retrieved from a given hash matches the expected type.
+ *
+ * @warning Since these values are included in transactions, which are signed
+ *          objects, and used by the code to determine the type of transaction
+ *          being invoked, they are part of the protocol. **Changing them
+ *          should be avoided because without special handling, this will
+ *          result in a hard fork.**
+ *
+ * @note When retiring types, the specific values should not be removed but
+ *       should be marked as [[deprecated]]. This is to avoid accidental
+ *       reuse of identifiers.
+ *
+ * @todo The C++ language does not enable checking for duplicate values
+ *       here. If it becomes possible then we should do this.
+ *
+ * @ingroup protocol
+ */
 // clang-format off
 // Protocol-critical, hundreds of usages
 // NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
@@ -52,28 +54,38 @@ enum TxType : std::uint16_t
 #undef TRANSACTION
 #pragma pop_macro("TRANSACTION")
 
-    /** This transaction type is deprecated; it is retained for historical purposes. */
+    /**
+     * This transaction type is deprecated; it is retained for historical purposes.
+     */
     TtNicknameSet [[deprecated("This transaction type is not supported and should not be used.")]] = 6,
 
-    /** This transaction type is deprecated; it is retained for historical purposes. */
+    /**
+     * This transaction type is deprecated; it is retained for historical purposes.
+     */
     TtContract [[deprecated("This transaction type is not supported and should not be used.")]] = 9,
 
-    /** This identifier was never used, but the slot is reserved for historical purposes. */
+    /**
+     * This identifier was never used, but the slot is reserved for historical purposes.
+     */
     TtSpinalTap [[deprecated("This transaction type is not supported and should not be used.")]] = 11,
 
-    /** This transaction type installs a hook. */
+    /**
+     * This transaction type installs a hook.
+     */
     TtHookSet [[maybe_unused]] = 22,
 };
 // clang-format on
 
-/** Manages the list of known transaction formats.
+/**
+ * Manages the list of known transaction formats.
  */
 class TxFormats : public KnownFormats<TxType, TxFormats>
 {
 private:
-    /** Create the object.
-        This will load the object with all the known transaction formats.
-    */
+    /**
+     * Create the object.
+     * This will load the object with all the known transaction formats.
+     */
     TxFormats();
 
 public:
diff --git a/include/xrpl/protocol/TxMeta.h b/include/xrpl/protocol/TxMeta.h
index 813f1b1615..88652afba9 100644
--- a/include/xrpl/protocol/TxMeta.h
+++ b/include/xrpl/protocol/TxMeta.h
@@ -60,7 +60,9 @@ public:
     STObject&
     getAffectedNode(uint256 const&);
 
-    /** Return a list of accounts affected by this transaction */
+    /**
+     * Return a list of accounts affected by this transaction
+     */
     [[nodiscard]] boost::container::flat_set<AccountID>
     getAffectedAccounts() const;
 
diff --git a/include/xrpl/protocol/UintTypes.h b/include/xrpl/protocol/UintTypes.h
index 1a3cb96691..25b0d1ffc9 100644
--- a/include/xrpl/protocol/UintTypes.h
+++ b/include/xrpl/protocol/UintTypes.h
@@ -30,34 +30,50 @@ public:
 
 }  // namespace detail
 
-/** Directory is an index into the directory of offer books.
-    The last 64 bits of this are the quality. */
+/**
+ * Directory is an index into the directory of offer books.
+ * The last 64 bits of this are the quality.
+ */
 using Directory = BaseUInt<256, detail::DirectoryTag>;
 
-/** Currency is a hash representing a specific currency. */
+/**
+ * Currency is a hash representing a specific currency.
+ */
 using Currency = BaseUInt<160, detail::CurrencyTag>;
 
-/** NodeID is a 160-bit hash representing one node. */
+/**
+ * NodeID is a 160-bit hash representing one node.
+ */
 using NodeID = BaseUInt<160, detail::NodeIDTag>;
 
-/** MPTID is a 192-bit value representing MPT Issuance ID,
+/**
+ * MPTID is a 192-bit value representing MPT Issuance ID,
  * which is a concatenation of a 32-bit sequence (big endian)
- * and a 160-bit account */
+ * and a 160-bit account
+ */
 using MPTID = BaseUInt<192>;
 
-/** Domain is a 256-bit hash representing a specific domain. */
+/**
+ * Domain is a 256-bit hash representing a specific domain.
+ */
 using Domain = BaseUInt<256>;
 
-/** XRP currency. */
+/**
+ * XRP currency.
+ */
 Currency const&
 xrpCurrency();
 
-/** A placeholder for empty currencies. */
+/**
+ * A placeholder for empty currencies.
+ */
 Currency const&
 noCurrency();
 
-/** We deliberately disallow the currency that looks like "XRP" because too
-    many people were using it instead of the correct XRP currency. */
+/**
+ * We deliberately disallow the currency that looks like "XRP" because too
+ * many people were using it instead of the correct XRP currency.
+ */
 Currency const&
 badCurrency();
 
@@ -67,26 +83,30 @@ isXRP(Currency const& c)
     return c == beast::kZero;
 }
 
-/** Returns "", "XRP", or three letter ISO code. */
+/**
+ * Returns "", "XRP", or three letter ISO code.
+ */
 std::string
 to_string(Currency const& c);
 
-/** Tries to convert a string to a Currency, returns true on success.
-
-    @note This function will return success if the resulting currency is
-          badCurrency(). This legacy behavior is unfortunate; changing this
-          will require very careful checking everywhere and may mean having
-          to rewrite some unit test code.
-*/
+/**
+ * Tries to convert a string to a Currency, returns true on success.
+ *
+ * @note This function will return success if the resulting currency is
+ *       badCurrency(). This legacy behavior is unfortunate; changing this
+ *       will require very careful checking everywhere and may mean having
+ *       to rewrite some unit test code.
+ */
 bool
 toCurrency(Currency&, std::string const&);
 
-/** Tries to convert a string to a Currency, returns noCurrency() on failure.
-
-    @note This function can return badCurrency(). This legacy behavior is
-          unfortunate; changing this will require very careful checking
-          everywhere and may mean having to rewrite some unit test code.
-*/
+/**
+ * Tries to convert a string to a Currency, returns noCurrency() on failure.
+ *
+ * @note This function can return badCurrency(). This legacy behavior is
+ *       unfortunate; changing this will require very careful checking
+ *       everywhere and may mean having to rewrite some unit test code.
+ */
 Currency
 toCurrency(std::string const&);
 
diff --git a/include/xrpl/protocol/Units.h b/include/xrpl/protocol/Units.h
index 8b418704d6..169ee2c543 100644
--- a/include/xrpl/protocol/Units.h
+++ b/include/xrpl/protocol/Units.h
@@ -20,18 +20,26 @@ namespace xrpl {
 
 namespace unit {
 
-/** "drops" are the smallest divisible amount of XRP. This is what most
-    of the code uses. */
+/**
+ * "drops" are the smallest divisible amount of XRP. This is what most
+ * of the code uses.
+ */
 struct dropTag;
-/** "fee levels" are used by the transaction queue to compare the relative
-    cost of transactions that require different levels of effort to process.
-    See also: src/xrpld/app/misc/FeeEscalation.md#fee-level */
+/**
+ * "fee levels" are used by the transaction queue to compare the relative
+ * cost of transactions that require different levels of effort to process.
+ * See also: src/xrpld/app/misc/FeeEscalation.md#fee-level
+ */
 struct feelevelTag;
-/** unitless values are plain scalars wrapped in a ValueUnit. They are
-    used for calculations in this header. */
+/**
+ * unitless values are plain scalars wrapped in a ValueUnit. They are
+ * used for calculations in this header.
+ */
 struct unitlessTag;
 
-/** Units to represent basis points (bips) and 1/10 basis points */
+/**
+ * Units to represent basis points (bips) and 1/10 basis points
+ */
 class BipsTag;
 class TenthBipsTag;
 
@@ -42,13 +50,14 @@ template <class T>
 concept Valid = std::is_class_v<T> && std::is_object_v<typename T::unit_type> &&
     std::is_object_v<typename T::value_type>;
 
-/** `Usable` is checked to ensure that only values with
-    known valid type tags can be used (sometimes transparently) in
-    non-unit contexts. At the time of implementation, this includes
-    all known tags, but more may be added in the future, and they
-    should not be added automatically unless determined to be
-    appropriate.
-*/
+/**
+ * `Usable` is checked to ensure that only values with
+ * known valid type tags can be used (sometimes transparently) in
+ * non-unit contexts. At the time of implementation, this includes
+ * all known tags, but more may be added in the future, and they
+ * should not be added automatically unless determined to be
+ * appropriate.
+ */
 template <class T>
 concept Usable = Valid<T> &&
     (std::is_same_v<typename T::unit_type, feelevelTag> ||
@@ -115,9 +124,11 @@ public:
         return *this;
     }
 
-    /** Instances with the same unit, and a type that is
-        "safe" to convert to this one can be converted
-        implicitly */
+    /**
+     * Instances with the same unit, and a type that is
+     * "safe" to convert to this one can be converted
+     * implicitly
+     */
     template <Compatible<ValueUnit> Other>
     constexpr ValueUnit(ValueUnit<unit_type, Other> const& value)
         requires SafeToCast<Other, value_type>
@@ -260,14 +271,18 @@ public:
         return value_ < other.value_;
     }
 
-    /** Returns true if the amount is not zero */
+    /**
+     * Returns true if the amount is not zero
+     */
     explicit constexpr
     operator bool() const noexcept
     {
         return value_ != 0;
     }
 
-    /** Return the sign of the amount */
+    /**
+     * Return the sign of the amount
+     */
     [[nodiscard]] constexpr int
     signum() const noexcept
     {
@@ -276,7 +291,9 @@ public:
         return value_ ? 1 : 0;
     }
 
-    /** Returns the number of drops */
+    /**
+     * Returns the number of drops
+     */
     // TODO: Move this to a new class, maybe with the old "TaggedFee" name
     [[nodiscard]] constexpr value_type
     fee() const
@@ -319,10 +336,11 @@ public:
         }
     }
 
-    /** Returns the underlying value. Code SHOULD NOT call this
-        function unless the type has been abstracted away,
-        e.g. in a templated function.
-    */
+    /**
+     * Returns the underlying value. Code SHOULD NOT call this
+     * function unless the type has been abstracted away,
+     * e.g. in a templated function.
+     */
     [[nodiscard]] constexpr value_type
     value() const
     {
diff --git a/include/xrpl/protocol/XRPAmount.h b/include/xrpl/protocol/XRPAmount.h
index 3190980ecb..26e10929df 100644
--- a/include/xrpl/protocol/XRPAmount.h
+++ b/include/xrpl/protocol/XRPAmount.h
@@ -138,7 +138,9 @@ public:
         return drops_ < other.drops_;
     }
 
-    /** Returns true if the amount is not zero */
+    /**
+     * Returns true if the amount is not zero
+     */
     explicit constexpr
     operator bool() const noexcept
     {
@@ -150,7 +152,9 @@ public:
         return drops();
     }
 
-    /** Return the sign of the amount */
+    /**
+     * Return the sign of the amount
+     */
     [[nodiscard]] constexpr int
     signum() const noexcept
     {
@@ -159,7 +163,9 @@ public:
         return (drops_ != 0) ? 1 : 0;
     }
 
-    /** Returns the number of drops */
+    /**
+     * Returns the number of drops
+     */
     [[nodiscard]] constexpr value_type
     drops() const
     {
@@ -217,10 +223,11 @@ public:
         return static_cast<json::Int>(drops_);
     }
 
-    /** Returns the underlying value. Code SHOULD NOT call this
-        function unless the type has been abstracted away,
-        e.g. in a templated function.
-    */
+    /**
+     * Returns the underlying value. Code SHOULD NOT call this
+     * function unless the type has been abstracted away,
+     * e.g. in a templated function.
+     */
     [[nodiscard]] constexpr value_type
     value() const
     {
@@ -241,7 +248,9 @@ public:
     }
 };
 
-/** Number of drops per 1 XRP */
+/**
+ * Number of drops per 1 XRP
+ */
 constexpr XRPAmount kDropsPerXrp{1'000'000};
 
 constexpr double
diff --git a/include/xrpl/protocol/detail/STVar.h b/include/xrpl/protocol/detail/STVar.h
index e95461c253..12026f3d09 100644
--- a/include/xrpl/protocol/detail/STVar.h
+++ b/include/xrpl/protocol/detail/STVar.h
@@ -120,7 +120,8 @@ private:
         }
     }
 
-    /** Construct requested Serializable Type according to id.
+    /**
+     * Construct requested Serializable Type according to id.
      * The variadic args are: (SField), or (SerialIter, SField).
      * depth is ignored in former case.
      */
diff --git a/include/xrpl/protocol/digest.h b/include/xrpl/protocol/digest.h
index c1e70cada2..44fca3d1ea 100644
--- a/include/xrpl/protocol/digest.h
+++ b/include/xrpl/protocol/digest.h
@@ -12,21 +12,23 @@
 
 namespace xrpl {
 
-/** Message digest functions used in the codebase
-
-    @note These are modeled to meet the requirements of `Hasher` in the
-          `hash_append` interface, discussed in proposal:
-
-          N3980 "Types Don't Know #"
-          http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2014/n3980.html
-*/
+/**
+ * Message digest functions used in the codebase
+ *
+ * @note These are modeled to meet the requirements of `Hasher` in the
+ *       `hash_append` interface, discussed in proposal:
+ *
+ *       N3980 "Types Don't Know #"
+ *       http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2014/n3980.html
+ */
 
 //------------------------------------------------------------------------------
 
-/** RIPEMD-160 digest
-
-    @note This uses the OpenSSL implementation
-*/
+/**
+ * RIPEMD-160 digest
+ *
+ * @note This uses the OpenSSL implementation
+ */
 struct OpensslRipemd160Hasher
 {
 public:
@@ -46,10 +48,11 @@ private:
     char ctx_[96]{};
 };
 
-/** SHA-512 digest
-
-    @note This uses the OpenSSL implementation
-*/
+/**
+ * SHA-512 digest
+ *
+ * @note This uses the OpenSSL implementation
+ */
 struct OpensslSha512Hasher
 {
 public:
@@ -69,10 +72,11 @@ private:
     char ctx_[216]{};
 };
 
-/** SHA-256 digest
-
-    @note This uses the OpenSSL implementation
-*/
+/**
+ * SHA-256 digest
+ *
+ * @note This uses the OpenSSL implementation
+ */
 struct OpensslSha256Hasher
 {
 public:
@@ -100,21 +104,22 @@ using sha512_hasher = OpensslSha512Hasher;
 
 //------------------------------------------------------------------------------
 
-/** Returns the RIPEMD-160 digest of the SHA256 hash of the message.
-
-    This operation is used to compute the 160-bit identifier
-    representing an XRPL account, from a message. Typically the
-    message is the public key of the account - which is not
-    stored in the account root.
-
-    The same computation is used regardless of the cryptographic
-    scheme implied by the public key. For example, the public key
-    may be an ed25519 public key or a secp256k1 public key. Support
-    for new cryptographic systems may be added, using the same
-    formula for calculating the account identifier.
-
-    Meets the requirements of Hasher (in hash_append)
-*/
+/**
+ * Returns the RIPEMD-160 digest of the SHA256 hash of the message.
+ *
+ * This operation is used to compute the 160-bit identifier
+ * representing an XRPL account, from a message. Typically the
+ * message is the public key of the account - which is not
+ * stored in the account root.
+ *
+ * The same computation is used regardless of the cryptographic
+ * scheme implied by the public key. For example, the public key
+ * may be an ed25519 public key or a secp256k1 public key. Support
+ * for new cryptographic systems may be added, using the same
+ * formula for calculating the account identifier.
+ *
+ * Meets the requirements of Hasher (in hash_append)
+ */
 struct RipeshaHasher
 {
 private:
@@ -145,11 +150,12 @@ public:
 
 namespace detail {
 
-/** Returns the SHA512-Half digest of a message.
-
-    The SHA512-Half is the first 256 bits of the
-    SHA-512 digest of the message.
-*/
+/**
+ * Returns the SHA512-Half digest of a message.
+ *
+ * The SHA512-Half is the first 256 bits of the
+ * SHA-512 digest of the message.
+ */
 template <bool Secure>
 struct BasicSha512HalfHasher
 {
@@ -201,7 +207,9 @@ using sha512_half_hasher_s = detail::BasicSha512HalfHasher<true>;
 
 //------------------------------------------------------------------------------
 
-/** Returns the SHA512-Half of a series of objects. */
+/**
+ * Returns the SHA512-Half of a series of objects.
+ */
 template <class... Args>
 sha512_half_hasher::result_type
 sha512Half(Args const&... args)
@@ -212,12 +220,13 @@ sha512Half(Args const&... args)
     return static_cast<sha512_half_hasher::result_type>(h);
 }
 
-/** Returns the SHA512-Half of a series of objects.
-
-    Postconditions:
-        Temporary memory storing copies of
-        input messages will be cleared.
-*/
+/**
+ * Returns the SHA512-Half of a series of objects.
+ *
+ * Postconditions:
+ *     Temporary memory storing copies of
+ *     input messages will be cleared.
+ */
 template <class... Args>
 sha512_half_hasher_s::result_type
 sha512HalfS(Args const&... args)
diff --git a/include/xrpl/protocol/serialize.h b/include/xrpl/protocol/serialize.h
index e758b57d49..130a2366cb 100644
--- a/include/xrpl/protocol/serialize.h
+++ b/include/xrpl/protocol/serialize.h
@@ -9,7 +9,9 @@
 
 namespace xrpl {
 
-/** Serialize an object to a blob. */
+/**
+ * Serialize an object to a blob.
+ */
 template <class Object>
 Blob
 serializeBlob(Object const& o)
@@ -19,7 +21,9 @@ serializeBlob(Object const& o)
     return s.peekData();
 }
 
-/** Serialize an object to a hex string. */
+/**
+ * Serialize an object to a hex string.
+ */
 inline std::string
 serializeHex(STObject const& o)
 {
diff --git a/include/xrpl/protocol/tokens.h b/include/xrpl/protocol/tokens.h
index bce7e7b5d6..0ce80030e6 100644
--- a/include/xrpl/protocol/tokens.h
+++ b/include/xrpl/protocol/tokens.h
@@ -35,17 +35,18 @@ template <class T>
 [[nodiscard]] std::optional<T>
 parseBase58(TokenType type, std::string const& s);
 
-/** Encode data in Base58Check format using XRPL alphabet
-
-    For details on the format see
-    https://xrpl.org/base58-encodings.html#base58-encodings
-
-    @param type The type of token to encode.
-    @param token Pointer to the data to encode.
-    @param size The size of the data to encode.
-
-    @return the encoded token.
-*/
+/**
+ * Encode data in Base58Check format using XRPL alphabet
+ *
+ * For details on the format see
+ * https://xrpl.org/base58-encodings.html#base58-encodings
+ *
+ * @param type The type of token to encode.
+ * @param token Pointer to the data to encode.
+ * @param size The size of the data to encode.
+ *
+ * @return the encoded token.
+ */
 [[nodiscard]] std::string
 encodeBase58Token(TokenType type, void const* token, std::size_t size);
 
diff --git a/include/xrpl/protocol_autogen/LedgerEntryBase.h b/include/xrpl/protocol_autogen/LedgerEntryBase.h
index 5758adbb24..7902055b85 100644
--- a/include/xrpl/protocol_autogen/LedgerEntryBase.h
+++ b/include/xrpl/protocol_autogen/LedgerEntryBase.h
@@ -158,7 +158,9 @@ public:
     }
 
 protected:
-    /** @brief The underlying serialized ledger entry being wrapped. */
+    /**
+     * @brief The underlying serialized ledger entry being wrapped.
+     */
     SLE::const_pointer sle_;
 };
 
diff --git a/include/xrpl/protocol_autogen/TransactionBase.h b/include/xrpl/protocol_autogen/TransactionBase.h
index 161d718c66..a135709576 100644
--- a/include/xrpl/protocol_autogen/TransactionBase.h
+++ b/include/xrpl/protocol_autogen/TransactionBase.h
@@ -450,7 +450,9 @@ public:
     }
 
 protected:
-    /** @brief The underlying transaction object being wrapped. */
+    /**
+     * @brief The underlying transaction object being wrapped.
+     */
     std::shared_ptr<STTx const> tx_;
 };
 
diff --git a/include/xrpl/protocol_autogen/ledger_entries/AMM.h b/include/xrpl/protocol_autogen/ledger_entries/AMM.h
index 11fd3738c9..e6daaf0043 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/AMM.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/AMM.h
@@ -265,7 +265,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h b/include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h
index 725f46437e..04249b4e04 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h
@@ -636,7 +636,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Amendments.h b/include/xrpl/protocol_autogen/ledger_entries/Amendments.h
index 6a801308ca..c8b6c2d524 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Amendments.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Amendments.h
@@ -175,7 +175,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAmendments (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Bridge.h b/include/xrpl/protocol_autogen/ledger_entries/Bridge.h
index 2c7479b243..31d0e50c02 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Bridge.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Bridge.h
@@ -219,7 +219,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Check.h b/include/xrpl/protocol_autogen/ledger_entries/Check.h
index 5b3fd10b92..d354425c39 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Check.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Check.h
@@ -278,7 +278,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Credential.h b/include/xrpl/protocol_autogen/ledger_entries/Credential.h
index dfce76e45c..f4d243aea8 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Credential.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Credential.h
@@ -228,7 +228,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfSubject (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/DID.h b/include/xrpl/protocol_autogen/ledger_entries/DID.h
index ad423377e7..71113862c5 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/DID.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/DID.h
@@ -202,7 +202,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Delegate.h b/include/xrpl/protocol_autogen/ledger_entries/Delegate.h
index bfe5f5587a..84a33ea2be 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Delegate.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Delegate.h
@@ -181,7 +181,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/DepositPreauth.h b/include/xrpl/protocol_autogen/ledger_entries/DepositPreauth.h
index 069bed6b77..c4c4434251 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/DepositPreauth.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/DepositPreauth.h
@@ -179,7 +179,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/DirectoryNode.h b/include/xrpl/protocol_autogen/ledger_entries/DirectoryNode.h
index 50659c33f6..7879f104af 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/DirectoryNode.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/DirectoryNode.h
@@ -440,7 +440,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfOwner (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Escrow.h b/include/xrpl/protocol_autogen/ledger_entries/Escrow.h
index f3c033d26d..106d69722f 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Escrow.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Escrow.h
@@ -372,7 +372,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/FeeSettings.h b/include/xrpl/protocol_autogen/ledger_entries/FeeSettings.h
index 8f43d3b782..21478f749d 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/FeeSettings.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/FeeSettings.h
@@ -294,7 +294,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfBaseFee (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/LedgerHashes.h b/include/xrpl/protocol_autogen/ledger_entries/LedgerHashes.h
index f1d3684b55..2c6747b07b 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/LedgerHashes.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/LedgerHashes.h
@@ -139,7 +139,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfFirstLedgerSequence (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Loan.h b/include/xrpl/protocol_autogen/ledger_entries/Loan.h
index 5d837736ec..a0abf9bd97 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Loan.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Loan.h
@@ -616,7 +616,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfPreviousTxnID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/LoanBroker.h b/include/xrpl/protocol_autogen/ledger_entries/LoanBroker.h
index 88f05e3433..281af2cfeb 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/LoanBroker.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/LoanBroker.h
@@ -387,7 +387,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfPreviousTxnID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/MPToken.h b/include/xrpl/protocol_autogen/ledger_entries/MPToken.h
index 379cfe53f5..874d779d09 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/MPToken.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/MPToken.h
@@ -335,7 +335,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h b/include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h
index b6c77093ac..8518a0fe14 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h
@@ -420,7 +420,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfIssuer (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/NFTokenOffer.h b/include/xrpl/protocol_autogen/ledger_entries/NFTokenOffer.h
index 072d3721f9..61aaccacdc 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/NFTokenOffer.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/NFTokenOffer.h
@@ -217,7 +217,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfOwner (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/NFTokenPage.h b/include/xrpl/protocol_autogen/ledger_entries/NFTokenPage.h
index 5e00cb1120..1aea6d6b01 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/NFTokenPage.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/NFTokenPage.h
@@ -166,7 +166,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfPreviousPageMin (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/NegativeUNL.h b/include/xrpl/protocol_autogen/ledger_entries/NegativeUNL.h
index 7ca9729082..a35865202d 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/NegativeUNL.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/NegativeUNL.h
@@ -199,7 +199,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfDisabledValidators (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Offer.h b/include/xrpl/protocol_autogen/ledger_entries/Offer.h
index f51b54cfd2..e3539fc1fc 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Offer.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Offer.h
@@ -268,7 +268,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Oracle.h b/include/xrpl/protocol_autogen/ledger_entries/Oracle.h
index 902032f94f..727e63ea84 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Oracle.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Oracle.h
@@ -231,7 +231,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfOwner (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/PayChannel.h b/include/xrpl/protocol_autogen/ledger_entries/PayChannel.h
index 61a4e2d044..4d00fbb7e5 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/PayChannel.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/PayChannel.h
@@ -339,7 +339,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/PermissionedDomain.h b/include/xrpl/protocol_autogen/ledger_entries/PermissionedDomain.h
index 638dda2420..e793e2d658 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/PermissionedDomain.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/PermissionedDomain.h
@@ -157,7 +157,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfOwner (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/RippleState.h b/include/xrpl/protocol_autogen/ledger_entries/RippleState.h
index 388a062ec1..dda1b78e66 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/RippleState.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/RippleState.h
@@ -335,7 +335,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfBalance (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/SignerList.h b/include/xrpl/protocol_autogen/ledger_entries/SignerList.h
index 443e5588f9..3aff8fa51b 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/SignerList.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/SignerList.h
@@ -181,7 +181,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfOwner (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Sponsorship.h b/include/xrpl/protocol_autogen/ledger_entries/Sponsorship.h
index c309a38aef..065e655682 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Sponsorship.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Sponsorship.h
@@ -228,7 +228,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfPreviousTxnID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Ticket.h b/include/xrpl/protocol_autogen/ledger_entries/Ticket.h
index 6fa5b57f6c..e1205bdb67 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Ticket.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Ticket.h
@@ -143,7 +143,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/Vault.h b/include/xrpl/protocol_autogen/ledger_entries/Vault.h
index d1aaeb4ed8..2bf92b4f5d 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/Vault.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/Vault.h
@@ -339,7 +339,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfPreviousTxnID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/XChainOwnedClaimID.h b/include/xrpl/protocol_autogen/ledger_entries/XChainOwnedClaimID.h
index 3f8058a4a1..bfd7a0a8b8 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/XChainOwnedClaimID.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/XChainOwnedClaimID.h
@@ -196,7 +196,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/ledger_entries/XChainOwnedCreateAccountClaimID.h b/include/xrpl/protocol_autogen/ledger_entries/XChainOwnedCreateAccountClaimID.h
index e24009a4b7..4872d4063e 100644
--- a/include/xrpl/protocol_autogen/ledger_entries/XChainOwnedCreateAccountClaimID.h
+++ b/include/xrpl/protocol_autogen/ledger_entries/XChainOwnedCreateAccountClaimID.h
@@ -170,7 +170,9 @@ public:
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 
     /**
      * @brief Set sfAccount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AMMBid.h b/include/xrpl/protocol_autogen/transactions/AMMBid.h
index cd2792e810..30a2b6f2ab 100644
--- a/include/xrpl/protocol_autogen/transactions/AMMBid.h
+++ b/include/xrpl/protocol_autogen/transactions/AMMBid.h
@@ -190,7 +190,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAsset (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AMMClawback.h b/include/xrpl/protocol_autogen/transactions/AMMClawback.h
index ccbd7d99e6..38aba892c4 100644
--- a/include/xrpl/protocol_autogen/transactions/AMMClawback.h
+++ b/include/xrpl/protocol_autogen/transactions/AMMClawback.h
@@ -154,7 +154,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfHolder (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AMMCreate.h b/include/xrpl/protocol_autogen/transactions/AMMCreate.h
index cc88428e7a..c6ccd4e860 100644
--- a/include/xrpl/protocol_autogen/transactions/AMMCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/AMMCreate.h
@@ -127,7 +127,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAmount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AMMDelete.h b/include/xrpl/protocol_autogen/transactions/AMMDelete.h
index 4cc0497c32..05899a46c8 100644
--- a/include/xrpl/protocol_autogen/transactions/AMMDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/AMMDelete.h
@@ -114,7 +114,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAsset (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AMMDeposit.h b/include/xrpl/protocol_autogen/transactions/AMMDeposit.h
index e01332c3e2..5416547dab 100644
--- a/include/xrpl/protocol_autogen/transactions/AMMDeposit.h
+++ b/include/xrpl/protocol_autogen/transactions/AMMDeposit.h
@@ -246,7 +246,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAsset (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AMMVote.h b/include/xrpl/protocol_autogen/transactions/AMMVote.h
index b19d440c84..7dce3c252f 100644
--- a/include/xrpl/protocol_autogen/transactions/AMMVote.h
+++ b/include/xrpl/protocol_autogen/transactions/AMMVote.h
@@ -127,7 +127,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAsset (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AMMWithdraw.h b/include/xrpl/protocol_autogen/transactions/AMMWithdraw.h
index 196f0faba2..81258f22d6 100644
--- a/include/xrpl/protocol_autogen/transactions/AMMWithdraw.h
+++ b/include/xrpl/protocol_autogen/transactions/AMMWithdraw.h
@@ -220,7 +220,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAsset (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AccountDelete.h b/include/xrpl/protocol_autogen/transactions/AccountDelete.h
index c0346d9499..cf6e97bb63 100644
--- a/include/xrpl/protocol_autogen/transactions/AccountDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/AccountDelete.h
@@ -151,7 +151,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfDestination (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/AccountSet.h b/include/xrpl/protocol_autogen/transactions/AccountSet.h
index 7ddda45752..55c449e78e 100644
--- a/include/xrpl/protocol_autogen/transactions/AccountSet.h
+++ b/include/xrpl/protocol_autogen/transactions/AccountSet.h
@@ -346,7 +346,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfEmailHash (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/Batch.h b/include/xrpl/protocol_autogen/transactions/Batch.h
index 00f553ada7..1a59d2b4c0 100644
--- a/include/xrpl/protocol_autogen/transactions/Batch.h
+++ b/include/xrpl/protocol_autogen/transactions/Batch.h
@@ -123,7 +123,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfRawTransactions (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/CheckCancel.h b/include/xrpl/protocol_autogen/transactions/CheckCancel.h
index 4f7534278b..b75b717e3f 100644
--- a/include/xrpl/protocol_autogen/transactions/CheckCancel.h
+++ b/include/xrpl/protocol_autogen/transactions/CheckCancel.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfCheckID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/CheckCash.h b/include/xrpl/protocol_autogen/transactions/CheckCash.h
index a58a20c57e..c742a15154 100644
--- a/include/xrpl/protocol_autogen/transactions/CheckCash.h
+++ b/include/xrpl/protocol_autogen/transactions/CheckCash.h
@@ -153,7 +153,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfCheckID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/CheckCreate.h b/include/xrpl/protocol_autogen/transactions/CheckCreate.h
index 17f985ac63..63e55f8604 100644
--- a/include/xrpl/protocol_autogen/transactions/CheckCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/CheckCreate.h
@@ -191,7 +191,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfDestination (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/Clawback.h b/include/xrpl/protocol_autogen/transactions/Clawback.h
index ecd7ebe7a2..9a3a7f9feb 100644
--- a/include/xrpl/protocol_autogen/transactions/Clawback.h
+++ b/include/xrpl/protocol_autogen/transactions/Clawback.h
@@ -126,7 +126,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAmount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h
index 2b16590649..c80fc81dc5 100644
--- a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h
@@ -138,7 +138,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfMPTokenIssuanceID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h
index f7a4cb601a..dec7f733c9 100644
--- a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h
@@ -229,7 +229,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfMPTokenIssuanceID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h
index 68bf326645..53a8e64125 100644
--- a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h
@@ -203,7 +203,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfMPTokenIssuanceID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h
index bb932080d8..848da42a41 100644
--- a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfMPTokenIssuanceID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h
index 2d8a77d56f..806a2586e9 100644
--- a/include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h
+++ b/include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h
@@ -268,7 +268,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfMPTokenIssuanceID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/CredentialAccept.h b/include/xrpl/protocol_autogen/transactions/CredentialAccept.h
index 152c18ea09..f2ab546320 100644
--- a/include/xrpl/protocol_autogen/transactions/CredentialAccept.h
+++ b/include/xrpl/protocol_autogen/transactions/CredentialAccept.h
@@ -112,7 +112,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfIssuer (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/CredentialCreate.h b/include/xrpl/protocol_autogen/transactions/CredentialCreate.h
index d7e056f590..6cf09c852b 100644
--- a/include/xrpl/protocol_autogen/transactions/CredentialCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/CredentialCreate.h
@@ -164,7 +164,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfSubject (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/CredentialDelete.h b/include/xrpl/protocol_autogen/transactions/CredentialDelete.h
index 512f230a26..24a2bfa62a 100644
--- a/include/xrpl/protocol_autogen/transactions/CredentialDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/CredentialDelete.h
@@ -151,7 +151,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfSubject (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/DIDDelete.h b/include/xrpl/protocol_autogen/transactions/DIDDelete.h
index 5f90821bfd..304287883d 100644
--- a/include/xrpl/protocol_autogen/transactions/DIDDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/DIDDelete.h
@@ -86,7 +86,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Build and return the DIDDelete wrapper.
diff --git a/include/xrpl/protocol_autogen/transactions/DIDSet.h b/include/xrpl/protocol_autogen/transactions/DIDSet.h
index 27242cda71..67e5ba23c5 100644
--- a/include/xrpl/protocol_autogen/transactions/DIDSet.h
+++ b/include/xrpl/protocol_autogen/transactions/DIDSet.h
@@ -164,7 +164,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfDIDDocument (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/DelegateSet.h b/include/xrpl/protocol_autogen/transactions/DelegateSet.h
index 1f454ff4a1..592a778952 100644
--- a/include/xrpl/protocol_autogen/transactions/DelegateSet.h
+++ b/include/xrpl/protocol_autogen/transactions/DelegateSet.h
@@ -112,7 +112,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAuthorize (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/DepositPreauth.h b/include/xrpl/protocol_autogen/transactions/DepositPreauth.h
index d303ffbeff..b5d575aac5 100644
--- a/include/xrpl/protocol_autogen/transactions/DepositPreauth.h
+++ b/include/xrpl/protocol_autogen/transactions/DepositPreauth.h
@@ -186,7 +186,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAuthorize (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/EnableAmendment.h b/include/xrpl/protocol_autogen/transactions/EnableAmendment.h
index b397c5df87..e811ca16df 100644
--- a/include/xrpl/protocol_autogen/transactions/EnableAmendment.h
+++ b/include/xrpl/protocol_autogen/transactions/EnableAmendment.h
@@ -112,7 +112,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLedgerSequence (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/EscrowCancel.h b/include/xrpl/protocol_autogen/transactions/EscrowCancel.h
index 4da943c351..e7e49eca0d 100644
--- a/include/xrpl/protocol_autogen/transactions/EscrowCancel.h
+++ b/include/xrpl/protocol_autogen/transactions/EscrowCancel.h
@@ -112,7 +112,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfOwner (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/EscrowCreate.h b/include/xrpl/protocol_autogen/transactions/EscrowCreate.h
index 35775c31ae..b994e4ec07 100644
--- a/include/xrpl/protocol_autogen/transactions/EscrowCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/EscrowCreate.h
@@ -217,7 +217,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfDestination (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/EscrowFinish.h b/include/xrpl/protocol_autogen/transactions/EscrowFinish.h
index f6ca73d209..2476def5c2 100644
--- a/include/xrpl/protocol_autogen/transactions/EscrowFinish.h
+++ b/include/xrpl/protocol_autogen/transactions/EscrowFinish.h
@@ -190,7 +190,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfOwner (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LedgerStateFix.h b/include/xrpl/protocol_autogen/transactions/LedgerStateFix.h
index 52723ad5eb..af86dea0b0 100644
--- a/include/xrpl/protocol_autogen/transactions/LedgerStateFix.h
+++ b/include/xrpl/protocol_autogen/transactions/LedgerStateFix.h
@@ -151,7 +151,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLedgerFixType (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverClawback.h b/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverClawback.h
index 4842381362..875e0a4c5e 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverClawback.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverClawback.h
@@ -139,7 +139,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLoanBrokerID (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverDeposit.h b/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverDeposit.h
index 98cebdccb2..38cc113844 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverDeposit.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverDeposit.h
@@ -113,7 +113,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLoanBrokerID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverWithdraw.h b/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverWithdraw.h
index e734c6802a..56a93acbb4 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverWithdraw.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanBrokerCoverWithdraw.h
@@ -165,7 +165,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLoanBrokerID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanBrokerDelete.h b/include/xrpl/protocol_autogen/transactions/LoanBrokerDelete.h
index 55c0a12381..29b3a787fd 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanBrokerDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanBrokerDelete.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLoanBrokerID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanBrokerSet.h b/include/xrpl/protocol_autogen/transactions/LoanBrokerSet.h
index 854022242d..41c87c281d 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanBrokerSet.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanBrokerSet.h
@@ -255,7 +255,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfVaultID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanDelete.h b/include/xrpl/protocol_autogen/transactions/LoanDelete.h
index 70c9e50097..8ed537b37a 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanDelete.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLoanID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanManage.h b/include/xrpl/protocol_autogen/transactions/LoanManage.h
index f11782c4e1..5eb95d21b1 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanManage.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanManage.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLoanID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanPay.h b/include/xrpl/protocol_autogen/transactions/LoanPay.h
index 4012225e17..8e1faeb981 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanPay.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanPay.h
@@ -113,7 +113,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLoanID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/LoanSet.h b/include/xrpl/protocol_autogen/transactions/LoanSet.h
index 3fa3c905c2..2cadebd02e 100644
--- a/include/xrpl/protocol_autogen/transactions/LoanSet.h
+++ b/include/xrpl/protocol_autogen/transactions/LoanSet.h
@@ -500,7 +500,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLoanBrokerID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/MPTokenAuthorize.h b/include/xrpl/protocol_autogen/transactions/MPTokenAuthorize.h
index 90440c41f9..2fb93eaf35 100644
--- a/include/xrpl/protocol_autogen/transactions/MPTokenAuthorize.h
+++ b/include/xrpl/protocol_autogen/transactions/MPTokenAuthorize.h
@@ -125,7 +125,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfMPTokenIssuanceID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceCreate.h b/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceCreate.h
index d723a3041c..e6fece8354 100644
--- a/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceCreate.h
@@ -242,7 +242,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAssetScale (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceDestroy.h b/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceDestroy.h
index 19c4530792..cbcd206097 100644
--- a/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceDestroy.h
+++ b/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceDestroy.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfMPTokenIssuanceID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h b/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h
index 8099af1148..803868c640 100644
--- a/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h
+++ b/include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h
@@ -281,7 +281,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfMPTokenIssuanceID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/NFTokenAcceptOffer.h b/include/xrpl/protocol_autogen/transactions/NFTokenAcceptOffer.h
index 7627437a52..325d2d7fbd 100644
--- a/include/xrpl/protocol_autogen/transactions/NFTokenAcceptOffer.h
+++ b/include/xrpl/protocol_autogen/transactions/NFTokenAcceptOffer.h
@@ -164,7 +164,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfNFTokenBuyOffer (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/NFTokenBurn.h b/include/xrpl/protocol_autogen/transactions/NFTokenBurn.h
index 9f981b1ec4..ec423ea468 100644
--- a/include/xrpl/protocol_autogen/transactions/NFTokenBurn.h
+++ b/include/xrpl/protocol_autogen/transactions/NFTokenBurn.h
@@ -125,7 +125,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfNFTokenID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/NFTokenCancelOffer.h b/include/xrpl/protocol_autogen/transactions/NFTokenCancelOffer.h
index 2eca27fc8d..4c4fb1dc65 100644
--- a/include/xrpl/protocol_autogen/transactions/NFTokenCancelOffer.h
+++ b/include/xrpl/protocol_autogen/transactions/NFTokenCancelOffer.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfNFTokenOffers (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/NFTokenCreateOffer.h b/include/xrpl/protocol_autogen/transactions/NFTokenCreateOffer.h
index a5c6e226d9..a535a578e0 100644
--- a/include/xrpl/protocol_autogen/transactions/NFTokenCreateOffer.h
+++ b/include/xrpl/protocol_autogen/transactions/NFTokenCreateOffer.h
@@ -190,7 +190,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfNFTokenID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/NFTokenMint.h b/include/xrpl/protocol_autogen/transactions/NFTokenMint.h
index ad68f1a18b..5af41eb3dd 100644
--- a/include/xrpl/protocol_autogen/transactions/NFTokenMint.h
+++ b/include/xrpl/protocol_autogen/transactions/NFTokenMint.h
@@ -255,7 +255,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfNFTokenTaxon (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/NFTokenModify.h b/include/xrpl/protocol_autogen/transactions/NFTokenModify.h
index 277146ce78..9b9701fed6 100644
--- a/include/xrpl/protocol_autogen/transactions/NFTokenModify.h
+++ b/include/xrpl/protocol_autogen/transactions/NFTokenModify.h
@@ -151,7 +151,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfNFTokenID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/OfferCancel.h b/include/xrpl/protocol_autogen/transactions/OfferCancel.h
index 833924f683..5e6010e0dd 100644
--- a/include/xrpl/protocol_autogen/transactions/OfferCancel.h
+++ b/include/xrpl/protocol_autogen/transactions/OfferCancel.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfOfferSequence (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/OfferCreate.h b/include/xrpl/protocol_autogen/transactions/OfferCreate.h
index 13e868643f..ffc1216297 100644
--- a/include/xrpl/protocol_autogen/transactions/OfferCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/OfferCreate.h
@@ -192,7 +192,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfTakerPays (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/OracleDelete.h b/include/xrpl/protocol_autogen/transactions/OracleDelete.h
index d6d46d1d7a..ebdc8fb7e9 100644
--- a/include/xrpl/protocol_autogen/transactions/OracleDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/OracleDelete.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfOracleDocumentID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/OracleSet.h b/include/xrpl/protocol_autogen/transactions/OracleSet.h
index 1d295b4cc2..0ec6d5cad0 100644
--- a/include/xrpl/protocol_autogen/transactions/OracleSet.h
+++ b/include/xrpl/protocol_autogen/transactions/OracleSet.h
@@ -203,7 +203,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfOracleDocumentID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/Payment.h b/include/xrpl/protocol_autogen/transactions/Payment.h
index b2e82cd6af..389900bf12 100644
--- a/include/xrpl/protocol_autogen/transactions/Payment.h
+++ b/include/xrpl/protocol_autogen/transactions/Payment.h
@@ -295,7 +295,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfDestination (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/PaymentChannelClaim.h b/include/xrpl/protocol_autogen/transactions/PaymentChannelClaim.h
index 1db3057366..4c567b13f4 100644
--- a/include/xrpl/protocol_autogen/transactions/PaymentChannelClaim.h
+++ b/include/xrpl/protocol_autogen/transactions/PaymentChannelClaim.h
@@ -229,7 +229,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfChannel (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/PaymentChannelCreate.h b/include/xrpl/protocol_autogen/transactions/PaymentChannelCreate.h
index cf0cbae2aa..0a513d575a 100644
--- a/include/xrpl/protocol_autogen/transactions/PaymentChannelCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/PaymentChannelCreate.h
@@ -190,7 +190,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfDestination (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/PaymentChannelFund.h b/include/xrpl/protocol_autogen/transactions/PaymentChannelFund.h
index 3612fcbf48..51210dd796 100644
--- a/include/xrpl/protocol_autogen/transactions/PaymentChannelFund.h
+++ b/include/xrpl/protocol_autogen/transactions/PaymentChannelFund.h
@@ -138,7 +138,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfChannel (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/PermissionedDomainDelete.h b/include/xrpl/protocol_autogen/transactions/PermissionedDomainDelete.h
index e08ff1ed5a..3db921776c 100644
--- a/include/xrpl/protocol_autogen/transactions/PermissionedDomainDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/PermissionedDomainDelete.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfDomainID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/PermissionedDomainSet.h b/include/xrpl/protocol_autogen/transactions/PermissionedDomainSet.h
index 68f1cfebb2..3e352cad76 100644
--- a/include/xrpl/protocol_autogen/transactions/PermissionedDomainSet.h
+++ b/include/xrpl/protocol_autogen/transactions/PermissionedDomainSet.h
@@ -125,7 +125,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfDomainID (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/SetFee.h b/include/xrpl/protocol_autogen/transactions/SetFee.h
index bc5fc0e603..177f39199b 100644
--- a/include/xrpl/protocol_autogen/transactions/SetFee.h
+++ b/include/xrpl/protocol_autogen/transactions/SetFee.h
@@ -294,7 +294,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLedgerSequence (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/SetRegularKey.h b/include/xrpl/protocol_autogen/transactions/SetRegularKey.h
index 1eca1bef25..a943bb0279 100644
--- a/include/xrpl/protocol_autogen/transactions/SetRegularKey.h
+++ b/include/xrpl/protocol_autogen/transactions/SetRegularKey.h
@@ -112,7 +112,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfRegularKey (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/SignerListSet.h b/include/xrpl/protocol_autogen/transactions/SignerListSet.h
index c711864e95..6e9d0e41ba 100644
--- a/include/xrpl/protocol_autogen/transactions/SignerListSet.h
+++ b/include/xrpl/protocol_autogen/transactions/SignerListSet.h
@@ -123,7 +123,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfSignerQuorum (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/SponsorshipSet.h b/include/xrpl/protocol_autogen/transactions/SponsorshipSet.h
index 2831c8a077..0124da5e58 100644
--- a/include/xrpl/protocol_autogen/transactions/SponsorshipSet.h
+++ b/include/xrpl/protocol_autogen/transactions/SponsorshipSet.h
@@ -216,7 +216,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfCounterpartySponsor (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h b/include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h
index bc27f1603b..ab26e887e3 100644
--- a/include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h
+++ b/include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h
@@ -138,7 +138,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfObjectID (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/TicketCreate.h b/include/xrpl/protocol_autogen/transactions/TicketCreate.h
index 0b4206152e..0d8670a76a 100644
--- a/include/xrpl/protocol_autogen/transactions/TicketCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/TicketCreate.h
@@ -99,7 +99,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfTicketCount (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/TrustSet.h b/include/xrpl/protocol_autogen/transactions/TrustSet.h
index 30d537492d..22891b94ec 100644
--- a/include/xrpl/protocol_autogen/transactions/TrustSet.h
+++ b/include/xrpl/protocol_autogen/transactions/TrustSet.h
@@ -164,7 +164,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfLimitAmount (SoeOptional)
diff --git a/include/xrpl/protocol_autogen/transactions/UNLModify.h b/include/xrpl/protocol_autogen/transactions/UNLModify.h
index a8556ca699..6569e4bf7d 100644
--- a/include/xrpl/protocol_autogen/transactions/UNLModify.h
+++ b/include/xrpl/protocol_autogen/transactions/UNLModify.h
@@ -125,7 +125,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfUNLModifyDisabling (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/VaultClawback.h b/include/xrpl/protocol_autogen/transactions/VaultClawback.h
index 8ec1d359dc..270ccc94bb 100644
--- a/include/xrpl/protocol_autogen/transactions/VaultClawback.h
+++ b/include/xrpl/protocol_autogen/transactions/VaultClawback.h
@@ -139,7 +139,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfVaultID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/VaultCreate.h b/include/xrpl/protocol_autogen/transactions/VaultCreate.h
index c8efa83cbf..b7e1527754 100644
--- a/include/xrpl/protocol_autogen/transactions/VaultCreate.h
+++ b/include/xrpl/protocol_autogen/transactions/VaultCreate.h
@@ -256,7 +256,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfAsset (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/VaultDelete.h b/include/xrpl/protocol_autogen/transactions/VaultDelete.h
index b4c08ae229..67cc32f543 100644
--- a/include/xrpl/protocol_autogen/transactions/VaultDelete.h
+++ b/include/xrpl/protocol_autogen/transactions/VaultDelete.h
@@ -125,7 +125,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfVaultID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/VaultDeposit.h b/include/xrpl/protocol_autogen/transactions/VaultDeposit.h
index 01f707e07f..5bb5362114 100644
--- a/include/xrpl/protocol_autogen/transactions/VaultDeposit.h
+++ b/include/xrpl/protocol_autogen/transactions/VaultDeposit.h
@@ -113,7 +113,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfVaultID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/VaultSet.h b/include/xrpl/protocol_autogen/transactions/VaultSet.h
index 5bdc6a7a95..14df70f13b 100644
--- a/include/xrpl/protocol_autogen/transactions/VaultSet.h
+++ b/include/xrpl/protocol_autogen/transactions/VaultSet.h
@@ -177,7 +177,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfVaultID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/VaultWithdraw.h b/include/xrpl/protocol_autogen/transactions/VaultWithdraw.h
index 75b5b90035..3211524e1f 100644
--- a/include/xrpl/protocol_autogen/transactions/VaultWithdraw.h
+++ b/include/xrpl/protocol_autogen/transactions/VaultWithdraw.h
@@ -165,7 +165,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfVaultID (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/XChainAccountCreateCommit.h b/include/xrpl/protocol_autogen/transactions/XChainAccountCreateCommit.h
index 36d8170af1..b8d551c5e1 100644
--- a/include/xrpl/protocol_autogen/transactions/XChainAccountCreateCommit.h
+++ b/include/xrpl/protocol_autogen/transactions/XChainAccountCreateCommit.h
@@ -138,7 +138,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfXChainBridge (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/XChainAddAccountCreateAttestation.h b/include/xrpl/protocol_autogen/transactions/XChainAddAccountCreateAttestation.h
index a04eec1505..22b57803dc 100644
--- a/include/xrpl/protocol_autogen/transactions/XChainAddAccountCreateAttestation.h
+++ b/include/xrpl/protocol_autogen/transactions/XChainAddAccountCreateAttestation.h
@@ -229,7 +229,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfXChainBridge (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/XChainAddClaimAttestation.h b/include/xrpl/protocol_autogen/transactions/XChainAddClaimAttestation.h
index 1896f11681..5e80c05aae 100644
--- a/include/xrpl/protocol_autogen/transactions/XChainAddClaimAttestation.h
+++ b/include/xrpl/protocol_autogen/transactions/XChainAddClaimAttestation.h
@@ -229,7 +229,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfXChainBridge (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/XChainClaim.h b/include/xrpl/protocol_autogen/transactions/XChainClaim.h
index f5b680049e..ec403b5eb8 100644
--- a/include/xrpl/protocol_autogen/transactions/XChainClaim.h
+++ b/include/xrpl/protocol_autogen/transactions/XChainClaim.h
@@ -164,7 +164,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfXChainBridge (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/XChainCommit.h b/include/xrpl/protocol_autogen/transactions/XChainCommit.h
index a9ce7d1d08..48b2263645 100644
--- a/include/xrpl/protocol_autogen/transactions/XChainCommit.h
+++ b/include/xrpl/protocol_autogen/transactions/XChainCommit.h
@@ -151,7 +151,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfXChainBridge (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/XChainCreateBridge.h b/include/xrpl/protocol_autogen/transactions/XChainCreateBridge.h
index ae5be4108f..9614b0bd88 100644
--- a/include/xrpl/protocol_autogen/transactions/XChainCreateBridge.h
+++ b/include/xrpl/protocol_autogen/transactions/XChainCreateBridge.h
@@ -138,7 +138,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfXChainBridge (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/XChainCreateClaimID.h b/include/xrpl/protocol_autogen/transactions/XChainCreateClaimID.h
index 7c1beb20c7..d17759619f 100644
--- a/include/xrpl/protocol_autogen/transactions/XChainCreateClaimID.h
+++ b/include/xrpl/protocol_autogen/transactions/XChainCreateClaimID.h
@@ -125,7 +125,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfXChainBridge (SoeRequired)
diff --git a/include/xrpl/protocol_autogen/transactions/XChainModifyBridge.h b/include/xrpl/protocol_autogen/transactions/XChainModifyBridge.h
index 30558ab88c..e79c9139ce 100644
--- a/include/xrpl/protocol_autogen/transactions/XChainModifyBridge.h
+++ b/include/xrpl/protocol_autogen/transactions/XChainModifyBridge.h
@@ -151,7 +151,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 
     /**
      * @brief Set sfXChainBridge (SoeRequired)
diff --git a/include/xrpl/rdb/RelationalDatabase.h b/include/xrpl/rdb/RelationalDatabase.h
index 91c282ff16..c77c8a7ed3 100644
--- a/include/xrpl/rdb/RelationalDatabase.h
+++ b/include/xrpl/rdb/RelationalDatabase.h
@@ -65,8 +65,10 @@ public:
     struct AccountTxOptions
     {
         AccountID const& account;
-        /// Ledger sequence range to search. A value of 0 for min or max
-        /// means unbounded in that direction (no constraint applied).
+        /**
+         * Ledger sequence range to search. A value of 0 for min or max
+         * means unbounded in that direction (no constraint applied).
+         */
         LedgerRange ledgerRange{};
         std::uint32_t offset = 0;
         std::uint32_t limit = 0;
diff --git a/include/xrpl/rdb/SociDB.h b/include/xrpl/rdb/SociDB.h
index 0f427bd18b..61edcf2263 100644
--- a/include/xrpl/rdb/SociDB.h
+++ b/include/xrpl/rdb/SociDB.h
@@ -1,12 +1,13 @@
 #pragma once
 
-/** An embedded database wrapper with an intuitive, type-safe interface.
-
-    This collection of classes let's you access embedded SQLite databases
-    using C++ syntax that is very similar to regular SQL.
-
-    This module requires the @ref beast_sqlite external module.
-*/
+/**
+ * An embedded database wrapper with an intuitive, type-safe interface.
+ *
+ * This collection of classes let's you access embedded SQLite databases
+ * using C++ syntax that is very similar to regular SQL.
+ *
+ * This module requires the @ref beast_sqlite external module.
+ */
 
 #include <soci/blob.h>
 #include <soci/session.h>
@@ -35,9 +36,9 @@ namespace xrpl {
 class BasicConfig;
 
 /**
-   DBConfig is used when a client wants to delay opening a soci::session after
-   parsing the config parameters. If a client want to open a session
-   immediately, use the free function "open" below.
+ * DBConfig is used when a client wants to delay opening a soci::session after
+ * parsing the config parameters. If a client want to open a session
+ * immediately, use the free function "open" below.
  */
 class DBConfig
 {
@@ -53,27 +54,27 @@ public:
 };
 
 /**
-   Open a soci session.
-
-   @param s Session to open.
-
-   @param config Parameters to pick the soci backend and how to connect to that
-                 backend.
-
-   @param dbName Name of the database. This has different meaning for different
-                 backends. Sometimes it is part of a filename (sqlite3),
-                 other times it is a database name (postgresql).
-*/
+ * Open a soci session.
+ *
+ * @param s Session to open.
+ *
+ * @param config Parameters to pick the soci backend and how to connect to that
+ *               backend.
+ *
+ * @param dbName Name of the database. This has different meaning for different
+ *               backends. Sometimes it is part of a filename (sqlite3),
+ *               other times it is a database name (postgresql).
+ */
 void
 open(soci::session& s, BasicConfig const& config, std::string const& dbName);
 
 /**
- *  Open a soci session.
+ * Open a soci session.
  *
- *  @param s Session to open.
- *  @param beName Backend name.
- *  @param connectionString Connection string to forward to soci::open.
- *         see the soci::open documentation for how to use this.
+ * @param s Session to open.
+ * @param beName Backend name.
+ * @param connectionString Connection string to forward to soci::open.
+ *        see the soci::open documentation for how to use this.
  *
  */
 void
@@ -107,11 +108,12 @@ public:
     checkpoint() = 0;
 };
 
-/** Returns a new checkpointer which makes checkpoints of a
-    soci database every checkpointPageCount pages, using a job on the job queue.
-
-    The checkpointer contains references to the session and job queue
-    and so must outlive them both.
+/**
+ * Returns a new checkpointer which makes checkpoints of a
+ * soci database every checkpointPageCount pages, using a job on the job queue.
+ *
+ * The checkpointer contains references to the session and job queue
+ * and so must outlive them both.
  */
 std::shared_ptr<Checkpointer>
 makeCheckpointer(std::uintptr_t id, std::weak_ptr<soci::session>, JobQueue&, ServiceRegistry&);
diff --git a/include/xrpl/resource/Charge.h b/include/xrpl/resource/Charge.h
index 394d641e6c..12ea548fd2 100644
--- a/include/xrpl/resource/Charge.h
+++ b/include/xrpl/resource/Charge.h
@@ -6,28 +6,40 @@
 
 namespace xrpl::Resource {
 
-/** A consumption charge. */
+/**
+ * A consumption charge.
+ */
 class Charge
 {
 public:
-    /** The type used to hold a consumption charge. */
+    /**
+     * The type used to hold a consumption charge.
+     */
     using value_type = int;
 
     // A default constructed Charge has no way to get a label.  Delete
     Charge() = delete;
 
-    /** Create a charge with the specified cost and name. */
+    /**
+     * Create a charge with the specified cost and name.
+     */
     Charge(value_type cost, std::string label = std::string());
 
-    /** Return the human readable label associated with the charge. */
+    /**
+     * Return the human readable label associated with the charge.
+     */
     [[nodiscard]] std::string const&
     label() const;
 
-    /** Return the cost of the charge in Resource::Manager units. */
+    /**
+     * Return the cost of the charge in Resource::Manager units.
+     */
     [[nodiscard]] value_type
     cost() const;
 
-    /** Converts this charge into a human readable string. */
+    /**
+     * Converts this charge into a human readable string.
+     */
     [[nodiscard]] std::string
     toString() const;
 
diff --git a/include/xrpl/resource/Consumer.h b/include/xrpl/resource/Consumer.h
index 18207832ac..9abcbffc82 100644
--- a/include/xrpl/resource/Consumer.h
+++ b/include/xrpl/resource/Consumer.h
@@ -13,7 +13,9 @@ namespace xrpl::Resource {
 struct Entry;
 class Logic;
 
-/** An endpoint that consumes resources. */
+/**
+ * An endpoint that consumes resources.
+ */
 class Consumer
 {
 private:
@@ -27,42 +29,55 @@ public:
     Consumer&
     operator=(Consumer const& other);
 
-    /** Return a human readable string uniquely identifying this consumer. */
+    /**
+     * Return a human readable string uniquely identifying this consumer.
+     */
     [[nodiscard]] std::string
     toString() const;
 
-    /** Returns `true` if this is a privileged endpoint. */
+    /**
+     * Returns `true` if this is a privileged endpoint.
+     */
     [[nodiscard]] bool
     isUnlimited() const;
 
-    /** Raise the Consumer's privilege level to a Named endpoint.
-        The reference to the original endpoint descriptor is released.
-    */
+    /**
+     * Raise the Consumer's privilege level to a Named endpoint.
+     * The reference to the original endpoint descriptor is released.
+     */
     void
     elevate(std::string const& name);
 
-    /** Returns the current disposition of this consumer.
-        This should be checked upon creation to determine if the consumer
-        should be disconnected immediately.
-    */
+    /**
+     * Returns the current disposition of this consumer.
+     * This should be checked upon creation to determine if the consumer
+     * should be disconnected immediately.
+     */
     [[nodiscard]] Disposition
     disposition() const;
 
-    /** Apply a load charge to the consumer. */
+    /**
+     * Apply a load charge to the consumer.
+     */
     Disposition
     charge(Charge const& fee, std::string const& context = {});
 
-    /** Returns `true` if the consumer should be warned.
-        This consumes the warning.
-    */
+    /**
+     * Returns `true` if the consumer should be warned.
+     * This consumes the warning.
+     */
     bool
     warn();
 
-    /** Returns `true` if the consumer should be disconnected. */
+    /**
+     * Returns `true` if the consumer should be disconnected.
+     */
     bool
     disconnect(beast::Journal const& j);
 
-    /** Returns the credit balance representing consumption. */
+    /**
+     * Returns the credit balance representing consumption.
+     */
     int
     balance();
 
diff --git a/include/xrpl/resource/Disposition.h b/include/xrpl/resource/Disposition.h
index 6dad8db19a..cd5bceafa5 100644
--- a/include/xrpl/resource/Disposition.h
+++ b/include/xrpl/resource/Disposition.h
@@ -2,16 +2,24 @@
 
 namespace xrpl::Resource {
 
-/** The disposition of a consumer after applying a load charge. */
+/**
+ * The disposition of a consumer after applying a load charge.
+ */
 enum class Disposition {
-    /** No action required. */
+    /**
+     * No action required.
+     */
     Ok
 
-    /** Consumer should be warned that consumption is high. */
+    /**
+     * Consumer should be warned that consumption is high.
+     */
     ,
     Warn
 
-    /** Consumer should be disconnected for excess consumption. */
+    /**
+     * Consumer should be disconnected for excess consumption.
+     */
     ,
     Drop
 };
diff --git a/include/xrpl/resource/Fees.h b/include/xrpl/resource/Fees.h
index 55d539ac6a..5001b504d6 100644
--- a/include/xrpl/resource/Fees.h
+++ b/include/xrpl/resource/Fees.h
@@ -4,7 +4,9 @@
 
 namespace xrpl::Resource {
 
-/** Schedule of fees charged for imposing load on the server. */
+/**
+ * Schedule of fees charged for imposing load on the server.
+ */
 /** @{ */
 extern Charge const kFeeMalformedRequest;  // A request that we can immediately tell is invalid.
 extern Charge const kFeeRequestNoReply;    // A request that we cannot satisfy.
diff --git a/include/xrpl/resource/Gossip.h b/include/xrpl/resource/Gossip.h
index e626af37c3..4ad5852de0 100644
--- a/include/xrpl/resource/Gossip.h
+++ b/include/xrpl/resource/Gossip.h
@@ -6,12 +6,16 @@
 
 namespace xrpl::Resource {
 
-/** Data format for exchanging consumption information across peers. */
+/**
+ * Data format for exchanging consumption information across peers.
+ */
 struct Gossip
 {
     explicit Gossip() = default;
 
-    /** Describes a single consumer. */
+    /**
+     * Describes a single consumer.
+     */
     struct Item
     {
         explicit Item() = default;
diff --git a/include/xrpl/resource/ResourceManager.h b/include/xrpl/resource/ResourceManager.h
index 13e0d09343..03aab60c75 100644
--- a/include/xrpl/resource/ResourceManager.h
+++ b/include/xrpl/resource/ResourceManager.h
@@ -16,7 +16,9 @@
 
 namespace xrpl::Resource {
 
-/** Tracks load and resource consumption. */
+/**
+ * Tracks load and resource consumption.
+ */
 class Manager : public beast::PropertyStream::Source
 {
 protected:
@@ -25,8 +27,10 @@ protected:
 public:
     ~Manager() override = 0;
 
-    /** Create a new endpoint keyed by inbound IP address or the forwarded
-     * IP if proxied. */
+    /**
+     * Create a new endpoint keyed by inbound IP address or the forwarded
+     * IP if proxied.
+     */
     virtual Consumer
     newInboundEndpoint(beast::IP::Endpoint const& address) = 0;
     virtual Consumer
@@ -35,27 +39,36 @@ public:
         bool const proxy,
         std::string_view forwardedFor) = 0;
 
-    /** Create a new endpoint keyed by outbound IP address and port. */
+    /**
+     * Create a new endpoint keyed by outbound IP address and port.
+     */
     virtual Consumer
     newOutboundEndpoint(beast::IP::Endpoint const& address) = 0;
 
-    /** Create a new unlimited endpoint keyed by forwarded IP. */
+    /**
+     * Create a new unlimited endpoint keyed by forwarded IP.
+     */
     virtual Consumer
     newUnlimitedEndpoint(beast::IP::Endpoint const& address) = 0;
 
-    /** Extract packaged consumer information for export. */
+    /**
+     * Extract packaged consumer information for export.
+     */
     virtual Gossip
     exportConsumers() = 0;
 
-    /** Extract consumer information for reporting. */
+    /**
+     * Extract consumer information for reporting.
+     */
     virtual json::Value
     getJson() = 0;
     virtual json::Value
     getJson(int threshold) = 0;
 
-    /** Import packaged consumer information.
-        @param origin An identifier that unique labels the origin.
-    */
+    /**
+     * Import packaged consumer information.
+     * @param origin An identifier that unique labels the origin.
+     */
     virtual void
     importConsumers(std::string const& origin, Gossip const& gossip) = 0;
 };
diff --git a/include/xrpl/resource/detail/Entry.h b/include/xrpl/resource/detail/Entry.h
index 6f44ac2c29..1336bda6ab 100644
--- a/include/xrpl/resource/detail/Entry.h
+++ b/include/xrpl/resource/detail/Entry.h
@@ -23,8 +23,8 @@ struct Entry : public beast::List<Entry>::Node
     Entry() = delete;
 
     /**
-       @param now Construction time of Entry.
-    */
+     * @param now Construction time of Entry.
+     */
     explicit Entry(clock_type::time_point const now)
         : refcount(0), localBalance(now), remoteBalance(0)
     {
diff --git a/include/xrpl/resource/detail/Import.h b/include/xrpl/resource/detail/Import.h
index a3df6fd73b..b19dbc4d1a 100644
--- a/include/xrpl/resource/detail/Import.h
+++ b/include/xrpl/resource/detail/Import.h
@@ -7,7 +7,9 @@
 
 namespace xrpl::Resource {
 
-/** A set of imported consumer data from a gossip origin. */
+/**
+ * A set of imported consumer data from a gossip origin.
+ */
 struct Import
 {
     struct Item
diff --git a/include/xrpl/resource/detail/Logic.h b/include/xrpl/resource/detail/Logic.h
index 78cd0ac36c..3f36ad84a3 100644
--- a/include/xrpl/resource/detail/Logic.h
+++ b/include/xrpl/resource/detail/Logic.h
@@ -192,7 +192,9 @@ public:
         return getJson(kWarningThreshold);
     }
 
-    /** Returns a json::ValueType::Object. */
+    /**
+     * Returns a json::ValueType::Object.
+     */
     json::Value
     getJson(int threshold)
     {
diff --git a/include/xrpl/resource/detail/Tuning.h b/include/xrpl/resource/detail/Tuning.h
index 7b2046f45c..62f7fa3f9d 100644
--- a/include/xrpl/resource/detail/Tuning.h
+++ b/include/xrpl/resource/detail/Tuning.h
@@ -4,7 +4,9 @@
 
 namespace xrpl::Resource {
 
-/** Tunable constants. */
+/**
+ * Tunable constants.
+ */
 
 // balance at which a warning is issued
 static constexpr auto kWarningThreshold = 5000;
diff --git a/include/xrpl/server/Handoff.h b/include/xrpl/server/Handoff.h
index b80a9c5745..6dc547467b 100644
--- a/include/xrpl/server/Handoff.h
+++ b/include/xrpl/server/Handoff.h
@@ -13,7 +13,9 @@ using http_request_type = boost::beast::http::request<boost::beast::http::dynami
 
 using http_response_type = boost::beast::http::response<boost::beast::http::dynamic_body>;
 
-/** Used to indicate the result of a server connection handoff. */
+/**
+ * Used to indicate the result of a server connection handoff.
+ */
 struct Handoff
 {
     // When `true`, the Session will close the socket. The
diff --git a/include/xrpl/server/InfoSub.h b/include/xrpl/server/InfoSub.h
index d708a456c4..2e9bd857c7 100644
--- a/include/xrpl/server/InfoSub.h
+++ b/include/xrpl/server/InfoSub.h
@@ -35,20 +35,21 @@ public:
     doStatus(json::Value const&) = 0;
 };
 
-/** Manages a client's subscription to data feeds.
+/**
+ * Manages a client's subscription to data feeds.
  *
- *  An InfoSub holds a non-owning reference to its `Source` (typically the
- *  process-wide `NetworkOPsImp`). The destructor reaches back into the
- *  `Source` to remove this subscriber from every server-side subscription
- *  map.
+ * An InfoSub holds a non-owning reference to its `Source` (typically the
+ * process-wide `NetworkOPsImp`). The destructor reaches back into the
+ * `Source` to remove this subscriber from every server-side subscription
+ * map.
  *
- *  @note Lifetime contract: every `InfoSub` instance MUST be destroyed
- *        before the backing `Source`. NetworkOPsImp shutdown drops all
- *        subscriber strong refs before its own teardown to satisfy this.
- *  @note Thread-safety: per-instance state is guarded by `lock_`. The
- *        destructor reads tracking sets without taking `lock_` because
- *        the strong-pointer ref-count is zero at destruction time, so
- *        no other thread can be calling the public mutators.
+ * @note Lifetime contract: every `InfoSub` instance MUST be destroyed
+ *       before the backing `Source`. NetworkOPsImp shutdown drops all
+ *       subscriber strong refs before its own teardown to satisfy this.
+ * @note Thread-safety: per-instance state is guarded by `lock_`. The
+ *       destructor reads tracking sets without taking `lock_` because
+ *       the strong-pointer ref-count is zero at destruction time, so
+ *       no other thread can be calling the public mutators.
  */
 class InfoSub : public CountedObject<InfoSub>
 {
@@ -64,7 +65,8 @@ public:
     using Consumer = Resource::Consumer;
 
 public:
-    /** Abstracts the source of subscription data.
+    /**
+     * Abstracts the source of subscription data.
      */
     class Source
     {
@@ -217,7 +219,8 @@ public:
         virtual bool
         tryRemoveRpcSub(std::string const& strUrl) = 0;
 
-        /** Journal used by InfoSub for diagnostics that occur after the
+        /**
+         * Journal used by InfoSub for diagnostics that occur after the
          *  owning subsystem (e.g. application-level Logs) is the only
          *  surviving sink — primarily destructor-time cleanup failures.
          */
@@ -249,27 +252,29 @@ public:
     void
     deleteSubAccountInfo(AccountID const& account, bool rt);
 
-    /** Record that this subscriber is following @p book.
+    /**
+     * Record that this subscriber is following @p book.
      *
-     *  Called by NetworkOPsImp::subBook so that ~InfoSub() can issue a
-     *  matching unsubBook for every book this subscriber is tracking,
-     *  keeping per-subscriber state symmetric with the server-side map.
+     * Called by NetworkOPsImp::subBook so that ~InfoSub() can issue a
+     * matching unsubBook for every book this subscriber is tracking,
+     * keeping per-subscriber state symmetric with the server-side map.
      *
-     *  @param book The order book this subscriber has just subscribed to.
-     *  @note Idempotent: re-inserting an already-tracked book is a no-op.
-     *  @note Thread-safe: takes InfoSub::lock_.
+     * @param book The order book this subscriber has just subscribed to.
+     * @note Idempotent: re-inserting an already-tracked book is a no-op.
+     * @note Thread-safe: takes InfoSub::lock_.
      */
     void
     insertBookSubscription(Book const& book);
 
-    /** Stop tracking @p book for this subscriber.
+    /**
+     * Stop tracking @p book for this subscriber.
      *
-     *  Called by the unsubscribe RPC handler so that the book is not
-     *  re-unsubscribed by ~InfoSub(). Pairs with insertBookSubscription.
+     * Called by the unsubscribe RPC handler so that the book is not
+     * re-unsubscribed by ~InfoSub(). Pairs with insertBookSubscription.
      *
-     *  @param book The order book to forget.
-     *  @note No-op if @p book was not previously inserted.
-     *  @note Thread-safe: takes InfoSub::lock_.
+     * @param book The order book to forget.
+     * @note No-op if @p book was not previously inserted.
+     * @note Thread-safe: takes InfoSub::lock_.
      */
     void
     deleteBookSubscription(Book const& book);
diff --git a/include/xrpl/server/LoadFeeTrack.h b/include/xrpl/server/LoadFeeTrack.h
index a19ca063d5..3afd602241 100644
--- a/include/xrpl/server/LoadFeeTrack.h
+++ b/include/xrpl/server/LoadFeeTrack.h
@@ -13,15 +13,16 @@ namespace xrpl {
 
 struct Fees;
 
-/** Manages the current fee schedule.
-
-    The "base" fee is the cost to send a reference transaction under no load,
-    expressed in millionths of one XRP.
-
-    The "load" fee is how much the local server currently charges to send a
-    reference transaction. This fee fluctuates based on the load of the
-    server.
-*/
+/**
+ * Manages the current fee schedule.
+ *
+ * The "base" fee is the cost to send a reference transaction under no load,
+ * expressed in millionths of one XRP.
+ *
+ * The "load" fee is how much the local server currently charges to send a
+ * reference transaction. This fee fluctuates based on the load of the
+ * server.
+ */
 class LoadFeeTrack final
 {
 public:
diff --git a/include/xrpl/server/Manifest.h b/include/xrpl/server/Manifest.h
index c58c784de3..710545271a 100644
--- a/include/xrpl/server/Manifest.h
+++ b/include/xrpl/server/Manifest.h
@@ -68,22 +68,32 @@ namespace xrpl {
 
 struct Manifest
 {
-    /// The manifest in serialized form.
+    /**
+     * The manifest in serialized form.
+     */
     std::string serialized;
 
-    /// The master key associated with this manifest.
+    /**
+     * The master key associated with this manifest.
+     */
     PublicKey masterKey;
 
-    /// The ephemeral key associated with this manifest.
+    /**
+     * The ephemeral key associated with this manifest.
+     */
     // A revoked manifest does not have a signingKey
     // This field is specified as "optional" in manifestFormat's
     // SOTemplate
     std::optional<PublicKey> signingKey;
 
-    /// The sequence number of this manifest.
+    /**
+     * The sequence number of this manifest.
+     */
     std::uint32_t sequence = 0;
 
-    /// The domain, if one was specified in the manifest; empty otherwise.
+    /**
+     * The domain, if one was specified in the manifest; empty otherwise.
+     */
     std::string domain;
 
     Manifest() = delete;
@@ -109,46 +119,61 @@ struct Manifest
     Manifest&
     operator=(Manifest&& other) = default;
 
-    /// Returns `true` if manifest signature is valid
+    /**
+     * Returns `true` if manifest signature is valid
+     */
     [[nodiscard]] bool
     verify() const;
 
-    /// Returns hash of serialized manifest data
+    /**
+     * Returns hash of serialized manifest data
+     */
     [[nodiscard]] uint256
     hash() const;
 
-    /// Returns `true` if manifest revokes master key
+    /**
+     * Returns `true` if manifest revokes master key
+     */
     // The maximum possible sequence number means that the master key has
     // been revoked
     static bool
     revoked(std::uint32_t sequence);
 
-    /// Returns `true` if manifest revokes master key
+    /**
+     * Returns `true` if manifest revokes master key
+     */
     [[nodiscard]] bool
     revoked() const;
 
-    /// Returns manifest signature
+    /**
+     * Returns manifest signature
+     */
     [[nodiscard]] std::optional<Blob>
     getSignature() const;
 
-    /// Returns manifest master key signature
+    /**
+     * Returns manifest master key signature
+     */
     [[nodiscard]] Blob
     getMasterSignature() const;
 };
 
-/** Format the specified manifest to a string for debugging purposes. */
+/**
+ * Format the specified manifest to a string for debugging purposes.
+ */
 std::string
 to_string(Manifest const& m);
 
-/** Constructs Manifest from serialized string
-
-    @param s Serialized manifest string
-
-    @return `std::nullopt` if string is invalid
-
-    @note This does not verify manifest signatures.
-          `Manifest::verify` should be called after constructing manifest.
-*/
+/**
+ * Constructs Manifest from serialized string
+ *
+ * @param s Serialized manifest string
+ *
+ * @return `std::nullopt` if string is invalid
+ *
+ * @note This does not verify manifest signatures.
+ *       `Manifest::verify` should be called after constructing manifest.
+ */
 /** @{ */
 std::optional<Manifest>
 deserializeManifest(Slice s, beast::Journal journal);
@@ -200,19 +225,29 @@ loadValidatorToken(
     beast::Journal journal = beast::Journal(beast::Journal::getNullSink()));
 
 enum class ManifestDisposition {
-    /// Manifest is valid
+    /**
+     * Manifest is valid
+     */
     Accepted = 0,
 
-    /// Sequence is too old
+    /**
+     * Sequence is too old
+     */
     Stale,
 
-    /// The master key is not acceptable to us
+    /**
+     * The master key is not acceptable to us
+     */
     BadMasterKey,
 
-    /// The ephemeral key is not acceptable to us
+    /**
+     * The ephemeral key is not acceptable to us
+     */
     BadEphemeralKey,
 
-    /// Timely, but invalid signature
+    /**
+     * Timely, but invalid signature
+     */
     Invalid
 };
 
@@ -238,17 +273,23 @@ to_string(ManifestDisposition m)
 
 class DatabaseCon;
 
-/** Remembers manifests with the highest sequence number. */
+/**
+ * Remembers manifests with the highest sequence number.
+ */
 class ManifestCache
 {
 private:
     beast::Journal j_;
     std::shared_mutex mutable mutex_;
 
-    /** Active manifests stored by master public key. */
+    /**
+     * Active manifests stored by master public key.
+     */
     hash_map<PublicKey, Manifest> map_;
 
-    /** Master public keys stored by current ephemeral public key. */
+    /**
+     * Master public keys stored by current ephemeral public key.
+     */
     hash_map<PublicKey, PublicKey> signingToMasterKeys_;
 
     std::atomic<std::uint32_t> seq_{0};
@@ -258,104 +299,114 @@ public:
     {
     }
 
-    /** A monotonically increasing number used to detect new manifests. */
+    /**
+     * A monotonically increasing number used to detect new manifests.
+     */
     std::uint32_t
     sequence() const
     {
         return seq_.load();
     }
 
-    /** Returns master key's current signing key.
-
-        @param pk Master public key
-
-        @return pk if no known signing key from a manifest
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Returns master key's current signing key.
+     *
+     * @param pk Master public key
+     *
+     * @return pk if no known signing key from a manifest
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     std::optional<PublicKey>
     getSigningKey(PublicKey const& pk) const;
 
-    /** Returns ephemeral signing key's master public key.
-
-        @param pk Ephemeral signing public key
-
-        @return pk if signing key is not in a valid manifest
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Returns ephemeral signing key's master public key.
+     *
+     * @param pk Ephemeral signing public key
+     *
+     * @return pk if signing key is not in a valid manifest
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     PublicKey
     getMasterKey(PublicKey const& pk) const;
 
-    /** Returns master key's current manifest sequence.
-
-        @return sequence corresponding to Master public key
-          if configured or std::nullopt otherwise
-    */
+    /**
+     * Returns master key's current manifest sequence.
+     *
+     * @return sequence corresponding to Master public key
+     *   if configured or std::nullopt otherwise
+     */
     std::optional<std::uint32_t>
     getSequence(PublicKey const& pk) const;
 
-    /** Returns domain claimed by a given public key
-
-        @return domain corresponding to Master public key
-          if present, otherwise std::nullopt
-    */
+    /**
+     * Returns domain claimed by a given public key
+     *
+     * @return domain corresponding to Master public key
+     *   if present, otherwise std::nullopt
+     */
     std::optional<std::string>
     getDomain(PublicKey const& pk) const;
 
-    /** Returns manifest corresponding to a given public key
-
-        @return manifest corresponding to Master public key
-          if present, otherwise std::nullopt
-    */
+    /**
+     * Returns manifest corresponding to a given public key
+     *
+     * @return manifest corresponding to Master public key
+     *   if present, otherwise std::nullopt
+     */
     std::optional<std::string>
     getManifest(PublicKey const& pk) const;
 
-    /** Returns `true` if master key has been revoked in a manifest.
-
-        @param pk Master public key
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Returns `true` if master key has been revoked in a manifest.
+     *
+     * @param pk Master public key
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     bool
     revoked(PublicKey const& pk) const;
 
-    /** Add manifest to cache.
-
-        @param m Manifest to add
-
-        @return `ManifestDisposition::accepted` if successful, or
-                `stale` or `invalid` otherwise
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Add manifest to cache.
+     *
+     * @param m Manifest to add
+     *
+     * @return `ManifestDisposition::accepted` if successful, or
+     *         `stale` or `invalid` otherwise
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     ManifestDisposition
     applyManifest(Manifest m);
 
-    /** Populate manifest cache with manifests in database and config.
-
-        @param dbCon Database connection with dbTable
-
-        @param dbTable Database table
-
-        @param configManifest Base64 encoded manifest for local node's
-            validator keys
-
-        @param configRevocation Base64 encoded validator key revocation
-            from the config
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Populate manifest cache with manifests in database and config.
+     *
+     * @param dbCon Database connection with dbTable
+     *
+     * @param dbTable Database table
+     *
+     * @param configManifest Base64 encoded manifest for local node's
+     *     validator keys
+     *
+     * @param configRevocation Base64 encoded validator key revocation
+     *     from the config
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     bool
     load(
         DatabaseCon& dbCon,
@@ -363,48 +414,51 @@ public:
         std::string const& configManifest,
         std::vector<std::string> const& configRevocation);
 
-    /** Populate manifest cache with manifests in database.
-
-        @param dbCon Database connection with dbTable
-
-        @param dbTable Database table
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Populate manifest cache with manifests in database.
+     *
+     * @param dbCon Database connection with dbTable
+     *
+     * @param dbTable Database table
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     void
     load(DatabaseCon& dbCon, std::string const& dbTable);
 
-    /** Save cached manifests to database.
-
-        @param dbCon Database connection with `ValidatorManifests` table
-
-        @param isTrusted Function that returns true if manifest is trusted
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Save cached manifests to database.
+     *
+     * @param dbCon Database connection with `ValidatorManifests` table
+     *
+     * @param isTrusted Function that returns true if manifest is trusted
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     void
     save(
         DatabaseCon& dbCon,
         std::string const& dbTable,
         std::function<bool(PublicKey const&)> const& isTrusted);
 
-    /** Invokes the callback once for every populated manifest.
-
-        @note Do not call ManifestCache member functions from within the
-        callback. This can re-lock the mutex from the same thread, which is UB.
-        @note Do not write ManifestCache member variables from within the
-        callback. This can lead to data races.
-
-        @param f Function called for each manifest
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Invokes the callback once for every populated manifest.
+     *
+     * @note Do not call ManifestCache member functions from within the
+     * callback. This can re-lock the mutex from the same thread, which is UB.
+     * @note Do not write ManifestCache member variables from within the
+     * callback. This can lead to data races.
+     *
+     * @param f Function called for each manifest
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     template <class Function>
     void
     forEachManifest(Function&& f) const
@@ -417,22 +471,23 @@ public:
         }
     }
 
-    /** Invokes the callback once for every populated manifest.
-
-        @note Do not call ManifestCache member functions from within the
-        callback. This can re-lock the mutex from the same thread, which is UB.
-        @note Do not write ManifestCache member variables from
-        within the callback. This can lead to data races.
-
-        @param pf Pre-function called with the maximum number of times f will be
-            called (useful for memory allocations)
-
-        @param f Function called for each manifest
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Invokes the callback once for every populated manifest.
+     *
+     * @note Do not call ManifestCache member functions from within the
+     * callback. This can re-lock the mutex from the same thread, which is UB.
+     * @note Do not write ManifestCache member variables from
+     * within the callback. This can lead to data races.
+     *
+     * @param pf Pre-function called with the maximum number of times f will be
+     *     called (useful for memory allocations)
+     *
+     * @param f Function called for each manifest
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     template <class PreFun, class EachFun>
     void
     forEachManifest(PreFun&& pf, EachFun&& f) const
diff --git a/include/xrpl/server/NetworkOPs.h b/include/xrpl/server/NetworkOPs.h
index ed2dbbb220..d3d3bb9f70 100644
--- a/include/xrpl/server/NetworkOPs.h
+++ b/include/xrpl/server/NetworkOPs.h
@@ -47,35 +47,37 @@ class SHAMap;
 // there's a functional network.
 //
 
-/** Specifies the mode under which the server believes it's operating.
-
-    This has implications about how the server processes transactions and
-    how it responds to requests (e.g. account balance request).
-
-    @note Other code relies on the numerical values of these constants; do
-          not change them without verifying each use and ensuring that it is
-          not a breaking change.
-*/
+/**
+ * Specifies the mode under which the server believes it's operating.
+ *
+ * This has implications about how the server processes transactions and
+ * how it responds to requests (e.g. account balance request).
+ *
+ * @note Other code relies on the numerical values of these constants; do
+ *       not change them without verifying each use and ensuring that it is
+ *       not a breaking change.
+ */
 enum class OperatingMode {
-    DISCONNECTED = 0,  //!< not ready to process requests
-    CONNECTED = 1,     //!< convinced we are talking to the network
-    SYNCING = 2,       //!< fallen slightly behind
-    TRACKING = 3,      //!< convinced we agree with the network
-    FULL = 4           //!< we have the ledger and can even validate
+    DISCONNECTED = 0,  ///< not ready to process requests
+    CONNECTED = 1,     ///< convinced we are talking to the network
+    SYNCING = 2,       ///< fallen slightly behind
+    TRACKING = 3,      ///< convinced we agree with the network
+    FULL = 4           ///< we have the ledger and can even validate
 };
 
-/** Provides server functionality for clients.
-
-    Clients include backend applications, local commands, and connected
-    clients. This class acts as a proxy, fulfilling the command with local
-    data if possible, or asking the network and returning the results if
-    needed.
-
-    A backend application or local client can trust a local instance of
-    xrpld / NetworkOPs. However, client software connecting to non-local
-    instances of xrpld will need to be hardened to protect against hostile
-    or unreliable servers.
-*/
+/**
+ * Provides server functionality for clients.
+ *
+ * Clients include backend applications, local commands, and connected
+ * clients. This class acts as a proxy, fulfilling the command with local
+ * data if possible, or asking the network and returning the results if
+ * needed.
+ *
+ * A backend application or local client can trust a local instance of
+ * xrpld / NetworkOPs. However, client software connecting to non-local
+ * instances of xrpld will need to be hardened to protect against hostile
+ * or unreliable servers.
+ */
 class NetworkOPs : public InfoSub::Source
 {
 public:
@@ -225,12 +227,13 @@ public:
     virtual json::Value
     getLedgerFetchInfo() = 0;
 
-    /** Accepts the current transaction tree, return the new ledger's sequence
-
-        This API is only used via RPC with the server in STANDALONE mode and
-        performs a virtual consensus round, with all the transactions we are
-        proposing being accepted.
-    */
+    /**
+     * Accepts the current transaction tree, return the new ledger's sequence
+     *
+     * This API is only used via RPC with the server in STANDALONE mode and
+     * performs a virtual consensus round, with all the transactions we are
+     * proposing being accepted.
+     */
     virtual std::uint32_t
     acceptLedger(std::optional<std::chrono::milliseconds> consensusDelay = std::nullopt) = 0;
 
@@ -259,15 +262,16 @@ public:
     virtual void
     stateAccounting(json::Value& obj) = 0;
 
-    /** Total number of (book, subscriber) entries currently tracked.
+    /**
+     * Total number of (book, subscriber) entries currently tracked.
      *
-     *  Counts every weak_ptr stored across every book in subBook_, NOT the
-     *  number of distinct subscribers and NOT the number of distinct
-     *  books: a single subscriber following N books contributes N entries.
+     * Counts every weak_ptr stored across every book in subBook_, NOT the
+     * number of distinct subscribers and NOT the number of distinct
+     * books: a single subscriber following N books contributes N entries.
      *
-     *  @note Diagnostic accessor; intended for tests and operator visibility
-     *        into per-book subscription state. The returned value is a
-     *        snapshot under the subscription lock.
+     * @note Diagnostic accessor; intended for tests and operator visibility
+     *       into per-book subscription state. The returned value is a
+     *       snapshot under the subscription lock.
      */
     virtual std::size_t
     getBookSubscribersCount() = 0;
diff --git a/include/xrpl/server/Port.h b/include/xrpl/server/Port.h
index c48a2546c1..b8bca6f95f 100644
--- a/include/xrpl/server/Port.h
+++ b/include/xrpl/server/Port.h
@@ -22,7 +22,9 @@ namespace xrpl {
 
 class Section;
 
-/** Configuration information for a Server listening port. */
+/**
+ * Configuration information for a Server listening port.
+ */
 struct Port
 {
     explicit Port() = default;
diff --git a/include/xrpl/server/Server.h b/include/xrpl/server/Server.h
index 956a414be8..f8d6005d0c 100644
--- a/include/xrpl/server/Server.h
+++ b/include/xrpl/server/Server.h
@@ -9,7 +9,9 @@
 
 namespace xrpl {
 
-/** Create the HTTP server using the specified handler. */
+/**
+ * Create the HTTP server using the specified handler.
+ */
 template <class Handler>
 std::unique_ptr<Server>
 makeServer(Handler& handler, boost::asio::io_context& ioContext, beast::Journal journal)
diff --git a/include/xrpl/server/Session.h b/include/xrpl/server/Session.h
index 266570862a..be8d9a497c 100644
--- a/include/xrpl/server/Session.h
+++ b/include/xrpl/server/Session.h
@@ -15,11 +15,12 @@
 
 namespace xrpl {
 
-/** Persistent state information for a connection session.
-    These values are preserved between calls for efficiency.
-    Some fields are input parameters, some are output parameters,
-    and all only become defined during specific callbacks.
-*/
+/**
+ * Persistent state information for a connection session.
+ * These values are preserved between calls for efficiency.
+ * Some fields are input parameters, some are output parameters,
+ * and all only become defined during specific callbacks.
+ */
 class Session
 {
 public:
@@ -29,29 +30,40 @@ public:
     operator=(Session const&) = delete;
     virtual ~Session() = default;
 
-    /** A user-definable pointer.
-        The initial value is always zero.
-        Changes to the value are persisted between calls.
-    */
+    /**
+     * A user-definable pointer.
+     * The initial value is always zero.
+     * Changes to the value are persisted between calls.
+     */
     void* tag = nullptr;
 
-    /** Returns the Journal to use for logging. */
+    /**
+     * Returns the Journal to use for logging.
+     */
     virtual beast::Journal
     journal() = 0;
 
-    /** Returns the Port settings for this connection. */
+    /**
+     * Returns the Port settings for this connection.
+     */
     virtual Port const&
     port() = 0;
 
-    /** Returns the remote address of the connection. */
+    /**
+     * Returns the remote address of the connection.
+     */
     virtual beast::IP::Endpoint
     remoteAddress() = 0;
 
-    /** Returns the current HTTP request. */
+    /**
+     * Returns the current HTTP request.
+     */
     virtual http_request_type&
     request() = 0;
 
-    /** Send a copy of data asynchronously. */
+    /**
+     * Send a copy of data asynchronously.
+     */
     /** @{ */
     void
     write(std::string_view s)
@@ -80,32 +92,37 @@ public:
 
     /** @} */
 
-    /** Detach the session.
-        This holds the session open so that the response can be sent
-        asynchronously. Calls to io_context::run made by the server
-        will not return until all detached sessions are closed.
-    */
+    /**
+     * Detach the session.
+     * This holds the session open so that the response can be sent
+     * asynchronously. Calls to io_context::run made by the server
+     * will not return until all detached sessions are closed.
+     */
     virtual std::shared_ptr<Session>
     detach() = 0;
 
-    /** Indicate that the response is complete.
-        The handler should call this when it has completed writing
-        the response. If Keep-Alive is indicated on the connection,
-        this will trigger a read for the next request; else, the
-        connection will be closed when all remaining data has been sent.
-    */
+    /**
+     * Indicate that the response is complete.
+     * The handler should call this when it has completed writing
+     * the response. If Keep-Alive is indicated on the connection,
+     * this will trigger a read for the next request; else, the
+     * connection will be closed when all remaining data has been sent.
+     */
     virtual void
     complete() = 0;
 
-    /** Close the session.
-        This will be performed asynchronously. The session will be
-        closed gracefully after all pending writes have completed.
-        @param graceful `true` to wait until all data has finished sending.
-    */
+    /**
+     * Close the session.
+     * This will be performed asynchronously. The session will be
+     * closed gracefully after all pending writes have completed.
+     * @param graceful `true` to wait until all data has finished sending.
+     */
     virtual void
     close(bool graceful) = 0;
 
-    /** Convert the connection to WebSocket. */
+    /**
+     * Convert the connection to WebSocket.
+     */
     virtual std::shared_ptr<WSSession>
     websocketUpgrade() = 0;
 };
diff --git a/include/xrpl/server/SimpleWriter.h b/include/xrpl/server/SimpleWriter.h
index 996403eafb..597e6e6d8f 100644
--- a/include/xrpl/server/SimpleWriter.h
+++ b/include/xrpl/server/SimpleWriter.h
@@ -14,7 +14,9 @@
 
 namespace xrpl {
 
-/// Deprecated: Writer that serializes a HTTP/1 message
+/**
+ * Deprecated: Writer that serializes a HTTP/1 message
+ */
 class SimpleWriter : public Writer
 {
     boost::beast::multi_buffer sb_;
diff --git a/include/xrpl/server/WSSession.h b/include/xrpl/server/WSSession.h
index 0087f9f50f..69f7decdb3 100644
--- a/include/xrpl/server/WSSession.h
+++ b/include/xrpl/server/WSSession.h
@@ -28,23 +28,24 @@ public:
     operator=(WSMsg const&) = delete;
     virtual ~WSMsg() = default;
 
-    /** Retrieve message data.
-
-        Returns a tribool indicating whether or not
-        data is available, and a ConstBufferSequence
-        representing the data.
-
-        tribool values:
-            maybe:      Data is not ready yet
-            false:      Data is available
-            true:       Data is available, and
-                        it is the last chunk of bytes.
-
-        Derived classes that do not know when the data
-        ends (for example, when returning the output of a
-        paged database query) may return `true` and an
-        empty vector.
-    */
+    /**
+     * Retrieve message data.
+     *
+     * Returns a tribool indicating whether or not
+     * data is available, and a ConstBufferSequence
+     * representing the data.
+     *
+     * tribool values:
+     *     maybe:      Data is not ready yet
+     *     false:      Data is available
+     *     true:       Data is available, and
+     *                 it is the last chunk of bytes.
+     *
+     * Derived classes that do not know when the data
+     * ends (for example, when returning the output of a
+     * paged database query) may return `true` and an
+     * empty vector.
+     */
     virtual std::pair<boost::tribool, std::vector<boost::asio::const_buffer>>
     prepare(std::size_t bytes, std::function<void(void)> resume) = 0;
 };
@@ -106,7 +107,9 @@ struct WSSession
     [[nodiscard]] virtual boost::asio::ip::tcp::endpoint const&
     remoteEndpoint() const = 0;
 
-    /** Send a WebSockets message. */
+    /**
+     * Send a WebSockets message.
+     */
     virtual void
     send(std::shared_ptr<WSMsg> w) = 0;
 
@@ -116,10 +119,11 @@ struct WSSession
     virtual void
     close(boost::beast::websocket::close_reason const& reason) = 0;
 
-    /** Indicate that the response is complete.
-        The handler should call this when it has completed writing
-        the response.
-    */
+    /**
+     * Indicate that the response is complete.
+     * The handler should call this when it has completed writing
+     * the response.
+     */
     virtual void
     complete() = 0;
 };
diff --git a/include/xrpl/server/Wallet.h b/include/xrpl/server/Wallet.h
index eea44db200..ed8378989f 100644
--- a/include/xrpl/server/Wallet.h
+++ b/include/xrpl/server/Wallet.h
@@ -78,19 +78,22 @@ saveManifests(
 void
 addValidatorManifest(soci::session& session, std::string const& serialized);
 
-/** Delete any saved public/private key associated with this node. */
+/**
+ * Delete any saved public/private key associated with this node.
+ */
 void
 clearNodeIdentity(soci::session& session);
 
-/** Returns a stable public and private key for this node.
-
-    The node's public identity is defined by a secp256k1 keypair
-    that is (normally) randomly generated. This function will
-    return such a keypair, securely generating one if needed.
-
-    @param session Session with the database.
-
-    @return Pair of public and private secp256k1 keys.
+/**
+ * Returns a stable public and private key for this node.
+ *
+ * The node's public identity is defined by a secp256k1 keypair
+ * that is (normally) randomly generated. This function will
+ * return such a keypair, securely generating one if needed.
+ *
+ * @param session Session with the database.
+ *
+ * @return Pair of public and private secp256k1 keys.
  */
 std::pair<PublicKey, SecretKey>
 getNodeIdentity(soci::session& session);
diff --git a/include/xrpl/server/Writer.h b/include/xrpl/server/Writer.h
index fe9d9519e1..a80563af43 100644
--- a/include/xrpl/server/Writer.h
+++ b/include/xrpl/server/Writer.h
@@ -13,26 +13,32 @@ class Writer
 public:
     virtual ~Writer() = default;
 
-    /** Returns `true` if there is no more data to pull. */
+    /**
+     * Returns `true` if there is no more data to pull.
+     */
     virtual bool
     complete() = 0;
 
-    /** Removes bytes from the input sequence.
-
-        Can be called with 0.
-    */
+    /**
+     * Removes bytes from the input sequence.
+     *
+     * Can be called with 0.
+     */
     virtual void
     consume(std::size_t bytes) = 0;
 
-    /** Add data to the input sequence.
-        @param bytes A hint to the number of bytes desired.
-        @param resume A functor to later resume execution.
-        @return `true` if the writer is ready to provide more data.
-    */
+    /**
+     * Add data to the input sequence.
+     * @param bytes A hint to the number of bytes desired.
+     * @param resume A functor to later resume execution.
+     * @return `true` if the writer is ready to provide more data.
+     */
     virtual bool
     prepare(std::size_t bytes, std::function<void(void)> resume) = 0;
 
-    /** Returns a ConstBufferSequence representing the input sequence. */
+    /**
+     * Returns a ConstBufferSequence representing the input sequence.
+     */
     virtual std::vector<boost::asio::const_buffer>
     data() = 0;
 };
diff --git a/include/xrpl/server/detail/BaseHTTPPeer.h b/include/xrpl/server/detail/BaseHTTPPeer.h
index 7b35dbd4be..c7553c1da3 100644
--- a/include/xrpl/server/detail/BaseHTTPPeer.h
+++ b/include/xrpl/server/detail/BaseHTTPPeer.h
@@ -35,7 +35,9 @@
 
 namespace xrpl {
 
-/** Represents an active connection. */
+/**
+ * Represents an active connection.
+ */
 template <class Handler, class Impl>
 class BaseHTTPPeer : public IOList::Work, public Session
 {
diff --git a/include/xrpl/server/detail/BaseWSPeer.h b/include/xrpl/server/detail/BaseWSPeer.h
index d557140bd4..59a866ab8c 100644
--- a/include/xrpl/server/detail/BaseWSPeer.h
+++ b/include/xrpl/server/detail/BaseWSPeer.h
@@ -30,7 +30,9 @@
 
 namespace xrpl {
 
-/** Represents an active WebSocket connection. */
+/**
+ * Represents an active WebSocket connection.
+ */
 template <class Handler, class Impl>
 class BaseWSPeer : public BasePeer<Handler, Impl>, public WSSession
 {
@@ -48,9 +50,11 @@ private:
     boost::beast::multi_buffer rb_;
     boost::beast::multi_buffer wb_;
     std::list<std::shared_ptr<WSMsg>> wq_;
-    /// The socket has been closed, or will close after the next write
-    /// finishes. Do not do any more writes, and don't try to close
-    /// again.
+    /**
+     * The socket has been closed, or will close after the next write
+     * finishes. Do not do any more writes, and don't try to close
+     * again.
+     */
     bool doClose_ = false;
     boost::beast::websocket::close_reason cr_;
     waitable_timer timer_;
diff --git a/include/xrpl/server/detail/Door.h b/include/xrpl/server/detail/Door.h
index d2d7a7baf4..285bde14ac 100644
--- a/include/xrpl/server/detail/Door.h
+++ b/include/xrpl/server/detail/Door.h
@@ -40,7 +40,9 @@
 
 namespace xrpl {
 
-/** A listening socket. */
+/**
+ * A listening socket.
+ */
 template <class Handler>
 class Door : public IOList::Work, public std::enable_shared_from_this<Door<Handler>>
 {
@@ -129,12 +131,13 @@ public:
     void
     run();
 
-    /** Close the Door listening socket and connections.
-        The listening socket is closed, and all open connections
-        belonging to the Door are closed.
-        Thread Safety:
-            May be called concurrently
-    */
+    /**
+     * Close the Door listening socket and connections.
+     * The listening socket is closed, and all open connections
+     * belonging to the Door are closed.
+     * Thread Safety:
+     *     May be called concurrently
+     */
     void
     close() override;
 
diff --git a/include/xrpl/server/detail/ServerImpl.h b/include/xrpl/server/detail/ServerImpl.h
index df2bba0284..c2e411cf9b 100644
--- a/include/xrpl/server/detail/ServerImpl.h
+++ b/include/xrpl/server/detail/ServerImpl.h
@@ -26,39 +26,45 @@ namespace xrpl {
 
 using Endpoints = std::unordered_map<std::string, boost::asio::ip::tcp::endpoint>;
 
-/** A multi-protocol server.
-
-    This server maintains multiple configured listening ports,
-    with each listening port allows for multiple protocols including
-    HTTP, HTTP/S, WebSocket, Secure WebSocket, and the Peer protocol.
-*/
+/**
+ * A multi-protocol server.
+ *
+ * This server maintains multiple configured listening ports,
+ * with each listening port allows for multiple protocols including
+ * HTTP, HTTP/S, WebSocket, Secure WebSocket, and the Peer protocol.
+ */
 class Server
 {
 public:
-    /** Destroy the server.
-        The server is closed if it is not already closed. This call
-        blocks until the server has stopped.
-    */
+    /**
+     * Destroy the server.
+     * The server is closed if it is not already closed. This call
+     * blocks until the server has stopped.
+     */
     virtual ~Server() = default;
 
-    /** Returns the Journal associated with the server. */
+    /**
+     * Returns the Journal associated with the server.
+     */
     virtual beast::Journal
     journal() = 0;
 
-    /** Set the listening port settings.
-        This may only be called once.
-    */
+    /**
+     * Set the listening port settings.
+     * This may only be called once.
+     */
     virtual Endpoints
     ports(std::vector<Port> const& v) = 0;
 
-    /** Close the server.
-        The close is performed asynchronously. The handler will be notified
-        when the server has stopped. The server is considered stopped when
-        there are no pending I/O completion handlers and all connections
-        have closed.
-        Thread safety:
-            Safe to call concurrently from any thread.
-    */
+    /**
+     * Close the server.
+     * The close is performed asynchronously. The handler will be notified
+     * when the server has stopped. The server is considered stopped when
+     * there are no pending I/O completion handlers and all connections
+     * have closed.
+     * Thread safety:
+     *     Safe to call concurrently from any thread.
+     */
     virtual void
     close() = 0;
 };
diff --git a/include/xrpl/server/detail/io_list.h b/include/xrpl/server/detail/io_list.h
index 0153bd3457..7ffa85b898 100644
--- a/include/xrpl/server/detail/io_list.h
+++ b/include/xrpl/server/detail/io_list.h
@@ -12,7 +12,9 @@
 
 namespace xrpl {
 
-/** Manages a set of objects performing asynchronous I/O. */
+/**
+ * Manages a set of objects performing asynchronous I/O.
+ */
 class IOList final
 {
 public:
@@ -31,12 +33,13 @@ public:
             destroy();
         }
 
-        /** Return the IOList associated with the work.
-
-            Requirements:
-                The call to IOList::emplace to
-                create the work has already returned.
-        */
+        /**
+         * Return the IOList associated with the work.
+         *
+         * Requirements:
+         *     The call to IOList::emplace to
+         *     create the work has already returned.
+         */
         IOList&
         ios()
         {
@@ -62,71 +65,74 @@ private:
 public:
     IOList() = default;
 
-    /** Destroy the list.
-
-        Effects:
-            Closes the IOList if it was not previously
-                closed. No finisher is invoked in this case.
-
-            Blocks until all work is destroyed.
-    */
+    /**
+     * Destroy the list.
+     *
+     * Effects:
+     *     Closes the IOList if it was not previously
+     *         closed. No finisher is invoked in this case.
+     *
+     *     Blocks until all work is destroyed.
+     */
     ~IOList()
     {
         destroy();
     }
 
-    /** Return `true` if the list is closed.
-
-        Thread Safety:
-            Undefined result if called concurrently
-            with close().
-    */
+    /**
+     * Return `true` if the list is closed.
+     *
+     * Thread Safety:
+     *     Undefined result if called concurrently
+     *     with close().
+     */
     [[nodiscard]] bool
     closed() const
     {
         return closed_;
     }
 
-    /** Create associated work if not closed.
-
-        Requirements:
-            `std::is_base_of_v<Work, T> == true`
-
-        Thread Safety:
-            May be called concurrently.
-
-        Effects:
-            Atomically creates, inserts, and returns new
-            work T, or returns nullptr if the io_list is
-            closed,
-
-        If the call succeeds and returns a new object,
-        it is guaranteed that a subsequent call to close
-        will invoke Work::close on the object.
-
-    */
+    /**
+     * Create associated work if not closed.
+     *
+     * Requirements:
+     *     `std::is_base_of_v<Work, T> == true`
+     *
+     * Thread Safety:
+     *     May be called concurrently.
+     *
+     * Effects:
+     *     Atomically creates, inserts, and returns new
+     *     work T, or returns nullptr if the io_list is
+     *     closed,
+     *
+     * If the call succeeds and returns a new object,
+     * it is guaranteed that a subsequent call to close
+     * will invoke Work::close on the object.
+     */
     template <class T, class... Args>
     std::shared_ptr<T>
     emplace(Args&&... args);
 
-    /** Cancel active I/O.
-
-        Thread Safety:
-            May not be called concurrently.
-
-        Effects:
-            Associated work is closed.
-
-            Finisher if provided, will be called when
-            all associated work is destroyed. The finisher
-            may be called from a foreign thread, or within
-            the call to this function.
-
-            Only the first call to close will set the
-            finisher.
-
-            No effect after the first call.
-    */
+    /**
+     * Cancel active I/O.
+     *
+     * Thread Safety:
+     *     May not be called concurrently.
+     *
+     * Effects:
+     *     Associated work is closed.
+     *
+     *     Finisher if provided, will be called when
+     *     all associated work is destroyed. The finisher
+     *     may be called from a foreign thread, or within
+     *     the call to this function.
+     *
+     *     Only the first call to close will set the
+     *     finisher.
+     *
+     *     No effect after the first call.
+     */
     template <class Finisher>
     void
     close(Finisher&& f);
@@ -137,20 +143,21 @@ public:
         close([] {});
     }
 
-    /** Block until the io_list stops.
-
-        Effects:
-            The caller is blocked until the io_list is
-            closed and all associated work is destroyed.
-
-        Thread safety:
-            May be called concurrently.
-
-        Preconditions:
-            No call to io_context::run on any io_context
-            used by work objects associated with this io_list
-            exists in the caller's call stack.
-    */
+    /**
+     * Block until the io_list stops.
+     *
+     * Effects:
+     *     The caller is blocked until the io_list is
+     *     closed and all associated work is destroyed.
+     *
+     * Thread safety:
+     *     May be called concurrently.
+     *
+     * Preconditions:
+     *     No call to io_context::run on any io_context
+     *     used by work objects associated with this io_list
+     *     exists in the caller's call stack.
+     */
     template <class = void>
     void
     join();
diff --git a/include/xrpl/shamap/Family.h b/include/xrpl/shamap/Family.h
index c5bf953bfd..7624b3e600 100644
--- a/include/xrpl/shamap/Family.h
+++ b/include/xrpl/shamap/Family.h
@@ -35,18 +35,23 @@ public:
     virtual beast::Journal const&
     journal() = 0;
 
-    /** Return a pointer to the Family Full Below Cache */
+    /**
+     * Return a pointer to the Family Full Below Cache
+     */
     virtual std::shared_ptr<FullBelowCache>
     getFullBelowCache() = 0;
 
-    /** Return a pointer to the Family Tree Node Cache */
+    /**
+     * Return a pointer to the Family Tree Node Cache
+     */
     virtual std::shared_ptr<TreeNodeCache>
     getTreeNodeCache() = 0;
 
     virtual void
     sweep() = 0;
 
-    /** Acquire ledger that has a missing node by ledger sequence
+    /**
+     * Acquire ledger that has a missing node by ledger sequence
      *
      * @param refNum Sequence of ledger to acquire.
      * @param nodeHash Hash of missing node to report in throw.
@@ -54,7 +59,8 @@ public:
     virtual void
     missingNodeAcquireBySeq(std::uint32_t refNum, uint256 const& nodeHash) = 0;
 
-    /** Acquire ledger that has a missing node by ledger hash
+    /**
+     * Acquire ledger that has a missing node by ledger hash
      *
      * @param refHash Hash of ledger to acquire.
      * @param refNum Ledger sequence with missing node.
diff --git a/include/xrpl/shamap/FullBelowCache.h b/include/xrpl/shamap/FullBelowCache.h
index b6d1142eb4..1bb67c7453 100644
--- a/include/xrpl/shamap/FullBelowCache.h
+++ b/include/xrpl/shamap/FullBelowCache.h
@@ -17,9 +17,10 @@ namespace xrpl {
 
 namespace detail {
 
-/** Remembers which tree keys have all descendants resident.
-    This optimizes the process of acquiring a complete tree.
-*/
+/**
+ * Remembers which tree keys have all descendants resident.
+ * This optimizes the process of acquiring a complete tree.
+ */
 class BasicFullBelowCache
 {
 private:
@@ -31,13 +32,14 @@ public:
     using key_type = uint256;
     using clock_type = CacheType::clock_type;
 
-    /** Construct the cache.
-
-        @param name A label for diagnostics and stats reporting.
-        @param collector The collector to use for reporting stats.
-        @param targetSize The cache target size.
-        @param targetExpirationSeconds The expiration time for items.
-    */
+    /**
+     * Construct the cache.
+     *
+     * @param name A label for diagnostics and stats reporting.
+     * @param collector The collector to use for reporting stats.
+     * @param targetSize The cache target size.
+     * @param targetExpirationSeconds The expiration time for items.
+     */
     BasicFullBelowCache(
         std::string const& name,
         clock_type& clock,
@@ -49,59 +51,67 @@ public:
     {
     }
 
-    /** Return the clock associated with the cache. */
+    /**
+     * Return the clock associated with the cache.
+     */
     clock_type&
     clock()
     {
         return cache_.clock();
     }
 
-    /** Return the number of elements in the cache.
-        Thread safety:
-            Safe to call from any thread.
-    */
+    /**
+     * Return the number of elements in the cache.
+     * Thread safety:
+     *     Safe to call from any thread.
+     */
     std::size_t
     size() const
     {
         return cache_.size();
     }
 
-    /** Remove expired cache items.
-        Thread safety:
-            Safe to call from any thread.
-    */
+    /**
+     * Remove expired cache items.
+     * Thread safety:
+     *     Safe to call from any thread.
+     */
     void
     sweep()
     {
         cache_.sweep();
     }
 
-    /** Refresh the last access time of an item, if it exists.
-        Thread safety:
-            Safe to call from any thread.
-        @param key The key to refresh.
-        @return `true` If the key exists.
-    */
+    /**
+     * Refresh the last access time of an item, if it exists.
+     * Thread safety:
+     *     Safe to call from any thread.
+     * @param key The key to refresh.
+     * @return `true` If the key exists.
+     */
     bool
     touchIfExists(key_type const& key)
     {
         return cache_.touchIfExists(key);
     }
 
-    /** Insert a key into the cache.
-        If the key already exists, the last access time will still
-        be refreshed.
-        Thread safety:
-            Safe to call from any thread.
-        @param key The key to insert.
-    */
+    /**
+     * Insert a key into the cache.
+     * If the key already exists, the last access time will still
+     * be refreshed.
+     * Thread safety:
+     *     Safe to call from any thread.
+     * @param key The key to insert.
+     */
     void
     insert(key_type const& key)
     {
         cache_.insert(key);
     }
 
-    /** generation determines whether cached entry is valid */
+    /**
+     * generation determines whether cached entry is valid
+     */
     std::uint32_t
     getGeneration() const
     {
diff --git a/include/xrpl/shamap/SHAMap.h b/include/xrpl/shamap/SHAMap.h
index d49e323b3f..a1194ccfd3 100644
--- a/include/xrpl/shamap/SHAMap.h
+++ b/include/xrpl/shamap/SHAMap.h
@@ -38,55 +38,62 @@ namespace xrpl {
 class SHAMapNodeID;
 class SHAMapSyncFilter;
 
-/** Describes the current state of a given SHAMap */
+/**
+ * Describes the current state of a given SHAMap
+ */
 enum class SHAMapState {
-    /** The map is in flux and objects can be added and removed.
-
-        Example: map underlying the open ledger.
+    /**
+     * The map is in flux and objects can be added and removed.
+     *
+     * Example: map underlying the open ledger.
      */
     Modifying = 0,
 
-    /** The map is set in stone and cannot be changed.
-
-        Example: a map underlying a given closed ledger.
+    /**
+     * The map is set in stone and cannot be changed.
+     *
+     * Example: a map underlying a given closed ledger.
      */
     Immutable = 1,
 
-    /** The map's hash is fixed but valid nodes may be missing and can be added.
-
-        Example: a map that's syncing a given peer's closing ledger.
+    /**
+     * The map's hash is fixed but valid nodes may be missing and can be added.
+     *
+     * Example: a map that's syncing a given peer's closing ledger.
      */
     Synching = 2,
 
-    /** The map is known to not be valid.
-
-        Example: usually synching a corrupt ledger.
+    /**
+     * The map is known to not be valid.
+     *
+     * Example: usually synching a corrupt ledger.
      */
     Invalid = 3,
 };
 
-/** A SHAMap is both a radix tree with a fan-out of 16 and a Merkle tree.
-
-    A radix tree is a tree with two properties:
-
-      1. The key for a node is represented by the node's position in the tree
-         (the "prefix property").
-      2. A node with only one child is merged with that child
-         (the "merge property")
-
-    These properties result in a significantly smaller memory footprint for
-    a radix tree.
-
-    A fan-out of 16 means that each node in the tree has at most 16
-    children. See https://en.wikipedia.org/wiki/Radix_tree
-
-    A Merkle tree is a tree where each non-leaf node is labelled with the hash
-    of the combined labels of its children nodes.
-
-    A key property of a Merkle tree is that testing for node inclusion is
-    O(log(N)) where N is the number of nodes in the tree.
-
-    See https://en.wikipedia.org/wiki/Merkle_tree
+/**
+ * A SHAMap is both a radix tree with a fan-out of 16 and a Merkle tree.
+ *
+ * A radix tree is a tree with two properties:
+ *
+ *   1. The key for a node is represented by the node's position in the tree
+ *      (the "prefix property").
+ *   2. A node with only one child is merged with that child
+ *      (the "merge property")
+ *
+ * These properties result in a significantly smaller memory footprint for
+ * a radix tree.
+ *
+ * A fan-out of 16 means that each node in the tree has at most 16
+ * children. See https://en.wikipedia.org/wiki/Radix_tree
+ *
+ * A Merkle tree is a tree where each non-leaf node is labelled with the hash
+ * of the combined labels of its children nodes.
+ *
+ * A key property of a Merkle tree is that testing for node inclusion is
+ * O(log(N)) where N is the number of nodes in the tree.
+ *
+ * See https://en.wikipedia.org/wiki/Merkle_tree
  */
 class SHAMap
 {
@@ -94,10 +101,14 @@ private:
     Family& f_;
     beast::Journal journal_;
 
-    /** ID to distinguish this map for all others we're sharing nodes with. */
+    /**
+     * ID to distinguish this map for all others we're sharing nodes with.
+     */
     std::uint32_t cowid_ = 1;
 
-    /** The sequence of the ledger that this map references, if any. */
+    /**
+     * The sequence of the ledger that this map references, if any.
+     */
     std::uint32_t ledgerSeq_ = 0;
 
     SHAMapTreeNodePtr root_;
@@ -107,11 +118,15 @@ private:
     mutable bool full_ = false;  // Map is believed complete in database
 
 public:
-    /** Number of children each non-leaf node has (the 'radix tree' part of the
-     * map) */
+    /**
+     * Number of children each non-leaf node has (the 'radix tree' part of the
+     * map)
+     */
     static constexpr unsigned int kBranchFactor = SHAMapInnerNode::kBranchFactor;
 
-    /** The depth of the hash map: data is only present in the leaves */
+    /**
+     * The depth of the hash map: data is only present in the leaves
+     */
     static constexpr unsigned int kLeafDepth = 64;
 
     using DeltaItem =
@@ -147,10 +162,11 @@ public:
 
     //--------------------------------------------------------------------------
 
-    /** Iterator to a SHAMap's leaves
-        This is always a const iterator.
-        Meets the requirements of ForwardRange.
-    */
+    /**
+     * Iterator to a SHAMap's leaves
+     * This is always a const iterator.
+     * Meets the requirements of ForwardRange.
+     */
     class ConstIterator;
 
     ConstIterator
@@ -180,7 +196,9 @@ public:
 
     // normal hash access functions
 
-    /** Does the tree have an item with the given ID? */
+    /**
+     * Does the tree have an item with the given ID?
+     */
     bool
     hasItem(uint256 const& id) const;
 
@@ -208,60 +226,66 @@ public:
     peekItem(uint256 const& id, SHAMapHash& hash) const;
 
     // traverse functions
-    /** Find the first item after the given item.
-
-        @param id the identifier of the item.
-
-        @note The item does not need to exist.
+    /**
+     * Find the first item after the given item.
+     *
+     * @param id the identifier of the item.
+     *
+     * @note The item does not need to exist.
      */
     ConstIterator
     upperBound(uint256 const& id) const;
 
-    /** Find the object with the greatest object id smaller than the input id.
-
-        @param id the identifier of the item.
-
-        @note The item does not need to exist.
+    /**
+     * Find the object with the greatest object id smaller than the input id.
+     *
+     * @param id the identifier of the item.
+     *
+     * @note The item does not need to exist.
      */
     ConstIterator
     lowerBound(uint256 const& id) const;
 
-    /**  Visit every node in this SHAMap
-
-         @param function called with every node visited.
-         If function returns false, visitNodes exits.
-    */
+    /**
+     * Visit every node in this SHAMap
+     *
+     * @param function called with every node visited.
+     * If function returns false, visitNodes exits.
+     */
     void
     visitNodes(std::function<bool(SHAMapTreeNode&)> const& function) const;
 
-    /**  Visit every node in this SHAMap that
-         is not present in the specified SHAMap
-
-         @param function called with every node visited.
-         If function returns false, visitDifferences exits.
-    */
+    /**
+     * Visit every node in this SHAMap that
+     * is not present in the specified SHAMap
+     *
+     * @param function called with every node visited.
+     * If function returns false, visitDifferences exits.
+     */
     void
     visitDifferences(SHAMap const* have, std::function<bool(SHAMapTreeNode const&)> const&) const;
 
-    /**  Visit every leaf node in this SHAMap
-
-         @param function called with every non inner node visited.
-    */
+    /**
+     * Visit every leaf node in this SHAMap
+     *
+     * @param function called with every non inner node visited.
+     */
     void
     visitLeaves(std::function<void(boost::intrusive_ptr<SHAMapItem const> const&)> const&) const;
 
     // comparison/sync functions
 
-    /** Check for nodes in the SHAMap not available
-
-        Traverse the SHAMap efficiently, maximizing I/O
-        concurrency, to discover nodes referenced in the
-        SHAMap but not available locally.
-
-        @param maxNodes The maximum number of found nodes to return
-        @param filter The filter to use when retrieving nodes
-        @param return The nodes known to be missing
-    */
+    /**
+     * Check for nodes in the SHAMap not available
+     *
+     * Traverse the SHAMap efficiently, maximizing I/O
+     * concurrency, to discover nodes referenced in the
+     * SHAMap but not available locally.
+     *
+     * @param maxNodes The maximum number of found nodes to return
+     * @param filter The filter to use when retrieving nodes
+     * @param return The nodes known to be missing
+     */
     std::vector<std::pair<SHAMapNodeID, uint256>>
     getMissingNodes(int maxNodes, SHAMapSyncFilter const* filter);
 
@@ -291,7 +315,9 @@ public:
     static bool
     verifyProofPath(uint256 const& rootHash, uint256 const& key, std::vector<Blob> const& path);
 
-    /** Serializes the root in a format appropriate for sending over the wire */
+    /**
+     * Serializes the root in a format appropriate for sending over the wire
+     */
     void
     serializeRoot(Serializer& s) const;
 
@@ -317,11 +343,15 @@ public:
     bool
     compare(SHAMap const& otherMap, Delta& differences, int maxCount) const;
 
-    /** Convert any modified nodes to shared. */
+    /**
+     * Convert any modified nodes to shared.
+     */
     int
     unshare();
 
-    /** Flush modified nodes to the nodestore and convert them to shared. */
+    /**
+     * Flush modified nodes to the nodestore and convert them to shared.
+     */
     int
     flushDirty(NodeObjectType t);
 
@@ -364,30 +394,42 @@ private:
     SHAMapTreeNodePtr
     checkFilter(SHAMapHash const& hash, SHAMapSyncFilter const* filter) const;
 
-    /** Update hashes up to the root */
+    /**
+     * Update hashes up to the root
+     */
     void
     dirtyUp(SharedPtrNodeStack& stack, uint256 const& target, SHAMapTreeNodePtr terminal);
 
-    /** Walk towards the specified id, returning the node.  Caller must check
-        if the return is nullptr, and if not, if the node->peekItem()->key() ==
-       id */
+    /**
+     * Walk towards the specified id, returning the node.  Caller must check
+     *  if the return is nullptr, and if not, if the node->peekItem()->key() ==
+     * id
+     */
     SHAMapLeafNode*
     walkTowardsKey(uint256 const& id, SharedPtrNodeStack* stack = nullptr) const;
-    /** Return nullptr if key not found */
+    /**
+     * Return nullptr if key not found
+     */
     SHAMapLeafNode*
     findKey(uint256 const& id) const;
 
-    /** Unshare the node, allowing it to be modified */
+    /**
+     * Unshare the node, allowing it to be modified
+     */
     template <class Node>
     intr_ptr::SharedPtr<Node>
     unshareNode(intr_ptr::SharedPtr<Node>, SHAMapNodeID const& nodeID);
 
-    /** prepare a node to be modified before flushing */
+    /**
+     * prepare a node to be modified before flushing
+     */
     template <class Node>
     intr_ptr::SharedPtr<Node>
     preFlushNode(intr_ptr::SharedPtr<Node> node) const;
 
-    /** write and canonicalize modified node */
+    /**
+     * write and canonicalize modified node
+     */
     SHAMapTreeNodePtr
     writeNode(NodeObjectType t, SHAMapTreeNodePtr node) const;
 
@@ -442,7 +484,9 @@ private:
     SHAMapTreeNodePtr
     descendNoStore(SHAMapInnerNode&, int branch) const;
 
-    /** If there is only one leaf below this node, get its contents */
+    /**
+     * If there is only one leaf below this node, get its contents
+     */
     boost::intrusive_ptr<SHAMapItem const> const&
     onlyBelow(SHAMapTreeNode*) const;
 
diff --git a/include/xrpl/shamap/SHAMapAccountStateLeafNode.h b/include/xrpl/shamap/SHAMapAccountStateLeafNode.h
index ee81107f61..96c853eb28 100644
--- a/include/xrpl/shamap/SHAMapAccountStateLeafNode.h
+++ b/include/xrpl/shamap/SHAMapAccountStateLeafNode.h
@@ -15,7 +15,9 @@
 
 namespace xrpl {
 
-/** A leaf node for a state object. */
+/**
+ * A leaf node for a state object.
+ */
 class SHAMapAccountStateLeafNode final : public SHAMapLeafNode,
                                          public CountedObject<SHAMapAccountStateLeafNode>
 {
diff --git a/include/xrpl/shamap/SHAMapInnerNode.h b/include/xrpl/shamap/SHAMapInnerNode.h
index 0fb4e24077..44d3bd6279 100644
--- a/include/xrpl/shamap/SHAMapInnerNode.h
+++ b/include/xrpl/shamap/SHAMapInnerNode.h
@@ -18,63 +18,72 @@ namespace xrpl {
 class SHAMapInnerNode final : public SHAMapTreeNode, public CountedObject<SHAMapInnerNode>
 {
 public:
-    /** Each inner node has 16 children (the 'radix tree' part of the map) */
+    /**
+     * Each inner node has 16 children (the 'radix tree' part of the map)
+     */
     static constexpr unsigned int kBranchFactor = 16;
 
 private:
-    /** Opaque type that contains the `hashes` array (array of type
-       `SHAMapHash`) and the `children` array (array of type
-       `intr_ptr::SharedPtr<SHAMapInnerNode>`).
+    /**
+     * Opaque type that contains the `hashes` array (array of type
+     * `SHAMapHash`) and the `children` array (array of type
+     * `intr_ptr::SharedPtr<SHAMapInnerNode>`).
      */
     TaggedPointer hashesAndChildren_;
 
     std::uint32_t fullBelowGen_ = 0;
     std::uint16_t isBranch_ = 0;
 
-    /** A bitlock for the children of this node, with one bit per child */
+    /**
+     * A bitlock for the children of this node, with one bit per child
+     */
     mutable std::atomic<std::uint16_t> lock_ = 0;
 
-    /** Convert arrays stored in `hashesAndChildren_` so they can store the
-        requested number of children.
-
-        @param toAllocate allocate space for at least this number of children
-        (must be <= branchFactor)
-
-        @note the arrays may allocate more than the requested value in
-        `toAllocate`. This is due to the implementation of TagPointer, which
-        only supports allocating arrays of 4 different sizes.
+    /**
+     * Convert arrays stored in `hashesAndChildren_` so they can store the
+     * requested number of children.
+     *
+     * @param toAllocate allocate space for at least this number of children
+     * (must be <= branchFactor)
+     *
+     * @note the arrays may allocate more than the requested value in
+     * `toAllocate`. This is due to the implementation of TagPointer, which
+     * only supports allocating arrays of 4 different sizes.
      */
     void
     resizeChildArrays(std::uint8_t toAllocate);
 
-    /** Get the child's index inside the `hashes` or `children` array (stored in
-        `hashesAndChildren_`.
-
-        These arrays may or may not be sparse). The optional will be empty is an
-        empty branch is requested and the arrays are sparse.
-
-        @param i index of the requested child
+    /**
+     * Get the child's index inside the `hashes` or `children` array (stored in
+     * `hashesAndChildren_`.
+     *
+     * These arrays may or may not be sparse). The optional will be empty is an
+     * empty branch is requested and the arrays are sparse.
+     *
+     * @param i index of the requested child
      */
     std::optional<int>
     getChildIndex(int i) const;
 
-    /** Call the `f` callback for all 16 (branchFactor) branches - even if
-        the branch is empty.
-
-        @param f a one parameter callback function. The parameter is the
-        child's hash.
-    */
+    /**
+     * Call the `f` callback for all 16 (branchFactor) branches - even if
+     * the branch is empty.
+     *
+     * @param f a one parameter callback function. The parameter is the
+     * child's hash.
+     */
     template <class F>
     void
     iterChildren(F&& f) const;
 
-    /** Call the `f` callback for all non-empty branches.
-
-        @param f a two parameter callback function. The first parameter is
-        the branch number, the second parameter is the index into the array.
-        For dense formats these are the same, for sparse they may be
-        different.
-    */
+    /**
+     * Call the `f` callback for all non-empty branches.
+     *
+     * @param f a two parameter callback function. The first parameter is
+     * the branch number, the second parameter is the index into the array.
+     * For dense formats these are the same, for sparse they may be
+     * different.
+     */
     template <class F>
     void
     iterNonEmptyChildIndexes(F&& f) const;
@@ -149,7 +158,9 @@ public:
     void
     updateHash() override;
 
-    /** Recalculate the hash of all children and this node. */
+    /**
+     * Recalculate the hash of all children and this node.
+     */
     void
     updateHashDeep();
 
diff --git a/include/xrpl/shamap/SHAMapLeafNode.h b/include/xrpl/shamap/SHAMapLeafNode.h
index 112c243131..26cfde9fe8 100644
--- a/include/xrpl/shamap/SHAMapLeafNode.h
+++ b/include/xrpl/shamap/SHAMapLeafNode.h
@@ -46,11 +46,12 @@ public:
     boost::intrusive_ptr<SHAMapItem const> const&
     peekItem() const;
 
-    /** Set the item that this node points to and update the node's hash.
-
-        @param i the new item
-        @return false if the change was, effectively, a noop (that is, if the
-                hash was unchanged); true otherwise.
+    /**
+     * Set the item that this node points to and update the node's hash.
+     *
+     * @param i the new item
+     * @return false if the change was, effectively, a noop (that is, if the
+     *         hash was unchanged); true otherwise.
      */
     bool
     setItem(boost::intrusive_ptr<SHAMapItem const> i);
diff --git a/include/xrpl/shamap/SHAMapNodeID.h b/include/xrpl/shamap/SHAMapNodeID.h
index b812c10ca9..6094892091 100644
--- a/include/xrpl/shamap/SHAMapNodeID.h
+++ b/include/xrpl/shamap/SHAMapNodeID.h
@@ -12,7 +12,9 @@
 
 namespace xrpl {
 
-/** Identifies a node inside a SHAMap */
+/**
+ * Identifies a node inside a SHAMap
+ */
 class SHAMapNodeID : public CountedObject<SHAMapNodeID>
 {
 private:
@@ -64,7 +66,9 @@ public:
     createID(int depth, uint256 const& key);
 
     // FIXME-C++20: use spaceship and operator synthesis
-    /** Comparison operators */
+    /**
+     * Comparison operators
+     */
     bool
     operator<(SHAMapNodeID const& n) const
     {
@@ -117,7 +121,8 @@ operator<<(std::ostream& out, SHAMapNodeID const& node)
     return out << to_string(node);
 }
 
-/** Return an object representing a serialized SHAMap Node ID
+/**
+ * Return an object representing a serialized SHAMap Node ID
  *
  * @param s A string of bytes
  * @param data a non-null pointer to a buffer of @param size bytes.
@@ -136,7 +141,9 @@ deserializeSHAMapNodeID(std::string_view s)
 }
 /** @} */
 
-/** Returns the branch that would contain the given hash */
+/**
+ * Returns the branch that would contain the given hash
+ */
 [[nodiscard]] unsigned int
 selectBranch(SHAMapNodeID const& id, uint256 const& hash);
 
diff --git a/include/xrpl/shamap/SHAMapSyncFilter.h b/include/xrpl/shamap/SHAMapSyncFilter.h
index b6ce175915..60f340db3c 100644
--- a/include/xrpl/shamap/SHAMapSyncFilter.h
+++ b/include/xrpl/shamap/SHAMapSyncFilter.h
@@ -7,7 +7,9 @@
 #include <cstdint>
 #include <optional>
 
-/** Callback for filtering SHAMap during sync. */
+/**
+ * Callback for filtering SHAMap during sync.
+ */
 namespace xrpl {
 
 class SHAMapSyncFilter
diff --git a/include/xrpl/shamap/SHAMapTreeNode.h b/include/xrpl/shamap/SHAMapTreeNode.h
index 1eebbaa17f..c8b242238a 100644
--- a/include/xrpl/shamap/SHAMapTreeNode.h
+++ b/include/xrpl/shamap/SHAMapTreeNode.h
@@ -39,18 +39,20 @@ class SHAMapTreeNode : public IntrusiveRefCounts
 protected:
     SHAMapHash hash_;
 
-    /** Determines the owning SHAMap, if any. Used for copy-on-write semantics.
-
-        If this value is 0, the node is not dirty and does not need to be
-        flushed. It is eligible for sharing and may be included multiple
-        SHAMap instances.
+    /**
+     * Determines the owning SHAMap, if any. Used for copy-on-write semantics.
+     *
+     * If this value is 0, the node is not dirty and does not need to be
+     * flushed. It is eligible for sharing and may be included multiple
+     * SHAMap instances.
      */
     std::uint32_t cowid_;
 
-    /** Construct a node
-
-        @param cowid The identifier of a SHAMap. For more, see #cowid_
-        @param hash The hash associated with this node, if any.
+    /**
+     * Construct a node
+     *
+     * @param cowid The identifier of a SHAMap. For more, see #cowid_
+     * @param hash The hash associated with this node, if any.
      */
     /** @{ */
     explicit SHAMapTreeNode(std::uint32_t cowid) noexcept : cowid_(cowid)
@@ -74,28 +76,30 @@ public:
     virtual void
     partialDestructor() {};
 
-    /** \defgroup SHAMap Copy-on-Write Support
-
-        By nature, a node may appear in multiple SHAMap instances. Rather
-       than actually duplicating these nodes, SHAMap opts to be memory
-       efficient and uses copy-on-write semantics for nodes.
-
-        Only nodes that are not modified and don't need to be flushed back
-       can be shared. Once a node needs to be changed, it must first be
-       copied and the copy must marked as not shareable.
-
-        Note that just because a node may not be *owned* by a given SHAMap
-        instance does not mean that the node is NOT a part of any SHAMap. It
-        only means that the node is not owned exclusively by any one SHAMap.
-
-        For more on copy-on-write, check out:
-            https://en.wikipedia.org/wiki/Copy-on-write
+    /**
+     * @defgroup SHAMap Copy-on-Write Support
+     *
+     *  By nature, a node may appear in multiple SHAMap instances. Rather
+     * than actually duplicating these nodes, SHAMap opts to be memory
+     * efficient and uses copy-on-write semantics for nodes.
+     *
+     *  Only nodes that are not modified and don't need to be flushed back
+     * can be shared. Once a node needs to be changed, it must first be
+     * copied and the copy must marked as not shareable.
+     *
+     *  Note that just because a node may not be *owned* by a given SHAMap
+     *  instance does not mean that the node is NOT a part of any SHAMap. It
+     *  only means that the node is not owned exclusively by any one SHAMap.
+     *
+     *  For more on copy-on-write, check out:
+     *      https://en.wikipedia.org/wiki/Copy-on-write
      */
     /** @{ */
-    /** Returns the SHAMap that owns this node.
-
-        @return the ID of the SHAMap that owns this node, or 0 if the
-       node is not owned by any SHAMap and is a candidate for sharing.
+    /**
+     * Returns the SHAMap that owns this node.
+     *
+     * @return the ID of the SHAMap that owns this node, or 0 if the
+     * node is not owned by any SHAMap and is a candidate for sharing.
      */
     std::uint32_t
     cowid() const
@@ -103,10 +107,11 @@ public:
         return cowid_;
     }
 
-    /** If this node is shared with another map, mark it as no longer shared.
-
-        Only nodes that are not modified and do not need to be flushed back
-        should be marked as unshared.
+    /**
+     * If this node is shared with another map, mark it as no longer shared.
+     *
+     * Only nodes that are not modified and do not need to be flushed back
+     * should be marked as unshared.
      */
     void
     unshare()
@@ -114,39 +119,55 @@ public:
         cowid_ = 0;
     }
 
-    /** Make a copy of this node, setting the owner. */
+    /**
+     * Make a copy of this node, setting the owner.
+     */
     virtual SHAMapTreeNodePtr
     clone(std::uint32_t cowid) const = 0;
     /** @} */
 
-    /** Recalculate the hash of this node. */
+    /**
+     * Recalculate the hash of this node.
+     */
     virtual void
     updateHash() = 0;
 
-    /** Return the hash of this node. */
+    /**
+     * Return the hash of this node.
+     */
     SHAMapHash const&
     getHash() const
     {
         return hash_;
     }
 
-    /** Determines the type of node. */
+    /**
+     * Determines the type of node.
+     */
     virtual SHAMapNodeType
     getType() const = 0;
 
-    /** Determines if this is a leaf node. */
+    /**
+     * Determines if this is a leaf node.
+     */
     virtual bool
     isLeaf() const = 0;
 
-    /** Determines if this is an inner node. */
+    /**
+     * Determines if this is an inner node.
+     */
     virtual bool
     isInner() const = 0;
 
-    /** Serialize the node in a format appropriate for sending over the wire */
+    /**
+     * Serialize the node in a format appropriate for sending over the wire
+     */
     virtual void
     serializeForWire(Serializer&) const = 0;
 
-    /** Serialize the node in a format appropriate for hashing */
+    /**
+     * Serialize the node in a format appropriate for hashing
+     */
     virtual void
     serializeWithPrefix(Serializer&) const = 0;
 
diff --git a/include/xrpl/shamap/SHAMapTxLeafNode.h b/include/xrpl/shamap/SHAMapTxLeafNode.h
index 86186434f8..9b9ac2f996 100644
--- a/include/xrpl/shamap/SHAMapTxLeafNode.h
+++ b/include/xrpl/shamap/SHAMapTxLeafNode.h
@@ -15,7 +15,9 @@
 
 namespace xrpl {
 
-/** A leaf node for a transaction. No metadata is included. */
+/**
+ * A leaf node for a transaction. No metadata is included.
+ */
 class SHAMapTxLeafNode final : public SHAMapLeafNode, public CountedObject<SHAMapTxLeafNode>
 {
 public:
diff --git a/include/xrpl/shamap/SHAMapTxPlusMetaLeafNode.h b/include/xrpl/shamap/SHAMapTxPlusMetaLeafNode.h
index 9e4573d45b..6f8a7ebfda 100644
--- a/include/xrpl/shamap/SHAMapTxPlusMetaLeafNode.h
+++ b/include/xrpl/shamap/SHAMapTxPlusMetaLeafNode.h
@@ -15,7 +15,9 @@
 
 namespace xrpl {
 
-/** A leaf node for a transaction and its associated metadata. */
+/**
+ * A leaf node for a transaction and its associated metadata.
+ */
 class SHAMapTxPlusMetaLeafNode final : public SHAMapLeafNode,
                                        public CountedObject<SHAMapTxPlusMetaLeafNode>
 {
diff --git a/include/xrpl/shamap/detail/TaggedPointer.h b/include/xrpl/shamap/detail/TaggedPointer.h
index 79f3464d5b..509e6cc58d 100644
--- a/include/xrpl/shamap/detail/TaggedPointer.h
+++ b/include/xrpl/shamap/detail/TaggedPointer.h
@@ -12,111 +12,122 @@
 
 namespace xrpl {
 
-/** TaggedPointer is a combination of a pointer and a mask stored in the
-    lowest two bits.
-
-    Since pointers do not have arbitrary alignment, the lowest bits in the
-    pointer are guaranteed to be zero. TaggedPointer stores information in these
-    low bits. When dereferencing the pointer, these low "tag" bits are set to
-    zero. When accessing the tag bits, the high "pointer" bits are set to zero.
-
-    The "pointer" part points to the equivalent to an array of
-    `SHAMapHash` followed immediately by an array of
-    `shared_ptr<SHAMapTreeNode>`. The sizes of these arrays are
-    determined by the tag. The tag is an index into an array (`boundaries`,
-    defined in the cpp file) that specifies the size. Both arrays are the
-    same size. Note that the sizes may be smaller than the full 16 elements
-    needed to explicitly store all the children. In this case, the arrays
-    only store the non-empty children. The non-empty children are stored in
-    index order. For example, if only children `2` and `14` are non-empty, a
-    two-element array would store child `2` in array index 0 and child `14`
-    in array index 1. There are functions to convert between a child's tree
-    index and the child's index in a sparse array.
-
-    The motivation for this class is saving RAM. A large percentage of inner
-    nodes only store a small number of children. Memory can be saved by
-    storing the inner node's children in sparse arrays. Measurements show
-    that on average a typical SHAMap's inner nodes can be stored using only
-    25% of the original space.
-*/
+/**
+ * TaggedPointer is a combination of a pointer and a mask stored in the
+ * lowest two bits.
+ *
+ * Since pointers do not have arbitrary alignment, the lowest bits in the
+ * pointer are guaranteed to be zero. TaggedPointer stores information in these
+ * low bits. When dereferencing the pointer, these low "tag" bits are set to
+ * zero. When accessing the tag bits, the high "pointer" bits are set to zero.
+ *
+ * The "pointer" part points to the equivalent to an array of
+ * `SHAMapHash` followed immediately by an array of
+ * `shared_ptr<SHAMapTreeNode>`. The sizes of these arrays are
+ * determined by the tag. The tag is an index into an array (`boundaries`,
+ * defined in the cpp file) that specifies the size. Both arrays are the
+ * same size. Note that the sizes may be smaller than the full 16 elements
+ * needed to explicitly store all the children. In this case, the arrays
+ * only store the non-empty children. The non-empty children are stored in
+ * index order. For example, if only children `2` and `14` are non-empty, a
+ * two-element array would store child `2` in array index 0 and child `14`
+ * in array index 1. There are functions to convert between a child's tree
+ * index and the child's index in a sparse array.
+ *
+ * The motivation for this class is saving RAM. A large percentage of inner
+ * nodes only store a small number of children. Memory can be saved by
+ * storing the inner node's children in sparse arrays. Measurements show
+ * that on average a typical SHAMap's inner nodes can be stored using only
+ * 25% of the original space.
+ */
 class TaggedPointer
 {
 private:
     static_assert(
         alignof(SHAMapHash) >= 4,
         "Bad alignment: Tag pointer requires low two bits to be zero.");
-    /** Upper bits are the pointer, lowest two bits are the tag
-        A moved-from object will have a tp_ of zero.
-    */
+    /**
+     * Upper bits are the pointer, lowest two bits are the tag
+     * A moved-from object will have a tp_ of zero.
+     */
     std::uintptr_t tp_ = 0;
-    /** bit-and with this mask to get the tag bits (lowest two bits) */
+    /**
+     * bit-and with this mask to get the tag bits (lowest two bits)
+     */
     static constexpr std::uintptr_t kTagMask = 3;
-    /** bit-and with this mask to get the pointer bits (mask out the tag) */
+    /**
+     * bit-and with this mask to get the pointer bits (mask out the tag)
+     */
     static constexpr std::uintptr_t kPtrMask = ~kTagMask;
 
-    /** Deallocate memory and run destructors */
+    /**
+     * Deallocate memory and run destructors
+     */
     void
     destroyHashesAndChildren();
 
     struct RawAllocateTag
     {
     };
-    /** This constructor allocates space for the hashes and children, but
-        does not run constructors.
-
-        @param RawAllocateTag used to select overload only
-
-        @param numChildren allocate space for at least this number of children
-        (must be <= branchFactor)
-
-        @note Since the hashes/children destructors are always run in the
-        TaggedPointer destructor, this means those constructors _must_ be run
-        after this constructor is run. This constructor is private and only used
-        in places where the hashes/children constructor are subsequently run.
-    */
+    /**
+     * This constructor allocates space for the hashes and children, but
+     * does not run constructors.
+     *
+     * @param RawAllocateTag used to select overload only
+     *
+     * @param numChildren allocate space for at least this number of children
+     * (must be <= branchFactor)
+     *
+     * @note Since the hashes/children destructors are always run in the
+     * TaggedPointer destructor, this means those constructors _must_ be run
+     * after this constructor is run. This constructor is private and only used
+     * in places where the hashes/children constructor are subsequently run.
+     */
     explicit TaggedPointer(RawAllocateTag, std::uint8_t numChildren);
 
 public:
     TaggedPointer() = delete;
     explicit TaggedPointer(std::uint8_t numChildren);
 
-    /** Constructor is used change the number of allocated children.
-
-        Existing children from `other` are copied (toAllocate must be >= the
-        number of children). The motivation for making this a constructor is it
-        saves unneeded copying and zeroing out of hashes if this were
-        implemented directly in the SHAMapInnerNode class.
-
-        @param other children and hashes are moved from this param
-
-        @param isBranch bitset of non-empty children in `other`
-
-        @param toAllocate allocate space for at least this number of children
-        (must be <= branchFactor)
-    */
+    /**
+     * Constructor is used change the number of allocated children.
+     *
+     * Existing children from `other` are copied (toAllocate must be >= the
+     * number of children). The motivation for making this a constructor is it
+     * saves unneeded copying and zeroing out of hashes if this were
+     * implemented directly in the SHAMapInnerNode class.
+     *
+     * @param other children and hashes are moved from this param
+     *
+     * @param isBranch bitset of non-empty children in `other`
+     *
+     * @param toAllocate allocate space for at least this number of children
+     * (must be <= branchFactor)
+     */
     explicit TaggedPointer(TaggedPointer&& other, std::uint16_t isBranch, std::uint8_t toAllocate);
 
-    /** Given `other` with the specified children in `srcBranches`, create a
-        new TaggedPointer with the allocated number of children and the
-        children specified in `dstBranches`.
-
-        @param other children and hashes are moved from this param
-
-        @param srcBranches bitset of non-empty children in `other`
-
-        @param dstBranches bitset of children to copy from `other` (or space to
-        leave in a sparse array - see note below)
-
-        @param toAllocate allocate space for at least this number of children
-        (must be <= branchFactor)
-
-        @note a child may be absent in srcBranches but present in dstBranches
-        (if dst has a sparse representation, space for the new child will be
-        left in the sparse array). Typically, srcBranches and dstBranches will
-        differ by at most one bit. The function works correctly if they differ
-        by more, but there are likely more efficient algorithms to consider if
-        this becomes a common use-case.
-    */
+    /**
+     * Given `other` with the specified children in `srcBranches`, create a
+     * new TaggedPointer with the allocated number of children and the
+     * children specified in `dstBranches`.
+     *
+     * @param other children and hashes are moved from this param
+     *
+     * @param srcBranches bitset of non-empty children in `other`
+     *
+     * @param dstBranches bitset of children to copy from `other` (or space to
+     * leave in a sparse array - see note below)
+     *
+     * @param toAllocate allocate space for at least this number of children
+     * (must be <= branchFactor)
+     *
+     * @note a child may be absent in srcBranches but present in dstBranches
+     * (if dst has a sparse representation, space for the new child will be
+     * left in the sparse array). Typically, srcBranches and dstBranches will
+     * differ by at most one bit. The function works correctly if they differ
+     * by more, but there are likely more efficient algorithms to consider if
+     * this becomes a common use-case.
+     */
     explicit TaggedPointer(
         TaggedPointer&& other,
         std::uint16_t srcBranches,
@@ -132,68 +143,81 @@ public:
 
     ~TaggedPointer();
 
-    /** Decode the tagged pointer into its tag and pointer */
+    /**
+     * Decode the tagged pointer into its tag and pointer
+     */
     [[nodiscard]] std::pair<std::uint8_t, void*>
     decode() const;
 
-    /** Get the number of elements allocated for each array */
+    /**
+     * Get the number of elements allocated for each array
+     */
     [[nodiscard]] std::uint8_t
     capacity() const;
 
-    /** Check if the arrays have a dense format.
-
-        @note The dense format is when there is an array element for all 16
-        (branchFactor) possible children.
-    */
+    /**
+     * Check if the arrays have a dense format.
+     *
+     * @note The dense format is when there is an array element for all 16
+     * (branchFactor) possible children.
+     */
     [[nodiscard]] bool
     isDense() const;
 
-    /** Get the number of elements in each array and a pointer to the start
-        of each array.
-    */
+    /**
+     * Get the number of elements in each array and a pointer to the start
+     * of each array.
+     */
     [[nodiscard]] std::tuple<std::uint8_t, SHAMapHash*, SHAMapTreeNodePtr*>
     getHashesAndChildren() const;
 
-    /** Get the `hashes` array */
+    /**
+     * Get the `hashes` array
+     */
     [[nodiscard]] SHAMapHash*
     getHashes() const;
 
-    /** Get the `children` array */
+    /**
+     * Get the `children` array
+     */
     [[nodiscard]] SHAMapTreeNodePtr*
     getChildren() const;
 
-    /** Call the `f` callback for all 16 (branchFactor) branches - even if
-        the branch is empty.
-
-        @param isBranch bitset of non-empty children
-
-        @param f a one parameter callback function. The parameter is the
-        child's hash.
+    /**
+     * Call the `f` callback for all 16 (branchFactor) branches - even if
+     * the branch is empty.
+     *
+     * @param isBranch bitset of non-empty children
+     *
+     * @param f a one parameter callback function. The parameter is the
+     * child's hash.
      */
     template <class F>
     void
     iterChildren(std::uint16_t isBranch, F&& f) const;
 
-    /** Call the `f` callback for all non-empty branches.
-
-        @param isBranch bitset of non-empty children
-
-        @param f a two parameter callback function. The first parameter is
-        the branch number, the second parameter is the index into the array.
-        For dense formats these are the same, for sparse they may be
-        different.
+    /**
+     * Call the `f` callback for all non-empty branches.
+     *
+     * @param isBranch bitset of non-empty children
+     *
+     * @param f a two parameter callback function. The first parameter is
+     * the branch number, the second parameter is the index into the array.
+     * For dense formats these are the same, for sparse they may be
+     * different.
      */
     template <class F>
     void
     iterNonEmptyChildIndexes(std::uint16_t isBranch, F&& f) const;
 
-    /** Get the child's index inside the `hashes` or `children` array (which
-        may or may not be sparse). The optional will be empty if an empty
-        branch is requested and the children are sparse.
-
-        @param isBranch bitset of non-empty children
-
-        @param i index of the requested child
+    /**
+     * Get the child's index inside the `hashes` or `children` array (which
+     * may or may not be sparse). The optional will be empty if an empty
+     * branch is requested and the children are sparse.
+     *
+     * @param isBranch bitset of non-empty children
+     *
+     * @param i index of the requested child
      */
     [[nodiscard]] std::optional<int>
     getChildIndex(std::uint16_t isBranch, int i) const;
diff --git a/include/xrpl/tx/ApplyContext.h b/include/xrpl/tx/ApplyContext.h
index f64957dd35..472afdf624 100644
--- a/include/xrpl/tx/ApplyContext.h
+++ b/include/xrpl/tx/ApplyContext.h
@@ -21,7 +21,9 @@
 
 namespace xrpl {
 
-/** State information when applying a tx. */
+/**
+ * State information when applying a tx.
+ */
 class ApplyContext
 {
 public:
@@ -83,7 +85,9 @@ public:
         return flags_;
     }
 
-    /** Sets the DeliveredAmount field in the metadata */
+    /**
+     * Sets the DeliveredAmount field in the metadata
+     */
     void
     deliver(STAmount const& amount)
     {
@@ -91,18 +95,26 @@ public:
         view_->deliver(amount);
     }
 
-    /** Discard changes and start fresh. */
+    /**
+     * Discard changes and start fresh.
+     */
     void
     discard();
 
-    /** Apply the transaction result to the base. */
+    /**
+     * Apply the transaction result to the base.
+     */
     std::optional<TxMeta> apply(TER);
 
-    /** Get the number of unapplied changes. */
+    /**
+     * Get the number of unapplied changes.
+     */
     std::size_t
     size();
 
-    /** Visit unapplied changes. */
+    /**
+     * Visit unapplied changes.
+     */
     void
     visit(
         std::function<void(
@@ -118,11 +130,12 @@ public:
         view_->rawDestroyXRP(fee);
     }
 
-    /** Applies all invariant checkers one by one.
-
-        @param result the result generated by processing this transaction.
-        @param fee the fee charged for this transaction
-        @return the result code that should be returned for this transaction.
+    /**
+     * Applies all invariant checkers one by one.
+     *
+     * @param result the result generated by processing this transaction.
+     * @param fee the fee charged for this transaction
+     * @return the result code that should be returned for this transaction.
      */
     TER
     checkInvariants(TER const result, XRPAmount const fee);
diff --git a/include/xrpl/tx/Transactor.h b/include/xrpl/tx/Transactor.h
index bdb51b06ec..a71285f70e 100644
--- a/include/xrpl/tx/Transactor.h
+++ b/include/xrpl/tx/Transactor.h
@@ -31,7 +31,9 @@
 
 namespace xrpl {
 
-/** State information when preflighting a tx. */
+/**
+ * State information when preflighting a tx.
+ */
 struct PreflightContext
 {
 public:
@@ -74,7 +76,9 @@ public:
     operator=(PreflightContext const&) = delete;
 };
 
-/** State information when determining if a tx is likely to claim a fee. */
+/**
+ * State information when determining if a tx is likely to claim a fee.
+ */
 struct PreclaimContext
 {
 public:
@@ -161,7 +165,9 @@ public:
 
     enum class ConsequencesFactoryType { Normal, Blocker, Custom };
 
-    /** Process the transaction. */
+    /**
+     * Process the transaction.
+     */
     ApplyResult
     operator()();
 
@@ -177,16 +183,17 @@ public:
         return ctx_.view();
     }
 
-    /** Check all invariants for the current transaction.
+    /**
+     * Check all invariants for the current transaction.
      *
-     *  Runs transaction-specific invariants first (visitInvariantEntry +
-     *  finalizeInvariants), then protocol-level invariants.  Both layers
-     *  always run; the worst failure code is returned.
+     * Runs transaction-specific invariants first (visitInvariantEntry +
+     * finalizeInvariants), then protocol-level invariants.  Both layers
+     * always run; the worst failure code is returned.
      *
-     *  @param result  the tentative TER from transaction processing.
-     *  @param fee     the fee consumed by the transaction.
+     * @param result  the tentative TER from transaction processing.
+     * @param fee     the fee consumed by the transaction.
      *
-     *  @return the final TER after all invariant checks.
+     * @return the final TER after all invariant checks.
      */
     [[nodiscard]] TER
     checkInvariants(TER result, XRPAmount fee);
@@ -341,40 +348,42 @@ protected:
     virtual TER
     doApply() = 0;
 
-    /** Inspect a single ledger entry modified by this transaction.
+    /**
+     * Inspect a single ledger entry modified by this transaction.
      *
-     *  Called once for every SLE created, modified, or deleted by the
-     *  transaction, before finalizeInvariants.  Implementations should
-     *  accumulate whatever state they need to verify transaction-specific
-     *  post-conditions.
+     * Called once for every SLE created, modified, or deleted by the
+     * transaction, before finalizeInvariants.  Implementations should
+     * accumulate whatever state they need to verify transaction-specific
+     * post-conditions.
      *
-     *  @param isDelete  true if the entry was erased from the ledger.
-     *  @param before    the entry's state before the transaction (nullptr
-     *                   for newly created entries).
-     *  @param after     the entry's state as supplied by the apply logic
-     *                   for this transaction. For deletions, this is the
-     *                   SLE being erased and is not guaranteed to be null;
-     *                   callers must use isDelete rather than after == nullptr
-     *                   to detect deletions.
+     * @param isDelete  true if the entry was erased from the ledger.
+     * @param before    the entry's state before the transaction (nullptr
+     *                  for newly created entries).
+     * @param after     the entry's state as supplied by the apply logic
+     *                  for this transaction. For deletions, this is the
+     *                  SLE being erased and is not guaranteed to be null;
+     *                  callers must use isDelete rather than after == nullptr
+     *                  to detect deletions.
      */
     virtual void
     visitInvariantEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after) = 0;
 
-    /** Check transaction-specific post-conditions after all entries have
-     *  been visited.
+    /**
+     * Check transaction-specific post-conditions after all entries have
+     * been visited.
      *
-     *  Called once after every modified ledger entry has been passed to
-     *  visitInvariantEntry.  Returns true if all transaction-specific
-     *  invariants hold, or false to fail the transaction with
-     *  tecINVARIANT_FAILED.
+     * Called once after every modified ledger entry has been passed to
+     * visitInvariantEntry.  Returns true if all transaction-specific
+     * invariants hold, or false to fail the transaction with
+     * tecINVARIANT_FAILED.
      *
-     *  @param tx    the transaction being applied.
-     *  @param result the tentative TER result so far.
-     *  @param fee   the fee consumed by the transaction.
-     *  @param view  read-only view of the ledger after the transaction.
-     *  @param j     journal for logging invariant failures.
+     * @param tx    the transaction being applied.
+     * @param result the tentative TER result so far.
+     * @param fee   the fee consumed by the transaction.
+     * @param view  read-only view of the ledger after the transaction.
+     * @param j     journal for logging invariant failures.
      *
-     *  @return true if all invariants pass; false otherwise.
+     * @return true if all invariants pass; false otherwise.
      */
     [[nodiscard]] virtual bool
     finalizeInvariants(
@@ -384,14 +393,15 @@ protected:
         ReadView const& view,
         beast::Journal const& j) = 0;
 
-    /** Compute the minimum fee required to process a transaction
-        with a given baseFee based on the current server load.
-
-        @param registry The service registry.
-        @param baseFee The base fee of a candidate transaction
-            @see xrpl::calculateBaseFee
-        @param fees Fee settings from the current ledger
-        @param flags Transaction processing fees
+    /**
+     * Compute the minimum fee required to process a transaction
+     * with a given baseFee based on the current server load.
+     *
+     * @param registry The service registry.
+     * @param baseFee The base fee of a candidate transaction
+     * @see xrpl::calculateBaseFee
+     * @param fees Fee settings from the current ledger
+     * @param flags Transaction processing fees
      */
     static XRPAmount
     minimumFee(ServiceRegistry& registry, XRPAmount baseFee, Fees const& fees, ApplyFlags flags);
@@ -440,12 +450,16 @@ protected:
         unit::ValueUnit<Unit, T> max,
         unit::ValueUnit<Unit, T> min = unit::ValueUnit<Unit, T>{});
 
-    /// Minimum will usually be zero.
+    /**
+     * Minimum will usually be zero.
+     */
     template <class T>
     static bool
     validNumericMinimum(std::optional<T> value, T min = T{});
 
-    /// Minimum will usually be zero.
+    /**
+     * Minimum will usually be zero.
+     */
     template <class T, class Unit>
     static bool
     validNumericMinimum(
@@ -493,44 +507,48 @@ private:
 
     void trapTransaction(uint256) const;
 
-    /** Performs early sanity checks on the account and fee fields.
-
-        (And passes flagMask to preflight0)
-
-        Do not try to call preflight1 from preflight() in derived classes. See
-        the description of invokePreflight for details.
-    */
+    /**
+     * Performs early sanity checks on the account and fee fields.
+     *
+     * (And passes flagMask to preflight0)
+     *
+     * Do not try to call preflight1 from preflight() in derived classes. See
+     * the description of invokePreflight for details.
+     */
     static NotTEC
     preflight1(PreflightContext const& ctx, std::uint32_t flagMask);
 
-    /** Checks whether the signature appears valid
-
-        Do not try to call preflight2 from preflight() in derived classes. See
-        the description of invokePreflight for details.
-    */
+    /**
+     * Checks whether the signature appears valid
+     *
+     * Do not try to call preflight2 from preflight() in derived classes. See
+     * the description of invokePreflight for details.
+     */
     static NotTEC
     preflight2(PreflightContext const& ctx);
 
-    /** Universal validations
-       - Valid MPTAmount and XRPAmount
-
-        Do not try to call preflightUniversal from preflight() in derived classes. See
-        the description of invokePreflight for details.
-    */
+    /**
+     * Universal validations
+     * - Valid MPTAmount and XRPAmount
+     *
+     *  Do not try to call preflightUniversal from preflight() in derived classes. See
+     *  the description of invokePreflight for details.
+     */
     static NotTEC
     preflightUniversal(PreflightContext const& ctx);
 
-    /** Check transaction-specific invariants only.
+    /**
+     * Check transaction-specific invariants only.
      *
-     *  Walks every modified ledger entry via visitInvariantEntry, then
-     *  calls finalizeInvariants on the derived transactor.  Returns
-     *  tecINVARIANT_FAILED if any transaction invariant is violated.
+     * Walks every modified ledger entry via visitInvariantEntry, then
+     * calls finalizeInvariants on the derived transactor.  Returns
+     * tecINVARIANT_FAILED if any transaction invariant is violated.
      *
-     *  @param result  the tentative TER from transaction processing.
-     *  @param fee     the fee consumed by the transaction.
+     * @param result  the tentative TER from transaction processing.
+     * @param fee     the fee consumed by the transaction.
      *
-     *  @return the original result if all invariants pass, or
-     *          tecINVARIANT_FAILED otherwise.
+     * @return the original result if all invariants pass, or
+     *         tecINVARIANT_FAILED otherwise.
      */
     [[nodiscard]] TER
     checkTransactionInvariants(TER result, XRPAmount fee);
@@ -542,20 +560,24 @@ Transactor::checkExtraFeatures(PreflightContext const& ctx)
     return true;
 }
 
-/** Performs early sanity checks on the txid and flags */
+/**
+ * Performs early sanity checks on the txid and flags
+ */
 NotTEC
 preflight0(PreflightContext const& ctx, std::uint32_t flagMask);
 
 namespace detail {
 
-/** Checks the validity of the transactor signing key.
+/**
+ * Checks the validity of the transactor signing key.
  *
  * Normally called from preflight1 with ctx.tx.
  */
 NotTEC
 preflightCheckSigningKey(STObject const& sigObject, beast::Journal j);
 
-/** Checks the special signing key state needed for simulation
+/**
+ * Checks the special signing key state needed for simulation
  *
  * Normally called from preflight2 with ctx.tx.
  */
diff --git a/include/xrpl/tx/apply.h b/include/xrpl/tx/apply.h
index 55d365c31b..8c11d870f1 100644
--- a/include/xrpl/tx/apply.h
+++ b/include/xrpl/tx/apply.h
@@ -16,88 +16,98 @@ namespace xrpl {
 class HashRouter;
 class ServiceRegistry;
 
-/** Describes the pre-processing validity of a transaction.
-
-    @see checkValidity, forceValidity
-*/
+/**
+ * Describes the pre-processing validity of a transaction.
+ *
+ * @see checkValidity, forceValidity
+ */
 enum class Validity {
-    /// Signature is bad. Didn't do local checks.
+    /**
+     * Signature is bad. Didn't do local checks.
+     */
     SigBad,
-    /// Signature is good, but local checks fail.
+    /**
+     * Signature is good, but local checks fail.
+     */
     SigGoodOnly,
-    /// Signature and local checks are good / passed.
+    /**
+     * Signature and local checks are good / passed.
+     */
     Valid
 };
 
-/** Checks transaction signature and local checks.
-
-    @return A `Validity` enum representing how valid the
-        `STTx` is and, if not `Valid`, a reason string.
-
-    @note Results are cached internally, so tests will not be
-        repeated over repeated calls, unless cache expires.
-
-    @return `std::pair`, where `.first` is the status, and
-            `.second` is the reason if appropriate.
-
-    @see Validity
-*/
+/**
+ * Checks transaction signature and local checks.
+ *
+ * @return A `Validity` enum representing how valid the
+ *     `STTx` is and, if not `Valid`, a reason string.
+ *
+ * @note Results are cached internally, so tests will not be
+ *     repeated over repeated calls, unless cache expires.
+ *
+ * @return `std::pair`, where `.first` is the status, and
+ *         `.second` is the reason if appropriate.
+ *
+ * @see Validity
+ */
 std::pair<Validity, std::string>
 checkValidity(HashRouter& router, STTx const& tx, Rules const& rules);
 
-/** Sets the validity of a given transaction in the cache.
-
-    @warning Use with extreme care.
-
-    @note Can only raise the validity to a more valid state,
-          and can not override anything cached bad.
-
-    @see checkValidity, Validity
-*/
+/**
+ * Sets the validity of a given transaction in the cache.
+ *
+ * @warning Use with extreme care.
+ *
+ * @note Can only raise the validity to a more valid state,
+ *       and can not override anything cached bad.
+ *
+ * @see checkValidity, Validity
+ */
 void
 forceValidity(HashRouter& router, uint256 const& txid, Validity validity);
 
-/** Apply a transaction to an `OpenView`.
-
-    This function is the canonical way to apply a transaction
-    to a ledger. It rolls the validation and application
-    steps into one function. To do the steps manually, the
-    correct calling order is:
-    @code{.cpp}
-    preflight -> preclaim -> doApply
-    @endcode
-    The result of one function must be passed to the next.
-    The `preflight` result can be safely cached and reused
-    asynchronously, but `preclaim` and `doApply` must be called
-    in the same thread and with the same view.
-
-    @note Does not throw.
-
-    For open ledgers, the `Transactor` will catch exceptions
-    and return `tefEXCEPTION`. For closed ledgers, the
-    `Transactor` will attempt to only charge a fee,
-    and return `tecFAILED_PROCESSING`.
-
-    If the `Transactor` gets an exception while trying
-    to charge the fee, it will be caught and
-    turned into `tefEXCEPTION`.
-
-    For network health, a `Transactor` makes its
-    best effort to at least charge a fee if the
-    ledger is closed.
-
-    @param app The current running `Application`.
-    @param view The open ledger that the transaction
-        will attempt to be applied to.
-    @param tx The transaction to be checked.
-    @param flags `ApplyFlags` describing processing options.
-    @param journal A journal.
-
-    @see preflight, preclaim, doApply
-
-    @return A pair with the `TER` and a `bool` indicating
-            whether or not the transaction was applied.
-*/
+/**
+ * Apply a transaction to an `OpenView`.
+ *
+ * This function is the canonical way to apply a transaction
+ * to a ledger. It rolls the validation and application
+ * steps into one function. To do the steps manually, the
+ * correct calling order is:
+ * @code
+ * preflight -> preclaim -> doApply
+ * @endcode
+ * The result of one function must be passed to the next.
+ * The `preflight` result can be safely cached and reused
+ * asynchronously, but `preclaim` and `doApply` must be called
+ * in the same thread and with the same view.
+ *
+ * @note Does not throw.
+ *
+ * For open ledgers, the `Transactor` will catch exceptions
+ * and return `tefEXCEPTION`. For closed ledgers, the
+ * `Transactor` will attempt to only charge a fee,
+ * and return `tecFAILED_PROCESSING`.
+ *
+ * If the `Transactor` gets an exception while trying
+ * to charge the fee, it will be caught and
+ * turned into `tefEXCEPTION`.
+ *
+ * For network health, a `Transactor` makes its
+ * best effort to at least charge a fee if the
+ * ledger is closed.
+ *
+ * @param app The current running `Application`.
+ * @param view The open ledger that the transaction
+ *     will attempt to be applied to.
+ * @param tx The transaction to be checked.
+ * @param flags `ApplyFlags` describing processing options.
+ * @param journal A journal.
+ *
+ * @see preflight, preclaim, doApply
+ *
+ * @return A pair with the `TER` and a `bool` indicating
+ *         whether or not the transaction was applied.
+ */
 ApplyResult
 apply(
     ServiceRegistry& registry,
@@ -106,26 +116,34 @@ apply(
     ApplyFlags flags,
     beast::Journal journal);
 
-/** Enum class for return value from `applyTransaction`
-
-    @see applyTransaction
-*/
+/**
+ * Enum class for return value from `applyTransaction`
+ *
+ * @see applyTransaction
+ */
 enum class ApplyTransactionResult {
-    /// Applied to this ledger
+    /**
+     * Applied to this ledger
+     */
     Success,
-    /// Should not be retried in this ledger
+    /**
+     * Should not be retried in this ledger
+     */
     Fail,
-    /// Should be retried in this ledger
+    /**
+     * Should be retried in this ledger
+     */
     Retry
 };
 
-/** Transaction application helper
-
-    Provides more detailed logging and decodes the
-    correct behavior based on the `TER` type
-
-    @see ApplyTransactionResult
-*/
+/**
+ * Transaction application helper
+ *
+ * Provides more detailed logging and decodes the
+ * correct behavior based on the `TER` type
+ *
+ * @see ApplyTransactionResult
+ */
 ApplyTransactionResult
 applyTransaction(
     ServiceRegistry& registry,
diff --git a/include/xrpl/tx/applySteps.h b/include/xrpl/tx/applySteps.h
index 3298e49192..bd495481f2 100644
--- a/include/xrpl/tx/applySteps.h
+++ b/include/xrpl/tx/applySteps.h
@@ -33,8 +33,9 @@ struct ApplyResult
     }
 };
 
-/** Return true if the transaction can claim a fee (tec),
-    and the `ApplyFlags` do not allow soft failures.
+/**
+ * Return true if the transaction can claim a fee (tec),
+ * and the `ApplyFlags` do not allow soft failures.
  */
 inline bool
 isTecClaimHardFail(TER ter, ApplyFlags flags)
@@ -42,34 +43,51 @@ isTecClaimHardFail(TER ter, ApplyFlags flags)
     return isTecClaim(ter) && ((flags & TapRetry) == 0u);
 }
 
-/** Class describing the consequences to the account
-    of applying a transaction if the transaction consumes
-    the maximum XRP allowed.
-*/
+/**
+ * Class describing the consequences to the account
+ * of applying a transaction if the transaction consumes
+ * the maximum XRP allowed.
+ */
 class TxConsequences
 {
 public:
-    /// Describes how the transaction affects subsequent
-    /// transactions
+    /**
+     * Describes how the transaction affects subsequent
+     * transactions
+     */
     enum class Category {
-        /// Moves currency around, creates offers, etc.
+        /**
+         * Moves currency around, creates offers, etc.
+         */
         Normal = 0,
-        /// Affects the ability of subsequent transactions
-        /// to claim a fee. Eg. `SetRegularKey`
+        /**
+         * Affects the ability of subsequent transactions
+         * to claim a fee. Eg. `SetRegularKey`
+         */
         Blocker
     };
 
 private:
-    /// Describes how the transaction affects subsequent
-    /// transactions
+    /**
+     * Describes how the transaction affects subsequent
+     * transactions
+     */
     bool isBlocker_;
-    /// Transaction fee
+    /**
+     * Transaction fee
+     */
     XRPAmount fee_;
-    /// Does NOT include the fee.
+    /**
+     * Does NOT include the fee.
+     */
     XRPAmount potentialSpend_;
-    /// SeqProxy of transaction.
+    /**
+     * SeqProxy of transaction.
+     */
     SeqProxy seqProx_;
-    /// Number of sequences consumed.
+    /**
+     * Number of sequences consumed.
+     */
     std::uint32_t sequencesConsumed_;
 
 public:
@@ -77,58 +95,84 @@ public:
     // Asserts if tesSUCCESS is passed.
     explicit TxConsequences(NotTEC pfResult);
 
-    /// Constructor if the STTx has no notable consequences for the TxQ.
+    /**
+     * Constructor if the STTx has no notable consequences for the TxQ.
+     */
     explicit TxConsequences(STTx const& tx);
 
-    /// Constructor for a blocker.
+    /**
+     * Constructor for a blocker.
+     */
     TxConsequences(STTx const& tx, Category category);
 
-    /// Constructor for an STTx that may consume more XRP than the fee.
+    /**
+     * Constructor for an STTx that may consume more XRP than the fee.
+     */
     TxConsequences(STTx const& tx, XRPAmount potentialSpend);
 
-    /// Constructor for an STTx that consumes more than the usual sequences.
+    /**
+     * Constructor for an STTx that consumes more than the usual sequences.
+     */
     TxConsequences(STTx const& tx, std::uint32_t sequencesConsumed);
 
-    /// Copy constructor
+    /**
+     * Copy constructor
+     */
     TxConsequences(TxConsequences const&) = default;
-    /// Copy assignment operator
+    /**
+     * Copy assignment operator
+     */
     TxConsequences&
     operator=(TxConsequences const&) = default;
-    /// Move constructor
+    /**
+     * Move constructor
+     */
     TxConsequences(TxConsequences&&) = default;
-    /// Move assignment operator
+    /**
+     * Move assignment operator
+     */
     TxConsequences&
     operator=(TxConsequences&&) = default;
 
-    /// Fee
+    /**
+     * Fee
+     */
     [[nodiscard]] XRPAmount
     fee() const
     {
         return fee_;
     }
 
-    /// Potential Spend
+    /**
+     * Potential Spend
+     */
     [[nodiscard]] XRPAmount const&
     potentialSpend() const
     {
         return potentialSpend_;
     }
 
-    /// SeqProxy
+    /**
+     * SeqProxy
+     */
     [[nodiscard]] SeqProxy
     seqProxy() const
     {
         return seqProx_;
     }
 
-    /// Sequences consumed
+    /**
+     * Sequences consumed
+     */
     [[nodiscard]] std::uint32_t
     sequencesConsumed() const
     {
         return sequencesConsumed_;
     }
 
-    /// Returns true if the transaction is a blocker.
+    /**
+     * Returns true if the transaction is a blocker.
+     */
     [[nodiscard]] bool
     isBlocker() const
     {
@@ -145,32 +189,49 @@ public:
     }
 };
 
-/** Describes the results of the `preflight` check
-
-    @note All members are const to make it more difficult
-        to "fake" a result without calling `preflight`.
-    @see preflight, preclaim, doApply, apply
-*/
+/**
+ * Describes the results of the `preflight` check
+ *
+ * @note All members are const to make it more difficult
+ *     to "fake" a result without calling `preflight`.
+ * @see preflight, preclaim, doApply, apply
+ */
 struct PreflightResult
 {
 public:
-    /// From the input - the transaction
+    /**
+     * From the input - the transaction
+     */
     STTx const& tx;
-    /// From the input - the batch identifier, if part of a batch
+    /**
+     * From the input - the batch identifier, if part of a batch
+     */
     std::optional<uint256 const> const parentBatchId;
-    /// From the input - the rules
+    /**
+     * From the input - the rules
+     */
     Rules const rules;
-    /// Consequences of the transaction
+    /**
+     * Consequences of the transaction
+     */
     TxConsequences const consequences;
-    /// From the input - the flags
+    /**
+     * From the input - the flags
+     */
     ApplyFlags const flags;
-    /// From the input - the journal
+    /**
+     * From the input - the journal
+     */
     beast::Journal const j;
 
-    /// Intermediate transaction result
+    /**
+     * Intermediate transaction result
+     */
     NotTEC const ter;
 
-    /// Constructor
+    /**
+     * Constructor
+     */
     template <class Context>
     PreflightResult(Context const& ctx, std::pair<NotTEC, TxConsequences> const& result)
         : tx(ctx.tx)
@@ -184,39 +245,58 @@ public:
     }
 
     PreflightResult(PreflightResult const&) = default;
-    /// Deleted copy assignment operator
+    /**
+     * Deleted copy assignment operator
+     */
     PreflightResult&
     operator=(PreflightResult const&) = delete;
 };
 
-/** Describes the results of the `preclaim` check
-
-    @note All members are const to make it more difficult
-        to "fake" a result without calling `preclaim`.
-    @see preflight, preclaim, doApply, apply
-*/
+/**
+ * Describes the results of the `preclaim` check
+ *
+ * @note All members are const to make it more difficult
+ *     to "fake" a result without calling `preclaim`.
+ * @see preflight, preclaim, doApply, apply
+ */
 struct PreclaimResult
 {
 public:
-    /// From the input - the ledger view
+    /**
+     * From the input - the ledger view
+     */
     ReadView const& view;
-    /// From the input - the transaction
+    /**
+     * From the input - the transaction
+     */
     STTx const& tx;
-    /// From the input - the batch identifier, if part of a batch
+    /**
+     * From the input - the batch identifier, if part of a batch
+     */
     std::optional<uint256 const> const parentBatchId;
-    /// From the input - the flags
+    /**
+     * From the input - the flags
+     */
     ApplyFlags const flags;
-    /// From the input - the journal
+    /**
+     * From the input - the journal
+     */
     beast::Journal const j;
 
-    /// Intermediate transaction result
+    /**
+     * Intermediate transaction result
+     */
     TER const ter;
 
-    /// Success flag - whether the transaction is likely to
-    /// claim a fee
+    /**
+     * Success flag - whether the transaction is likely to
+     * claim a fee
+     */
     bool const likelyToClaimFee{};
 
-    /// Constructor
+    /**
+     * Constructor
+     */
     template <class Context>
     PreclaimResult(Context const& ctx, TER ter)
         : view(ctx.view)
@@ -230,27 +310,30 @@ public:
     }
 
     PreclaimResult(PreclaimResult const&) = default;
-    /// Deleted copy assignment operator
+    /**
+     * Deleted copy assignment operator
+     */
     PreclaimResult&
     operator=(PreclaimResult const&) = delete;
 };
 
-/** Gate a transaction based on static information.
-
-    The transaction is checked against all possible
-    validity constraints that do not require a ledger.
-
-    @param app The current running `Application`.
-    @param rules The `Rules` in effect at the time of the check.
-    @param tx The transaction to be checked.
-    @param flags `ApplyFlags` describing processing options.
-    @param j A journal.
-
-    @see PreflightResult, preclaim, doApply, apply
-
-    @return A `PreflightResult` object containing, among
-    other things, the `TER` code.
-*/
+/**
+ * Gate a transaction based on static information.
+ *
+ * The transaction is checked against all possible
+ * validity constraints that do not require a ledger.
+ *
+ * @param app The current running `Application`.
+ * @param rules The `Rules` in effect at the time of the check.
+ * @param tx The transaction to be checked.
+ * @param flags `ApplyFlags` describing processing options.
+ * @param j A journal.
+ *
+ * @see PreflightResult, preclaim, doApply, apply
+ *
+ * @return A `PreflightResult` object containing, among
+ * other things, the `TER` code.
+ */
 /** @{ */
 PreflightResult
 preflight(
@@ -270,86 +353,90 @@ preflight(
     beast::Journal j);
 /** @} */
 
-/** Gate a transaction based on static ledger information.
-
-    The transaction is checked against all possible
-    validity constraints that DO require a ledger.
-
-    If preclaim succeeds, then the transaction is very
-    likely to claim a fee. This will determine if the
-    transaction is safe to relay without being applied
-    to the open ledger.
-
-    "Succeeds" in this case is defined as returning a
-    `tes` or `tec`, since both lead to claiming a fee.
-
-    @pre The transaction has been checked
-    and validated using `preflight`
-
-    @param preflightResult The result of a previous
-        call to `preflight` for the transaction.
-    @param app The current running `Application`.
-    @param view The open ledger that the transaction
-        will attempt to be applied to.
-
-    @see PreclaimResult, preflight, doApply, apply
-
-    @return A `PreclaimResult` object containing, among
-    other things the `TER` code and the base fee value for
-    this transaction.
-*/
+/**
+ * Gate a transaction based on static ledger information.
+ *
+ * The transaction is checked against all possible
+ * validity constraints that DO require a ledger.
+ *
+ * If preclaim succeeds, then the transaction is very
+ * likely to claim a fee. This will determine if the
+ * transaction is safe to relay without being applied
+ * to the open ledger.
+ *
+ * "Succeeds" in this case is defined as returning a
+ * `tes` or `tec`, since both lead to claiming a fee.
+ *
+ * @pre The transaction has been checked
+ * and validated using `preflight`
+ *
+ * @param preflightResult The result of a previous
+ *     call to `preflight` for the transaction.
+ * @param app The current running `Application`.
+ * @param view The open ledger that the transaction
+ *     will attempt to be applied to.
+ *
+ * @see PreclaimResult, preflight, doApply, apply
+ *
+ * @return A `PreclaimResult` object containing, among
+ * other things the `TER` code and the base fee value for
+ * this transaction.
+ */
 PreclaimResult
 preclaim(PreflightResult const& preflightResult, ServiceRegistry& registry, OpenView const& view);
 
-/** Compute only the expected base fee for a transaction.
-
-    Base fees are transaction specific, so any calculation
-    needing them must get the base fee for each transaction.
-
-    No validation is done or implied by this function.
-
-    Caller is responsible for handling any exceptions.
-    Since none should be thrown, that will usually
-    mean terminating.
-
-    @param view The current open ledger.
-    @param tx The transaction to be checked.
-
-    @return The base fee.
-*/
+/**
+ * Compute only the expected base fee for a transaction.
+ *
+ * Base fees are transaction specific, so any calculation
+ * needing them must get the base fee for each transaction.
+ *
+ * No validation is done or implied by this function.
+ *
+ * Caller is responsible for handling any exceptions.
+ * Since none should be thrown, that will usually
+ * mean terminating.
+ *
+ * @param view The current open ledger.
+ * @param tx The transaction to be checked.
+ *
+ * @return The base fee.
+ */
 XRPAmount
 calculateBaseFee(ReadView const& view, STTx const& tx);
 
-/** Return the minimum fee that an "ordinary" transaction would pay.
-
-    When computing the FeeLevel for a transaction the TxQ sometimes needs
-    the know what an "ordinary" or reference transaction would be required
-    to pay.
-
-    @param view The current open ledger.
-    @param tx The transaction so the correct multisigner count is used.
-
-    @return The base fee in XRPAmount.
-*/
+/**
+ * Return the minimum fee that an "ordinary" transaction would pay.
+ *
+ * When computing the FeeLevel for a transaction the TxQ sometimes needs
+ * the know what an "ordinary" or reference transaction would be required
+ * to pay.
+ *
+ * @param view The current open ledger.
+ * @param tx The transaction so the correct multisigner count is used.
+ *
+ * @return The base fee in XRPAmount.
+ */
 XRPAmount
 calculateDefaultBaseFee(ReadView const& view, STTx const& tx);
 
-/** Apply a prechecked transaction to an OpenView.
-
-    @pre The transaction has been checked
-    and validated using `preflight` and `preclaim`
-
-    @param preclaimResult The result of a previous
-    call to `preclaim` for the transaction.
-    @param registry The service registry.
-    @param view The open ledger that the transaction
-    will attempt to be applied to.
-
-    @see preflight, preclaim, apply
-
-    @return A pair with the `TER` and a `bool` indicating
-    whether or not the transaction was applied.
-*/
+/**
+ * Apply a prechecked transaction to an OpenView.
+ *
+ * @pre The transaction has been checked
+ * and validated using `preflight` and `preclaim`
+ *
+ * @param preclaimResult The result of a previous
+ * call to `preclaim` for the transaction.
+ * @param registry The service registry.
+ * @param view The open ledger that the transaction
+ * will attempt to be applied to.
+ *
+ * @see preflight, preclaim, apply
+ *
+ * @return A pair with the `TER` and a `bool` indicating
+ * whether or not the transaction was applied.
+ */
 ApplyResult
 doApply(PreclaimResult const& preclaimResult, ServiceRegistry& registry, OpenView& view);
 
diff --git a/include/xrpl/tx/invariants/InvariantCheck.h b/include/xrpl/tx/invariants/InvariantCheck.h
index 0e6b2a361d..bb51105de2 100644
--- a/include/xrpl/tx/invariants/InvariantCheck.h
+++ b/include/xrpl/tx/invariants/InvariantCheck.h
@@ -376,7 +376,8 @@ public:
     finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&);
 };
 
-/** Verify that MPT/XRP STAmounts are canonical in any ledger entries left after the
+/**
+ * Verify that MPT/XRP STAmounts are canonical in any ledger entries left after the
  * transaction applies.
  */
 class ValidAmounts
diff --git a/include/xrpl/tx/invariants/MPTInvariant.h b/include/xrpl/tx/invariants/MPTInvariant.h
index 1d39fd13d8..9a546fa400 100644
--- a/include/xrpl/tx/invariants/MPTInvariant.h
+++ b/include/xrpl/tx/invariants/MPTInvariant.h
@@ -31,16 +31,22 @@ class ValidMPTIssuance
     // MPToken by an issuer
     bool mptCreatedByIssuer_ = false;
 
-    /// sfReferenceHolding is intended to be set exactly once at vault
-    /// creation and immutable thereafter; true when that rule was violated.
+    /**
+     * sfReferenceHolding is intended to be set exactly once at vault
+     * creation and immutable thereafter; true when that rule was violated.
+     */
     bool referenceHoldingSetOnCreate_ = false;
 
-    /// True when sfReferenceHolding was mutated on an existing MPTokenIssuance.
+    /**
+     * True when sfReferenceHolding was mutated on an existing MPTokenIssuance.
+     */
     bool referenceHoldingMutated_ = false;
 
-    /// MPTokens and RippleStates deleted during apply. finalize() checks each
-    /// holder's AccountRoot to detect vault pseudo-account holdings deleted
-    /// outside VaultDelete. All these checks are gated on fixCleanup3_2_0.
+    /**
+     * MPTokens and RippleStates deleted during apply. finalize() checks each
+     * holder's AccountRoot to detect vault pseudo-account holdings deleted
+     * outside VaultDelete. All these checks are gated on fixCleanup3_2_0.
+     */
     std::vector<std::shared_ptr<SLE const>> deletedHoldings_;
 
 public:
diff --git a/include/xrpl/tx/invariants/VaultInvariant.h b/include/xrpl/tx/invariants/VaultInvariant.h
index bc8246b234..136c6c4a25 100644
--- a/include/xrpl/tx/invariants/VaultInvariant.h
+++ b/include/xrpl/tx/invariants/VaultInvariant.h
@@ -21,7 +21,7 @@
 
 namespace xrpl {
 
-/*
+/**
  * @brief Invariants: Vault object and MPTokenIssuance for vault shares
  *
  * - vault deleted and vault created is empty
@@ -96,7 +96,7 @@ private:
      *
      * @param vaultDelta Delta of the vault's asset balance for this transaction.
      * @param rules      Active ledger rules (used to check the amendment).
-     * @returns The minimum scale to apply when rounding vault-related amounts.
+     * @return The minimum scale to apply when rounding vault-related amounts.
      */
     [[nodiscard]] std::int32_t
     computeVaultMinScale(DeltaInfo const& vaultDelta, Rules const& rules) const;
@@ -109,7 +109,7 @@ private:
      * to the vault asset held by @p id.
      *
      * @param id Account whose asset delta is requested.
-     * @returns The delta, or @c std::nullopt if the entry was not touched.
+     * @return The delta, or @c std::nullopt if the entry was not touched.
      */
     [[nodiscard]] std::optional<DeltaInfo>
     deltaAssets(AccountID const& id) const;
@@ -124,8 +124,8 @@ private:
      *
      * @param tx  The transaction being applied.
      * @param fee Fee charged by this transaction.
-     * @returns The fee-adjusted delta, or @c std::nullopt if the net delta is
-     *          zero or the account entry was not touched.
+     * @return The fee-adjusted delta, or @c std::nullopt if the net delta is
+     *         zero or the account entry was not touched.
      */
     [[nodiscard]] std::optional<DeltaInfo>
     deltaAssetsTxAccount(STTx const& tx, XRPAmount fee) const;
@@ -138,7 +138,7 @@ private:
      * returned.
      *
      * @param id Account whose share delta is requested.
-     * @returns The delta, or @c std::nullopt if the entry was not touched.
+     * @return The delta, or @c std::nullopt if the entry was not touched.
      */
     [[nodiscard]] std::optional<DeltaInfo>
     deltaShares(AccountID const& id) const;
@@ -147,8 +147,8 @@ private:
      * @brief Check whether a vault holds no assets.
      *
      * @param vault Snapshot of the vault to test.
-     * @returns @c true when both @c assetsAvailable and @c assetsTotal are
-     *          zero.
+     * @return @c true when both @c assetsAvailable and @c assetsTotal are
+     *         zero.
      */
     [[nodiscard]] static bool
     isVaultEmpty(Vault const& vault);
diff --git a/include/xrpl/tx/paths/AMMLiquidity.h b/include/xrpl/tx/paths/AMMLiquidity.h
index bf62155b61..1904445554 100644
--- a/include/xrpl/tx/paths/AMMLiquidity.h
+++ b/include/xrpl/tx/paths/AMMLiquidity.h
@@ -17,7 +17,8 @@ namespace xrpl {
 template <StepAmount TIn, StepAmount TOut>
 class AMMOffer;
 
-/** AMMLiquidity class provides AMM offers to BookStep class.
+/**
+ * AMMLiquidity class provides AMM offers to BookStep class.
  * The offers are generated in two ways. If there are multiple
  * paths specified to the payment transaction then the offers
  * are generated based on the Fibonacci sequence with
@@ -59,7 +60,8 @@ public:
     AMMLiquidity&
     operator=(AMMLiquidity const&) = delete;
 
-    /** Generate AMM offer. Returns nullopt if clobQuality is provided
+    /**
+     * Generate AMM offer. Returns nullopt if clobQuality is provided
      * and it is better than AMM offer quality. Otherwise returns AMM offer.
      * If clobQuality is provided then AMM offer size is set based on the
      * quality.
@@ -104,12 +106,14 @@ public:
     }
 
 private:
-    /** Fetches current AMM balances.
+    /**
+     * Fetches current AMM balances.
      */
     [[nodiscard]] TAmounts<TIn, TOut>
     fetchBalances(ReadView const& view) const;
 
-    /** Generate AMM offers with the offer size based on Fibonacci sequence.
+    /**
+     * Generate AMM offers with the offer size based on Fibonacci sequence.
      * The sequence corresponds to the payment engine iterations with AMM
      * liquidity. Iterations that don't consume AMM offers don't count.
      * The number of iterations with AMM offers is limited.
@@ -119,7 +123,8 @@ private:
     [[nodiscard]] TAmounts<TIn, TOut>
     generateFibSeqOffer(TAmounts<TIn, TOut> const& balances) const;
 
-    /** Generate max offer.
+    /**
+     * Generate max offer.
      * If `fixAMMOverflowOffer` is active, the offer is generated as:
      * takerGets = 99% * balances.out takerPays = swapOut(takerGets).
      * Return nullopt if takerGets is 0 or takerGets == balances.out.
diff --git a/include/xrpl/tx/paths/AMMOffer.h b/include/xrpl/tx/paths/AMMOffer.h
index 6e7a5ceca5..8e7ffedc10 100644
--- a/include/xrpl/tx/paths/AMMOffer.h
+++ b/include/xrpl/tx/paths/AMMOffer.h
@@ -20,7 +20,8 @@ template <typename TIn, typename TOut>
 class AMMLiquidity;
 class QualityFunction;
 
-/** Represents synthetic AMM offer in BookStep. AMMOffer mirrors TOffer
+/**
+ * Represents synthetic AMM offer in BookStep. AMMOffer mirrors TOffer
  * methods for use in generic BookStep methods. AMMOffer amounts
  * are changed indirectly in BookStep limiting steps.
  */
@@ -87,14 +88,16 @@ public:
         return consumed_;
     }
 
-    /** Limit out of the provided offer. If one-path then swapOut
+    /**
+     * Limit out of the provided offer. If one-path then swapOut
      * using current balances. If multi-path then ceil_out using
      * current quality.
      */
     [[nodiscard]] TAmounts<TIn, TOut>
     limitOut(TAmounts<TIn, TOut> const& offerAmount, TOut const& limit, bool roundUp) const;
 
-    /** Limit in of the provided offer. If one-path then swapIn
+    /**
+     * Limit in of the provided offer. If one-path then swapIn
      * using current balances. If multi-path then ceil_in using
      * current quality.
      */
@@ -104,7 +107,8 @@ public:
     [[nodiscard]] QualityFunction
     getQualityFunc() const;
 
-    /** Send funds without incurring the transfer fee
+    /**
+     * Send funds without incurring the transfer fee
      */
     template <typename... Args>
     static TER
@@ -131,7 +135,8 @@ public:
         return {ofrInRate, QUALITY_ONE};
     }
 
-    /** Check the new pool product is greater or equal to the old pool
+    /**
+     * Check the new pool product is greater or equal to the old pool
      * product or if decreases then within some threshold.
      */
     [[nodiscard]] bool
diff --git a/include/xrpl/tx/paths/BookTip.h b/include/xrpl/tx/paths/BookTip.h
index bad007ca5b..0a7e3c343e 100644
--- a/include/xrpl/tx/paths/BookTip.h
+++ b/include/xrpl/tx/paths/BookTip.h
@@ -11,10 +11,11 @@ namespace xrpl {
 
 class Logs;
 
-/** Iterates and consumes raw offers in an order book.
-    Offers are presented from highest quality to lowest quality. This will
-    return all offers present including missing, invalid, unfunded, etc.
-*/
+/**
+ * Iterates and consumes raw offers in an order book.
+ * Offers are presented from highest quality to lowest quality. This will
+ * return all offers present including missing, invalid, unfunded, etc.
+ */
 class BookTip
 {
 private:
@@ -28,7 +29,9 @@ private:
     Quality quality_{};
 
 public:
-    /** Create the iterator. */
+    /**
+     * Create the iterator.
+     */
     BookTip(ApplyView& view, Book const& book);
 
     [[nodiscard]] uint256 const&
@@ -55,10 +58,11 @@ public:
         return entry_;
     }
 
-    /** Erases the current offer and advance to the next offer.
-        Complexity: Constant
-        @return `true` if there is a next offer
-    */
+    /**
+     * Erases the current offer and advance to the next offer.
+     * Complexity: Constant
+     * @return `true` if there is a next offer
+     */
     bool
     step(beast::Journal j);
 };
diff --git a/include/xrpl/tx/paths/Flow.h b/include/xrpl/tx/paths/Flow.h
index f73b9a3440..af056ce2fe 100644
--- a/include/xrpl/tx/paths/Flow.h
+++ b/include/xrpl/tx/paths/Flow.h
@@ -18,25 +18,25 @@ struct FlowDebugInfo;
 }  // namespace path::detail
 
 /**
-  Make a payment from the src account to the dst account
-
-  @param view Trust lines and balances
-  @param deliver Amount to deliver to the dst account
-  @param src Account providing input funds for the payment
-  @param dst Account receiving the payment
-  @param paths Set of paths to explore for liquidity
-  @param defaultPaths Include defaultPaths in the path set
-  @param partialPayment If the payment cannot deliver the entire
-           requested amount, deliver as much as possible, given the constraints
-  @param ownerPaysTransferFee If true then owner, not sender, pays fee
-  @param offerCrossing If Yes or Sell then flow is executing offer crossing, not
-  payments
-  @param limitQuality Do not use liquidity below this quality threshold
-  @param sendMax Do not spend more than this amount
-  @param j Journal to write journal messages to
-  @param flowDebugInfo If non-null a pointer to FlowDebugInfo for debugging
-  @return Actual amount in and out, and the result code
-*/
+ * Make a payment from the src account to the dst account
+ *
+ * @param view Trust lines and balances
+ * @param deliver Amount to deliver to the dst account
+ * @param src Account providing input funds for the payment
+ * @param dst Account receiving the payment
+ * @param paths Set of paths to explore for liquidity
+ * @param defaultPaths Include defaultPaths in the path set
+ * @param partialPayment If the payment cannot deliver the entire
+ *          requested amount, deliver as much as possible, given the constraints
+ * @param ownerPaysTransferFee If true then owner, not sender, pays fee
+ * @param offerCrossing If Yes or Sell then flow is executing offer crossing, not
+ * payments
+ * @param limitQuality Do not use liquidity below this quality threshold
+ * @param sendMax Do not spend more than this amount
+ * @param j Journal to write journal messages to
+ * @param flowDebugInfo If non-null a pointer to FlowDebugInfo for debugging
+ * @return Actual amount in and out, and the result code
+ */
 path::RippleCalc::Output
 flow(
     PaymentSandbox& view,
diff --git a/include/xrpl/tx/paths/Offer.h b/include/xrpl/tx/paths/Offer.h
index d7daa30cab..7f368fc2dd 100644
--- a/include/xrpl/tx/paths/Offer.h
+++ b/include/xrpl/tx/paths/Offer.h
@@ -44,38 +44,44 @@ public:
 
     TOffer(SLE::pointer entry, Quality quality);
 
-    /** Returns the quality of the offer.
-        Conceptually, the quality is the ratio of output to input currency.
-        The implementation calculates it as the ratio of input to output
-        currency (so it sorts ascending). The quality is computed at the time
-        the offer is placed, and never changes for the lifetime of the offer.
-        This is an important business rule that maintains accuracy when an
-        offer is partially filled; Subsequent partial fills will use the
-        original quality.
-    */
+    /**
+     * Returns the quality of the offer.
+     * Conceptually, the quality is the ratio of output to input currency.
+     * The implementation calculates it as the ratio of input to output
+     * currency (so it sorts ascending). The quality is computed at the time
+     * the offer is placed, and never changes for the lifetime of the offer.
+     * This is an important business rule that maintains accuracy when an
+     * offer is partially filled; Subsequent partial fills will use the
+     * original quality.
+     */
     [[nodiscard]] Quality
     quality() const noexcept
     {
         return quality_;
     }
 
-    /** Returns the account id of the offer's owner. */
+    /**
+     * Returns the account id of the offer's owner.
+     */
     [[nodiscard]] AccountID const&
     owner() const
     {
         return accountID_;
     }
 
-    /** Returns the in and out amounts.
-        Some or all of the out amount may be unfunded.
-    */
+    /**
+     * Returns the in and out amounts.
+     * Some or all of the out amount may be unfunded.
+     */
     [[nodiscard]] TAmounts<TIn, TOut> const&
     amount() const
     {
         return amounts_;
     }
 
-    /** Returns `true` if no more funds can flow through this offer. */
+    /**
+     * Returns `true` if no more funds can flow through this offer.
+     */
     [[nodiscard]] bool
     fullyConsumed() const
     {
@@ -86,7 +92,9 @@ public:
         return false;
     }
 
-    /** Adjusts the offer to indicate that we consumed some (or all) of it. */
+    /**
+     * Adjusts the offer to indicate that we consumed some (or all) of it.
+     */
     void
     consume(ApplyView& view, TAmounts<TIn, TOut> const& consumed)
     {
@@ -142,7 +150,8 @@ public:
         return {ofrInRate, ofrOutRate};
     }
 
-    /** Check any required invariant. Limit order book offer
+    /**
+     * Check any required invariant. Limit order book offer
      * always returns true.
      */
     [[nodiscard]] bool
diff --git a/include/xrpl/tx/paths/OfferStream.h b/include/xrpl/tx/paths/OfferStream.h
index 8ecd495d1a..28eefb5d66 100644
--- a/include/xrpl/tx/paths/OfferStream.h
+++ b/include/xrpl/tx/paths/OfferStream.h
@@ -85,10 +85,11 @@ public:
 
     virtual ~TOfferStreamBase() = default;
 
-    /** Returns the offer at the tip of the order book.
-        Offers are always presented in decreasing quality.
-        Only valid if step() returned `true`.
-    */
+    /**
+     * Returns the offer at the tip of the order book.
+     * Offers are always presented in decreasing quality.
+     * Only valid if step() returned `true`.
+     */
     [[nodiscard]] TOffer<TIn, TOut>&
     tip() const
     {
@@ -96,13 +97,14 @@ public:
         return const_cast<TOfferStreamBase*>(this)->offer_;
     }
 
-    /** Advance to the next valid offer.
-        This automatically removes:
-            - Offers with missing ledger entries
-            - Offers found unfunded
-            - expired offers
-        @return `true` if there is a valid offer.
-    */
+    /**
+     * Advance to the next valid offer.
+     * This automatically removes:
+     *     - Offers with missing ledger entries
+     *     - Offers found unfunded
+     *     - expired offers
+     * @return `true` if there is a valid offer.
+     */
     bool
     step();
 
@@ -114,23 +116,24 @@ public:
     }
 };
 
-/** Presents and consumes the offers in an order book.
-
-    The `view_' ` `ApplyView` accumulates changes to the ledger.
-    The `cancelView_` is used to determine if an offer is found
-    unfunded or became unfunded.
-    The `permToRemove` collection identifies offers that should be
-    removed even if the strand associated with this OfferStream
-    is not applied.
-
-    Certain invalid offers are added to the `permToRemove` collection:
-    - Offers with missing ledger entries
-    - Offers that expired
-    - Offers found unfunded:
-    An offer is found unfunded when the corresponding balance is zero
-    and the caller has not modified the balance. This is accomplished
-    by also looking up the balance in the cancel view.
-*/
+/**
+ * Presents and consumes the offers in an order book.
+ *
+ * The `view_' ` `ApplyView` accumulates changes to the ledger.
+ * The `cancelView_` is used to determine if an offer is found
+ * unfunded or became unfunded.
+ * The `permToRemove` collection identifies offers that should be
+ * removed even if the strand associated with this OfferStream
+ * is not applied.
+ *
+ * Certain invalid offers are added to the `permToRemove` collection:
+ * - Offers with missing ledger entries
+ * - Offers that expired
+ * - Offers found unfunded:
+ * An offer is found unfunded when the corresponding balance is zero
+ * and the caller has not modified the balance. This is accomplished
+ * by also looking up the balance in the cancel view.
+ */
 template <StepAmount TIn, StepAmount TOut>
 class FlowOfferStream : public TOfferStreamBase<TIn, TOut>
 {
diff --git a/include/xrpl/tx/paths/RippleCalc.h b/include/xrpl/tx/paths/RippleCalc.h
index 62c966d384..c3ee9165a6 100644
--- a/include/xrpl/tx/paths/RippleCalc.h
+++ b/include/xrpl/tx/paths/RippleCalc.h
@@ -20,11 +20,12 @@ namespace detail {
 struct FlowDebugInfo;
 }  // namespace detail
 
-/** RippleCalc calculates the quality of a payment path.
-
-    Quality is the amount of input required to produce a given output along a
-    specified path - another name for this is exchange rate.
-*/
+/**
+ * RippleCalc calculates the quality of a payment path.
+ *
+ * Quality is the amount of input required to produce a given output along a
+ * specified path - another name for this is exchange rate.
+ */
 class RippleCalc
 {
 public:
diff --git a/include/xrpl/tx/paths/detail/FlatSets.h b/include/xrpl/tx/paths/detail/FlatSets.h
index c0fc8fa417..267c0499a2 100644
--- a/include/xrpl/tx/paths/detail/FlatSets.h
+++ b/include/xrpl/tx/paths/detail/FlatSets.h
@@ -4,11 +4,12 @@
 
 namespace xrpl {
 
-/** Given two flat sets dst and src, compute dst = dst union src
-
-    @param dst set to store the resulting union, and also a source of elements
-   for the union
-    @param src second source of elements for the union
+/**
+ * Given two flat sets dst and src, compute dst = dst union src
+ *
+ * @param dst set to store the resulting union, and also a source of elements
+ * for the union
+ * @param src second source of elements for the union
  */
 template <class T>
 void
diff --git a/include/xrpl/tx/paths/detail/Steps.h b/include/xrpl/tx/paths/detail/Steps.h
index 7eb6b938a5..8ee37c026c 100644
--- a/include/xrpl/tx/paths/detail/Steps.h
+++ b/include/xrpl/tx/paths/detail/Steps.h
@@ -50,31 +50,31 @@ issues(DebtDirection dir)
 }
 
 /**
-   A step in a payment path
-
-   There are five concrete step classes:
-     DirectStepI is an IOU step between accounts
-     BookStepII is an IOU/IOU offer book
-     BookStepIX is an IOU/XRP offer book
-     BookStepXI is an XRP/IOU offer book
-     XRPEndpointStep is the source or destination account for XRP
-     MPTEndpointStep is the source or destination account for MPT
-
-   Amounts may be transformed through a step in either the forward or the
-   reverse direction. In the forward direction, the function `fwd` is used to
-   find the amount the step would output given an input amount. In the reverse
-   direction, the function `rev` is used to find the amount of input needed to
-   produce the desired output.
-
-   Amounts are always transformed using liquidity with the same quality (quality
-   is the amount out/amount in). For example, a BookStep may use multiple offers
-   when executing `fwd` or `rev`, but all those offers will be from the same
-   quality directory.
-
-   A step may not have enough liquidity to transform the entire requested
-   amount. Both `fwd` and `rev` return a pair of amounts (one for input amount,
-   one for output amount) that show how much of the requested amount the step
-   was actually able to use.
+ * A step in a payment path
+ *
+ * There are five concrete step classes:
+ *   DirectStepI is an IOU step between accounts
+ *   BookStepII is an IOU/IOU offer book
+ *   BookStepIX is an IOU/XRP offer book
+ *   BookStepXI is an XRP/IOU offer book
+ *   XRPEndpointStep is the source or destination account for XRP
+ *   MPTEndpointStep is the source or destination account for MPT
+ *
+ * Amounts may be transformed through a step in either the forward or the
+ * reverse direction. In the forward direction, the function `fwd` is used to
+ * find the amount the step would output given an input amount. In the reverse
+ * direction, the function `rev` is used to find the amount of input needed to
+ * produce the desired output.
+ *
+ * Amounts are always transformed using liquidity with the same quality (quality
+ * is the amount out/amount in). For example, a BookStep may use multiple offers
+ * when executing `fwd` or `rev`, but all those offers will be from the same
+ * quality directory.
+ *
+ * A step may not have enough liquidity to transform the entire requested
+ * amount. Both `fwd` and `rev` return a pair of amounts (one for input amount,
+ * one for output amount) that show how much of the requested amount the step
+ * was actually able to use.
  */
 class Step
 {
@@ -82,17 +82,17 @@ public:
     virtual ~Step() = default;
 
     /**
-       Find the amount we need to put into the step to get the requested out
-       subject to liquidity limits
-
-       @param sb view with the strand's state of balances and offers
-       @param afView view the state of balances before the strand runs
-              this determines if an offer becomes unfunded or is found unfunded
-       @param ofrsToRm offers found unfunded or in an error state are added to
-       this collection
-       @param out requested step output
-       @return actual step input and output
-    */
+     * Find the amount we need to put into the step to get the requested out
+     * subject to liquidity limits
+     *
+     * @param sb view with the strand's state of balances and offers
+     * @param afView view the state of balances before the strand runs
+     *        this determines if an offer becomes unfunded or is found unfunded
+     * @param ofrsToRm offers found unfunded or in an error state are added to
+     * this collection
+     * @param out requested step output
+     * @return actual step input and output
+     */
     virtual std::pair<EitherAmount, EitherAmount>
     rev(PaymentSandbox& sb,
         ApplyView& afView,
@@ -100,17 +100,17 @@ public:
         EitherAmount const& out) = 0;
 
     /**
-       Find the amount we get out of the step given the input
-       subject to liquidity limits
-
-       @param sb view with the strand's state of balances and offers
-       @param afView view the state of balances before the strand runs
-              this determines if an offer becomes unfunded or is found unfunded
-       @param ofrsToRm offers found unfunded or in an error state are added to
-       this collection
-       @param in requested step input
-       @return actual step input and output
-    */
+     * Find the amount we get out of the step given the input
+     * subject to liquidity limits
+     *
+     * @param sb view with the strand's state of balances and offers
+     * @param afView view the state of balances before the strand runs
+     *        this determines if an offer becomes unfunded or is found unfunded
+     * @param ofrsToRm offers found unfunded or in an error state are added to
+     * this collection
+     * @param in requested step input
+     * @return actual step input and output
+     */
     virtual std::pair<EitherAmount, EitherAmount>
     fwd(PaymentSandbox& sb,
         ApplyView& afView,
@@ -118,23 +118,23 @@ public:
         EitherAmount const& in) = 0;
 
     /**
-       Amount of currency computed coming into the Step the last time the
-       step ran in reverse.
-    */
+     * Amount of currency computed coming into the Step the last time the
+     * step ran in reverse.
+     */
     [[nodiscard]] virtual std::optional<EitherAmount>
     cachedIn() const = 0;
 
     /**
-       Amount of currency computed coming out of the Step the last time the
-       step ran in reverse.
-    */
+     * Amount of currency computed coming out of the Step the last time the
+     * step ran in reverse.
+     */
     [[nodiscard]] virtual std::optional<EitherAmount>
     cachedOut() const = 0;
 
     /**
-       If this step is DirectStepI (IOU->IOU direct step), return the src
-       account. This is needed for checkNoRipple.
-    */
+     * If this step is DirectStepI (IOU->IOU direct step), return the src
+     * account. This is needed for checkNoRipple.
+     */
     [[nodiscard]] virtual std::optional<AccountID>
     directStepSrcAcct() const
     {
@@ -150,19 +150,19 @@ public:
     }
 
     /**
-       If this step is a DirectStepI and the src redeems to the dst, return
-       true, otherwise return false. If this step is a BookStep, return false if
-       the owner pays the transfer fee, otherwise return true.
-
-       @param sb view with the strand's state of balances and offers
-       @param dir reverse -> called from rev(); forward -> called from fwd().
-    */
+     * If this step is a DirectStepI and the src redeems to the dst, return
+     * true, otherwise return false. If this step is a BookStep, return false if
+     * the owner pays the transfer fee, otherwise return true.
+     *
+     * @param sb view with the strand's state of balances and offers
+     * @param dir reverse -> called from rev(); forward -> called from fwd().
+     */
     [[nodiscard]] virtual DebtDirection
     debtDirection(ReadView const& sb, StrandDirection dir) const = 0;
 
     /**
-        If this step is a DirectStepI, return the quality in of the dst account.
-    */
+     * If this step is a DirectStepI, return the quality in of the dst account.
+     */
     [[nodiscard]] virtual std::uint32_t
     lineQualityIn(ReadView const&) const
     {
@@ -170,22 +170,23 @@ public:
     }
 
     /**
-       Find an upper bound of quality for the step
-
-       @param v view to query the ledger state from
-       @param prevStepDir Set to DebtDirection::redeems if the previous step redeems.
-       @return A pair. The first element is the upper bound of quality for the step, or std::nullopt
-               if the step is dry. The second element will be set to DebtDirection::redeems if this
-               steps redeems, DebtDirection:issues if this step issues.
-       @note It is an upper bound because offers on the books may be unfunded. If there is always a
-             funded offer at the tip of the book, then we could rename this `theoreticalQuality`
-             rather than `qualityUpperBound`. It could still differ from the actual quality, but
-             except for "dust" amounts, it should be a good estimate for the actual quality.
-    */
+     * Find an upper bound of quality for the step
+     *
+     * @param v view to query the ledger state from
+     * @param prevStepDir Set to DebtDirection::redeems if the previous step redeems.
+     * @return A pair. The first element is the upper bound of quality for the step, or std::nullopt
+     *         if the step is dry. The second element will be set to DebtDirection::redeems if this
+     *         steps redeems, DebtDirection:issues if this step issues.
+     * @note It is an upper bound because offers on the books may be unfunded. If there is always a
+     *       funded offer at the tip of the book, then we could rename this `theoreticalQuality`
+     *       rather than `qualityUpperBound`. It could still differ from the actual quality, but
+     *       except for "dust" amounts, it should be a good estimate for the actual quality.
+     */
     [[nodiscard]] virtual std::pair<std::optional<Quality>, DebtDirection>
     qualityUpperBound(ReadView const& v, DebtDirection prevStepDir) const = 0;
 
-    /** Get QualityFunction. Used in one path optimization where
+    /**
+     * Get QualityFunction. Used in one path optimization where
      * the quality function is non-constant (has AMM) and there is
      * limitQuality. QualityFunction allows calculation of
      * required path output given requested limitQuality.
@@ -195,12 +196,13 @@ public:
     [[nodiscard]] virtual std::pair<std::optional<QualityFunction>, DebtDirection>
     getQualityFunc(ReadView const& v, DebtDirection prevStepDir) const;
 
-    /** Return the number of offers consumed or partially consumed the last time
-        the step ran, including expired and unfunded offers.
-
-        N.B. This this not the total number offers consumed by this step for the
-        entire payment, it is only the number the last time it ran. Offers may
-        be partially consumed multiple times during a payment.
+    /**
+     * Return the number of offers consumed or partially consumed the last time
+     * the step ran, including expired and unfunded offers.
+     *
+     * N.B. This this not the total number offers consumed by this step for the
+     * entire payment, it is only the number the last time it ran. Offers may
+     * be partially consumed multiple times during a payment.
      */
     [[nodiscard]] virtual std::uint32_t
     offersUsed() const
@@ -209,8 +211,8 @@ public:
     }
 
     /**
-       If this step is a BookStep, return the book.
-    */
+     * If this step is a BookStep, return the book.
+     */
     [[nodiscard]] virtual std::optional<Book>
     bookStepBook() const
     {
@@ -218,15 +220,15 @@ public:
     }
 
     /**
-       Check if amount is zero
-    */
+     * Check if amount is zero
+     */
     [[nodiscard]] virtual bool
     isZero(EitherAmount const& out) const = 0;
 
     /**
-       Return true if the step should be considered inactive.
-       A strand that has additional liquidity may be marked inactive if a step
-       has consumed too many offers.
+     * Return true if the step should be considered inactive.
+     * A strand that has additional liquidity may be marked inactive if a step
+     * has consumed too many offers.
      */
     [[nodiscard]] virtual bool
     inactive() const
@@ -235,55 +237,59 @@ public:
     }
 
     /**
-       Return true if Out of lhs == Out of rhs.
-    */
+     * Return true if Out of lhs == Out of rhs.
+     */
     [[nodiscard]] virtual bool
     equalOut(EitherAmount const& lhs, EitherAmount const& rhs) const = 0;
 
     /**
-       Return true if In of lhs == In of rhs.
-    */
+     * Return true if In of lhs == In of rhs.
+     */
     [[nodiscard]] virtual bool
     equalIn(EitherAmount const& lhs, EitherAmount const& rhs) const = 0;
 
     /**
-       Check that the step can correctly execute in the forward direction
-
-       @param sb view with the strands state of balances and offers
-       @param afView view the state of balances before the strand runs
-       this determines if an offer becomes unfunded or is found unfunded
-       @param in requested step input
-       @return first element is true if step is valid, second element is out
-       amount
-    */
+     * Check that the step can correctly execute in the forward direction
+     *
+     * @param sb view with the strands state of balances and offers
+     * @param afView view the state of balances before the strand runs
+     * this determines if an offer becomes unfunded or is found unfunded
+     * @param in requested step input
+     * @return first element is true if step is valid, second element is out
+     * amount
+     */
     virtual std::pair<bool, EitherAmount>
     validFwd(PaymentSandbox& sb, ApplyView& afView, EitherAmount const& in) = 0;
 
-    /** Return true if lhs == rhs.
-
-        @param lhs Step to compare.
-        @param rhs Step to compare.
-        @return true if lhs == rhs.
-    */
+    /**
+     * Return true if lhs == rhs.
+     *
+     * @param lhs Step to compare.
+     * @param rhs Step to compare.
+     * @return true if lhs == rhs.
+     */
     friend bool
     operator==(Step const& lhs, Step const& rhs)
     {
         return lhs.equal(rhs);
     }
 
-    /** Return true if lhs != rhs.
-
-        @param lhs Step to compare.
-        @param rhs Step to compare.
-        @return true if lhs != rhs.
-    */
+    /**
+     * Return true if lhs != rhs.
+     *
+     * @param lhs Step to compare.
+     * @param rhs Step to compare.
+     * @return true if lhs != rhs.
+     */
     friend bool
     operator!=(Step const& lhs, Step const& rhs)
     {
         return !(lhs == rhs);
     }
 
-    /** Streaming operator for a Step. */
+    /**
+     * Streaming operator for a Step.
+     */
     friend std::ostream&
     operator<<(std::ostream& stream, Step const& step)
     {
@@ -308,7 +314,7 @@ Step::getQualityFunc(ReadView const& v, DebtDirection prevStepDir) const
     return {std::nullopt, res.second};
 }
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 using Strand = std::vector<std::unique_ptr<Step>>;
 
 inline std::uint32_t
@@ -322,9 +328,9 @@ offersUsed(Strand const& strand)
     }
     return r;
 }
-/// @endcond
+/** @endcond */
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 inline bool
 operator==(Strand const& lhs, Strand const& rhs)
 {
@@ -337,21 +343,21 @@ operator==(Strand const& lhs, Strand const& rhs)
     }
     return true;
 }
-/// @endcond
+/** @endcond */
 
-/*
-   Normalize a path by inserting implied accounts and offers
-
-   @param src Account that is sending assets
-   @param dst Account that is receiving assets
-   @param deliver Asset the dst account will receive
-   (if issuer of deliver == dst, then accept any issuer)
-   @param sendMax Optional asset to send.
-   @param path Liquidity sources to use for this strand of the payment. The path
-               contains an ordered collection of the offer books to use and
-               accounts to ripple through.
-   @return error code and normalized path
-*/
+/**
+ * Normalize a path by inserting implied accounts and offers
+ *
+ * @param src Account that is sending assets
+ * @param dst Account that is receiving assets
+ * @param deliver Asset the dst account will receive
+ * (if issuer of deliver == dst, then accept any issuer)
+ * @param sendMax Optional asset to send.
+ * @param path Liquidity sources to use for this strand of the payment. The path
+ *             contains an ordered collection of the offer books to use and
+ *             accounts to ripple through.
+ * @return error code and normalized path
+ */
 std::pair<TER, STPath>
 normalizePath(
     AccountID const& src,
@@ -361,29 +367,29 @@ normalizePath(
     STPath const& path);
 
 /**
-   Create a Strand for the specified path
-
-   @param sb view for trust lines, balances, and attributes like auth and freeze
-   @param src Account that is sending assets
-   @param dst Account that is receiving assets
-   @param deliver Asset the dst account will receive
-                  (if issuer of deliver == dst, then accept any issuer)
-   @param limitQuality Offer crossing BookSteps use this value in an
-                       optimization.  If, during direct offer crossing, the
-                       quality of the tip of the book drops below this value,
-                       then evaluating the strand can stop.
-   @param sendMaxAsset Optional asset to send.
-   @param path Liquidity sources to use for this strand of the payment. The path
-               contains an ordered collection of the offer books to use and
-               accounts to ripple through.
-   @param ownerPaysTransferFee false -> charge sender; true -> charge offer
-   owner
-   @param offerCrossing false -> payment; true -> offer crossing
-   @param ammContext counts iterations with AMM offers
-   @param domainID the domain that order books will use
-   @param j Journal for logging messages
-   @return Error code and constructed Strand
-*/
+ * Create a Strand for the specified path
+ *
+ * @param sb view for trust lines, balances, and attributes like auth and freeze
+ * @param src Account that is sending assets
+ * @param dst Account that is receiving assets
+ * @param deliver Asset the dst account will receive
+ *                (if issuer of deliver == dst, then accept any issuer)
+ * @param limitQuality Offer crossing BookSteps use this value in an
+ *                     optimization.  If, during direct offer crossing, the
+ *                     quality of the tip of the book drops below this value,
+ *                     then evaluating the strand can stop.
+ * @param sendMaxAsset Optional asset to send.
+ * @param path Liquidity sources to use for this strand of the payment. The path
+ *             contains an ordered collection of the offer books to use and
+ *             accounts to ripple through.
+ * @param ownerPaysTransferFee false -> charge sender; true -> charge offer
+ * owner
+ * @param offerCrossing false -> payment; true -> offer crossing
+ * @param ammContext counts iterations with AMM offers
+ * @param domainID the domain that order books will use
+ * @param j Journal for logging messages
+ * @return Error code and constructed Strand
+ */
 std::pair<TER, Strand>
 toStrand(
     ReadView const& sb,
@@ -400,31 +406,31 @@ toStrand(
     beast::Journal j);
 
 /**
-   Create a Strand for each specified path (including the default path, if
-   indicated)
-
-   @param sb View for trust lines, balances, and attributes like auth and freeze
-   @param src Account that is sending assets
-   @param dst Account that is receiving assets
-   @param deliver Asset the dst account will receive
-                  (if issuer of deliver == dst, then accept any issuer)
-   @param limitQuality Offer crossing BookSteps use this value in an
-                       optimization.  If, during direct offer crossing, the
-                       quality of the tip of the book drops below this value,
-                       then evaluating the strand can stop.
-   @param sendMax Optional asset to send.
-   @param paths Paths to use to fulfill the payment. Each path in the pathset
-                contains an ordered collection of the offer books to use and
-                accounts to ripple through.
-   @param addDefaultPath Determines if the default path should be included
-   @param ownerPaysTransferFee false -> charge sender; true -> charge offer
-   owner
-   @param offerCrossing false -> payment; true -> offer crossing
-   @param ammContext counts iterations with AMM offers
-   @param domainID the domain that order books will use
-   @param j Journal for logging messages
-   @return error code and collection of strands
-*/
+ * Create a Strand for each specified path (including the default path, if
+ * indicated)
+ *
+ * @param sb View for trust lines, balances, and attributes like auth and freeze
+ * @param src Account that is sending assets
+ * @param dst Account that is receiving assets
+ * @param deliver Asset the dst account will receive
+ *                (if issuer of deliver == dst, then accept any issuer)
+ * @param limitQuality Offer crossing BookSteps use this value in an
+ *                     optimization.  If, during direct offer crossing, the
+ *                     quality of the tip of the book drops below this value,
+ *                     then evaluating the strand can stop.
+ * @param sendMax Optional asset to send.
+ * @param paths Paths to use to fulfill the payment. Each path in the pathset
+ *              contains an ordered collection of the offer books to use and
+ *              accounts to ripple through.
+ * @param addDefaultPath Determines if the default path should be included
+ * @param ownerPaysTransferFee false -> charge sender; true -> charge offer
+ * owner
+ * @param offerCrossing false -> payment; true -> offer crossing
+ * @param ammContext counts iterations with AMM offers
+ * @param domainID the domain that order books will use
+ * @param j Journal for logging messages
+ * @return error code and collection of strands
+ */
 std::pair<TER, std::vector<Strand>>
 toStrands(
     ReadView const& sb,
@@ -441,7 +447,7 @@ toStrands(
     std::optional<uint256> const& domainID,
     beast::Journal j);
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 template <StepAmount TIn, StepAmount TOut, class TDerived>
 struct StepImp : public Step
 {
@@ -490,9 +496,9 @@ public:
     }
     friend TDerived;
 };
-/// @endcond
+/** @endcond */
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 // Thrown when unexpected errors occur
 class FlowException : public std::runtime_error
 {
@@ -507,9 +513,9 @@ public:
     {
     }
 };
-/// @endcond
+/** @endcond */
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 // Check equal with tolerance
 bool
 checkNear(IOUAmount const& expected, IOUAmount const& actual);
@@ -523,10 +529,10 @@ checkNear(XRPAmount const& expected, XRPAmount const& actual)
 {
     return expected == actual;
 }
-/// @endcond
+/** @endcond */
 
 /**
-   Context needed to build Strand Steps and for error checking
+ * Context needed to build Strand Steps and for error checking
  */
 struct StrandContext
 {
@@ -541,25 +547,30 @@ struct StrandContext
     OfferCrossing const offerCrossing;          ///< Yes/Sell if offer crossing, not payment
     bool const isDefaultPath;                   ///< true if Strand is default path
     size_t const strandSize;                    ///< Length of Strand
-    /** The previous step in the strand. Needed to check the no ripple
-        constraint
+    /**
+     * The previous step in the strand. Needed to check the no ripple
+     * constraint
      */
     Step const* const prevStep = nullptr;
-    /** A strand may not include the same account node more than once
-        in the same currency. In a direct step, an account will show up
-        at most twice: once as a src and once as a dst (hence the two element
-       array). The strandSrc and strandDst will only show up once each.
-    */
+    /**
+     * A strand may not include the same account node more than once
+     *  in the same currency. In a direct step, an account will show up
+     *  at most twice: once as a src and once as a dst (hence the two element
+     * array). The strandSrc and strandDst will only show up once each.
+     */
     std::array<boost::container::flat_set<Asset>, 2>& seenDirectAssets;
-    /** A strand may not include an offer that output the same issue more
-        than once
-    */
+    /**
+     * A strand may not include an offer that output the same issue more
+     * than once
+     */
     boost::container::flat_set<Asset>& seenBookOuts;
     AMMContext& ammContext;
     std::optional<uint256> domainID;  // the domain the order book will use
     beast::Journal const j;
 
-    /** StrandContext constructor. */
+    /**
+     * StrandContext constructor.
+     */
     StrandContext(
         ReadView const& view,
         std::vector<std::unique_ptr<Step>> const& strand,
@@ -581,7 +592,7 @@ struct StrandContext
         beast::Journal j);  ///< Journal for logging
 };
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 namespace test {
 // Needed for testing
 bool
@@ -659,6 +670,6 @@ isDirectXrpToXrp(Strand const& strand)
         return false;
     }
 }
-/// @endcond
+/** @endcond */
 
 }  // namespace xrpl
diff --git a/include/xrpl/tx/paths/detail/StrandFlow.h b/include/xrpl/tx/paths/detail/StrandFlow.h
index fe657b2100..c932c49cca 100644
--- a/include/xrpl/tx/paths/detail/StrandFlow.h
+++ b/include/xrpl/tx/paths/detail/StrandFlow.h
@@ -39,7 +39,9 @@
 
 namespace xrpl {
 
-/** Result of flow() execution of a single Strand. */
+/**
+ * Result of flow() execution of a single Strand.
+ */
 template <class TInAmt, class TOutAmt>
 struct StrandResult
 {
@@ -56,7 +58,9 @@ struct StrandResult
     bool inactive = false;  ///< Strand should not considered as a further
                             ///< source of liquidity (dry)
 
-    /** Strand result constructor */
+    /**
+     * Strand result constructor
+     */
     StrandResult() = default;
 
     StrandResult(
@@ -83,15 +87,15 @@ struct StrandResult
 };
 
 /**
-   Request `out` amount from a strand
-
-   @param baseView Trust lines and balances
-   @param strand Steps of Accounts to ripple through and offer books to use
-   @param maxIn Max amount of input allowed
-   @param out Amount of output requested from the strand
-   @param j Journal to write log messages to
-   @return Actual amount in and out from the strand, errors, offers to remove,
-           and payment sandbox
+ * Request `out` amount from a strand
+ *
+ * @param baseView Trust lines and balances
+ * @param strand Steps of Accounts to ripple through and offer books to use
+ * @param maxIn Max amount of input allowed
+ * @param out Amount of output requested from the strand
+ * @param j Journal to write log messages to
+ * @return Actual amount in and out from the strand, errors, offers to remove,
+ *         and payment sandbox
  */
 template <class TInAmt, class TOutAmt>
 StrandResult<TInAmt, TOutAmt>
@@ -296,7 +300,7 @@ flow(
     }
 }
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 template <class TInAmt, class TOutAmt>
 struct FlowResult
 {
@@ -335,9 +339,9 @@ struct FlowResult
     {
     }
 };
-/// @endcond
+/** @endcond */
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 inline std::optional<Quality>
 qualityUpperBound(ReadView const& v, Strand const& strand)
 {
@@ -357,10 +361,11 @@ qualityUpperBound(ReadView const& v, Strand const& strand)
     }
     return q;
 };
-/// @endcond
+/** @endcond */
 
-/// @cond INTERNAL
-/** Limit remaining out only if one strand and limitQuality is included.
+/** @cond INTERNAL */
+/**
+ * Limit remaining out only if one strand and limitQuality is included.
  * Targets one path payment with AMM where the average quality is linear
  * and instant quality is quadratic function of output. Calculating quality
  * function for the whole strand enables figuring out required output
@@ -428,9 +433,9 @@ limitOut(
         return remainingOut;
     return std::min(out, remainingOut);
 };
-/// @endcond
+/** @endcond */
 
-/// @cond INTERNAL
+/** @cond INTERNAL */
 /* Track the non-dry strands
 
    flow will search the non-dry strands (stored in `cur_`) for the best
@@ -545,28 +550,28 @@ public:
         return cur_.size();
     }
 };
-/// @endcond
+/** @endcond */
 
 /**
-   Request `out` amount from a collection of strands
-
-   Attempt to fulfill the payment by using liquidity from the strands in order
-   from least expensive to most expensive
-
-   @param baseView Trust lines and balances
-   @param strands Each strand contains the steps of accounts to ripple through
-                  and offer books to use
-   @param outReq Amount of output requested from the strand
-   @param partialPayment If true allow less than the full payment
-   @param offerCrossing If true offer crossing, not handling a standard payment
-   @param limitQuality If present, the minimum quality for any strand taken
-   @param sendMaxST If present, the maximum STAmount to send
-   @param j Journal to write journal messages to
-   @param ammContext counts iterations with AMM offers
-   @param flowDebugInfo If pointer is non-null, write flow debug info here
-   @return Actual amount in and out from the strands, errors, and payment
-   sandbox
-*/
+ * Request `out` amount from a collection of strands
+ *
+ * Attempt to fulfill the payment by using liquidity from the strands in order
+ * from least expensive to most expensive
+ *
+ * @param baseView Trust lines and balances
+ * @param strands Each strand contains the steps of accounts to ripple through
+ *                and offer books to use
+ * @param outReq Amount of output requested from the strand
+ * @param partialPayment If true allow less than the full payment
+ * @param offerCrossing If true offer crossing, not handling a standard payment
+ * @param limitQuality If present, the minimum quality for any strand taken
+ * @param sendMaxST If present, the maximum STAmount to send
+ * @param j Journal to write journal messages to
+ * @param ammContext counts iterations with AMM offers
+ * @param flowDebugInfo If pointer is non-null, write flow debug info here
+ * @return Actual amount in and out from the strands, errors, and payment
+ * sandbox
+ */
 template <StepAmount TInAmt, StepAmount TOutAmt>
 FlowResult<TInAmt, TOutAmt>
 flow(
diff --git a/include/xrpl/tx/transactors/account/SignerListSet.h b/include/xrpl/tx/transactors/account/SignerListSet.h
index da2274a1de..9f7872a18e 100644
--- a/include/xrpl/tx/transactors/account/SignerListSet.h
+++ b/include/xrpl/tx/transactors/account/SignerListSet.h
@@ -20,9 +20,9 @@
 namespace xrpl {
 
 /**
-See the README.md for an overview of the SignerListSet transaction that
-this class implements.
-*/
+ * See the README.md for an overview of the SignerListSet transaction that
+ * this class implements.
+ */
 class SignerListSet : public Transactor
 {
 private:
diff --git a/include/xrpl/tx/transactors/dex/AMMBid.h b/include/xrpl/tx/transactors/dex/AMMBid.h
index fa257696e8..9d8eb8578b 100644
--- a/include/xrpl/tx/transactors/dex/AMMBid.h
+++ b/include/xrpl/tx/transactors/dex/AMMBid.h
@@ -11,7 +11,8 @@
 
 namespace xrpl {
 
-/** AMMBid implements AMM bid Transactor.
+/**
+ * AMMBid implements AMM bid Transactor.
  * This is a mechanism for an AMM instance to auction-off
  * the trading advantages to users (arbitrageurs) at a discounted
  * TradingFee for a 24 hour slot. Any account that owns corresponding
diff --git a/include/xrpl/tx/transactors/dex/AMMClawback.h b/include/xrpl/tx/transactors/dex/AMMClawback.h
index 54eb3c9f27..3f3f2c421a 100644
--- a/include/xrpl/tx/transactors/dex/AMMClawback.h
+++ b/include/xrpl/tx/transactors/dex/AMMClawback.h
@@ -56,7 +56,8 @@ private:
     TER
     applyGuts(Sandbox& view);
 
-    /** Withdraw both assets by providing maximum amount of asset1,
+    /**
+     * Withdraw both assets by providing maximum amount of asset1,
      * asset2's amount will be calculated according to the current proportion.
      * Since it is two-asset withdrawal, tfee is omitted.
      * @param view
diff --git a/include/xrpl/tx/transactors/dex/AMMContext.h b/include/xrpl/tx/transactors/dex/AMMContext.h
index 65954044be..b878e4f10b 100644
--- a/include/xrpl/tx/transactors/dex/AMMContext.h
+++ b/include/xrpl/tx/transactors/dex/AMMContext.h
@@ -6,7 +6,8 @@
 
 namespace xrpl {
 
-/** Maintains AMM info per overall payment engine execution and
+/**
+ * Maintains AMM info per overall payment engine execution and
  * individual iteration.
  * Only one instance of this class is created in Flow.cpp::flow().
  * The reference is percolated through calls to AMMLiquidity class,
@@ -84,7 +85,8 @@ public:
         return accountID_;
     }
 
-    /** Strand execution may fail. Reset the flag at the start
+    /**
+     * Strand execution may fail. Reset the flag at the start
      * of each payment engine iteration.
      */
     void
diff --git a/include/xrpl/tx/transactors/dex/AMMCreate.h b/include/xrpl/tx/transactors/dex/AMMCreate.h
index 188af8d4ef..5260cf31cd 100644
--- a/include/xrpl/tx/transactors/dex/AMMCreate.h
+++ b/include/xrpl/tx/transactors/dex/AMMCreate.h
@@ -11,34 +11,35 @@
 
 namespace xrpl {
 
-/** AMMCreate implements Automatic Market Maker(AMM) creation Transactor.
- *  It creates a new AMM instance with two tokens. Any trader, or Liquidity
- *  Provider (LP), can create the AMM instance and receive in return shares
- *  of the AMM pool in the form of LPTokens. The number of tokens that LP gets
- *  are determined by LPTokens = sqrt(A * B), where A and B is the current
- *  composition of the AMM pool. LP can add (AMMDeposit) or withdraw
- *  (AMMWithdraw) tokens from AMM and
- *  AMM can be used transparently in the payment or offer crossing transactions.
- *  Trading fee is charged to the traders for the trades executed against
- *  AMM instance. The fee is added to the AMM pool and distributed to the LPs
- *  in proportion to the LPTokens upon liquidity removal. The fee can be voted
- *  on by LP's (AMMVote). LP's can continuously bid (AMMBid) for the 24 hour
- *  auction slot, which enables LP's to trade at zero trading fee.
- *  AMM instance creates AccountRoot object with disabled master key
- *  for book-keeping of XRP balance if one of the tokens
- *  is XRP, a trustline for each IOU token, a trustline to keep track
- *  of LPTokens, and ltAMM ledger object. AccountRoot ID is generated
- *  internally from the parent's hash. ltAMM's object ID is
+/**
+ * AMMCreate implements Automatic Market Maker(AMM) creation Transactor.
+ * It creates a new AMM instance with two tokens. Any trader, or Liquidity
+ * Provider (LP), can create the AMM instance and receive in return shares
+ * of the AMM pool in the form of LPTokens. The number of tokens that LP gets
+ * are determined by LPTokens = sqrt(A * B), where A and B is the current
+ * composition of the AMM pool. LP can add (AMMDeposit) or withdraw
+ * (AMMWithdraw) tokens from AMM and
+ * AMM can be used transparently in the payment or offer crossing transactions.
+ * Trading fee is charged to the traders for the trades executed against
+ * AMM instance. The fee is added to the AMM pool and distributed to the LPs
+ * in proportion to the LPTokens upon liquidity removal. The fee can be voted
+ * on by LP's (AMMVote). LP's can continuously bid (AMMBid) for the 24 hour
+ * auction slot, which enables LP's to trade at zero trading fee.
+ * AMM instance creates AccountRoot object with disabled master key
+ * for book-keeping of XRP balance if one of the tokens
+ * is XRP, a trustline for each IOU token, a trustline to keep track
+ * of LPTokens, and ltAMM ledger object. AccountRoot ID is generated
+ * internally from the parent's hash. ltAMM's object ID is
  * hash{token1.currency, token1.issuer, token2.currency, token2.issuer}, where
  * issue1 < issue2. ltAMM object provides mapping from the hash to AccountRoot
  * ID and contains: AMMAccount - AMM AccountRoot ID. TradingFee - AMM voted
  * TradingFee. VoteSlots - Array of VoteEntry, contains fee vote information.
- *  AuctionSlot - Auction slot, contains discounted fee bid information.
- *  LPTokenBalance - LPTokens outstanding balance.
- *  AMMToken - currency/issuer information for AMM tokens.
- *  AMMDeposit, AMMWithdraw, AMMVote, and AMMBid transactions use the hash
- *  to access AMM instance.
- *  @see [XLS30d:Creating AMM instance on
+ * AuctionSlot - Auction slot, contains discounted fee bid information.
+ * LPTokenBalance - LPTokens outstanding balance.
+ * AMMToken - currency/issuer information for AMM tokens.
+ * AMMDeposit, AMMWithdraw, AMMVote, and AMMBid transactions use the hash
+ * to access AMM instance.
+ * @see [XLS30d:Creating AMM instance on
  * XRPL](https://github.com/XRPLF/XRPL-Standards/discussions/78)
  */
 class AMMCreate : public Transactor
@@ -62,7 +63,9 @@ public:
     static TER
     preclaim(PreclaimContext const& ctx);
 
-    /** Attempt to create the AMM instance. */
+    /**
+     * Attempt to create the AMM instance.
+     */
     TER
     doApply() override;
 
diff --git a/include/xrpl/tx/transactors/dex/AMMDelete.h b/include/xrpl/tx/transactors/dex/AMMDelete.h
index 4a0905fe10..abf800c4d1 100644
--- a/include/xrpl/tx/transactors/dex/AMMDelete.h
+++ b/include/xrpl/tx/transactors/dex/AMMDelete.h
@@ -11,7 +11,8 @@
 
 namespace xrpl {
 
-/** AMMDelete implements AMM delete transactor. This is a mechanism to
+/**
+ * AMMDelete implements AMM delete transactor. This is a mechanism to
  * delete AMM in an empty state when the number of LP tokens is 0.
  * AMMDelete deletes the trustlines up to configured maximum. If all
  * trustlines are deleted then AMM ltAMM and root account are deleted.
diff --git a/include/xrpl/tx/transactors/dex/AMMDeposit.h b/include/xrpl/tx/transactors/dex/AMMDeposit.h
index b87db19b2d..2959f1b10a 100644
--- a/include/xrpl/tx/transactors/dex/AMMDeposit.h
+++ b/include/xrpl/tx/transactors/dex/AMMDeposit.h
@@ -20,7 +20,8 @@ namespace xrpl {
 
 class Sandbox;
 
-/** AMMDeposit implements AMM deposit Transactor.
+/**
+ * AMMDeposit implements AMM deposit Transactor.
  * The deposit transaction is used to add liquidity to the AMM instance pool,
  * thus obtaining some share of the instance's pools in the form of LPTokens.
  * If the trader deposits proportional values of both assets without changing
@@ -92,7 +93,8 @@ private:
     std::pair<TER, bool>
     applyGuts(Sandbox& view);
 
-    /** Deposit requested assets and token amount into LP account.
+    /**
+     * Deposit requested assets and token amount into LP account.
      * Return new total LPToken balance.
      * @param view
      * @param ammAccount
@@ -121,7 +123,8 @@ private:
         std::optional<STAmount> const& lpTokensDepositMin,
         std::uint16_t tfee);
 
-    /** Equal asset deposit (LPTokens) for the specified share of
+    /**
+     * Equal asset deposit (LPTokens) for the specified share of
      * the AMM instance pools. The trading fee is not charged.
      * @param view
      * @param ammAccount
@@ -146,7 +149,8 @@ private:
         std::optional<STAmount> const& deposit2Min,
         std::uint16_t tfee);
 
-    /** Equal asset deposit (Asset1In, Asset2In) with the constraint on
+    /**
+     * Equal asset deposit (Asset1In, Asset2In) with the constraint on
      * the maximum amount of both assets that the trader is willing to deposit.
      * The trading fee is not charged.
      * @param view
@@ -172,7 +176,8 @@ private:
         std::optional<STAmount> const& lpTokensDepositMin,
         std::uint16_t tfee);
 
-    /** Single asset deposit (Asset1In) by the amount.
+    /**
+     * Single asset deposit (Asset1In) by the amount.
      * The trading fee is charged.
      * @param view
      * @param ammAccount
@@ -193,7 +198,8 @@ private:
         std::optional<STAmount> const& lpTokensDepositMin,
         std::uint16_t tfee);
 
-    /** Single asset deposit (Asset1In, LPTokens) by the tokens.
+    /**
+     * Single asset deposit (Asset1In, LPTokens) by the tokens.
      * The trading fee is charged.
      * @param view
      * @param ammAccount
@@ -214,7 +220,8 @@ private:
         STAmount const& lpTokensDeposit,
         std::uint16_t tfee);
 
-    /** Single asset deposit (Asset1In, EPrice) with two constraints.
+    /**
+     * Single asset deposit (Asset1In, EPrice) with two constraints.
      * The trading fee is charged.
      * @param view
      * @param ammAccount
@@ -235,7 +242,8 @@ private:
         STAmount const& ePrice,
         std::uint16_t tfee);
 
-    /** Equal deposit in empty AMM state (LP tokens balance is 0)
+    /**
+     * Equal deposit in empty AMM state (LP tokens balance is 0)
      * @param view
      * @param ammAccount
      * @param amount requested asset1 deposit amount
diff --git a/include/xrpl/tx/transactors/dex/AMMVote.h b/include/xrpl/tx/transactors/dex/AMMVote.h
index 10ad284bb3..4d63a98534 100644
--- a/include/xrpl/tx/transactors/dex/AMMVote.h
+++ b/include/xrpl/tx/transactors/dex/AMMVote.h
@@ -11,7 +11,8 @@
 
 namespace xrpl {
 
-/** AMMVote implements AMM vote Transactor.
+/**
+ * AMMVote implements AMM vote Transactor.
  * This transactor allows for the TradingFee of the AMM instance be a votable
  * parameter. Any account (LP) that holds the corresponding LPTokens can cast
  * a vote using the new AMMVote transaction. VoteSlots array in ltAMM object
diff --git a/include/xrpl/tx/transactors/dex/AMMWithdraw.h b/include/xrpl/tx/transactors/dex/AMMWithdraw.h
index 8f6700037d..7004dd57c1 100644
--- a/include/xrpl/tx/transactors/dex/AMMWithdraw.h
+++ b/include/xrpl/tx/transactors/dex/AMMWithdraw.h
@@ -22,7 +22,8 @@ namespace xrpl {
 
 class Sandbox;
 
-/** AMMWithdraw implements AMM withdraw Transactor.
+/**
+ * AMMWithdraw implements AMM withdraw Transactor.
  * The withdraw transaction is used to remove liquidity from the AMM instance
  * pool, thus redeeming some share of the pools that one owns in the form
  * of LPTokens. If the trader withdraws proportional values of both assets
@@ -96,7 +97,8 @@ public:
         ReadView const& view,
         beast::Journal const& j) override;
 
-    /** Equal-asset withdrawal (LPTokens) of some AMM instance pools
+    /**
+     * Equal-asset withdrawal (LPTokens) of some AMM instance pools
      * shares represented by the number of LPTokens .
      * The trading fee is not charged.
      * @param view
@@ -129,7 +131,8 @@ public:
         XRPAmount const& priorBalance,
         beast::Journal const& journal);
 
-    /** Withdraw requested assets and token from AMM into LP account.
+    /**
+     * Withdraw requested assets and token from AMM into LP account.
      * Return new total LPToken balance and the withdrawn amounts for both
      * assets.
      * @param view
@@ -173,15 +176,18 @@ public:
         beast::Journal const& journal);
 
 private:
-    /** Returns IgnoreFreeze when the withdrawer is the issuer of a pool
-     *  asset (post-fixCleanup3_3_0), ZeroIfFrozen otherwise. */
+    /**
+     * Returns IgnoreFreeze when the withdrawer is the issuer of a pool
+     *  asset (post-fixCleanup3_3_0), ZeroIfFrozen otherwise.
+     */
     [[nodiscard]] FreezeHandling
     issuerFreezeHandling() const;
 
     std::pair<TER, bool>
     applyGuts(Sandbox& view);
 
-    /** Withdraw requested assets and token from AMM into LP account.
+    /**
+     * Withdraw requested assets and token from AMM into LP account.
      * Return new total LPToken balance.
      * @param view
      * @param ammSle AMM ledger entry
@@ -205,7 +211,8 @@ private:
         STAmount const& lpTokensWithdraw,
         std::uint16_t tfee);
 
-    /** Equal-asset withdrawal (LPTokens) of some AMM instance pools
+    /**
+     * Equal-asset withdrawal (LPTokens) of some AMM instance pools
      * shares represented by the number of LPTokens .
      * The trading fee is not charged.
      * @param view
@@ -230,7 +237,8 @@ private:
         STAmount const& lpTokensWithdraw,
         std::uint16_t tfee);
 
-    /** Withdraw both assets (Asset1Out, Asset2Out) with the constraints
+    /**
+     * Withdraw both assets (Asset1Out, Asset2Out) with the constraints
      * on the maximum amount of each asset that the trader is willing
      * to withdraw. The trading fee is not charged.
      * @param view
@@ -255,7 +263,8 @@ private:
         STAmount const& amount2,
         std::uint16_t tfee);
 
-    /** Single asset withdrawal (Asset1Out) equivalent to the amount specified
+    /**
+     * Single asset withdrawal (Asset1Out) equivalent to the amount specified
      * in Asset1Out. The trading fee is charged.
      * @param view
      * @param ammAccount
@@ -275,7 +284,8 @@ private:
         STAmount const& amount,
         std::uint16_t tfee);
 
-    /** Single asset withdrawal (Asset1Out, LPTokens) proportional
+    /**
+     * Single asset withdrawal (Asset1Out, LPTokens) proportional
      * to the share specified by tokens. The trading fee is charged.
      * @param view
      * @param ammAccount
@@ -297,7 +307,8 @@ private:
         STAmount const& lpTokensWithdraw,
         std::uint16_t tfee);
 
-    /** Withdraw single asset (Asset1Out, EPrice) with two constraints.
+    /**
+     * Withdraw single asset (Asset1Out, EPrice) with two constraints.
      * The trading fee is charged.
      * @param view
      * @param ammAccount
@@ -319,7 +330,9 @@ private:
         STAmount const& ePrice,
         std::uint16_t tfee);
 
-    /** Check from the flags if it's withdraw all */
+    /**
+     * Check from the flags if it's withdraw all
+     */
     static WithdrawAll
     isWithdrawAll(STTx const& tx);
 };
diff --git a/include/xrpl/tx/transactors/dex/OfferCreate.h b/include/xrpl/tx/transactors/dex/OfferCreate.h
index a3bf7626f9..0ce34646dd 100644
--- a/include/xrpl/tx/transactors/dex/OfferCreate.h
+++ b/include/xrpl/tx/transactors/dex/OfferCreate.h
@@ -28,13 +28,17 @@ namespace xrpl {
 class PaymentSandbox;
 class Sandbox;
 
-/** Transactor specialized for creating offers in the ledger. */
+/**
+ * Transactor specialized for creating offers in the ledger.
+ */
 class OfferCreate : public Transactor
 {
 public:
     static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Custom;
 
-    /** Construct a Transactor subclass that creates an offer in the ledger. */
+    /**
+     * Construct a Transactor subclass that creates an offer in the ledger.
+     */
     explicit OfferCreate(ApplyContext& ctx) : Transactor(ctx)
     {
     }
@@ -48,15 +52,21 @@ public:
     static std::uint32_t
     getFlagsMask(PreflightContext const& ctx);
 
-    /** Enforce constraints beyond those of the Transactor base class. */
+    /**
+     * Enforce constraints beyond those of the Transactor base class.
+     */
     static NotTEC
     preflight(PreflightContext const& ctx);
 
-    /** Enforce constraints beyond those of the Transactor base class. */
+    /**
+     * Enforce constraints beyond those of the Transactor base class.
+     */
     static TER
     preclaim(PreclaimContext const& ctx);
 
-    /** Precondition: fee collection is likely.  Attempt to create the offer. */
+    /**
+     * Precondition: fee collection is likely.  Attempt to create the offer.
+     */
     TER
     doApply() override;
 
diff --git a/include/xrpl/tx/transactors/lending/LoanManage.h b/include/xrpl/tx/transactors/lending/LoanManage.h
index c8a5584131..e641e03dd1 100644
--- a/include/xrpl/tx/transactors/lending/LoanManage.h
+++ b/include/xrpl/tx/transactors/lending/LoanManage.h
@@ -36,7 +36,8 @@ public:
     static TER
     preclaim(PreclaimContext const& ctx);
 
-    /** Helper function that might be needed by other transactors
+    /**
+     * Helper function that might be needed by other transactors
      */
     static TER
     defaultLoan(
@@ -47,7 +48,8 @@ public:
         Asset const& vaultAsset,
         beast::Journal j);
 
-    /** Helper function that might be needed by other transactors
+    /**
+     * Helper function that might be needed by other transactors
      */
     static TER
     impairLoan(
@@ -57,7 +59,8 @@ public:
         Asset const& vaultAsset,
         beast::Journal j);
 
-    /** Helper function that might be needed by other transactors
+    /**
+     * Helper function that might be needed by other transactors
      */
     [[nodiscard]] static TER
     unimpairLoan(
diff --git a/include/xrpl/tx/transactors/oracle/OracleDelete.h b/include/xrpl/tx/transactors/oracle/OracleDelete.h
index f9e9230527..d44065d7bb 100644
--- a/include/xrpl/tx/transactors/oracle/OracleDelete.h
+++ b/include/xrpl/tx/transactors/oracle/OracleDelete.h
@@ -14,13 +14,13 @@
 namespace xrpl {
 
 /**
-    Price Oracle is a system that acts as a bridge between
-    a blockchain network and the external world, providing off-chain price data
-    to decentralized applications (dApps) on the blockchain. This implementation
-    conforms to the requirements specified in the XLS-47d.
-
-    The OracleDelete transactor implements the deletion of Oracle objects.
-*/
+ * Price Oracle is a system that acts as a bridge between
+ * a blockchain network and the external world, providing off-chain price data
+ * to decentralized applications (dApps) on the blockchain. This implementation
+ * conforms to the requirements specified in the XLS-47d.
+ *
+ * The OracleDelete transactor implements the deletion of Oracle objects.
+ */
 
 class OracleDelete : public Transactor
 {
diff --git a/include/xrpl/tx/transactors/oracle/OracleSet.h b/include/xrpl/tx/transactors/oracle/OracleSet.h
index e95970923b..b6aed3f4fc 100644
--- a/include/xrpl/tx/transactors/oracle/OracleSet.h
+++ b/include/xrpl/tx/transactors/oracle/OracleSet.h
@@ -12,13 +12,13 @@
 namespace xrpl {
 
 /**
-    Price Oracle is a system that acts as a bridge between
-    a blockchain network and the external world, providing off-chain price data
-    to decentralized applications (dApps) on the blockchain. This implementation
-    conforms to the requirements specified in the XLS-47d.
-
-    The OracleSet transactor implements creating or updating Oracle objects.
-*/
+ * Price Oracle is a system that acts as a bridge between
+ * a blockchain network and the external world, providing off-chain price data
+ * to decentralized applications (dApps) on the blockchain. This implementation
+ * conforms to the requirements specified in the XLS-47d.
+ *
+ * The OracleSet transactor implements creating or updating Oracle objects.
+ */
 
 class OracleSet : public Transactor
 {
diff --git a/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.h b/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.h
index 5a07262a3b..6bd68a0142 100644
--- a/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.h
+++ b/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.h
@@ -26,7 +26,9 @@ public:
     static TER
     preclaim(PreclaimContext const& ctx);
 
-    /** Attempt to delete the Permissioned Domain. */
+    /**
+     * Attempt to delete the Permissioned Domain.
+     */
     TER
     doApply() override;
 
diff --git a/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.h b/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.h
index 38de800284..cb5d341c50 100644
--- a/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.h
+++ b/include/xrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.h
@@ -29,7 +29,9 @@ public:
     static TER
     preclaim(PreclaimContext const& ctx);
 
-    /** Attempt to create the Permissioned Domain. */
+    /**
+     * Attempt to create the Permissioned Domain.
+     */
     TER
     doApply() override;
 
diff --git a/include/xrpl/tx/transactors/system/TicketCreate.h b/include/xrpl/tx/transactors/system/TicketCreate.h
index 2a1036c732..f249fd7db2 100644
--- a/include/xrpl/tx/transactors/system/TicketCreate.h
+++ b/include/xrpl/tx/transactors/system/TicketCreate.h
@@ -57,15 +57,21 @@ public:
     static TxConsequences
     makeTxConsequences(PreflightContext const& ctx);
 
-    /** Enforce constraints beyond those of the Transactor base class. */
+    /**
+     * Enforce constraints beyond those of the Transactor base class.
+     */
     static NotTEC
     preflight(PreflightContext const& ctx);
 
-    /** Enforce constraints beyond those of the Transactor base class. */
+    /**
+     * Enforce constraints beyond those of the Transactor base class.
+     */
     static TER
     preclaim(PreclaimContext const& ctx);
 
-    /** Precondition: fee collection is likely.  Attempt to create ticket(s). */
+    /**
+     * Precondition: fee collection is likely.  Attempt to create ticket(s).
+     */
     TER
     doApply() override;
 
diff --git a/src/libxrpl/basics/Number.cpp b/src/libxrpl/basics/Number.cpp
index 0a1d558421..d08fd23016 100644
--- a/src/libxrpl/basics/Number.cpp
+++ b/src/libxrpl/basics/Number.cpp
@@ -186,35 +186,36 @@ divu10(uint128_t& u)
 template <class T>
 concept UnsignedMantissa = std::is_unsigned_v<T> || std::is_same_v<T, uint128_t>;
 
-/** Guard
-
-    The Guard class is used to temporarily add extra digits of
-    precision to an operation.  This enables the final result
-    to be correctly rounded to the internal precision of Number.
-
-    At its core, the Guard really only needs three pieces of information to determine how to round:
-    1. The rounding mode
-    2. The last digit dropped from the mantissa (i.e. the first digit after the decimal point).
-        (first byte of digits_)
-    3. Whether any other non-zero digits were dropped from the mantissa. (remaining bytes of digits_
-   and xbit_)
-
-    Upward and Downward rounding modes round the unsigned mantissa toward or away from zero
-    depending on whether the sign is negative (sbit_). For positive values, Upward is away, and
-    Downward is toward. For negative values, that's reversed. For simplicity, I'm going to describe
-    the logic using "TowardZero" and "AwayFromZero".
-
-    * TowardZero is the easiest rounding mode. It always rounds down. digits_ and xbit_ are
-        irrelevant.
-    * AwayFromZero is almost as simple. If both "digits_" and "xbit_" are zero (0), it rounds down.
-        Else it rounds up.
-    * ToNearest is only a little more complicated. If the last dropped digit is < 5, then round
-        down. If it is > 5, round up. If it is exactly 5, and there are _any_ other digits (the
-        remainder of "digits_" or "xbit_"), round up, else round to even.
-
-    The current implementation stores 16 digits in "digits_" so that digits can be "pop"ped back
-    out if needed during subtraction (negative addition) operations.
-*/
+/**
+ * Guard
+ *
+ * The Guard class is used to temporarily add extra digits of
+ * precision to an operation.  This enables the final result
+ * to be correctly rounded to the internal precision of Number.
+ *
+ * At its core, the Guard really only needs three pieces of information to determine how to round:
+ * 1. The rounding mode
+ * 2. The last digit dropped from the mantissa (i.e. the first digit after the decimal point).
+ * (first byte of digits_)
+ * 3. Whether any other non-zero digits were dropped from the mantissa. (remaining bytes of digits_
+ * and xbit_)
+ *
+ * Upward and Downward rounding modes round the unsigned mantissa toward or away from zero
+ * depending on whether the sign is negative (sbit_). For positive values, Upward is away, and
+ * Downward is toward. For negative values, that's reversed. For simplicity, I'm going to describe
+ * the logic using "TowardZero" and "AwayFromZero".
+ *
+ * TowardZero is the easiest rounding mode. It always rounds down. digits_ and xbit_ are
+ * irrelevant.
+ * AwayFromZero is almost as simple. If both "digits_" and "xbit_" are zero (0), it rounds down.
+ * Else it rounds up.
+ * ToNearest is only a little more complicated. If the last dropped digit is < 5, then round
+ * down. If it is > 5, round up. If it is exactly 5, and there are _any_ other digits (the
+ * remainder of "digits_" or "xbit_"), round up, else round to even.
+ *
+ * The current implementation stores 16 digits in "digits_" so that digits can be "pop"ped back
+ * out if needed during subtraction (negative addition) operations.
+ */
 class Number::Guard
 {
     std::uint64_t digits_{0};    // 16 decimal guard digits
@@ -263,13 +264,14 @@ public:
     [[nodiscard]] bool
     empty() const noexcept;
 
-    /** Drop a digit from the mantissa, and increment the exponent, storing the dropped digit in
+    /**
+     * Drop a digit from the mantissa, and increment the exponent, storing the dropped digit in
      * this Guard.
      *
      * Substitute for:
-                push(mantissa % 10);
-                mantissa /= 10;
-                ++exponent;
+     * push(mantissa % 10);
+     * mantissa /= 10;
+     * ++exponent;
      */
     template <class T>
     void
diff --git a/src/libxrpl/basics/ResolverAsio.cpp b/src/libxrpl/basics/ResolverAsio.cpp
index 7e1b56f87a..25e95b7fc5 100644
--- a/src/libxrpl/basics/ResolverAsio.cpp
+++ b/src/libxrpl/basics/ResolverAsio.cpp
@@ -33,10 +33,11 @@
 
 namespace xrpl {
 
-/** Mix-in to track when all pending I/O is complete.
-    Derived classes must be callable with this signature:
-        void asyncHandlersComplete()
-*/
+/**
+ * Mix-in to track when all pending I/O is complete.
+ * Derived classes must be callable with this signature:
+ *     void asyncHandlersComplete()
+ */
 template <class Derived>
 class AsyncObject
 {
@@ -51,10 +52,11 @@ public:
         XRPL_ASSERT(pending_.load() == 0, "xrpl::AsyncObject::~AsyncObject : nothing pending");
     }
 
-    /** RAII container that maintains the count of pending I/O.
-        Bind this into the argument list of every handler passed
-        to an initiating function.
-    */
+    /**
+     * RAII container that maintains the count of pending I/O.
+     * Bind this into the argument list of every handler passed
+     * to an initiating function.
+     */
     class CompletionCounter
     {
     public:
diff --git a/src/libxrpl/basics/base64.cpp b/src/libxrpl/basics/base64.cpp
index 541ddd0839..c980a08669 100644
--- a/src/libxrpl/basics/base64.cpp
+++ b/src/libxrpl/basics/base64.cpp
@@ -76,32 +76,37 @@ getInverse()
     return &kTab[0];
 }
 
-/// Returns max chars needed to encode a base64 string
+/**
+ * Returns max chars needed to encode a base64 string
+ */
 constexpr std::size_t
 encodedSize(std::size_t n)
 {
     return 4 * ((n + 2) / 3);
 }
 
-/// Returns max bytes needed to decode a base64 string
+/**
+ * Returns max bytes needed to decode a base64 string
+ */
 constexpr std::size_t
 decodedSize(std::size_t n)
 {
     return ((n / 4) * 3) + 2;
 }
 
-/** Encode a series of octets as a padded, base64 string.
-
-    The resulting string will not be null terminated.
-
-    @par Requires
-
-    The memory pointed to by `out` points to valid memory
-    of at least `encoded_size(len)` bytes.
-
-    @return The number of characters written to `out`. This
-    will exclude any null termination.
-*/
+/**
+ * Encode a series of octets as a padded, base64 string.
+ *
+ * The resulting string will not be null terminated.
+ *
+ * @par Requires
+ *
+ * The memory pointed to by `out` points to valid memory
+ * of at least `encoded_size(len)` bytes.
+ *
+ * @return The number of characters written to `out`. This
+ * will exclude any null termination.
+ */
 std::size_t
 encode(void* dest, void const* src, std::size_t len)
 {
@@ -142,17 +147,18 @@ encode(void* dest, void const* src, std::size_t len)
     return out - static_cast<char*>(dest);
 }
 
-/** Decode a padded base64 string into a series of octets.
-
-    @par Requires
-
-    The memory pointed to by `out` points to valid memory
-    of at least `decoded_size(len)` bytes.
-
-    @return The number of octets written to `out`, and
-    the number of characters read from the input string,
-    expressed as a pair.
-*/
+/**
+ * Decode a padded base64 string into a series of octets.
+ *
+ * @par Requires
+ *
+ * The memory pointed to by `out` points to valid memory
+ * of at least `decoded_size(len)` bytes.
+ *
+ * @return The number of octets written to `out`, and
+ * the number of characters read from the input string,
+ * expressed as a pair.
+ */
 std::pair<std::size_t, std::size_t>
 decode(void* dest, char const* src, std::size_t len)
 {
diff --git a/src/libxrpl/basics/make_SSLContext.cpp b/src/libxrpl/basics/make_SSLContext.cpp
index 165d36076b..3fca0c0d77 100644
--- a/src/libxrpl/basics/make_SSLContext.cpp
+++ b/src/libxrpl/basics/make_SSLContext.cpp
@@ -30,35 +30,37 @@ namespace xrpl {
 
 namespace openssl::detail {
 
-/** The default strength of self-signed RSA certificates.
-
-    Per NIST Special Publication 800-57 Part 3, 2048-bit RSA is still
-    considered acceptably secure. Generally, we would want to go above
-    and beyond such recommendations (e.g. by using 3072 or 4096 bits)
-    but there is a computational cost associated with that may not
-    be worth paying, considering that:
-
-    - We regenerate a new ephemeral certificate and a securely generated
-      random private key every time the server is started; and
-    - There should not be any truly secure information (e.g. seeds or private
-      keys) that gets relayed to the server anyways over these RPCs.
-
-      @note If you increase the number of bits you need to generate new
-            default DH parameters and update defaultDH  accordingly.
- * */
+/**
+ * The default strength of self-signed RSA certificates.
+ *
+ * Per NIST Special Publication 800-57 Part 3, 2048-bit RSA is still
+ * considered acceptably secure. Generally, we would want to go above
+ * and beyond such recommendations (e.g. by using 3072 or 4096 bits)
+ * but there is a computational cost associated with that may not
+ * be worth paying, considering that:
+ *
+ * - We regenerate a new ephemeral certificate and a securely generated
+ *   random private key every time the server is started; and
+ * - There should not be any truly secure information (e.g. seeds or private
+ *   keys) that gets relayed to the server anyways over these RPCs.
+ *
+ * @note If you increase the number of bits you need to generate new
+ *       default DH parameters and update defaultDH  accordingly.
+ */
 int gDefaultRsaKeyBits = 2048;
 
-/** The default DH parameters.
-
-    These were generated using the OpenSSL command: `openssl dhparam 2048`
-    by Nik Bougalis <nikb@bougalis.net> on May, 29, 2022.
-
-    It is safe to use this, but if you want you can generate different
-    parameters and put them here. There's no easy way to change this
-    via the config file at this time.
-
-    @note If you increase the number of bits you need to update
-          defaultRSAKeyBits accordingly.
+/**
+ * The default DH parameters.
+ *
+ * These were generated using the OpenSSL command: `openssl dhparam 2048`
+ * by Nik Bougalis <nikb@bougalis.net> on May, 29, 2022.
+ *
+ * It is safe to use this, but if you want you can generate different
+ * parameters and put them here. There's no easy way to change this
+ * via the config file at this time.
+ *
+ * @note If you increase the number of bits you need to update
+ *       defaultRSAKeyBits accordingly.
  */
 static constexpr char kDefaultDh[] =
     "-----BEGIN DH PARAMETERS-----\n"
@@ -70,19 +72,20 @@ static constexpr char kDefaultDh[] =
     "9yqY3xXZID240RRcaJ25+U4lszFPqP+CEwIBAg==\n"
     "-----END DH PARAMETERS-----";
 
-/** The default list of ciphers we accept over TLS.
-
-    Generally we include cipher suites that are part of TLS v1.2, but
-    we specifically exclude:
-
-    - the DSS cipher suites (!DSS);
-    - cipher suites using pre-shared keys (!PSK);
-    - cipher suites that don't offer encryption (!eNULL); and
-    - cipher suites that don't offer authentication (!aNULL).
-
-    @note Server administrators can override this default list, on either a
-          global or per-port basis, using the `ssl_ciphers` directive in the
-          config file.
+/**
+ * The default list of ciphers we accept over TLS.
+ *
+ * Generally we include cipher suites that are part of TLS v1.2, but
+ * we specifically exclude:
+ *
+ * - the DSS cipher suites (!DSS);
+ * - cipher suites using pre-shared keys (!PSK);
+ * - cipher suites that don't offer encryption (!eNULL); and
+ * - cipher suites that don't offer authentication (!aNULL).
+ *
+ * @note Server administrators can override this default list, on either a
+ *       global or per-port basis, using the `ssl_ciphers` directive in the
+ *       config file.
  */
 std::string const kDefaultCipherList = "TLSv1.2:!CBC:!DSS:!PSK:!eNULL:!aNULL";
 
diff --git a/src/libxrpl/core/detail/LoadMonitor.cpp b/src/libxrpl/core/detail/LoadMonitor.cpp
index 95e0e7d3b9..92eff61285 100644
--- a/src/libxrpl/core/detail/LoadMonitor.cpp
+++ b/src/libxrpl/core/detail/LoadMonitor.cpp
@@ -101,10 +101,11 @@ LoadMonitor::addLoadSample(LoadEvent const& s)
     addSamples(1, latency);
 }
 
-/* Add multiple samples
-   @param count The number of samples to add
-   @param latencyMS The total number of milliseconds
-*/
+/**
+ * Add multiple samples
+ * @param count The number of samples to add
+ * @param latencyMS The total number of milliseconds
+ */
 void
 LoadMonitor::addSamples(int count, std::chrono::milliseconds latency)
 {
diff --git a/src/libxrpl/crypto/RFC1751.cpp b/src/libxrpl/crypto/RFC1751.cpp
index 41e29ee00c..4b17e1443c 100644
--- a/src/libxrpl/crypto/RFC1751.cpp
+++ b/src/libxrpl/crypto/RFC1751.cpp
@@ -379,14 +379,15 @@ RFC1751::etob(std::string& strData, std::vector<std::string> vsHuman)
     return 1;
 }
 
-/** Convert words separated by spaces into a 128 bit key in big-endian format.
-
-    @return
-         1 if succeeded
-         0 if word not in dictionary
-        -1 if badly formed string
-        -2 if words are okay but parity is wrong.
-*/
+/**
+ * Convert words separated by spaces into a 128 bit key in big-endian format.
+ *
+ * @return
+ *      1 if succeeded
+ *      0 if word not in dictionary
+ *     -1 if badly formed string
+ *     -2 if words are okay but parity is wrong.
+ */
 int
 RFC1751::getKeyFromEnglish(std::string& strKey, std::string const& strHuman)
 {
@@ -415,7 +416,8 @@ RFC1751::getKeyFromEnglish(std::string& strKey, std::string const& strHuman)
     return rc;
 }
 
-/** Convert to human from a 128 bit key in big-endian format
+/**
+ * Convert to human from a 128 bit key in big-endian format
  */
 void
 RFC1751::getEnglishFromKey(std::string& strHuman, std::string const& strKey)
diff --git a/src/libxrpl/json/Writer.cpp b/src/libxrpl/json/Writer.cpp
index b21013cda7..4c922a0e33 100644
--- a/src/libxrpl/json/Writer.cpp
+++ b/src/libxrpl/json/Writer.cpp
@@ -199,15 +199,21 @@ private:
     // JSON collections are either arrays, or objects.
     struct Collection
     {
-        /** What type of collection are we in? */
+        /**
+         * What type of collection are we in?
+         */
         Writer::CollectionType type = Writer::CollectionType::Array;
 
-        /** Is this the first entry in a collection?
-         *  If false, we have to emit a , before we write the next entry. */
+        /**
+         * Is this the first entry in a collection?
+         *  If false, we have to emit a , before we write the next entry.
+         */
         bool isFirst = true;
 
 #ifndef NDEBUG
-        /** What tags have we already seen in this collection? */
+        /**
+         * What tags have we already seen in this collection?
+         */
         std::set<std::string> tags{};  // NOLINT(readability-redundant-member-init)
 #endif
     };
diff --git a/src/libxrpl/json/json_value.cpp b/src/libxrpl/json/json_value.cpp
index ce208418de..cf95d873fb 100644
--- a/src/libxrpl/json/json_value.cpp
+++ b/src/libxrpl/json/json_value.cpp
@@ -174,7 +174,8 @@ Value::CZString::isStaticString() const
 // //////////////////////////////////////////////////////////////////
 // //////////////////////////////////////////////////////////////////
 
-/*! \internal Default constructor initialization must be equivalent to:
+/**
+ * @internal Default constructor initialization must be equivalent to:
  * memset( this, 0, sizeof(Value) )
  * This optimization is used in ValueInternalMap fast allocator.
  */
@@ -794,7 +795,9 @@ Value::isConvertibleTo(ValueType other) const
     return false;  // unreachable;
 }
 
-/// Number of values in array or object
+/**
+ * Number of values in array or object
+ */
 Value::UInt
 Value::size() const
 {
diff --git a/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp b/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
index c67ab6775d..589e49d335 100644
--- a/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/NFTokenHelpers.cpp
@@ -258,7 +258,9 @@ changeTokenURI(
     return tesSUCCESS;
 }
 
-/** Insert the token in the owner's token directory. */
+/**
+ * Insert the token in the owner's token directory.
+ */
 TER
 insertToken(ApplyView& view, AccountID owner, STObject&& nft)
 {
@@ -347,7 +349,9 @@ mergePages(ApplyView& view, SLE::ref p1, SLE::ref p2)
     return true;
 }
 
-/** Remove the token from the owner's token directory. */
+/**
+ * Remove the token from the owner's token directory.
+ */
 TER
 removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID)
 {
@@ -360,7 +364,9 @@ removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID)
     return removeToken(view, owner, nftokenID, page);
 }
 
-/** Remove the token from the owner's token directory. */
+/**
+ * Remove the token from the owner's token directory.
+ */
 TER
 removeToken(ApplyView& view, AccountID const& owner, uint256 const& nftokenID, SLE::ref curr)
 {
diff --git a/src/libxrpl/nodestore/backend/NullFactory.cpp b/src/libxrpl/nodestore/backend/NullFactory.cpp
index e36b13a2e1..0c76cb9938 100644
--- a/src/libxrpl/nodestore/backend/NullFactory.cpp
+++ b/src/libxrpl/nodestore/backend/NullFactory.cpp
@@ -81,7 +81,9 @@ public:
     {
     }
 
-    /** Returns the number of file descriptors the backend expects to need */
+    /**
+     * Returns the number of file descriptors the backend expects to need
+     */
     [[nodiscard]] int
     fdRequired() const override
     {
diff --git a/src/libxrpl/nodestore/backend/RocksDBFactory.cpp b/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
index bcf4ba4a49..673b0daae0 100644
--- a/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
+++ b/src/libxrpl/nodestore/backend/RocksDBFactory.cpp
@@ -419,7 +419,9 @@ public:
         storeBatch(batch);
     }
 
-    /** Returns the number of file descriptors the backend expects to need */
+    /**
+     * Returns the number of file descriptors the backend expects to need
+     */
     [[nodiscard]] int
     fdRequired() const override
     {
diff --git a/src/libxrpl/protocol/AccountID.cpp b/src/libxrpl/protocol/AccountID.cpp
index 6050144a8e..c6a5226566 100644
--- a/src/libxrpl/protocol/AccountID.cpp
+++ b/src/libxrpl/protocol/AccountID.cpp
@@ -21,7 +21,9 @@ namespace xrpl {
 
 namespace detail {
 
-/** Caches the base58 representations of AccountIDs */
+/**
+ * Caches the base58 representations of AccountIDs
+ */
 class AccountIdCache
 {
 private:
diff --git a/src/libxrpl/protocol/Feature.cpp b/src/libxrpl/protocol/Feature.cpp
index 059abe2996..2a8476dea8 100644
--- a/src/libxrpl/protocol/Feature.cpp
+++ b/src/libxrpl/protocol/Feature.cpp
@@ -154,7 +154,9 @@ public:
     uint256
     registerFeature(std::string const& name, Supported support, VoteBehavior vote);
 
-    /** Tell FeatureCollections when registration is complete. */
+    /**
+     * Tell FeatureCollections when registration is complete.
+     */
     bool
     registrationIsDone();
 
@@ -167,30 +169,38 @@ public:
     std::string
     featureToName(uint256 const& f) const;
 
-    /** All amendments that are registered within the table. */
+    /**
+     * All amendments that are registered within the table.
+     */
     std::map<std::string, AmendmentSupport> const&
     allAmendments() const
     {
         return all_;
     }
 
-    /** Amendments that this server supports.
-    Whether they are enabled depends on the Rules defined in the validated
-    ledger */
+    /**
+     * Amendments that this server supports.
+     * Whether they are enabled depends on the Rules defined in the validated
+     * ledger
+     */
     std::map<std::string, VoteBehavior> const&
     supportedAmendments() const
     {
         return supported_;
     }
 
-    /** Amendments that this server WON'T vote for by default. */
+    /**
+     * Amendments that this server WON'T vote for by default.
+     */
     std::size_t
     numDownVotedAmendments() const
     {
         return downVotes_;
     }
 
-    /** Amendments that this server WILL vote for by default. */
+    /**
+     * Amendments that this server WILL vote for by default.
+     */
     std::size_t
     numUpVotedAmendments() const
     {
@@ -271,7 +281,9 @@ FeatureCollections::registerFeature(std::string const& name, Supported support,
     logicError("Duplicate feature registration");
 }
 
-/** Tell FeatureCollections when registration is complete. */
+/**
+ * Tell FeatureCollections when registration is complete.
+ */
 bool
 FeatureCollections::registrationIsDone()
 {
@@ -313,30 +325,38 @@ FeatureCollections gFeatureCollections;
 
 }  // namespace
 
-/** All amendments libxrpl knows of. */
+/**
+ * All amendments libxrpl knows of.
+ */
 std::map<std::string, AmendmentSupport> const&
 allAmendments()
 {
     return gFeatureCollections.allAmendments();
 }
 
-/** Amendments that this server supports.
-   Whether they are enabled depends on the Rules defined in the validated
-   ledger */
+/**
+ * Amendments that this server supports.
+ * Whether they are enabled depends on the Rules defined in the validated
+ * ledger
+ */
 std::map<std::string, VoteBehavior> const&
 detail::supportedAmendments()
 {
     return gFeatureCollections.supportedAmendments();
 }
 
-/** Amendments that this server won't vote for by default. */
+/**
+ * Amendments that this server won't vote for by default.
+ */
 std::size_t
 detail::numDownVotedAmendments()
 {
     return gFeatureCollections.numDownVotedAmendments();
 }
 
-/** Amendments that this server will vote for by default. */
+/**
+ * Amendments that this server will vote for by default.
+ */
 std::size_t
 detail::numUpVotedAmendments()
 {
@@ -365,7 +385,9 @@ retireFeature(std::string const& name)
     return registerFeature(name, Supported::Yes, VoteBehavior::Obsolete);
 }
 
-/** Tell FeatureCollections when registration is complete. */
+/**
+ * Tell FeatureCollections when registration is complete.
+ */
 bool
 registrationIsDone()
 {
diff --git a/src/libxrpl/protocol/Indexes.cpp b/src/libxrpl/protocol/Indexes.cpp
index ced18d4db6..02a4932526 100644
--- a/src/libxrpl/protocol/Indexes.cpp
+++ b/src/libxrpl/protocol/Indexes.cpp
@@ -32,23 +32,24 @@
 
 namespace xrpl {
 
-/** Type-specific prefix for calculating ledger indices.
-
-    The identifier for a given object within the ledger is calculated based
-    on some object-specific parameters. To ensure that different types of
-    objects have different indices, even if they happen to use the same set
-    of parameters, we use "tagged hashing" by adding a type-specific prefix.
-
-    @note These values are part of the protocol and *CANNOT* be arbitrarily
-          changed. If they were, on-ledger objects may no longer be able to
-          be located or addressed.
-
-          Additions to this list are OK, but changing existing entries to
-          assign them a different values should never be needed.
-
-          Entries that are removed should be moved to the bottom of the enum
-          and marked as [[deprecated]] to prevent accidental reuse.
-*/
+/**
+ * Type-specific prefix for calculating ledger indices.
+ *
+ * The identifier for a given object within the ledger is calculated based
+ * on some object-specific parameters. To ensure that different types of
+ * objects have different indices, even if they happen to use the same set
+ * of parameters, we use "tagged hashing" by adding a type-specific prefix.
+ *
+ * @note These values are part of the protocol and *CANNOT* be arbitrarily
+ *       changed. If they were, on-ledger objects may no longer be able to
+ *       be located or addressed.
+ *
+ *       Additions to this list are OK, but changing existing entries to
+ *       assign them a different values should never be needed.
+ *
+ *       Entries that are removed should be moved to the bottom of the enum
+ *       and marked as [[deprecated]] to prevent accidental reuse.
+ */
 enum class LedgerNameSpace : std::uint16_t {
     Account = 'a',
     DirNode = 'd',
diff --git a/src/libxrpl/protocol/PublicKey.cpp b/src/libxrpl/protocol/PublicKey.cpp
index 97948fcae3..cb6ea9e851 100644
--- a/src/libxrpl/protocol/PublicKey.cpp
+++ b/src/libxrpl/protocol/PublicKey.cpp
@@ -96,18 +96,19 @@ sliceToHex(Slice const& slice)
     return s;
 }
 
-/** Determine whether a signature is canonical.
-    Canonical signatures are important to protect against signature morphing
-    attacks.
-    @param vSig the signature data
-    @param sigLen the length of the signature
-    @param strict_param whether to enforce strictly canonical semantics
-
-    @note For more details please see:
-    https://xrpl.org/transaction-malleability.html
-    https://bitcointalk.org/index.php?topic=8392.msg127623#msg127623
-    https://github.com/sipa/bitcoin/commit/58bc86e37fda1aec270bccb3df6c20fbd2a6591c
-*/
+/**
+ * Determine whether a signature is canonical.
+ * Canonical signatures are important to protect against signature morphing
+ * attacks.
+ * @param vSig the signature data
+ * @param sigLen the length of the signature
+ * @param strict_param whether to enforce strictly canonical semantics
+ *
+ * @note For more details please see:
+ * https://xrpl.org/transaction-malleability.html
+ * https://bitcointalk.org/index.php?topic=8392.msg127623#msg127623
+ * https://github.com/sipa/bitcoin/commit/58bc86e37fda1aec270bccb3df6c20fbd2a6591c
+ */
 std::optional<ECDSACanonicality>
 ecdsaCanonicality(Slice const& sig)
 {
diff --git a/src/libxrpl/protocol/SecretKey.cpp b/src/libxrpl/protocol/SecretKey.cpp
index f33b1871e1..7713911ab4 100644
--- a/src/libxrpl/protocol/SecretKey.cpp
+++ b/src/libxrpl/protocol/SecretKey.cpp
@@ -99,23 +99,24 @@ deriveDeterministicRootKey(Seed const& seed)
 }
 
 //------------------------------------------------------------------------------
-/** Produces a sequence of secp256k1 key pairs.
-
-    The reference implementation of the XRP Ledger uses a custom derivation
-    algorithm which enables the derivation of an entire family of secp256k1
-    keypairs from a single 128-bit seed. The algorithm predates widely-used
-    standards like BIP-32 and BIP-44.
-
-    Important note to implementers:
-
-        Using this algorithm is not required: all valid secp256k1 keypairs will
-        work correctly. Third party implementations can use whatever mechanisms
-        they prefer. However, implementers of wallets or other tools that allow
-        users to use existing accounts should consider at least supporting this
-        derivation technique to make it easier for users to 'import' accounts.
-
-    For more details, please check out:
-        https://xrpl.org/cryptographic-keys.html#secp256k1-key-derivation
+/**
+ * Produces a sequence of secp256k1 key pairs.
+ *
+ * The reference implementation of the XRP Ledger uses a custom derivation
+ * algorithm which enables the derivation of an entire family of secp256k1
+ * keypairs from a single 128-bit seed. The algorithm predates widely-used
+ * standards like BIP-32 and BIP-44.
+ *
+ * Important note to implementers:
+ *
+ *     Using this algorithm is not required: all valid secp256k1 keypairs will
+ *     work correctly. Third party implementations can use whatever mechanisms
+ *     they prefer. However, implementers of wallets or other tools that allow
+ *     users to use existing accounts should consider at least supporting this
+ *     derivation technique to make it easier for users to 'import' accounts.
+ *
+ * For more details, please check out:
+ *     https://xrpl.org/cryptographic-keys.html#secp256k1-key-derivation
  */
 class Generator
 {
@@ -177,7 +178,9 @@ public:
         secureErase(generator_.data(), generator_.size());
     }
 
-    /** Generate the nth key pair. */
+    /**
+     * Generate the nth key pair.
+     */
     std::pair<PublicKey, SecretKey>
     operator()(std::size_t ordinal) const
     {
diff --git a/src/libxrpl/protocol/tokens.cpp b/src/libxrpl/protocol/tokens.cpp
index 21984c67e7..bd0f54c3ae 100644
--- a/src/libxrpl/protocol/tokens.cpp
+++ b/src/libxrpl/protocol/tokens.cpp
@@ -160,15 +160,16 @@ digest2(Args const&... args)
     return digest<Hasher>(digest<Hasher>(args...));
 }
 
-/** Calculate a 4-byte checksum of the data
-
-    The checksum is calculated as the first 4 bytes
-    of the SHA256 digest of the message. This is added
-    to the base58 encoding of identifiers to detect
-    user error in data entry.
-
-    @note This checksum algorithm is part of the client API
-*/
+/**
+ * Calculate a 4-byte checksum of the data
+ *
+ * The checksum is calculated as the first 4 bytes
+ * of the SHA256 digest of the message. This is added
+ * to the base58 encoding of identifiers to detect
+ * user error in data entry.
+ *
+ * @note This checksum algorithm is part of the client API
+ */
 static void
 checksum(void* out, void const* message, std::size_t size)
 {
diff --git a/src/libxrpl/rdb/SociDB.cpp b/src/libxrpl/rdb/SociDB.cpp
index 08c826b210..7354ef9b23 100644
--- a/src/libxrpl/rdb/SociDB.cpp
+++ b/src/libxrpl/rdb/SociDB.cpp
@@ -188,14 +188,15 @@ convert(std::string const& from, soci::blob& to)
 
 namespace {
 
-/** Run a thread to checkpoint the write ahead log (wal) for
-    the given soci::session every 1000 pages. This is only implemented
-    for sqlite databases.
-
-    Note: According to: https://www.sqlite.org/wal.html#ckpt this
-    is the default behavior of sqlite. We may be able to remove this
-    class.
-*/
+/**
+ * Run a thread to checkpoint the write ahead log (wal) for
+ * the given soci::session every 1000 pages. This is only implemented
+ * for sqlite databases.
+ *
+ * Note: According to: https://www.sqlite.org/wal.html#ckpt this
+ * is the default behavior of sqlite. We may be able to remove this
+ * class.
+ */
 
 class WALCheckpointer : public Checkpointer
 {
diff --git a/src/libxrpl/shamap/SHAMap.cpp b/src/libxrpl/shamap/SHAMap.cpp
index 0df0430a5f..2483e6f6e1 100644
--- a/src/libxrpl/shamap/SHAMap.cpp
+++ b/src/libxrpl/shamap/SHAMap.cpp
@@ -919,17 +919,18 @@ SHAMap::fetchRoot(SHAMapHash const& hash, SHAMapSyncFilter const* filter)
     return false;
 }
 
-/** Replace a node with a shareable node.
-
-    This code handles two cases:
-
-    1) An unshared, unshareable node needs to be made shareable
-       so immutable SHAMap's can have references to it.
-    2) An unshareable node is shared. This happens when you make
-       a mutable snapshot of a mutable SHAMap.
-
-    @note The node must have already been unshared by having the caller
-          first call SHAMapTreeNode::unshare().
+/**
+ * Replace a node with a shareable node.
+ *
+ * This code handles two cases:
+ *
+ * 1) An unshared, unshareable node needs to be made shareable
+ *    so immutable SHAMap's can have references to it.
+ * 2) An unshareable node is shared. This happens when you make
+ *    a mutable snapshot of a mutable SHAMap.
+ *
+ * @note The node must have already been unshared by having the caller
+ *       first call SHAMapTreeNode::unshare().
  */
 SHAMapTreeNodePtr
 SHAMap::writeNode(NodeObjectType t, SHAMapTreeNodePtr node) const
diff --git a/src/libxrpl/shamap/SHAMapSync.cpp b/src/libxrpl/shamap/SHAMapSync.cpp
index 1f38049abe..cc30426f9d 100644
--- a/src/libxrpl/shamap/SHAMapSync.cpp
+++ b/src/libxrpl/shamap/SHAMapSync.cpp
@@ -300,10 +300,11 @@ SHAMap::gmnProcessDeferredReads(MissingNodes& mn)
     mn.deferred = 0;
 }
 
-/** Get a list of node IDs and hashes for nodes that are part of this SHAMap
-    but not available locally.  The filter can hold alternate sources of
-    nodes that are not permanently stored locally
-*/
+/**
+ * Get a list of node IDs and hashes for nodes that are part of this SHAMap
+ * but not available locally.  The filter can hold alternate sources of
+ * nodes that are not permanently stored locally
+ */
 std::vector<std::pair<SHAMapNodeID, uint256>>
 SHAMap::getMissingNodes(int max, SHAMapSyncFilter const* filter)
 {
@@ -720,7 +721,8 @@ SHAMap::deepCompare(SHAMap& other) const
     return true;
 }
 
-/** Does this map have this inner node?
+/**
+ * Does this map have this inner node?
  */
 bool
 SHAMap::hasInnerNode(SHAMapNodeID const& targetNodeID, SHAMapHash const& targetNodeHash) const
@@ -742,7 +744,8 @@ SHAMap::hasInnerNode(SHAMapNodeID const& targetNodeID, SHAMapHash const& targetN
     return (node->isInner()) && (node->getHash() == targetNodeHash);
 }
 
-/** Does this map have this leaf node?
+/**
+ * Does this map have this leaf node?
  */
 bool
 SHAMap::hasLeafNode(uint256 const& tag, SHAMapHash const& targetNodeHash) const
diff --git a/src/libxrpl/tx/Transactor.cpp b/src/libxrpl/tx/Transactor.cpp
index 065dead1fd..4b562692d7 100644
--- a/src/libxrpl/tx/Transactor.cpp
+++ b/src/libxrpl/tx/Transactor.cpp
@@ -56,7 +56,9 @@
 
 namespace xrpl {
 
-/** Performs early sanity checks on the txid */
+/**
+ * Performs early sanity checks on the txid
+ */
 NotTEC
 preflight0(PreflightContext const& ctx, std::uint32_t flagMask)
 {
@@ -111,7 +113,8 @@ preflight0(PreflightContext const& ctx, std::uint32_t flagMask)
 
 namespace detail {
 
-/** Checks the validity of the transactor signing key.
+/**
+ * Checks the validity of the transactor signing key.
  *
  * Normally called from preflight1.
  */
@@ -221,7 +224,9 @@ preflight1Sponsor(PreflightContext const& ctx)
     return tesSUCCESS;
 }
 
-/** Performs early sanity checks on the account and fee fields */
+/**
+ * Performs early sanity checks on the account and fee fields
+ */
 NotTEC
 Transactor::preflight1(PreflightContext const& ctx, std::uint32_t flagMask)
 {
@@ -290,7 +295,9 @@ Transactor::preflight1(PreflightContext const& ctx, std::uint32_t flagMask)
     return tesSUCCESS;
 }
 
-/** Checks whether the signature appears valid */
+/**
+ * Checks whether the signature appears valid
+ */
 NotTEC
 Transactor::preflight2(PreflightContext const& ctx)
 {
@@ -1276,10 +1283,11 @@ removeDeletedTrustLines(
     }
 }
 
-/** Reset the context, discarding any changes made and adjust the fee.
-
-    @param fee The transaction fee to be charged.
-    @return A pair containing the transaction result and the actual fee charged.
+/**
+ * Reset the context, discarding any changes made and adjust the fee.
+ *
+ * @param fee The transaction fee to be charged.
+ * @return A pair containing the transaction result and the actual fee charged.
  */
 std::pair<TER, XRPAmount>
 Transactor::reset(XRPAmount fee)
diff --git a/src/libxrpl/tx/paths/BookStep.cpp b/src/libxrpl/tx/paths/BookStep.cpp
index bf24c66ee1..71902ce8b9 100644
--- a/src/libxrpl/tx/paths/BookStep.cpp
+++ b/src/libxrpl/tx/paths/BookStep.cpp
@@ -66,13 +66,14 @@ protected:
     bool const ownerPaysTransferFee_;
     // Mark as inactive (dry) if too many offers are consumed
     bool inactive_ = false;
-    /** Number of offers consumed or partially consumed the last time
-        the step ran, including expired and unfunded offers.
-
-        N.B. This is not the total number offers consumed by this step for the
-        entire payment, it is only the number the last time it ran. Offers may
-        be partially consumed multiple times during a payment.
-    */
+    /**
+     * Number of offers consumed or partially consumed the last time
+     * the step ran, including expired and unfunded offers.
+     *
+     * N.B. This is not the total number offers consumed by this step for the
+     * entire payment, it is only the number the last time it ran. Offers may
+     * be partially consumed multiple times during a payment.
+     */
     std::uint32_t offersUsed_ = 0;
     // If set, AMM liquidity might be available
     // if AMM offer quality is better than CLOB offer
diff --git a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
index 92a8dccdb9..e03cb56fd5 100644
--- a/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
+++ b/src/libxrpl/tx/transactors/bridge/XChainBridge.cpp
@@ -238,35 +238,35 @@ claimHelper(
 }
 
 /**
- Handle a new attestation event.
-
- Attempt to add the given attestation and reconcile with the current
- signer's list. Attestations that are not part of the current signer's
- list will be removed.
-
- @param claimAtt New attestation to add. It will be added if it is not
- already part of the collection, or attests to a larger value.
-
- @param quorum Min weight required for a quorum
-
- @param signersList Map from signer's account id (derived from public keys)
- to the weight of that key.
-
- @return optional reward accounts. If after handling the new attestation
- there is a quorum for the amount specified on the new attestation, then
- return the reward accounts for that amount, otherwise return a nullopt.
- Note that if the signer's list changes and there have been `commit`
- transactions of different amounts then there may be a different subset that
- has reached quorum. However, to "trigger" that subset would require adding
- (or re-adding) an attestation that supports that subset.
-
- The reason for using a nullopt instead of an empty vector when a quorum is
- not reached is to allow for an interface where a quorum is reached but no
- rewards are distributed.
-
- @note This function is not called `add` because it does more than just
-       add the new attestation (in fact, it may not add the attestation at
-       all). Instead, it handles the event of a new attestation.
+ * Handle a new attestation event.
+ *
+ * Attempt to add the given attestation and reconcile with the current
+ * signer's list. Attestations that are not part of the current signer's
+ * list will be removed.
+ *
+ * @param claimAtt New attestation to add. It will be added if it is not
+ * already part of the collection, or attests to a larger value.
+ *
+ * @param quorum Min weight required for a quorum
+ *
+ * @param signersList Map from signer's account id (derived from public keys)
+ * to the weight of that key.
+ *
+ * @return optional reward accounts. If after handling the new attestation
+ * there is a quorum for the amount specified on the new attestation, then
+ * return the reward accounts for that amount, otherwise return a nullopt.
+ * Note that if the signer's list changes and there have been `commit`
+ * transactions of different amounts then there may be a different subset that
+ * has reached quorum. However, to "trigger" that subset would require adding
+ * (or re-adding) an attestation that supports that subset.
+ *
+ * The reason for using a nullopt instead of an empty vector when a quorum is
+ * not reached is to allow for an interface where a quorum is reached but no
+ * rewards are distributed.
+ *
+ * @note This function is not called `add` because it does more than just
+ *       add the new attestation (in fact, it may not add the attestation at
+ *       all). Instead, it handles the event of a new attestation.
  */
 struct OnNewAttestationResult
 {
@@ -364,26 +364,27 @@ struct TransferHelperSubmittingAccountInfo
     STAmount postFeeBalance;
 };
 
-/** Transfer funds from the src account to the dst account
-
-    @param psb The payment sandbox.
-    @param src The source of funds.
-    @param dst The destination for funds.
-    @param dstTag Integer destination tag. Used to check if funds should be
-           transferred to an account with a `RequireDstTag` flag set.
-    @param claimOwner Owner of the claim ledger object.
-    @param amt Amount to transfer from the src account to the dst account.
-    @param canCreate Flag to determine if accounts may be created using this
-           transfer.
-    @param depositAuthPolicy Flag to determine if dst can bypass deposit auth if
-           it is also the claim owner.
-    @param submittingAccountInfo If the transaction is allowed to dip into the
-           reserve to pay fees, then this optional will be seated ("commit"
-           transactions support this, other transactions should not).
-    @param j Log
-
-    @return tesSUCCESS if payment succeeds, otherwise the error code for the
-            failure reason.
+/**
+ * Transfer funds from the src account to the dst account
+ *
+ * @param psb The payment sandbox.
+ * @param src The source of funds.
+ * @param dst The destination for funds.
+ * @param dstTag Integer destination tag. Used to check if funds should be
+ *        transferred to an account with a `RequireDstTag` flag set.
+ * @param claimOwner Owner of the claim ledger object.
+ * @param amt Amount to transfer from the src account to the dst account.
+ * @param canCreate Flag to determine if accounts may be created using this
+ *        transfer.
+ * @param depositAuthPolicy Flag to determine if dst can bypass deposit auth if
+ *        it is also the claim owner.
+ * @param submittingAccountInfo If the transaction is allowed to dip into the
+ *        reserve to pay fees, then this optional will be seated ("commit"
+ *        transactions support this, other transactions should not).
+ * @param j Log
+ *
+ * @return tesSUCCESS if payment succeeds, otherwise the error code for the
+ *         failure reason.
  */
 
 TER
@@ -504,21 +505,28 @@ transferHelper(
     return tecXCHAIN_PAYMENT_FAILED;
 }
 
-/**  Action to take when the transfer from the door account to the dst fails
-
-     @note This is useful to prevent a failed "create account" transaction from
-           blocking subsequent "create account" transactions.
-*/
+/**
+ * Action to take when the transfer from the door account to the dst fails
+ *
+ * @note This is useful to prevent a failed "create account" transaction from
+ *       blocking subsequent "create account" transactions.
+ */
 enum class OnTransferFail {
-    /** Remove the claim even if the transfer fails */
+    /**
+     * Remove the claim even if the transfer fails
+     */
     RemoveClaim,
-    /**  Keep the claim if the transfer fails */
+    /**
+     * Keep the claim if the transfer fails
+     */
     KeepClaim
 };
 
 struct FinalizeClaimHelperResult
 {
-    /// TER for transfering the payment funds
+    /**
+     * TER for transfering the payment funds
+     */
     std::optional<TER> mainFundsTer;
     // TER for transfering the reward funds
     std::optional<TER> rewardTer;
@@ -562,33 +570,34 @@ struct FinalizeClaimHelperResult
     }
 };
 
-/** Transfer funds from the door account to the dst and distribute rewards
-
-    @param psb The payment sandbox.
-    @param bridgeSpc Bridge
-    @param dst The destination for funds.
-    @param dstTag Integer destination tag. Used to check if funds should be
-           transferred to an account with a `RequireDstTag` flag set.
-    @param claimOwner Owner of the claim ledger object.
-    @param sendingAmount Amount that was committed on the source chain.
-    @param rewardPoolSrc Source of the funds for the reward pool (claim owner).
-    @param rewardPool Amount to split among the rewardAccounts.
-    @param rewardAccounts Account to receive the reward pool.
-    @param srcChain Chain where the commit event occurred.
-    @param sleClaimID sle for the claim id (may be NULL or XChainClaimID or
-           XChainCreateAccountClaimID). Don't read fields that aren't in common
-           with those two types and always check for NULL. Remove on success (if
-           not null). Remove on fail if the onTransferFail flag is removeClaim.
-    @param onTransferFail Flag to determine if the claim is removed on transfer
-           failure. This is used for create account transactions where claims
-           are removed so they don't block future txns.
-    @param j Log
-
-    @return FinalizeClaimHelperResult. See the comments in this struct for what
-            the fields mean. The individual ters need to be returned instead of
-            an overall ter because the caller needs this information if the
-            attestation list changed or not.
-*/
+/**
+ * Transfer funds from the door account to the dst and distribute rewards
+ *
+ * @param psb The payment sandbox.
+ * @param bridgeSpc Bridge
+ * @param dst The destination for funds.
+ * @param dstTag Integer destination tag. Used to check if funds should be
+ *        transferred to an account with a `RequireDstTag` flag set.
+ * @param claimOwner Owner of the claim ledger object.
+ * @param sendingAmount Amount that was committed on the source chain.
+ * @param rewardPoolSrc Source of the funds for the reward pool (claim owner).
+ * @param rewardPool Amount to split among the rewardAccounts.
+ * @param rewardAccounts Account to receive the reward pool.
+ * @param srcChain Chain where the commit event occurred.
+ * @param sleClaimID sle for the claim id (may be NULL or XChainClaimID or
+ *        XChainCreateAccountClaimID). Don't read fields that aren't in common
+ *        with those two types and always check for NULL. Remove on success (if
+ *        not null). Remove on fail if the onTransferFail flag is removeClaim.
+ * @param onTransferFail Flag to determine if the claim is removed on transfer
+ *        failure. This is used for create account transactions where claims
+ *        are removed so they don't block future txns.
+ * @param j Log
+ *
+ * @return FinalizeClaimHelperResult. See the comments in this struct for what
+ *         the fields mean. The individual ters need to be returned instead of
+ *         an overall ter because the caller needs this information if the
+ *         attestation list changed or not.
+ */
 
 FinalizeClaimHelperResult
 finalizeClaimHelper(
@@ -733,15 +742,16 @@ finalizeClaimHelper(
     return result;
 }
 
-/** Get signers list corresponding to the account that owns the bridge
-
-    @param view View to read the signer's list from.
-    @param sleBridge Sle of the bridge.
-    @param j Log
-
-    @return map of the signer's list (AccountIDs and weights), the quorum, and
-            error code
-*/
+/**
+ * Get signers list corresponding to the account that owns the bridge
+ *
+ * @param view View to read the signer's list from.
+ * @param sleBridge Sle of the bridge.
+ * @param j Log
+ *
+ * @return map of the signer's list (AccountIDs and weights), the quorum, and
+ *         error code
+ */
 std::tuple<std::unordered_map<AccountID, std::uint32_t>, std::uint32_t, TER>
 getSignersListAndQuorum(ReadView const& view, SLE const& sleBridge, beast::Journal j)
 {
diff --git a/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp b/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
index 6a9600d060..0d1798babc 100644
--- a/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMDeposit.cpp
@@ -680,7 +680,8 @@ adjustLPTokensOut(
     return adjustLPTokens(lptAMMBalance, lpTokensDeposit, IsDeposit::Yes);
 }
 
-/** Proportional deposit of pools assets in exchange for the specified
+/**
+ * Proportional deposit of pools assets in exchange for the specified
  * amount of LPTokens.
  */
 std::pair<TER, STAmount>
@@ -728,7 +729,8 @@ AMMDeposit::equalDepositTokens(
     }
 }
 
-/** Proportional deposit of pool assets with the constraints on the maximum
+/**
+ * Proportional deposit of pool assets with the constraints on the maximum
  * amount of each asset that the trader is willing to deposit.
  *      a = (t/T) * A (1)
  *      b = (t/T) * B (2)
@@ -829,7 +831,8 @@ AMMDeposit::equalDepositLimit(
     return {tecAMM_FAILED, STAmount{}};
 }
 
-/** Single asset deposit of the amount of asset specified by Asset1In.
+/**
+ * Single asset deposit of the amount of asset specified by Asset1In.
  *       t = T * (b / B - x) / (1 + x) (3)
  *      where
  *         f1 = (1 - 0.5 * tfee) / (1 - tfee)
@@ -877,7 +880,8 @@ AMMDeposit::singleDeposit(
         tfee);
 }
 
-/** Single asset asset1 is deposited to obtain some share of
+/**
+ * Single asset asset1 is deposited to obtain some share of
  * the AMM instance's pools represented by amount of LPTokens.
  * Use equation 4 to compute the amount of asset1 to be deposited,
  * given t represented by amount of LPTokens. Equation 4 solves
@@ -915,7 +919,8 @@ AMMDeposit::singleDepositTokens(
         tfee);
 }
 
-/** Single asset deposit with two constraints.
+/**
+ * Single asset deposit with two constraints.
  * a. Amount of asset1 if specified (not 0) in Asset1In specifies the maximum
  *     amount of asset1 that the trader is willing to deposit.
  * b. The effective-price of the LPToken traded out does not exceed
diff --git a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
index ff27a58ad7..2baa7edfb4 100644
--- a/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
+++ b/src/libxrpl/tx/transactors/dex/AMMWithdraw.cpp
@@ -760,7 +760,8 @@ adjustLPTokensIn(
     return adjustLPTokens(lptAMMBalance, lpTokensWithdraw, IsDeposit::No);
 }
 
-/** Proportional withdrawal of pool assets for the amount of LPTokens.
+/**
+ * Proportional withdrawal of pool assets for the amount of LPTokens.
  */
 std::pair<TER, STAmount>
 AMMWithdraw::equalWithdrawTokens(
@@ -824,7 +825,8 @@ AMMWithdraw::deleteAMMAccountIfEmpty(
     return {ter, true};
 }
 
-/** Proportional withdrawal of pool assets for the amount of LPTokens.
+/**
+ * Proportional withdrawal of pool assets for the amount of LPTokens.
  */
 std::tuple<TER, STAmount, STAmount, std::optional<STAmount>>
 AMMWithdraw::equalWithdrawTokens(
@@ -910,7 +912,8 @@ AMMWithdraw::equalWithdrawTokens(
     // LCOV_EXCL_STOP
 }
 
-/** All assets withdrawal with the constraints on the maximum amount
+/**
+ * All assets withdrawal with the constraints on the maximum amount
  * of each asset that the trader is willing to withdraw.
  *       a = (t/T) * A (5)
  *       b = (t/T) * B (6)
@@ -1000,7 +1003,8 @@ AMMWithdraw::equalWithdrawLimit(
         tfee);
 }
 
-/** Withdraw single asset equivalent to the amount specified in Asset1Out.
+/**
+ * Withdraw single asset equivalent to the amount specified in Asset1Out.
  * t = T * (c - sqrt(c**2 - 4*R))/2
  *     where R = b/B, c = R*fee + 2 - fee
  * Use equation 7 to compute the t, given the amount in Asset1Out.
@@ -1046,7 +1050,8 @@ AMMWithdraw::singleWithdraw(
         tfee);
 }
 
-/** withdrawal of single asset specified in Asset1Out proportional
+/**
+ * withdrawal of single asset specified in Asset1Out proportional
  * to the share represented by the amount of LPTokens.
  * Use equation 8 to compute the amount of asset1, given the redeemed t
  *   represented by LPTokens. Let this be Y.
@@ -1090,7 +1095,8 @@ AMMWithdraw::singleWithdrawTokens(
     return {tecAMM_FAILED, STAmount{}};
 }
 
-/** Withdraw single asset with two constraints.
+/**
+ * Withdraw single asset with two constraints.
  * a. amount of asset1 if specified (not 0) in Asset1Out specifies the minimum
  *     amount of asset1 that the trader is willing to withdraw.
  * b. The effective price of asset traded out does not exceed the amount
diff --git a/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.cpp b/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.cpp
index 9978d3e260..dc1b323482 100644
--- a/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.cpp
+++ b/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainDelete.cpp
@@ -42,7 +42,9 @@ PermissionedDomainDelete::preclaim(PreclaimContext const& ctx)
     return tesSUCCESS;
 }
 
-/** Attempt to delete the Permissioned Domain. */
+/**
+ * Attempt to delete the Permissioned Domain.
+ */
 TER
 PermissionedDomainDelete::doApply()
 {
diff --git a/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.cpp b/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.cpp
index c2df114e48..61ebdcf9c7 100644
--- a/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.cpp
+++ b/src/libxrpl/tx/transactors/permissioned_domain/PermissionedDomainSet.cpp
@@ -73,7 +73,9 @@ PermissionedDomainSet::preclaim(PreclaimContext const& ctx)
     return tesSUCCESS;
 }
 
-/** Attempt to create the Permissioned Domain. */
+/**
+ * Attempt to create the Permissioned Domain.
+ */
 TER
 PermissionedDomainSet::doApply()
 {
diff --git a/src/test/app/AMMCalc_test.cpp b/src/test/app/AMMCalc_test.cpp
index 3c4a62bfd3..74080e669c 100644
--- a/src/test/app/AMMCalc_test.cpp
+++ b/src/test/app/AMMCalc_test.cpp
@@ -31,7 +31,8 @@
 
 namespace xrpl::test {
 
-/** AMM Calculator. Uses AMM formulas to simulate the payment engine
+/**
+ * AMM Calculator. Uses AMM formulas to simulate the payment engine
  * expected results. Assuming the formulas are correct some unit-tests can
  * be verified. Currently supported operations are:
  *  - swapIn, find out given in. in can flow through multiple AMM/Offer steps.
diff --git a/src/test/app/AMMExtendedMPT_test.cpp b/src/test/app/AMMExtendedMPT_test.cpp
index 63b7841fba..f04ea39f2b 100644
--- a/src/test/app/AMMExtendedMPT_test.cpp
+++ b/src/test/app/AMMExtendedMPT_test.cpp
@@ -2296,8 +2296,10 @@ private:
             // 1,400e12 - 56.3368e12*1.25 = 1400e12 - 70.4210e12 =
             // 1329.5789e12GBP
             env.require(Balance(alice_, gbp(1'329'578'947'368'420)));
-            //// 25% on 56.3368e12ETH is paid in tr fee 56.3368e12*1.25
-            ///= 70.4210e12ETH
+            /**
+             * / 25% on 56.3368e12ETH is paid in tr fee 56.3368e12*1.25
+             * = 70.4210e12ETH
+             */
             // 56.3368e12GBP is swapped in for 53.3322e12ETH
             BEAST_EXPECT(amm.expectBalances(
                 gbp(1'056'336'842'105'264), eth(946'667'729'591'836), amm.tokens()));
diff --git a/src/test/app/AMMExtended_test.cpp b/src/test/app/AMMExtended_test.cpp
index 563bb3ca33..bb532b361a 100644
--- a/src/test/app/AMMExtended_test.cpp
+++ b/src/test/app/AMMExtended_test.cpp
@@ -2420,8 +2420,10 @@ private:
                 // 1,400 - 56.3368*1.25 = 1400 - 70.4210 = 1329.5789GBP
                 BEAST_EXPECT(
                     expectHolding(env, alice_, STAmount{GBP, UINT64_C(1'329'578947368421), -12}));
-                //// 25% on 56.3368EUR is paid in tr fee 56.3368*1.25
-                ///= 70.4210EUR
+                /**
+                 * / 25% on 56.3368EUR is paid in tr fee 56.3368*1.25
+                 * = 70.4210EUR
+                 */
                 // 56.3368GBP is swapped in for 53.3322EUR
                 BEAST_EXPECT(amm.expectBalances(
                     STAmount{GBP, UINT64_C(1'056'336842105263), -12},
@@ -2435,8 +2437,10 @@ private:
                 // 1,400 - 56.3368*1.25 = 1400 - 70.4210 = 1329.5789GBP
                 BEAST_EXPECT(
                     expectHolding(env, alice_, STAmount{GBP, UINT64_C(1'329'57894736842), -11}));
-                //// 25% on 56.3368EUR is paid in tr fee 56.3368*1.25
-                ///= 70.4210EUR
+                /**
+                 * / 25% on 56.3368EUR is paid in tr fee 56.3368*1.25
+                 * = 70.4210EUR
+                 */
                 // 56.3368GBP is swapped in for 53.3322EUR
                 BEAST_EXPECT(amm.expectBalances(
                     STAmount{GBP, UINT64_C(1'056'336842105264), -12},
diff --git a/src/test/app/CheckMPT_test.cpp b/src/test/app/CheckMPT_test.cpp
index 93e752154c..6370be7b6f 100644
--- a/src/test/app/CheckMPT_test.cpp
+++ b/src/test/app/CheckMPT_test.cpp
@@ -1411,7 +1411,8 @@ class CheckMPT_test : public beast::unit_test::Suite
                 return acct.id();
             }
 
-            /** Create MPTTester if it doesn't exist for the given MPT.
+            /**
+             * Create MPTTester if it doesn't exist for the given MPT.
              * Increment owners if created since it creates MPTokenIssuance
              */
             MPT
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 8a1f24e30b..461a151d8e 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -101,7 +101,8 @@ class Invariants_test : public beast::unit_test::Suite
         return xrpl::test::jtx::testableAmendments() | fixCleanup3_1_3 | fixCleanup3_2_0;
     }
 
-    /** Run a specific test case to put the ledger into a state that will be
+    /**
+     * Run a specific test case to put the ledger into a state that will be
      * detected by an invariant. Simulates the actions of a transaction that
      * would violate an invariant.
      *
diff --git a/src/test/app/LedgerHistory_test.cpp b/src/test/app/LedgerHistory_test.cpp
index 3d0e546678..f8688899e0 100644
--- a/src/test/app/LedgerHistory_test.cpp
+++ b/src/test/app/LedgerHistory_test.cpp
@@ -29,13 +29,13 @@ namespace xrpl::test {
 class LedgerHistory_test : public beast::unit_test::Suite
 {
 public:
-    /** Generate a new ledger by hand, applying a specific close time offset
-        and optionally inserting a transaction.
-
-        If prev is nullptr, then the genesis ledger is made and no offset or
-        transaction is applied.
-
-    */
+    /**
+     * Generate a new ledger by hand, applying a specific close time offset
+     * and optionally inserting a transaction.
+     *
+     * If prev is nullptr, then the genesis ledger is made and no offset or
+     * transaction is applied.
+     */
     static std::shared_ptr<Ledger>
     makeLedger(
         std::shared_ptr<Ledger const> const& prev,
diff --git a/src/test/app/Loan_test.cpp b/src/test/app/Loan_test.cpp
index 569306e920..371fcae54f 100644
--- a/src/test/app/Loan_test.cpp
+++ b/src/test/app/Loan_test.cpp
@@ -324,7 +324,8 @@ protected:
         TenthBips32 const interestRate{};
     };
 
-    /** Helper class to compare the expected state of a loan and loan broker
+    /**
+     * Helper class to compare the expected state of a loan and loan broker
      * against the data in the ledger.
      */
     struct VerifyLoanStatus
@@ -344,7 +345,8 @@ protected:
         {
         }
 
-        /** Checks the expected broker state against the ledger
+        /**
+         * Checks the expected broker state against the ledger
          */
         void
         checkBroker(
@@ -415,7 +417,9 @@ protected:
             }
         }
 
-        /** Checks both the loan and broker expect states against the ledger */
+        /**
+         * Checks both the loan and broker expect states against the ledger
+         */
         void
         operator()(
             std::uint32_t previousPaymentDate,
@@ -475,7 +479,9 @@ protected:
             }
         }
 
-        /** Checks both the loan and broker expect states against the ledger */
+        /**
+         * Checks both the loan and broker expect states against the ledger
+         */
         void
         operator()(LoanState const& state) const
         {
@@ -541,7 +547,9 @@ protected:
         return {asset, keylet, vaultKeylet, params};
     }
 
-    /// Get the state without checking anything
+    /**
+     * Get the state without checking anything
+     */
     LoanState
     getCurrentState(jtx::Env const& env, BrokerInfo const& broker, Keylet const& loanKeylet)
     {
@@ -569,8 +577,10 @@ protected:
         return LoanState{};
     }
 
-    /// Get the state and check the values against the parameters used in
-    /// `lifecycle`
+    /**
+     * Get the state and check the values against the parameters used in
+     * `lifecycle`
+     */
     LoanState
     getCurrentState(
         jtx::Env const& env,
@@ -1242,7 +1252,8 @@ protected:
             PaymentParameters{.showStepBalances = true});
     }
 
-    /** Runs through the complete lifecycle of a loan
+    /**
+     * Runs through the complete lifecycle of a loan
      *
      * 1. Create a loan.
      * 2. Test a bunch of transaction failure conditions.
@@ -1560,7 +1571,8 @@ protected:
         return "Unknown";
     }
 
-    /** Wrapper to run a series of lifecycle tests for a given asset and loan
+    /**
+     * Wrapper to run a series of lifecycle tests for a given asset and loan
      * amount
      *
      * Will be used in the future to vary the loan parameters. For now, it is
diff --git a/src/test/app/Ticket_test.cpp b/src/test/app/Ticket_test.cpp
index 5700503830..f14afd5990 100644
--- a/src/test/app/Ticket_test.cpp
+++ b/src/test/app/Ticket_test.cpp
@@ -47,9 +47,11 @@ namespace xrpl {
 
 class Ticket_test : public beast::unit_test::Suite
 {
-    /// @brief Validate metadata for a successful TicketCreate transaction.
-    ///
-    /// @param env current jtx env (tx and meta are extracted using it)
+    /**
+     * @brief Validate metadata for a successful TicketCreate transaction.
+     *
+     * @param env current jtx env (tx and meta are extracted using it)
+     */
     void
     checkTicketCreateMeta(test::jtx::Env& env)
     {
@@ -233,11 +235,13 @@ class Ticket_test : public beast::unit_test::Suite
         BEAST_EXPECT(*ticketSeqs.rbegin() == acctRootFinalSeq - 1);
     }
 
-    /// @brief Validate metadata for a ticket using transaction.
-    ///
-    /// The transaction may have been successful or failed with a tec.
-    ///
-    /// @param env current jtx env (tx and meta are extracted using it)
+    /**
+     * @brief Validate metadata for a ticket using transaction.
+     *
+     * The transaction may have been successful or failed with a tec.
+     *
+     * @param env current jtx env (tx and meta are extracted using it)
+     */
     void
     checkTicketConsumeMeta(test::jtx::Env& env)
     {
diff --git a/src/test/beast/define_print.cpp b/src/test/beast/define_print.cpp
index 569b06ca67..e6b24e5cf2 100644
--- a/src/test/beast/define_print.cpp
+++ b/src/test/beast/define_print.cpp
@@ -15,7 +15,9 @@
 
 namespace beast::unit_test {
 
-/** A suite that prints the list of globally defined suites. */
+/**
+ * A suite that prints the list of globally defined suites.
+ */
 class print_test : public Suite
 {
 public:
diff --git a/src/test/consensus/DistributedValidatorsSim_test.cpp b/src/test/consensus/DistributedValidatorsSim_test.cpp
index 1def09db13..437ad81ee0 100644
--- a/src/test/consensus/DistributedValidatorsSim_test.cpp
+++ b/src/test/consensus/DistributedValidatorsSim_test.cpp
@@ -21,7 +21,8 @@
 
 namespace xrpl::test {
 
-/** In progress simulations for diversifying and distributing validators
+/**
+ * In progress simulations for diversifying and distributing validators
  */
 class DistributedValidators_test : public beast::unit_test::Suite
 {
diff --git a/src/test/consensus/LedgerTrie_test.cpp b/src/test/consensus/LedgerTrie_test.cpp
index 0ddf1bf82f..a4eb7bc087 100644
--- a/src/test/consensus/LedgerTrie_test.cpp
+++ b/src/test/consensus/LedgerTrie_test.cpp
@@ -519,17 +519,18 @@ class LedgerTrie_test : public beast::unit_test::Suite
 
         // Changing largestSeq perspective changes preferred branch
         {
-            /** Build the tree below with initial tip support annotated
-                   A
-                  / \
-               B(1)  C(1)
-              /  |   |
-             H   D   F(1)
-                 |
-                 E(2)
-                 |
-                 G
-            */
+            /**
+             * Build the tree below with initial tip support annotated
+             *       A
+             *      / \
+             *   B(1)  C(1)
+             *  /  |   |
+             * H   D   F(1)
+             *     |
+             *     E(2)
+             *     |
+             *     G
+             */
             LedgerTrie<Ledger> t;
             LedgerHistoryHelper h;
             t.insert(h["ab"]);
@@ -548,17 +549,18 @@ class LedgerTrie_test : public beast::unit_test::Suite
             BEAST_EXPECT(t.getPreferred(Seq{4})->id == h["a"].id());
             // NOLINTEND(bugprone-unchecked-optional-access)
 
-            /** One of E advancing to G doesn't change anything
-                   A
-                  / \
-               B(1)  C(1)
-              /  |   |
-             H   D   F(1)
-                 |
-                 E(1)
-                 |
-                 G(1)
-            */
+            /**
+             * One of E advancing to G doesn't change anything
+             *       A
+             *      / \
+             *   B(1)  C(1)
+             *  /  |   |
+             * H   D   F(1)
+             *     |
+             *     E(1)
+             *     |
+             *     G(1)
+             */
             t.remove(h["abde"]);
             t.insert(h["abdeg"]);
 
@@ -570,17 +572,18 @@ class LedgerTrie_test : public beast::unit_test::Suite
             BEAST_EXPECT(t.getPreferred(Seq{5})->id == h["a"].id());
             // NOLINTEND(bugprone-unchecked-optional-access)
 
-            /** C advancing to H does advance the seq 3 preferred ledger
-                   A
-                  / \
-               B(1)  C
-              /  |   |
-             H(1)D   F(1)
-                 |
-                 E(1)
-                 |
-                 G(1)
-            */
+            /**
+             * C advancing to H does advance the seq 3 preferred ledger
+             *       A
+             *      / \
+             *   B(1)  C
+             *  /  |   |
+             * H(1)D   F(1)
+             *     |
+             *     E(1)
+             *     |
+             *     G(1)
+             */
             t.remove(h["ac"]);
             t.insert(h["abh"]);
 
@@ -592,17 +595,18 @@ class LedgerTrie_test : public beast::unit_test::Suite
             BEAST_EXPECT(t.getPreferred(Seq{5})->id == h["a"].id());
             // NOLINTEND(bugprone-unchecked-optional-access)
 
-            /** F advancing to E also moves the preferred ledger forward
-                   A
-                  / \
-               B(1)  C
-              /  |   |
-             H(1)D   F
-                 |
-                 E(2)
-                 |
-                 G(1)
-            */
+            /**
+             * F advancing to E also moves the preferred ledger forward
+             *       A
+             *      / \
+             *   B(1)  C
+             *  /  |   |
+             * H(1)D   F
+             *     |
+             *     E(2)
+             *     |
+             *     G(1)
+             */
             t.remove(h["acf"]);
             t.insert(h["abde"]);
 
diff --git a/src/test/core/Config_test.cpp b/src/test/core/Config_test.cpp
index 17c48b1ccc..e98a0e1e88 100644
--- a/src/test/core/Config_test.cpp
+++ b/src/test/core/Config_test.cpp
@@ -124,7 +124,7 @@ backend=sqlite
 }
 
 /**
-   Write an xrpld config file and remove when done.
+ * Write an xrpld config file and remove when done.
  */
 class FileCfgGuard : public xrpl::detail::FileDirGuard
 {
@@ -235,7 +235,7 @@ more-xrpl-validators.net
 }
 
 /**
-   Write a validators.txt file and remove when done.
+ * Write a validators.txt file and remove when done.
  */
 class ValidatorsTxtGuard : public detail::FileDirGuard
 {
diff --git a/src/test/csf/BasicNetwork.h b/src/test/csf/BasicNetwork.h
index 4b88592128..0428475504 100644
--- a/src/test/csf/BasicNetwork.h
+++ b/src/test/csf/BasicNetwork.h
@@ -6,59 +6,59 @@
 #include <cassert>
 
 namespace xrpl::test::csf {
-/** Peer to peer network simulator.
-
-    The network is formed from a set of Peer objects representing
-    vertices and configurable connections representing edges.
-    The caller is responsible for creating the Peer objects ahead
-    of time.
-
-    Peer objects cannot be destroyed once the BasicNetwork is
-    constructed. To handle peers going online and offline,
-    callers can simply disconnect all links and reconnect them
-    later. Connections are directed, one end is the inbound
-    Peer and the other is the outbound Peer.
-
-    Peers may send messages along their connections. To simulate
-    the effects of latency, these messages can be delayed by a
-    configurable duration set when the link is established.
-    Messages always arrive in the order they were sent on a
-    particular connection.
-
-    A message is modeled using a lambda function. The caller
-    provides the code to execute upon delivery of the message.
-    If a Peer is disconnected, all messages pending delivery
-    at either end of the connection will not be delivered.
-
-    When creating the Peer set, the caller needs to provide a
-    Scheduler object for managing the timing and delivery
-    of messages. After constructing the network, and establishing
-    connections, the caller uses the scheduler's step* functions
-    to drive messages through the network.
-
-    The graph of peers and connections is internally represented
-    using Digraph<Peer,BasicNetwork::LinkType>. Clients have
-    const access to that graph to perform additional operations not
-    directly provided by BasicNetwork.
-
-    Peer Requirements:
-
-        Peer should be a lightweight type, cheap to copy
-        and/or move. A good candidate is a simple pointer to
-        the underlying user defined type in the simulation.
-
-        Expression      Type        Requirements
-        ----------      ----        ------------
-        P               Peer
-        u, v                        Values of type P
-        P u(v)                      CopyConstructible
-        u.~P()                      Destructible
-        u == v          bool        EqualityComparable
-        u < v           bool        LessThanComparable
-        std::hash<P>    class       std::hash is defined for P
-        ! u             bool        true if u is not-a-peer
-
-*/
+/**
+ * Peer to peer network simulator.
+ *
+ * The network is formed from a set of Peer objects representing
+ * vertices and configurable connections representing edges.
+ * The caller is responsible for creating the Peer objects ahead
+ * of time.
+ *
+ * Peer objects cannot be destroyed once the BasicNetwork is
+ * constructed. To handle peers going online and offline,
+ * callers can simply disconnect all links and reconnect them
+ * later. Connections are directed, one end is the inbound
+ * Peer and the other is the outbound Peer.
+ *
+ * Peers may send messages along their connections. To simulate
+ * the effects of latency, these messages can be delayed by a
+ * configurable duration set when the link is established.
+ * Messages always arrive in the order they were sent on a
+ * particular connection.
+ *
+ * A message is modeled using a lambda function. The caller
+ * provides the code to execute upon delivery of the message.
+ * If a Peer is disconnected, all messages pending delivery
+ * at either end of the connection will not be delivered.
+ *
+ * When creating the Peer set, the caller needs to provide a
+ * Scheduler object for managing the timing and delivery
+ * of messages. After constructing the network, and establishing
+ * connections, the caller uses the scheduler's step* functions
+ * to drive messages through the network.
+ *
+ * The graph of peers and connections is internally represented
+ * using Digraph<Peer,BasicNetwork::LinkType>. Clients have
+ * const access to that graph to perform additional operations not
+ * directly provided by BasicNetwork.
+ *
+ * Peer Requirements:
+ *
+ *     Peer should be a lightweight type, cheap to copy
+ *     and/or move. A good candidate is a simple pointer to
+ *     the underlying user defined type in the simulation.
+ *
+ *     Expression      Type        Requirements
+ *     ----------      ----        ------------
+ *     P               Peer
+ *     u, v                        Values of type P
+ *     P u(v)                      CopyConstructible
+ *     u.~P()                      Destructible
+ *     u == v          bool        EqualityComparable
+ *     u < v           bool        LessThanComparable
+ *     std::hash<P>    class       std::hash is defined for P
+ *     ! u             bool        true if u is not-a-peer
+ */
 template <class Peer>
 class BasicNetwork
 {
@@ -92,79 +92,84 @@ public:
 
     BasicNetwork(Scheduler& s);
 
-    /** Connect two peers.
-
-        The link is directed, with `from` establishing
-        the outbound connection and `to` receiving the
-        incoming connection.
-
-        Preconditions:
-
-            from != to (self connect disallowed).
-
-            A link between from and to does not
-            already exist (duplicates disallowed).
-
-        Effects:
-
-            Creates a link between from and to.
-
-        @param `from` The source of the outgoing connection
-        @param `to` The recipient of the incoming connection
-        @param `delay` The time delay of all delivered messages
-        @return `true` if a new connection was established
-    */
+    /**
+     * Connect two peers.
+     *
+     * The link is directed, with `from` establishing
+     * the outbound connection and `to` receiving the
+     * incoming connection.
+     *
+     * Preconditions:
+     *
+     *     from != to (self connect disallowed).
+     *
+     *     A link between from and to does not
+     *     already exist (duplicates disallowed).
+     *
+     * Effects:
+     *
+     *     Creates a link between from and to.
+     *
+     * @param `from` The source of the outgoing connection
+     * @param `to` The recipient of the incoming connection
+     * @param `delay` The time delay of all delivered messages
+     * @return `true` if a new connection was established
+     */
     bool
     connect(Peer const& from, Peer const& to, duration const& delay = std::chrono::seconds{0});
 
-    /** Break a link.
-
-        Effects:
-
-            If a connection is present, both ends are
-            disconnected.
-
-            Any pending messages on the connection
-            are discarded.
-
-        @return `true` if a connection was broken.
-    */
+    /**
+     * Break a link.
+     *
+     * Effects:
+     *
+     *     If a connection is present, both ends are
+     *     disconnected.
+     *
+     *     Any pending messages on the connection
+     *     are discarded.
+     *
+     * @return `true` if a connection was broken.
+     */
     bool
     disconnect(Peer const& peer1, Peer const& peer2);
 
-    /** Send a message to a peer.
-
-        Preconditions:
-
-            A link exists between from and to.
-
-        Effects:
-
-            If the link is not broken when the
-            link's `delay` time has elapsed,
-            the function will be invoked with
-            no arguments.
-
-        @note Its the caller's responsibility to
-        ensure that the body of the function performs
-        activity consistent with `from`'s receipt of
-        a message from `to`.
-    */
+    /**
+     * Send a message to a peer.
+     *
+     * Preconditions:
+     *
+     *     A link exists between from and to.
+     *
+     * Effects:
+     *
+     *     If the link is not broken when the
+     *     link's `delay` time has elapsed,
+     *     the function will be invoked with
+     *     no arguments.
+     *
+     * @note Its the caller's responsibility to
+     * ensure that the body of the function performs
+     * activity consistent with `from`'s receipt of
+     * a message from `to`.
+     */
     template <class Function>
     void
     send(Peer const& from, Peer const& to, Function&& f);
 
-    /** Return the range of active links.
-
-        @return A random access range over Digraph::Edge instances
-    */
+    /**
+     * Return the range of active links.
+     *
+     * @return A random access range over Digraph::Edge instances
+     */
     auto
     links(Peer const& from)
     {
         return links_.outEdges(from);
     }
 
-    /** Return the underlying digraph
+    /**
+     * Return the underlying digraph
      */
     [[nodiscard]] Digraph<Peer, LinkType> const&
     graph() const
diff --git a/src/test/csf/CollectorRef.h b/src/test/csf/CollectorRef.h
index 5bc55c7515..3aef4d617f 100644
--- a/src/test/csf/CollectorRef.h
+++ b/src/test/csf/CollectorRef.h
@@ -12,45 +12,45 @@
 
 namespace xrpl::test::csf {
 
-/** Holds a type-erased reference to an arbitrary collector.
-
-    A collector is any class that implements
-
-        on(NodeID, SimTime, Event)
-
-    for all events emitted by a Peer.
-
-    This class is used to type-erase the actual collector used by each peer in
-    the simulation. The idea is to compose complicated and typed collectors
-   using the helpers in collectors.h, then only type erase at the higher-most
-   level when adding to the simulation.
-
-    The example code below demonstrates the reason for storing the collector
-    as a reference.  The collector's lifetime will generally be longer than
-    the simulation; perhaps several simulations are run for a single collector
-    instance.  The collector potentially stores lots of data as well, so the
-    simulation needs to point to the single instance, rather than requiring
-    collectors to manage copying that data efficiently in their design.
-
-    @code
-        // Initialize a specific collector that might write to a file.
-        SomeFancyCollector collector{"out.file"};
-
-        // Setup your simulation
-        Sim sim(trustgraph, topology, collector);
-
-        // Run the simulation
-        sim.run(100);
-
-        // do any reported related to the collector
-        collector.report();
-
-    @endcode
-
-    @note If a new event type is added, it needs to be added to the interfaces
-    below.
-
-*/
+/**
+ * Holds a type-erased reference to an arbitrary collector.
+ *
+ * A collector is any class that implements
+ *
+ *     on(NodeID, SimTime, Event)
+ *
+ * for all events emitted by a Peer.
+ *
+ * This class is used to type-erase the actual collector used by each peer in
+ * the simulation. The idea is to compose complicated and typed collectors
+ * using the helpers in collectors.h, then only type erase at the higher-most
+ * level when adding to the simulation.
+ *
+ * The example code below demonstrates the reason for storing the collector
+ * as a reference.  The collector's lifetime will generally be longer than
+ * the simulation; perhaps several simulations are run for a single collector
+ * instance.  The collector potentially stores lots of data as well, so the
+ * simulation needs to point to the single instance, rather than requiring
+ * collectors to manage copying that data efficiently in their design.
+ *
+ * @code
+ *     // Initialize a specific collector that might write to a file.
+ *     SomeFancyCollector collector{"out.file"};
+ *
+ *     // Setup your simulation
+ *     Sim sim(trustgraph, topology, collector);
+ *
+ *     // Run the simulation
+ *     sim.run(100);
+ *
+ *     // do any reported related to the collector
+ *     collector.report();
+ *
+ * @endcode
+ *
+ * @note If a new event type is added, it needs to be added to the interfaces
+ * below.
+ */
 class CollectorRef
 {
     using tp = SimTime;
@@ -296,16 +296,17 @@ public:
     }
 };
 
-/** A container of CollectorRefs
-
-    A set of CollectorRef instances that process the same events. An event is
-    processed by collectors in the order the collectors were added.
-
-    This class type-erases the collector instances. By contract, the
-    Collectors/collectors class/helper in collectors.h are not type erased and
-    offer an opportunity for type transformations and combinations with
-    improved compiler optimizations.
-*/
+/**
+ * A container of CollectorRefs
+ *
+ * A set of CollectorRef instances that process the same events. An event is
+ * processed by collectors in the order the collectors were added.
+ *
+ * This class type-erases the collector instances. By contract, the
+ * Collectors/collectors class/helper in collectors.h are not type erased and
+ * offer an opportunity for type transformations and combinations with
+ * improved compiler optimizations.
+ */
 class CollectorRefs
 {
     std::vector<CollectorRef> collectors_;
diff --git a/src/test/csf/Digraph.h b/src/test/csf/Digraph.h
index 82ed713561..b1b49404b5 100644
--- a/src/test/csf/Digraph.h
+++ b/src/test/csf/Digraph.h
@@ -21,16 +21,16 @@ struct NoEdgeData
 
 namespace test::csf {
 
-/** Directed graph
-
-Basic directed graph that uses an adjacency list to represent out edges.
-
-Instances of Vertex uniquely identify vertices in the graph. Instances of
-EdgeData is any data to store in the edge connecting two vertices.
-
-Both Vertex and EdgeData should be lightweight and cheap to copy.
-
-*/
+/**
+ * Directed graph
+ *
+ * Basic directed graph that uses an adjacency list to represent out edges.
+ *
+ * Instances of Vertex uniquely identify vertices in the graph. Instances of
+ * EdgeData is any data to store in the edge connecting two vertices.
+ *
+ * Both Vertex and EdgeData should be lightweight and cheap to copy.
+ */
 template <class Vertex, class EdgeData = detail::NoEdgeData>
 class Digraph
 {
@@ -42,41 +42,42 @@ class Digraph
     Links empty_;
 
 public:
-    /** Connect two vertices
-
-        @param source The source vertex
-        @param target The target vertex
-        @param e The edge data
-        @return true if the edge was created
-
-    */
+    /**
+     * Connect two vertices
+     *
+     * @param source The source vertex
+     * @param target The target vertex
+     * @param e The edge data
+     * @return true if the edge was created
+     */
     bool
     connect(Vertex source, Vertex target, EdgeData e)
     {
         return graph_[source].emplace(target, e).second;
     }
 
-    /** Connect two vertices using default constructed edge data
-
-        @param source The source vertex
-        @param target The target vertex
-        @return true if the edge was created
-
-    */
+    /**
+     * Connect two vertices using default constructed edge data
+     *
+     * @param source The source vertex
+     * @param target The target vertex
+     * @return true if the edge was created
+     */
     bool
     connect(Vertex source, Vertex target)
     {
         return connect(source, target, EdgeData{});
     }
 
-    /** Disconnect two vertices
-
-        @param source The source vertex
-        @param target The target vertex
-        @return true if an edge was removed
-
-        If source is not connected to target, this function does nothing.
-    */
+    /**
+     * Disconnect two vertices
+     *
+     * @param source The source vertex
+     * @param target The target vertex
+     * @return true if an edge was removed
+     *
+     * If source is not connected to target, this function does nothing.
+     */
     bool
     disconnect(Vertex source, Vertex target)
     {
@@ -88,13 +89,13 @@ public:
         return false;
     }
 
-    /** Return edge data between two vertices
-
-        @param source The source vertex
-        @param target The target vertex
-        @return optional<Edge> which is std::nullopt if no edge exists
-
-    */
+    /**
+     * Return edge data between two vertices
+     *
+     * @param source The source vertex
+     * @param target The target vertex
+     * @return optional<Edge> which is std::nullopt if no edge exists
+     */
     [[nodiscard]] std::optional<EdgeData>
     edge(Vertex source, Vertex target) const
     {
@@ -108,23 +109,25 @@ public:
         return std::nullopt;
     }
 
-    /** Check if two vertices are connected
-
-        @param source The source vertex
-        @param target The target vertex
-        @return true if the source has an out edge to target
-    */
+    /**
+     * Check if two vertices are connected
+     *
+     * @param source The source vertex
+     * @param target The target vertex
+     * @return true if the source has an out edge to target
+     */
     [[nodiscard]] bool
     connected(Vertex source, Vertex target) const
     {
         return edge(source, target) != std::nullopt;
     }
 
-    /** Range over vertices in the graph
-
-        @return A boost transformed range over the vertices with out edges in
-       the graph
-    */
+    /**
+     * Range over vertices in the graph
+     *
+     * @return A boost transformed range over the vertices with out edges in
+     * the graph
+     */
     [[nodiscard]] auto
     outVertices() const
     {
@@ -132,10 +135,11 @@ public:
             graph_, [](Graph::value_type const& v) { return v.first; });
     }
 
-    /** Range over target vertices
-
-        @param source The source vertex
-        @return A boost transformed range over the target vertices of source.
+    /**
+     * Range over target vertices
+     *
+     * @param source The source vertex
+     * @return A boost transformed range over the target vertices of source.
      */
     [[nodiscard]] auto
     outVertices(Vertex source) const
@@ -148,7 +152,8 @@ public:
         return boost::adaptors::transform(empty_, transform);
     }
 
-    /** Vertices and data associated with an Edge
+    /**
+     * Vertices and data associated with an Edge
      */
     struct Edge
     {
@@ -157,12 +162,13 @@ public:
         EdgeData data;
     };
 
-    /** Range of out edges
-
-        @param source The source vertex
-        @return A boost transformed range of Edge type for all out edges of
-                source.
-    */
+    /**
+     * Range of out edges
+     *
+     * @param source The source vertex
+     * @return A boost transformed range of Edge type for all out edges of
+     *         source.
+     */
     [[nodiscard]] auto
     outEdges(Vertex source) const
     {
@@ -177,11 +183,12 @@ public:
         return boost::adaptors::transform(empty_, transform);
     }
 
-    /** Vertex out-degree
-
-        @param source The source vertex
-        @return The number of outgoing edges from source
-    */
+    /**
+     * Vertex out-degree
+     *
+     * @param source The source vertex
+     * @return The number of outgoing edges from source
+     */
     [[nodiscard]] std::size_t
     outDegree(Vertex source) const
     {
@@ -191,14 +198,15 @@ public:
         return 0;
     }
 
-    /** Save GraphViz dot file
-
-        Save a GraphViz dot description of the graph
-        @param fileName The output file (creates)
-        @param vertexName A invocable T vertexName(Vertex const &) that
-                          returns the name target use for the vertex in the file
-                          T must be ostream-able
-    */
+    /**
+     * Save GraphViz dot file
+     *
+     * Save a GraphViz dot description of the graph
+     * @param fileName The output file (creates)
+     * @param vertexName A invocable T vertexName(Vertex const &) that
+     *                   returns the name target use for the vertex in the file
+     *                   T must be ostream-able
+     */
     template <class VertexName>
     void
     saveDot(std::ostream& out, VertexName&& vertexName) const
diff --git a/src/test/csf/Histogram.h b/src/test/csf/Histogram.h
index 60cb9a132e..62791c10f3 100644
--- a/src/test/csf/Histogram.h
+++ b/src/test/csf/Histogram.h
@@ -8,17 +8,16 @@
 
 namespace xrpl::test::csf {
 
-/** Basic histogram.
-
-    Histogram for a type `T` that satisfies
-      - Default construction: T{}
-      - Comparison : T a, b;  bool res = a < b
-      - Addition: T a, b; T c = a + b;
-      - Multiplication : T a, std::size_t b; T c = a * b;
-      - Division: T a; std::size_t b;  T c = a/b;
-
-
-*/
+/**
+ * Basic histogram.
+ *
+ * Histogram for a type `T` that satisfies
+ *   - Default construction: T{}
+ *   - Comparison : T a, b;  bool res = a < b
+ *   - Addition: T a, b; T c = a + b;
+ *   - Multiplication : T a, std::size_t b; T c = a * b;
+ *   - Division: T a; std::size_t b;  T c = a/b;
+ */
 template <class T, class Compare = std::less<T>>
 class Histogram
 {
@@ -28,7 +27,9 @@ class Histogram
     std::size_t samples_ = 0;
 
 public:
-    /** Insert an sample */
+    /**
+     * Insert an sample
+     */
     void
     insert(T const& s)
     {
@@ -36,35 +37,45 @@ public:
         ++samples_;
     }
 
-    /** The number of samples */
+    /**
+     * The number of samples
+     */
     [[nodiscard]] std::size_t
     size() const
     {
         return samples_;
     }
 
-    /** The number of distinct samples (bins) */
+    /**
+     * The number of distinct samples (bins)
+     */
     [[nodiscard]] std::size_t
     numBins() const
     {
         return counts_.size();
     }
 
-    /** Minimum observed value */
+    /**
+     * Minimum observed value
+     */
     [[nodiscard]] T
     minValue() const
     {
         return counts_.empty() ? T{} : counts_.begin()->first;
     }
 
-    /** Maximum observed value */
+    /**
+     * Maximum observed value
+     */
     [[nodiscard]] T
     maxValue() const
     {
         return counts_.empty() ? T{} : counts_.rbegin()->first;
     }
 
-    /** Histogram average */
+    /**
+     * Histogram average
+     */
     [[nodiscard]] T
     avg() const
     {
@@ -80,12 +91,13 @@ public:
         return tmp / samples_;
     }
 
-    /** Calculate the given percentile of the distribution.
-
-        @param p Percentile between 0 and 1, e.g. 0.50 is 50-th percentile
-                 If the percentile falls between two bins, uses the nearest bin.
-        @return The given percentile of the distribution
-    */
+    /**
+     * Calculate the given percentile of the distribution.
+     *
+     * @param p Percentile between 0 and 1, e.g. 0.50 is 50-th percentile
+     *          If the percentile falls between two bins, uses the nearest bin.
+     * @return The given percentile of the distribution
+     */
     [[nodiscard]] T
     percentile(float p) const
     {
diff --git a/src/test/csf/Peer.h b/src/test/csf/Peer.h
index 9d29704172..53b26d05cf 100644
--- a/src/test/csf/Peer.h
+++ b/src/test/csf/Peer.h
@@ -42,24 +42,26 @@ namespace xrpl::test::csf {
 
 namespace bc = boost::container;
 
-/** A single peer in the simulation.
-
-    This is the main work-horse of the consensus simulation framework and is
-    where many other components are integrated. The peer
-
-     - Implements the Callbacks required by Consensus
-     - Manages trust & network connections with other peers
-     - Issues events back to the simulation based on its actions for analysis
-       by Collectors
-     - Exposes most internal state for forcibly simulating arbitrary scenarios
-*/
+/**
+ * A single peer in the simulation.
+ *
+ * This is the main work-horse of the consensus simulation framework and is
+ * where many other components are integrated. The peer
+ *
+ *  - Implements the Callbacks required by Consensus
+ *  - Manages trust & network connections with other peers
+ *  - Issues events back to the simulation based on its actions for analysis
+ *    by Collectors
+ *  - Exposes most internal state for forcibly simulating arbitrary scenarios
+ */
 struct Peer
 {
-    /** Basic wrapper of a proposed position taken by a peer.
-
-        For real consensus, this would add additional data for serialization
-        and signing. For simulation, nothing extra is needed.
-    */
+    /**
+     * Basic wrapper of a proposed position taken by a peer.
+     *
+     * For real consensus, this would add additional data for serialization
+     * and signing. For simulation, nothing extra is needed.
+     */
     class Position
     {
     public:
@@ -89,16 +91,21 @@ struct Peer
         Proposal proposal_;
     };
 
-    /** Simulated delays in internal peer processing.
+    /**
+     * Simulated delays in internal peer processing.
      */
     struct ProcessingDelays
     {
-        //! Delay in consensus calling doAccept to accepting and issuing
-        //! validation
-        //! TODO: This should be a function of the number of transactions
+        /**
+         * Delay in consensus calling doAccept to accepting and issuing
+         * validation
+         * TODO: This should be a function of the number of transactions
+         */
         std::chrono::milliseconds ledgerAccept{0};
 
-        //! Delay in processing validations from remote peers
+        /**
+         * Delay in processing validations from remote peers
+         */
         std::chrono::milliseconds recvValidation{0};
 
         // Return the receive delay for message type M, default is no delay
@@ -122,7 +129,8 @@ struct Peer
     {
     };
 
-    /** Generic Validations adaptor that simply ignores recently stale
+    /**
+     * Generic Validations adaptor that simply ignores recently stale
      * validations
      */
     class ValAdaptor
@@ -165,7 +173,9 @@ struct Peer
         }
     };
 
-    //! Type definitions for generic consensus
+    /**
+     * Type definitions for generic consensus
+     */
     using Ledger_t = Ledger;
     using NodeID_t = PeerID;
     using NodeKey_t = PeerKey;
@@ -174,74 +184,114 @@ struct Peer
     using Result = ConsensusResult<Peer>;
     using NodeKey = Validation::NodeKey;
 
-    //! Logging support that prefixes messages with the peer ID
+    /**
+     * Logging support that prefixes messages with the peer ID
+     */
     beast::WrappedSink sink;
     beast::Journal j;
 
-    //! Generic consensus
+    /**
+     * Generic consensus
+     */
     Consensus<Peer> consensus;
 
-    //! Our unique ID
+    /**
+     * Our unique ID
+     */
     PeerID id;
 
-    //! Current signing key
+    /**
+     * Current signing key
+     */
     PeerKey key;
 
-    //! The oracle that manages unique ledgers
+    /**
+     * The oracle that manages unique ledgers
+     */
     LedgerOracle& oracle;
 
-    //! Scheduler of events
+    /**
+     * Scheduler of events
+     */
     Scheduler& scheduler;
 
-    //! Handle to network for sending messages
+    /**
+     * Handle to network for sending messages
+     */
     BasicNetwork<Peer*>& net;
 
-    //! Handle to Trust graph of network
+    /**
+     * Handle to Trust graph of network
+     */
     TrustGraph<Peer*>& trustGraph;
 
-    //! openTxs that haven't been closed in a ledger yet
+    /**
+     * openTxs that haven't been closed in a ledger yet
+     */
     TxSetType openTxs;
 
-    //! The last ledger closed by this node
+    /**
+     * The last ledger closed by this node
+     */
     Ledger lastClosedLedger;
 
-    //! Ledgers this node has closed or loaded from the network
+    /**
+     * Ledgers this node has closed or loaded from the network
+     */
     hash_map<Ledger::ID, Ledger> ledgers;
 
-    //! Validations from trusted nodes
+    /**
+     * Validations from trusted nodes
+     */
     Validations<ValAdaptor> validations;
 
-    //! The most recent ledger that has been fully validated by the network from
-    //! the perspective of this Peer
+    /**
+     * The most recent ledger that has been fully validated by the network from
+     * the perspective of this Peer
+     */
     Ledger fullyValidatedLedger;
 
     //-------------------------------------------------------------------------
     // Store most network messages; these could be purged if memory use ever
     // becomes problematic
 
-    //! Map from Ledger::ID to vector of Positions with that ledger
-    //! as the prior ledger
+    /**
+     * Map from Ledger::ID to vector of Positions with that ledger
+     * as the prior ledger
+     */
     bc::flat_map<Ledger::ID, std::vector<Proposal>> peerPositions;
-    //! TxSet associated with a TxSet::ID
+    /**
+     * TxSet associated with a TxSet::ID
+     */
     bc::flat_map<TxSet::ID, TxSet> txSets;
 
     // Ledgers/TxSets we are acquiring and when that request times out
     bc::flat_map<Ledger::ID, SimTime> acquiringLedgers;
     bc::flat_map<TxSet::ID, SimTime> acquiringTxSets;
 
-    //! The number of ledgers this peer has completed
+    /**
+     * The number of ledgers this peer has completed
+     */
     int completedLedgers = 0;
 
-    //! The number of ledgers this peer should complete before stopping to run
+    /**
+     * The number of ledgers this peer should complete before stopping to run
+     */
     int targetLedgers = std::numeric_limits<int>::max();
 
-    //! Skew of time relative to the common scheduler clock
+    /**
+     * Skew of time relative to the common scheduler clock
+     */
     std::chrono::seconds clockSkew{0};
 
-    //! Simulated delays to use for internal processing
+    /**
+     * Simulated delays to use for internal processing
+     */
     ProcessingDelays delays;
 
-    //! Whether to simulate running as validator or a tracking node
+    /**
+     * Whether to simulate running as validator or a tracking node
+     */
     bool runAsValidator = true;
 
     // TODO: Consider removing these two, they are only a convenience for tests
@@ -259,20 +309,22 @@ struct Peer
     // Simulation parameters
     ConsensusParms consensusParms;
 
-    //! The collectors to report events to
+    /**
+     * The collectors to report events to
+     */
     CollectorRefs& collectors;
 
-    /** Constructor
-
-        @param i Unique PeerID
-        @param s Simulation Scheduler
-        @param o Simulation Oracle
-        @param n Simulation network
-        @param tg Simulation trust graph
-        @param c Simulation collectors
-        @param jIn Simulation journal
-
-    */
+    /**
+     * Constructor
+     *
+     * @param i Unique PeerID
+     * @param s Simulation Scheduler
+     * @param o Simulation Oracle
+     * @param n Simulation network
+     * @param tg Simulation trust graph
+     * @param c Simulation collectors
+     * @param jIn Simulation journal
+     */
     Peer(
         PeerID i,
         Scheduler& s,
@@ -302,9 +354,10 @@ struct Peer
         trustGraph.trust(this, this);
     }
 
-    /**  Schedule the provided callback in `when` duration, but if
-        `when` is 0, call immediately
-    */
+    /**
+     * Schedule the provided callback in `when` duration, but if
+     * `when` is 0, call immediately
+     */
     template <class T>
     void
     schedule(std::chrono::nanoseconds when, T&& what)
@@ -368,14 +421,15 @@ struct Peer
         return false;
     }
 
-    /** Create network connection
-
-        Creates a new outbound connection to another Peer if none exists
-
-        @param o The peer with the inbound connection
-        @param dur The fixed delay for messages between the two Peers
-        @return Whether the connection was created.
-    */
+    /**
+     * Create network connection
+     *
+     * Creates a new outbound connection to another Peer if none exists
+     *
+     * @param o The peer with the inbound connection
+     * @param dur The fixed delay for messages between the two Peers
+     * @return Whether the connection was created.
+     */
 
     bool
     connect(Peer& o, SimDuration dur)
@@ -383,13 +437,14 @@ struct Peer
         return net.connect(this, &o, dur);
     }
 
-    /** Remove a network connection
-
-        Removes a connection between peers if one exists
-
-        @param o The peer we disconnect from
-        @return Whether the connection was removed
-    */
+    /**
+     * Remove a network connection
+     *
+     * Removes a connection between peers if one exists
+     *
+     * @param o The peer we disconnect from
+     * @return Whether the connection was removed
+     */
     bool
     disconnect(Peer& o)
     {
@@ -653,7 +708,9 @@ struct Peer
     //--------------------------------------------------------------------------
     // Validation members
 
-    /** Add a trusted validation and return true if it is worth forwarding */
+    /**
+     * Add a trusted validation and return true if it is worth forwarding
+     */
     bool
     addTrustedValidation(Validation v)
     {
@@ -670,7 +727,9 @@ struct Peer
         return true;
     }
 
-    /** Check if a new ledger can be deemed fully validated */
+    /**
+     * Check if a new ledger can be deemed fully validated
+     */
     void
     checkFullyValidated(Ledger const& ledger)
     {
@@ -872,7 +931,9 @@ struct Peer
     //--------------------------------------------------------------------------
     // Simulation "driver" members
 
-    //! Heartbeat timer call
+    /**
+     * Heartbeat timer call
+     */
     void
     timerEntry()
     {
@@ -939,16 +1000,17 @@ struct Peer
     // TODO: Make this more robust
     hash_map<Ledger::Seq, Tx> txInjections;
 
-    /** Inject non-consensus Tx
-
-        Injects a transactionsinto the ledger following prevLedger's sequence
-        number.
-
-        @param prevLedger The ledger we are building the new ledger on top of
-        @param src The Consensus TxSet
-        @return Consensus TxSet with inject transactions added if prevLedger.seq
-                matches a previously registered Tx.
-    */
+    /**
+     * Inject non-consensus Tx
+     *
+     * Injects a transactionsinto the ledger following prevLedger's sequence
+     * number.
+     *
+     * @param prevLedger The ledger we are building the new ledger on top of
+     * @param src The Consensus TxSet
+     * @return Consensus TxSet with inject transactions added if prevLedger.seq
+     *         matches a previously registered Tx.
+     */
     TxSet
     injectTxs(Ledger prevLedger, TxSet const& src)
     {
diff --git a/src/test/csf/PeerGroup.h b/src/test/csf/PeerGroup.h
index e5efecac34..1c31209ef3 100644
--- a/src/test/csf/PeerGroup.h
+++ b/src/test/csf/PeerGroup.h
@@ -17,14 +17,15 @@
 
 namespace xrpl::test::csf {
 
-/** A group of simulation Peers
-
-    A PeerGroup is a convenient handle for logically grouping peers together,
-    and then creating trust or network relations for the group at large. Peer
-    groups may also be combined to build out more complex structures.
-
-    The PeerGroup provides random access style iterators and operator[]
-*/
+/**
+ * A group of simulation Peers
+ *
+ * A PeerGroup is a convenient handle for logically grouping peers together,
+ * and then creating trust or network relations for the group at large. Peer
+ * groups may also be combined to build out more complex structures.
+ *
+ * The PeerGroup provides random access style iterators and operator[]
+ */
 class PeerGroup
 {
     using peers_type = std::vector<Peer*>;
@@ -102,12 +103,13 @@ public:
         return peers_.size();
     }
 
-    /** Establish trust
-
-        Establish trust from all peers in this group to all peers in o
-
-        @param o The group of peers to trust
-    */
+    /**
+     * Establish trust
+     *
+     * Establish trust from all peers in this group to all peers in o
+     *
+     * @param o The group of peers to trust
+     */
     void
     trust(PeerGroup const& o)
     {
@@ -120,12 +122,13 @@ public:
         }
     }
 
-    /** Revoke trust
-
-        Revoke trust from all peers in this group to all peers in o
-
-        @param o The group of peers to untrust
-    */
+    /**
+     * Revoke trust
+     *
+     * Revoke trust from all peers in this group to all peers in o
+     *
+     * @param o The group of peers to untrust
+     */
     void
     untrust(PeerGroup const& o)
     {
@@ -138,16 +141,15 @@ public:
         }
     }
 
-    /** Establish network connection
-
-        Establish outbound connections from all peers in this group to all peers
-       in o. If a connection already exists, no new connection is established.
-
-        @param o The group of peers to connect to (will get inbound connections)
-        @param delay The fixed messaging delay for all established connections
-
-
-    */
+    /**
+     * Establish network connection
+     *
+     * Establish outbound connections from all peers in this group to all peers
+     * in o. If a connection already exists, no new connection is established.
+     *
+     * @param o The group of peers to connect to (will get inbound connections)
+     * @param delay The fixed messaging delay for all established connections
+     */
     void
     connect(PeerGroup const& o, SimDuration delay)
     {
@@ -162,12 +164,13 @@ public:
         }
     }
 
-    /** Destroy network connection
-
-        Destroy connections from all peers in this group to all peers in o
-
-        @param o The group of peers to disconnect from
-    */
+    /**
+     * Destroy network connection
+     *
+     * Destroy connections from all peers in this group to all peers in o
+     *
+     * @param o The group of peers to disconnect from
+     */
     void
     disconnect(PeerGroup const& o)
     {
@@ -180,14 +183,15 @@ public:
         }
     }
 
-    /** Establish trust and network connection
-
-        Establish trust and create a network connection with fixed delay
-        from all peers in this group to all peers in o
-
-        @param o The group of peers to trust and connect to
-        @param delay The fixed messaging delay for all established connections
-    */
+    /**
+     * Establish trust and network connection
+     *
+     * Establish trust and create a network connection with fixed delay
+     * from all peers in this group to all peers in o
+     *
+     * @param o The group of peers to trust and connect to
+     * @param delay The fixed messaging delay for all established connections
+     */
     void
     trustAndConnect(PeerGroup const& o, SimDuration delay)
     {
@@ -195,15 +199,15 @@ public:
         connect(o, delay);
     }
 
-    /** Establish network connections based on trust relations
-
-        For each peers in this group, create outbound network connection
-        to the set of peers it trusts. If a connection already exists, it is
-        not recreated.
-
-        @param delay The fixed messaging delay for all established connections
-
-    */
+    /**
+     * Establish network connections based on trust relations
+     *
+     * For each peers in this group, create outbound network connection
+     * to the set of peers it trusts. If a connection already exists, it is
+     * not recreated.
+     *
+     * @param delay The fixed messaging delay for all established connections
+     */
     void
     connectFromTrust(SimDuration delay)
     {
@@ -253,25 +257,25 @@ public:
     }
 };
 
-/** Randomly generate peer groups according to ranks.
-
-    Generates random peer groups based on a provided ranking of peers. This
-    mimics a process of randomly generating UNLs, where more "important" peers
-    are more likely to appear in a UNL.
-
-    `numGroups` subgroups are generated by randomly sampling without without
-    replacement from peers according to the `ranks`.
-
-
-
-    @param peers The group of peers
-    @param ranks The relative importance of each peer, must match the size of
-                 peers. Higher relative rank means more likely to be sampled.
-    @param numGroups The number of peer link groups to generate
-    @param sizeDist The distribution that determines the size of a link group
-    @param g The uniform random bit generator
-
-*/
+/**
+ * Randomly generate peer groups according to ranks.
+ *
+ * Generates random peer groups based on a provided ranking of peers. This
+ * mimics a process of randomly generating UNLs, where more "important" peers
+ * are more likely to appear in a UNL.
+ *
+ * `numGroups` subgroups are generated by randomly sampling without without
+ * replacement from peers according to the `ranks`.
+ *
+ *
+ *
+ * @param peers The group of peers
+ * @param ranks The relative importance of each peer, must match the size of
+ *              peers. Higher relative rank means more likely to be sampled.
+ * @param numGroups The number of peer link groups to generate
+ * @param sizeDist The distribution that determines the size of a link group
+ * @param g The uniform random bit generator
+ */
 template <class RandomNumberDistribution, class Generator>
 std::vector<PeerGroup>
 randomRankedGroups(
@@ -295,10 +299,11 @@ randomRankedGroups(
     return groups;
 }
 
-/** Generate random trust groups based on peer rankings.
-
-    @see randomRankedGroups for descriptions of the arguments
-*/
+/**
+ * Generate random trust groups based on peer rankings.
+ *
+ * @see randomRankedGroups for descriptions of the arguments
+ */
 template <class RandomNumberDistribution, class Generator>
 void
 randomRankedTrust(
@@ -318,10 +323,11 @@ randomRankedTrust(
     }
 }
 
-/** Generate random network groups based on peer rankings.
-
-    @see randomRankedGroups for descriptions of the arguments
-*/
+/**
+ * Generate random network groups based on peer rankings.
+ *
+ * @see randomRankedGroups for descriptions of the arguments
+ */
 template <class RandomNumberDistribution, class Generator>
 void
 randomRankedConnect(
diff --git a/src/test/csf/Proposal.h b/src/test/csf/Proposal.h
index 06486daed3..ecf430ae8d 100644
--- a/src/test/csf/Proposal.h
+++ b/src/test/csf/Proposal.h
@@ -7,9 +7,10 @@
 #include <xrpld/consensus/ConsensusProposal.h>
 
 namespace xrpl::test::csf {
-/** Proposal is a position taken in the consensus process and is represented
-    directly from the generic types.
-*/
+/**
+ * Proposal is a position taken in the consensus process and is represented
+ * directly from the generic types.
+ */
 using Proposal = ConsensusProposal<PeerID, Ledger::ID, TxSet::ID>;
 
 }  // namespace xrpl::test::csf
diff --git a/src/test/csf/Scheduler.h b/src/test/csf/Scheduler.h
index 3fc187e1e7..b1ac2bb5d4 100644
--- a/src/test/csf/Scheduler.h
+++ b/src/test/csf/Scheduler.h
@@ -12,17 +12,18 @@
 
 namespace xrpl::test::csf {
 
-/** Simulated discrete-event scheduler.
-
-    Simulates the behavior of events using a single common clock.
-
-    An event is modeled using a lambda function and is scheduled to occur at a
-    specific time. Events may be canceled using a token returned when the
-    event is scheduled.
-
-    The caller uses one or more of the step, stepOne, stepFor, stepUntil and
-    stepWhile functions to process scheduled events.
-*/
+/**
+ * Simulated discrete-event scheduler.
+ *
+ * Simulates the behavior of events using a single common clock.
+ *
+ * An event is modeled using a lambda function and is scheduled to occur at a
+ * specific time. Events may be canceled using a token returned when the
+ * event is scheduled.
+ *
+ * The caller uses one or more of the step, stepOne, stepFor, stepUntil and
+ * stepWhile functions to process scheduled events.
+ */
 class Scheduler
 {
 public:
@@ -135,116 +136,127 @@ public:
 
     Scheduler();
 
-    /** Return the clock. (aged_containers want a non-const ref =( */
+    /**
+     * Return the clock. (aged_containers want a non-const ref =(
+     */
     clock_type&
     clock() const;
 
-    /** Return the current network time.
-
-        @note The epoch is unspecified
-    */
+    /**
+     * Return the current network time.
+     *
+     * @note The epoch is unspecified
+     */
     time_point
     now() const;
 
     // Used to cancel timers
     struct CancelToken;
 
-    /** Schedule an event at a specific time
-
-        Effects:
-
-            When the network time is reached,
-            the function will be called with
-            no arguments.
-    */
+    /**
+     * Schedule an event at a specific time
+     *
+     * Effects:
+     *
+     *     When the network time is reached,
+     *     the function will be called with
+     *     no arguments.
+     */
     template <class Function>
     CancelToken
     at(time_point const& when, Function&& f);
 
-    /** Schedule an event after a specified duration passes
-
-        Effects:
-
-            When the specified time has elapsed,
-            the function will be called with
-            no arguments.
-    */
+    /**
+     * Schedule an event after a specified duration passes
+     *
+     * Effects:
+     *
+     *     When the specified time has elapsed,
+     *     the function will be called with
+     *     no arguments.
+     */
     template <class Function>
     CancelToken
     in(duration const& delay, Function&& f);
 
-    /** Cancel a timer.
-
-        Preconditions:
-
-            `token` was the return value of a call
-            timer() which has not yet been invoked.
-    */
+    /**
+     * Cancel a timer.
+     *
+     * Preconditions:
+     *
+     *     `token` was the return value of a call
+     *     timer() which has not yet been invoked.
+     */
     void
     cancel(CancelToken const& token);
 
-    /** Run the scheduler for up to one event.
-
-        Effects:
-
-            The clock is advanced to the time
-            of the last delivered event.
-
-        @return `true` if an event was processed.
-    */
+    /**
+     * Run the scheduler for up to one event.
+     *
+     * Effects:
+     *
+     *     The clock is advanced to the time
+     *     of the last delivered event.
+     *
+     * @return `true` if an event was processed.
+     */
     bool
     stepOne();
 
-    /** Run the scheduler until no events remain.
-
-        Effects:
-
-            The clock is advanced to the time
-            of the last event.
-
-        @return `true` if an event was processed.
-    */
+    /**
+     * Run the scheduler until no events remain.
+     *
+     * Effects:
+     *
+     *     The clock is advanced to the time
+     *     of the last event.
+     *
+     * @return `true` if an event was processed.
+     */
     bool
     step();
 
-    /** Run the scheduler while a condition is true.
-
-        Function takes no arguments and will be called
-        repeatedly after each event is processed to
-        decide whether to continue.
-
-        Effects:
-
-            The clock is advanced to the time
-            of the last delivered event.
-
-        @return `true` if any event was processed.
-    */
+    /**
+     * Run the scheduler while a condition is true.
+     *
+     * Function takes no arguments and will be called
+     * repeatedly after each event is processed to
+     * decide whether to continue.
+     *
+     * Effects:
+     *
+     *     The clock is advanced to the time
+     *     of the last delivered event.
+     *
+     * @return `true` if any event was processed.
+     */
     template <class Function>
     bool
     stepWhile(Function&& func);
 
-    /** Run the scheduler until the specified time.
-
-        Effects:
-
-            The clock is advanced to the
-            specified time.
-
-        @return `true` if any event remain.
-    */
+    /**
+     * Run the scheduler until the specified time.
+     *
+     * Effects:
+     *
+     *     The clock is advanced to the
+     *     specified time.
+     *
+     * @return `true` if any event remain.
+     */
     bool
     stepUntil(time_point const& until);
 
-    /** Run the scheduler until time has elapsed.
-
-        Effects:
-
-            The clock is advanced by the
-            specified duration.
-
-        @return `true` if any event remain.
-    */
+    /**
+     * Run the scheduler until time has elapsed.
+     *
+     * Effects:
+     *
+     *     The clock is advanced by the
+     *     specified duration.
+     *
+     * @return `true` if any event remain.
+     */
     template <class Period, class Rep>
     bool
     stepFor(std::chrono::duration<Period, Rep> const& amount);
diff --git a/src/test/csf/Sim.h b/src/test/csf/Sim.h
index d2a63f6507..94d26d5e06 100644
--- a/src/test/csf/Sim.h
+++ b/src/test/csf/Sim.h
@@ -21,7 +21,9 @@
 
 namespace xrpl::test::csf {
 
-/** Sink that prepends simulation time to messages */
+/**
+ * Sink that prepends simulation time to messages
+ */
 class BasicSink : public beast::Journal::Sink
 {
     Scheduler::clock_type const& clock_;
@@ -65,28 +67,29 @@ public:
     TrustGraph<Peer*> trustGraph;
     CollectorRefs collectors;
 
-    /** Create a simulation
-
-        Creates a new simulation. The simulation has no peers, no trust links
-        and no network connections.
-
-    */
+    /**
+     * Create a simulation
+     *
+     * Creates a new simulation. The simulation has no peers, no trust links
+     * and no network connections.
+     */
     // NOLINTNEXTLINE(bugprone-random-generator-seed): fixed seed for reproducible test
     Sim() : sink{scheduler.clock()}, j{sink}, net{scheduler}
     {
     }
 
-    /** Create a new group of peers.
-
-        Creates a new group of peers. The peers do not have any trust relations
-        or network connections by default. Those must be configured by the
-       client.
-
-        @param numPeers The number of peers in the group
-        @return PeerGroup representing these new peers
-
-        @note This increases the number of peers in the simulation by numPeers.
-    */
+    /**
+     * Create a new group of peers.
+     *
+     * Creates a new group of peers. The peers do not have any trust relations
+     * or network connections by default. Those must be configured by the
+     * client.
+     *
+     * @param numPeers The number of peers in the group
+     * @return PeerGroup representing these new peers
+     *
+     * @note This increases the number of peers in the simulation by numPeers.
+     */
     PeerGroup
     createGroup(std::size_t numPeers)
     {
@@ -109,48 +112,57 @@ public:
         return res;
     }
 
-    //! The number of peers in the simulation
+    /**
+     * The number of peers in the simulation
+     */
     std::size_t
     size() const
     {
         return peers_.size();
     }
 
-    /** Run consensus protocol to generate the provided number of ledgers.
-
-        Has each peer run consensus until it closes `ledgers` more ledgers.
-
-        @param ledgers The number of additional ledgers to close
-    */
+    /**
+     * Run consensus protocol to generate the provided number of ledgers.
+     *
+     * Has each peer run consensus until it closes `ledgers` more ledgers.
+     *
+     * @param ledgers The number of additional ledgers to close
+     */
     void
     run(int ledgers);
 
-    /** Run consensus for the given duration */
+    /**
+     * Run consensus for the given duration
+     */
     void
     run(SimDuration const& dur);
 
-    /** Check whether all peers in the group are synchronized.
-
-        Nodes in the group are synchronized if they share the same last
-        fully validated and last generated ledger.
-    */
+    /**
+     * Check whether all peers in the group are synchronized.
+     *
+     * Nodes in the group are synchronized if they share the same last
+     * fully validated and last generated ledger.
+     */
     static bool
     synchronized(PeerGroup const& g);
 
-    /** Check whether all peers in the network are synchronized
+    /**
+     * Check whether all peers in the network are synchronized
      */
     bool
     synchronized() const;
 
-    /** Calculate the number of branches in the group.
-
-        A branch occurs if two nodes in the group have fullyValidatedLedgers
-        that are not on the same chain of ledgers.
-    */
+    /**
+     * Calculate the number of branches in the group.
+     *
+     * A branch occurs if two nodes in the group have fullyValidatedLedgers
+     * that are not on the same chain of ledgers.
+     */
     std::size_t
     branches(PeerGroup const& g) const;
 
-    /** Calculate the number  of branches in the network
+    /**
+     * Calculate the number  of branches in the network
      */
     std::size_t
     branches() const;
diff --git a/src/test/csf/TrustGraph.h b/src/test/csf/TrustGraph.h
index a10e318706..d46a887364 100644
--- a/src/test/csf/TrustGraph.h
+++ b/src/test/csf/TrustGraph.h
@@ -10,13 +10,14 @@
 
 namespace xrpl::test::csf {
 
-/** Trust graph
-
-    Trust is a directed relationship from a node i to node j.
-    If node i trusts node j, then node i has node j in its UNL.
-    This class wraps a digraph representing the trust relationships for all
-   peers in the simulation.
-*/
+/**
+ * Trust graph
+ *
+ *  Trust is a directed relationship from a node i to node j.
+ *  If node i trusts node j, then node i has node j in its UNL.
+ *  This class wraps a digraph representing the trust relationships for all
+ * peers in the simulation.
+ */
 template <class Peer>
 class TrustGraph
 {
@@ -25,7 +26,8 @@ class TrustGraph
     Graph graph_;
 
 public:
-    /** Create an empty trust graph
+    /**
+     * Create an empty trust graph
      */
     TrustGraph() = default;
 
@@ -35,29 +37,30 @@ public:
         return graph_;
     }
 
-    /** Create trust
-
-        Establish trust between Peer `from` and Peer `to`; as if `from` put `to`
-        in its UNL.
-
-        @param from The peer granting trust
-        @param to The peer receiving trust
-
-    */
+    /**
+     * Create trust
+     *
+     * Establish trust between Peer `from` and Peer `to`; as if `from` put `to`
+     * in its UNL.
+     *
+     * @param from The peer granting trust
+     * @param to The peer receiving trust
+     */
     void
     trust(Peer const& from, Peer const& to)
     {
         graph_.connect(from, to);
     }
 
-    /** Remove trust
-
-        Revoke trust from Peer `from` to Peer `to`; as if `from` removed `to`
-        from its  UNL.
-
-        @param from The peer revoking trust
-        @param to The peer being revoked
-    */
+    /**
+     * Remove trust
+     *
+     * Revoke trust from Peer `from` to Peer `to`; as if `from` removed `to`
+     * from its  UNL.
+     *
+     * @param from The peer revoking trust
+     * @param to The peer being revoked
+     */
     void
     untrust(Peer const& from, Peer const& to)
     {
@@ -71,19 +74,21 @@ public:
         return graph_.connected(from, to);
     }
 
-    /** Range over trusted peers
-
-        @param a The node granting trust
-        @return boost transformed range over nodes `a` trusts, i.e. the nodes
-                in its UNL
-    */
+    /**
+     * Range over trusted peers
+     *
+     * @param a The node granting trust
+     * @return boost transformed range over nodes `a` trusts, i.e. the nodes
+     *         in its UNL
+     */
     [[nodiscard]] auto
     trustedPeers(Peer const& a) const
     {
         return graph_.outVertices(a);
     }
 
-    /** An example of nodes that fail the whitepaper no-forking condition
+    /**
+     * An example of nodes that fail the whitepaper no-forking condition
      */
     struct ForkInfo
     {
@@ -133,9 +138,10 @@ public:
         return res;
     }
 
-    /** Check whether this trust graph satisfies the whitepaper no-forking
-        condition
-    */
+    /**
+     * Check whether this trust graph satisfies the whitepaper no-forking
+     * condition
+     */
     [[nodiscard]] bool
     canFork(double quorum) const
     {
diff --git a/src/test/csf/Tx.h b/src/test/csf/Tx.h
index 75254f865a..0412d346f3 100644
--- a/src/test/csf/Tx.h
+++ b/src/test/csf/Tx.h
@@ -17,7 +17,9 @@
 
 namespace xrpl::test::csf {
 
-//! A single transaction
+/**
+ * A single transaction
+ */
 class Tx
 {
 public:
@@ -56,11 +58,15 @@ private:
     ID id_;
 };
 
-//!-------------------------------------------------------------------------
-//! All sets of Tx are represented as a flat_set for performance.
+/**
+ * -------------------------------------------------------------------------
+ * All sets of Tx are represented as a flat_set for performance.
+ */
 using TxSetType = boost::container::flat_set<Tx>;
 
-//! TxSet is a set of transactions to consider including in the ledger
+/**
+ * TxSet is a set of transactions to consider including in the ledger
+ */
 class TxSet
 {
 public:
@@ -135,10 +141,11 @@ public:
         return id_;
     }
 
-    /** @return Map of Tx::ID that are missing. True means
-                    it was in this set and not other. False means
-                    it was in the other set and not this
-    */
+    /**
+     * @return Map of Tx::ID that are missing. True means
+     * it was in this set and not other. False means
+     * it was in the other set and not this
+     */
     [[nodiscard]] std::map<Tx::ID, bool>
     compare(TxSet const& other) const
     {
@@ -160,10 +167,14 @@ public:
     }
 
 private:
-    //! The set contains the actual transactions
+    /**
+     * The set contains the actual transactions
+     */
     TxSetType txs_;
 
-    //! The unique ID of this tx set
+    /**
+     * The unique ID of this tx set
+     */
     ID id_{};
 };
 
diff --git a/src/test/csf/Validation.h b/src/test/csf/Validation.h
index 73b6784534..0b9fc94890 100644
--- a/src/test/csf/Validation.h
+++ b/src/test/csf/Validation.h
@@ -16,15 +16,17 @@ struct PeerIDTag;
 //< Uniquely identifies a peer
 using PeerID = TaggedInteger<std::uint32_t, PeerIDTag>;
 
-/** The current key of a peer
-
-    Eventually, the second entry in the pair can be used to model ephemeral
-    keys. Right now, the convention is to have the second entry 0 as the
-    master key.
-*/
+/**
+ * The current key of a peer
+ *
+ * Eventually, the second entry in the pair can be used to model ephemeral
+ * keys. Right now, the convention is to have the second entry 0 as the
+ * master key.
+ */
 using PeerKey = std::pair<PeerID, std::uint32_t>;
 
-/** Validation of a specific ledger by a specific Peer.
+/**
+ * Validation of a specific ledger by a specific Peer.
  */
 class Validation
 {
diff --git a/src/test/csf/collectors.h b/src/test/csf/collectors.h
index 1100f6c690..f85854e5dd 100644
--- a/src/test/csf/collectors.h
+++ b/src/test/csf/collectors.h
@@ -32,12 +32,13 @@ namespace xrpl::test::csf {
 //  This file contains helper functions for composing different collectors
 //  and also defines several standard collectors available for simulations.
 
-/** Group of collectors.
-
-    Presents a group of collectors as a single collector which process an event
-    by calling each collector sequentially. This is analogous to CollectorRefs
-    in CollectorRef.h, but does *not* erase the type information of the combined
-    collectors.
+/**
+ * Group of collectors.
+ *
+ * Presents a group of collectors as a single collector which process an event
+ * by calling each collector sequentially. This is analogous to CollectorRefs
+ * in CollectorRef.h, but does *not* erase the type information of the combined
+ * collectors.
  */
 template <class... Cs>
 class Collectors
@@ -59,10 +60,11 @@ class Collectors
     }
 
 public:
-    /** Constructor
-
-        @param cs References to the collectors to call together
-    */
+    /**
+     * Constructor
+     *
+     * @param cs References to the collectors to call together
+     */
     Collectors(Cs&... cs) : cs_(std::tie(cs...))
     {
     }
@@ -75,7 +77,9 @@ public:
     }
 };
 
-/** Create an instance of Collectors<Cs...> */
+/**
+ * Create an instance of Collectors<Cs...>
+ */
 template <class... Cs>
 Collectors<Cs...>
 makeCollectors(Cs&... cs)
@@ -83,14 +87,15 @@ makeCollectors(Cs&... cs)
     return Collectors<Cs...>(cs...);
 }
 
-/** Maintain an instance of a Collector per peer
-
-    For each peer that emits events, this class maintains a corresponding
-    instance of CollectorType, only forwarding events emitted by the peer to
-    the related instance.
-
-    CollectorType should be default constructible.
-*/
+/**
+ * Maintain an instance of a Collector per peer
+ *
+ * For each peer that emits events, this class maintains a corresponding
+ * instance of CollectorType, only forwarding events emitted by the peer to
+ * the related instance.
+ *
+ * CollectorType should be default constructible.
+ */
 template <class CollectorType>
 struct CollectByNode
 {
@@ -115,7 +120,9 @@ struct CollectByNode
     }
 };
 
-/** Collector which ignores all events */
+/**
+ * Collector which ignores all events
+ */
 struct NullCollector
 {
     template <class E>
@@ -125,7 +132,9 @@ struct NullCollector
     }
 };
 
-/** Tracks the overall duration of a simulation */
+/**
+ * Tracks the overall duration of a simulation
+ */
 struct SimDurationCollector
 {
     bool init = false;
@@ -148,15 +157,16 @@ struct SimDurationCollector
     }
 };
 
-/** Tracks the submission -> accepted -> validated evolution of transactions.
-
-    This collector tracks transactions through the network by monitoring the
-    *first* time the transaction is seen by any node in the network, or
-    seen by any node's accepted or fully validated ledger.
-
-    If transactions submitted to the network do not have unique IDs, this
-    collector will not track subsequent submissions.
-*/
+/**
+ * Tracks the submission -> accepted -> validated evolution of transactions.
+ *
+ * This collector tracks transactions through the network by monitoring the
+ * *first* time the transaction is seen by any node in the network, or
+ * seen by any node's accepted or fully validated ledger.
+ *
+ * If transactions submitted to the network do not have unique IDs, this
+ * collector will not track subsequent submissions.
+ */
 struct TxCollector
 {
     // Counts
@@ -381,12 +391,12 @@ struct TxCollector
     }
 };
 
-/** Tracks the accepted -> validated evolution of ledgers.
-
-    This collector tracks ledgers through the network by monitoring the
-    *first* time the ledger is accepted or fully validated by ANY node.
-
-*/
+/**
+ * Tracks the accepted -> validated evolution of ledgers.
+ *
+ * This collector tracks ledgers through the network by monitoring the
+ * *first* time the ledger is accepted or fully validated by ANY node.
+ */
 struct LedgerCollector
 {
     std::size_t accepted{0};
@@ -580,11 +590,12 @@ struct LedgerCollector
     }
 };
 
-/** Write out stream of ledger activity
-
-    Writes information about every accepted and fully-validated ledger to a
-    provided std::ostream.
-*/
+/**
+ * Write out stream of ledger activity
+ *
+ * Writes information about every accepted and fully-validated ledger to a
+ * provided std::ostream.
+ */
 struct StreamCollector
 {
     std::ostream& out;
@@ -611,11 +622,12 @@ struct StreamCollector
     }
 };
 
-/** Saves information about Jumps for closed and fully validated ledgers. A
-    jump occurs when a node closes/fully validates a new ledger that is not the
-    immediate child of the prior closed/fully validated ledgers. This includes
-    jumps across branches and jumps ahead in the same branch of ledger history.
-*/
+/**
+ * Saves information about Jumps for closed and fully validated ledgers. A
+ * jump occurs when a node closes/fully validates a new ledger that is not the
+ * immediate child of the prior closed/fully validated ledgers. This includes
+ * jumps across branches and jumps ahead in the same branch of ledger history.
+ */
 struct JumpCollector
 {
     struct Jump
diff --git a/src/test/csf/events.h b/src/test/csf/events.h
index dfedd2627a..2cf4fd9e9b 100644
--- a/src/test/csf/events.h
+++ b/src/test/csf/events.h
@@ -29,58 +29,81 @@ namespace xrpl::test::csf {
 // CollectorRef.f defines a type-erased holder for arbitrary Collectors.  If
 // any new events are added, the interface there needs to be updated.
 
-/** A value to be flooded to all other peers starting from this peer.
+/**
+ * A value to be flooded to all other peers starting from this peer.
  */
 template <class V>
 struct Share
 {
-    //! Event that is shared
+    /**
+     * Event that is shared
+     */
     V val;
 };
 
-/** A value relayed to another peer as part of flooding
+/**
+ * A value relayed to another peer as part of flooding
  */
 template <class V>
 struct Relay
 {
-    //! Peer relaying to
+    /**
+     * Peer relaying to
+     */
     PeerID to;
 
-    //! The value to relay
+    /**
+     * The value to relay
+     */
     V val;
 };
 
-/** A value received from another peer as part of flooding
+/**
+ * A value received from another peer as part of flooding
  */
 template <class V>
 struct Receive
 {
-    //! Peer that sent the value
+    /**
+     * Peer that sent the value
+     */
     PeerID from;
 
-    //! The received value
+    /**
+     * The received value
+     */
     V val;
 };
 
-/** A transaction submitted to a peer */
+/**
+ * A transaction submitted to a peer
+ */
 struct SubmitTx
 {
-    //! The submitted transaction
+    /**
+     * The submitted transaction
+     */
     Tx tx;
 };
 
-/** Peer starts a new consensus round
+/**
+ * Peer starts a new consensus round
  */
 struct StartRound
 {
-    //! The preferred ledger for the start of consensus
+    /**
+     * The preferred ledger for the start of consensus
+     */
     Ledger::ID bestLedger{};
 
-    //! The prior ledger on hand
+    /**
+     * The prior ledger on hand
+     */
     Ledger prevLedger;
 };
 
-/** Peer closed the open ledger
+/**
+ * Peer closed the open ledger
  */
 struct CloseLedger
 {
@@ -91,7 +114,9 @@ struct CloseLedger
     TxSetType txs;
 };
 
-//! Peer accepted consensus results
+/**
+ * Peer accepted consensus results
+ */
 struct AcceptLedger
 {
     // The newly created ledger
@@ -101,7 +126,9 @@ struct AcceptLedger
     Ledger prior;
 };
 
-//! Peer detected a wrong prior ledger during consensus
+/**
+ * Peer detected a wrong prior ledger during consensus
+ */
 struct WrongPrevLedger
 {
     // ID of wrong ledger we had
@@ -110,14 +137,20 @@ struct WrongPrevLedger
     Ledger::ID right;
 };
 
-//! Peer fully validated a new ledger
+/**
+ * Peer fully validated a new ledger
+ */
 struct FullyValidateLedger
 {
-    //! The new fully validated ledger
+    /**
+     * The new fully validated ledger
+     */
     Ledger ledger;
 
-    //! The prior fully validated ledger
-    //! This is a jump if prior.id() != ledger.parentID()
+    /**
+     * The prior fully validated ledger
+     * This is a jump if prior.id() != ledger.parentID()
+     */
     Ledger prior;
 };
 
diff --git a/src/test/csf/ledgers.h b/src/test/csf/ledgers.h
index 4873519dee..09f5fa54de 100644
--- a/src/test/csf/ledgers.h
+++ b/src/test/csf/ledgers.h
@@ -22,27 +22,28 @@
 
 namespace xrpl::test::csf {
 
-/** A ledger is a set of observed transactions and a sequence number
-    identifying the ledger.
-
-    Peers in the consensus process are trying to agree on a set of transactions
-    to include in a ledger. For simulation, each transaction is a single
-    integer and the ledger is the set of observed integers. This means future
-    ledgers have prior ledgers as subsets, e.g.
-
-        Ledger 0 :  {}
-        Ledger 1 :  {1,4,5}
-        Ledger 2 :  {1,2,4,5,10}
-        ....
-
-    Ledgers are immutable value types. All ledgers with the same sequence
-    number, transactions, close time, etc. will have the same ledger ID. The
-    LedgerOracle class below manages ID assignments for a simulation and is the
-    only way to close and create a new ledger. Since the parent ledger ID is
-    part of type, this also means ledgers with distinct histories will have
-    distinct ids, even if they have the same set of transactions, sequence
-    number and close time.
-*/
+/**
+ * A ledger is a set of observed transactions and a sequence number
+ * identifying the ledger.
+ *
+ * Peers in the consensus process are trying to agree on a set of transactions
+ * to include in a ledger. For simulation, each transaction is a single
+ * integer and the ledger is the set of observed integers. This means future
+ * ledgers have prior ledgers as subsets, e.g.
+ *
+ *     Ledger 0 :  {}
+ *     Ledger 1 :  {1,4,5}
+ *     Ledger 2 :  {1,2,4,5,10}
+ *     ....
+ *
+ * Ledgers are immutable value types. All ledgers with the same sequence
+ * number, transactions, close time, etc. will have the same ledger ID. The
+ * LedgerOracle class below manages ID assignments for a simulation and is the
+ * only way to close and create a new ledger. Since the parent ledger ID is
+ * part of type, this also means ledgers with distinct histories will have
+ * distinct ids, even if they have the same set of transactions, sequence
+ * number and close time.
+ */
 class Ledger
 {
     friend class LedgerOracle;
@@ -74,21 +75,31 @@ private:
         // Resolution used to determine close time
         NetClock::duration closeTimeResolution = kLedgerDefaultTimeResolution;
 
-        //! When the ledger closed (up to closeTimeResolution)
+        /**
+         * When the ledger closed (up to closeTimeResolution)
+         */
         NetClock::time_point closeTime;
 
-        //! Whether consensus agreed on the close time
+        /**
+         * Whether consensus agreed on the close time
+         */
         bool closeTimeAgree = true;
 
-        //! Parent ledger id
+        /**
+         * Parent ledger id
+         */
         ID parentID{0};
 
-        //! Parent ledger close time
+        /**
+         * Parent ledger close time
+         */
         NetClock::time_point parentCloseTime;
 
-        //! IDs of this ledgers ancestors. Since each ledger already has unique
-        //! ancestors based on the parentID, this member is not needed for any
-        //! of the operators below.
+        /**
+         * IDs of this ledgers ancestors. Since each ledger already has unique
+         * ancestors based on the parentID, this member is not needed for any
+         * of the operators below.
+         */
         std::vector<Ledger::ID> ancestors;
 
         [[nodiscard]] auto
@@ -199,16 +210,20 @@ public:
         return instance_->txs;
     }
 
-    /** Determine whether ancestor is really an ancestor of this ledger */
+    /**
+     * Determine whether ancestor is really an ancestor of this ledger
+     */
     [[nodiscard]] bool
     isAncestor(Ledger const& ancestor) const;
 
-    /** Return the id of the ancestor with the given seq (if exists/known)
+    /**
+     * Return the id of the ancestor with the given seq (if exists/known)
      */
     ID
     operator[](Seq seq) const;
 
-    /** Return the sequence number of the first mismatching ancestor
+    /**
+     * Return the sequence number of the first mismatching ancestor
      */
     friend Ledger::Seq
     mismatch(Ledger const& a, Ledger const& o);
@@ -227,7 +242,8 @@ private:
     Instance const* instance_;
 };
 
-/** Oracle maintaining unique ledgers for a simulation.
+/**
+ * Oracle maintaining unique ledgers for a simulation.
  */
 class LedgerOracle
 {
@@ -246,18 +262,21 @@ class LedgerOracle
 public:
     LedgerOracle();
 
-    /** Find the ledger with the given ID */
+    /**
+     * Find the ledger with the given ID
+     */
     [[nodiscard]] std::optional<Ledger>
     lookup(Ledger::ID const& id) const;
 
-    /** Accept the given txs and generate a new ledger
-
-        @param curr The current ledger
-        @param txs The transactions to apply to the current ledger
-        @param closeTimeResolution Resolution used in determining close time
-        @param consensusCloseTime The consensus agreed close time, no valid time
-                                  if 0
-    */
+    /**
+     * Accept the given txs and generate a new ledger
+     *
+     * @param curr The current ledger
+     * @param txs The transactions to apply to the current ledger
+     * @param closeTimeResolution Resolution used in determining close time
+     * @param consensusCloseTime The consensus agreed close time, no valid time
+     *                           if 0
+     */
     Ledger
     accept(
         Ledger const& curr,
@@ -272,38 +291,39 @@ public:
         return accept(curr, TxSetType{tx}, curr.closeTimeResolution(), curr.closeTime() + 1s);
     }
 
-    /** Determine the number of distinct branches for the set of ledgers.
-
-        Ledgers A and B are on different branches if A != B, A is not an
-       ancestor of B and B is not an ancestor of A, e.g.
-
-          /--> A
-        O
-          \--> B
-    */
+    /**
+     * Determine the number of distinct branches for the set of ledgers.
+     *
+     *  Ledgers A and B are on different branches if A != B, A is not an
+     * ancestor of B and B is not an ancestor of A, e.g.
+     *
+     *    /--> A
+     *  O
+     *    \--> B
+     */
     static std::size_t
     branches(std::set<Ledger> const& ledgers);
 };
 
-/** Helper for writing unit tests with controlled ledger histories.
-
-    This class allows clients to refer to distinct ledgers as strings, where
-    each character in the string indicates a unique ledger. It enforces the
-    uniqueness at runtime, but this simplifies creation of alternate ledger
-    histories, e.g.
-
-     HistoryHelper hh;
-     hh["a"]
-     hh["ab"]
-     hh["ac"]
-     hh["abd"]
-
-   Creates a history like
-           b - d
-         /
-       a - c
-
-*/
+/**
+ * Helper for writing unit tests with controlled ledger histories.
+ *
+ *  This class allows clients to refer to distinct ledgers as strings, where
+ *  each character in the string indicates a unique ledger. It enforces the
+ *  uniqueness at runtime, but this simplifies creation of alternate ledger
+ *  histories, e.g.
+ *
+ *   HistoryHelper hh;
+ *   hh["a"]
+ *   hh["ab"]
+ *   hh["ac"]
+ *   hh["abd"]
+ *
+ * Creates a history like
+ *         b - d
+ *       /
+ *     a - c
+ */
 struct LedgerHistoryHelper
 {
     LedgerOracle oracle;
@@ -316,11 +336,12 @@ struct LedgerHistoryHelper
         ledgers[""] = Ledger{Ledger::MakeGenesis{}};
     }
 
-    /** Get or create the ledger with the given string history.
-
-        Creates any necessary intermediate ledgers, but asserts if
-        a letter is re-used (e.g. "abc" then "adc" would assert)
-    */
+    /**
+     * Get or create the ledger with the given string history.
+     *
+     * Creates any necessary intermediate ledgers, but asserts if
+     * a letter is re-used (e.g. "abc" then "adc" would assert)
+     */
     Ledger const&
     operator[](std::string const& s)
     {
diff --git a/src/test/csf/random.h b/src/test/csf/random.h
index aa20c73a10..f8df253642 100644
--- a/src/test/csf/random.h
+++ b/src/test/csf/random.h
@@ -8,15 +8,16 @@
 
 namespace xrpl::test::csf {
 
-/** Return a randomly shuffled copy of vector based on weights w.
-
-    @param v  The set of values
-    @param w  The set of weights of each value
-    @param g  A pseudo-random number generator
-    @return A vector with entries randomly sampled without replacement
-            from the original vector based on the provided weights.
-            I.e.  res[0] comes from sample v[i] with weight w[i]/suk_ w[k]
-*/
+/**
+ * Return a randomly shuffled copy of vector based on weights w.
+ *
+ * @param v  The set of values
+ * @param w  The set of weights of each value
+ * @param g  A pseudo-random number generator
+ * @return A vector with entries randomly sampled without replacement
+ *         from the original vector based on the provided weights.
+ *         I.e.  res[0] comes from sample v[i] with weight w[i]/suk_ w[k]
+ */
 template <class T, class G>
 std::vector<T>
 randomWeightedShuffle(std::vector<T> v, std::vector<double> w, G& g)
@@ -34,14 +35,15 @@ randomWeightedShuffle(std::vector<T> v, std::vector<double> w, G& g)
     return v;
 }
 
-/** Generate a vector of random samples
-
-    @param size the size of the sample
-    @param dist the distribution to sample
-    @param g the pseudo-random number generator
-
-    @return vector of samples
-*/
+/**
+ * Generate a vector of random samples
+ *
+ * @param size the size of the sample
+ * @param dist the distribution to sample
+ * @param g the pseudo-random number generator
+ *
+ * @return vector of samples
+ */
 template <class RandomNumberDistribution, class Generator>
 std::vector<typename RandomNumberDistribution::result_type>
 sample(std::size_t size, RandomNumberDistribution dist, Generator& g)
@@ -51,13 +53,14 @@ sample(std::size_t size, RandomNumberDistribution dist, Generator& g)
     return res;
 }
 
-/** Invocable that returns random samples from a range according to a discrete
-    distribution
-
-    Given a pair of random access iterators begin and end, each call to the
-    instance of Selector returns a random entry in the range (begin,end)
-    according to the weights provided at construction.
-*/
+/**
+ * Invocable that returns random samples from a range according to a discrete
+ * distribution
+ *
+ * Given a pair of random access iterators begin and end, each call to the
+ * instance of Selector returns a random entry in the range (begin,end)
+ * according to the weights provided at construction.
+ */
 template <class RAIter, class Generator>
 class Selector
 {
@@ -66,12 +69,13 @@ class Selector
     Generator g_;
 
 public:
-    /** Constructor
-        @param first Random access iterator to the start of the range
-        @param last Random access iterator to the end of the range
-        @param w Vector of weights of size list-first
-        @param g the pseudo-random number generator
-    */
+    /**
+     * Constructor
+     * @param first Random access iterator to the start of the range
+     * @param last Random access iterator to the end of the range
+     * @param w Vector of weights of size list-first
+     * @param g the pseudo-random number generator
+     */
     Selector(RAIter first, RAIter last, std::vector<double> const& w, Generator& g)
         : first_{first}, last_{last}, dd_{w.begin(), w.end()}, g_{g}
     {
@@ -100,7 +104,8 @@ makeSelector(Iter first, Iter last, std::vector<double> const& w, Generator& g)
 //------------------------------------------------------------------------------
 // Additional distributions of interest not defined in <random>
 
-/** Constant "distribution" that always returns the same value
+/**
+ * Constant "distribution" that always returns the same value
  */
 class ConstantDistribution
 {
@@ -119,11 +124,12 @@ public:
     }
 };
 
-/** Power-law distribution with PDF
-
-        P(x) = (x/xmin)^-a
-
-    for a >= 1 and xmin >= 1
+/**
+ * Power-law distribution with PDF
+ *
+ *     P(x) = (x/xmin)^-a
+ *
+ * for a >= 1 and xmin >= 1
  */
 class PowerLawDistribution
 {
diff --git a/src/test/csf/submitters.h b/src/test/csf/submitters.h
index a71c849fb7..160d0bcd9f 100644
--- a/src/test/csf/submitters.h
+++ b/src/test/csf/submitters.h
@@ -13,7 +13,9 @@ namespace xrpl::test::csf {
 // Submitters are classes for simulating submission of transactions to the
 // network
 
-/** Represents rate as a count/duration */
+/**
+ * Represents rate as a count/duration
+ */
 struct Rate
 {
     std::size_t count;
@@ -26,23 +28,24 @@ struct Rate
     }
 };
 
-/** Submits transactions to a specified peer
-
-    Submits successive transactions beginning at start, then spaced according
-    to successive calls of distribution(), until stop.
-
-    @tparam Distribution is a `UniformRandomBitGenerator` from the STL that
-            is used by random distributions to generate random samples
-    @tparam Generator is an object with member
-
-            T operator()(Generator &g)
-
-            which generates the delay T in SimDuration units to the next
-            transaction. For the current definition of SimDuration, this is
-            currently the number of nanoseconds. Submitter internally casts
-            arithmetic T to SimDuration::rep units to allow using standard
-            library distributions as a Distribution.
-*/
+/**
+ * Submits transactions to a specified peer
+ *
+ * Submits successive transactions beginning at start, then spaced according
+ * to successive calls of distribution(), until stop.
+ *
+ * @tparam Distribution is a `UniformRandomBitGenerator` from the STL that
+ *         is used by random distributions to generate random samples
+ * @tparam Generator is an object with member
+ *
+ *         T operator()(Generator &g)
+ *
+ *         which generates the delay T in SimDuration units to the next
+ *         transaction. For the current definition of SimDuration, this is
+ *         currently the number of nanoseconds. Submitter internally casts
+ *         arithmetic T to SimDuration::rep units to allow using standard
+ *         library distributions as a Distribution.
+ */
 template <class Distribution, class Generator, class Selector>
 class Submitter
 {
diff --git a/src/test/csf/timers.h b/src/test/csf/timers.h
index 2f86fe7729..4f13b21b25 100644
--- a/src/test/csf/timers.h
+++ b/src/test/csf/timers.h
@@ -12,7 +12,8 @@ namespace xrpl::test::csf {
 // Timers are classes that schedule repeated events and are mostly independent
 // of simulation-specific details.
 
-/** Gives heartbeat of simulation to signal simulation progression
+/**
+ * Gives heartbeat of simulation to signal simulation progression
  */
 class HeartbeatTimer
 {
diff --git a/src/test/jtx/AMM.h b/src/test/jtx/AMM.h
index 605f15f812..68b6d9f745 100644
--- a/src/test/jtx/AMM.h
+++ b/src/test/jtx/AMM.h
@@ -131,7 +131,8 @@ struct ClawbackArg
     std::optional<Ter> err = std::nullopt;
 };
 
-/** Convenience class to test AMM functionality.
+/**
+ * Convenience class to test AMM functionality.
  */
 class AMM
 {
@@ -187,7 +188,8 @@ public:
         STAmount const& asset2,
         std::uint16_t const& tfee);
 
-    /** Send amm_info RPC command
+    /**
+     * Send amm_info RPC command
      */
     [[nodiscard]] json::Value
     ammRpcInfo(
@@ -209,7 +211,8 @@ public:
         bool ignoreParams,
         unsigned apiVersion) const;
 
-    /** Verify the AMM balances.
+    /**
+     * Verify the AMM balances.
      */
     [[nodiscard]] bool
     expectBalances(
@@ -218,7 +221,8 @@ public:
         IOUAmount const& lpt,
         std::optional<AccountID> const& account = std::nullopt) const;
 
-    /** Get AMM balances for the token pair.
+    /**
+     * Get AMM balances for the token pair.
      */
     [[nodiscard]] std::tuple<STAmount, STAmount, STAmount>
     balances(
diff --git a/src/test/jtx/AMMTest.h b/src/test/jtx/AMMTest.h
index 971cc5db84..9385313225 100644
--- a/src/test/jtx/AMMTest.h
+++ b/src/test/jtx/AMMTest.h
@@ -103,7 +103,8 @@ public:
     }
 
 protected:
-    /** testAMM() funds 30,000XRP and 30,000IOU
+    /**
+     * testAMM() funds 30,000XRP and 30,000IOU
      * for each non-XRP asset to Alice and Carol
      */
     void
diff --git a/src/test/jtx/AbstractClient.h b/src/test/jtx/AbstractClient.h
index 7c7107ca79..f9d8de0768 100644
--- a/src/test/jtx/AbstractClient.h
+++ b/src/test/jtx/AbstractClient.h
@@ -20,21 +20,24 @@ public:
     AbstractClient&
     operator=(AbstractClient const&) = delete;
 
-    /** Submit a command synchronously.
-
-        The arguments to the function and the returned JSON
-        are in a normalized format, the same whether the client
-        is using the JSON-RPC over HTTP/S or WebSocket transport.
-
-        @param cmd The command to execute
-        @param params json::Value of null or object type
-                      with zero or more key/value pairs.
-        @return The server response in normalized format.
-    */
+    /**
+     * Submit a command synchronously.
+     *
+     * The arguments to the function and the returned JSON
+     * are in a normalized format, the same whether the client
+     * is using the JSON-RPC over HTTP/S or WebSocket transport.
+     *
+     * @param cmd The command to execute
+     * @param params json::Value of null or object type
+     *               with zero or more key/value pairs.
+     * @return The server response in normalized format.
+     */
     virtual json::Value
     invoke(std::string const& cmd, json::Value const& params = {}) = 0;
 
-    /// Get RPC 1.0 or RPC 2.0
+    /**
+     * Get RPC 1.0 or RPC 2.0
+     */
     [[nodiscard]] virtual unsigned
     version() const = 0;
 };
diff --git a/src/test/jtx/Account.h b/src/test/jtx/Account.h
index 264a39f08b..60d07beebd 100644
--- a/src/test/jtx/Account.h
+++ b/src/test/jtx/Account.h
@@ -14,7 +14,9 @@ namespace xrpl::test::jtx {
 
 class IOU;
 
-/** Immutable cryptographic account descriptor. */
+/**
+ * Immutable cryptographic account descriptor.
+ */
 class Account
 {
 private:
@@ -24,7 +26,9 @@ private:
     };
 
 public:
-    /** The master account. */
+    /**
+     * The master account.
+     */
     static Account const kMaster;
 
     Account() = delete;
@@ -35,7 +39,9 @@ public:
     Account&
     operator=(Account&&) = default;
 
-    /** Create an account from a simple string name. */
+    /**
+     * Create an account from a simple string name.
+     */
     /** @{ */
     Account(std::string name, KeyType type = KeyType::Secp256k1);
 
@@ -50,63 +56,79 @@ public:
 
     /** @} */
 
-    /** Create an Account from an account ID. Should only be used when the
-     * secret key is unavailable, such as for pseudo-accounts. */
+    /**
+     * Create an Account from an account ID. Should only be used when the
+     * secret key is unavailable, such as for pseudo-accounts.
+     */
     explicit Account(std::string name, AccountID const& id);
 
     enum class AcctStringType { Base58Seed, Other };
-    /** Create an account from a base58 seed string.  Throws on invalid seed. */
+    /**
+     * Create an account from a base58 seed string.  Throws on invalid seed.
+     */
     Account(AcctStringType stringType, std::string base58SeedStr);
 
-    /** Return the name */
+    /**
+     * Return the name
+     */
     [[nodiscard]] std::string const&
     name() const
     {
         return name_;
     }
 
-    /** Return the public key. */
+    /**
+     * Return the public key.
+     */
     [[nodiscard]] PublicKey const&
     pk() const
     {
         return pk_;
     }
 
-    /** Return the secret key. */
+    /**
+     * Return the secret key.
+     */
     [[nodiscard]] SecretKey const&
     sk() const
     {
         return sk_;
     }
 
-    /** Returns the Account ID.
-
-        The Account ID is the uint160 hash of the public key.
-    */
+    /**
+     * Returns the Account ID.
+     *
+     * The Account ID is the uint160 hash of the public key.
+     */
     [[nodiscard]] AccountID
     id() const
     {
         return id_;
     }
 
-    /** Returns the human readable public key. */
+    /**
+     * Returns the human readable public key.
+     */
     [[nodiscard]] std::string const&
     human() const
     {
         return human_;
     }
 
-    /** Implicit conversion to AccountID.
-
-        This allows passing an Account
-        where an AccountID is expected.
-    */
+    /**
+     * Implicit conversion to AccountID.
+     *
+     * This allows passing an Account
+     * where an AccountID is expected.
+     */
     operator AccountID() const
     {
         return id_;
     }
 
-    /** Returns an IOU for the specified gateway currency. */
+    /**
+     * Returns an IOU for the specified gateway currency.
+     */
     IOU
     operator[](std::string const& s) const;
 
diff --git a/src/test/jtx/CheckMessageLogs.h b/src/test/jtx/CheckMessageLogs.h
index fc46f41671..24b2c24a73 100644
--- a/src/test/jtx/CheckMessageLogs.h
+++ b/src/test/jtx/CheckMessageLogs.h
@@ -9,7 +9,8 @@
 
 namespace xrpl::test {
 
-/** Log manager that searches for a specific message substring
+/**
+ * Log manager that searches for a specific message substring
  */
 class CheckMessageLogs : public Logs
 {
@@ -41,12 +42,13 @@ class CheckMessageLogs : public Logs
     };
 
 public:
-    /** Constructor
-
-        @param msg The message string to search for
-        @param pFound Pointer to the variable to set to true if the message is
-       found
-    */
+    /**
+     * Constructor
+     *
+     * @param msg The message string to search for
+     * @param pFound Pointer to the variable to set to true if the message is
+     * found
+     */
     CheckMessageLogs(std::string msg, bool* pFound)
         : Logs{beast::Severity::Debug}, msg_{std::move(msg)}, pFound_{pFound}
     {
diff --git a/src/test/jtx/Env.h b/src/test/jtx/Env.h
index 04cbce953a..7e22cdd571 100644
--- a/src/test/jtx/Env.h
+++ b/src/test/jtx/Env.h
@@ -55,14 +55,15 @@
 
 namespace xrpl::test::jtx {
 
-/** Wrapper that captures std::source_location when implicitly constructed.
-    This solves the problem of combining std::source_location with variadic
-    templates. The std::source_location default argument is evaluated at the
-    call site when the wrapper is constructed via implicit conversion.
-
-    This is a template struct that holds the value directly, allowing implicit
-    conversion without template argument deduction issues via CTAD.
-*/
+/**
+ * Wrapper that captures std::source_location when implicitly constructed.
+ * This solves the problem of combining std::source_location with variadic
+ * templates. The std::source_location default argument is evaluated at the
+ * call site when the wrapper is constructed via implicit conversion.
+ *
+ * This is a template struct that holds the value directly, allowing implicit
+ * conversion without template argument deduction issues via CTAD.
+ */
 template <class T>
 struct WithSourceLocation
 {
@@ -77,7 +78,9 @@ struct WithSourceLocation
     }
 };
 
-/** Designate accounts as no-ripple in Env::fund */
+/**
+ * Designate accounts as no-ripple in Env::fund
+ */
 template <class... Args>
 std::array<Account, 1 + sizeof...(Args)>
 noripple(Account const& account, Args const&... args)
@@ -151,7 +154,9 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** A transaction testing environment. */
+/**
+ * A transaction testing environment.
+ */
 class Env
 {
 public:
@@ -159,7 +164,9 @@ public:
 
     Account const& master = Account::kMaster;
 
-    /// Used by parseResult() and postConditions()
+    /**
+     * Used by parseResult() and postConditions()
+     */
     struct ParsedResult
     {
         std::optional<TER> ter;
@@ -308,11 +315,12 @@ public:
         return *bundle_.timeKeeper;
     }
 
-    /** Returns the current network time
-
-        @note This is manually advanced when ledgers
-              close or by callers.
-    */
+    /**
+     * Returns the current network time
+     *
+     * @note This is manually advanced when ledgers
+     *       close or by callers.
+     */
     NetClock::time_point
     // NOLINTNEXTLINE(readability-make-member-function-const)
     now()
@@ -320,7 +328,9 @@ public:
         return timeKeeper().now();
     }
 
-    /** Returns the connected client. */
+    /**
+     * Returns the connected client.
+     */
     AbstractClient&
     // NOLINTNEXTLINE(readability-make-member-function-const)
     client()
@@ -328,11 +338,12 @@ public:
         return *bundle_.client;
     }
 
-    /** Execute an RPC command.
-
-        The command is examined and used to build
-        the correct JSON as per the arguments.
-    */
+    /**
+     * Execute an RPC command.
+     *
+     * The command is examined and used to build
+     * the correct JSON as per the arguments.
+     */
     template <class... Args>
     json::Value
     rpc(unsigned apiVersion,
@@ -354,61 +365,64 @@ public:
     json::Value
     rpc(std::string const& cmd, Args&&... args);
 
-    /** Returns the current ledger.
-
-        This is a non-modifiable snapshot of the
-        open ledger at the moment of the call.
-        Transactions applied after the call to open()
-        will not be visible.
-
-    */
+    /**
+     * Returns the current ledger.
+     *
+     * This is a non-modifiable snapshot of the
+     * open ledger at the moment of the call.
+     * Transactions applied after the call to open()
+     * will not be visible.
+     */
     [[nodiscard]] std::shared_ptr<OpenView const>
     current() const
     {
         return app().getOpenLedger().current();
     }
 
-    /** Returns the last closed ledger.
-
-        The open ledger is built on top of the
-        last closed ledger. When the open ledger
-        is closed, it becomes the new closed ledger
-        and a new open ledger takes its place.
-    */
+    /**
+     * Returns the last closed ledger.
+     *
+     * The open ledger is built on top of the
+     * last closed ledger. When the open ledger
+     * is closed, it becomes the new closed ledger
+     * and a new open ledger takes its place.
+     */
     std::shared_ptr<ReadView const>
     closed();
 
-    /** Close and advance the ledger.
-
-        The resulting close time will be different and
-        greater than the previous close time, and at or
-        after the passed-in close time.
-
-        Effects:
-
-            Creates a new closed ledger from the last
-            closed ledger.
-
-            All transactions that made it into the open
-            ledger are applied to the closed ledger.
-
-            The Application network time is set to
-            the close time of the resulting ledger.
-
-        @return true if no error, false if error
-    */
+    /**
+     * Close and advance the ledger.
+     *
+     * The resulting close time will be different and
+     * greater than the previous close time, and at or
+     * after the passed-in close time.
+     *
+     * Effects:
+     *
+     *     Creates a new closed ledger from the last
+     *     closed ledger.
+     *
+     *     All transactions that made it into the open
+     *     ledger are applied to the closed ledger.
+     *
+     *     The Application network time is set to
+     *     the close time of the resulting ledger.
+     *
+     * @return true if no error, false if error
+     */
     bool
     close(
         NetClock::time_point closeTime,
         std::optional<std::chrono::milliseconds> consensusDelay = std::nullopt);
 
-    /** Close and advance the ledger.
-
-        The time is calculated as the duration from
-        the previous ledger closing time.
-
-        @return true if no error, false if error
-    */
+    /**
+     * Close and advance the ledger.
+     *
+     * The time is calculated as the duration from
+     * the previous ledger closing time.
+     *
+     * @return true if no error, false if error
+     */
     template <class Rep, class Period>
     bool
     close(std::chrono::duration<Rep, Period> const& elapsed)
@@ -417,13 +431,14 @@ public:
         return close(now() + elapsed);
     }
 
-    /** Close and advance the ledger.
-
-        The time is calculated as five seconds from
-        the previous ledger closing time.
-
-        @return true if no error, false if error
-    */
+    /**
+     * Close and advance the ledger.
+     *
+     * The time is calculated as five seconds from
+     * the previous ledger closing time.
+     *
+     * @return true if no error, false if error
+     */
     bool
     close()
     {
@@ -431,34 +446,35 @@ public:
         return close(std::chrono::seconds(5));
     }
 
-    /** Close and advance the ledger, then synchronize with the server's
-        io_context to ensure all async operations initiated by the close have
-        been started.
-
-        This function performs the same ledger close as close(), but additionally
-        ensures that all tasks posted to the server's io_context (such as
-        WebSocket subscription message sends) have been initiated before returning.
-
-        What it guarantees:
-        - All async operations posted before syncClose() have been STARTED
-        - For WebSocket sends: async_write_some() has been called
-        - The actual I/O completion may still be pending (async)
-
-        What it does NOT guarantee:
-        - Async operations have COMPLETED
-        - WebSocket messages have been received by clients
-        - However, for localhost connections, the remaining latency is typically
-          microseconds, making tests reliable
-
-        Use this instead of close() when:
-        - Test code immediately checks for subscription messages
-        - Race conditions between test and worker threads must be avoided
-        - Deterministic test behavior is required
-
-        @param timeout Maximum time to wait for the barrier task to execute
-        @return true if close succeeded and barrier executed within timeout,
-                false otherwise
-    */
+    /**
+     * Close and advance the ledger, then synchronize with the server's
+     * io_context to ensure all async operations initiated by the close have
+     * been started.
+     *
+     * This function performs the same ledger close as close(), but additionally
+     * ensures that all tasks posted to the server's io_context (such as
+     * WebSocket subscription message sends) have been initiated before returning.
+     *
+     * What it guarantees:
+     * - All async operations posted before syncClose() have been STARTED
+     * - For WebSocket sends: async_write_some() has been called
+     * - The actual I/O completion may still be pending (async)
+     *
+     * What it does NOT guarantee:
+     * - Async operations have COMPLETED
+     * - WebSocket messages have been received by clients
+     * - However, for localhost connections, the remaining latency is typically
+     *   microseconds, making tests reliable
+     *
+     * Use this instead of close() when:
+     * - Test code immediately checks for subscription messages
+     * - Race conditions between test and worker threads must be avoided
+     * - Deterministic test behavior is required
+     *
+     * @param timeout Maximum time to wait for the barrier task to execute
+     * @return true if close succeeded and barrier executed within timeout,
+     *         false otherwise
+     */
     [[nodiscard]] bool
     syncClose(std::chrono::steady_clock::duration timeout = std::chrono::seconds{1})
     {
@@ -473,16 +489,19 @@ public:
         return result && status == std::future_status::ready;
     }
 
-    /** Turn on JSON tracing.
-        With no arguments, trace all
-    */
+    /**
+     * Turn on JSON tracing.
+     * With no arguments, trace all
+     */
     void
     trace(int howMany = -1)
     {
         trace_ = howMany;
     }
 
-    /** Turn off JSON tracing. */
+    /**
+     * Turn off JSON tracing.
+     */
     void
     notrace()
     {
@@ -495,7 +514,9 @@ public:
         parseFailureExpected_ = b;
     }
 
-    /** Turn off signature checks. */
+    /**
+     * Turn off signature checks.
+     */
     void
     disableSigs()
     {
@@ -516,11 +537,15 @@ public:
         return retries_;
     }
 
-    /** Associate AccountID with account. */
+    /**
+     * Associate AccountID with account.
+     */
     void
     memoize(Account const& account);
 
-    /** Returns the Account given the AccountID. */
+    /**
+     * Returns the Account given the AccountID.
+     */
     /** @{ */
     [[nodiscard]] Account const&
     lookup(AccountID const& id) const;
@@ -529,69 +554,84 @@ public:
     lookup(std::string const& base58ID) const;
     /** @} */
 
-    /** Returns the XRP balance on an account.
-        Returns 0 if the account does not exist.
-    */
+    /**
+     * Returns the XRP balance on an account.
+     * Returns 0 if the account does not exist.
+     */
     [[nodiscard]] PrettyAmount
     balance(Account const& account) const;
 
-    /** Returns the next sequence number on account.
-        Exceptions:
-            Throws if the account does not exist
-    */
+    /**
+     * Returns the next sequence number on account.
+     *
+     * @throws if the account does not exist
+     */
     [[nodiscard]] std::uint32_t
     seq(Account const& account) const;
 
-    /** Return the balance on an account.
-        Returns 0 if the trust line does not exist.
-    */
+    /**
+     * Return the balance on an account.
+     * Returns 0 if the trust line does not exist.
+     */
     // VFALCO NOTE This should return a unit-less amount
     [[nodiscard]] PrettyAmount
     balance(Account const& account, Asset const& asset) const;
 
-    /** Returns the IOU limit on an account.
-        Returns 0 if the trust line does not exist.
-    */
+    /**
+     * Returns the IOU limit on an account.
+     * Returns 0 if the trust line does not exist.
+     */
     [[nodiscard]] PrettyAmount
     limit(Account const& account, Issue const& issue) const;
 
-    /** Return the number of objects owned by an account.
+    /**
+     * Return the number of objects owned by an account.
      * Returns 0 if the account does not exist.
      */
     [[nodiscard]] std::uint32_t
     ownerCount(Account const& account) const;
 
-    /** Return the number of sponsored objects owned by an account.
-     * Throws if the account does not exist.
+    /**
+     * Return the number of sponsored objects owned by an account.
+     *
+     * @throws if the account does not exist.
      */
     [[nodiscard]] std::uint32_t
     sponsoredOwnerCount(Account const& account) const;
 
-    /** Return the number of sponsoring objects owned by an account.
-     * Throws if the account does not exist.
+    /**
+     * Return the number of sponsoring objects owned by an account.
+     *
+     * @throws if the account does not exist.
      */
     [[nodiscard]] std::uint32_t
     sponsoringOwnerCount(Account const& account) const;
 
-    /** Return the number of sponsoring accounts owned by an account.
-     * Throws if the account does not exist.
+    /**
+     * Return the number of sponsoring accounts owned by an account.
+     *
+     * @throws if the account does not exist.
      */
     [[nodiscard]] std::uint32_t
     sponsoringAccountCount(Account const& account) const;
 
-    /** Return an account root.
-        @return empty if the account does not exist.
-    */
+    /**
+     * Return an account root.
+     * @return empty if the account does not exist.
+     */
     [[nodiscard]] SLE::const_pointer
     le(Account const& account) const;
 
-    /** Return a ledger entry.
-        @return empty if the ledger entry does not exist
-    */
+    /**
+     * Return a ledger entry.
+     * @return empty if the ledger entry does not exist
+     */
     [[nodiscard]] SLE::const_pointer
     le(Keylet const& k) const;
 
-    /** Create a JTx from parameters. */
+    /**
+     * Create a JTx from parameters.
+     */
     template <class JsonValue, class... FN>
     JTx
     jt(JsonValue&& jv, FN const&... fN)
@@ -603,7 +643,9 @@ public:
         return jt;
     }
 
-    /** Create a JTx from parameters. */
+    /**
+     * Create a JTx from parameters.
+     */
     template <class JsonValue, class... FN>
     JTx
     jtnofill(JsonValue&& jv, FN const&... fN)
@@ -615,9 +657,10 @@ public:
         return jt;
     }
 
-    /** Create JSON from parameters.
-        This will apply funclets and autofill.
-    */
+    /**
+     * Create JSON from parameters.
+     * This will apply funclets and autofill.
+     */
     template <class JsonValue, class... FN>
     json::Value
     json(JsonValue&& jv, FN const&... fN)
@@ -626,11 +669,12 @@ public:
         return std::move(tj.jv);
     }
 
-    /** Check a set of requirements.
-
-        The requirements are formed
-        from condition functors.
-    */
+    /**
+     * Check a set of requirements.
+     *
+     * The requirements are formed
+     * from condition functors.
+     */
     template <class... Args>
     void
     require(Args const&... args)
@@ -638,29 +682,33 @@ public:
         jtx::required(args...)(*this);
     }
 
-    /** Gets the TER result and `didApply` flag from a RPC Json result object.
+    /**
+     * Gets the TER result and `didApply` flag from a RPC Json result object.
      */
     static ParsedResult
     parseResult(json::Value const& jr);
 
-    /** Submit an existing JTx.
-        This calls postconditions.
-    */
+    /**
+     * Submit an existing JTx.
+     * This calls postconditions.
+     */
     virtual void
     submit(JTx const& jt, std::source_location const& loc = std::source_location::current());
 
-    /** Use the submit RPC command with a provided JTx object.
-        This calls postconditions.
-    */
+    /**
+     * Use the submit RPC command with a provided JTx object.
+     * This calls postconditions.
+     */
     void
     signAndSubmit(
         JTx const& jt,
         json::Value params = json::ValueType::Null,
         std::source_location const& loc = std::source_location::current());
 
-    /** Check expected postconditions
-        of JTx submission.
-    */
+    /**
+     * Check expected postconditions
+     * of JTx submission.
+     */
     void
     postconditions(
         JTx const& jt,
@@ -668,7 +716,9 @@ public:
         json::Value const& jr = json::Value(),
         std::source_location const& loc = std::source_location::current());
 
-    /** Apply funclets and submit. */
+    /**
+     * Apply funclets and submit.
+     */
     /** @{ */
     template <class... FN>
     Env&
@@ -701,38 +751,42 @@ public:
     }
     /** @} */
 
-    /** Return the TER for the last JTx. */
+    /**
+     * Return the TER for the last JTx.
+     */
     [[nodiscard]] TER
     ter() const
     {
         return ter_;
     }
 
-    /** Return metadata for the last JTx.
+    /**
+     * Return metadata for the last JTx.
      *
-     *  NOTE: this has a side effect of closing the open ledger.
-     *  The ledger will only be closed if it includes transactions.
+     * NOTE: this has a side effect of closing the open ledger.
+     * The ledger will only be closed if it includes transactions.
      *
-     *  Effects:
+     * Effects:
      *
-     *      The open ledger is closed as if by a call
-     *      to close(). The metadata for the last
-     *      transaction ID, if any, is returned.
+     *     The open ledger is closed as if by a call
+     *     to close(). The metadata for the last
+     *     transaction ID, if any, is returned.
      */
     std::shared_ptr<STObject const>
     meta();
 
-    /** Return the tx data for the last JTx.
-
-        Effects:
-
-            The tx data for the last transaction
-            ID, if any, is returned. No side
-            effects.
-
-        @note Only necessary for JTx submitted
-            with via sign-and-submit method.
-    */
+    /**
+     * Return the tx data for the last JTx.
+     *
+     * Effects:
+     *
+     *     The tx data for the last transaction
+     *     ID, if any, is returned. No side
+     *     effects.
+     *
+     * @note Only necessary for JTx submitted
+     *     with via sign-and-submit method.
+     */
     [[nodiscard]] std::shared_ptr<STTx const>
     tx() const;
 
@@ -767,32 +821,33 @@ private:
     }
 
 public:
-    /** Create a new account with some XRP.
-
-        These convenience functions are for easy set-up
-        of the environment, they bypass fee, seq, and sig
-        settings. The XRP is transferred from the master
-        account.
-
-        Preconditions:
-            The account must not already exist
-
-        Effects:
-            The asfDefaultRipple on the account is set,
-            and the sequence number is incremented, unless
-            the account is wrapped with a call to noripple.
-
-            The account's XRP balance is set to amount.
-
-            Generates a test that the balance is set.
-
-        @param amount The amount of XRP to transfer to
-                      each account.
-
-        @param args A heterogeneous list of accounts to fund
-                    or calls to noripple with lists of accounts
-                    to fund.
-    */
+    /**
+     * Create a new account with some XRP.
+     *
+     * These convenience functions are for easy set-up
+     * of the environment, they bypass fee, seq, and sig
+     * settings. The XRP is transferred from the master
+     * account.
+     *
+     * Preconditions:
+     *     The account must not already exist
+     *
+     * Effects:
+     *     The asfDefaultRipple on the account is set,
+     *     and the sequence number is incremented, unless
+     *     the account is wrapped with a call to noripple.
+     *
+     *     The account's XRP balance is set to amount.
+     *
+     *     Generates a test that the balance is set.
+     *
+     * @param amount The amount of XRP to transfer to
+     *               each account.
+     *
+     * @param args A heterogeneous list of accounts to fund
+     *             or calls to noripple with lists of accounts
+     *             to fund.
+     */
     template <class Arg, class... Args>
     void
     fund(STAmount const& amount, Arg const& arg, Args const&... args)
@@ -802,23 +857,24 @@ public:
             fund(amount, args...);
     }
 
-    /** Establish trust lines.
-
-        These convenience functions are for easy set-up
-        of the environment, they bypass fee, seq, and sig
-        settings.
-
-        Preconditions:
-            The account must already exist
-
-        Effects:
-            A trust line is added for the account.
-            The account's sequence number is incremented.
-            The account is refunded for the transaction fee
-                to set the trust line.
-
-        The refund comes from the master account.
-    */
+    /**
+     * Establish trust lines.
+     *
+     * These convenience functions are for easy set-up
+     * of the environment, they bypass fee, seq, and sig
+     * settings.
+     *
+     * Preconditions:
+     *     The account must already exist
+     *
+     * Effects:
+     *     A trust line is added for the account.
+     *     The account's sequence number is incremented.
+     *     The account is refunded for the transaction fee
+     *         to set the trust line.
+     *
+     * The refund comes from the master account.
+     */
     /** @{ */
     void
     trust(STAmount const& amount, Account const& account);
@@ -832,10 +888,11 @@ public:
     }
     /** @} */
 
-    /** Create a STTx from a JTx without sanitizing
-        Use to inject bogus values into test transactions by first
-        editing the JSON.
-    */
+    /**
+     * Create a STTx from a JTx without sanitizing
+     * Use to inject bogus values into test transactions by first
+     * editing the JSON.
+     */
     std::shared_ptr<STTx const>
     ust(JTx const& jt);
 
@@ -859,13 +916,14 @@ protected:
     virtual void
     autofill(JTx& jt);
 
-    /** Create a STTx from a JTx
-        The framework requires that JSON is valid.
-        On a parse error, the JSON is logged and
-        an exception thrown.
-        Throws:
-            ParseError
-    */
+    /**
+     * Create a STTx from a JTx
+     * The framework requires that JSON is valid.
+     * On a parse error, the JSON is logged and
+     * an exception thrown.
+     *
+     * @throws ParseError
+     */
     std::shared_ptr<STTx const>
     st(JTx const& jt);
 
diff --git a/src/test/jtx/Env_ss.h b/src/test/jtx/Env_ss.h
index 16e1cdbc82..ca298f0069 100644
--- a/src/test/jtx/Env_ss.h
+++ b/src/test/jtx/Env_ss.h
@@ -10,10 +10,11 @@
 
 namespace xrpl::test::jtx {
 
-/** A transaction testing environment wrapper.
-    Transactions submitted in sign-and-submit mode
-    by default.
-*/
+/**
+ * A transaction testing environment wrapper.
+ * Transactions submitted in sign-and-submit mode
+ * by default.
+ */
 class EnvSs
 {
 private:
diff --git a/src/test/jtx/JSONRPCClient.h b/src/test/jtx/JSONRPCClient.h
index 2864cbbdc8..10e567e91f 100644
--- a/src/test/jtx/JSONRPCClient.h
+++ b/src/test/jtx/JSONRPCClient.h
@@ -8,7 +8,9 @@
 
 namespace xrpl::test {
 
-/** Returns a client using JSON-RPC over HTTP/S. */
+/**
+ * Returns a client using JSON-RPC over HTTP/S.
+ */
 std::unique_ptr<AbstractClient>
 makeJSONRPCClient(Config const& cfg, unsigned rpcVersion = 2);
 
diff --git a/src/test/jtx/JTx.h b/src/test/jtx/JTx.h
index ed585ebb6e..794334bec7 100644
--- a/src/test/jtx/JTx.h
+++ b/src/test/jtx/JTx.h
@@ -19,9 +19,10 @@ namespace xrpl::test::jtx {
 
 class Env;
 
-/** Execution context for applying a JSON transaction.
-    This augments the transaction with various settings.
-*/
+/**
+ * Execution context for applying a JSON transaction.
+ * This augments the transaction with various settings.
+ */
 struct JTx
 {
     json::Value jv;
@@ -63,10 +64,11 @@ struct JTx
         return jv[key];
     }
 
-    /** Return a property if it exists
-
-        @return nullptr if the Prop does not exist
-    */
+    /**
+     * Return a property if it exists
+     *
+     * @return nullptr if the Prop does not exist
+     */
     /** @{ */
     template <class Prop>
     Prop*
@@ -93,10 +95,11 @@ struct JTx
     }
     /** @} */
 
-    /** Set a property
-        If the property already exists,
-        it is replaced.
-    */
+    /**
+     * Set a property
+     * If the property already exists,
+     * it is replaced.
+     */
     /** @{ */
     void
     set(std::unique_ptr<BasicProp> p)
diff --git a/src/test/jtx/Oracle.h b/src/test/jtx/Oracle.h
index 2c296ba705..d0fe8104e5 100644
--- a/src/test/jtx/Oracle.h
+++ b/src/test/jtx/Oracle.h
@@ -102,7 +102,8 @@ struct RemoveArg
 // validation {close-maxLastUpdateTimeDelta,close+maxLastUpdateTimeDelta}.
 static constexpr std::chrono::seconds kTestStartTime = kEpochOffset + std::chrono::seconds(10'000);
 
-/** Oracle class facilitates unit-testing of the Price Oracle feature.
+/**
+ * Oracle class facilitates unit-testing of the Price Oracle feature.
  * It defines functions to create, update, and delete the Oracle object,
  * to query for various states, and to call APIs.
  */
diff --git a/src/test/jtx/PathSet.h b/src/test/jtx/PathSet.h
index fa3f0d40f9..42d391c46f 100644
--- a/src/test/jtx/PathSet.h
+++ b/src/test/jtx/PathSet.h
@@ -18,7 +18,8 @@
 
 namespace xrpl::test {
 
-/** Count offer
+/**
+ * Count offer
  */
 inline std::size_t
 countOffers(
@@ -52,7 +53,8 @@ countOffers(
     return count;
 }
 
-/** An offer exists
+/**
+ * An offer exists
  */
 inline bool
 isOffer(
@@ -64,7 +66,8 @@ isOffer(
     return countOffers(env, account, takerPays, takerGets) > 0;
 }
 
-/** An offer exists
+/**
+ * An offer exists
  */
 inline bool
 isOffer(jtx::Env& env, jtx::Account const& account, Asset const& takerPays, Asset const& takerGets)
diff --git a/src/test/jtx/TestHelpers.h b/src/test/jtx/TestHelpers.h
index 4c18d7343c..c4991c4ff3 100644
--- a/src/test/jtx/TestHelpers.h
+++ b/src/test/jtx/TestHelpers.h
@@ -51,11 +51,12 @@
 
 namespace xrpl::test::jtx {
 
-/** Generic helper class for helper classes that set a field on a JTx.
-
- Not every helper will be able to use this because of conversions and other
- issues, but for classes where it's straightforward, this can simplify things.
-*/
+/**
+ * Generic helper class for helper classes that set a field on a JTx.
+ *
+ * Not every helper will be able to use this because of conversions and other
+ * issues, but for classes where it's straightforward, this can simplify things.
+ */
 template <
     class SField,
     // NOLINTNEXTLINE(readability-redundant-typename): typename required by MSVC
@@ -306,7 +307,8 @@ using valueUnitWrapper = JTxFieldWrapper<ValueUnitField<SField, UnitTag, ValueTy
 template <class SField, class StoredValue = typename SField::type::value_type>
 using simpleField = JTxFieldWrapper<JTxField<SField, StoredValue>>;
 
-/** General field definitions, or fields used in multiple transaction namespaces
+/**
+ * General field definitions, or fields used in multiple transaction namespaces
  */
 auto const kData = JTxFieldWrapper<BlobField>(sfData);
 
@@ -753,7 +755,9 @@ equal(Strand const& strand, Args&&... args)
 /***************************************************************/
 namespace check {
 
-/** Create a check. */
+/**
+ * Create a check.
+ */
 template <typename A>
     requires std::is_same_v<A, AccountID>
 json::Value
@@ -973,7 +977,9 @@ pay(AccountID const& account,
 
 }  // namespace loan
 
-/** Set Expiration on a JTx. */
+/**
+ * Set Expiration on a JTx.
+ */
 class Expiration
 {
 private:
@@ -992,7 +998,9 @@ public:
     }
 };
 
-/** Set SourceTag on a JTx. */
+/**
+ * Set SourceTag on a JTx.
+ */
 class SourceTag
 {
 private:
@@ -1010,7 +1018,9 @@ public:
     }
 };
 
-/** Set DestinationTag on a JTx. */
+/**
+ * Set DestinationTag on a JTx.
+ */
 class DestTag
 {
 private:
diff --git a/src/test/jtx/WSClient.h b/src/test/jtx/WSClient.h
index 4aa41e072c..ee5a46e9ae 100644
--- a/src/test/jtx/WSClient.h
+++ b/src/test/jtx/WSClient.h
@@ -18,18 +18,24 @@ namespace xrpl::test {
 class WSClient : public AbstractClient
 {
 public:
-    /** Retrieve a message. */
+    /**
+     * Retrieve a message.
+     */
     virtual std::optional<json::Value>
     getMsg(std::chrono::milliseconds const& timeout = std::chrono::milliseconds{0}) = 0;
 
-    /** Retrieve a message that meets the predicate criteria. */
+    /**
+     * Retrieve a message that meets the predicate criteria.
+     */
     virtual std::optional<json::Value>
     findMsg(
         std::chrono::milliseconds const& timeout,
         std::function<bool(json::Value const&)> pred) = 0;
 };
 
-/** Returns a client operating through WebSockets/S. */
+/**
+ * Returns a client operating through WebSockets/S.
+ */
 std::unique_ptr<WSClient>
 makeWSClient(
     Config const& cfg,
diff --git a/src/test/jtx/acctdelete.h b/src/test/jtx/acctdelete.h
index 3f8b9f1ed2..935a97ac65 100644
--- a/src/test/jtx/acctdelete.h
+++ b/src/test/jtx/acctdelete.h
@@ -9,7 +9,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Delete account.  If successful transfer remaining XRP to dest. */
+/**
+ * Delete account.  If successful transfer remaining XRP to dest.
+ */
 json::Value
 acctdelete(Account const& account, Account const& dest);
 
diff --git a/src/test/jtx/amount.h b/src/test/jtx/amount.h
index db7dbd1cc1..57a4502db9 100644
--- a/src/test/jtx/amount.h
+++ b/src/test/jtx/amount.h
@@ -69,10 +69,11 @@ struct None
 // could change that value (however unlikely).
 constexpr XRPAmount kJtxDropsPerXrp{1'000'000};
 
-/** Represents an XRP, IOU, or MPT quantity
-    This customizes the string conversion and supports
-    XRP conversions from integer and floating point.
-*/
+/**
+ * Represents an XRP, IOU, or MPT quantity
+ * This customizes the string conversion and supports
+ * XRP conversions from integer and floating point.
+ */
 struct PrettyAmount
 {
 private:
@@ -91,7 +92,9 @@ public:
     {
     }
 
-    /** drops */
+    /**
+     * drops
+     */
     template <class T>
     PrettyAmount(T v)
         requires(sizeof(T) >= sizeof(int) && std::is_integral_v<T> && std::is_signed_v<T>)
@@ -99,7 +102,9 @@ public:
     {
     }
 
-    /** drops */
+    /**
+     * drops
+     */
     template <class T>
     PrettyAmount(T v)
         requires(sizeof(T) >= sizeof(int) && std::is_unsigned_v<T>)
@@ -107,7 +112,9 @@ public:
     {
     }
 
-    /** drops */
+    /**
+     * drops
+     */
     PrettyAmount(XRPAmount v) : amount_(v)
     {
     }
@@ -253,11 +260,12 @@ struct BookSpec
 
 struct XrpT
 {
-    /** Implicit conversion to Issue.
-
-        This allows passing XRP where
-        an Issue is expected.
-    */
+    /**
+     * Implicit conversion to Issue.
+     *
+     * This allows passing XRP where
+     * an Issue is expected.
+     */
     operator Issue() const
     {
         return xrpIssue();
@@ -273,11 +281,12 @@ struct XrpT
         return true;
     }
 
-    /** Returns an amount of XRP as PrettyAmount,
-        which is trivially convertible to STAmount
-
-        @param v The number of XRP (not drops)
-    */
+    /**
+     * Returns an amount of XRP as PrettyAmount,
+     * which is trivially convertible to STAmount
+     *
+     * @param v The number of XRP (not drops)
+     */
     /** @{ */
     template <class T>
     PrettyAmount
@@ -288,11 +297,12 @@ struct XrpT
         return {TOut{v} * kJtxDropsPerXrp};
     }
 
-    /** Returns an amount of XRP as PrettyAmount,
-        which is trivially convertible to STAmount
-
-        @param v The Number of XRP (not drops). May be fractional.
-    */
+    /**
+     * Returns an amount of XRP as PrettyAmount,
+     * which is trivially convertible to STAmount
+     *
+     * @param v The Number of XRP (not drops). May be fractional.
+     */
     PrettyAmount
     operator()(Number v) const
     {
@@ -321,7 +331,9 @@ struct XrpT
     }
     /** @} */
 
-    /** Returns None-of-XRP */
+    /**
+     * Returns None-of-XRP
+     */
     None
     operator()(NoneT) const
     {
@@ -335,19 +347,21 @@ struct XrpT
     }
 };
 
-/** Converts to XRP Issue or STAmount.
-
-    Examples:
-        XRP         Converts to the XRP Issue
-        XRP(10)     Returns STAmount of 10 XRP
-*/
+/**
+ * Converts to XRP Issue or STAmount.
+ *
+ * Examples:
+ *     XRP         Converts to the XRP Issue
+ *     XRP(10)     Returns STAmount of 10 XRP
+ */
 extern XrpT const XRP;  // NOLINT(readability-identifier-naming)
 
-/** Returns an XRP PrettyAmount, which is trivially convertible to STAmount.
-
-    Example:
-        drops(10)   Returns PrettyAmount of 10 drops
-*/
+/**
+ * Returns an XRP PrettyAmount, which is trivially convertible to STAmount.
+ *
+ * Example:
+ *     drops(10)   Returns PrettyAmount of 10 drops
+ */
 template <class Integer>
 PrettyAmount
 drops(Integer i)
@@ -356,11 +370,12 @@ drops(Integer i)
     return {i};
 }
 
-/** Returns an XRP PrettyAmount, which is trivially convertible to STAmount.
-
-Example:
-drops(view->fee().basefee)   Returns PrettyAmount of 10 drops
-*/
+/**
+ * Returns an XRP PrettyAmount, which is trivially convertible to STAmount.
+ *
+ * Example:
+ * drops(view->fee().basefee)   Returns PrettyAmount of 10 drops
+ */
 inline PrettyAmount
 drops(XRPAmount i)
 {
@@ -383,13 +398,14 @@ struct EpsilonT
 
 static EpsilonT const kEpsilon;
 
-/** Converts to IOU Issue or STAmount.
-
-    Examples:
-        IOU         Converts to the underlying Issue
-        IOU(10)     Returns STAmount of 10 of
-                        the underlying Issue.
-*/
+/**
+ * Converts to IOU Issue or STAmount.
+ *
+ * Examples:
+ *     IOU         Converts to the underlying Issue
+ *     IOU(10)     Returns STAmount of 10 of
+ *                     the underlying Issue.
+ */
 class IOU
 {
 public:
@@ -417,11 +433,12 @@ public:
         return issue().integral();
     }
 
-    /** Implicit conversion to Issue or Asset.
-
-        This allows passing an IOU
-        value where an Issue or Asset is expected.
-    */
+    /**
+     * Implicit conversion to Issue or Asset.
+     *
+     * This allows passing an IOU
+     * value where an Issue or Asset is expected.
+     */
     operator Issue() const
     {
         return issue();
@@ -453,7 +470,9 @@ public:
     // VFALCO TODO
     // STAmount operator()(char const* s) const;
 
-    /** Returns None-of-Issue */
+    /**
+     * Returns None-of-Issue
+     */
     None
     operator()(NoneT) const
     {
@@ -472,13 +491,14 @@ operator<<(std::ostream& os, IOU const& iou);
 
 //------------------------------------------------------------------------------
 
-/** Converts to MPT Issue or STAmount.
-
-    Examples:
-        MPT         Converts to the underlying Issue
-        MPT(10)     Returns STAmount of 10 of
-                        the underlying MPT
-*/
+/**
+ * Converts to MPT Issue or STAmount.
+ *
+ * Examples:
+ *     MPT         Converts to the underlying Issue
+ *     MPT(10)     Returns STAmount of 10 of
+ *                     the underlying MPT
+ */
 class MPT
 {
 public:
@@ -504,7 +524,8 @@ public:
         return issuanceID;
     }
 
-    /** Explicit conversion to MPTIssue or asset.
+    /**
+     * Explicit conversion to MPTIssue or asset.
      */
     [[nodiscard]] xrpl::MPTIssue
     mptIssue() const
@@ -522,11 +543,12 @@ public:
         return true;
     }
 
-    /** Implicit conversion to MPTIssue or asset.
-
-        This allows passing an MPT
-        value where an MPTIssue is expected.
-    */
+    /**
+     * Implicit conversion to MPTIssue or asset.
+     *
+     * This allows passing an MPT
+     * value where an MPTIssue is expected.
+     */
     operator xrpl::MPTIssue() const
     {
         return mptIssue();
@@ -558,7 +580,9 @@ public:
     PrettyAmount
     operator()(detail::EpsilonMultiple) const;
 
-    /** Returns None-of-Issue */
+    /**
+     * Returns None-of-Issue
+     */
     None
     operator()(NoneT) const
     {
@@ -583,7 +607,9 @@ struct AnyT
     operator()(STAmount const& sta) const;
 };
 
-/** Amount specifier with an option for any issuer. */
+/**
+ * Amount specifier with an option for any issuer.
+ */
 struct AnyAmount
 {
     bool isAny;
@@ -618,9 +644,10 @@ AnyT::operator()(STAmount const& sta) const
     return AnyAmount(sta, this);
 }
 
-/** Returns an amount representing "any issuer"
-    @note With respect to what the recipient will accept
-*/
+/**
+ * Returns an amount representing "any issuer"
+ * @note With respect to what the recipient will accept
+ */
 extern AnyT const kAny;
 
 }  // namespace test::jtx
diff --git a/src/test/jtx/balance.h b/src/test/jtx/balance.h
index 3f39e9f0fb..9d7937369b 100644
--- a/src/test/jtx/balance.h
+++ b/src/test/jtx/balance.h
@@ -11,14 +11,15 @@
 
 namespace xrpl::test::jtx {
 
-/** A balance matches.
-
-    This allows "none" which means either the account
-    doesn't exist (no XRP) or the trust line does not
-    exist. If an amount is specified, the SLE must
-    exist even if the amount is 0, or else the test
-    fails.
-*/
+/**
+ * A balance matches.
+ *
+ * This allows "none" which means either the account
+ * doesn't exist (no XRP) or the trust line does not
+ * exist. If an amount is specified, the SLE must
+ * exist even if the amount is 0, or else the test
+ * fails.
+ */
 class Balance
 {
 private:
diff --git a/src/test/jtx/batch.h b/src/test/jtx/batch.h
index bb1deec1a2..140fc84ab1 100644
--- a/src/test/jtx/batch.h
+++ b/src/test/jtx/batch.h
@@ -18,7 +18,9 @@
 #include <utility>
 #include <vector>
 
-/** @brief Helpers for constructing Batch test transactions. */
+/**
+ * @brief Helpers for constructing Batch test transactions.
+ */
 namespace xrpl::test::jtx::batch {
 
 /**
@@ -57,7 +59,9 @@ calcConfidentialBatchFee(jtx::Env const& env, uint32_t const& numSigners, uint32
 json::Value
 outer(jtx::Account const& account, uint32_t seq, STAmount const& fee, std::uint32_t flags);
 
-/** @brief Adds an inner Batch transaction to a JTx and autofills it. */
+/**
+ * @brief Adds an inner Batch transaction to a JTx and autofills it.
+ */
 class Inner
 {
 private:
@@ -106,7 +110,9 @@ public:
     }
 };
 
-/** @brief Sets the Batch transaction signers on a JTx. */
+/**
+ * @brief Sets the Batch transaction signers on a JTx.
+ */
 class Sig
 {
 public:
@@ -129,7 +135,9 @@ public:
     operator()(Env&, JTx& jt) const;
 };
 
-/** @brief Sets a nested multi-signature for a Batch transaction on a JTx. */
+/**
+ * @brief Sets a nested multi-signature for a Batch transaction on a JTx.
+ */
 class Msig
 {
 public:
diff --git a/src/test/jtx/check.h b/src/test/jtx/check.h
index f66d802247..a5d1f079c4 100644
--- a/src/test/jtx/check.h
+++ b/src/test/jtx/check.h
@@ -12,14 +12,20 @@
 
 namespace xrpl::test::jtx {
 
-/** Check operations. */
+/**
+ * Check operations.
+ */
 namespace check {
 
-/** Cash a check requiring that a specific amount be delivered. */
+/**
+ * Cash a check requiring that a specific amount be delivered.
+ */
 json::Value
 cash(jtx::Account const& dest, uint256 const& checkId, STAmount const& amount);
 
-/** Type used to specify DeliverMin for cashing a check. */
+/**
+ * Type used to specify DeliverMin for cashing a check.
+ */
 struct DeliverMin
 {
     STAmount value;
@@ -28,17 +34,23 @@ struct DeliverMin
     }
 };
 
-/** Cash a check requiring that at least a minimum amount be delivered. */
+/**
+ * Cash a check requiring that at least a minimum amount be delivered.
+ */
 json::Value
 cash(jtx::Account const& dest, uint256 const& checkId, DeliverMin const& atLeast);
 
-/** Cancel a check. */
+/**
+ * Cancel a check.
+ */
 json::Value
 cancel(jtx::Account const& dest, uint256 const& checkId);
 
 }  // namespace check
 
-/** Match the number of checks on the account. */
+/**
+ * Match the number of checks on the account.
+ */
 using checks = OwnerCount<ltCHECK>;
 
 }  // namespace xrpl::test::jtx
diff --git a/src/test/jtx/delivermin.h b/src/test/jtx/delivermin.h
index 29256e37bd..db5014bc07 100644
--- a/src/test/jtx/delivermin.h
+++ b/src/test/jtx/delivermin.h
@@ -9,7 +9,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Sets the DeliverMin on a JTx. */
+/**
+ * Sets the DeliverMin on a JTx.
+ */
 class DeliverMin
 {
 private:
diff --git a/src/test/jtx/deposit.h b/src/test/jtx/deposit.h
index 5ba12648e2..3039167cee 100644
--- a/src/test/jtx/deposit.h
+++ b/src/test/jtx/deposit.h
@@ -10,14 +10,20 @@
 #include <string>
 #include <vector>
 
-/** Deposit preauthorize operations */
+/**
+ * Deposit preauthorize operations
+ */
 namespace xrpl::test::jtx::deposit {
 
-/** Preauthorize for deposit.  Invoke as deposit::auth. */
+/**
+ * Preauthorize for deposit.  Invoke as deposit::auth.
+ */
 json::Value
 auth(Account const& account, Account const& auth);
 
-/** Remove pre-authorization for deposit.  Invoke as deposit::unauth. */
+/**
+ * Remove pre-authorization for deposit.  Invoke as deposit::unauth.
+ */
 json::Value
 unauth(Account const& account, Account const& unauth);
 
diff --git a/src/test/jtx/did.h b/src/test/jtx/did.h
index 30c89fd879..da10b476e8 100644
--- a/src/test/jtx/did.h
+++ b/src/test/jtx/did.h
@@ -10,7 +10,9 @@
 
 #include <string>
 
-/** DID operations. */
+/**
+ * DID operations.
+ */
 namespace xrpl::test::jtx::did {
 
 json::Value
@@ -19,7 +21,9 @@ set(jtx::Account const& account);
 json::Value
 setValid(jtx::Account const& account);
 
-/** Sets the optional DIDDocument on a DIDSet. */
+/**
+ * Sets the optional DIDDocument on a DIDSet.
+ */
 class Document
 {
 private:
@@ -37,7 +41,9 @@ public:
     }
 };
 
-/** Sets the optional URI on a DIDSet. */
+/**
+ * Sets the optional URI on a DIDSet.
+ */
 class Uri
 {
 private:
@@ -55,7 +61,9 @@ public:
     }
 };
 
-/** Sets the optional Data on a DIDSet. */
+/**
+ * Sets the optional Data on a DIDSet.
+ */
 class Data
 {
 private:
diff --git a/src/test/jtx/directory.h b/src/test/jtx/directory.h
index 13473f949e..294cfcc43c 100644
--- a/src/test/jtx/directory.h
+++ b/src/test/jtx/directory.h
@@ -13,7 +13,9 @@
 #include <functional>
 #include <limits>
 
-/** Directory operations. */
+/**
+ * Directory operations.
+ */
 namespace xrpl::test::jtx::directory {
 
 enum class Error {
@@ -25,14 +27,16 @@ enum class Error {
     AdjustmentError
 };
 
-/// Move the position of the last page in the user's directory on open ledger to
-/// newLastPage. Requirements:
-/// - directory must have at least two pages (root and one more)
-/// - adjust should be used to update owner nodes of the objects affected
-/// - newLastPage must be greater than index of the last page in the directory
-///
-/// Use this to test tecDIR_FULL errors in open ledger.
-/// NOTE: effects will be DISCARDED on env.close()
+/**
+ * Move the position of the last page in the user's directory on open ledger to
+ * newLastPage. Requirements:
+ * - directory must have at least two pages (root and one more)
+ * - adjust should be used to update owner nodes of the objects affected
+ * - newLastPage must be greater than index of the last page in the directory
+ *
+ * Use this to test tecDIR_FULL errors in open ledger.
+ * NOTE: effects will be DISCARDED on env.close()
+ */
 auto
 bumpLastPage(
     Env& env,
@@ -40,10 +44,12 @@ bumpLastPage(
     Keylet directory,
     std::function<bool(ApplyView&, uint256, std::uint64_t)> adjust) -> std::expected<void, Error>;
 
-/// Implementation of adjust for the most common ledger entry, i.e. one where
-/// page index is stored in sfOwnerNode (and only there). Pass this function
-/// to bumpLastPage if the last page of directory has only objects
-/// of this kind (e.g. ticket, DID, offer, deposit preauth, MPToken etc.)
+/**
+ * Implementation of adjust for the most common ledger entry, i.e. one where
+ * page index is stored in sfOwnerNode (and only there). Pass this function
+ * to bumpLastPage if the last page of directory has only objects
+ * of this kind (e.g. ticket, DID, offer, deposit preauth, MPToken etc.)
+ */
 bool
 adjustOwnerNode(ApplyView& view, uint256 key, std::uint64_t page);
 
diff --git a/src/test/jtx/domain.h b/src/test/jtx/domain.h
index ebcfdb662a..c6061c9795 100644
--- a/src/test/jtx/domain.h
+++ b/src/test/jtx/domain.h
@@ -7,7 +7,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Set the domain on a JTx. */
+/**
+ * Set the domain on a JTx.
+ */
 class Domain
 {
 private:
diff --git a/src/test/jtx/envconfig.h b/src/test/jtx/envconfig.h
index 0079605637..1f920fca58 100644
--- a/src/test/jtx/envconfig.h
+++ b/src/test/jtx/envconfig.h
@@ -17,18 +17,22 @@ getEnvLocalhostAddr()
     return gEnvUseIPv4 ? "127.0.0.1" : "::1";
 }
 
-/// @brief initializes a config object for use with jtx::Env
-///
-/// @param config the configuration object to be initialized
+/**
+ * @brief initializes a config object for use with jtx::Env
+ *
+ * @param config the configuration object to be initialized
+ */
 extern void
 setupConfigForUnitTests(Config& config);
 
 namespace jtx {
 
-/// @brief creates and initializes a default
-/// configuration for jtx::Env
-///
-/// @return unique_ptr to Config instance
+/**
+ * @brief creates and initializes a default
+ * configuration for jtx::Env
+ *
+ * @return unique_ptr to Config instance
+ */
 inline std::unique_ptr<Config>
 envconfig()
 {
@@ -37,18 +41,20 @@ envconfig()
     return p;
 }
 
-/// @brief creates and initializes a default configuration for jtx::Env and
-/// invokes the provided function/lambda with the configuration object.
-///
-/// @param modfunc callable function or lambda to modify the default config.
-/// The first argument to the function must be std::unique_ptr to
-/// xrpl::Config. The function takes ownership of the unique_ptr and
-/// relinquishes ownership by returning a unique_ptr.
-///
-/// @param args additional arguments that will be passed to
-/// the config modifier function (optional)
-///
-/// @return unique_ptr to Config instance
+/**
+ * @brief creates and initializes a default configuration for jtx::Env and
+ * invokes the provided function/lambda with the configuration object.
+ *
+ * @param modfunc callable function or lambda to modify the default config.
+ * The first argument to the function must be std::unique_ptr to
+ * xrpl::Config. The function takes ownership of the unique_ptr and
+ * relinquishes ownership by returning a unique_ptr.
+ *
+ * @param args additional arguments that will be passed to
+ * the config modifier function (optional)
+ *
+ * @return unique_ptr to Config instance
+ */
 template <class F, class... Args>
 std::unique_ptr<Config>
 envconfig(F&& modfunc, Args&&... args)
@@ -56,14 +62,16 @@ envconfig(F&& modfunc, Args&&... args)
     return modfunc(envconfig(), std::forward<Args>(args)...);
 }
 
-/// @brief adjust config so no admin ports are enabled
-///
-/// this is intended for use with envconfig, as in
-/// envconfig(noAdmin)
-///
-/// @param cfg config instance to be modified
-///
-/// @return unique_ptr to Config instance
+/**
+ * @brief adjust config so no admin ports are enabled
+ *
+ * this is intended for use with envconfig, as in
+ * envconfig(noAdmin)
+ *
+ * @param cfg config instance to be modified
+ *
+ * @return unique_ptr to Config instance
+ */
 std::unique_ptr<Config> noAdmin(std::unique_ptr<Config>);
 
 std::unique_ptr<Config> secureGateway(std::unique_ptr<Config>);
@@ -74,61 +82,71 @@ std::unique_ptr<Config> secureGatewayLocalnet(std::unique_ptr<Config>);
 
 std::unique_ptr<Config> singleThreadIo(std::unique_ptr<Config>);
 
-/// @brief adjust configuration with params needed to be a validator
-///
-/// this is intended for use with envconfig, as in
-/// envconfig(validator, myseed)
-///
-/// @param cfg config instance to be modified
-/// @param seed seed string for use in secret key generation. A fixed default
-/// value will be used if this string is empty
-///
-/// @return unique_ptr to Config instance
+/**
+ * @brief adjust configuration with params needed to be a validator
+ *
+ * this is intended for use with envconfig, as in
+ * envconfig(validator, myseed)
+ *
+ * @param cfg config instance to be modified
+ * @param seed seed string for use in secret key generation. A fixed default
+ * value will be used if this string is empty
+ *
+ * @return unique_ptr to Config instance
+ */
 std::unique_ptr<Config>
 validator(std::unique_ptr<Config>, std::string const&);
 
-/// @brief add a grpc address and port to config
-///
-/// This is intended for use with envconfig, for tests that require a grpc
-/// server. If this function is not called, grpc server will not start
-///
-///
-/// @param cfg config instance to be modified
+/**
+ * @brief add a grpc address and port to config
+ *
+ * This is intended for use with envconfig, for tests that require a grpc
+ * server. If this function is not called, grpc server will not start
+ *
+ *
+ * @param cfg config instance to be modified
+ */
 std::unique_ptr<Config> addGrpcConfig(std::unique_ptr<Config>);
 
-/// @brief add a grpc address, port and secureGateway to config
-///
-/// This is intended for use with envconfig, for tests that require a grpc
-/// server. If this function is not called, grpc server will not start
-///
-///
-/// @param cfg config instance to be modified
+/**
+ * @brief add a grpc address, port and secureGateway to config
+ *
+ * This is intended for use with envconfig, for tests that require a grpc
+ * server. If this function is not called, grpc server will not start
+ *
+ *
+ * @param cfg config instance to be modified
+ */
 std::unique_ptr<Config>
 addGrpcConfigWithSecureGateway(std::unique_ptr<Config>, std::string const& secureGateway);
 
-/// @brief add a grpc address, port and TLS certificate/key paths to config
-///
-/// This is intended for use with envconfig, for tests that require a grpc
-/// server with TLS enabled.
-///
-/// @param cfg config instance to be modified
-/// @param certPath path to SSL certificate file
-/// @param keyPath path to SSL private key file
+/**
+ * @brief add a grpc address, port and TLS certificate/key paths to config
+ *
+ * This is intended for use with envconfig, for tests that require a grpc
+ * server with TLS enabled.
+ *
+ * @param cfg config instance to be modified
+ * @param certPath path to SSL certificate file
+ * @param keyPath path to SSL private key file
+ */
 std::unique_ptr<Config>
 addGrpcConfigWithTLS(
     std::unique_ptr<Config>,
     std::string const& certPath,
     std::string const& keyPath);
 
-/// @brief add a grpc address, port and TLS certificate/key/client CA paths to config
-///
-/// This is intended for use with envconfig, for tests that require a grpc
-/// server with mutual TLS (client certificate verification) enabled.
-///
-/// @param cfg config instance to be modified
-/// @param certPath path to SSL certificate file
-/// @param keyPath path to SSL private key file
-/// @param clientCAPath path to SSL client CA certificate file for mTLS
+/**
+ * @brief add a grpc address, port and TLS certificate/key/client CA paths to config
+ *
+ * This is intended for use with envconfig, for tests that require a grpc
+ * server with mutual TLS (client certificate verification) enabled.
+ *
+ * @param cfg config instance to be modified
+ * @param certPath path to SSL certificate file
+ * @param keyPath path to SSL private key file
+ * @param clientCAPath path to SSL client CA certificate file for mTLS
+ */
 std::unique_ptr<Config>
 addGrpcConfigWithTLSAndClientCA(
     std::unique_ptr<Config>,
@@ -136,15 +154,17 @@ addGrpcConfigWithTLSAndClientCA(
     std::string const& keyPath,
     std::string const& clientCAPath);
 
-/// @brief add a grpc address, port and TLS with server cert chain to config
-///
-/// This is intended for use with envconfig, for tests that require a grpc
-/// server with TLS enabled and intermediate CA certificates.
-///
-/// @param cfg config instance to be modified
-/// @param certPath path to SSL certificate file
-/// @param keyPath path to SSL private key file
-/// @param certChainPath path to SSL intermediate CA certificate(s) file
+/**
+ * @brief add a grpc address, port and TLS with server cert chain to config
+ *
+ * This is intended for use with envconfig, for tests that require a grpc
+ * server with TLS enabled and intermediate CA certificates.
+ *
+ * @param cfg config instance to be modified
+ * @param certPath path to SSL certificate file
+ * @param keyPath path to SSL private key file
+ * @param certChainPath path to SSL intermediate CA certificate(s) file
+ */
 std::unique_ptr<Config>
 addGrpcConfigWithTLSAndCertChain(
     std::unique_ptr<Config>,
diff --git a/src/test/jtx/escrow.h b/src/test/jtx/escrow.h
index 728b2e3643..68737c2e35 100644
--- a/src/test/jtx/escrow.h
+++ b/src/test/jtx/escrow.h
@@ -13,7 +13,9 @@
 #include <array>
 #include <cstdint>
 
-/** Escrow operations. */
+/**
+ * Escrow operations.
+ */
 namespace xrpl::test::jtx::escrow {
 
 json::Value
@@ -70,10 +72,14 @@ std::array<std::uint8_t, 39> const kCb3 = {
      0x3F, 0xA6, 0x3B, 0x1B, 0x60, 0x6F, 0x2D, 0x26, 0x4A, 0x2D, 0x85, 0x7B, 0xE8,
      0xA0, 0x9C, 0x1D, 0xFD, 0x57, 0x0D, 0x15, 0x85, 0x8B, 0xD4, 0x81, 0x01, 0x04}};
 
-/** Set the "FinishAfter" time tag on a JTx */
+/**
+ * Set the "FinishAfter" time tag on a JTx
+ */
 auto const kFinishTime = JTxFieldWrapper<TimePointField>(sfFinishAfter);
 
-/** Set the "CancelAfter" time tag on a JTx */
+/**
+ * Set the "CancelAfter" time tag on a JTx
+ */
 auto const kCancelTime = JTxFieldWrapper<TimePointField>(sfCancelAfter);
 
 auto const kCondition = JTxFieldWrapper<BlobField>(sfCondition);
diff --git a/src/test/jtx/fee.h b/src/test/jtx/fee.h
index ad3002dc75..3754036479 100644
--- a/src/test/jtx/fee.h
+++ b/src/test/jtx/fee.h
@@ -13,7 +13,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Set the fee on a JTx. */
+/**
+ * Set the fee on a JTx.
+ */
 class Fee
 {
 private:
diff --git a/src/test/jtx/flags.h b/src/test/jtx/flags.h
index 83470f9a1b..5bbe3c8d12 100644
--- a/src/test/jtx/flags.h
+++ b/src/test/jtx/flags.h
@@ -97,18 +97,24 @@ namespace test::jtx {
 
 // JSON generators
 
-/** Add and/or remove flag. */
+/**
+ * Add and/or remove flag.
+ */
 json::Value
 fset(Account const& account, std::uint32_t on, std::uint32_t off = 0);
 
-/** Remove account flag. */
+/**
+ * Remove account flag.
+ */
 inline json::Value
 fclear(Account const& account, std::uint32_t off)
 {
     return fset(account, 0, off);
 }
 
-/** Match set account flags */
+/**
+ * Match set account flags
+ */
 class Flags : private xrpl::detail::FlagsHelper
 {
 private:
@@ -124,7 +130,9 @@ public:
     operator()(Env& env) const;
 };
 
-/** Match clear account flags */
+/**
+ * Match clear account flags
+ */
 class Nflags : private xrpl::detail::FlagsHelper
 {
 private:
diff --git a/src/test/jtx/impl/dids.cpp b/src/test/jtx/impl/dids.cpp
index d82250ca34..9c27ea21e3 100644
--- a/src/test/jtx/impl/dids.cpp
+++ b/src/test/jtx/impl/dids.cpp
@@ -7,7 +7,9 @@
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/jss.h>
 
-/** DID operations. */
+/**
+ * DID operations.
+ */
 namespace xrpl::test::jtx::did {
 
 json::Value
diff --git a/src/test/jtx/impl/directory.cpp b/src/test/jtx/impl/directory.cpp
index 9fb06e25df..5eaf0be196 100644
--- a/src/test/jtx/impl/directory.cpp
+++ b/src/test/jtx/impl/directory.cpp
@@ -18,7 +18,9 @@
 #include <functional>
 #include <memory>
 
-/** Directory operations. */
+/**
+ * Directory operations.
+ */
 namespace xrpl::test::jtx::directory {
 
 auto
diff --git a/src/test/jtx/impl/escrow.cpp b/src/test/jtx/impl/escrow.cpp
index 007f492849..61c260a5d0 100644
--- a/src/test/jtx/impl/escrow.cpp
+++ b/src/test/jtx/impl/escrow.cpp
@@ -14,7 +14,9 @@
 
 #include <cstdint>
 
-/** Escrow operations. */
+/**
+ * Escrow operations.
+ */
 namespace xrpl::test::jtx::escrow {
 
 json::Value
diff --git a/src/test/jtx/jtx_json.h b/src/test/jtx/jtx_json.h
index b22d4c30e1..1ef5c155a8 100644
--- a/src/test/jtx/jtx_json.h
+++ b/src/test/jtx/jtx_json.h
@@ -9,7 +9,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Inject raw JSON. */
+/**
+ * Inject raw JSON.
+ */
 class Json
 {
 private:
diff --git a/src/test/jtx/ledgerStateFix.h b/src/test/jtx/ledgerStateFix.h
index dd1ac19f04..2fe5c8accc 100644
--- a/src/test/jtx/ledgerStateFix.h
+++ b/src/test/jtx/ledgerStateFix.h
@@ -5,14 +5,20 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/json/json_value.h>
 
-/** LedgerStateFix operations. */
+/**
+ * LedgerStateFix operations.
+ */
 namespace xrpl::test::jtx::ledgerStateFix {
 
-/** Repair the links in an NFToken directory. */
+/**
+ * Repair the links in an NFToken directory.
+ */
 json::Value
 nftPageLinks(jtx::Account const& acct, jtx::Account const& owner);
 
-/** Repair sfExchangeRate on a book directory's first page. */
+/**
+ * Repair sfExchangeRate on a book directory's first page.
+ */
 json::Value
 bookExchangeRate(jtx::Account const& acct, uint256 const& bookDir);
 
diff --git a/src/test/jtx/memo.h b/src/test/jtx/memo.h
index cea4923d38..4e342816ca 100644
--- a/src/test/jtx/memo.h
+++ b/src/test/jtx/memo.h
@@ -8,11 +8,12 @@
 
 namespace xrpl::test::jtx {
 
-/** Add a memo to a JTx.
-
-    If a memo already exists, the new
-    memo is appended to the array.
-*/
+/**
+ * Add a memo to a JTx.
+ *
+ * If a memo already exists, the new
+ * memo is appended to the array.
+ */
 class Memo
 {
 private:
diff --git a/src/test/jtx/mpt.h b/src/test/jtx/mpt.h
index 1a7fe94785..c6532ab14a 100644
--- a/src/test/jtx/mpt.h
+++ b/src/test/jtx/mpt.h
@@ -65,7 +65,9 @@ gMakeZeroBuffer(std::size_t size)
     return b;
 }
 
-/** @brief Test helper that checks MPT flag settings after creation. */
+/**
+ * @brief Test helper that checks MPT flag settings after creation.
+ */
 class MptFlags
 {
 private:
@@ -86,7 +88,9 @@ public:
     operator()(Env& env) const;
 };
 
-/** @brief Test helper that checks MPT issuance or holder balances. */
+/**
+ * @brief Test helper that checks MPT issuance or holder balances.
+ */
 class MptBalance
 {
 private:
@@ -104,7 +108,9 @@ public:
     operator()(Env& env) const;
 };
 
-/** @brief Test helper that accepts any condition supplied by a callback. */
+/**
+ * @brief Test helper that accepts any condition supplied by a callback.
+ */
 class RequireAny
 {
 private:
@@ -121,7 +127,9 @@ public:
 
 using Holders = std::vector<Account>;
 
-/** @brief Arguments for building an MPTokenIssuanceCreate test transaction. */
+/**
+ * @brief Arguments for building an MPTokenIssuanceCreate test transaction.
+ */
 struct MPTCreate
 {
     static inline std::vector<Account> allHolders = {};
@@ -145,7 +153,9 @@ struct MPTCreate
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for initializing funded MPT test accounts and issuance. */
+/**
+ * @brief Arguments for initializing funded MPT test accounts and issuance.
+ */
 struct MPTInit
 {
     // Default-initialized so designated-initializer call sites that omit
@@ -161,7 +171,9 @@ struct MPTInit
 };
 static MPTInit const kMptInitNoFund{.fund = false};
 
-/** @brief Full constructor arguments for MPTTester initialization. */
+/**
+ * @brief Full constructor arguments for MPTTester initialization.
+ */
 struct MPTInitDef
 {
     Env& env;
@@ -179,7 +191,9 @@ struct MPTInitDef
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for building an MPTokenIssuanceDestroy test transaction. */
+/**
+ * @brief Arguments for building an MPTokenIssuanceDestroy test transaction.
+ */
 struct MPTDestroy
 {
     std::optional<Account> issuer = std::nullopt;
@@ -190,7 +204,9 @@ struct MPTDestroy
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for building an MPTokenAuthorize test transaction. */
+/**
+ * @brief Arguments for building an MPTokenAuthorize test transaction.
+ */
 struct MPTAuthorize
 {
     std::optional<Account> account = std::nullopt;
@@ -202,7 +218,9 @@ struct MPTAuthorize
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for building an MPTokenIssuanceSet test transaction. */
+/**
+ * @brief Arguments for building an MPTokenIssuanceSet test transaction.
+ */
 struct MPTSet
 {
     std::optional<Account> account = std::nullopt;
@@ -222,7 +240,9 @@ struct MPTSet
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for building a ConfidentialMPTConvert test transaction. */
+/**
+ * @brief Arguments for building a ConfidentialMPTConvert test transaction.
+ */
 struct MPTConvert
 {
     std::optional<Account> account = std::nullopt;
@@ -250,7 +270,9 @@ struct MPTConvert
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for building a ConfidentialMPTMergeInbox test transaction. */
+/**
+ * @brief Arguments for building a ConfidentialMPTMergeInbox test transaction.
+ */
 struct MPTMergeInbox
 {
     std::optional<Account> account = std::nullopt;
@@ -264,7 +286,9 @@ struct MPTMergeInbox
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for building a ConfidentialMPTSend test transaction. */
+/**
+ * @brief Arguments for building a ConfidentialMPTSend test transaction.
+ */
 struct MPTConfidentialSend
 {
     std::optional<Account> account = std::nullopt;
@@ -293,7 +317,9 @@ struct MPTConfidentialSend
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for building a ConfidentialMPTConvertBack test transaction. */
+/**
+ * @brief Arguments for building a ConfidentialMPTConvertBack test transaction.
+ */
 struct MPTConvertBack
 {
     std::optional<Account> account = std::nullopt;
@@ -316,7 +342,9 @@ struct MPTConvertBack
     std::optional<TER> err = std::nullopt;
 };
 
-/** @brief Arguments for building a ConfidentialMPTClawback test transaction. */
+/**
+ * @brief Arguments for building a ConfidentialMPTClawback test transaction.
+ */
 struct MPTConfidentialClawback
 {
     std::optional<Account> account = std::nullopt;
@@ -339,16 +367,24 @@ struct MPTConfidentialClawback
  */
 struct PedersenProofParams
 {
-    /** @brief The Pedersen commitment used by the proof. */
+    /**
+     * @brief The Pedersen commitment used by the proof.
+     */
     Buffer const pedersenCommitment;
 
-    /** @brief Either the spending balance or the value being transferred. */
+    /**
+     * @brief Either the spending balance or the value being transferred.
+     */
     uint64_t const amt;
 
-    /** @brief The encrypted amount linked to the Pedersen commitment. */
+    /**
+     * @brief The encrypted amount linked to the Pedersen commitment.
+     */
     Buffer const encryptedAmt;
 
-    /** @brief The blinding factor used to create the Pedersen commitment. */
+    /**
+     * @brief The blinding factor used to create the Pedersen commitment.
+     */
     Buffer const blindingFactor;
 };
 
@@ -365,13 +401,19 @@ struct PedersenProofParams
  */
 struct ConfidentialSendChainState
 {
-    /** @brief Decrypted spending balance after the previous send. */
+    /**
+     * @brief Decrypted spending balance after the previous send.
+     */
     std::uint64_t spending;
 
-    /** @brief Encrypted spending balance after the previous send. */
+    /**
+     * @brief Encrypted spending balance after the previous send.
+     */
     Buffer encSpending;
 
-    /** @brief sfConfidentialBalanceVersion after the previous send. */
+    /**
+     * @brief sfConfidentialBalanceVersion after the previous send.
+     */
     std::uint32_t version;
 };
 
diff --git a/src/test/jtx/multisign.h b/src/test/jtx/multisign.h
index c90e28537a..65e39f971d 100644
--- a/src/test/jtx/multisign.h
+++ b/src/test/jtx/multisign.h
@@ -20,7 +20,9 @@
 
 namespace xrpl::test::jtx {
 
-/** A signer in a SignerList */
+/**
+ * A signer in a SignerList
+ */
 struct Signer
 {
     std::uint32_t weight;
@@ -36,24 +38,31 @@ struct Signer
 json::Value
 signers(Account const& account, std::uint32_t quorum, std::vector<Signer> const& v);
 
-/** Remove a signer list. */
+/**
+ * Remove a signer list.
+ */
 json::Value
 signers(Account const& account, NoneT);
 
 //------------------------------------------------------------------------------
 
-/** Set a multisignature on a JTx. */
+/**
+ * Set a multisignature on a JTx.
+ */
 class Msig
 {
 public:
     std::vector<Reg> signers;
-    /** Alternative transaction object field in which to place the signer list.
+    /**
+     * Alternative transaction object field in which to place the signer list.
      *
      * subField is only supported if an account_ is provided as well.
      */
     SField const* const subField = nullptr;
-    /// Used solely as a convenience placeholder for ctors that do _not_ specify
-    /// a subfield.
+    /**
+     * Used solely as a convenience placeholder for ctors that do _not_ specify
+     * a subfield.
+     */
     static constexpr SField const* kTopLevel = nullptr;
 
     Msig(SField const* subField, std::vector<Reg> signers)
@@ -103,7 +112,9 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** The number of signer lists matches. */
+/**
+ * The number of signer lists matches.
+ */
 using siglists = OwnerCount<ltSIGNER_LIST>;
 
 }  // namespace xrpl::test::jtx
diff --git a/src/test/jtx/noop.h b/src/test/jtx/noop.h
index c38dfdde25..2ca97a1916 100644
--- a/src/test/jtx/noop.h
+++ b/src/test/jtx/noop.h
@@ -7,7 +7,9 @@
 
 namespace xrpl::test::jtx {
 
-/** The null transaction. */
+/**
+ * The null transaction.
+ */
 inline json::Value
 noop(Account const& account)
 {
diff --git a/src/test/jtx/offer.h b/src/test/jtx/offer.h
index f3e7277933..140e16da83 100644
--- a/src/test/jtx/offer.h
+++ b/src/test/jtx/offer.h
@@ -9,7 +9,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Create an offer. */
+/**
+ * Create an offer.
+ */
 json::Value
 offer(
     Account const& account,
@@ -17,7 +19,9 @@ offer(
     STAmount const& takerGets,
     std::uint32_t flags = 0);
 
-/** Cancel an offer. */
+/**
+ * Cancel an offer.
+ */
 json::Value
 offerCancel(Account const& account, std::uint32_t offerSeq);
 
diff --git a/src/test/jtx/owners.h b/src/test/jtx/owners.h
index 3f64601244..1e12603429 100644
--- a/src/test/jtx/owners.h
+++ b/src/test/jtx/owners.h
@@ -48,7 +48,9 @@ public:
     }
 };
 
-/** Match the number of items in the account's owner directory */
+/**
+ * Match the number of items in the account's owner directory
+ */
 class Owners
 {
 private:
@@ -64,8 +66,10 @@ public:
     operator()(Env& env) const;
 };
 
-/** Match the account's SponsoredOwnerCount field: the number of owned
-    objects whose reserve is sponsored by another account. */
+/**
+ * Match the account's SponsoredOwnerCount field: the number of owned
+ * objects whose reserve is sponsored by another account.
+ */
 class SponsoredOwners
 {
 private:
@@ -82,8 +86,10 @@ public:
     operator()(Env& env) const;
 };
 
-/** Match the account's SponsoringOwnerCount field: the number of objects
-    (owned by other accounts) whose reserve this account sponsors. */
+/**
+ * Match the account's SponsoringOwnerCount field: the number of objects
+ * (owned by other accounts) whose reserve this account sponsors.
+ */
 class SponsoringOwners
 {
 private:
@@ -100,8 +106,10 @@ public:
     operator()(Env& env) const;
 };
 
-/** Match the account's SponsoringAccountCount field: the number of accounts
-    whose base reserve this account sponsors. */
+/**
+ * Match the account's SponsoringAccountCount field: the number of accounts
+ * whose base reserve this account sponsors.
+ */
 class SponsoringAccountCount
 {
 private:
@@ -118,13 +126,19 @@ public:
     operator()(Env& env) const;
 };
 
-/** Match the number of trust lines in the account's owner directory */
+/**
+ * Match the number of trust lines in the account's owner directory
+ */
 using lines = OwnerCount<ltRIPPLE_STATE>;
 
-/** Match the number of offers in the account's owner directory */
+/**
+ * Match the number of offers in the account's owner directory
+ */
 using offers = OwnerCount<ltOFFER>;
 
-/** Match the number of MPToken in the account's owner directory */
+/**
+ * Match the number of MPToken in the account's owner directory
+ */
 using mptokens = OwnerCount<ltMPTOKEN>;
 
 }  // namespace test::jtx
diff --git a/src/test/jtx/paths.h b/src/test/jtx/paths.h
index b141300a66..07d0117f8f 100644
--- a/src/test/jtx/paths.h
+++ b/src/test/jtx/paths.h
@@ -16,7 +16,9 @@ class STPath;
 
 namespace test::jtx {
 
-/** Set Paths, SendMax on a JTx. */
+/**
+ * Set Paths, SendMax on a JTx.
+ */
 class Paths
 {
 private:
@@ -36,10 +38,11 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** Add a path.
-
-    If no paths are present, a new one is created.
-*/
+/**
+ * Add a path.
+ *
+ * If no paths are present, a new one is created.
+ */
 class Path
 {
 private:
diff --git a/src/test/jtx/pay.h b/src/test/jtx/pay.h
index fa193e7b02..04ccf27f70 100644
--- a/src/test/jtx/pay.h
+++ b/src/test/jtx/pay.h
@@ -8,7 +8,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Create a payment. */
+/**
+ * Create a payment.
+ */
 json::Value
 pay(AccountID const& account, AccountID const& to, AnyAmount amount);
 json::Value
diff --git a/src/test/jtx/prop.h b/src/test/jtx/prop.h
index e85751e4c9..24dca21ca0 100644
--- a/src/test/jtx/prop.h
+++ b/src/test/jtx/prop.h
@@ -8,7 +8,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Set a property on a JTx. */
+/**
+ * Set a property on a JTx.
+ */
 template <class T>
 struct Prop
 {
diff --git a/src/test/jtx/quality.h b/src/test/jtx/quality.h
index c7896fadf9..a15d319b40 100644
--- a/src/test/jtx/quality.h
+++ b/src/test/jtx/quality.h
@@ -7,7 +7,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Sets the literal QualityIn on a trust JTx. */
+/**
+ * Sets the literal QualityIn on a trust JTx.
+ */
 class QualityIn
 {
 private:
@@ -22,7 +24,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Sets the QualityIn on a trust JTx. */
+/**
+ * Sets the QualityIn on a trust JTx.
+ */
 class QualityInPercent
 {
 private:
@@ -35,7 +39,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Sets the literal QualityOut on a trust JTx. */
+/**
+ * Sets the literal QualityOut on a trust JTx.
+ */
 class QualityOut
 {
 private:
@@ -50,7 +56,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Sets the QualityOut on a trust JTx as a percentage. */
+/**
+ * Sets the QualityOut on a trust JTx as a percentage.
+ */
 class QualityOutPercent
 {
 private:
diff --git a/src/test/jtx/rate.h b/src/test/jtx/rate.h
index f76c2dd538..f8caf39fd8 100644
--- a/src/test/jtx/rate.h
+++ b/src/test/jtx/rate.h
@@ -6,7 +6,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Set a transfer rate. */
+/**
+ * Set a transfer rate.
+ */
 json::Value
 rate(Account const& account, double multiplier);
 
diff --git a/src/test/jtx/regkey.h b/src/test/jtx/regkey.h
index 676633b2b7..8aa5bd9709 100644
--- a/src/test/jtx/regkey.h
+++ b/src/test/jtx/regkey.h
@@ -7,11 +7,15 @@
 
 namespace xrpl::test::jtx {
 
-/** Disable the regular key. */
+/**
+ * Disable the regular key.
+ */
 json::Value
 regkey(Account const& account, DisabledT);
 
-/** Set a regular key. */
+/**
+ * Set a regular key.
+ */
 json::Value
 regkey(Account const& account, Account const& signer);
 
diff --git a/src/test/jtx/require.h b/src/test/jtx/require.h
index 19e161b938..eba20b613c 100644
--- a/src/test/jtx/require.h
+++ b/src/test/jtx/require.h
@@ -23,7 +23,9 @@ requireArgs(test::jtx::requires_t& vec, Cond const& cond, Args const&... args)
 
 namespace test::jtx {
 
-/** Compose many condition functors into one */
+/**
+ * Compose many condition functors into one
+ */
 template <class... Args>
 require_t
 required(Args const&... args)
@@ -36,12 +38,13 @@ required(Args const&... args)
     };
 }
 
-/** Check a set of conditions.
-
-    The conditions are checked after a JTx is
-    applied, and only if the resulting TER
-    matches the expected TER.
-*/
+/**
+ * Check a set of conditions.
+ *
+ * The conditions are checked after a JTx is
+ * applied, and only if the resulting TER
+ * matches the expected TER.
+ */
 class Require
 {
 private:
diff --git a/src/test/jtx/rpc.h b/src/test/jtx/rpc.h
index bc05450909..9bd99c15f8 100644
--- a/src/test/jtx/rpc.h
+++ b/src/test/jtx/rpc.h
@@ -12,9 +12,10 @@
 
 namespace xrpl::test::jtx {
 
-/** Set the expected result code for a JTx
-    The test will fail if the code doesn't match.
-*/
+/**
+ * Set the expected result code for a JTx
+ * The test will fail if the code doesn't match.
+ */
 class Rpc
 {
 private:
@@ -24,13 +25,17 @@ private:
     std::optional<std::string> errorException_;
 
 public:
-    /// If there's an error code, we expect an error message
+    /**
+     * If there's an error code, we expect an error message
+     */
     explicit Rpc(ErrorCodeI code, std::optional<std::string> m = {})
         : code_(code), errorMessage_(std::move(m))
     {
     }
 
-    ///  If there is not a code, we expect an exception message
+    /**
+     * If there is not a code, we expect an exception message
+     */
     explicit Rpc(std::string error, std::optional<std::string> exceptionMessage = {})
         : error_(error), errorException_(std::move(exceptionMessage))
     {
diff --git a/src/test/jtx/sendmax.h b/src/test/jtx/sendmax.h
index 1241d76b91..672959d1aa 100644
--- a/src/test/jtx/sendmax.h
+++ b/src/test/jtx/sendmax.h
@@ -9,7 +9,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Sets the SendMax on a JTx. */
+/**
+ * Sets the SendMax on a JTx.
+ */
 class Sendmax
 {
 private:
diff --git a/src/test/jtx/seq.h b/src/test/jtx/seq.h
index 956c0a77e8..323fb33bb2 100644
--- a/src/test/jtx/seq.h
+++ b/src/test/jtx/seq.h
@@ -9,7 +9,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Set the sequence number on a JTx. */
+/**
+ * Set the sequence number on a JTx.
+ */
 struct Seq
 {
 private:
diff --git a/src/test/jtx/sig.h b/src/test/jtx/sig.h
index 76f0a34dff..1f20dcf942 100644
--- a/src/test/jtx/sig.h
+++ b/src/test/jtx/sig.h
@@ -11,26 +11,31 @@
 
 namespace xrpl::test::jtx {
 
-/** Set the regular signature on a JTx.
-    @note For multisign, use msig.
-*/
+/**
+ * Set the regular signature on a JTx.
+ * @note For multisign, use msig.
+ */
 class Sig
 {
 private:
     bool manual_ = true;
-    /** Alternative transaction object field in which to place the signature.
+    /**
+     * Alternative transaction object field in which to place the signature.
      *
      * subField is only supported if an account_ is provided as well.
      */
     SField const* const subField_ = nullptr;
-    /** Account that will generate the signature.
+    /**
+     * Account that will generate the signature.
      *
      * If not provided, no signature will be added by this helper. See also
      * Env::autofillSig.
      */
     std::optional<Account> account_;
-    /// Used solely as a convenience placeholder for ctors that do _not_ specify
-    /// a subfield.
+    /**
+     * Used solely as a convenience placeholder for ctors that do _not_ specify
+     * a subfield.
+     */
     static constexpr SField const* kTopLevel = nullptr;
 
 public:
diff --git a/src/test/jtx/tag.h b/src/test/jtx/tag.h
index 77870367a9..b9a10e55f4 100644
--- a/src/test/jtx/tag.h
+++ b/src/test/jtx/tag.h
@@ -7,7 +7,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Set the destination tag on a JTx*/
+/**
+ * Set the destination tag on a JTx
+ */
 struct Dtag
 {
 private:
@@ -22,7 +24,9 @@ public:
     operator()(Env&, JTx& jt) const;
 };
 
-/** Set the source tag on a JTx*/
+/**
+ * Set the source tag on a JTx
+ */
 struct Stag
 {
 private:
diff --git a/src/test/jtx/tags.h b/src/test/jtx/tags.h
index 4f4afbd1fa..1915c57b5c 100644
--- a/src/test/jtx/tags.h
+++ b/src/test/jtx/tags.h
@@ -20,7 +20,9 @@ struct DisabledT
 };
 static DisabledT const kDisabled;
 
-/** Used for Fee() calls that use an owner reserve increment */
+/**
+ * Used for Fee() calls that use an owner reserve increment
+ */
 struct IncrementT
 {
     IncrementT() = default;
diff --git a/src/test/jtx/ter.h b/src/test/jtx/ter.h
index 880711dca0..0ac65e62ee 100644
--- a/src/test/jtx/ter.h
+++ b/src/test/jtx/ter.h
@@ -10,9 +10,10 @@
 
 namespace xrpl::test::jtx {
 
-/** Set the expected result code for a JTx
-    The test will fail if the code doesn't match.
-*/
+/**
+ * Set the expected result code for a JTx
+ * The test will fail if the code doesn't match.
+ */
 class Ter
 {
 private:
diff --git a/src/test/jtx/ticket.h b/src/test/jtx/ticket.h
index 1035be7674..9c9a698eaa 100644
--- a/src/test/jtx/ticket.h
+++ b/src/test/jtx/ticket.h
@@ -18,14 +18,20 @@ namespace xrpl::test::jtx {
     without changing the base declarations.
 */
 
-/** Ticket operations */
+/**
+ * Ticket operations
+ */
 namespace ticket {
 
-/** Create one of more tickets */
+/**
+ * Create one of more tickets
+ */
 json::Value
 create(Account const& account, std::uint32_t count);
 
-/** Set a ticket sequence on a JTx. */
+/**
+ * Set a ticket sequence on a JTx.
+ */
 class Use
 {
 private:
@@ -42,7 +48,9 @@ public:
 
 }  // namespace ticket
 
-/** Match the number of tickets on the account. */
+/**
+ * Match the number of tickets on the account.
+ */
 using tickets = OwnerCount<ltTICKET>;
 
 }  // namespace xrpl::test::jtx
diff --git a/src/test/jtx/token.h b/src/test/jtx/token.h
index 97f968fdfc..e94cfd2e12 100644
--- a/src/test/jtx/token.h
+++ b/src/test/jtx/token.h
@@ -16,11 +16,15 @@
 
 namespace xrpl::test::jtx::token {
 
-/** Mint an NFToken. */
+/**
+ * Mint an NFToken.
+ */
 json::Value
 mint(jtx::Account const& account, std::uint32_t tokenTaxon = 0);
 
-/** Sets the optional TransferFee on an NFTokenMint. */
+/**
+ * Sets the optional TransferFee on an NFTokenMint.
+ */
 class XferFee
 {
 private:
@@ -35,7 +39,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Sets the optional Issuer on an NFTokenMint. */
+/**
+ * Sets the optional Issuer on an NFTokenMint.
+ */
 class Issuer
 {
 private:
@@ -50,7 +56,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Sets the optional URI on an NFTokenMint. */
+/**
+ * Sets the optional URI on an NFTokenMint.
+ */
 class Uri
 {
 private:
@@ -65,7 +73,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Sets the optional amount field on an NFTokenMint. */
+/**
+ * Sets the optional amount field on an NFTokenMint.
+ */
 class Amount
 {
 private:
@@ -80,7 +90,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Get the next NFTokenID that will be issued. */
+/**
+ * Get the next NFTokenID that will be issued.
+ */
 uint256
 getNextID(
     jtx::Env const& env,
@@ -89,7 +101,9 @@ getNextID(
     std::uint16_t flags = 0,
     std::uint16_t xferFee = 0);
 
-/** Get the NFTokenID for a particular nftSequence. */
+/**
+ * Get the NFTokenID for a particular nftSequence.
+ */
 uint256
 getID(
     jtx::Env const& env,
@@ -99,15 +113,21 @@ getID(
     std::uint16_t flags = 0,
     std::uint16_t xferFee = 0);
 
-/** Burn an NFToken. */
+/**
+ * Burn an NFToken.
+ */
 json::Value
 burn(jtx::Account const& account, uint256 const& nftokenID);
 
-/** Create an NFTokenOffer. */
+/**
+ * Create an NFTokenOffer.
+ */
 json::Value
 createOffer(jtx::Account const& account, uint256 const& nftokenID, STAmount const& amount);
 
-/** Sets the optional Owner on an NFTokenOffer. */
+/**
+ * Sets the optional Owner on an NFTokenOffer.
+ */
 class Owner
 {
 private:
@@ -122,7 +142,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Sets the optional Expiration field on an NFTokenOffer. */
+/**
+ * Sets the optional Expiration field on an NFTokenOffer.
+ */
 class Expiration
 {
 private:
@@ -137,7 +159,9 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Sets the optional Destination field on an NFTokenOffer. */
+/**
+ * Sets the optional Destination field on an NFTokenOffer.
+ */
 class Destination
 {
 private:
@@ -152,14 +176,18 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Cancel NFTokenOffers. */
+/**
+ * Cancel NFTokenOffers.
+ */
 json::Value
 cancelOffer(jtx::Account const& account, std::initializer_list<uint256> const& nftokenOffers = {});
 
 json::Value
 cancelOffer(jtx::Account const& account, std::vector<uint256> const& nftokenOffers);
 
-/** Sets the optional RootIndex field when canceling NFTokenOffers. */
+/**
+ * Sets the optional RootIndex field when canceling NFTokenOffers.
+ */
 class RootIndex
 {
 private:
@@ -174,22 +202,30 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Accept an NFToken buy offer. */
+/**
+ * Accept an NFToken buy offer.
+ */
 json::Value
 acceptBuyOffer(jtx::Account const& account, uint256 const& offerIndex);
 
-/** Accept an NFToken sell offer. */
+/**
+ * Accept an NFToken sell offer.
+ */
 json::Value
 acceptSellOffer(jtx::Account const& account, uint256 const& offerIndex);
 
-/** Broker two NFToken offers. */
+/**
+ * Broker two NFToken offers.
+ */
 json::Value
 brokerOffers(
     jtx::Account const& account,
     uint256 const& buyOfferIndex,
     uint256 const& sellOfferIndex);
 
-/** Sets the optional NFTokenBrokerFee field in a brokerOffer transaction. */
+/**
+ * Sets the optional NFTokenBrokerFee field in a brokerOffer transaction.
+ */
 class BrokerFee
 {
 private:
@@ -204,15 +240,21 @@ public:
     operator()(Env&, JTx& jtx) const;
 };
 
-/** Set the authorized minter on an account root. */
+/**
+ * Set the authorized minter on an account root.
+ */
 json::Value
 setMinter(jtx::Account const& account, jtx::Account const& minter);
 
-/** Clear any authorized minter from an account root. */
+/**
+ * Clear any authorized minter from an account root.
+ */
 json::Value
 clearMinter(jtx::Account const& account);
 
-/** Modify an NFToken. */
+/**
+ * Modify an NFToken.
+ */
 json::Value
 modify(jtx::Account const& account, uint256 const& nftokenID);
 
diff --git a/src/test/jtx/trust.h b/src/test/jtx/trust.h
index 034f80fcec..235780c825 100644
--- a/src/test/jtx/trust.h
+++ b/src/test/jtx/trust.h
@@ -10,11 +10,15 @@
 
 namespace xrpl::test::jtx {
 
-/** Modify a trust line. */
+/**
+ * Modify a trust line.
+ */
 json::Value
 trust(Account const& account, STAmount const& amount, std::uint32_t flags = 0);
 
-/** Change flags on a trust line. */
+/**
+ * Change flags on a trust line.
+ */
 json::Value
 trust(Account const& account, STAmount const& amount, Account const& peer, std::uint32_t flags);
 
diff --git a/src/test/jtx/txflags.h b/src/test/jtx/txflags.h
index 7f5b31b2ac..c940681d82 100644
--- a/src/test/jtx/txflags.h
+++ b/src/test/jtx/txflags.h
@@ -7,7 +7,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Set the flags on a JTx. */
+/**
+ * Set the flags on a JTx.
+ */
 class Txflags
 {
 private:
diff --git a/src/test/jtx/utility.h b/src/test/jtx/utility.h
index f1cf3f7ae8..289afec8b3 100644
--- a/src/test/jtx/utility.h
+++ b/src/test/jtx/utility.h
@@ -13,7 +13,9 @@
 
 namespace xrpl::test::jtx {
 
-/** Thrown when parse fails. */
+/**
+ * Thrown when parse fails.
+ */
 struct ParseError : std::logic_error
 {
     template <class String>
@@ -22,35 +24,44 @@ struct ParseError : std::logic_error
     }
 };
 
-/** Convert JSON to STObject.
-    This throws on failure, the JSON must be correct.
-    @note Testing malformed JSON is beyond the scope of
-          this set of unit test routines.
-*/
+/**
+ * Convert JSON to STObject.
+ * This throws on failure, the JSON must be correct.
+ * @note Testing malformed JSON is beyond the scope of
+ *       this set of unit test routines.
+ */
 STObject
 parse(json::Value const& jv);
 
-/** Sign automatically into a specific Json field of the jv object.
-    @note This only works on accounts with multi-signing off.
-*/
+/**
+ * Sign automatically into a specific Json field of the jv object.
+ * @note This only works on accounts with multi-signing off.
+ */
 void
 sign(json::Value& jv, Account const& account, json::Value& sigObject);
 
-/** Sign automatically.
-    @note This only works on accounts with multi-signing off.
-*/
+/**
+ * Sign automatically.
+ * @note This only works on accounts with multi-signing off.
+ */
 void
 sign(json::Value& jv, Account const& account);
 
-/** Set the fee automatically. */
+/**
+ * Set the fee automatically.
+ */
 void
 fillFee(json::Value& jv, ReadView const& view);
 
-/** Set the sequence number automatically. */
+/**
+ * Set the sequence number automatically.
+ */
 void
 fillSeq(json::Value& jv, ReadView const& view);
 
-/** Given an xrpld unit test rpc command, return the corresponding JSON. */
+/**
+ * Given an xrpld unit test rpc command, return the corresponding JSON.
+ */
 json::Value
 cmdToJSONRPC(std::vector<std::string> const& args, beast::Journal j, unsigned int apiVersion);
 }  // namespace xrpl::test::jtx
diff --git a/src/test/jtx/vault.h b/src/test/jtx/vault.h
index 4e6b90fe1f..e72eae89b7 100644
--- a/src/test/jtx/vault.h
+++ b/src/test/jtx/vault.h
@@ -27,7 +27,9 @@ struct Vault
             std::nullopt;  // NOLINT(readability-redundant-member-init)
     };
 
-    /** Return a VaultCreate transaction and the Vault's expected keylet. */
+    /**
+     * Return a VaultCreate transaction and the Vault's expected keylet.
+     */
     [[nodiscard]] std::tuple<json::Value, Keylet>
     create(CreateArgs const& args) const;
 
diff --git a/src/test/nodestore/TestBase.h b/src/test/nodestore/TestBase.h
index a1245ec963..235e76501f 100644
--- a/src/test/nodestore/TestBase.h
+++ b/src/test/nodestore/TestBase.h
@@ -20,13 +20,14 @@
 
 namespace xrpl::NodeStore {
 
-/** Binary function that satisfies the strict-weak-ordering requirement.
-
-    This compares the hashes of both objects and returns true if
-    the first hash is considered to go before the second.
-
-    @see std::sort
-*/
+/**
+ * Binary function that satisfies the strict-weak-ordering requirement.
+ *
+ * This compares the hashes of both objects and returns true if
+ * the first hash is considered to go before the second.
+ *
+ * @see std::sort
+ */
 struct LessThan
 {
     bool
@@ -37,7 +38,9 @@ struct LessThan
     }
 };
 
-/** Returns `true` if objects are identical. */
+/**
+ * Returns `true` if objects are identical.
+ */
 inline bool
 isSame(std::shared_ptr<NodeObject> const& lhs, std::shared_ptr<NodeObject> const& rhs)
 {
diff --git a/src/test/overlay/reduce_relay_test.cpp b/src/test/overlay/reduce_relay_test.cpp
index 433595522d..c55729a45a 100644
--- a/src/test/overlay/reduce_relay_test.cpp
+++ b/src/test/overlay/reduce_relay_test.cpp
@@ -64,7 +64,8 @@ static constexpr std::uint32_t kMaxPeers = 10;
 static constexpr std::uint32_t kMaxValidators = 10;
 static constexpr std::uint32_t kMaxMessages = 200000;
 
-/** Simulate two entities - peer directly connected to the server
+/**
+ * Simulate two entities - peer directly connected to the server
  * (via squelch in PeerSim) and PeerImp (via Overlay)
  */
 class PeerPartial : public Peer
@@ -192,7 +193,9 @@ public:
     }
 };
 
-/** Manually advanced clock. */
+/**
+ * Manually advanced clock.
+ */
 class ManualClock
 {
 public:
@@ -238,7 +241,9 @@ private:
     inline static time_point kNow = time_point(seconds(0));
 };
 
-/** Simulate server's OverlayImpl */
+/**
+ * Simulate server's OverlayImpl
+ */
 class Overlay
 {
 public:
@@ -260,7 +265,8 @@ public:
 
 class Validator;
 
-/** Simulate link from a validator to a peer directly connected
+/**
+ * Simulate link from a validator to a peer directly connected
  * to the server.
  */
 class Link
@@ -317,7 +323,9 @@ private:
     bool up_{true};
 };
 
-/** Simulate Validator */
+/**
+ * Simulate Validator
+ */
 class Validator
 {
     using Links = std::unordered_map<Peer::id_t, LinkSPtr>;
@@ -400,14 +408,18 @@ public:
         }
     }
 
-    /** Send to specific peers */
+    /**
+     * Send to specific peers
+     */
     void
     send(std::vector<Peer::id_t> peers, SquelchCB f)
     {
         forLinks(peers, [&](Link& link, MessageSPtr m) { link.send(m, f); });
     }
 
-    /** Send to all peers */
+    /**
+     * Send to all peers
+     */
     void
     send(SquelchCB f)
     {
@@ -478,7 +490,9 @@ public:
         sid = 0;
     }
 
-    /** Local Peer (PeerImp) */
+    /**
+     * Local Peer (PeerImp)
+     */
     void
     onMessage(MessageSPtr const& m, SquelchCB f) override
     {
@@ -491,7 +505,9 @@ public:
             {}, *validator, id(), f);  // NOLINT(bugprone-unchecked-optional-access)
     }
 
-    /** Remote Peer (Directly connected Peer) */
+    /**
+     * Remote Peer (Directly connected Peer)
+     */
     void
     onMessage(protocol::TMSquelch const& squelch) override
     {
@@ -836,7 +852,9 @@ public:
         }
     }
 
-    /** Is peer in Selected state in any of the slots */
+    /**
+     * Is peer in Selected state in any of the slots
+     */
     bool
     isSelected(Peer::id_t id)
     {
@@ -848,7 +866,8 @@ public:
         return false;
     }
 
-    /** Check if there are peers to unsquelch - peer is in Selected
+    /**
+     * Check if there are peers to unsquelch - peer is in Selected
      * state in any of the slots and there are peers in Squelched state
      * in those slots.
      */
@@ -892,7 +911,9 @@ protected:
         std::cout << std::endl;
     }
 
-    /** Send squelch (if duration is set) or unsquelch (if duration not set) */
+    /**
+     * Send squelch (if duration is set) or unsquelch (if duration not set)
+     */
     static Peer::id_t
     sendSquelch(
         PublicKey const& validator,
@@ -930,7 +951,8 @@ protected:
         bool handled = false;
     };
 
-    /** Randomly brings the link between a validator and a peer down.
+    /**
+     * Randomly brings the link between a validator and a peer down.
      * Randomly disconnects a peer. Those events are generated one at a time.
      */
     void
@@ -1108,7 +1130,8 @@ protected:
         f(log);
     }
 
-    /** Initial counting round: three peers receive message "faster" then
+    /**
+     * Initial counting round: three peers receive message "faster" then
      * others. Once the message count for the three peers reaches threshold
      * the rest of the peers are squelched and the slot for the given validator
      * is in Selected state.
@@ -1119,7 +1142,8 @@ protected:
         doTest("Initial Round", log, [this](bool log) { BEAST_EXPECT(propagateAndSquelch(log)); });
     }
 
-    /** Receiving message from squelched peer too soon should not change the
+    /**
+     * Receiving message from squelched peer too soon should not change the
      * slot's state to Counting.
      */
     void
@@ -1130,7 +1154,8 @@ protected:
         });
     }
 
-    /** Receiving message from squelched peer should change the
+    /**
+     * Receiving message from squelched peer should change the
      * slot's state to Counting.
      */
     void
@@ -1142,7 +1167,9 @@ protected:
         });
     }
 
-    /** Propagate enough messages to generate one squelch event */
+    /**
+     * Propagate enough messages to generate one squelch event
+     */
     bool
     propagateAndSquelch(bool log, bool purge = true, bool resetClock = true)
     {
@@ -1176,7 +1203,9 @@ protected:
         return n == 1 && res;
     }
 
-    /** Send fewer message so that squelch event is not generated */
+    /**
+     * Send fewer message so that squelch event is not generated
+     */
     bool
     propagateNoSquelch(
         bool log,
@@ -1203,7 +1232,8 @@ protected:
         return !squelched && res;
     }
 
-    /** Receiving a message from new peer should change the
+    /**
+     * Receiving a message from new peer should change the
      * slot's state to Counting.
      */
     void
@@ -1216,8 +1246,10 @@ protected:
         });
     }
 
-    /** Selected peer disconnects. Should change the state to counting and
-     * unsquelch squelched peers. */
+    /**
+     * Selected peer disconnects. Should change the state to counting and
+     * unsquelch squelched peers.
+     */
     void
     testSelectedPeerDisconnects(bool log)
     {
@@ -1235,8 +1267,10 @@ protected:
         });
     }
 
-    /** Selected peer stops relaying. Should change the state to counting and
-     * unsquelch squelched peers. */
+    /**
+     * Selected peer stops relaying. Should change the state to counting and
+     * unsquelch squelched peers.
+     */
     void
     testSelectedPeerStopsRelaying(bool log)
     {
@@ -1255,7 +1289,8 @@ protected:
         });
     }
 
-    /** Squelched peer disconnects. Should not change the state to counting.
+    /**
+     * Squelched peer disconnects. Should not change the state to counting.
      */
     void
     testSquelchedPeerDisconnects(bool log)
diff --git a/src/test/rpc/LedgerEntry_test.cpp b/src/test/rpc/LedgerEntry_test.cpp
index d321ab39aa..7adb5a4518 100644
--- a/src/test/rpc/LedgerEntry_test.cpp
+++ b/src/test/rpc/LedgerEntry_test.cpp
@@ -2288,7 +2288,9 @@ class LedgerEntry_test : public beast::unit_test::Suite
         }
     }
 
-    /// Test the ledger entry types that don't take parameters
+    /**
+     * Test the ledger entry types that don't take parameters
+     */
     void
     testFixed()
     {
@@ -2304,7 +2306,8 @@ class LedgerEntry_test : public beast::unit_test::Suite
 
         env.close();
 
-        /** Verifies that the RPC result has the expected data
+        /**
+         * Verifies that the RPC result has the expected data
          *
          * @param good: Indicates that the request should have succeeded
          *   and returned a ledger object of `expectedType` type.
@@ -2339,7 +2342,8 @@ class LedgerEntry_test : public beast::unit_test::Suite
             }
         };
 
-        /** Runs a series of tests for a given fixed-position ledger
+        /**
+         * Runs a series of tests for a given fixed-position ledger
          * entry.
          *
          * @param field: The Json request field to use.
@@ -2497,7 +2501,8 @@ class LedgerEntry_test : public beast::unit_test::Suite
 
         env.close();
 
-        /** Verifies that the RPC result has the expected data
+        /**
+         * Verifies that the RPC result has the expected data
          *
          * @param good: Indicates that the request should have succeeded
          *   and returned a ledger object of `expectedType` type.
@@ -2537,7 +2542,8 @@ class LedgerEntry_test : public beast::unit_test::Suite
             }
         };
 
-        /** Runs a series of tests for a given ledger index.
+        /**
+         * Runs a series of tests for a given ledger index.
          *
          * @param ledger: The ledger index value of the "hashes" request
          *   parameter. May not necessarily be a number.
diff --git a/src/test/rpc/LedgerRPC_test.cpp b/src/test/rpc/LedgerRPC_test.cpp
index af56a9e9ba..3a2c957691 100644
--- a/src/test/rpc/LedgerRPC_test.cpp
+++ b/src/test/rpc/LedgerRPC_test.cpp
@@ -258,10 +258,12 @@ class LedgerRPC_test : public beast::unit_test::Suite
         BEAST_EXPECT(jrr[jss::ledger][jss::accountState].size() == 3u);
     }
 
-    /// @brief ledger RPC requests as a way to drive
-    /// input options to lookupLedger. The point of this test is
-    /// coverage for lookupLedger, not so much the ledger
-    /// RPC request.
+    /**
+     * @brief ledger RPC requests as a way to drive
+     * input options to lookupLedger. The point of this test is
+     * coverage for lookupLedger, not so much the ledger
+     * RPC request.
+     */
     void
     testLookupLedger()
     {
diff --git a/src/test/unit_test/FileDirGuard.h b/src/test/unit_test/FileDirGuard.h
index 3fc5d015b0..b583f821a4 100644
--- a/src/test/unit_test/FileDirGuard.h
+++ b/src/test/unit_test/FileDirGuard.h
@@ -15,8 +15,8 @@
 namespace xrpl::detail {
 
 /**
-    Create a directory and remove it when it's done
-*/
+ * Create a directory and remove it when it's done
+ */
 class DirGuard
 {
 protected:
@@ -93,8 +93,8 @@ public:
 };
 
 /**
-    Write a file in a directory and remove when done
-*/
+ * Write a file in a directory and remove when done
+ */
 class FileDirGuard : public DirGuard
 {
 protected:
diff --git a/src/test/unit_test/multi_runner.h b/src/test/unit_test/multi_runner.h
index 3390014cb8..c17fdf3bf0 100644
--- a/src/test/unit_test/multi_runner.h
+++ b/src/test/unit_test/multi_runner.h
@@ -199,7 +199,8 @@ namespace test {
 
 //------------------------------------------------------------------------------
 
-/** Manager for children running unit tests
+/**
+ * Manager for children running unit tests
  */
 class MultiRunnerParent : private detail::MultiRunnerBase</*IsParent*/ true>
 {
@@ -234,7 +235,8 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** A class to run a subset of unit tests
+/**
+ * A class to run a subset of unit tests
  */
 class MultiRunnerChild : public beast::unit_test::Runner,
                          private detail::MultiRunnerBase</*IsParent*/ false>
diff --git a/src/test/unit_test/utils.h b/src/test/unit_test/utils.h
index 677bbff31b..d4b1e5f7f4 100644
--- a/src/test/unit_test/utils.h
+++ b/src/test/unit_test/utils.h
@@ -6,9 +6,11 @@
 
 namespace xrpl::test {
 
-/// Compare two SecretKey objects for equality.
-/// SecretKey::operator== is deleted, so a named function is used
-/// to avoid member-function lookup shadowing free-function overloads.
+/**
+ * Compare two SecretKey objects for equality.
+ * SecretKey::operator== is deleted, so a named function is used
+ * to avoid member-function lookup shadowing free-function overloads.
+ */
 inline bool
 equal(SecretKey const& lhs, SecretKey const& rhs)
 {
diff --git a/src/tests/libxrpl/helpers/Account.h b/src/tests/libxrpl/helpers/Account.h
index a92497f2c3..ca2bf68afb 100644
--- a/src/tests/libxrpl/helpers/Account.h
+++ b/src/tests/libxrpl/helpers/Account.h
@@ -38,35 +38,45 @@ public:
      */
     explicit Account(std::string_view name, KeyType type = KeyType::Secp256k1);
 
-    /** @brief Return the human-readable name. */
+    /**
+     * @brief Return the human-readable name.
+     */
     [[nodiscard]] std::string const&
     name() const noexcept
     {
         return name_;
     }
 
-    /** @brief Return the AccountID. */
+    /**
+     * @brief Return the AccountID.
+     */
     [[nodiscard]] AccountID const&
     id() const noexcept
     {
         return id_;
     }
 
-    /** @brief Return the public key. */
+    /**
+     * @brief Return the public key.
+     */
     [[nodiscard]] PublicKey const&
     pk() const noexcept
     {
         return keyPair_.first;
     }
 
-    /** @brief Return the secret key. */
+    /**
+     * @brief Return the secret key.
+     */
     [[nodiscard]] SecretKey const&
     sk() const noexcept
     {
         return keyPair_.second;
     }
 
-    /** @brief Implicit conversion to AccountID. */
+    /**
+     * @brief Implicit conversion to AccountID.
+     */
     operator AccountID const&() const noexcept
     {
         return id_;
diff --git a/src/tests/libxrpl/helpers/TestFamily.h b/src/tests/libxrpl/helpers/TestFamily.h
index a5ff34a111..1a11d3bb68 100644
--- a/src/tests/libxrpl/helpers/TestFamily.h
+++ b/src/tests/libxrpl/helpers/TestFamily.h
@@ -20,11 +20,12 @@
 
 namespace xrpl::test {
 
-/** Test implementation of Family for unit tests.
-
-    Uses an in-memory NodeStore database and simple caches.
-    The missingNode methods throw since tests shouldn't encounter missing nodes.
-*/
+/**
+ * Test implementation of Family for unit tests.
+ *
+ * Uses an in-memory NodeStore database and simple caches.
+ * The missingNode methods throw since tests shouldn't encounter missing nodes.
+ */
 class TestFamily : public Family
 {
 private:
@@ -109,7 +110,9 @@ public:
         (*tnCache_).reset();
     }
 
-    /** Access the test clock for time manipulation in tests. */
+    /**
+     * Access the test clock for time manipulation in tests.
+     */
     TestStopwatch&
     clock()
     {
diff --git a/src/tests/libxrpl/helpers/TestServiceRegistry.h b/src/tests/libxrpl/helpers/TestServiceRegistry.h
index 0108f886d3..5475b54dc6 100644
--- a/src/tests/libxrpl/helpers/TestServiceRegistry.h
+++ b/src/tests/libxrpl/helpers/TestServiceRegistry.h
@@ -23,7 +23,9 @@
 
 namespace xrpl::test {
 
-/** Logs implementation that creates TestSink instances. */
+/**
+ * Logs implementation that creates TestSink instances.
+ */
 class TestLogs : public Logs
 {
 public:
@@ -38,7 +40,9 @@ public:
     }
 };
 
-/** Simple NetworkIDService implementation for tests. */
+/**
+ * Simple NetworkIDService implementation for tests.
+ */
 class TestNetworkIDService final : public NetworkIDService
 {
 public:
@@ -56,14 +60,15 @@ private:
     std::uint32_t networkID_;
 };
 
-/** Test implementation of ServiceRegistry for unit tests.
-
-    This class provides real implementations for services that can be
-    instantiated from libxrpl (such as Logs, io_context, caches), and
-    throws std::logic_error for services that require the full Application.
-
-    Tests can subclass this to provide additional services they need.
-*/
+/**
+ * Test implementation of ServiceRegistry for unit tests.
+ *
+ * This class provides real implementations for services that can be
+ * instantiated from libxrpl (such as Logs, io_context, caches), and
+ * throws std::logic_error for services that require the full Application.
+ *
+ * Tests can subclass this to provide additional services they need.
+ */
 class TestServiceRegistry : public ServiceRegistry
 {
     TestLogs logs_{beast::Severity::Warning};
diff --git a/src/tests/libxrpl/helpers/TxTest.h b/src/tests/libxrpl/helpers/TxTest.h
index cb75cd5ee0..98198e45f8 100644
--- a/src/tests/libxrpl/helpers/TxTest.h
+++ b/src/tests/libxrpl/helpers/TxTest.h
@@ -157,10 +157,10 @@ allFeatures();
  */
 struct TxResult
 {
-    TER ter;                        /**< The transaction engine result code. */
-    bool applied;                   /**< Whether the transaction was applied to the ledger. */
-    std::optional<TxMeta> metadata; /**< Transaction metadata, if available. */
-    std::shared_ptr<STTx const> tx; /**< Pointer to the submitted transaction. */
+    TER ter;                         ///< The transaction engine result code.
+    bool applied;                    ///< Whether the transaction was applied to the ledger.
+    std::optional<TxMeta> metadata;  ///< Transaction metadata, if available.
+    std::shared_ptr<STTx const> tx;  ///< Pointer to the submitted transaction.
 };
 
 /**
@@ -360,10 +360,14 @@ private:
     std::shared_ptr<Ledger const> closedLedger_;
     std::shared_ptr<OpenView> openLedger_;
 
-    /** Transactions submitted to the open ledger, for canonical reordering on close. */
+    /**
+     * Transactions submitted to the open ledger, for canonical reordering on close.
+     */
     std::vector<std::shared_ptr<STTx const>> pendingTxs_;
 
-    /** Current time (can be advanced arbitrarily for testing). */
+    /**
+     * Current time (can be advanced arbitrarily for testing).
+     */
     NetClock::time_point now_;
 };
 
diff --git a/src/xrpld/app/consensus/RCLCensorshipDetector.h b/src/xrpld/app/consensus/RCLCensorshipDetector.h
index 4318a7b4ff..6d0e20031e 100644
--- a/src/xrpld/app/consensus/RCLCensorshipDetector.h
+++ b/src/xrpld/app/consensus/RCLCensorshipDetector.h
@@ -51,11 +51,12 @@ private:
 public:
     RCLCensorshipDetector() = default;
 
-    /** Add transactions being proposed for the current consensus round.
-
-        @param proposed The set of transactions that we are initially proposing
-                        for this round.
-    */
+    /**
+     * Add transactions being proposed for the current consensus round.
+     *
+     * @param proposed The set of transactions that we are initially proposing
+     *                 for this round.
+     */
     void
     propose(TxIDSeqVec proposed)
     {
@@ -74,19 +75,20 @@ public:
         tracker_ = std::move(proposed);
     }
 
-    /** Determine which transactions made it and perform censorship detection.
-
-        This function is called when the server is proposing and a consensus
-        round it participated in completed.
-
-        @param accepted The set of transactions that the network agreed
-                        should be included in the ledger being built.
-        @param pred     A predicate invoked for every transaction we've proposed
-                        but which hasn't yet made it. The predicate must be
-                        callable as:
-                            bool pred(TxID const&, Sequence)
-                        It must return true for entries that should be removed.
-    */
+    /**
+     * Determine which transactions made it and perform censorship detection.
+     *
+     * This function is called when the server is proposing and a consensus
+     * round it participated in completed.
+     *
+     * @param accepted The set of transactions that the network agreed
+     *                 should be included in the ledger being built.
+     * @param pred     A predicate invoked for every transaction we've proposed
+     *                 but which hasn't yet made it. The predicate must be
+     *                 callable as:
+     *                     bool pred(TxID const&, Sequence)
+     *                 It must return true for entries that should be removed.
+     */
     template <class Predicate>
     void
     check(std::vector<TxID> accepted, Predicate&& pred)
@@ -108,11 +110,12 @@ public:
         tracker_.erase(i, tracker_.end());
     }
 
-    /** Removes all elements from the tracker
-
-        Typically, this function might be called after we reconnect to the
-        network following an outage, or after we start tracking the network.
-    */
+    /**
+     * Removes all elements from the tracker
+     *
+     * Typically, this function might be called after we reconnect to the
+     * network following an outage, or after we start tracking the network.
+     */
     void
     reset()
     {
diff --git a/src/xrpld/app/consensus/RCLConsensus.cpp b/src/xrpld/app/consensus/RCLConsensus.cpp
index 2abc881adc..4abf77f578 100644
--- a/src/xrpld/app/consensus/RCLConsensus.cpp
+++ b/src/xrpld/app/consensus/RCLConsensus.cpp
@@ -955,7 +955,9 @@ RCLConsensus::gotTxSet(NetClock::time_point const& now, RCLTxSet const& txSet)
     }
 }
 
-//! @see Consensus::simulate
+/**
+ * @see Consensus::simulate
+ */
 
 void
 RCLConsensus::simulate(
diff --git a/src/xrpld/app/consensus/RCLConsensus.h b/src/xrpld/app/consensus/RCLConsensus.h
index 359f6b8009..4ffe18a7a8 100644
--- a/src/xrpld/app/consensus/RCLConsensus.h
+++ b/src/xrpld/app/consensus/RCLConsensus.h
@@ -43,11 +43,13 @@ class LocalTxs;
 class LedgerMaster;
 class ValidatorKeys;
 
-/** Manages the generic consensus algorithm for use by the RCL.
+/**
+ * Manages the generic consensus algorithm for use by the RCL.
  */
 class RCLConsensus
 {
-    /** Warn for transactions that haven't been included every so many ledgers.
+    /**
+     * Warn for transactions that haven't been included every so many ledgers.
      */
     static constexpr unsigned int kCensorshipWarnInternal = 15;
 
@@ -126,12 +128,13 @@ class RCLConsensus
             return mode_;
         }
 
-        /** Called before kicking off a new consensus round.
-
-            @param prevLedger Ledger that will be prior ledger for next round
-            @param nowTrusted the new validators
-            @return Whether we enter the round proposing
-        */
+        /**
+         * Called before kicking off a new consensus round.
+         *
+         * @param prevLedger Ledger that will be prior ledger for next round
+         * @param nowTrusted the new validators
+         * @return Whether we enter the round proposing
+         */
         bool
         preStartRound(RCLCxLedger const& prevLedger, hash_set<NodeID> const& nowTrusted);
 
@@ -147,14 +150,16 @@ class RCLConsensus
         std::size_t
         laggards(Ledger_t::Seq const seq, hash_set<NodeKey_t>& trustedKeys) const;
 
-        /** Whether I am a validator.
+        /**
+         * Whether I am a validator.
          *
          * @return whether I am a validator.
          */
         bool
         validator() const;
 
-        /** Update operating mode based on current peer positions.
+        /**
+         * Update operating mode based on current peer positions.
          *
          * If our current ledger has no agreement from the network,
          * then we cannot be in the omFULL mode.
@@ -164,7 +169,8 @@ class RCLConsensus
         void
         updateOperatingMode(std::size_t const positions) const;
 
-        /** Consensus simulation parameters
+        /**
+         * Consensus simulation parameters
          */
         ConsensusParms const&
         parms() const
@@ -186,129 +192,142 @@ class RCLConsensus
         // changing state until a future call to startRound.
         friend class Consensus<Adaptor>;
 
-        /** Attempt to acquire a specific ledger.
-
-            If not available, asynchronously acquires from the network.
-
-            @param hash The ID/hash of the ledger acquire
-            @return Optional ledger, will be seated if we locally had the ledger
-        */
+        /**
+         * Attempt to acquire a specific ledger.
+         *
+         * If not available, asynchronously acquires from the network.
+         *
+         * @param hash The ID/hash of the ledger acquire
+         * @return Optional ledger, will be seated if we locally had the ledger
+         */
         std::optional<RCLCxLedger>
         acquireLedger(LedgerHash const& hash);
 
-        /** Share the given proposal with all peers
-
-            @param peerPos The peer position to share.
+        /**
+         * Share the given proposal with all peers
+         *
+         * @param peerPos The peer position to share.
          */
         void
         share(RCLCxPeerPos const& peerPos);
 
-        /** Share disputed transaction to peers.
-
-            Only share if the provided transaction hasn't been shared recently.
-
-            @param tx The disputed transaction to share.
-        */
+        /**
+         * Share disputed transaction to peers.
+         *
+         * Only share if the provided transaction hasn't been shared recently.
+         *
+         * @param tx The disputed transaction to share.
+         */
         void
         share(RCLCxTx const& tx);
 
-        /** Acquire the transaction set associated with a proposal.
-
-            If the transaction set is not available locally, will attempt
-            acquire it from the network.
-
-            @param setId The transaction set ID associated with the proposal
-            @return Optional set of transactions, seated if available.
-       */
+        /**
+         * Acquire the transaction set associated with a proposal.
+         *
+         * If the transaction set is not available locally, will attempt
+         * acquire it from the network.
+         *
+         * @param setId The transaction set ID associated with the proposal
+         * @return Optional set of transactions, seated if available.
+         */
         std::optional<RCLTxSet>
         acquireTxSet(RCLTxSet::ID const& setId);
 
-        /** Whether the open ledger has any transactions
+        /**
+         * Whether the open ledger has any transactions
          */
         bool
         hasOpenTransactions() const;
 
-        /** Number of proposers that have validated the given ledger
-
-            @param h The hash of the ledger of interest
-            @return the number of proposers that validated a ledger
-        */
+        /**
+         * Number of proposers that have validated the given ledger
+         *
+         * @param h The hash of the ledger of interest
+         * @return the number of proposers that validated a ledger
+         */
         std::size_t
         proposersValidated(LedgerHash const& h) const;
 
-        /** Number of proposers that have validated a ledger descended from
-           requested ledger.
-
-            @param ledger The current working ledger
-            @param h The hash of the preferred working ledger
-            @return The number of validating peers that have validated a ledger
-                    descended from the preferred working ledger.
-        */
+        /**
+         * Number of proposers that have validated a ledger descended from
+         * requested ledger.
+         *
+         * @param ledger The current working ledger
+         * @param h The hash of the preferred working ledger
+         * @return The number of validating peers that have validated a ledger
+         *         descended from the preferred working ledger.
+         */
         std::size_t
         proposersFinished(RCLCxLedger const& ledger, LedgerHash const& h) const;
 
-        /** Propose the given position to my peers.
-
-            @param proposal Our proposed position
-        */
+        /**
+         * Propose the given position to my peers.
+         *
+         * @param proposal Our proposed position
+         */
         void
         propose(RCLCxPeerPos::Proposal const& proposal);
 
-        /** Share the given tx set to peers.
-
-            @param txns The TxSet to share.
-        */
+        /**
+         * Share the given tx set to peers.
+         *
+         * @param txns The TxSet to share.
+         */
         void
         share(RCLTxSet const& txns);
 
-        /** Get the ID of the previous ledger/last closed ledger(LCL) on the
-           network
-
-            @param ledgerID ID of previous ledger used by consensus
-            @param ledger Previous ledger consensus has available
-            @param mode Current consensus mode
-            @return The id of the last closed network
-
-            @note ledgerID may not match ledger.id() if we haven't acquired
-                  the ledger matching ledgerID from the network
+        /**
+         * Get the ID of the previous ledger/last closed ledger(LCL) on the
+         * network
+         *
+         * @param ledgerID ID of previous ledger used by consensus
+         * @param ledger Previous ledger consensus has available
+         * @param mode Current consensus mode
+         * @return The id of the last closed network
+         *
+         * @note ledgerID may not match ledger.id() if we haven't acquired
+         *       the ledger matching ledgerID from the network
          */
         uint256
         getPrevLedger(uint256 ledgerID, RCLCxLedger const& ledger, ConsensusMode mode);
 
-        /** Notified of change in consensus mode
-
-            @param before The prior consensus mode
-            @param after The new consensus mode
-        */
+        /**
+         * Notified of change in consensus mode
+         *
+         * @param before The prior consensus mode
+         * @param after The new consensus mode
+         */
         void
         onModeChange(ConsensusMode before, ConsensusMode after);
 
-        /** Close the open ledger and return initial consensus position.
-
-           @param ledger the ledger we are changing to
-           @param closeTime When consensus closed the ledger
-           @param mode Current consensus mode
-           @return Tentative consensus result
-        */
+        /**
+         * Close the open ledger and return initial consensus position.
+         *
+         * @param ledger the ledger we are changing to
+         * @param closeTime When consensus closed the ledger
+         * @param mode Current consensus mode
+         * @return Tentative consensus result
+         */
         Result
         onClose(
             RCLCxLedger const& ledger,
             NetClock::time_point const& closeTime,
             ConsensusMode mode);
 
-        /** Process the accepted ledger.
-
-            @param result The result of consensus
-            @param prevLedger The closed ledger consensus worked from
-            @param closeResolution The resolution used in agreeing on an
-                                   effective closeTime
-            @param rawCloseTimes The unrounded closetimes of ourself and our
-                                 peers
-            @param mode Our participating mode at the time consensus was
-                        declared
-            @param consensusJson Json representation of consensus state
-            @param validating whether this is a validator
-        */
+        /**
+         * Process the accepted ledger.
+         *
+         * @param result The result of consensus
+         * @param prevLedger The closed ledger consensus worked from
+         * @param closeResolution The resolution used in agreeing on an
+         *                        effective closeTime
+         * @param rawCloseTimes The unrounded closetimes of ourself and our
+         *                      peers
+         * @param mode Our participating mode at the time consensus was
+         *             declared
+         * @param consensusJson Json representation of consensus state
+         * @param validating whether this is a validator
+         */
         void
         onAccept(
             Result const& result,
@@ -319,11 +338,12 @@ class RCLConsensus
             json::Value&& consensusJson,
             bool const validating);
 
-        /** Process the accepted ledger that was a result of simulation/force
-            accept.
-
-            @ref onAccept
-        */
+        /**
+         * Process the accepted ledger that was a result of simulation/force
+         * accept.
+         *
+         * @ref onAccept
+         */
         void
         onForceAccept(
             Result const& result,
@@ -333,18 +353,20 @@ class RCLConsensus
             ConsensusMode const& mode,
             json::Value&& consensusJson);
 
-        /** Notify peers of a consensus state change
-
-            @param ne Event type for notification
-            @param ledger The ledger at the time of the state change
-            @param haveCorrectLCL Whether we believe we have the correct LCL.
-        */
+        /**
+         * Notify peers of a consensus state change
+         *
+         * @param ne Event type for notification
+         * @param ledger The ledger at the time of the state change
+         * @param haveCorrectLCL Whether we believe we have the correct LCL.
+         */
         void
         notify(protocol::NodeEvent ne, RCLCxLedger const& ledger, bool haveCorrectLCL);
 
-        /** Accept a new ledger based on the given transactions.
-
-            @ref onAccept
+        /**
+         * Accept a new ledger based on the given transactions.
+         *
+         * @ref onAccept
          */
         void
         doAccept(
@@ -355,27 +377,28 @@ class RCLConsensus
             ConsensusMode const& mode,
             json::Value&& consensusJson);
 
-        /** Build the new last closed ledger.
-
-            Accept the given the provided set of consensus transactions and
-            build the last closed ledger. Since consensus just agrees on which
-            transactions to apply, but not whether they make it into the closed
-            ledger, this function also populates retriableTxs with those that
-            can be retried in the next round.
-
-            @param previousLedger Prior ledger building upon
-            @param retriableTxs On entry, the set of transactions to apply to
-                                the ledger; on return, the set of transactions
-                                to retry in the next round.
-            @param closeTime The time the ledger closed
-            @param closeTimeCorrect Whether consensus agreed on close time
-            @param closeResolution Resolution used to determine consensus close
-                                   time
-            @param roundTime Duration of this consensus round
-            @param failedTxs Populate with transactions that we could not
-                             successfully apply.
-            @return The newly built ledger
-        */
+        /**
+         * Build the new last closed ledger.
+         *
+         * Accept the given the provided set of consensus transactions and
+         * build the last closed ledger. Since consensus just agrees on which
+         * transactions to apply, but not whether they make it into the closed
+         * ledger, this function also populates retriableTxs with those that
+         * can be retried in the next round.
+         *
+         * @param previousLedger Prior ledger building upon
+         * @param retriableTxs On entry, the set of transactions to apply to
+         *                     the ledger; on return, the set of transactions
+         *                     to retry in the next round.
+         * @param closeTime The time the ledger closed
+         * @param closeTimeCorrect Whether consensus agreed on close time
+         * @param closeResolution Resolution used to determine consensus close
+         *                        time
+         * @param roundTime Duration of this consensus round
+         * @param failedTxs Populate with transactions that we could not
+         *                  successfully apply.
+         * @return The newly built ledger
+         */
         RCLCxLedger
         buildLCL(
             RCLCxLedger const& previousLedger,
@@ -386,22 +409,25 @@ class RCLConsensus
             std::chrono::milliseconds roundTime,
             std::set<TxID>& failedTxs);
 
-        /** Validate the given ledger and share with peers as necessary
-
-            @param ledger The ledger to validate
-            @param txns The consensus transaction set
-            @param proposing Whether we were proposing transactions while
-                             generating this ledger.  If we are not proposing,
-                             a validation can still be sent to inform peers that
-                             we know we aren't fully participating in consensus
-                             but are still around and trying to catch up.
-        */
+        /**
+         * Validate the given ledger and share with peers as necessary
+         *
+         * @param ledger The ledger to validate
+         * @param txns The consensus transaction set
+         * @param proposing Whether we were proposing transactions while
+         *                  generating this ledger.  If we are not proposing,
+         *                  a validation can still be sent to inform peers that
+         *                  we know we aren't fully participating in consensus
+         *                  but are still around and trying to catch up.
+         */
         void
         validate(RCLCxLedger const& ledger, RCLTxSet const& txns, bool proposing);
     };
 
 public:
-    //! Constructor
+    /**
+     * Constructor
+     */
     RCLConsensus(
         Application& app,
         std::unique_ptr<FeeVote>&& feeVote,
@@ -417,35 +443,42 @@ public:
     RCLConsensus&
     operator=(RCLConsensus const&) = delete;
 
-    //! Whether we are validating consensus ledgers.
+    /**
+     * Whether we are validating consensus ledgers.
+     */
     bool
     validating() const
     {
         return adaptor_.validating();
     }
 
-    //! Get the number of proposing peers that participated in the previous
-    //! round.
+    /**
+     * Get the number of proposing peers that participated in the previous
+     * round.
+     */
     std::size_t
     prevProposers() const
     {
         return adaptor_.prevProposers();
     }
 
-    /** Get duration of the previous round.
-
-        The duration of the round is the establish phase, measured from closing
-        the open ledger to accepting the consensus result.
-
-        @return Last round duration in milliseconds
-    */
+    /**
+     * Get duration of the previous round.
+     *
+     * The duration of the round is the establish phase, measured from closing
+     * the open ledger to accepting the consensus result.
+     *
+     * @return Last round duration in milliseconds
+     */
     std::chrono::milliseconds
     prevRoundTime() const
     {
         return adaptor_.prevRoundTime();
     }
 
-    //! @see Consensus::mode
+    /**
+     * @see Consensus::mode
+     */
     ConsensusMode
     mode() const
     {
@@ -458,12 +491,15 @@ public:
         return consensus_.phase();
     }
 
-    //! @see Consensus::getJson
+    /**
+     * @see Consensus::getJson
+     */
     json::Value
     getJson(bool full) const;
 
-    /** Adjust the set of trusted validators and kick-off the next round of
-       consensus. For more details, @see Consensus::startRound
+    /**
+     * Adjust the set of trusted validators and kick-off the next round of
+     * consensus. For more details, @see Consensus::startRound
      */
     void
     startRound(
@@ -474,17 +510,23 @@ public:
         hash_set<NodeID> const& nowTrusted,
         std::unique_ptr<std::stringstream> const& clog);
 
-    //! @see Consensus::timerEntry
+    /**
+     * @see Consensus::timerEntry
+     */
     void
     timerEntry(
         NetClock::time_point const& now,
         std::unique_ptr<std::stringstream> const& clog = {});
 
-    //! @see Consensus::gotTxSet
+    /**
+     * @see Consensus::gotTxSet
+     */
     void
     gotTxSet(NetClock::time_point const& now, RCLTxSet const& txSet);
 
-    // @see Consensus::prevLedgerID
+    /**
+     * @see Consensus::prevLedgerID
+     */
     RCLCxLedger::ID
     prevLedgerID() const
     {
@@ -492,13 +534,17 @@ public:
         return consensus_.prevLedgerID();
     }
 
-    //! @see Consensus::simulate
+    /**
+     * @see Consensus::simulate
+     */
     void
     simulate(
         NetClock::time_point const& now,
         std::optional<std::chrono::milliseconds> consensusDelay);
 
-    //! @see Consensus::proposal
+    /**
+     * @see Consensus::proposal
+     */
     bool
     peerProposal(NetClock::time_point const& now, RCLCxPeerPos const& newProposal);
 
@@ -519,7 +565,8 @@ private:
     beast::Journal const j_;
 };
 
-/** Collects logging information.
+/**
+ * Collects logging information.
  *
  * Eases correlating multiple data points together to
  * help follow flow of a complex activity, such as
diff --git a/src/xrpld/app/consensus/RCLCxLedger.h b/src/xrpld/app/consensus/RCLCxLedger.h
index 89f70f9add..f9f27d2322 100644
--- a/src/xrpld/app/consensus/RCLCxLedger.h
+++ b/src/xrpld/app/consensus/RCLCxLedger.h
@@ -14,95 +14,119 @@
 
 namespace xrpl {
 
-/** Represents a ledger in RCLConsensus.
-
-    RCLCxLedger is a thin wrapper over `std::shared_ptr<Ledger const>`.
-*/
+/**
+ * Represents a ledger in RCLConsensus.
+ *
+ * RCLCxLedger is a thin wrapper over `std::shared_ptr<Ledger const>`.
+ */
 class RCLCxLedger
 {
 public:
-    //! Unique identifier of a ledger
+    /**
+     * Unique identifier of a ledger
+     */
     using ID = LedgerHash;
-    //! Sequence number of a ledger
+    /**
+     * Sequence number of a ledger
+     */
     using Seq = LedgerIndex;
 
-    /** Default constructor
-
-        TODO: This may not be needed if we ensure RCLConsensus is handed a valid
-        ledger in its constructor.  Its bad now because other members are not
-        checking whether the ledger is valid.
-    */
+    /**
+     * Default constructor
+     *
+     * TODO: This may not be needed if we ensure RCLConsensus is handed a valid
+     * ledger in its constructor.  Its bad now because other members are not
+     * checking whether the ledger is valid.
+     */
     RCLCxLedger() = default;
 
-    /** Constructor
-
-        @param l The ledger to wrap.
-    */
+    /**
+     * Constructor
+     *
+     * @param l The ledger to wrap.
+     */
     RCLCxLedger(std::shared_ptr<Ledger const> l) : ledger{std::move(l)}
     {
     }
 
-    //! Sequence number of the ledger.
+    /**
+     * Sequence number of the ledger.
+     */
     [[nodiscard]] Seq const&
     seq() const
     {
         return ledger->header().seq;
     }
 
-    //! Unique identifier (hash) of this ledger.
+    /**
+     * Unique identifier (hash) of this ledger.
+     */
     [[nodiscard]] ID const&
     id() const
     {
         return ledger->header().hash;
     }
 
-    //! Unique identifier (hash) of this ledger's parent.
+    /**
+     * Unique identifier (hash) of this ledger's parent.
+     */
     [[nodiscard]] ID const&
     parentID() const
     {
         return ledger->header().parentHash;
     }
 
-    //! Resolution used when calculating this ledger's close time.
+    /**
+     * Resolution used when calculating this ledger's close time.
+     */
     [[nodiscard]] NetClock::duration
     closeTimeResolution() const
     {
         return ledger->header().closeTimeResolution;
     }
 
-    //! Whether consensus process agreed on close time of the ledger.
+    /**
+     * Whether consensus process agreed on close time of the ledger.
+     */
     [[nodiscard]] bool
     closeAgree() const
     {
         return xrpl::getCloseAgree(ledger->header());
     }
 
-    //! The close time of this ledger
+    /**
+     * The close time of this ledger
+     */
     [[nodiscard]] NetClock::time_point
     closeTime() const
     {
         return ledger->header().closeTime;
     }
 
-    //! The close time of this ledger's parent.
+    /**
+     * The close time of this ledger's parent.
+     */
     [[nodiscard]] NetClock::time_point
     parentCloseTime() const
     {
         return ledger->header().parentCloseTime;
     }
 
-    //! JSON representation of this ledger.
+    /**
+     * JSON representation of this ledger.
+     */
     [[nodiscard]] json::Value
     getJson() const
     {
         return xrpl::getJson({*ledger, {}});
     }
 
-    /** The ledger instance.
-
-        TODO: Make this shared_ptr<ReadView const> .. requires ability to create
-        a new ledger from a readView?
-    */
+    /**
+     * The ledger instance.
+     *
+     * TODO: Make this shared_ptr<ReadView const> .. requires ability to create
+     * a new ledger from a readView?
+     */
     std::shared_ptr<Ledger const> ledger;
 };
 }  // namespace xrpl
diff --git a/src/xrpld/app/consensus/RCLCxPeerPos.h b/src/xrpld/app/consensus/RCLCxPeerPos.h
index e73ac3b532..050bdf6d36 100644
--- a/src/xrpld/app/consensus/RCLCxPeerPos.h
+++ b/src/xrpld/app/consensus/RCLCxPeerPos.h
@@ -18,26 +18,28 @@
 
 namespace xrpl {
 
-/** A peer's signed, proposed position for use in RCLConsensus.
-
-    Carries a ConsensusProposal signed by a peer. Provides value semantics
-    but manages shared storage of the peer position internally.
-*/
+/**
+ * A peer's signed, proposed position for use in RCLConsensus.
+ *
+ * Carries a ConsensusProposal signed by a peer. Provides value semantics
+ * but manages shared storage of the peer position internally.
+ */
 class RCLCxPeerPos
 {
 public:
     //< The type of the proposed position
     using Proposal = ConsensusProposal<NodeID, uint256, uint256>;
 
-    /** Constructor
-
-        Constructs a signed peer position.
-
-        @param publicKey Public key of the peer
-        @param signature Signature provided with the proposal
-        @param suppress Unique id used for hash router suppression
-        @param proposal The consensus proposal
-    */
+    /**
+     * Constructor
+     *
+     * Constructs a signed peer position.
+     *
+     * @param publicKey Public key of the peer
+     * @param signature Signature provided with the proposal
+     * @param suppress Unique id used for hash router suppression
+     * @param proposal The consensus proposal
+     */
 
     RCLCxPeerPos(
         PublicKey const& publicKey,
@@ -45,25 +47,33 @@ public:
         uint256 const& suppress,
         Proposal const& proposal);  // trivially copyable
 
-    //! Verify the signing hash of the proposal
+    /**
+     * Verify the signing hash of the proposal
+     */
     bool
     checkSign() const;
 
-    //! Signature of the proposal (not necessarily verified)
+    /**
+     * Signature of the proposal (not necessarily verified)
+     */
     Slice
     signature() const
     {
         return {signature_.data(), signature_.size()};
     }
 
-    //! Public key of peer that sent the proposal
+    /**
+     * Public key of peer that sent the proposal
+     */
     PublicKey const&
     publicKey() const
     {
         return publicKey_;
     }
 
-    //! Unique id used by hash router to suppress duplicates
+    /**
+     * Unique id used by hash router to suppress duplicates
+     */
     uint256 const&
     suppressionID() const
     {
@@ -76,7 +86,9 @@ public:
         return proposal_;
     }
 
-    //! JSON representation of proposal
+    /**
+     * JSON representation of proposal
+     */
     json::Value
     getJson() const;
 
@@ -105,22 +117,23 @@ private:
     }
 };
 
-/** Calculate a unique identifier for a signed proposal.
-
-    The identifier is based on all the fields that contribute to the signature,
-    as well as the signature itself. The "last closed ledger" field may be
-    omitted, but the signer will compute the signature as if this field was
-    present. Recipients of the proposal will inject the last closed ledger in
-    order to validate the signature. If the last closed ledger is left out, then
-    it is considered as all zeroes for the purposes of signing.
-
-    @param proposeHash The hash of the proposed position
-    @param previousLedger The hash of the ledger the proposal is based upon
-    @param proposeSeq Sequence number of the proposal
-    @param closeTime Close time of the proposal
-    @param publicKey Signer's public key
-    @param signature Proposal signature
-*/
+/**
+ * Calculate a unique identifier for a signed proposal.
+ *
+ * The identifier is based on all the fields that contribute to the signature,
+ * as well as the signature itself. The "last closed ledger" field may be
+ * omitted, but the signer will compute the signature as if this field was
+ * present. Recipients of the proposal will inject the last closed ledger in
+ * order to validate the signature. If the last closed ledger is left out, then
+ * it is considered as all zeroes for the purposes of signing.
+ *
+ * @param proposeHash The hash of the proposed position
+ * @param previousLedger The hash of the ledger the proposal is based upon
+ * @param proposeSeq Sequence number of the proposal
+ * @param closeTime Close time of the proposal
+ * @param publicKey Signer's public key
+ * @param signature Proposal signature
+ */
 uint256
 proposalUniqueId(
     uint256 const& proposeHash,
diff --git a/src/xrpld/app/consensus/RCLCxTx.h b/src/xrpld/app/consensus/RCLCxTx.h
index f174a2fd54..110ef14e1d 100644
--- a/src/xrpld/app/consensus/RCLCxTx.h
+++ b/src/xrpld/app/consensus/RCLCxTx.h
@@ -12,54 +12,69 @@
 
 namespace xrpl {
 
-/** Represents a transaction in RCLConsensus.
-
-    RCLCxTx is a thin wrapper over the SHAMapItem that corresponds to the
-    transaction.
-*/
+/**
+ * Represents a transaction in RCLConsensus.
+ *
+ * RCLCxTx is a thin wrapper over the SHAMapItem that corresponds to the
+ * transaction.
+ */
 class RCLCxTx
 {
 public:
-    //! Unique identifier/hash of transaction
+    /**
+     * Unique identifier/hash of transaction
+     */
     using ID = uint256;
 
-    /** Constructor
-
-        @param txn The transaction to wrap
-    */
+    /**
+     * Constructor
+     *
+     * @param txn The transaction to wrap
+     */
     RCLCxTx(boost::intrusive_ptr<SHAMapItem const> txn) : tx(std::move(txn))
     {
     }
 
-    //! The unique identifier/hash of the transaction
+    /**
+     * The unique identifier/hash of the transaction
+     */
     [[nodiscard]] ID const&
     id() const
     {
         return tx->key();
     }
 
-    //! The SHAMapItem that represents the transaction.
+    /**
+     * The SHAMapItem that represents the transaction.
+     */
     boost::intrusive_ptr<SHAMapItem const> tx;
 };
 
-/** Represents a set of transactions in RCLConsensus.
-
-    RCLTxSet is a thin wrapper over a SHAMap that stores the set of
-    transactions.
-*/
+/**
+ * Represents a set of transactions in RCLConsensus.
+ *
+ * RCLTxSet is a thin wrapper over a SHAMap that stores the set of
+ * transactions.
+ */
 class RCLTxSet
 {
 public:
-    //! Unique identifier/hash of the set of transactions
+    /**
+     * Unique identifier/hash of the set of transactions
+     */
     using ID = uint256;
-    //! The type that corresponds to a single transaction
+    /**
+     * The type that corresponds to a single transaction
+     */
     using Tx = RCLCxTx;
 
     //< Provide a mutable view of a TxSet
     class MutableTxSet
     {
         friend class RCLTxSet;
-        //! The SHAMap representing the transactions.
+        /**
+         * The SHAMap representing the transactions.
+         */
         std::shared_ptr<SHAMap> map_;
 
     public:
@@ -67,22 +82,24 @@ public:
         {
         }
 
-        /** Insert a new transaction into the set.
-
-        @param t The transaction to insert.
-        @return Whether the transaction took place.
-        */
+        /**
+         * Insert a new transaction into the set.
+         *
+         * @param t The transaction to insert.
+         * @return Whether the transaction took place.
+         */
         bool
         insert(Tx const& t)
         {
             return map_->addItem(SHAMapNodeType::TnTransactionNm, t.tx);
         }
 
-        /** Remove a transaction from the set.
-
-        @param entry The ID of the transaction to remove.
-        @return Whether the transaction was removed.
-        */
+        /**
+         * Remove a transaction from the set.
+         *
+         * @param entry The ID of the transaction to remove.
+         * @return Whether the transaction was removed.
+         */
         bool
         erase(Tx::ID const& entry)
         {
@@ -90,66 +107,73 @@ public:
         }
     };
 
-    /** Constructor
-
-        @param m SHAMap to wrap
-    */
+    /**
+     * Constructor
+     *
+     * @param m SHAMap to wrap
+     */
     RCLTxSet(std::shared_ptr<SHAMap> m) : map{std::move(m)}
     {
         XRPL_ASSERT(map, "xrpl::RCLTxSet::MutableTxSet::RCLTxSet : non-null input");
     }
 
-    /** Constructor from a previously created MutableTxSet
-
-        @param m MutableTxSet that will become fixed
+    /**
+     * Constructor from a previously created MutableTxSet
+     *
+     * @param m MutableTxSet that will become fixed
      */
     RCLTxSet(MutableTxSet const& m) : map{m.map_->snapShot(false)}
     {
     }
 
-    /** Test if a transaction is in the set.
-
-        @param entry The ID of transaction to test.
-        @return Whether the transaction is in the set.
-    */
+    /**
+     * Test if a transaction is in the set.
+     *
+     * @param entry The ID of transaction to test.
+     * @return Whether the transaction is in the set.
+     */
     [[nodiscard]] bool
     exists(Tx::ID const& entry) const
     {
         return map->hasItem(entry);
     }
 
-    /** Lookup a transaction.
-
-        @param entry The ID of the transaction to find.
-        @return A shared pointer to the SHAMapItem.
-
-        @note Since find may not succeed, this returns a
-              `std::shared_ptr<const SHAMapItem>` rather than a Tx, which
-              cannot refer to a missing transaction.  The generic consensus
-              code uses the shared_ptr semantics to know whether the find
-              was successful and properly creates a Tx as needed.
-    */
+    /**
+     * Lookup a transaction.
+     *
+     * @param entry The ID of the transaction to find.
+     * @return A shared pointer to the SHAMapItem.
+     *
+     * @note Since find may not succeed, this returns a
+     *       `std::shared_ptr<const SHAMapItem>` rather than a Tx, which
+     *       cannot refer to a missing transaction.  The generic consensus
+     *       code uses the shared_ptr semantics to know whether the find
+     *       was successful and properly creates a Tx as needed.
+     */
     [[nodiscard]] boost::intrusive_ptr<SHAMapItem const> const&
     find(Tx::ID const& entry) const
     {
         return map->peekItem(entry);
     }
 
-    //! The unique ID/hash of the transaction set
+    /**
+     * The unique ID/hash of the transaction set
+     */
     [[nodiscard]] ID
     id() const
     {
         return map->getHash().asUInt256();
     }
 
-    /** Find transactions not in common between this and another transaction
-       set.
-
-        @param j The set to compare with
-        @return Map of transactions in this set and `j` but not both. The key
-                is the transaction ID and the value is a bool of the transaction
-                exists in this set.
-    */
+    /**
+     * Find transactions not in common between this and another transaction
+     * set.
+     *
+     * @param j The set to compare with
+     * @return Map of transactions in this set and `j` but not both. The key
+     *         is the transaction ID and the value is a bool of the transaction
+     *         exists in this set.
+     */
     [[nodiscard]] std::map<Tx::ID, bool>
     compare(RCLTxSet const& j) const
     {
@@ -171,7 +195,9 @@ public:
         return ret;
     }
 
-    //! The SHAMap representing the transactions.
+    /**
+     * The SHAMap representing the transactions.
+     */
     std::shared_ptr<SHAMap> map;
 };
 }  // namespace xrpl
diff --git a/src/xrpld/app/consensus/RCLValidations.h b/src/xrpld/app/consensus/RCLValidations.h
index e8a1996204..7eadaf0dff 100644
--- a/src/xrpld/app/consensus/RCLValidations.h
+++ b/src/xrpld/app/consensus/RCLValidations.h
@@ -27,10 +27,11 @@ class Application;
 
 enum class BypassAccept : bool { No = false, Yes };
 
-/** Wrapper over STValidation for generic Validation code
-
-    Wraps an STValidation for compatibility with the generic validation code.
-*/
+/**
+ * Wrapper over STValidation for generic Validation code
+ *
+ * Wraps an STValidation for compatibility with the generic validation code.
+ */
 class RCLValidation
 {
     std::shared_ptr<STValidation> val_;
@@ -39,57 +40,72 @@ public:
     using NodeKey = xrpl::PublicKey;
     using NodeID = xrpl::NodeID;
 
-    /** Constructor
-
-        @param v The validation to wrap.
-    */
+    /**
+     * Constructor
+     *
+     * @param v The validation to wrap.
+     */
     RCLValidation(std::shared_ptr<STValidation> v) : val_{std::move(v)}
     {
     }
 
-    /// Validated ledger's hash
+    /**
+     * Validated ledger's hash
+     */
     [[nodiscard]] uint256
     ledgerID() const
     {
         return val_->getLedgerHash();
     }
 
-    /// Validated ledger's sequence number (0 if none)
+    /**
+     * Validated ledger's sequence number (0 if none)
+     */
     [[nodiscard]] std::uint32_t
     seq() const
     {
         return val_->getFieldU32(sfLedgerSequence);
     }
 
-    /// Validation's signing time
+    /**
+     * Validation's signing time
+     */
     [[nodiscard]] NetClock::time_point
     signTime() const
     {
         return val_->getSignTime();
     }
 
-    /// Validated ledger's first seen time
+    /**
+     * Validated ledger's first seen time
+     */
     [[nodiscard]] NetClock::time_point
     seenTime() const
     {
         return val_->getSeenTime();
     }
 
-    /// Public key of validator that published the validation
+    /**
+     * Public key of validator that published the validation
+     */
     [[nodiscard]] PublicKey
     key() const
     {
         return val_->getSignerPublic();
     }
 
-    /// NodeID of validator that published the validation
+    /**
+     * NodeID of validator that published the validation
+     */
     [[nodiscard]] NodeID
     nodeID() const
     {
         return val_->getNodeID();
     }
 
-    /// Whether the validation is considered trusted.
+    /**
+     * Whether the validation is considered trusted.
+     */
     [[nodiscard]] bool
     trusted() const
     {
@@ -108,28 +124,36 @@ public:
         val_->setUntrusted();
     }
 
-    /// Whether the validation is full (not-partial)
+    /**
+     * Whether the validation is full (not-partial)
+     */
     [[nodiscard]] bool
     full() const
     {
         return val_->isFull();
     }
 
-    /// Get the load fee of the validation if it exists
+    /**
+     * Get the load fee of the validation if it exists
+     */
     [[nodiscard]] std::optional<std::uint32_t>
     loadFee() const
     {
         return ~(*val_)[~sfLoadFee];
     }
 
-    /// Get the cookie specified in the validation (0 if not set)
+    /**
+     * Get the cookie specified in the validation (0 if not set)
+     */
     [[nodiscard]] std::uint64_t
     cookie() const
     {
         return (*val_)[sfCookie];
     }
 
-    /// Extract the underlying STValidation being wrapped
+    /**
+     * Extract the underlying STValidation being wrapped
+     */
     [[nodiscard]] std::shared_ptr<STValidation>
     unwrap() const
     {
@@ -137,15 +161,16 @@ public:
     }
 };
 
-/** Wraps a ledger instance for use in generic Validations LedgerTrie.
-
-    The LedgerTrie models a ledger's history as a map from Seq -> ID. Any
-    two ledgers that have the same ID for a given Seq have the same ID for
-    all earlier sequences (e.g. shared ancestry). In practice, a ledger only
-    conveniently has the prior 256 ancestor hashes available. For
-    RCLValidatedLedger, we treat any ledgers separated by more than 256 Seq as
-    distinct.
-*/
+/**
+ * Wraps a ledger instance for use in generic Validations LedgerTrie.
+ *
+ * The LedgerTrie models a ledger's history as a map from Seq -> ID. Any
+ * two ledgers that have the same ID for a given Seq have the same ID for
+ * all earlier sequences (e.g. shared ancestry). In practice, a ledger only
+ * conveniently has the prior 256 ancestor hashes available. For
+ * RCLValidatedLedger, we treat any ledgers separated by more than 256 Seq as
+ * distinct.
+ */
 class RCLValidatedLedger
 {
 public:
@@ -160,24 +185,31 @@ public:
 
     RCLValidatedLedger(std::shared_ptr<Ledger const> const& ledger, beast::Journal j);
 
-    /// The sequence (index) of the ledger
+    /**
+     * The sequence (index) of the ledger
+     */
     [[nodiscard]] Seq
     seq() const;
 
-    /// The ID (hash) of the ledger
+    /**
+     * The ID (hash) of the ledger
+     */
     [[nodiscard]] ID
     id() const;
 
-    /** Lookup the ID of the ancestor ledger
-
-        @param s The sequence (index) of the ancestor
-        @return The ID of this ledger's ancestor with that sequence number or
-                ID{0} if one was not determined
-    */
+    /**
+     * Lookup the ID of the ancestor ledger
+     *
+     * @param s The sequence (index) of the ancestor
+     * @return The ID of this ledger's ancestor with that sequence number or
+     *         ID{0} if one was not determined
+     */
     ID
     operator[](Seq const& s) const;
 
-    /// Find the sequence number of the earliest mismatching ancestor
+    /**
+     * Find the sequence number of the earliest mismatching ancestor
+     */
     friend Seq
     mismatch(RCLValidatedLedger const& a, RCLValidatedLedger const& b);
 
@@ -191,11 +223,12 @@ private:
     beast::Journal j_;
 };
 
-/** Generic validations adaptor class for RCL
-
-    Manages storing and writing stale RCLValidations to the sqlite DB and
-    acquiring validated ledgers from the network.
-*/
+/**
+ * Generic validations adaptor class for RCL
+ *
+ * Manages storing and writing stale RCLValidations to the sqlite DB and
+ * acquiring validated ledgers from the network.
+ */
 class RCLValidationsAdaptor
 {
 public:
@@ -206,12 +239,15 @@ public:
 
     RCLValidationsAdaptor(Application& app, beast::Journal j);
 
-    /** Current time used to determine if validations are stale.
+    /**
+     * Current time used to determine if validations are stale.
      */
     [[nodiscard]] NetClock::time_point
     now() const;
 
-    /** Attempt to acquire the ledger with given id from the network */
+    /**
+     * Attempt to acquire the ledger with given id from the network
+     */
     std::optional<RCLValidatedLedger>
     acquire(LedgerHash const& id);
 
@@ -226,18 +262,21 @@ private:
     beast::Journal j_;
 };
 
-/// Alias for RCL-specific instantiation of generic Validations
+/**
+ * Alias for RCL-specific instantiation of generic Validations
+ */
 using RCLValidations = Validations<RCLValidationsAdaptor>;
 
-/** Handle a new validation
-
-    Also sets the trust status of a validation based on the validating node's
-    public key and this node's current UNL.
-
-    @param app Application object containing validations and ledgerMaster
-    @param val The validation to add
-    @param source Name associated with validation used in logging
-*/
+/**
+ * Handle a new validation
+ *
+ * Also sets the trust status of a validation based on the validating node's
+ * public key and this node's current UNL.
+ *
+ * @param app Application object containing validations and ledgerMaster
+ * @param val The validation to add
+ * @param source Name associated with validation used in logging
+ */
 void
 handleNewValidation(
     Application& app,
diff --git a/src/xrpld/app/ledger/AbstractFetchPackContainer.h b/src/xrpld/app/ledger/AbstractFetchPackContainer.h
index 3adc435bd6..6298ddda0d 100644
--- a/src/xrpld/app/ledger/AbstractFetchPackContainer.h
+++ b/src/xrpld/app/ledger/AbstractFetchPackContainer.h
@@ -7,20 +7,22 @@
 
 namespace xrpl {
 
-/** An interface facilitating retrieval of fetch packs without
-    an application or ledgermaster object.
-*/
+/**
+ * An interface facilitating retrieval of fetch packs without
+ * an application or ledgermaster object.
+ */
 class AbstractFetchPackContainer
 {
 public:
     virtual ~AbstractFetchPackContainer() = default;
 
-    /** Retrieves partial ledger data of the corresponding hash from peers.`
-
-        @param nodeHash The 256-bit hash of the data to fetch.
-        @return `std::nullopt` if the hash isn't cached,
-            otherwise, the hash associated data.
-    */
+    /**
+     * Retrieves partial ledger data of the corresponding hash from peers.`
+     *
+     * @param nodeHash The 256-bit hash of the data to fetch.
+     * @return `std::nullopt` if the hash isn't cached,
+     *     otherwise, the hash associated data.
+     */
     virtual std::optional<Blob>
     getFetchPack(uint256 const& nodeHash) = 0;
 };
diff --git a/src/xrpld/app/ledger/AcceptedLedger.h b/src/xrpld/app/ledger/AcceptedLedger.h
index ec83839d7a..6e42d611d4 100644
--- a/src/xrpld/app/ledger/AcceptedLedger.h
+++ b/src/xrpld/app/ledger/AcceptedLedger.h
@@ -11,14 +11,15 @@
 
 namespace xrpl {
 
-/** A ledger that has become irrevocable.
-
-    An accepted ledger is a ledger that has a sufficient number of
-    validations to convince the local server that it is irrevocable.
-
-    The existence of an accepted ledger implies all preceding ledgers
-    are accepted.
-*/
+/**
+ * A ledger that has become irrevocable.
+ *
+ * An accepted ledger is a ledger that has a sufficient number of
+ * validations to convince the local server that it is irrevocable.
+ *
+ * The existence of an accepted ledger implies all preceding ledgers
+ * are accepted.
+ */
 /* VFALCO TODO digest this terminology clarification:
     Closed and accepted refer to ledgers that have not passed the
     validation threshold yet. Once they pass the threshold, they are
diff --git a/src/xrpld/app/ledger/BuildLedger.h b/src/xrpld/app/ledger/BuildLedger.h
index faa800daa7..22e33cabc0 100644
--- a/src/xrpld/app/ledger/BuildLedger.h
+++ b/src/xrpld/app/ledger/BuildLedger.h
@@ -16,21 +16,22 @@ class Ledger;
 class LedgerReplay;
 class SHAMap;
 
-/** Build a new ledger by applying consensus transactions
-
-    Build a new ledger by applying a set of transactions accepted as part of
-    consensus.
-
-    @param parent The ledger to apply transactions to
-    @param closeTime The time the ledger closed
-    @param closeTimeCorrect Whether consensus agreed on close time
-    @param closeResolution Resolution used to determine consensus close time
-    @param app Handle to application instance
-    @param txs On entry, transactions to apply; on exit, transactions that must
-               be retried in next round.
-    @param failedTxs Populated with transactions that failed in this round
-    @param j Journal to use for logging
-    @return The newly built ledger
+/**
+ * Build a new ledger by applying consensus transactions
+ *
+ * Build a new ledger by applying a set of transactions accepted as part of
+ * consensus.
+ *
+ * @param parent The ledger to apply transactions to
+ * @param closeTime The time the ledger closed
+ * @param closeTimeCorrect Whether consensus agreed on close time
+ * @param closeResolution Resolution used to determine consensus close time
+ * @param app Handle to application instance
+ * @param txs On entry, transactions to apply; on exit, transactions that must
+ *            be retried in next round.
+ * @param failedTxs Populated with transactions that failed in this round
+ * @param j Journal to use for logging
+ * @return The newly built ledger
  */
 std::shared_ptr<Ledger>
 buildLedger(
@@ -43,15 +44,16 @@ buildLedger(
     std::set<TxID>& failedTxs,
     beast::Journal j);
 
-/** Build a new ledger by replaying transactions
-
-    Build a new ledger by replaying transactions accepted into a prior ledger.
-
-    @param replayData Data of the ledger to replay
-    @param applyFlags Flags to use when applying transactions
-    @param app Handle to application instance
-    @param j Journal to use for logging
-    @return The newly built ledger
+/**
+ * Build a new ledger by replaying transactions
+ *
+ * Build a new ledger by replaying transactions accepted into a prior ledger.
+ *
+ * @param replayData Data of the ledger to replay
+ * @param applyFlags Flags to use when applying transactions
+ * @param app Handle to application instance
+ * @param j Journal to use for logging
+ * @return The newly built ledger
  */
 std::shared_ptr<Ledger>
 buildLedger(
diff --git a/src/xrpld/app/ledger/InboundLedger.h b/src/xrpld/app/ledger/InboundLedger.h
index 5f9f0e1baf..d8a9ddf46b 100644
--- a/src/xrpld/app/ledger/InboundLedger.h
+++ b/src/xrpld/app/ledger/InboundLedger.h
@@ -59,14 +59,18 @@ public:
     void
     update(std::uint32_t seq);
 
-    /** Returns true if we got all the data. */
+    /**
+     * Returns true if we got all the data.
+     */
     bool
     isComplete() const
     {
         return complete_;
     }
 
-    /** Returns false if we failed to get the data. */
+    /**
+     * Returns false if we failed to get the data.
+     */
     bool
     isFailed() const
     {
@@ -95,7 +99,9 @@ public:
 
     using neededHash_t = std::pair<protocol::TMGetObjectByHash::ObjectType, uint256>;
 
-    /** Return a json::ValueType::Object. */
+    /**
+     * Return a json::ValueType::Object.
+     */
     json::Value
     getJson(int);
 
diff --git a/src/xrpld/app/ledger/InboundLedgers.h b/src/xrpld/app/ledger/InboundLedgers.h
index 65b2db7d8e..e288201c66 100644
--- a/src/xrpld/app/ledger/InboundLedgers.h
+++ b/src/xrpld/app/ledger/InboundLedgers.h
@@ -20,10 +20,11 @@
 
 namespace xrpl {
 
-/** Manages the lifetime of inbound ledgers.
-
-    @see InboundLedger
-*/
+/**
+ * Manages the lifetime of inbound ledgers.
+ *
+ * @see InboundLedger
+ */
 class InboundLedgers
 {
 public:
@@ -68,11 +69,15 @@ public:
     virtual json::Value
     getInfo() = 0;
 
-    /** Returns the rate of historical ledger fetches per minute. */
+    /**
+     * Returns the rate of historical ledger fetches per minute.
+     */
     virtual std::size_t
     fetchRate() = 0;
 
-    /** Called when a complete ledger is obtained. */
+    /**
+     * Called when a complete ledger is obtained.
+     */
     virtual void
     onLedgerFetched() = 0;
 
diff --git a/src/xrpld/app/ledger/InboundTransactions.h b/src/xrpld/app/ledger/InboundTransactions.h
index d9799d9ad0..a961d04c33 100644
--- a/src/xrpld/app/ledger/InboundTransactions.h
+++ b/src/xrpld/app/ledger/InboundTransactions.h
@@ -18,7 +18,8 @@ namespace xrpl {
 
 class Application;
 
-/** Manages the acquisition and lifetime of transaction sets.
+/**
+ * Manages the acquisition and lifetime of transaction sets.
  */
 
 class InboundTransactions
@@ -33,7 +34,8 @@ public:
 
     virtual ~InboundTransactions() = 0;
 
-    /** Find and return a transaction set, or nullptr if it is missing.
+    /**
+     * Find and return a transaction set, or nullptr if it is missing.
      *
      * @param setHash The transaction set ID (digest of the SHAMap root node).
      * @param acquire Whether to fetch the transaction set from the network if
@@ -44,7 +46,8 @@ public:
     virtual std::shared_ptr<SHAMap>
     getSet(uint256 const& setHash, bool acquire) = 0;
 
-    /** Add a transaction set from a LedgerData message.
+    /**
+     * Add a transaction set from a LedgerData message.
      *
      * @param setHash The transaction set ID (digest of the SHAMap root node).
      * @param peer The peer that sent the message.
@@ -56,7 +59,8 @@ public:
         std::shared_ptr<Peer> peer,
         std::shared_ptr<protocol::TMLedgerData> message) = 0;
 
-    /** Add a transaction set.
+    /**
+     * Add a transaction set.
      *
      * @param setHash The transaction set ID (should match set.getHash()).
      * @param set The transaction set.
@@ -66,7 +70,8 @@ public:
     virtual void
     giveSet(uint256 const& setHash, std::shared_ptr<SHAMap> const& set, bool acquired) = 0;
 
-    /** Informs the container if a new consensus round
+    /**
+     * Informs the container if a new consensus round
      */
     virtual void
     newRound(std::uint32_t seq) = 0;
diff --git a/src/xrpld/app/ledger/LedgerCleaner.h b/src/xrpld/app/ledger/LedgerCleaner.h
index fd693d6bec..9dc35d463f 100644
--- a/src/xrpld/app/ledger/LedgerCleaner.h
+++ b/src/xrpld/app/ledger/LedgerCleaner.h
@@ -10,7 +10,9 @@
 
 namespace xrpl {
 
-/** Check the ledger/transaction databases to make sure they have continuity */
+/**
+ * Check the ledger/transaction databases to make sure they have continuity
+ */
 class LedgerCleaner : public beast::PropertyStream::Source
 {
 protected:
@@ -27,16 +29,17 @@ public:
     virtual void
     stop() = 0;
 
-    /** Start a long running task to clean the ledger.
-        The ledger is cleaned asynchronously, on an implementation defined
-        thread. This function call does not block. The long running task
-        will be stopped by a call to stop().
-
-        Thread safety:
-            Safe to call from any thread at any time.
-
-        @param parameters A Json object with configurable parameters.
-    */
+    /**
+     * Start a long running task to clean the ledger.
+     * The ledger is cleaned asynchronously, on an implementation defined
+     * thread. This function call does not block. The long running task
+     * will be stopped by a call to stop().
+     *
+     * Thread safety:
+     *     Safe to call from any thread at any time.
+     *
+     * @param parameters A Json object with configurable parameters.
+     */
     virtual void
     clean(json::Value const& parameters) = 0;
 };
diff --git a/src/xrpld/app/ledger/LedgerHistory.cpp b/src/xrpld/app/ledger/LedgerHistory.cpp
index b7e1772942..8734faa1fb 100644
--- a/src/xrpld/app/ledger/LedgerHistory.cpp
+++ b/src/xrpld/app/ledger/LedgerHistory.cpp
@@ -502,7 +502,8 @@ LedgerHistory::validatedLedger(
     entry->validatedConsensusHash = consensusHash;
 }
 
-/** Ensure ledgers_by_hash_ doesn't have the wrong hash for a particular index
+/**
+ * Ensure ledgers_by_hash_ doesn't have the wrong hash for a particular index
  */
 bool
 LedgerHistory::fixIndex(LedgerIndex ledgerIndex, LedgerHash const& ledgerHash)
diff --git a/src/xrpld/app/ledger/LedgerHistory.h b/src/xrpld/app/ledger/LedgerHistory.h
index 3fb6e345cf..922b354c32 100644
--- a/src/xrpld/app/ledger/LedgerHistory.h
+++ b/src/xrpld/app/ledger/LedgerHistory.h
@@ -19,43 +19,53 @@ namespace xrpl {
 
 // VFALCO TODO Rename to OldLedgers ?
 
-/** Retains historical ledgers. */
+/**
+ * Retains historical ledgers.
+ */
 class LedgerHistory
 {
 public:
     LedgerHistory(beast::insight::Collector::ptr const& collector, Application& app);
 
-    /** Track a ledger
-        @return `true` if the ledger was already tracked
-    */
+    /**
+     * Track a ledger
+     * @return `true` if the ledger was already tracked
+     */
     bool
     insert(std::shared_ptr<Ledger const> const& ledger, bool validated);
 
-    /** Get the ledgers_by_hash cache hit rate
-        @return the hit rate
-    */
+    /**
+     * Get the ledgers_by_hash cache hit rate
+     * @return the hit rate
+     */
     float
     getCacheHitRate()
     {
         return ledgersByHash_.getHitRate();
     }
 
-    /** Get a ledger given its sequence number */
+    /**
+     * Get a ledger given its sequence number
+     */
     std::shared_ptr<Ledger const>
     getLedgerBySeq(LedgerIndex ledgerIndex);
 
-    /** Retrieve a ledger given its hash */
+    /**
+     * Retrieve a ledger given its hash
+     */
     std::shared_ptr<Ledger const>
     getLedgerByHash(LedgerHash const& ledgerHash);
 
-    /** Get a ledger's hash given its sequence number
-        @param ledgerIndex The sequence number of the desired ledger
-        @return The hash of the specified ledger
-    */
+    /**
+     * Get a ledger's hash given its sequence number
+     * @param ledgerIndex The sequence number of the desired ledger
+     * @return The hash of the specified ledger
+     */
     LedgerHash
     getLedgerHash(LedgerIndex ledgerIndex);
 
-    /** Remove stale cache entries
+    /**
+     * Remove stale cache entries
      */
     void
     sweep()
@@ -64,21 +74,26 @@ public:
         consensusValidated_.sweep();
     }
 
-    /** Report that we have locally built a particular ledger */
+    /**
+     * Report that we have locally built a particular ledger
+     */
     void
     builtLedger(std::shared_ptr<Ledger const> const&, uint256 const& consensusHash, json::Value);
 
-    /** Report that we have validated a particular ledger */
+    /**
+     * Report that we have validated a particular ledger
+     */
     void
     validatedLedger(
         std::shared_ptr<Ledger const> const&,
         std::optional<uint256> const& consensusHash);
 
-    /** Repair a hash to index mapping
-        @param ledgerIndex The index whose mapping is to be repaired
-        @param ledgerHash The hash it is to be mapped to
-        @return `false` if the mapping was repaired
-    */
+    /**
+     * Repair a hash to index mapping
+     * @param ledgerIndex The index whose mapping is to be repaired
+     * @param ledgerHash The hash it is to be mapped to
+     * @return `false` if the mapping was repaired
+     */
     bool
     fixIndex(LedgerIndex ledgerIndex, LedgerHash const& ledgerHash);
 
@@ -86,16 +101,17 @@ public:
     clearLedgerCachePrior(LedgerIndex seq);
 
 private:
-    /** Log details in the case where we build one ledger but
-        validate a different one.
-        @param built The hash of the ledger we built
-        @param valid The hash of the ledger we deemed fully valid
-        @param builtConsensusHash The hash of the consensus transaction for the
-        ledger we built
-        @param validatedConsensusHash The hash of the validated ledger's
-        consensus transaction set
-        @param consensus The status of the consensus round
-    */
+    /**
+     * Log details in the case where we build one ledger but
+     * validate a different one.
+     * @param built The hash of the ledger we built
+     * @param valid The hash of the ledger we deemed fully valid
+     * @param builtConsensusHash The hash of the consensus transaction for the
+     * ledger we built
+     * @param validatedConsensusHash The hash of the validated ledger's
+     * consensus transaction set
+     * @param consensus The status of the consensus round
+     */
     void
     handleMismatch(
         LedgerHash const& built,
diff --git a/src/xrpld/app/ledger/LedgerHolder.h b/src/xrpld/app/ledger/LedgerHolder.h
index 3e70544bfc..da365e5e31 100644
--- a/src/xrpld/app/ledger/LedgerHolder.h
+++ b/src/xrpld/app/ledger/LedgerHolder.h
@@ -14,12 +14,13 @@ namespace xrpl {
 
 // VFALCO NOTE This class can be replaced with atomic<shared_ptr<...>>
 
-/** Hold a ledger in a thread-safe way.
-
-    VFALCO TODO The constructor should require a valid ledger, this
-                way the object always holds a value. We can use the
-                genesis ledger in all cases.
-*/
+/**
+ * Hold a ledger in a thread-safe way.
+ *
+ * VFALCO TODO The constructor should require a valid ledger, this
+ *             way the object always holds a value. We can use the
+ *             genesis ledger in all cases.
+ */
 class LedgerHolder : public CountedObject<LedgerHolder>
 {
 public:
diff --git a/src/xrpld/app/ledger/LedgerMaster.h b/src/xrpld/app/ledger/LedgerMaster.h
index efd8c15e20..32163fd57b 100644
--- a/src/xrpld/app/ledger/LedgerMaster.h
+++ b/src/xrpld/app/ledger/LedgerMaster.h
@@ -108,10 +108,11 @@ public:
     void
     setFullLedger(std::shared_ptr<Ledger const> const& ledger, bool isSynchronous, bool isCurrent);
 
-    /** Check the sequence number and parent close time of a
-        ledger against our clock and last validated ledger to
-        see if it can be the network's current ledger
-    */
+    /**
+     * Check the sequence number and parent close time of a
+     * ledger against our clock and last validated ledger to
+     * see if it can be the network's current ledger
+     */
     bool
     canBeCurrent(std::shared_ptr<Ledger const> const& ledger);
 
@@ -124,38 +125,44 @@ public:
     std::string
     getCompleteLedgers();
 
-    /** Apply held transactions to the open ledger
-        This is normally called as we close the ledger.
-        The open ledger remains open to handle new transactions
-        until a new open ledger is built.
-    */
+    /**
+     * Apply held transactions to the open ledger
+     * This is normally called as we close the ledger.
+     * The open ledger remains open to handle new transactions
+     * until a new open ledger is built.
+     */
     void
     applyHeldTransactions();
 
-    /** Get the next transaction held for a particular account if any.
-        This is normally called when a transaction for that account is
-        successfully applied to the open ledger so the next transaction
-        can be resubmitted without waiting for ledger close.
-    */
+    /**
+     * Get the next transaction held for a particular account if any.
+     * This is normally called when a transaction for that account is
+     * successfully applied to the open ledger so the next transaction
+     * can be resubmitted without waiting for ledger close.
+     */
     std::shared_ptr<STTx const>
     popAcctTransaction(std::shared_ptr<STTx const> const& tx);
 
-    /** Get a ledger's hash by sequence number using the cache
+    /**
+     * Get a ledger's hash by sequence number using the cache
      */
     uint256
     getHashBySeq(std::uint32_t index);
 
-    /** Walk to a ledger's hash using the skip list */
+    /**
+     * Walk to a ledger's hash using the skip list
+     */
     std::optional<LedgerHash>
     walkHashBySeq(std::uint32_t index, InboundLedger::Reason reason);
 
-    /** Walk the chain of ledger hashes to determine the hash of the
-        ledger with the specified index. The referenceLedger is used as
-        the base of the chain and should be fully validated and must not
-        precede the target index. This function may throw if nodes
-        from the reference ledger or any prior ledger are not present
-        in the node store.
-    */
+    /**
+     * Walk the chain of ledger hashes to determine the hash of the
+     * ledger with the specified index. The referenceLedger is used as
+     * the base of the chain and should be fully validated and must not
+     * precede the target index. This function may throw if nodes
+     * from the reference ledger or any prior ledger are not present
+     * in the node store.
+     */
     std::optional<LedgerHash>
     walkHashBySeq(
         std::uint32_t index,
@@ -255,7 +262,9 @@ public:
     std::size_t
     getFetchPackCacheSize() const;
 
-    //! Whether we have ever fully validated a ledger.
+    /**
+     * Whether we have ever fully validated a ledger.
+     */
     bool
     haveValidated()
     {
diff --git a/src/xrpld/app/ledger/LedgerPersistence.h b/src/xrpld/app/ledger/LedgerPersistence.h
index f466c32296..e2e442cb30 100644
--- a/src/xrpld/app/ledger/LedgerPersistence.h
+++ b/src/xrpld/app/ledger/LedgerPersistence.h
@@ -14,15 +14,16 @@ namespace xrpl {
 class ServiceRegistry;
 struct Fees;
 
-/** Save, or arrange to save, a fully-validated ledger.
-
-    @param registry The service registry providing access to required services.
-    @param ledger The fully-validated ledger to save.
-    @param isSynchronous If true, wait for the save to complete.
-    @param isCurrent If true, the ledger is the current validated ledger.
-
-    @return false on error.
-*/
+/**
+ * Save, or arrange to save, a fully-validated ledger.
+ *
+ * @param registry The service registry providing access to required services.
+ * @param ledger The fully-validated ledger to save.
+ * @param isSynchronous If true, wait for the save to complete.
+ * @param isCurrent If true, the ledger is the current validated ledger.
+ *
+ * @return false on error.
+ */
 bool
 pendSaveValidated(
     ServiceRegistry& registry,
@@ -30,15 +31,16 @@ pendSaveValidated(
     bool isSynchronous,
     bool isCurrent);
 
-/** Make ledger using info loaded from database.
-
-    @param info Ledger information.
-    @param rules Rules to use (may be overwritten by setup()).
-    @param fees Fees to use (may be overwritten by setup()).
-    @param registry Service registry for dependency injection.
-    @param acquire Acquire the ledger if not found locally.
-    @return Shared pointer to the ledger.
-*/
+/**
+ * Make ledger using info loaded from database.
+ *
+ * @param info Ledger information.
+ * @param rules Rules to use (may be overwritten by setup()).
+ * @param fees Fees to use (may be overwritten by setup()).
+ * @param registry Service registry for dependency injection.
+ * @param acquire Acquire the ledger if not found locally.
+ * @return Shared pointer to the ledger.
+ */
 std::shared_ptr<Ledger>
 loadLedgerHelper(
     LedgerHeader const& info,
@@ -47,15 +49,16 @@ loadLedgerHelper(
     ServiceRegistry& registry,
     bool acquire);
 
-/** Load a ledger by its sequence number.
-
-    @param ledgerIndex The sequence number of the ledger to load.
-    @param rules Rules to use (may be overwritten by setup()).
-    @param fees Fees to use (may be overwritten by setup()).
-    @param registry Service registry for dependency injection.
-    @param acquire Acquire the ledger if not found locally.
-    @return Shared pointer to the ledger, or nullptr if not found.
-*/
+/**
+ * Load a ledger by its sequence number.
+ *
+ * @param ledgerIndex The sequence number of the ledger to load.
+ * @param rules Rules to use (may be overwritten by setup()).
+ * @param fees Fees to use (may be overwritten by setup()).
+ * @param registry Service registry for dependency injection.
+ * @param acquire Acquire the ledger if not found locally.
+ * @return Shared pointer to the ledger, or nullptr if not found.
+ */
 std::shared_ptr<Ledger>
 loadByIndex(
     std::uint32_t ledgerIndex,
@@ -64,15 +67,16 @@ loadByIndex(
     ServiceRegistry& registry,
     bool acquire = true);
 
-/** Load a ledger by its hash.
-
-    @param ledgerHash The hash of the ledger to load.
-    @param rules Rules to use (may be overwritten by setup()).
-    @param fees Fees to use (may be overwritten by setup()).
-    @param registry Service registry for dependency injection.
-    @param acquire Acquire the ledger if not found locally.
-    @return Shared pointer to the ledger, or nullptr if not found.
-*/
+/**
+ * Load a ledger by its hash.
+ *
+ * @param ledgerHash The hash of the ledger to load.
+ * @param rules Rules to use (may be overwritten by setup()).
+ * @param fees Fees to use (may be overwritten by setup()).
+ * @param registry Service registry for dependency injection.
+ * @param acquire Acquire the ledger if not found locally.
+ * @return Shared pointer to the ledger, or nullptr if not found.
+ */
 std::shared_ptr<Ledger>
 loadByHash(
     uint256 const& ledgerHash,
@@ -81,13 +85,14 @@ loadByHash(
     ServiceRegistry& registry,
     bool acquire = true);
 
-/** Fetch the ledger with the highest sequence contained in the database.
-
-    @param rules Rules to use (may be overwritten by setup()).
-    @param fees Fees to use (may be overwritten by setup()).
-    @param registry Service registry for dependency injection.
-    @return Tuple of (ledger, sequence, hash), or empty if not found.
-*/
+/**
+ * Fetch the ledger with the highest sequence contained in the database.
+ *
+ * @param rules Rules to use (may be overwritten by setup()).
+ * @param fees Fees to use (may be overwritten by setup()).
+ * @param registry Service registry for dependency injection.
+ * @return Tuple of (ledger, sequence, hash), or empty if not found.
+ */
 std::tuple<std::shared_ptr<Ledger>, std::uint32_t, uint256>
 getLatestLedger(Rules const& rules, Fees const& fees, ServiceRegistry& registry);
 
diff --git a/src/xrpld/app/ledger/LedgerReplay.h b/src/xrpld/app/ledger/LedgerReplay.h
index 2dc4911ade..6a2da92007 100644
--- a/src/xrpld/app/ledger/LedgerReplay.h
+++ b/src/xrpld/app/ledger/LedgerReplay.h
@@ -25,7 +25,8 @@ public:
         std::shared_ptr<Ledger const> replay,
         std::map<std::uint32_t, std::shared_ptr<STTx const>>&& orderedTxns);
 
-    /** @return The parent of the ledger to replay
+    /**
+     * @return The parent of the ledger to replay
      */
     [[nodiscard]] std::shared_ptr<Ledger const> const&
     parent() const
@@ -33,7 +34,8 @@ public:
         return parent_;
     }
 
-    /** @return The ledger to replay
+    /**
+     * @return The ledger to replay
      */
     [[nodiscard]] std::shared_ptr<Ledger const> const&
     replay() const
@@ -41,7 +43,8 @@ public:
         return replay_;
     }
 
-    /** @return Transactions in the order they should be replayed
+    /**
+     * @return Transactions in the order they should be replayed
      */
     [[nodiscard]] std::map<std::uint32_t, std::shared_ptr<STTx const>> const&
     orderedTxns() const
diff --git a/src/xrpld/app/ledger/LedgerReplayTask.h b/src/xrpld/app/ledger/LedgerReplayTask.h
index 09329761c1..d908a36fc0 100644
--- a/src/xrpld/app/ledger/LedgerReplayTask.h
+++ b/src/xrpld/app/ledger/LedgerReplayTask.h
@@ -64,7 +64,9 @@ public:
         bool
         update(uint256 const& hash, std::uint32_t seq, std::vector<uint256> const& sList);
 
-        /** check if this task can be merged into an existing task */
+        /**
+         * check if this task can be merged into an existing task
+         */
         [[nodiscard]] bool
         canMergeInto(TaskParameter const& existingTask) const;
     };
@@ -87,7 +89,9 @@ public:
 
     ~LedgerReplayTask() override;
 
-    /** Start the task */
+    /**
+     * Start the task
+     */
     void
     init();
 
@@ -105,7 +109,9 @@ public:
         return parameter_;
     }
 
-    /** return if the task is finished */
+    /**
+     * return if the task is finished
+     */
     bool
     finished() const;
 
diff --git a/src/xrpld/app/ledger/LedgerReplayer.h b/src/xrpld/app/ledger/LedgerReplayer.h
index d44289121c..6feb187df6 100644
--- a/src/xrpld/app/ledger/LedgerReplayer.h
+++ b/src/xrpld/app/ledger/LedgerReplayer.h
@@ -78,7 +78,9 @@ public:
     void
     replay(InboundLedger::Reason r, uint256 const& finishLedgerHash, std::uint32_t totalNumLedgers);
 
-    /** Create LedgerDeltaAcquire subtasks for the LedgerReplayTask task */
+    /**
+     * Create LedgerDeltaAcquire subtasks for the LedgerReplayTask task
+     */
     void
     createDeltas(std::shared_ptr<LedgerReplayTask> task);
 
@@ -102,7 +104,9 @@ public:
         LedgerHeader const& info,
         std::map<std::uint32_t, std::shared_ptr<STTx const>>&& txns);
 
-    /** Remove completed tasks */
+    /**
+     * Remove completed tasks
+     */
     void
     sweep();
 
diff --git a/src/xrpld/app/ledger/LedgerToJson.h b/src/xrpld/app/ledger/LedgerToJson.h
index c9939fd2f4..1eac4d68f1 100644
--- a/src/xrpld/app/ledger/LedgerToJson.h
+++ b/src/xrpld/app/ledger/LedgerToJson.h
@@ -44,17 +44,22 @@ struct LedgerFill
     std::optional<NetClock::time_point> closeTime;
 };
 
-/** Given a Ledger and options, fill a json::Value with a
-    description of the ledger.
+/**
+ * Given a Ledger and options, fill a json::Value with a
+ * description of the ledger.
  */
 void
 addJson(json::Value&, LedgerFill const&);
 
-/** Return a new json::Value representing the ledger with given options.*/
+/**
+ * Return a new json::Value representing the ledger with given options.
+ */
 json::Value
 getJson(LedgerFill const&);
 
-/** Copy all the keys and values from one object into another. */
+/**
+ * Copy all the keys and values from one object into another.
+ */
 void
 copyFrom(json::Value& to, json::Value const& from);
 
diff --git a/src/xrpld/app/ledger/OpenLedger.h b/src/xrpld/app/ledger/OpenLedger.h
index 3e0577a9be..4a0aa105f9 100644
--- a/src/xrpld/app/ledger/OpenLedger.h
+++ b/src/xrpld/app/ledger/OpenLedger.h
@@ -36,7 +36,9 @@ using OrderedTxs = CanonicalTXSet;
 
 //------------------------------------------------------------------------------
 
-/** Represents the open ledger. */
+/**
+ * Represents the open ledger.
+ */
 class OpenLedger
 {
 private:
@@ -47,17 +49,18 @@ private:
     std::shared_ptr<OpenView const> current_;
 
 public:
-    /** Signature for modification functions.
-
-        The modification function is called during
-        apply and modify with an OpenView to accumulate
-        changes and the Journal to use for logging.
-
-        A return value of `true` informs OpenLedger
-        that changes were made. Always returning
-        `true` won't cause harm, but it may be
-        sub-optimal.
-    */
+    /**
+     * Signature for modification functions.
+     *
+     * The modification function is called during
+     * apply and modify with an OpenView to accumulate
+     * changes and the Journal to use for logging.
+     *
+     * A return value of `true` informs OpenLedger
+     * that changes were made. Always returning
+     * `true` won't cause harm, but it may be
+     * sub-optimal.
+     */
     using modify_type = std::function<bool(OpenView&, beast::Journal)>;
 
     OpenLedger() = delete;
@@ -65,90 +68,95 @@ public:
     OpenLedger&
     operator=(OpenLedger const&) = delete;
 
-    /** Create a new open ledger object.
-
-        @param ledger A closed ledger
-    */
+    /**
+     * Create a new open ledger object.
+     *
+     * @param ledger A closed ledger
+     */
     explicit OpenLedger(
         std::shared_ptr<Ledger const> const& ledger,
         CachedSLEs& cache,
         beast::Journal journal);
 
-    /** Returns `true` if there are no transactions.
-
-        The behavior of ledger closing can be different
-        depending on whether or not transactions exist
-        in the open ledger.
-
-        @note The value returned is only meaningful for
-              that specific instant in time. An open,
-              empty ledger can become non empty from
-              subsequent modifications. Caller is
-              responsible for synchronizing the meaning of
-              the return value.
-    */
+    /**
+     * Returns `true` if there are no transactions.
+     *
+     * The behavior of ledger closing can be different
+     * depending on whether or not transactions exist
+     * in the open ledger.
+     *
+     * @note The value returned is only meaningful for
+     *       that specific instant in time. An open,
+     *       empty ledger can become non empty from
+     *       subsequent modifications. Caller is
+     *       responsible for synchronizing the meaning of
+     *       the return value.
+     */
     bool
     empty() const;
 
-    /** Returns a view to the current open ledger.
-
-        Thread safety:
-            Can be called concurrently from any thread.
-
-        Effects:
-            The caller is given ownership of a
-            non-modifiable snapshot of the open ledger
-            at the time of the call.
-    */
+    /**
+     * Returns a view to the current open ledger.
+     *
+     * Thread safety:
+     *     Can be called concurrently from any thread.
+     *
+     * Effects:
+     *     The caller is given ownership of a
+     *     non-modifiable snapshot of the open ledger
+     *     at the time of the call.
+     */
     std::shared_ptr<OpenView const>
     current() const;
 
-    /** Modify the open ledger
-
-        Thread safety:
-            Can be called concurrently from any thread.
-
-        If `f` returns `true`, the changes made in the
-        OpenView will be published to the open ledger.
-
-        @return `true` if the open view was changed
-    */
+    /**
+     * Modify the open ledger
+     *
+     * Thread safety:
+     *     Can be called concurrently from any thread.
+     *
+     * If `f` returns `true`, the changes made in the
+     * OpenView will be published to the open ledger.
+     *
+     * @return `true` if the open view was changed
+     */
     bool
     modify(modify_type const& f);
 
-    /** Accept a new ledger.
-
-        Thread safety:
-            Can be called concurrently from any thread.
-
-        Effects:
-
-            A new open view based on the accepted ledger
-            is created, and the list of retriable
-            transactions is optionally applied first
-            depending on the value of `retriesFirst`.
-
-            The transactions in the current open view
-            are applied to the new open view.
-
-            The list of local transactions are applied
-            to the new open view.
-
-            The optional modify function f is called
-            to perform further modifications to the
-            open view, atomically. Changes made in
-            the modify function are not visible to
-            callers until accept() returns.
-
-            Any failed, retriable transactions are left
-            in `retries` for the caller.
-
-            The current view is atomically set to the
-            new open view.
-
-        @param rules The rules for the open ledger
-        @param ledger A new closed ledger
-    */
+    /**
+     * Accept a new ledger.
+     *
+     * Thread safety:
+     *     Can be called concurrently from any thread.
+     *
+     * Effects:
+     *
+     *     A new open view based on the accepted ledger
+     *     is created, and the list of retriable
+     *     transactions is optionally applied first
+     *     depending on the value of `retriesFirst`.
+     *
+     *     The transactions in the current open view
+     *     are applied to the new open view.
+     *
+     *     The list of local transactions are applied
+     *     to the new open view.
+     *
+     *     The optional modify function f is called
+     *     to perform further modifications to the
+     *     open view, atomically. Changes made in
+     *     the modify function are not visible to
+     *     callers until accept() returns.
+     *
+     *     Any failed, retriable transactions are left
+     *     in `retries` for the caller.
+     *
+     *     The current view is atomically set to the
+     *     new open view.
+     *
+     * @param rules The rules for the open ledger
+     * @param ledger A new closed ledger
+     */
     void
     accept(
         Application& app,
@@ -162,11 +170,12 @@ public:
         modify_type const& f = {});
 
 private:
-    /** Algorithm for applying transactions.
-
-        This has the retry logic and ordering semantics
-        used for consensus and building the open ledger.
-    */
+    /**
+     * Algorithm for applying transactions.
+     *
+     * This has the retry logic and ordering semantics
+     * used for consensus and building the open ledger.
+     */
     template <class FwdRange>
     static void
     apply(
diff --git a/src/xrpld/app/ledger/OrderBookDBImpl.h b/src/xrpld/app/ledger/OrderBookDBImpl.h
index d57d051cce..5f436a6946 100644
--- a/src/xrpld/app/ledger/OrderBookDBImpl.h
+++ b/src/xrpld/app/ledger/OrderBookDBImpl.h
@@ -20,19 +20,22 @@
 
 namespace xrpl {
 
-/** Configuration for OrderBookDB */
+/**
+ * Configuration for OrderBookDB
+ */
 struct OrderBookDBConfig
 {
     int pathSearchMax;
     bool standalone;
 };
 
-/** Create an OrderBookDB instance.
-
-    @param registry Service registry for accessing other services
-    @param config Configuration parameters
-    @return A new OrderBookDB instance
-*/
+/**
+ * Create an OrderBookDB instance.
+ *
+ * @param registry Service registry for accessing other services
+ * @param config Configuration parameters
+ * @return A new OrderBookDB instance
+ */
 std::unique_ptr<OrderBookDB>
 makeOrderBookDb(ServiceRegistry& registry, OrderBookDBConfig const& config);
 
diff --git a/src/xrpld/app/ledger/detail/BuildLedger.cpp b/src/xrpld/app/ledger/detail/BuildLedger.cpp
index d11e0610ba..e9c01c7133 100644
--- a/src/xrpld/app/ledger/detail/BuildLedger.cpp
+++ b/src/xrpld/app/ledger/detail/BuildLedger.cpp
@@ -81,15 +81,16 @@ buildLedgerImpl(
     return built;
 }
 
-/** Apply a set of consensus transactions to a ledger.
-
-  @param app Handle to application
-  @param txns the set of transactions to apply,
-  @param failed set of transactions that failed to apply
-  @param view ledger to apply to
-  @param j Journal for logging
-  @return number of transactions applied; transactions to retry left in txns
-*/
+/**
+ * Apply a set of consensus transactions to a ledger.
+ *
+ * @param app Handle to application
+ * @param txns the set of transactions to apply,
+ * @param failed set of transactions that failed to apply
+ * @param view ledger to apply to
+ * @param j Journal for logging
+ * @return number of transactions applied; transactions to retry left in txns
+ */
 
 std::size_t
 applyTransactions(
diff --git a/src/xrpld/app/ledger/detail/InboundLedger.cpp b/src/xrpld/app/ledger/detail/InboundLedger.cpp
index 4d34f60374..627a5d574f 100644
--- a/src/xrpld/app/ledger/detail/InboundLedger.cpp
+++ b/src/xrpld/app/ledger/detail/InboundLedger.cpp
@@ -336,7 +336,8 @@ InboundLedger::tryDB(NodeStore::Database& srcDB)
     }
 }
 
-/** Called with a lock by the PeerSet when the timer expires
+/**
+ * Called with a lock by the PeerSet when the timer expires
  */
 void
 InboundLedger::onTimer(bool wasProgress, ScopedLockType&)
@@ -385,7 +386,9 @@ InboundLedger::onTimer(bool wasProgress, ScopedLockType&)
     }
 }
 
-/** Add more peers to the set, if possible */
+/**
+ * Add more peers to the set, if possible
+ */
 void
 InboundLedger::addPeers()
 {
@@ -454,7 +457,8 @@ InboundLedger::done()
     });
 }
 
-/** Request more nodes, perhaps from a specific peer
+/**
+ * Request more nodes, perhaps from a specific peer
  */
 void
 InboundLedger::trigger(std::shared_ptr<Peer> const& peer, TriggerReason reason)
@@ -769,9 +773,10 @@ InboundLedger::filterNodes(
         recentNodes_.insert(n.second);
 }
 
-/** Take ledger header data
-    Call with a lock
-*/
+/**
+ * Take ledger header data
+ * Call with a lock
+ */
 // data must not have hash prefix
 bool
 InboundLedger::takeHeader(std::string const& data)
@@ -815,9 +820,10 @@ InboundLedger::takeHeader(std::string const& data)
     return true;
 }
 
-/** Process node data received from a peer
-    Call with a lock
-*/
+/**
+ * Process node data received from a peer
+ * Call with a lock
+ */
 void
 InboundLedger::receiveNode(protocol::TMLedgerData const& packet, SHAMapAddNode& san)
 {
@@ -911,9 +917,10 @@ InboundLedger::receiveNode(protocol::TMLedgerData const& packet, SHAMapAddNode&
     }
 }
 
-/** Process AS root node received from a peer
-    Call with a lock
-*/
+/**
+ * Process AS root node received from a peer
+ * Call with a lock
+ */
 bool
 InboundLedger::takeAsRootNode(Slice const& data, SHAMapAddNode& san)
 {
@@ -937,9 +944,10 @@ InboundLedger::takeAsRootNode(Slice const& data, SHAMapAddNode& san)
     return san.isGood();
 }
 
-/** Process AS root node received from a peer
-    Call with a lock
-*/
+/**
+ * Process AS root node received from a peer
+ * Call with a lock
+ */
 bool
 InboundLedger::takeTxRootNode(Slice const& data, SHAMapAddNode& san)
 {
@@ -994,9 +1002,10 @@ InboundLedger::getNeededHashes()
     return ret;
 }
 
-/** Stash a TMLedgerData received from a peer for later processing
-    Returns 'true' if we need to dispatch
-*/
+/**
+ * Stash a TMLedgerData received from a peer for later processing
+ * Returns 'true' if we need to dispatch
+ */
 bool
 InboundLedger::gotData(
     std::weak_ptr<Peer> peer,
@@ -1016,9 +1025,10 @@ InboundLedger::gotData(
     return true;
 }
 
-/** Process one TMLedgerData
-    Returns the number of useful nodes
-*/
+/**
+ * Process one TMLedgerData
+ * Returns the number of useful nodes
+ */
 // VFALCO NOTE, it is not necessary to pass the entire Peer,
 //              we can get away with just a Resource::Consumer endpoint.
 //
@@ -1193,9 +1203,10 @@ struct PeerDataCounts
 };
 }  // namespace detail
 
-/** Process pending TMLedgerData
-    Query the a random sample of the 'best' peers
-*/
+/**
+ * Process pending TMLedgerData
+ * Query the a random sample of the 'best' peers
+ */
 void
 InboundLedger::runData()
 {
diff --git a/src/xrpld/app/ledger/detail/InboundLedgers.cpp b/src/xrpld/app/ledger/detail/InboundLedgers.cpp
index 07daa7560e..dc361694cf 100644
--- a/src/xrpld/app/ledger/detail/InboundLedgers.cpp
+++ b/src/xrpld/app/ledger/detail/InboundLedgers.cpp
@@ -70,7 +70,9 @@ public:
     {
     }
 
-    /** @callgraph */
+    /**
+     * @callgraph
+     */
     std::shared_ptr<Ledger const>
     acquire(uint256 const& hash, std::uint32_t seq, InboundLedger::Reason reason) override
     {
@@ -182,7 +184,8 @@ public:
     // means "We got some data from an inbound ledger"
 
     // VFALCO TODO Remove the dependency on the Peer object.
-    /** We received a TMLedgerData from a peer.
+    /**
+     * We received a TMLedgerData from a peer.
      */
     bool
     gotLedgerData(
@@ -236,12 +239,13 @@ public:
         return recentFailures_.find(h) != recentFailures_.end();
     }
 
-    /** We got some data for a ledger we are no longer acquiring Since we paid
-        the price to receive it, we might as well stash it in case we need it.
-
-        Nodes are received in wire format and must be stashed/hashed in prefix
-        format
-    */
+    /**
+     * We got some data for a ledger we are no longer acquiring Since we paid
+     * the price to receive it, we might as well stash it in case we need it.
+     *
+     * Nodes are received in wire format and must be stashed/hashed in prefix
+     * format
+     */
     void
     gotStaleData(std::shared_ptr<protocol::TMLedgerData> packetPtr) override
     {
diff --git a/src/xrpld/app/ledger/detail/InboundTransactions.cpp b/src/xrpld/app/ledger/detail/InboundTransactions.cpp
index d744075869..9b50a1584f 100644
--- a/src/xrpld/app/ledger/detail/InboundTransactions.cpp
+++ b/src/xrpld/app/ledger/detail/InboundTransactions.cpp
@@ -119,7 +119,8 @@ public:
         return {};
     }
 
-    /** We received a TMLedgerData from a peer.
+    /**
+     * We received a TMLedgerData from a peer.
      */
     void
     gotData(
diff --git a/src/xrpld/app/ledger/detail/LedgerCleaner.cpp b/src/xrpld/app/ledger/detail/LedgerCleaner.cpp
index b96f01e577..d3ece3c036 100644
--- a/src/xrpld/app/ledger/detail/LedgerCleaner.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerCleaner.cpp
@@ -260,13 +260,14 @@ private:
         return hash ? *hash : beast::kZero;  // kludge
     }
 
-    /** Process a single ledger
-        @param ledgerIndex The index of the ledger to process.
-        @param ledgerHash  The known correct hash of the ledger.
-        @param doNodes Ensure all ledger nodes are in the node db.
-        @param doTxns Reprocess (account) transactions to SQL databases.
-        @return `true` if the ledger was cleaned.
-    */
+    /**
+     * Process a single ledger
+     * @param ledgerIndex The index of the ledger to process.
+     * @param ledgerHash  The known correct hash of the ledger.
+     * @param doNodes Ensure all ledger nodes are in the node db.
+     * @param doTxns Reprocess (account) transactions to SQL databases.
+     * @return `true` if the ledger was cleaned.
+     */
     bool
     doLedger(
         LedgerIndex const& ledgerIndex,
@@ -320,11 +321,12 @@ private:
         return true;
     }
 
-    /** Returns the hash of the specified ledger.
-        @param ledgerIndex The index of the desired ledger.
-        @param referenceLedger [out] An optional known good subsequent ledger.
-        @return The hash of the ledger. This will be all-bits-zero if not found.
-    */
+    /**
+     * Returns the hash of the specified ledger.
+     * @param ledgerIndex The index of the desired ledger.
+     * @param referenceLedger [out] An optional known good subsequent ledger.
+     * @return The hash of the ledger. This will be all-bits-zero if not found.
+     */
     LedgerHash
     getHash(LedgerIndex const& ledgerIndex, std::shared_ptr<ReadView const>& referenceLedger)
     {
@@ -373,7 +375,9 @@ private:
         return ledgerHash;
     }
 
-    /** Run the ledger cleaner. */
+    /**
+     * Run the ledger cleaner.
+     */
     void
     doLedgerCleaner()
     {
diff --git a/src/xrpld/app/ledger/detail/LedgerMaster.cpp b/src/xrpld/app/ledger/detail/LedgerMaster.cpp
index bab0dca827..2bd83b0f18 100644
--- a/src/xrpld/app/ledger/detail/LedgerMaster.cpp
+++ b/src/xrpld/app/ledger/detail/LedgerMaster.cpp
@@ -455,11 +455,12 @@ LedgerMaster::storeLedger(std::shared_ptr<Ledger const> ledger)
     return ledgerHistory_.insert(ledger, validated);
 }
 
-/** Apply held transactions to the open ledger
-    This is normally called as we close the ledger.
-    The open ledger remains open to handle new transactions
-    until a new open ledger is built.
-*/
+/**
+ * Apply held transactions to the open ledger
+ * This is normally called as we close the ledger.
+ * The open ledger remains open to handle new transactions
+ * until a new open ledger is built.
+ */
 void
 LedgerMaster::applyHeldTransactions()
 {
@@ -710,7 +711,8 @@ LedgerMaster::tryFill(std::shared_ptr<Ledger const> ledger)
     }
 }
 
-/** Request a fetch pack to get to the specified ledger
+/**
+ * Request a fetch pack to get to the specified ledger
  */
 void
 LedgerMaster::getFetchPack(LedgerIndex missing, InboundLedger::Reason reason)
@@ -1081,7 +1083,9 @@ LedgerMaster::checkAccept(std::shared_ptr<Ledger const> const& ledger)
     }
 }
 
-/** Report that the consensus process built a particular ledger */
+/**
+ * Report that the consensus process built a particular ledger
+ */
 void
 LedgerMaster::consensusBuilt(
     std::shared_ptr<Ledger const> const& ledger,
@@ -1511,7 +1515,8 @@ LedgerMaster::newOrderBookDB()
     return newPFWork("PthFindOBDB", ml);
 }
 
-/** A thread needs to be dispatched to handle pathfinding work of some kind.
+/**
+ * A thread needs to be dispatched to handle pathfinding work of some kind.
  */
 bool
 LedgerMaster::newPFWork(char const* name, std::unique_lock<std::recursive_mutex>&)
@@ -1996,30 +2001,31 @@ LedgerMaster::gotFetchPack(bool progress, std::uint32_t seq)
     }
 }
 
-/** Populate a fetch pack with data from the map the recipient wants.
-
-    A recipient may or may not have the map that they are asking for. If
-    they do, we can optimize the transfer by not including parts of the
-    map that they are already have.
-
-    @param have The map that the recipient already has (if any).
-    @param cnt The maximum number of nodes to return.
-    @param into The protocol object into which we add information.
-    @param seq The sequence number of the ledger the map is a part of.
-    @param withLeaves True if leaf nodes should be included.
-
-    @note: The withLeaves parameter is configurable even though the
-           code, so far, only ever sets the parameter to true.
-
-           The rationale is that for transaction trees, it may make
-           sense to not include the leaves if the fetch pack is being
-           constructed for someone attempting to get a recent ledger
-           for which they already have the transactions.
-
-           However, for historical ledgers, which is the only use we
-           have for fetch packs right now, it makes sense to include
-           the transactions because the caller is unlikely to have
-           them.
+/**
+ * Populate a fetch pack with data from the map the recipient wants.
+ *
+ * A recipient may or may not have the map that they are asking for. If
+ * they do, we can optimize the transfer by not including parts of the
+ * map that they are already have.
+ *
+ * @param have The map that the recipient already has (if any).
+ * @param cnt The maximum number of nodes to return.
+ * @param into The protocol object into which we add information.
+ * @param seq The sequence number of the ledger the map is a part of.
+ * @param withLeaves True if leaf nodes should be included.
+ *
+ * @note: The withLeaves parameter is configurable even though the
+ *        code, so far, only ever sets the parameter to true.
+ *
+ *        The rationale is that for transaction trees, it may make
+ *        sense to not include the leaves if the fetch pack is being
+ *        constructed for someone attempting to get a recent ledger
+ *        for which they already have the transactions.
+ *
+ *        However, for historical ledgers, which is the only use we
+ *        have for fetch packs right now, it makes sense to include
+ *        the transactions because the caller is unlikely to have
+ *        them.
  */
 static void
 populateFetchPack(
diff --git a/src/xrpld/app/ledger/detail/TimeoutCounter.h b/src/xrpld/app/ledger/detail/TimeoutCounter.h
index ab4dd28e47..682abf1537 100644
--- a/src/xrpld/app/ledger/detail/TimeoutCounter.h
+++ b/src/xrpld/app/ledger/detail/TimeoutCounter.h
@@ -18,39 +18,39 @@
 namespace xrpl {
 
 /**
-    This class is an "active" object. It maintains its own timer
-    and dispatches work to a job queue. Implementations derive
-    from this class and override the abstract hook functions in
-    the base.
-
-    This class implements an asynchronous loop:
-
-    1. The entry point is `setTimer`.
-
-    2. After `timerInterval_`, `queueJob` is called, which schedules a job to
-       call `invokeOnTimer` (or loops back to setTimer if there are too many
-       concurrent jobs).
-
-    3. The job queue calls `invokeOnTimer` which either breaks the loop if
-       `isDone` or calls `onTimer`.
-
-    4. `onTimer` is the only "real" virtual method in this class. It is the
-       callback for when the timeout expires. Generally, its only responsibility
-       is to set `failed_ = true`. However, if it wants to implement a policy of
-       retries, then it has a chance to just increment a count of expired
-       timeouts.
-
-    5. Once `onTimer` returns, if the object is still not `isDone`, then
-       `invokeOnTimer` sets another timeout by looping back to setTimer.
-
-   This loop executes concurrently with another asynchronous sequence,
-   implemented by the subtype, that is trying to make progress and eventually
-   set `complete_ = true`. While it is making progress but not complete, it
-   should set `progress_ = true`, which is passed to onTimer so it can decide
-   whether to postpone failure and reset the timeout. However, if it can
-   complete all its work in one synchronous step (while it holds the lock), then
-   it can ignore `progress_`.
-*/
+ * This class is an "active" object. It maintains its own timer
+ * and dispatches work to a job queue. Implementations derive
+ * from this class and override the abstract hook functions in
+ * the base.
+ *
+ * This class implements an asynchronous loop:
+ *
+ * 1. The entry point is `setTimer`.
+ *
+ * 2. After `timerInterval_`, `queueJob` is called, which schedules a job to
+ *    call `invokeOnTimer` (or loops back to setTimer if there are too many
+ *    concurrent jobs).
+ *
+ * 3. The job queue calls `invokeOnTimer` which either breaks the loop if
+ *    `isDone` or calls `onTimer`.
+ *
+ * 4. `onTimer` is the only "real" virtual method in this class. It is the
+ *    callback for when the timeout expires. Generally, its only responsibility
+ *    is to set `failed_ = true`. However, if it wants to implement a policy of
+ *    retries, then it has a chance to just increment a count of expired
+ *    timeouts.
+ *
+ * 5. Once `onTimer` returns, if the object is still not `isDone`, then
+ *    `invokeOnTimer` sets another timeout by looping back to setTimer.
+ *
+ * This loop executes concurrently with another asynchronous sequence,
+ * implemented by the subtype, that is trying to make progress and eventually
+ * set `complete_ = true`. While it is making progress but not complete, it
+ * should set `progress_ = true`, which is passed to onTimer so it can decide
+ * whether to postpone failure and reset the timeout. However, if it can
+ * complete all its work in one synchronous step (while it holds the lock), then
+ * it can ignore `progress_`.
+ */
 class TimeoutCounter
 {
 public:
@@ -84,19 +84,27 @@ protected:
         QueueJobParameter&& jobParameter,
         beast::Journal journal);
 
-    /** Schedule a call to queueJob() after timerInterval_. */
+    /**
+     * Schedule a call to queueJob() after timerInterval_.
+     */
     void
     setTimer(ScopedLockType&);
 
-    /** Queue a job to call invokeOnTimer(). */
+    /**
+     * Queue a job to call invokeOnTimer().
+     */
     void
     queueJob(ScopedLockType&);
 
-    /** Hook called from invokeOnTimer(). */
+    /**
+     * Hook called from invokeOnTimer().
+     */
     virtual void
     onTimer(bool progress, ScopedLockType&) = 0;
 
-    /** Return a weak pointer to this. */
+    /**
+     * Return a weak pointer to this.
+     */
     virtual std::weak_ptr<TimeoutCounter>
     pmDowncast() = 0;
 
@@ -112,21 +120,28 @@ protected:
     beast::Journal journal_;
     mutable std::recursive_mutex mtx_;
 
-    /** The hash of the object (in practice, always a ledger) we are trying to
-     * fetch. */
+    /**
+     * The hash of the object (in practice, always a ledger) we are trying to
+     * fetch.
+     */
     uint256 const hash_;
     int timeouts_{0};
     bool complete_{false};
     bool failed_{false};
-    /** Whether forward progress has been made. */
+    /**
+     * Whether forward progress has been made.
+     */
     bool progress_{false};
-    /** The minimum time to wait between calls to execute(). */
+    /**
+     * The minimum time to wait between calls to execute().
+     */
     std::chrono::milliseconds timerInterval_;
 
     QueueJobParameter queueJobParameter_;
 
 private:
-    /** Calls onTimer() if in the right state.
+    /**
+     * Calls onTimer() if in the right state.
      *  Only called by queueJob().
      */
     void
diff --git a/src/xrpld/app/main/Application.h b/src/xrpld/app/main/Application.h
index 33876b97b9..225275afe4 100644
--- a/src/xrpld/app/main/Application.h
+++ b/src/xrpld/app/main/Application.h
@@ -129,7 +129,9 @@ public:
     // ---
     //
 
-    /** Returns a 64-bit instance identifier, generated at startup */
+    /**
+     * Returns a 64-bit instance identifier, generated at startup
+     */
     [[nodiscard]] virtual std::uint64_t
     instanceID() const = 0;
 
@@ -152,12 +154,16 @@ public:
     [[nodiscard]] virtual int
     fdRequired() const = 0;
 
-    /** Ensure that a newly-started validator does not sign proposals older
-     * than the last ledger it persisted. */
+    /**
+     * Ensure that a newly-started validator does not sign proposals older
+     * than the last ledger it persisted.
+     */
     virtual LedgerIndex
     getMaxDisallowedLedger() = 0;
 
-    /** Returns the number of io_context (I/O worker) threads used by the application. */
+    /**
+     * Returns the number of io_context (I/O worker) threads used by the application.
+     */
     [[nodiscard]] virtual size_t
     getNumberOfThreads() const = 0;
 };
diff --git a/src/xrpld/app/main/CollectorManager.h b/src/xrpld/app/main/CollectorManager.h
index e695ddc956..fac72b4de1 100644
--- a/src/xrpld/app/main/CollectorManager.h
+++ b/src/xrpld/app/main/CollectorManager.h
@@ -10,7 +10,9 @@
 
 namespace xrpl {
 
-/** Provides the beast::insight::Collector service. */
+/**
+ * Provides the beast::insight::Collector service.
+ */
 class CollectorManager
 {
 public:
diff --git a/src/xrpld/app/main/LoadManager.h b/src/xrpld/app/main/LoadManager.h
index 794048567a..5d3f07e996 100644
--- a/src/xrpld/app/main/LoadManager.h
+++ b/src/xrpld/app/main/LoadManager.h
@@ -12,17 +12,18 @@ namespace xrpl {
 
 class Application;
 
-/** Manages load sources.
-
-    This object creates an associated thread to maintain a clock.
-
-    When the server is overloaded by a particular peer it issues a warning
-    first. This allows friendly peers to reduce their consumption of resources,
-    or disconnect from the server.
-
-    The warning system is used instead of merely dropping, because hostile
-    peers can just reconnect anyway.
-*/
+/**
+ * Manages load sources.
+ *
+ * This object creates an associated thread to maintain a clock.
+ *
+ * When the server is overloaded by a particular peer it issues a warning
+ * first. This allows friendly peers to reduce their consumption of resources,
+ * or disconnect from the server.
+ *
+ * The warning system is used instead of merely dropping, because hostile
+ * peers can just reconnect anyway.
+ */
 class LoadManager
 {
     LoadManager(Application& app, beast::Journal journal);
@@ -33,20 +34,22 @@ public:
     LoadManager&
     operator=(LoadManager const&) = delete;
 
-    /** Destroy the manager.
-
-        The destructor returns only after the thread has stopped.
-    */
+    /**
+     * Destroy the manager.
+     *
+     * The destructor returns only after the thread has stopped.
+     */
     ~LoadManager();
 
-    /** Turn on stall detection.
-
-        The stall detector begins in a disabled state. After this function
-        is called, it will report stalls using a separate thread whenever
-        the reset function is not called at least once per 10 seconds.
-
-        @see resetStallDetector
-    */
+    /**
+     * Turn on stall detection.
+     *
+     * The stall detector begins in a disabled state. After this function
+     * is called, it will report stalls using a separate thread whenever
+     * the reset function is not called at least once per 10 seconds.
+     *
+     * @see resetStallDetector
+     */
     // VFALCO NOTE it seems that the stall detector has an "armed" state
     //             to prevent it from going off during program startup if
     //             there's a lengthy initialization operation taking place?
@@ -54,11 +57,12 @@ public:
     void
     activateStallDetector();
 
-    /** Reset the stall detection timer.
-
-        A dedicated thread monitors the stall timer, and if too much
-        time passes it will produce log warnings.
-    */
+    /**
+     * Reset the stall detection timer.
+     *
+     * A dedicated thread monitors the stall timer, and if too much
+     * time passes it will produce log warnings.
+     */
     void
     heartbeat();
 
diff --git a/src/xrpld/app/main/NodeIdentity.h b/src/xrpld/app/main/NodeIdentity.h
index 789d061021..117acffdb1 100644
--- a/src/xrpld/app/main/NodeIdentity.h
+++ b/src/xrpld/app/main/NodeIdentity.h
@@ -11,10 +11,11 @@
 
 namespace xrpl {
 
-/** The cryptographic credentials identifying this server instance.
-
-    @param app The application object
-    @param cmdline The command line parameters passed into the application.
+/**
+ * The cryptographic credentials identifying this server instance.
+ *
+ * @param app The application object
+ * @param cmdline The command line parameters passed into the application.
  */
 std::pair<PublicKey, SecretKey>
 getNodeIdentity(Application& app, boost::program_options::variables_map const& cmdline);
diff --git a/src/xrpld/app/main/NodeStoreScheduler.h b/src/xrpld/app/main/NodeStoreScheduler.h
index 48e606bb45..8bfd1607ae 100644
--- a/src/xrpld/app/main/NodeStoreScheduler.h
+++ b/src/xrpld/app/main/NodeStoreScheduler.h
@@ -6,7 +6,9 @@
 
 namespace xrpl {
 
-/** A NodeStore::Scheduler which uses the JobQueue. */
+/**
+ * A NodeStore::Scheduler which uses the JobQueue.
+ */
 class NodeStoreScheduler : public NodeStore::Scheduler
 {
 public:
diff --git a/src/xrpld/app/misc/DeliverMax.h b/src/xrpld/app/misc/DeliverMax.h
index fefa59d46b..73ccc95800 100644
--- a/src/xrpld/app/misc/DeliverMax.h
+++ b/src/xrpld/app/misc/DeliverMax.h
@@ -9,13 +9,13 @@ class Value;
 namespace xrpl::RPC {
 
 /**
-   Copy `Amount` field to `DeliverMax` field in transaction output JSON.
-   This only applies to Payment transaction type, all others are ignored.
-
-   When apiVersion > 1 will also remove `Amount` field, forcing users
-   to access this value using new `DeliverMax` field only.
-   @{
+ * Copy `Amount` field to `DeliverMax` field in transaction output JSON.
+ * This only applies to Payment transaction type, all others are ignored.
+ *
+ * When apiVersion > 1 will also remove `Amount` field, forcing users
+ * to access this value using new `DeliverMax` field only.
  */
+/** @{ */
 
 void
 insertDeliverMax(json::Value& txJson, TxType txnType, unsigned int apiVersion);
diff --git a/src/xrpld/app/misc/FeeVote.h b/src/xrpld/app/misc/FeeVote.h
index d6b4b0fc6a..22b2d888f3 100644
--- a/src/xrpld/app/misc/FeeVote.h
+++ b/src/xrpld/app/misc/FeeVote.h
@@ -12,25 +12,29 @@
 
 namespace xrpl {
 
-/** Manager to process fee votes. */
+/**
+ * Manager to process fee votes.
+ */
 class FeeVote
 {
 public:
     virtual ~FeeVote() = default;
 
-    /** Add local fee preference to validation.
-
-        @param lastClosedLedger
-        @param baseValidation
-    */
+    /**
+     * Add local fee preference to validation.
+     *
+     * @param lastClosedLedger
+     * @param baseValidation
+     */
     virtual void
     doValidation(Fees const& lastFees, Rules const& rules, STValidation& val) = 0;
 
-    /** Cast our local vote on the fee.
-
-        @param lastClosedLedger
-        @param initialPosition
-    */
+    /**
+     * Cast our local vote on the fee.
+     *
+     * @param lastClosedLedger
+     * @param initialPosition
+     */
     virtual void
     doVoting(
         std::shared_ptr<ReadView const> const& lastClosedLedger,
@@ -39,10 +43,11 @@ public:
 };
 
 struct FeeSetup;
-/** Create an instance of the FeeVote logic.
-    @param setup The fee schedule to vote for.
-    @param journal Where to log.
-*/
+/**
+ * Create an instance of the FeeVote logic.
+ * @param setup The fee schedule to vote for.
+ * @param journal Where to log.
+ */
 std::unique_ptr<FeeVote>
 makeFeeVote(FeeSetup const& setup, beast::Journal journal);
 
diff --git a/src/xrpld/app/misc/NegativeUNLVote.h b/src/xrpld/app/misc/NegativeUNLVote.h
index 2896962a84..a01bf04dcf 100644
--- a/src/xrpld/app/misc/NegativeUNLVote.h
+++ b/src/xrpld/app/misc/NegativeUNLVote.h
@@ -141,8 +141,8 @@ private:
      * Pick one candidate from a vector of candidates.
      *
      * @param randomPadData the data used for picking a candidate.
-     *        @note Nodes must use the same randomPadData for picking the same
-     *        candidate. The hash of the parent ledger is used.
+     * @note Nodes must use the same randomPadData for picking the same
+     *       candidate. The hash of the parent ledger is used.
      * @param candidates the vector of candidates
      * @return the picked candidate
      */
diff --git a/src/xrpld/app/misc/NetworkOPs.cpp b/src/xrpld/app/misc/NetworkOPs.cpp
index 4d40247a29..14d23b26d5 100644
--- a/src/xrpld/app/misc/NetworkOPs.cpp
+++ b/src/xrpld/app/misc/NetworkOPs.cpp
@@ -266,7 +266,9 @@ class NetworkOPsImp final : public NetworkOPs
         }
     };
 
-    //! Server fees published on `server` subscription
+    /**
+     * Server fees published on `server` subscription
+     */
     struct ServerFeeSummary
     {
         ServerFeeSummary() = default;
@@ -469,9 +471,10 @@ public:
     void
     setStandAlone() override;
 
-    /** Called to initially start our timers.
-        Not called for stand-alone mode.
-    */
+    /**
+     * Called to initially start our timers.
+     * Not called for stand-alone mode.
+     */
     void
     setStateTimer() override;
 
@@ -838,7 +841,8 @@ private:
 
     LedgerMaster& ledgerMaster_;
 
-    /** Maps each order book to its current set of subscribers.
+    /**
+     * Maps each order book to its current set of subscribers.
      *  Outer key: the Book (currency pair + optional domain).
      *  Inner key: InfoSub::seq (unique per connection).
      *  Inner value: weak_ptr so that a dropped connection does not prevent
diff --git a/src/xrpld/app/misc/SHAMapStore.h b/src/xrpld/app/misc/SHAMapStore.h
index 9f12546463..df696c685f 100644
--- a/src/xrpld/app/misc/SHAMapStore.h
+++ b/src/xrpld/app/misc/SHAMapStore.h
@@ -25,7 +25,9 @@ class SHAMapStore
 public:
     virtual ~SHAMapStore() = default;
 
-    /** Called by LedgerMaster every time a ledger validates. */
+    /**
+     * Called by LedgerMaster every time a ledger validates.
+     */
     virtual void
     onLedgerClosed(std::shared_ptr<Ledger const> const& ledger) = 0;
 
@@ -44,44 +46,54 @@ public:
     virtual std::unique_ptr<NodeStore::Database>
     makeNodeStore(int readThreads) = 0;
 
-    /** Highest ledger that may be deleted. */
+    /**
+     * Highest ledger that may be deleted.
+     */
     virtual LedgerIndex
     setCanDelete(LedgerIndex canDelete) = 0;
 
-    /** Whether advisory delete is enabled. */
+    /**
+     * Whether advisory delete is enabled.
+     */
     [[nodiscard]] virtual bool
     advisoryDelete() const = 0;
 
-    /** Maximum ledger that has been deleted, or will be deleted if
+    /**
+     * Maximum ledger that has been deleted, or will be deleted if
      *  currently in the act of online deletion.
      */
     virtual LedgerIndex
     getLastRotated() = 0;
 
-    /** Highest ledger that may be deleted. */
+    /**
+     * Highest ledger that may be deleted.
+     */
     virtual LedgerIndex
     getCanDelete() = 0;
 
-    /** Returns the number of file descriptors that are needed. */
+    /**
+     * Returns the number of file descriptors that are needed.
+     */
     [[nodiscard]] virtual int
     fdRequired() const = 0;
 
-    /** The minimum ledger to try and maintain in our database.
-
-        This defines the lower bound for attempting to acquire historical
-        ledgers over the peer to peer network.
-
-        If online_delete is enabled, then each time online_delete executes
-        and just prior to clearing SQL databases of historical ledgers,
-        move the value forward to one past the greatest ledger being deleted.
-        This minimizes fetching of ledgers that are in the process of being
-        deleted. Without online_delete or before online_delete is
-        executed, this value is always the minimum value persisted in the
-        ledger database, if any.
-
-        @return The minimum ledger sequence to keep online based on the
-            description above. If not set, then an unseated optional.
-    */
+    /**
+     * The minimum ledger to try and maintain in our database.
+     *
+     * This defines the lower bound for attempting to acquire historical
+     * ledgers over the peer to peer network.
+     *
+     * If online_delete is enabled, then each time online_delete executes
+     * and just prior to clearing SQL databases of historical ledgers,
+     * move the value forward to one past the greatest ledger being deleted.
+     * This minimizes fetching of ledgers that are in the process of being
+     * deleted. Without online_delete or before online_delete is
+     * executed, this value is always the minimum value persisted in the
+     * ledger database, if any.
+     *
+     * @return The minimum ledger sequence to keep online based on the
+     *     description above. If not set, then an unseated optional.
+     */
     [[nodiscard]] virtual std::optional<LedgerIndex>
     minimumOnline() const = 0;
 };
diff --git a/src/xrpld/app/misc/SHAMapStoreImp.h b/src/xrpld/app/misc/SHAMapStoreImp.h
index 4025236868..a0ca59ecc8 100644
--- a/src/xrpld/app/misc/SHAMapStoreImp.h
+++ b/src/xrpld/app/misc/SHAMapStoreImp.h
@@ -101,10 +101,12 @@ private:
     std::uint32_t deleteBatch_ = 100;
     std::chrono::milliseconds backOff_{100};
     std::chrono::seconds ageThreshold_{60};
-    /// If  the node is out of sync during an online_delete healthWait()
-    /// call, sleep the thread for this time, and continue checking until
-    /// recovery.
-    /// See also: "recovery_wait_seconds" in xrpld-example.cfg
+    /**
+     * If  the node is out of sync during an online_delete healthWait()
+     * call, sleep the thread for this time, and continue checking until
+     * recovery.
+     * See also: "recovery_wait_seconds" in xrpld-example.cfg
+     */
     std::chrono::seconds recoveryWaitTime_{5};
 
     // these do not exist upon SHAMapStore creation, but do exist
@@ -197,7 +199,8 @@ private:
         return false;
     }
 
-    /** delete from sqlite table in batches to not lock the db excessively.
+    /**
+     * delete from sqlite table in batches to not lock the db excessively.
      *  Pause briefly to extend access time to other users.
      *  Call with mutex object unlocked.
      */
diff --git a/src/xrpld/app/misc/Transaction.h b/src/xrpld/app/misc/Transaction.h
index ab0fa1f4d8..b6b6d1a8d5 100644
--- a/src/xrpld/app/misc/Transaction.h
+++ b/src/xrpld/app/misc/Transaction.h
@@ -310,38 +310,46 @@ public:
     {
         std::variant<std::pair<uint256, uint32_t>, ClosedInterval<uint32_t>> locator;
 
-        // @return true if transaction was found, false otherwise
-        //
-        // Call this function first to determine the type of the contained info.
-        // Calling the wrong getter function will throw an exception.
-        // See documentation for the getter functions for more details
+        /**
+         * @return true if transaction was found, false otherwise
+         *
+         * Call this function first to determine the type of the contained info.
+         * Calling the wrong getter function will throw an exception.
+         * See documentation for the getter functions for more details
+         */
         [[nodiscard]] bool
         isFound() const
         {
             return std::holds_alternative<std::pair<uint256, uint32_t>>(locator);
         }
 
-        // @return key used to find transaction in nodestore
-        //
-        // Throws if isFound() returns false
+        /**
+         * @return key used to find transaction in nodestore
+         *
+         * @throws if isFound() returns false
+         */
         uint256 const&
         getNodestoreHash()
         {
             return std::get<std::pair<uint256, uint32_t>>(locator).first;
         }
 
-        // @return sequence of ledger containing the transaction
-        //
-        // Throws is isFound() returns false
+        /**
+         * @return sequence of ledger containing the transaction
+         *
+         * @throws if isFound() returns false
+         */
         uint32_t
         getLedgerSequence()
         {
             return std::get<std::pair<uint256, uint32_t>>(locator).second;
         }
 
-        // @return range of ledgers searched
-        //
-        // Throws if isFound() returns true
+        /**
+         * @return range of ledgers searched
+         *
+         * @throws if isFound() returns true
+         */
         ClosedInterval<uint32_t> const&
         getLedgerRangeSearched()
         {
@@ -400,7 +408,9 @@ private:
     */
     bool applying_ = false;
 
-    /** different ways for transaction to be accepted */
+    /**
+     * different ways for transaction to be accepted
+     */
     SubmitResult submitResult_;
 
     std::optional<CurrentLedgerState> currentLedgerState_;
diff --git a/src/xrpld/app/misc/TxQ.h b/src/xrpld/app/misc/TxQ.h
index 135cd592f0..65b4e9778c 100644
--- a/src/xrpld/app/misc/TxQ.h
+++ b/src/xrpld/app/misc/TxQ.h
@@ -37,160 +37,203 @@ class Application;
 class Config;
 
 /**
-    Transaction Queue. Used to manage transactions in conjunction with
-    fee escalation.
-
-    Once enough transactions are added to the open ledger, the required
-    fee will jump dramatically. If additional transactions are added,
-    the fee will grow exponentially from there.
-
-    Transactions that don't have a high enough fee to be applied to
-    the ledger are added to the queue in order from highest fee level to
-    lowest. Whenever a new ledger is accepted as validated, transactions
-    are first applied from the queue to the open ledger in fee level order
-    until either all transactions are applied or the fee again jumps
-    too high for the remaining transactions.
-
-    For further information and a high-level overview of how transactions
-    are processed with the `TxQ`, see FeeEscalation.md
-*/
+ * Transaction Queue. Used to manage transactions in conjunction with
+ * fee escalation.
+ *
+ * Once enough transactions are added to the open ledger, the required
+ * fee will jump dramatically. If additional transactions are added,
+ * the fee will grow exponentially from there.
+ *
+ * Transactions that don't have a high enough fee to be applied to
+ * the ledger are added to the queue in order from highest fee level to
+ * lowest. Whenever a new ledger is accepted as validated, transactions
+ * are first applied from the queue to the open ledger in fee level order
+ * until either all transactions are applied or the fee again jumps
+ * too high for the remaining transactions.
+ *
+ * For further information and a high-level overview of how transactions
+ * are processed with the `TxQ`, see FeeEscalation.md
+ */
 class TxQ
 {
 public:
-    /// Fee level for single-signed reference transaction.
+    /**
+     * Fee level for single-signed reference transaction.
+     */
     static constexpr FeeLevel64 kBaseLevel{256};
 
     /**
-        Structure used to customize @ref TxQ behavior.
-    */
+     * Structure used to customize @ref TxQ behavior.
+     */
     struct Setup
     {
-        /// Default constructor
+        /**
+         * Default constructor
+         */
         explicit Setup() = default;
 
-        /** Number of ledgers' worth of transactions to allow
-            in the queue. For example, if the last ledger had
-            150 transactions, then up to 3000 transactions can
-            be queued.
-
-            Can be overridden by @ref queueSizeMin
-        */
+        /**
+         * Number of ledgers' worth of transactions to allow
+         * in the queue. For example, if the last ledger had
+         * 150 transactions, then up to 3000 transactions can
+         * be queued.
+         *
+         * Can be overridden by @ref queueSizeMin
+         */
         std::size_t ledgersInQueue = 20;
-        /** The smallest limit the queue is allowed.
-
-            Will allow more than `ledgersInQueue` in the queue
-            if ledgers are small.
-        */
+        /**
+         * The smallest limit the queue is allowed.
+         *
+         * Will allow more than `ledgersInQueue` in the queue
+         * if ledgers are small.
+         */
         std::size_t queueSizeMin = 2000;
-        /** Extra percentage required on the fee level of a queued
-            transaction to replace that transaction with another
-            with the same SeqProxy.
-
-            If queued transaction for account "Alice" with seq 45
-            has a fee level of 512, a replacement transaction for
-            "Alice" with seq 45 must have a fee level of at least
-            512 * (1 + 0.25) = 640 to be considered.
-        */
+        /**
+         * Extra percentage required on the fee level of a queued
+         * transaction to replace that transaction with another
+         * with the same SeqProxy.
+         *
+         * If queued transaction for account "Alice" with seq 45
+         * has a fee level of 512, a replacement transaction for
+         * "Alice" with seq 45 must have a fee level of at least
+         * 512 * (1 + 0.25) = 640 to be considered.
+         */
         std::uint32_t retrySequencePercent = 25;
-        /// Minimum value of the escalation multiplier, regardless
-        /// of the prior ledger's median fee level.
+        /**
+         * Minimum value of the escalation multiplier, regardless
+         * of the prior ledger's median fee level.
+         */
         FeeLevel64 minimumEscalationMultiplier = kBaseLevel * 500;
-        /// Minimum number of transactions to allow into the ledger
-        /// before escalation, regardless of the prior ledger's size.
+        /**
+         * Minimum number of transactions to allow into the ledger
+         * before escalation, regardless of the prior ledger's size.
+         */
         std::uint32_t minimumTxnInLedger = 32;
-        /// Like @ref minimumTxnInLedger for standalone mode.
-        /// Primarily so that tests don't need to worry about queuing.
+        /**
+         * Like @ref minimumTxnInLedger for standalone mode.
+         * Primarily so that tests don't need to worry about queuing.
+         */
         std::uint32_t minimumTxnInLedgerSA = 1000;
-        /// Number of transactions per ledger that fee escalation "works
-        /// towards".
+        /**
+         * Number of transactions per ledger that fee escalation "works
+         * towards".
+         */
         std::uint32_t targetTxnInLedger = 256;
-        /** Optional maximum allowed value of transactions per ledger before
-            fee escalation kicks in. By default, the maximum is an emergent
-            property of network, validator, and consensus performance. This
-            setting can override that behavior to prevent fee escalation from
-            allowing more than `maximumTxnInLedger` "cheap" transactions into
-            the open ledger.
-
-            @todo ximinez. This setting seems to go against our goals and
-                values. Can it be removed?
-        */
+        /**
+         * Optional maximum allowed value of transactions per ledger before
+         * fee escalation kicks in. By default, the maximum is an emergent
+         * property of network, validator, and consensus performance. This
+         * setting can override that behavior to prevent fee escalation from
+         * allowing more than `maximumTxnInLedger` "cheap" transactions into
+         * the open ledger.
+         *
+         * @todo ximinez. This setting seems to go against our goals and
+         *     values. Can it be removed?
+         */
         std::optional<std::uint32_t> maximumTxnInLedger;
-        /** When the ledger has more transactions than "expected", and
-            performance is humming along nicely, the expected ledger size
-            is updated to the previous ledger size plus this percentage.
-
-            Calculations are subject to configured limits, and the recent
-            transactions counts buffer.
-
-            Example: If the "expectation" is for 500 transactions, and a
-            ledger is validated normally with 501 transactions, then the
-            expected ledger size will be updated to 601.
-        */
+        /**
+         * When the ledger has more transactions than "expected", and
+         * performance is humming along nicely, the expected ledger size
+         * is updated to the previous ledger size plus this percentage.
+         *
+         * Calculations are subject to configured limits, and the recent
+         * transactions counts buffer.
+         *
+         * Example: If the "expectation" is for 500 transactions, and a
+         * ledger is validated normally with 501 transactions, then the
+         * expected ledger size will be updated to 601.
+         */
         std::uint32_t normalConsensusIncreasePercent = 20;
-        /** When consensus takes longer than appropriate, the expected
-            ledger size is updated to the lesser of the previous ledger
-            size and the current expected ledger size minus this
-            percentage.
-
-            Calculations are subject to configured limits.
-
-            Example: If the ledger has 15000 transactions, and it is
-            validated slowly, then the expected ledger size will be
-            updated to 7500. If there are only 6 transactions, the
-            expected ledger size will be updated to 5, assuming the
-            default minimum.
-        */
+        /**
+         * When consensus takes longer than appropriate, the expected
+         * ledger size is updated to the lesser of the previous ledger
+         * size and the current expected ledger size minus this
+         * percentage.
+         *
+         * Calculations are subject to configured limits.
+         *
+         * Example: If the ledger has 15000 transactions, and it is
+         * validated slowly, then the expected ledger size will be
+         * updated to 7500. If there are only 6 transactions, the
+         * expected ledger size will be updated to 5, assuming the
+         * default minimum.
+         */
         std::uint32_t slowConsensusDecreasePercent = 50;
-        /// Maximum number of transactions that can be queued by one account.
+        /**
+         * Maximum number of transactions that can be queued by one account.
+         */
         std::uint32_t maximumTxnPerAccount = 10;
-        /** Minimum difference between the current ledger sequence and a
-            transaction's `LastLedgerSequence` for the transaction to be
-            queueable. Decreases the chance a transaction will get queued
-            and broadcast only to expire before it gets a chance to be
-            processed.
-        */
+        /**
+         * Minimum difference between the current ledger sequence and a
+         * transaction's `LastLedgerSequence` for the transaction to be
+         * queueable. Decreases the chance a transaction will get queued
+         * and broadcast only to expire before it gets a chance to be
+         * processed.
+         */
         std::uint32_t minimumLastLedgerBuffer = 2;
-        /// Use standalone mode behavior.
+        /**
+         * Use standalone mode behavior.
+         */
         bool standAlone = false;
     };
 
     /**
-        Structure returned by @ref TxQ::getMetrics, expressed in
-        reference fee level units.
-    */
+     * Structure returned by @ref TxQ::getMetrics, expressed in
+     * reference fee level units.
+     */
     struct Metrics
     {
-        /// Default constructor
+        /**
+         * Default constructor
+         */
         explicit Metrics() = default;
 
-        /// Number of transactions in the queue
+        /**
+         * Number of transactions in the queue
+         */
         std::size_t txCount{};
-        /// Max transactions currently allowed in queue
+        /**
+         * Max transactions currently allowed in queue
+         */
         std::optional<std::size_t> txQMaxSize;
-        /// Number of transactions currently in the open ledger
+        /**
+         * Number of transactions currently in the open ledger
+         */
         std::size_t txInLedger{};
-        /// Number of transactions expected per ledger
+        /**
+         * Number of transactions expected per ledger
+         */
         std::size_t txPerLedger{};
-        /// Reference transaction fee level
+        /**
+         * Reference transaction fee level
+         */
         FeeLevel64 referenceFeeLevel{};
-        /// Minimum fee level for a transaction to be considered for
-        /// the open ledger or the queue
+        /**
+         * Minimum fee level for a transaction to be considered for
+         * the open ledger or the queue
+         */
         FeeLevel64 minProcessingFeeLevel{};
-        /// Median fee level of the last ledger
+        /**
+         * Median fee level of the last ledger
+         */
         FeeLevel64 medFeeLevel{};
-        /// Minimum fee level to get into the current open ledger,
-        /// bypassing the queue
+        /**
+         * Minimum fee level to get into the current open ledger,
+         * bypassing the queue
+         */
         FeeLevel64 openLedgerFeeLevel{};
     };
 
     /**
-        Structure that describes a transaction in the queue
-        waiting to be applied to the current open ledger.
-        A collection of these is returned by @ref TxQ::getTxs.
-    */
+     * Structure that describes a transaction in the queue
+     * waiting to be applied to the current open ledger.
+     * A collection of these is returned by @ref TxQ::getTxs.
+     */
     struct TxDetails
     {
-        /// Full initialization
+        /**
+         * Full initialization
+         */
         TxDetails(
             FeeLevel64 feeLevel,
             std::optional<LedgerIndex> const& lastValid,
@@ -213,60 +256,78 @@ public:
         {
         }
 
-        /// Fee level of the queued transaction
+        /**
+         * Fee level of the queued transaction
+         */
         FeeLevel64 feeLevel;
-        /// LastValidLedger field of the queued transaction, if any
+        /**
+         * LastValidLedger field of the queued transaction, if any
+         */
         std::optional<LedgerIndex> lastValid;
-        /** Potential @ref TxConsequences of applying the queued transaction
-            to the open ledger.
-        */
+        /**
+         * Potential @ref TxConsequences of applying the queued transaction
+         * to the open ledger.
+         */
         TxConsequences consequences;
-        /// The account the transaction is queued for
+        /**
+         * The account the transaction is queued for
+         */
         AccountID account;
-        /// SeqProxy of the transaction
+        /**
+         * SeqProxy of the transaction
+         */
         SeqProxy seqProxy;
-        /// The full transaction
+        /**
+         * The full transaction
+         */
         std::shared_ptr<STTx const> txn;
-        /** Number of times the transactor can return a retry / `ter` result
-            when attempting to apply this transaction to the open ledger
-            from the queue. If the transactor returns `ter` and no retries are
-            left, this transaction will be dropped.
-        */
+        /**
+         * Number of times the transactor can return a retry / `ter` result
+         * when attempting to apply this transaction to the open ledger
+         * from the queue. If the transactor returns `ter` and no retries are
+         * left, this transaction will be dropped.
+         */
         int retriesRemaining;
-        /** The *intermediate* result returned by @ref preflight before
-            this transaction was queued, or after it is queued, but before
-            a failed attempt to `apply` it to the open ledger. This will
-            usually be `tesSUCCESS`, but there are some edge cases where
-            it has another value. Those edge cases are interesting enough
-            that this value is made available here. Specifically, if the
-            `rules` change between attempts, `preflight` will be run again
-            in `TxQ::MaybeTx::apply`.
-        */
+        /**
+         * The *intermediate* result returned by @ref preflight before
+         * this transaction was queued, or after it is queued, but before
+         * a failed attempt to `apply` it to the open ledger. This will
+         * usually be `tesSUCCESS`, but there are some edge cases where
+         * it has another value. Those edge cases are interesting enough
+         * that this value is made available here. Specifically, if the
+         * `rules` change between attempts, `preflight` will be run again
+         * in `TxQ::MaybeTx::apply`.
+         */
         TER preflightResult;
-        /** If the transactor attempted to apply the transaction to the open
-            ledger from the queue and *failed*, then this is the transactor
-            result from the last attempt. Should never be a `tec`, `tef`,
-            `tem`, or `tesSUCCESS`, because those results cause the
-            transaction to be removed from the queue.
-        */
+        /**
+         * If the transactor attempted to apply the transaction to the open
+         * ledger from the queue and *failed*, then this is the transactor
+         * result from the last attempt. Should never be a `tec`, `tef`,
+         * `tem`, or `tesSUCCESS`, because those results cause the
+         * transaction to be removed from the queue.
+         */
         std::optional<TER> lastResult;
     };
 
-    /// Constructor
+    /**
+     * Constructor
+     */
     TxQ(Setup const& setup, beast::Journal j);
 
-    /// Destructor
+    /**
+     * Destructor
+     */
     virtual ~TxQ();
 
     /**
-        Add a new transaction to the open ledger, hold it in the queue,
-        or reject it.
-
-        @return A pair with the `TER` and a `bool` indicating
-                whether or not the transaction was applied to
-                the open ledger. If the transaction is queued,
-                will return `{ terQUEUED, false }`.
-    */
+     * Add a new transaction to the open ledger, hold it in the queue,
+     * or reject it.
+     *
+     * @return A pair with the `TER` and a `bool` indicating
+     *         whether or not the transaction was applied to
+     *         the open ledger. If the transaction is queued,
+     *         will return `{ terQUEUED, false }`.
+     */
     ApplyResult
     apply(
         Application& app,
@@ -276,39 +337,42 @@ public:
         beast::Journal j);
 
     /**
-        Fill the new open ledger with transactions from the queue.
-
-        @note As more transactions are applied to the ledger, the
-        required fee may increase. The required fee may rise above
-        the fee level of the queued items before the queue is emptied,
-        which will end the process, leaving those in the queue for
-        the next open ledger.
-
-        @return Whether any transactions were added to the `view`.
-    */
+     * Fill the new open ledger with transactions from the queue.
+     *
+     * @note As more transactions are applied to the ledger, the
+     * required fee may increase. The required fee may rise above
+     * the fee level of the queued items before the queue is emptied,
+     * which will end the process, leaving those in the queue for
+     * the next open ledger.
+     *
+     * @return Whether any transactions were added to the `view`.
+     */
     bool
     accept(Application& app, OpenView& view);
 
     /**
-        Update fee metrics and clean up the queue in preparation for
-        the next ledger.
-
-        @note Fee metrics are updated based on the fee levels of the
-        txs in the validated ledger and whether consensus is slow.
-        Maximum queue size is adjusted to be enough to hold
-        `ledgersInQueue` ledgers or `queueSizeMin` transactions.
-        Any transactions for which the `LastLedgerSequence` has
-        passed are removed from the queue, and any account objects
-        that have no candidates under them are removed.
-    */
+     * Update fee metrics and clean up the queue in preparation for
+     * the next ledger.
+     *
+     * @note Fee metrics are updated based on the fee levels of the
+     * txs in the validated ledger and whether consensus is slow.
+     * Maximum queue size is adjusted to be enough to hold
+     * `ledgersInQueue` ledgers or `queueSizeMin` transactions.
+     * Any transactions for which the `LastLedgerSequence` has
+     * passed are removed from the queue, and any account objects
+     * that have no candidates under them are removed.
+     */
     void
     processClosedLedger(Application& app, ReadView const& view, bool timeLeap);
 
-    /** Return the next sequence that would go in the TxQ for an account. */
+    /**
+     * Return the next sequence that would go in the TxQ for an account.
+     */
     SeqProxy
     nextQueuableSeq(SLE::const_ref sleAccount) const;
 
-    /** Returns fee metrics in reference fee level units.
+    /**
+     * Returns fee metrics in reference fee level units.
      */
     Metrics
     getMetrics(OpenView const& view) const;
@@ -327,33 +391,36 @@ public:
      * @param view current open ledger
      * @param tx the transaction
      * @return minimum required fee, first sequence in the ledger
-     *        and first available sequence
+     *         and first available sequence
      */
     FeeAndSeq
     getTxRequiredFeeAndSeq(OpenView const& view, std::shared_ptr<STTx const> const& tx) const;
 
-    /** Returns information about the transactions currently
-        in the queue for the account.
-
-        @returns Empty `vector` if the account has no transactions
-        in the queue.
-    */
+    /**
+     * Returns information about the transactions currently
+     * in the queue for the account.
+     *
+     * @return Empty `vector` if the account has no transactions
+     * in the queue.
+     */
     std::vector<TxDetails>
     getAccountTxs(AccountID const& account) const;
 
-    /** Returns information about all transactions currently
-        in the queue.
-
-        @returns Empty `vector` if there are no transactions
-        in the queue.
-    */
+    /**
+     * Returns information about all transactions currently
+     * in the queue.
+     *
+     * @return Empty `vector` if there are no transactions
+     * in the queue.
+     */
     std::vector<TxDetails>
     getTxs() const;
 
-    /** Summarize current fee metrics for the `fee` RPC command.
-
-        @returns a `Json objectvalue`
-    */
+    /**
+     * Summarize current fee metrics for the `fee` RPC command.
+     *
+     * @return a `Json objectvalue`
+     */
     json::Value
     doRPC(Application& app) const;
 
@@ -363,35 +430,51 @@ private:
     nextQueuableSeqImpl(SLE::const_ref sleAccount, std::scoped_lock<std::mutex> const&) const;
 
     /**
-        Track and use the fee escalation metrics of the
-        current open ledger. Does the work of scaling fees
-        as the open ledger grows.
-    */
+     * Track and use the fee escalation metrics of the
+     * current open ledger. Does the work of scaling fees
+     * as the open ledger grows.
+     */
     class FeeMetrics
     {
     private:
-        /// Minimum value of txnsExpected.
+        /**
+         * Minimum value of txnsExpected.
+         */
         std::size_t const minimumTxnCount_;
-        /// Number of transactions per ledger that fee escalation "works
-        /// towards".
+        /**
+         * Number of transactions per ledger that fee escalation "works
+         * towards".
+         */
         std::size_t const targetTxnCount_;
-        /// Maximum value of txnsExpected
+        /**
+         * Maximum value of txnsExpected
+         */
         std::optional<std::size_t> const maximumTxnCount_;
-        /// Number of transactions expected per ledger.
-        /// One more than this value will be accepted
-        /// before escalation kicks in.
+        /**
+         * Number of transactions expected per ledger.
+         * One more than this value will be accepted
+         * before escalation kicks in.
+         */
         std::size_t txnsExpected_;
-        /// Recent history of transaction counts that
-        /// exceed the targetTxnCount_
+        /**
+         * Recent history of transaction counts that
+         * exceed the targetTxnCount_
+         */
         boost::circular_buffer<std::size_t> recentTxnCounts_;
-        /// Based on the median fee of the LCL. Used
-        /// when fee escalation kicks in.
+        /**
+         * Based on the median fee of the LCL. Used
+         * when fee escalation kicks in.
+         */
         FeeLevel64 escalationMultiplier_;
-        /// Journal
+        /**
+         * Journal
+         */
         beast::Journal const j_;
 
     public:
-        /// Constructor
+        /**
+         * Constructor
+         */
         FeeMetrics(Setup const& setup, beast::Journal j)
             : minimumTxnCount_(
                   setup.standAlone ? setup.minimumTxnInLedgerSA : setup.minimumTxnInLedger)
@@ -412,20 +495,22 @@ private:
         }
 
         /**
-            Updates fee metrics based on the transactions in the ReadView
-            for use in fee escalation calculations.
-
-            @param app Xrpld Application object.
-            @param view View of the LCL that was just closed or received.
-            @param timeLeap Indicates that xrpld is under load so fees
-            should grow faster.
-            @param setup Customization params.
-        */
+         * Updates fee metrics based on the transactions in the ReadView
+         * for use in fee escalation calculations.
+         *
+         * @param app Xrpld Application object.
+         * @param view View of the LCL that was just closed or received.
+         * @param timeLeap Indicates that xrpld is under load so fees
+         * should grow faster.
+         * @param setup Customization params.
+         */
         std::size_t
         update(Application& app, ReadView const& view, bool timeLeap, TxQ::Setup const& setup);
 
-        /// Snapshot of the externally relevant FeeMetrics
-        /// fields at any given time.
+        /**
+         * Snapshot of the externally relevant FeeMetrics
+         * fields at any given time.
+         */
         struct Snapshot
         {
             // Number of transactions expected per ledger.
@@ -437,54 +522,57 @@ private:
             FeeLevel64 const escalationMultiplier;
         };
 
-        /// Get the current @ref Snapshot
+        /**
+         * Get the current @ref Snapshot
+         */
         [[nodiscard]] Snapshot
         getSnapshot() const
         {
             return {.txnsExpected = txnsExpected_, .escalationMultiplier = escalationMultiplier_};
         }
 
-        /** Use the number of transactions in the current open ledger
-            to compute the fee level a transaction must pay to bypass the
-            queue.
-
-            @param view Current open ledger.
-
-            @return A fee level value.
-        */
+        /**
+         * Use the number of transactions in the current open ledger
+         * to compute the fee level a transaction must pay to bypass the
+         * queue.
+         *
+         * @param view Current open ledger.
+         *
+         * @return A fee level value.
+         */
         static FeeLevel64
         scaleFeeLevel(Snapshot const& snapshot, OpenView const& view);
 
         /**
-            Computes the total fee level for all transactions in a series.
-            Assumes that there are already more than @ref txnsExpected_ txns
-            between the view and `extraCount`. If there aren't, the result
-            will be sensible (e.g. there won't be any underflows or
-            overflows), but the level will be higher than actually required.
-
-            @note A "series" is a set of transactions for the same account.
-                In the context of this function, the series is already in
-                the queue, and the series starts with the account's current
-                sequence number. This function is called by
-                @ref tryClearAccountQueueUpThruTx to figure out if a newly
-                submitted transaction is paying enough to get all of the queued
-                transactions plus itself out of the queue and into the open
-                ledger while accounting for the escalating fee as each one
-                is processed. The idea is that if a series of transactions
-                are taking too long to get out of the queue, a user can
-                "rescue" them without having to resubmit each one with an
-                individually higher fee.
-
-            @param view Current open / working ledger. (May be a sandbox.)
-            @param extraCount Number of additional transactions to count as
-                in the ledger. (If `view` is a sandbox, should be the number of
-                transactions in the parent ledger.)
-            @param seriesSize Total number of transactions in the series to be
-                processed.
-
-            @return A `std::pair` indicating
-                whether the calculation result overflows.
-        */
+         * Computes the total fee level for all transactions in a series.
+         * Assumes that there are already more than @ref txnsExpected_ txns
+         * between the view and `extraCount`. If there aren't, the result
+         * will be sensible (e.g. there won't be any underflows or
+         * overflows), but the level will be higher than actually required.
+         *
+         * @note A "series" is a set of transactions for the same account.
+         *     In the context of this function, the series is already in
+         *     the queue, and the series starts with the account's current
+         *     sequence number. This function is called by
+         *     @ref tryClearAccountQueueUpThruTx to figure out if a newly
+         *     submitted transaction is paying enough to get all of the queued
+         *     transactions plus itself out of the queue and into the open
+         *     ledger while accounting for the escalating fee as each one
+         *     is processed. The idea is that if a series of transactions
+         *     are taking too long to get out of the queue, a user can
+         *     "rescue" them without having to resubmit each one with an
+         *     individually higher fee.
+         *
+         * @param view Current open / working ledger. (May be a sandbox.)
+         * @param extraCount Number of additional transactions to count as
+         *     in the ledger. (If `view` is a sandbox, should be the number of
+         *     transactions in the parent ledger.)
+         * @param seriesSize Total number of transactions in the series to be
+         *     processed.
+         *
+         * @return A `std::pair` indicating
+         *     whether the calculation result overflows.
+         */
         static std::pair<bool, FeeLevel64>
         escalatedSeriesFeeLevel(
             Snapshot const& snapshot,
@@ -494,90 +582,112 @@ private:
     };
 
     /**
-        Represents a transaction in the queue which may be applied
-        later to the open ledger.
-    */
+     * Represents a transaction in the queue which may be applied
+     * later to the open ledger.
+     */
     class MaybeTx
     {
     public:
-        /// Used by the TxQ::FeeHook and TxQ::FeeMultiSet below
-        /// to put each MaybeTx object into more than one
-        /// set without copies, pointers, etc.
+        /**
+         * Used by the TxQ::FeeHook and TxQ::FeeMultiSet below
+         * to put each MaybeTx object into more than one
+         * set without copies, pointers, etc.
+         */
         boost::intrusive::set_member_hook<> byFeeListHook;
 
-        /// The complete transaction.
+        /**
+         * The complete transaction.
+         */
         std::shared_ptr<STTx const> txn;
 
-        /// Computed fee level that the transaction will pay.
+        /**
+         * Computed fee level that the transaction will pay.
+         */
         FeeLevel64 const feeLevel;
-        /// Transaction ID.
+        /**
+         * Transaction ID.
+         */
         TxID const txID;
-        /// Account submitting the transaction.
+        /**
+         * Account submitting the transaction.
+         */
         AccountID const account;
-        /// Expiration ledger for the transaction
-        /// (`sfLastLedgerSequence` field).
+        /**
+         * Expiration ledger for the transaction
+         * (`sfLastLedgerSequence` field).
+         */
         std::optional<LedgerIndex> const lastValid;
-        /// Transaction SeqProxy number
-        /// (`sfSequence` or `sfTicketSequence` field).
+        /**
+         * Transaction SeqProxy number
+         * (`sfSequence` or `sfTicketSequence` field).
+         */
         SeqProxy const seqProxy;
         /**
-            A transaction at the front of the queue will be given
-            several attempts to succeed before being dropped from
-            the queue. If dropped, one of the account's penalty
-            flags will be set, and other transactions may have
-            their `retriesRemaining` forced down as part of the
-            penalty.
-        */
+         * A transaction at the front of the queue will be given
+         * several attempts to succeed before being dropped from
+         * the queue. If dropped, one of the account's penalty
+         * flags will be set, and other transactions may have
+         * their `retriesRemaining` forced down as part of the
+         * penalty.
+         */
         int retriesRemaining{kRetriesAllowed};
-        /// Flags provided to `apply`. If the transaction is later
-        /// attempted with different flags, it will need to be
-        /// `preflight`ed again.
+        /**
+         * Flags provided to `apply`. If the transaction is later
+         * attempted with different flags, it will need to be
+         * `preflight`ed again.
+         */
         ApplyFlags const flags;
-        /** If the transactor attempted to apply the transaction to the open
-            ledger from the queue and *failed*, then this is the transactor
-            result from the last attempt. Should never be a `tec`, `tef`,
-            `tem`, or `tesSUCCESS`, because those results cause the
-            transaction to be removed from the queue.
-        */
+        /**
+         * If the transactor attempted to apply the transaction to the open
+         * ledger from the queue and *failed*, then this is the transactor
+         * result from the last attempt. Should never be a `tec`, `tef`,
+         * `tem`, or `tesSUCCESS`, because those results cause the
+         * transaction to be removed from the queue.
+         */
         std::optional<TER> lastResult;
-        /** Cached result of the `preflight` operation. Because
-            `preflight` is expensive, minimize the number of times
-            it needs to be done.
-            @invariant `pfResult` is never allowed to be empty. The
-                `std::optional` is leveraged to allow `emplace`d
-                construction and replacement without a copy
-                assignment operation.
-        */
+        /**
+         * Cached result of the `preflight` operation. Because
+         * `preflight` is expensive, minimize the number of times
+         * it needs to be done.
+         * @invariant `pfResult` is never allowed to be empty. The
+         *     `std::optional` is leveraged to allow `emplace`d
+         *     construction and replacement without a copy
+         *     assignment operation.
+         */
         std::optional<PreflightResult const> pfResult;
 
-        /** Starting retry count for newly queued transactions.
-
-            In TxQ::accept, the required fee level may be low
-            enough that this transaction gets a chance to apply
-            to the ledger, but it may get a retry ter result for
-            another reason (eg. insufficient balance). When that
-            happens, the transaction is left in the queue to try
-            again later, but it shouldn't be allowed to fail
-            indefinitely. The number of failures allowed is
-            essentially arbitrary. It should be large enough to
-            allow temporary failures to clear up, but small enough
-            that the queue doesn't fill up with stale transactions
-            which prevent lower fee level transactions from queuing.
-        */
+        /**
+         * Starting retry count for newly queued transactions.
+         *
+         * In TxQ::accept, the required fee level may be low
+         * enough that this transaction gets a chance to apply
+         * to the ledger, but it may get a retry ter result for
+         * another reason (eg. insufficient balance). When that
+         * happens, the transaction is left in the queue to try
+         * again later, but it shouldn't be allowed to fail
+         * indefinitely. The number of failures allowed is
+         * essentially arbitrary. It should be large enough to
+         * allow temporary failures to clear up, but small enough
+         * that the queue doesn't fill up with stale transactions
+         * which prevent lower fee level transactions from queuing.
+         */
         static constexpr int kRetriesAllowed = 10;
 
-        /** The hash of the parent ledger.
-
-           This is used to pseudo-randomize the transaction order when
-           populating byFee_, by XORing it with the transaction hash (txID).
-           Using a single static and doing the XOR operation every time was
-           tested to be as fast or faster than storing the computed "sort key",
-           and obviously uses less memory.
+        /**
+         * The hash of the parent ledger.
+         *
+         * This is used to pseudo-randomize the transaction order when
+         * populating byFee_, by XORing it with the transaction hash (txID).
+         * Using a single static and doing the XOR operation every time was
+         * tested to be as fast or faster than storing the computed "sort key",
+         * and obviously uses less memory.
          */
         static LedgerHash parentHashComp;
 
     public:
-        /// Constructor
+        /**
+         * Constructor
+         */
         MaybeTx(
             std::shared_ptr<STTx const> const&,
             TxID const& txID,
@@ -585,12 +695,16 @@ private:
             ApplyFlags const flags,
             PreflightResult const& pfResult);
 
-        /// Attempt to apply the queued transaction to the open ledger.
+        /**
+         * Attempt to apply the queued transaction to the open ledger.
+         */
         ApplyResult
         apply(Application& app, OpenView& view, beast::Journal j);
 
-        /// Potential @ref TxConsequences of applying this transaction
-        /// to the open ledger.
+        /**
+         * Potential @ref TxConsequences of applying this transaction
+         * to the open ledger.
+         */
         [[nodiscard]] TxConsequences const&
         consequences() const
         {
@@ -598,7 +712,9 @@ private:
                                             // pfResult is never empty
         }
 
-        /// Return a TxDetails based on contained information.
+        /**
+         * Return a TxDetails based on contained information.
+         */
         [[nodiscard]] TxDetails
         getTxDetails() const
         {
@@ -616,14 +732,19 @@ private:
         }
     };
 
-    /// Used for sorting @ref MaybeTx
+    /**
+     * Used for sorting @ref MaybeTx
+     */
     class OrderCandidates
     {
     public:
-        /// Default constructor
+        /**
+         * Default constructor
+         */
         explicit OrderCandidates() = default;
 
-        /** Sort @ref MaybeTx by `feeLevel` descending, then by
+        /**
+         * Sort @ref MaybeTx by `feeLevel` descending, then by
          * pseudo-randomized transaction ID ascending
          *
          * The transaction queue is ordered such that transactions
@@ -636,7 +757,6 @@ private:
          * unpredictable. This allows validators to build similar queues
          * in the same order, and thus have more similar initial
          * proposals.
-         *
          */
         bool
         operator()(MaybeTx const& lhs, MaybeTx const& rhs) const
@@ -647,17 +767,22 @@ private:
         }
     };
 
-    /** Used to represent an account to the queue, and stores the
-        transactions queued for that account by SeqProxy.
-    */
+    /**
+     * Used to represent an account to the queue, and stores the
+     * transactions queued for that account by SeqProxy.
+     */
     class TxQAccount
     {
     public:
         using TxMap = std::map<SeqProxy, MaybeTx>;
 
-        /// The account
+        /**
+         * The account
+         */
         AccountID const account;
-        /// Sequence number will be used as the key.
+        /**
+         * Sequence number will be used as the key.
+         */
         TxMap transactions;
         /* If this account has had any transaction retry more than
             `retriesAllowed` times so that it was dropped from the
@@ -675,38 +800,51 @@ private:
         bool dropPenalty = false;
 
     public:
-        /// Construct from a transaction
+        /**
+         * Construct from a transaction
+         */
         explicit TxQAccount(std::shared_ptr<STTx const> const& txn);
-        /// Construct from an account
+        /**
+         * Construct from an account
+         */
         explicit TxQAccount(AccountID const& account);
 
-        /// Return the number of transactions currently queued for this account
+        /**
+         * Return the number of transactions currently queued for this account
+         */
         [[nodiscard]] std::size_t
         getTxnCount() const
         {
             return transactions.size();
         }
 
-        /// Checks if this account has no transactions queued
+        /**
+         * Checks if this account has no transactions queued
+         */
         [[nodiscard]] bool
         empty() const
         {
             return getTxnCount() == 0u;
         }
 
-        /// Find the entry in transactions that precedes seqProx, if one does.
+        /**
+         * Find the entry in transactions that precedes seqProx, if one does.
+         */
         [[nodiscard]] TxMap::const_iterator
         getPrevTx(SeqProxy seqProx) const;
 
-        /// Add a transaction candidate to this account for queuing
+        /**
+         * Add a transaction candidate to this account for queuing
+         */
         MaybeTx&
         add(MaybeTx&&);
 
-        /** Remove the candidate with given SeqProxy value from this
-            account.
-
-            @return Whether a candidate was removed
-        */
+        /**
+         * Remove the candidate with given SeqProxy value from this
+         * account.
+         *
+         * @return Whether a candidate was removed
+         */
         bool
         remove(SeqProxy seqProx);
     };
@@ -743,56 +881,68 @@ private:
 
     using AccountMap = std::map<AccountID, TxQAccount>;
 
-    /// Setup parameters used to control the behavior of the queue
+    /**
+     * Setup parameters used to control the behavior of the queue
+     */
     Setup const setup_;
-    /// Journal
+    /**
+     * Journal
+     */
     beast::Journal const j_;
 
-    /** Tracks the current state of the queue.
-        @note This member must always and only be accessed under
-        locked mutex_
-    */
+    /**
+     * Tracks the current state of the queue.
+     * @note This member must always and only be accessed under
+     * locked mutex_
+     */
     FeeMetrics feeMetrics_;
-    /** The queue itself: the collection of transactions ordered
-        by fee level.
-        @note This member must always and only be accessed under
-        locked mutex_
-    */
+    /**
+     * The queue itself: the collection of transactions ordered
+     * by fee level.
+     * @note This member must always and only be accessed under
+     * locked mutex_
+     */
     FeeMultiSet byFee_;
-    /** All of the accounts which currently have any transactions
-        in the queue. Entries are created and destroyed dynamically
-        as transactions are added and removed.
-        @note This member must always and only be accessed under
-        locked mutex_
-    */
+    /**
+     * All of the accounts which currently have any transactions
+     * in the queue. Entries are created and destroyed dynamically
+     * as transactions are added and removed.
+     * @note This member must always and only be accessed under
+     * locked mutex_
+     */
     AccountMap byAccount_;
-    /** Maximum number of transactions allowed in the queue based
-        on the current metrics. If uninitialized, there is no limit,
-        but that condition cannot last for long in practice.
-        @note This member must always and only be accessed under
-        locked mutex_
-    */
+    /**
+     * Maximum number of transactions allowed in the queue based
+     * on the current metrics. If uninitialized, there is no limit,
+     * but that condition cannot last for long in practice.
+     * @note This member must always and only be accessed under
+     * locked mutex_
+     */
     std::optional<size_t> maxSize_;
 
     /**
-        parentHash_ used for logging only
-    */
+     * parentHash_ used for logging only
+     */
     LedgerHash parentHash_{beast::kZero};
 
-    /** Most queue operations are done under the master lock,
-        but use this mutex for the RPC "fee" command, which isn't.
-    */
+    /**
+     * Most queue operations are done under the master lock,
+     * but use this mutex for the RPC "fee" command, which isn't.
+     */
     std::mutex mutable mutex_;
 
 private:
-    /// Is the queue at least `fillPercentage` full?
+    /**
+     * Is the queue at least `fillPercentage` full?
+     */
     template <size_t FillPercentage = 100>
     bool
     isFull() const;
 
-    /** Checks if the indicated transaction fits the conditions
-        for being stored in the queue.
-    */
+    /**
+     * Checks if the indicated transaction fits the conditions
+     * for being stored in the queue.
+     */
     TER
     canBeHeld(
         STTx const&,
@@ -803,14 +953,19 @@ private:
         std::optional<TxQAccount::TxMap::iterator> const&,
         std::scoped_lock<std::mutex> const& lock);
 
-    /// Erase and return the next entry in byFee_ (lower fee level)
+    /**
+     * Erase and return the next entry in byFee_ (lower fee level)
+     */
     FeeMultiSet::iterator_type erase(FeeMultiSet::const_iterator_type);
-    /** Erase and return the next entry for the account (if fee level
-        is higher), or next entry in byFee_ (lower fee level).
-        Used to get the next "applicable" MaybeTx for accept().
-    */
+    /**
+     * Erase and return the next entry for the account (if fee level
+     * is higher), or next entry in byFee_ (lower fee level).
+     * Used to get the next "applicable" MaybeTx for accept().
+     */
     FeeMultiSet::iterator_type eraseAndAdvance(FeeMultiSet::const_iterator_type);
-    /// Erase a range of items, based on TxQAccount::TxMap iterators
+    /**
+     * Erase a range of items, based on TxQAccount::TxMap iterators
+     */
     TxQAccount::TxMap::iterator
     erase(
         TxQAccount& txQAccount,
@@ -818,10 +973,10 @@ private:
         TxQAccount::TxMap::const_iterator end);
 
     /**
-        All-or-nothing attempt to try to apply the queued txs for
-        `accountIter` up to and including `tx`.  Transactions following
-        `tx` are not cleared.
-    */
+     * All-or-nothing attempt to try to apply the queued txs for
+     * `accountIter` up to and including `tx`.  Transactions following
+     * `tx` are not cleared.
+     */
     ApplyResult
     tryClearAccountQueueUpThruTx(
         Application& app,
@@ -838,8 +993,8 @@ private:
 };
 
 /**
-    Build a @ref TxQ::Setup object from application configuration.
-*/
+ * Build a @ref TxQ::Setup object from application configuration.
+ */
 TxQ::Setup
 setupTxQ(Config const&);
 
diff --git a/src/xrpld/app/misc/ValidatorKeys.h b/src/xrpld/app/misc/ValidatorKeys.h
index df88ec33a3..100b16a511 100644
--- a/src/xrpld/app/misc/ValidatorKeys.h
+++ b/src/xrpld/app/misc/ValidatorKeys.h
@@ -13,9 +13,10 @@ namespace xrpl {
 
 class Config;
 
-/** Validator keys and manifest as set in configuration file.  Values will be
-    empty if not configured as a validator or not configured with a manifest.
-*/
+/**
+ * Validator keys and manifest as set in configuration file.  Values will be
+ * empty if not configured as a validator or not configured with a manifest.
+ */
 class ValidatorKeys
 {
 public:
diff --git a/src/xrpld/app/misc/ValidatorList.h b/src/xrpld/app/misc/ValidatorList.h
index 0db3eee284..3f9039eab8 100644
--- a/src/xrpld/app/misc/ValidatorList.h
+++ b/src/xrpld/app/misc/ValidatorList.h
@@ -46,31 +46,49 @@ class STValidation;
    The "better" dispositions have lower values than the
    "worse" dispositions */
 enum class ListDisposition {
-    /// List is valid
+    /**
+     * List is valid
+     */
     Accepted = 0,
 
-    /// List is expired, but has the largest non-pending sequence seen so far
+    /**
+     * List is expired, but has the largest non-pending sequence seen so far
+     */
     Expired,
 
-    /// List will be valid in the future
+    /**
+     * List will be valid in the future
+     */
     Pending,
 
-    /// Same sequence as current list
+    /**
+     * Same sequence as current list
+     */
     SameSequence,
 
-    /// Future sequence already seen
+    /**
+     * Future sequence already seen
+     */
     KnownSequence,
 
-    /// Trusted publisher key, but seq is too old
+    /**
+     * Trusted publisher key, but seq is too old
+     */
     Stale,
 
-    /// List signed by untrusted publisher key
+    /**
+     * List signed by untrusted publisher key
+     */
     Untrusted,
 
-    /// List version is not supported
+    /**
+     * List version is not supported
+     */
     UnsupportedVersion,
 
-    /// Invalid format or signature
+    /**
+     * Invalid format or signature
+     */
     Invalid
 };
 
@@ -95,7 +113,8 @@ enum class PublisherStatus {
 std::string
 to_string(ListDisposition disposition);
 
-/** Changes in trusted nodes after updating validator list
+/**
+ * Changes in trusted nodes after updating validator list
  */
 struct TrustChanges
 {
@@ -105,7 +124,9 @@ struct TrustChanges
     hash_set<NodeID> removed;
 };
 
-/** Used to represent the information stored in the blobs_v2 Json array */
+/**
+ * Used to represent the information stored in the blobs_v2 Json array
+ */
 struct ValidatorBlobInfo
 {
     // base-64 encoded JSON containing the validator list.
@@ -118,50 +139,50 @@ struct ValidatorBlobInfo
 };
 
 /**
-    Trusted Validators List
-    -----------------------
-
-    Xrpld accepts ledger proposals and validations from trusted validator
-    nodes. A ledger is considered fully-validated once the number of received
-    trusted validations for a ledger meets or exceeds a quorum value.
-
-    This class manages the set of validation public keys the local xrpld node
-    trusts. The list of trusted keys is populated using the keys listed in the
-    configuration file as well as lists signed by trusted publishers. The
-    trusted publisher public keys are specified in the config.
-
-    New lists are expected to include the following data:
-
-    @li @c "blob": Base64-encoded JSON string containing a @c "sequence", @c
-        "validFrom", @c "validUntil", and @c "validators" field. @c "validFrom"
-        contains the XRPL timestamp (seconds since January 1st, 2000 (00:00
-        UTC)) for when the list becomes valid. @c "validUntil" contains the
-        XRPL timestamp for when the list expires. @c "validators" contains
-        an array of objects with a @c "validation_public_key" and optional
-        @c "manifest" field. @c "validation_public_key" should be the
-        hex-encoded master public key. @c "manifest" should be the
-        base64-encoded validator manifest.
-
-    @li @c "manifest": Base64-encoded serialization of a manifest containing the
-        publisher's master and signing public keys.
-
-    @li @c "signature": Hex-encoded signature of the blob using the publisher's
-        signing key.
-
-    @li @c "version": 1
-
-    Individual validator lists are stored separately by publisher. The number of
-    lists on which a validator's public key appears is also tracked.
-
-    The list of trusted validation public keys is reset at the start of each
-    consensus round to take into account the latest known lists as well as the
-    set of validators from whom validations are being received. Listed
-    validation public keys are shuffled and then sorted by the number of lists
-    they appear on. (The shuffling makes the order/rank of validators with the
-    same number of listings non-deterministic.) A quorum value is calculated for
-    the new trusted validator list. If there is only one list, all listed keys
-    are trusted. Otherwise, the trusted list size is set to 125% of the quorum.
-*/
+ * Trusted Validators List
+ * -----------------------
+ *
+ * Xrpld accepts ledger proposals and validations from trusted validator
+ * nodes. A ledger is considered fully-validated once the number of received
+ * trusted validations for a ledger meets or exceeds a quorum value.
+ *
+ * This class manages the set of validation public keys the local xrpld node
+ * trusts. The list of trusted keys is populated using the keys listed in the
+ * configuration file as well as lists signed by trusted publishers. The
+ * trusted publisher public keys are specified in the config.
+ *
+ * New lists are expected to include the following data:
+ *
+ * @li @c "blob": Base64-encoded JSON string containing a @c "sequence", @c
+ *     "validFrom", @c "validUntil", and @c "validators" field. @c "validFrom"
+ *     contains the XRPL timestamp (seconds since January 1st, 2000 (00:00
+ *     UTC)) for when the list becomes valid. @c "validUntil" contains the
+ *     XRPL timestamp for when the list expires. @c "validators" contains
+ *     an array of objects with a @c "validation_public_key" and optional
+ *     @c "manifest" field. @c "validation_public_key" should be the
+ *     hex-encoded master public key. @c "manifest" should be the
+ *     base64-encoded validator manifest.
+ *
+ * @li @c "manifest": Base64-encoded serialization of a manifest containing the
+ *     publisher's master and signing public keys.
+ *
+ * @li @c "signature": Hex-encoded signature of the blob using the publisher's
+ *     signing key.
+ *
+ * @li @c "version": 1
+ *
+ * Individual validator lists are stored separately by publisher. The number of
+ * lists on which a validator's public key appears is also tracked.
+ *
+ * The list of trusted validation public keys is reset at the start of each
+ * consensus round to take into account the latest known lists as well as the
+ * set of validators from whom validations are being received. Listed
+ * validation public keys are shuffled and then sorted by the number of lists
+ * they appear on. (The shuffling makes the order/rank of validators with the
+ * same number of listings non-deterministic.) A quorum value is calculated for
+ * the new trusted validator list. If there is only one list, all listed keys
+ * are trusted. Otherwise, the trusted list size is set to 125% of the quorum.
+ */
 class ValidatorList
 {
     struct PublisherList
@@ -276,11 +297,12 @@ public:
         std::optional<std::size_t> minimumQuorum = std::nullopt);
     ~ValidatorList() = default;
 
-    /** Describes the result of processing a Validator List (UNL),
-    including some of the information from the list which can
-    be used by the caller to know which list publisher is
-    involved.
-    */
+    /**
+     * Describes the result of processing a Validator List (UNL),
+     * including some of the information from the list which can
+     * be used by the caller to know which list publisher is
+     * involved.
+     */
     struct PublisherListStats
     {
         explicit PublisherListStats() = default;
@@ -314,23 +336,24 @@ public:
         std::size_t numVLs = 0;
     };
 
-    /** Load configured trusted keys.
-
-        @param localSigningKey This node's validation public key
-
-        @param configKeys List of trusted keys from config. Each entry
-        consists of a base58 encoded validation public key, optionally followed
-        by a comment.
-
-        @param publisherKeys List of trusted publisher public keys. Each
-        entry contains a base58 encoded account public key.
-
-        @par Thread Safety
-
-        May be called concurrently
-
-        @return `false` if an entry is invalid or unparsable
-    */
+    /**
+     * Load configured trusted keys.
+     *
+     * @param localSigningKey This node's validation public key
+     *
+     * @param configKeys List of trusted keys from config. Each entry
+     * consists of a base58 encoded validation public key, optionally followed
+     * by a comment.
+     *
+     * @param publisherKeys List of trusted publisher public keys. Each
+     * entry contains a base58 encoded account public key.
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     *
+     * @return `false` if an entry is invalid or unparsable
+     */
     bool
     load(
         std::optional<PublicKey> const& localSigningKey,
@@ -338,10 +361,11 @@ public:
         std::vector<std::string> const& publisherKeys,
         std::optional<std::size_t> listThreshold = {});
 
-    /** Pull the blob/signature/manifest information out of the appropriate Json
-        body fields depending on the version.
-
-        @return An empty vector indicates malformed Json.
+    /**
+     * Pull the blob/signature/manifest information out of the appropriate Json
+     * body fields depending on the version.
+     *
+     * @return An empty vector indicates malformed Json.
      */
     static std::vector<ValidatorBlobInfo>
     parseBlobs(std::uint32_t version, json::Value const& body);
@@ -375,35 +399,36 @@ public:
         std::vector<MessageWithHash>& messages,
         std::size_t maxSize = kMaximumMessageSize);
 
-    /** Apply multiple published lists of public keys, then broadcast it to all
-        peers that have not seen it or sent it.
-
-        @param manifest base64-encoded publisher key manifest
-
-        @param version Version of published list format
-
-        @param blobs Vector of BlobInfos representing one or more encoded
-            validator lists and signatures (and optional manifests)
-
-        @param siteUri Uri of the site from which the list was validated
-
-        @param hash Hash of the data parameters
-
-        @param overlay Overlay object which will handle sending the message
-
-        @param hashRouter HashRouter object which will determine which
-            peers not to send to
-
-        @param networkOPs NetworkOPs object which will be informed if there
-            is a valid VL
-
-        @return `ListDisposition::Accepted`, plus some of the publisher
-            information, if list was successfully applied
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Apply multiple published lists of public keys, then broadcast it to all
+     * peers that have not seen it or sent it.
+     *
+     * @param manifest base64-encoded publisher key manifest
+     *
+     * @param version Version of published list format
+     *
+     * @param blobs Vector of BlobInfos representing one or more encoded
+     *     validator lists and signatures (and optional manifests)
+     *
+     * @param siteUri Uri of the site from which the list was validated
+     *
+     * @param hash Hash of the data parameters
+     *
+     * @param overlay Overlay object which will handle sending the message
+     *
+     * @param hashRouter HashRouter object which will determine which
+     *     peers not to send to
+     *
+     * @param networkOPs NetworkOPs object which will be informed if there
+     *     is a valid VL
+     *
+     * @return `ListDisposition::Accepted`, plus some of the publisher
+     *     information, if list was successfully applied
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     PublisherListStats
     applyListsAndBroadcast(
         std::string const& manifest,
@@ -415,26 +440,27 @@ public:
         HashRouter& hashRouter,
         NetworkOPs& networkOPs);
 
-    /** Apply multiple published lists of public keys.
-
-        @param manifest base64-encoded publisher key manifest
-
-        @param version Version of published list format
-
-        @param blobs Vector of BlobInfos representing one or more encoded
-        validator lists and signatures (and optional manifests)
-
-        @param siteUri Uri of the site from which the list was validated
-
-        @param hash Optional hash of the data parameters
-
-        @return `ListDisposition::Accepted`, plus some of the publisher
-        information, if list was successfully applied
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Apply multiple published lists of public keys.
+     *
+     * @param manifest base64-encoded publisher key manifest
+     *
+     * @param version Version of published list format
+     *
+     * @param blobs Vector of BlobInfos representing one or more encoded
+     * validator lists and signatures (and optional manifests)
+     *
+     * @param siteUri Uri of the site from which the list was validated
+     *
+     * @param hash Optional hash of the data parameters
+     *
+     * @return `ListDisposition::Accepted`, plus some of the publisher
+     * information, if list was successfully applied
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     PublisherListStats
     applyLists(
         std::string const& manifest,
@@ -443,33 +469,35 @@ public:
         std::string siteUri,
         std::optional<uint256> const& hash = {});
 
-    /* Attempt to read previously stored list files. Expected to only be
-       called when loading from URL fails.
-
-       @return A list of valid file:// URLs, if any.
-
-       @par Thread Safety
-
-       May be called concurrently
-    */
+    /**
+     * Attempt to read previously stored list files. Expected to only be
+     * called when loading from URL fails.
+     *
+     * @return A list of valid file:// URLs, if any.
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     std::vector<std::string>
     loadLists();
 
-    /** Update trusted nodes
-
-        Reset the trusted nodes based on latest manifests, received validations,
-        and lists.
-
-        @param seenValidators Set of NodeIDs of validators that have signed
-        recently received validations
-
-        @return TrustedKeyChanges instance with newly trusted or untrusted
-        node identities.
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Update trusted nodes
+     *
+     * Reset the trusted nodes based on latest manifests, received validations,
+     * and lists.
+     *
+     * @param seenValidators Set of NodeIDs of validators that have signed
+     * recently received validations
+     *
+     * @return TrustedKeyChanges instance with newly trusted or untrusted
+     * node identities.
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     TrustChanges
     updateTrusted(
         hash_set<NodeID> const& seenValidators,
@@ -478,139 +506,148 @@ public:
         Overlay& overlay,
         HashRouter& hashRouter);
 
-    /** Get quorum value for current trusted key set
-
-        The quorum is the minimum number of validations needed for a ledger to
-        be fully validated. It can change when the set of trusted validation
-        keys is updated (at the start of each consensus round) and primarily
-        depends on the number of trusted keys.
-
-        @par Thread Safety
-
-        May be called concurrently
-
-        @return quorum value
-    */
+    /**
+     * Get quorum value for current trusted key set
+     *
+     * The quorum is the minimum number of validations needed for a ledger to
+     * be fully validated. It can change when the set of trusted validation
+     * keys is updated (at the start of each consensus round) and primarily
+     * depends on the number of trusted keys.
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     *
+     * @return quorum value
+     */
     std::size_t
     quorum() const
     {
         return quorum_;
     }
 
-    /** Returns `true` if public key is trusted
-
-        @param identity Validation public key
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Returns `true` if public key is trusted
+     *
+     * @param identity Validation public key
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     bool
     trusted(PublicKey const& identity) const;
 
-    /** Returns `true` if public key is included on any lists
-
-        @param identity Validation public key
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Returns `true` if public key is included on any lists
+     *
+     * @param identity Validation public key
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     bool
     listed(PublicKey const& identity) const;
 
-    /** Returns master public key if public key is trusted
-
-        @param identity Validation public key
-
-        @return `std::nullopt` if key is not trusted
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Returns master public key if public key is trusted
+     *
+     * @param identity Validation public key
+     *
+     * @return `std::nullopt` if key is not trusted
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     std::optional<PublicKey>
     getTrustedKey(PublicKey const& identity) const;
 
-    /** Returns listed master public if public key is included on any lists
-
-        @param identity Validation public key
-
-        @return `std::nullopt` if key is not listed
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Returns listed master public if public key is included on any lists
+     *
+     * @param identity Validation public key
+     *
+     * @return `std::nullopt` if key is not listed
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     std::optional<PublicKey>
     getListedKey(PublicKey const& identity) const;
 
-    /** Returns `true` if public key is a trusted publisher
-
-        @param identity Publisher public key
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Returns `true` if public key is a trusted publisher
+     *
+     * @param identity Publisher public key
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     bool
     trustedPublisher(PublicKey const& identity) const;
 
-    /** This function returns the local validator public key
+    /**
+     * This function returns the local validator public key
      * or a std::nullopt
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+     *
+     *    @par Thread Safety
+     *
+     *    May be called concurrently
+     */
     std::optional<PublicKey>
     localPublicKey() const;
 
-    /** Invokes the callback once for every listed validation public key.
-
-        @note Undefined behavior results when calling ValidatorList members from
-        within the callback
-
-        The arguments passed into the lambda are:
-
-        @li The validation public key
-
-        @li A boolean indicating whether this is a trusted key
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Invokes the callback once for every listed validation public key.
+     *
+     * @note Undefined behavior results when calling ValidatorList members from
+     * within the callback
+     *
+     * The arguments passed into the lambda are:
+     *
+     * @li The validation public key
+     *
+     * @li A boolean indicating whether this is a trusted key
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     void
     forEachListed(std::function<void(PublicKey const&, bool)> func) const;
 
-    /** Invokes the callback once for every available publisher list's raw
-        data members
-
-        @note Undefined behavior results when calling ValidatorList members
-        from within the callback
-
-        The arguments passed into the lambda are:
-
-        @li The raw manifest string
-
-        @li The raw "blob" string containing the values for the validator list
-
-        @li The signature string used to sign the blob
-
-        @li The version number
-
-        @li The `PublicKey` of the blob signer (matches the value from
-            [validator_list_keys])
-
-        @li The sequence number of the "blob"
-
-        @li The precomputed hash of the original / raw elements
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Invokes the callback once for every available publisher list's raw
+     * data members
+     *
+     * @note Undefined behavior results when calling ValidatorList members
+     * from within the callback
+     *
+     * The arguments passed into the lambda are:
+     *
+     * @li The raw manifest string
+     *
+     * @li The raw "blob" string containing the values for the validator list
+     *
+     * @li The signature string used to sign the blob
+     *
+     * @li The version number
+     *
+     * @li The `PublicKey` of the blob signer (matches the value from
+     *     [validator_list_keys])
+     *
+     * @li The sequence number of the "blob"
+     *
+     * @li The precomputed hash of the original / raw elements
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     void
     forEachAvailable(
         std::function<void(
@@ -621,38 +658,44 @@ public:
             std::size_t maxSequence,
             uint256 const& hash)> func) const;
 
-    /** Returns the current valid list for the given publisher key,
-        if available, as a Json object.
-    */
+    /**
+     * Returns the current valid list for the given publisher key,
+     * if available, as a Json object.
+     */
     std::optional<json::Value>
     getAvailable(std::string_view pubKey, std::optional<std::uint32_t> forceVersion = {});
 
-    /** Return the number of configured validator list sites. */
+    /**
+     * Return the number of configured validator list sites.
+     */
     std::size_t
     count() const;
 
-    /** Return the time when the validator list will expire
-
-        @note This may be a time in the past if a published list has not
-        been updated since its validUntil. It will be std::nullopt if any
-        configured published list has not been fetched.
-
-        @par Thread Safety
-        May be called concurrently
-    */
+    /**
+     * Return the time when the validator list will expire
+     *
+     * @note This may be a time in the past if a published list has not
+     * been updated since its validUntil. It will be std::nullopt if any
+     * configured published list has not been fetched.
+     *
+     * @par Thread Safety
+     * May be called concurrently
+     */
     std::optional<TimeKeeper::time_point>
     expires() const;
 
-    /** Return a JSON representation of the state of the validator list
-
-        @par Thread Safety
-        May be called concurrently
-    */
+    /**
+     * Return a JSON representation of the state of the validator list
+     *
+     * @par Thread Safety
+     * May be called concurrently
+     */
     json::Value
     getJson() const;
 
     using QuorumKeys = std::pair<std::size_t const, hash_set<PublicKey>>;
-    /** Get the quorum and all of the trusted keys.
+    /**
+     * Get the quorum and all of the trusted keys.
      *
      * @return quorum and keys.
      */
@@ -701,68 +744,74 @@ public:
     negativeUNLFilter(std::vector<std::shared_ptr<STValidation>>&& validations) const;
 
 private:
-    /** Return the number of configured validator list sites. */
+    /**
+     * Return the number of configured validator list sites.
+     */
     std::size_t
     count(shared_lock const&) const;
 
-    /** Returns `true` if public key is trusted
-
-    @param identity Validation public key
-
-    @par Thread Safety
-
-    May be called concurrently
-    */
+    /**
+     * Returns `true` if public key is trusted
+     *
+     * @param identity Validation public key
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     bool
     trusted(shared_lock const&, PublicKey const& identity) const;
 
-    /** Returns master public key if public key is trusted
-
-    @param identity Validation public key
-
-    @return `std::nullopt` if key is not trusted
-
-    @par Thread Safety
-
-    May be called concurrently
-    */
+    /**
+     * Returns master public key if public key is trusted
+     *
+     * @param identity Validation public key
+     *
+     * @return `std::nullopt` if key is not trusted
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     std::optional<PublicKey>
     getTrustedKey(shared_lock const&, PublicKey const& identity) const;
 
-    /** Return the time when the validator list will expire
-
-    @note This may be a time in the past if a published list has not
-    been updated since its expiration. It will be std::nullopt if any
-    configured published list has not been fetched.
-
-    @par Thread Safety
-    May be called concurrently
-    */
+    /**
+     * Return the time when the validator list will expire
+     *
+     * @note This may be a time in the past if a published list has not
+     * been updated since its expiration. It will be std::nullopt if any
+     * configured published list has not been fetched.
+     *
+     * @par Thread Safety
+     * May be called concurrently
+     */
     std::optional<TimeKeeper::time_point>
     expires(shared_lock const&) const;
 
-    /** Apply published list of public keys
-
-        @param manifest base64-encoded publisher key manifest
-
-        @param blob base64-encoded json containing published validator list
-
-        @param signature Signature of the decoded blob
-
-        @param version Version of published list format
-
-        @param siteUri Uri of the site from which the list was validated
-
-        @param hash Optional hash of the data parameters.
-            Defaults to uninitialized
-
-        @return `ListDisposition::Accepted`, plus some of the publisher
-            information, if list was successfully applied
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Apply published list of public keys
+     *
+     * @param manifest base64-encoded publisher key manifest
+     *
+     * @param blob base64-encoded json containing published validator list
+     *
+     * @param signature Signature of the decoded blob
+     *
+     * @param version Version of published list format
+     *
+     * @param siteUri Uri of the site from which the list was validated
+     *
+     * @param hash Optional hash of the data parameters.
+     *     Defaults to uninitialized
+     *
+     * @return `ListDisposition::Accepted`, plus some of the publisher
+     *     information, if list was successfully applied
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     PublisherListStats
     applyList(
         std::string const& globalManifest,
@@ -814,23 +863,26 @@ private:
         HashRouter& hashRouter,
         beast::Journal j);
 
-    /** Get the filename used for caching UNLs
+    /**
+     * Get the filename used for caching UNLs
      */
     boost::filesystem::path
     getCacheFileName(scoped_lock const&, PublicKey const& pubKey) const;
 
-    /** Build a Json representation of the collection, suitable for
-        writing to a cache file, or serving to a /vl/ query
-    */
+    /**
+     * Build a Json representation of the collection, suitable for
+     * writing to a cache file, or serving to a /vl/ query
+     */
     static json::Value
     buildFileData(
         std::string const& pubKey,
         PublisherListCollection const& pubCollection,
         beast::Journal j);
 
-    /** Build a Json representation of the collection, suitable for
-    writing to a cache file, or serving to a /vl/ query
-    */
+    /**
+     * Build a Json representation of the collection, suitable for
+     * writing to a cache file, or serving to a /vl/ query
+     */
     static json::Value
     buildFileData(
         std::string const& pubKey,
@@ -846,19 +898,21 @@ private:
         hash_append(h, pl.rawManifest, buildBlobInfos(pl), pl.rawVersion);
     }
 
-    /** Write a JSON UNL to a cache file
+    /**
+     * Write a JSON UNL to a cache file
      */
     void
     cacheValidatorFile(scoped_lock const& lock, PublicKey const& pubKey) const;
 
-    /** Check response for trusted valid published list
-
-        @return `ListDisposition::Accepted` if list can be applied
-
-        @par Thread Safety
-
-        Calling public member function is expected to lock mutex
-    */
+    /**
+     * Check response for trusted valid published list
+     *
+     * @return `ListDisposition::Accepted` if list can be applied
+     *
+     * @par Thread Safety
+     *
+     * Calling public member function is expected to lock mutex
+     */
     std::pair<ListDisposition, std::optional<PublicKey>>
     verify(
         scoped_lock const&,
@@ -867,29 +921,31 @@ private:
         std::string const& blob,
         std::string const& signature);
 
-    /** Stop trusting publisher's list of keys.
-
-        @param publisherKey Publisher public key
-
-        @return `false` if key was not trusted
-
-        @par Thread Safety
-
-        Calling public member function is expected to lock mutex
-    */
+    /**
+     * Stop trusting publisher's list of keys.
+     *
+     * @param publisherKey Publisher public key
+     *
+     * @return `false` if key was not trusted
+     *
+     * @par Thread Safety
+     *
+     * Calling public member function is expected to lock mutex
+     */
     bool
     removePublisherList(scoped_lock const&, PublicKey const& publisherKey, PublisherStatus reason);
 
-    /** Return quorum for trusted validator set
-
-        @param unlSize Number of trusted validator keys
-
-        @param effectiveUnlSize Number of trusted validator keys that are not in
-        the NegativeUNL
-
-        @param seenSize Number of trusted validators that have signed
-        recently received validations
-    */
+    /**
+     * Return quorum for trusted validator set
+     *
+     * @param unlSize Number of trusted validator keys
+     *
+     * @param effectiveUnlSize Number of trusted validator keys that are not in
+     * the NegativeUNL
+     *
+     * @param seenSize Number of trusted validators that have signed
+     * recently received validations
+     */
     std::size_t
     calculateQuorum(std::size_t unlSize, std::size_t effectiveUnlSize, std::size_t seenSize);
 };
diff --git a/src/xrpld/app/misc/ValidatorSite.h b/src/xrpld/app/misc/ValidatorSite.h
index 7302ebbb52..7e7ad098eb 100644
--- a/src/xrpld/app/misc/ValidatorSite.h
+++ b/src/xrpld/app/misc/ValidatorSite.h
@@ -23,35 +23,35 @@
 namespace xrpl {
 
 /**
-    Validator Sites
-    ---------------
-
-    This class manages the set of configured remote sites used to fetch the
-    latest published recommended validator lists.
-
-    Lists are fetched at a regular interval.
-    Fetched lists are expected to be in JSON format and contain the following
-    fields:
-
-    @li @c "blob": Base64-encoded JSON string containing a @c "sequence", @c
-        "validUntil", and @c "validators" field. @c "validUntil" contains the
-        XRPL timestamp (seconds since January 1st, 2000 (00:00 UTC)) for when
-        the list expires. @c "validators" contains an array of objects with a
-        @c "validation_public_key" and optional @c "manifest" field.
-        @c "validation_public_key" should be the hex-encoded master public key.
-        @c "manifest" should be the base64-encoded validator manifest.
-
-    @li @c "manifest": Base64-encoded serialization of a manifest containing the
-        publisher's master and signing public keys.
-
-    @li @c "signature": Hex-encoded signature of the blob using the publisher's
-        signing key.
-
-    @li @c "version": 1
-
-    @li @c "refreshInterval" (optional, integer minutes).
-        This value is clamped internally to [1,1440] (1 min - 1 day)
-*/
+ * Validator Sites
+ * ---------------
+ *
+ * This class manages the set of configured remote sites used to fetch the
+ * latest published recommended validator lists.
+ *
+ * Lists are fetched at a regular interval.
+ * Fetched lists are expected to be in JSON format and contain the following
+ * fields:
+ *
+ * @li @c "blob": Base64-encoded JSON string containing a @c "sequence", @c
+ *     "validUntil", and @c "validators" field. @c "validUntil" contains the
+ *     XRPL timestamp (seconds since January 1st, 2000 (00:00 UTC)) for when
+ *     the list expires. @c "validators" contains an array of objects with a
+ *     @c "validation_public_key" and optional @c "manifest" field.
+ *     @c "validation_public_key" should be the hex-encoded master public key.
+ *     @c "manifest" should be the base64-encoded validator manifest.
+ *
+ * @li @c "manifest": Base64-encoded serialization of a manifest containing the
+ *     publisher's master and signing public keys.
+ *
+ * @li @c "signature": Hex-encoded signature of the blob using the publisher's
+ *     signing key.
+ *
+ * @li @c "version": 1
+ *
+ * @li @c "refreshInterval" (optional, integer minutes).
+ *     This value is clamped internally to [1,1440] (1 min - 1 day)
+ */
 class ValidatorSite
 {
     friend class Work;
@@ -79,17 +79,23 @@ private:
 
         explicit Site(std::string uri);
 
-        /// the original uri as loaded from config
+        /**
+         * the original uri as loaded from config
+         */
         std::shared_ptr<Resource> loadedResource;
 
-        /// the resource to request at <timer>
-        /// intervals. same as loadedResource
-        /// except in the case of a permanent redir.
+        /**
+         * the resource to request at <timer>
+         * intervals. same as loadedResource
+         * except in the case of a permanent redir.
+         */
         std::shared_ptr<Resource> startingResource;
 
-        /// the active resource being requested.
-        /// same as startingResource except
-        /// when we've gotten a temp redirect
+        /**
+         * the active resource being requested.
+         * same as startingResource except
+         * when we've gotten a temp redirect
+         */
         std::shared_ptr<Resource> activeResource;
 
         unsigned short redirCount{0};
@@ -132,74 +138,89 @@ public:
         std::chrono::seconds timeout = std::chrono::seconds{20});
     ~ValidatorSite();
 
-    /** Load configured site URIs.
-
-        @param siteURIs List of URIs to fetch published validator lists
-
-        @par Thread Safety
-
-        May be called concurrently
-
-        @return `false` if an entry is invalid or unparsable
-    */
+    /**
+     * Load configured site URIs.
+     *
+     * @param siteURIs List of URIs to fetch published validator lists
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     *
+     * @return `false` if an entry is invalid or unparsable
+     */
     bool
     load(std::vector<std::string> const& siteURIs);
 
-    /** Start fetching lists from sites
-
-        This does nothing if list fetching has already started
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Start fetching lists from sites
+     *
+     * This does nothing if list fetching has already started
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     void
     start();
 
-    /** Wait for current fetches from sites to complete
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Wait for current fetches from sites to complete
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     void
     join();
 
-    /** Stop fetching lists from sites
-
-        This blocks until list fetching has stopped
-
-        @par Thread Safety
-
-        May be called concurrently
-    */
+    /**
+     * Stop fetching lists from sites
+     *
+     * This blocks until list fetching has stopped
+     *
+     * @par Thread Safety
+     *
+     * May be called concurrently
+     */
     void
     stop();
 
-    /** Return JSON representation of configured validator sites
+    /**
+     * Return JSON representation of configured validator sites
      */
     json::Value
     getJson() const;
 
 private:
-    /// Load configured site URIs.
+    /**
+     * Load configured site URIs.
+     */
     bool
     load(std::vector<std::string> const& siteURIs, std::scoped_lock<std::mutex> const&);
 
-    /// Queue next site to be fetched
-    /// lock over site_mutex_ and state_mutex_ required
+    /**
+     * Queue next site to be fetched
+     * lock over site_mutex_ and state_mutex_ required
+     */
     void
     setTimer(std::scoped_lock<std::mutex> const&, std::scoped_lock<std::mutex> const&);
 
-    /// request took too long
+    /**
+     * request took too long
+     */
     void
     onRequestTimeout(std::size_t siteIdx, error_code const& ec);
 
-    /// Fetch site whose time has come
+    /**
+     * Fetch site whose time has come
+     */
     void
     onTimer(std::size_t siteIdx, error_code const& ec);
 
-    /// Store latest list fetched from site
+    /**
+     * Store latest list fetched from site
+     */
     void
     onSiteFetch(
         boost::system::error_code const& ec,
@@ -207,36 +228,46 @@ private:
         detail::response_type const& res,
         std::size_t siteIdx);
 
-    /// Store latest list fetched from anywhere
+    /**
+     * Store latest list fetched from anywhere
+     */
     void
     onTextFetch(boost::system::error_code const& ec, std::string const& res, std::size_t siteIdx);
 
-    /// Initiate request to given resource.
-    /// lock over sites_mutex_ required
+    /**
+     * Initiate request to given resource.
+     * lock over sites_mutex_ required
+     */
     void
     makeRequest(
         std::shared_ptr<Site::Resource> resource,
         std::size_t siteIdx,
         std::scoped_lock<std::mutex> const&);
 
-    /// Parse json response from validator list site.
-    /// lock over sites_mutex_ required
+    /**
+     * Parse json response from validator list site.
+     * lock over sites_mutex_ required
+     */
     void
     parseJsonResponse(
         std::string const& res,
         std::size_t siteIdx,
         std::scoped_lock<std::mutex> const&);
 
-    /// Interpret a redirect response.
-    /// lock over sites_mutex_ required
+    /**
+     * Interpret a redirect response.
+     * lock over sites_mutex_ required
+     */
     std::shared_ptr<Site::Resource>
     processRedirect(
         detail::response_type const& res,
         std::size_t siteIdx,
         std::scoped_lock<std::mutex> const&);
 
-    /// If no sites are provided, or a site fails to load,
-    /// get a list of local cache files from the ValidatorList.
+    /**
+     * If no sites are provided, or a site fails to load,
+     * get a list of local cache files from the ValidatorList.
+     */
     bool
     missingSite(std::scoped_lock<std::mutex> const&);
 };
diff --git a/src/xrpld/app/misc/detail/AmendmentTable.cpp b/src/xrpld/app/misc/detail/AmendmentTable.cpp
index 694268752e..4af556d3e7 100644
--- a/src/xrpld/app/misc/detail/AmendmentTable.cpp
+++ b/src/xrpld/app/misc/detail/AmendmentTable.cpp
@@ -81,24 +81,25 @@ parseSection(Section const& section)
     return names;
 }
 
-/** TrustedVotes records the most recent votes from trusted validators.
-    We keep a record in an effort to avoid "flapping" while amendment voting
-    is in process.
-
-    If a trusted validator loses synchronization near a flag ledger their
-    amendment votes may be lost during that round.  If the validator is a
-    bit flaky, then this can cause an amendment to appear to repeatedly
-    gain and lose support.
-
-    TrustedVotes addresses the problem by holding on to the last vote seen
-    from every trusted validator.  So if any given validator is off line near
-    a flag ledger we can assume that they did not change their vote.
-
-    If we haven't seen any STValidations from a validator for several hours we
-    lose confidence that the validator hasn't changed their position.  So
-    there's a timeout.  We remove upVotes if they haven't been updated in
-    several hours.
-*/
+/**
+ * TrustedVotes records the most recent votes from trusted validators.
+ * We keep a record in an effort to avoid "flapping" while amendment voting
+ * is in process.
+ *
+ * If a trusted validator loses synchronization near a flag ledger their
+ * amendment votes may be lost during that round.  If the validator is a
+ * bit flaky, then this can cause an amendment to appear to repeatedly
+ * gain and lose support.
+ *
+ * TrustedVotes addresses the problem by holding on to the last vote seen
+ * from every trusted validator.  So if any given validator is off line near
+ * a flag ledger we can assume that they did not change their vote.
+ *
+ * If we haven't seen any STValidations from a validator for several hours we
+ * lose confidence that the validator hasn't changed their position.  So
+ * there's a timeout.  We remove upVotes if they haven't been updated in
+ * several hours.
+ */
 class TrustedVotes
 {
 private:
@@ -107,10 +108,11 @@ private:
     struct UpvotesAndTimeout
     {
         std::vector<uint256> upVotes;
-        /** An unseated timeout indicates that either
-            1. No validations have ever been received
-            2. The validator has not been heard from in long enough that the
-               timeout passed, and votes expired.
+        /**
+         * An unseated timeout indicates that either
+         * 1. No validations have ever been received
+         * 2. The validator has not been heard from in long enough that the
+         *    timeout passed, and votes expired.
          */
         std::optional<NetClock::time_point> timeout;
     };
@@ -279,32 +281,42 @@ public:
     }
 };
 
-/** Current state of an amendment.
-    Tells if a amendment is supported, enabled or vetoed. A vetoed amendment
-    means the node will never announce its support.
-*/
+/**
+ * Current state of an amendment.
+ * Tells if a amendment is supported, enabled or vetoed. A vetoed amendment
+ * means the node will never announce its support.
+ */
 struct AmendmentState
 {
-    /** If an amendment is down-voted, a server will not vote to enable it */
+    /**
+     * If an amendment is down-voted, a server will not vote to enable it
+     */
     AmendmentVote vote = AmendmentVote::Down;
 
-    /** Indicates that the amendment has been enabled.
-        This is a one-way switch: once an amendment is enabled
-        it can never be disabled, but it can be superseded by
-        a subsequent amendment.
-    */
+    /**
+     * Indicates that the amendment has been enabled.
+     * This is a one-way switch: once an amendment is enabled
+     * it can never be disabled, but it can be superseded by
+     * a subsequent amendment.
+     */
     bool enabled = false;
 
-    /** Indicates an amendment that this server has code support for. */
+    /**
+     * Indicates an amendment that this server has code support for.
+     */
     bool supported = false;
 
-    /** The name of this amendment, possibly empty. */
+    /**
+     * The name of this amendment, possibly empty.
+     */
     std::string name;
 
     explicit AmendmentState() = default;
 };
 
-/** The status of all amendments requested in a given window. */
+/**
+ * The status of all amendments requested in a given window.
+ */
 class AmendmentSet
 {
 private:
@@ -376,12 +388,13 @@ public:
 
 //------------------------------------------------------------------------------
 
-/** Track the list of "amendments"
-
-   An "amendment" is an option that can affect transaction processing rules.
-   Amendments are proposed and then adopted or rejected by the network. An
-   Amendment is uniquely identified by its AmendmentID, a 256-bit key.
-*/
+/**
+ * Track the list of "amendments"
+ *
+ * An "amendment" is an option that can affect transaction processing rules.
+ * Amendments are proposed and then adopted or rejected by the network. An
+ * Amendment is uniquely identified by its AmendmentID, a 256-bit key.
+ */
 class AmendmentTableImpl final : public AmendmentTable
 {
 private:
diff --git a/src/xrpld/app/misc/setup_HashRouter.h b/src/xrpld/app/misc/setup_HashRouter.h
index 665366ba03..86c472da7f 100644
--- a/src/xrpld/app/misc/setup_HashRouter.h
+++ b/src/xrpld/app/misc/setup_HashRouter.h
@@ -7,7 +7,9 @@ namespace xrpl {
 // Forward declaration
 class Config;
 
-/** Create HashRouter setup from configuration */
+/**
+ * Create HashRouter setup from configuration
+ */
 HashRouter::Setup
 setupHashRouter(Config const& config);
 
diff --git a/src/xrpld/consensus/Consensus.h b/src/xrpld/consensus/Consensus.h
index fa41f25be1..440191939b 100644
--- a/src/xrpld/consensus/Consensus.h
+++ b/src/xrpld/consensus/Consensus.h
@@ -28,25 +28,26 @@
 
 namespace xrpl {
 
-/** Determines whether the current ledger should close at this time.
-
-    This function should be called when a ledger is open and there is no close
-    in progress, or when a transaction is received and no close is in progress.
-
-    @param anyTransactions indicates whether any transactions have been received
-    @param prevProposers proposers in the last closing
-    @param proposersClosed proposers who have currently closed this ledger
-    @param proposersValidated proposers who have validated the last closed
-                              ledger
-    @param prevRoundTime time for the previous ledger to reach consensus
-    @param timeSincePrevClose  time since the previous ledger's (possibly
-   rounded) close time
-    @param openTime     duration this ledger has been open
-    @param idleInterval the network's desired idle interval
-    @param parms        Consensus constant parameters
-    @param j            journal for logging
-    @param clog         log object to which to append
-*/
+/**
+ * Determines whether the current ledger should close at this time.
+ *
+ * This function should be called when a ledger is open and there is no close
+ * in progress, or when a transaction is received and no close is in progress.
+ *
+ * @param anyTransactions indicates whether any transactions have been received
+ * @param prevProposers proposers in the last closing
+ * @param proposersClosed proposers who have currently closed this ledger
+ * @param proposersValidated proposers who have validated the last closed
+ *                           ledger
+ * @param prevRoundTime time for the previous ledger to reach consensus
+ * @param timeSincePrevClose  time since the previous ledger's (possibly
+ * rounded) close time
+ * @param openTime     duration this ledger has been open
+ * @param idleInterval the network's desired idle interval
+ * @param parms        Consensus constant parameters
+ * @param j            journal for logging
+ * @param clog         log object to which to append
+ */
 bool
 shouldCloseLedger(
     bool anyTransactions,
@@ -61,25 +62,26 @@ shouldCloseLedger(
     beast::Journal j,
     std::unique_ptr<std::stringstream> const& clog = {});
 
-/** Determine whether the network reached consensus and whether we joined.
-
-    @param prevProposers proposers in the last closing (not including us)
-    @param currentProposers proposers in this closing so far (not including us)
-    @param currentAgree proposers who agree with us
-    @param currentFinished proposers who have validated a ledger after this one
-    @param previousAgreeTime how long, in milliseconds, it took to agree on the
-                             last ledger
-    @param currentAgreeTime how long, in milliseconds, we've been trying to
-                            agree
-    @param stalled the network appears to be stalled, where
-           neither we nor our peers have changed their vote on any disputes in a
-           while. This is undesirable, and should be rare, and will cause us to
-           end consensus without 80% agreement.
-    @param parms            Consensus constant parameters
-    @param proposing        whether we should count ourselves
-    @param j                journal for logging
-    @param clog             log object to which to append
-*/
+/**
+ * Determine whether the network reached consensus and whether we joined.
+ *
+ * @param prevProposers proposers in the last closing (not including us)
+ * @param currentProposers proposers in this closing so far (not including us)
+ * @param currentAgree proposers who agree with us
+ * @param currentFinished proposers who have validated a ledger after this one
+ * @param previousAgreeTime how long, in milliseconds, it took to agree on the
+ *                          last ledger
+ * @param currentAgreeTime how long, in milliseconds, we've been trying to
+ *                         agree
+ * @param stalled the network appears to be stalled, where
+ *        neither we nor our peers have changed their vote on any disputes in a
+ *        while. This is undesirable, and should be rare, and will cause us to
+ *        end consensus without 80% agreement.
+ * @param parms            Consensus constant parameters
+ * @param proposing        whether we should count ourselves
+ * @param j                journal for logging
+ * @param clog             log object to which to append
+ */
 ConsensusState
 checkConsensus(
     std::size_t prevProposers,
@@ -94,194 +96,195 @@ checkConsensus(
     beast::Journal j,
     std::unique_ptr<std::stringstream> const& clog = {});
 
-/** Generic implementation of consensus algorithm.
-
-  Achieves consensus on the next ledger.
-
-  Two things need consensus:
-
-    1.  The set of transactions included in the ledger.
-    2.  The close time for the ledger.
-
-  The basic flow:
-
-    1. A call to `startRound` places the node in the `Open` phase.  In this
-       phase, the node is waiting for transactions to include in its open
-       ledger.
-    2. Successive calls to `timerEntry` check if the node can close the ledger.
-       Once the node `Close`s the open ledger, it transitions to the
-       `Establish` phase.  In this phase, the node shares/receives peer
-       proposals on which transactions should be accepted in the closed ledger.
-    3. During a subsequent call to `timerEntry`, the node determines it has
-       reached consensus with its peers on which transactions to include. It
-       transitions to the `Accept` phase. In this phase, the node works on
-       applying the transactions to the prior ledger to generate a new closed
-       ledger. Once the new ledger is completed, the node shares the validated
-       ledger with the network, does some book-keeping, then makes a call to
-       `startRound` to start the cycle again.
-
-  This class uses a generic interface to allow adapting Consensus for specific
-  applications. The Adaptor template implements a set of helper functions that
-  plug the consensus algorithm into a specific application.  It also identifies
-  the types that play important roles in Consensus (transactions, ledgers, ...).
-  The code stubs below outline the interface and type requirements.  The traits
-  types must be copy constructible and assignable.
-
-  @warning The generic implementation is not thread safe and the public methods
-  are not intended to be run concurrently.  When in a concurrent environment,
-  the application is responsible for ensuring thread-safety.  Simply locking
-  whenever touching the Consensus instance is one option.
-
-  @code
-  // A single transaction
-  struct Tx
-  {
-    // Unique identifier of transaction
-    using ID = ...;
-
-    ID id() const;
-
-  };
-
-  // A set of transactions
-  struct TxSet
-  {
-    // Unique ID of TxSet (not of Tx)
-    using ID = ...;
-    // Type of individual transaction comprising the TxSet
-    using Tx = Tx;
-
-    bool exists(Tx::ID const &) const;
-    // Return value should have semantics like Tx const *
-    Tx const * find(Tx::ID const &) const ;
-    ID const & id() const;
-
-    // Return set of transactions that are not common to this set or other
-    // boolean indicates which set it was in
-    std::map<Tx::ID, bool> compare(TxSet const & other) const;
-
-    // A mutable view of transactions
-    struct MutableTxSet
-    {
-        MutableTxSet(TxSet const &);
-        bool insert(Tx const &);
-        bool erase(Tx::ID const &);
-    };
-
-    // Construct from a mutable view.
-    TxSet(MutableTxSet const &);
-
-    // Alternatively, if the TxSet is itself mutable
-    // just alias MutableTxSet = TxSet
-
-  };
-
-  // Agreed upon state that consensus transactions will modify
-  struct Ledger
-  {
-    using ID = ...;
-    using Seq = ...;
-
-    // Unique identifier of ledger
-    ID const id() const;
-    Seq seq() const;
-    auto closeTimeResolution() const;
-    auto closeAgree() const;
-    auto closeTime() const;
-    auto parentCloseTime() const;
-    json::Value getJson() const;
-  };
-
-  // Wraps a peer's ConsensusProposal
-  struct PeerPosition
-  {
-    ConsensusProposal<
-        std::uint32_t, //NodeID,
-        typename Ledger::ID,
-        typename TxSet::ID> const &
-    proposal() const;
-
-  };
-
-
-  class Adaptor
-  {
-  public:
-      //-----------------------------------------------------------------------
-      // Define consensus types
-      using Ledger_t = Ledger;
-      using NodeID_t = std::uint32_t;
-      using TxSet_t = TxSet;
-      using PeerPosition_t = PeerPosition;
-
-      //-----------------------------------------------------------------------
-      //
-      // Attempt to acquire a specific ledger.
-      std::optional<Ledger> acquireLedger(Ledger::ID const & ledgerID);
-
-      // Acquire the transaction set associated with a proposed position.
-      std::optional<TxSet> acquireTxSet(TxSet::ID const & setID);
-
-      // Whether any transactions are in the open ledger
-      bool hasOpenTransactions() const;
-
-      // Number of proposers that have validated the given ledger
-      std::size_t proposersValidated(Ledger::ID const & prevLedger) const;
-
-      // Number of proposers that have validated a ledger descended from the
-      // given ledger; if prevLedger.id() != prevLedgerID, use prevLedgerID
-      // for the determination
-      std::size_t proposersFinished(Ledger const & prevLedger,
-                                    Ledger::ID const & prevLedger) const;
-
-      // Return the ID of the last closed (and validated) ledger that the
-      // application thinks consensus should use as the prior ledger.
-      Ledger::ID getPrevLedger(Ledger::ID const & prevLedgerID,
-                      Ledger const & prevLedger,
-                      Mode mode);
-
-      // Called whenever consensus operating mode changes
-      void onModeChange(ConsensusMode before, ConsensusMode after);
-
-      // Called when ledger closes
-      Result onClose(Ledger const &, Ledger const & prev, Mode mode);
-
-      // Called when ledger is accepted by consensus
-      void onAccept(Result const & result,
-        RCLCxLedger const & prevLedger,
-        NetClock::duration closeResolution,
-        CloseTimes const & rawCloseTimes,
-        Mode const & mode);
-
-      // Called when ledger was forcibly accepted by consensus via the simulate
-      // function.
-      void onForceAccept(Result const & result,
-        RCLCxLedger const & prevLedger,
-        NetClock::duration closeResolution,
-        CloseTimes const & rawCloseTimes,
-        Mode const & mode);
-
-      // Propose the position to peers.
-      void propose(ConsensusProposal<...> const & pos);
-
-      // Share a received peer proposal with other peer's.
-      void share(PeerPosition_t const & prop);
-
-      // Share a disputed transaction with peers
-      void share(Txn const & tx);
-
-      // Share given transaction set with peers
-      void share(TxSet const &s);
-
-      // Consensus timing parameters and constants
-      ConsensusParms const &
-      parms() const;
-  };
-  @endcode
-
-  @tparam Adaptor Defines types and provides helper functions needed to adapt
-                  Consensus to the larger application.
-*/
+/**
+ * Generic implementation of consensus algorithm.
+ *
+ * Achieves consensus on the next ledger.
+ *
+ * Two things need consensus:
+ *
+ *   1.  The set of transactions included in the ledger.
+ *   2.  The close time for the ledger.
+ *
+ * The basic flow:
+ *
+ *   1. A call to `startRound` places the node in the `Open` phase.  In this
+ *      phase, the node is waiting for transactions to include in its open
+ *      ledger.
+ *   2. Successive calls to `timerEntry` check if the node can close the ledger.
+ *      Once the node `Close`s the open ledger, it transitions to the
+ *      `Establish` phase.  In this phase, the node shares/receives peer
+ *      proposals on which transactions should be accepted in the closed ledger.
+ *   3. During a subsequent call to `timerEntry`, the node determines it has
+ *      reached consensus with its peers on which transactions to include. It
+ *      transitions to the `Accept` phase. In this phase, the node works on
+ *      applying the transactions to the prior ledger to generate a new closed
+ *      ledger. Once the new ledger is completed, the node shares the validated
+ *      ledger with the network, does some book-keeping, then makes a call to
+ *      `startRound` to start the cycle again.
+ *
+ * This class uses a generic interface to allow adapting Consensus for specific
+ * applications. The Adaptor template implements a set of helper functions that
+ * plug the consensus algorithm into a specific application.  It also identifies
+ * the types that play important roles in Consensus (transactions, ledgers, ...).
+ * The code stubs below outline the interface and type requirements.  The traits
+ * types must be copy constructible and assignable.
+ *
+ * @warning The generic implementation is not thread safe and the public methods
+ * are not intended to be run concurrently.  When in a concurrent environment,
+ * the application is responsible for ensuring thread-safety.  Simply locking
+ * whenever touching the Consensus instance is one option.
+ *
+ * @code
+ * // A single transaction
+ * struct Tx
+ * {
+ *   // Unique identifier of transaction
+ *   using ID = ...;
+ *
+ *   ID id() const;
+ *
+ * };
+ *
+ * // A set of transactions
+ * struct TxSet
+ * {
+ *   // Unique ID of TxSet (not of Tx)
+ *   using ID = ...;
+ *   // Type of individual transaction comprising the TxSet
+ *   using Tx = Tx;
+ *
+ *   bool exists(Tx::ID const &) const;
+ *   // Return value should have semantics like Tx const *
+ *   Tx const * find(Tx::ID const &) const ;
+ *   ID const & id() const;
+ *
+ *   // Return set of transactions that are not common to this set or other
+ *   // boolean indicates which set it was in
+ *   std::map<Tx::ID, bool> compare(TxSet const & other) const;
+ *
+ *   // A mutable view of transactions
+ *   struct MutableTxSet
+ *   {
+ *       MutableTxSet(TxSet const &);
+ *       bool insert(Tx const &);
+ *       bool erase(Tx::ID const &);
+ *   };
+ *
+ *   // Construct from a mutable view.
+ *   TxSet(MutableTxSet const &);
+ *
+ *   // Alternatively, if the TxSet is itself mutable
+ *   // just alias MutableTxSet = TxSet
+ *
+ * };
+ *
+ * // Agreed upon state that consensus transactions will modify
+ * struct Ledger
+ * {
+ *   using ID = ...;
+ *   using Seq = ...;
+ *
+ *   // Unique identifier of ledger
+ *   ID const id() const;
+ *   Seq seq() const;
+ *   auto closeTimeResolution() const;
+ *   auto closeAgree() const;
+ *   auto closeTime() const;
+ *   auto parentCloseTime() const;
+ *   json::Value getJson() const;
+ * };
+ *
+ * // Wraps a peer's ConsensusProposal
+ * struct PeerPosition
+ * {
+ *   ConsensusProposal<
+ *       std::uint32_t, //NodeID,
+ *       typename Ledger::ID,
+ *       typename TxSet::ID> const &
+ *   proposal() const;
+ *
+ * };
+ *
+ *
+ * class Adaptor
+ * {
+ * public:
+ *     //-----------------------------------------------------------------------
+ *     // Define consensus types
+ *     using Ledger_t = Ledger;
+ *     using NodeID_t = std::uint32_t;
+ *     using TxSet_t = TxSet;
+ *     using PeerPosition_t = PeerPosition;
+ *
+ *     //-----------------------------------------------------------------------
+ *     //
+ *     // Attempt to acquire a specific ledger.
+ *     std::optional<Ledger> acquireLedger(Ledger::ID const & ledgerID);
+ *
+ *     // Acquire the transaction set associated with a proposed position.
+ *     std::optional<TxSet> acquireTxSet(TxSet::ID const & setID);
+ *
+ *     // Whether any transactions are in the open ledger
+ *     bool hasOpenTransactions() const;
+ *
+ *     // Number of proposers that have validated the given ledger
+ *     std::size_t proposersValidated(Ledger::ID const & prevLedger) const;
+ *
+ *     // Number of proposers that have validated a ledger descended from the
+ *     // given ledger; if prevLedger.id() != prevLedgerID, use prevLedgerID
+ *     // for the determination
+ *     std::size_t proposersFinished(Ledger const & prevLedger,
+ *                                   Ledger::ID const & prevLedger) const;
+ *
+ *     // Return the ID of the last closed (and validated) ledger that the
+ *     // application thinks consensus should use as the prior ledger.
+ *     Ledger::ID getPrevLedger(Ledger::ID const & prevLedgerID,
+ *                     Ledger const & prevLedger,
+ *                     Mode mode);
+ *
+ *     // Called whenever consensus operating mode changes
+ *     void onModeChange(ConsensusMode before, ConsensusMode after);
+ *
+ *     // Called when ledger closes
+ *     Result onClose(Ledger const &, Ledger const & prev, Mode mode);
+ *
+ *     // Called when ledger is accepted by consensus
+ *     void onAccept(Result const & result,
+ *       RCLCxLedger const & prevLedger,
+ *       NetClock::duration closeResolution,
+ *       CloseTimes const & rawCloseTimes,
+ *       Mode const & mode);
+ *
+ *     // Called when ledger was forcibly accepted by consensus via the simulate
+ *     // function.
+ *     void onForceAccept(Result const & result,
+ *       RCLCxLedger const & prevLedger,
+ *       NetClock::duration closeResolution,
+ *       CloseTimes const & rawCloseTimes,
+ *       Mode const & mode);
+ *
+ *     // Propose the position to peers.
+ *     void propose(ConsensusProposal<...> const & pos);
+ *
+ *     // Share a received peer proposal with other peer's.
+ *     void share(PeerPosition_t const & prop);
+ *
+ *     // Share a disputed transaction with peers
+ *     void share(Txn const & tx);
+ *
+ *     // Share given transaction set with peers
+ *     void share(TxSet const &s);
+ *
+ *     // Consensus timing parameters and constants
+ *     ConsensusParms const &
+ *     parms() const;
+ * };
+ * @endcode
+ *
+ * @tparam Adaptor Defines types and provides helper functions needed to adapt
+ *                 Consensus to the larger application.
+ */
 template <class Adaptor>
 class Consensus
 {
@@ -319,34 +322,38 @@ class Consensus
     };
 
 public:
-    //! Clock type for measuring time within the consensus code
+    /**
+     * Clock type for measuring time within the consensus code
+     */
     using clock_type = beast::AbstractClock<std::chrono::steady_clock>;
 
     Consensus(Consensus&&) noexcept = default;
 
-    /** Constructor.
-
-        @param clock The clock used to internally sample consensus progress
-        @param adaptor The instance of the adaptor class
-        @param j The journal to log debug output
-    */
+    /**
+     * Constructor.
+     *
+     * @param clock The clock used to internally sample consensus progress
+     * @param adaptor The instance of the adaptor class
+     * @param j The journal to log debug output
+     */
     Consensus(clock_type const& clock, Adaptor& adaptor, beast::Journal j);
 
-    /** Kick-off the next round of consensus.
-
-        Called by the client code to start each round of consensus.
-
-        @param now          The network adjusted time
-        @param prevLedgerID the ID of the last ledger
-        @param prevLedger   The last ledger
-        @param nowUntrusted ID of nodes that are newly untrusted this round
-        @param proposing    Whether we want to send proposals to peers this
-       round.
-        @param clog         log object to which to append
-
-        @note @b prevLedgerID is not required to the ID of @b prevLedger since
-        the ID may be known locally before the contents of the ledger arrive
-    */
+    /**
+     * Kick-off the next round of consensus.
+     *
+     * Called by the client code to start each round of consensus.
+     *
+     * @param now          The network adjusted time
+     * @param prevLedgerID the ID of the last ledger
+     * @param prevLedger   The last ledger
+     * @param nowUntrusted ID of nodes that are newly untrusted this round
+     * @param proposing    Whether we want to send proposals to peers this
+     * round.
+     * @param clog         log object to which to append
+     *
+     * @note @b prevLedgerID is not required to the ID of @b prevLedger since
+     * the ID may be known locally before the contents of the ledger arrive
+     */
     void
     startRound(
         NetClock::time_point const& now,
@@ -356,61 +363,66 @@ public:
         bool proposing,
         std::unique_ptr<std::stringstream> const& clog = {});
 
-    /** A peer has proposed a new position, adjust our tracking.
-
-        @param now The network adjusted time
-        @param newProposal The new proposal from a peer
-        @return Whether we should do delayed relay of this proposal.
-    */
+    /**
+     * A peer has proposed a new position, adjust our tracking.
+     *
+     * @param now The network adjusted time
+     * @param newProposal The new proposal from a peer
+     * @return Whether we should do delayed relay of this proposal.
+     */
     bool
     peerProposal(NetClock::time_point const& now, PeerPosition_t const& newProposal);
 
-    /** Call periodically to drive consensus forward.
-
-        @param now  The network adjusted time
-        @param clog log object to which to append
-    */
+    /**
+     * Call periodically to drive consensus forward.
+     *
+     * @param now  The network adjusted time
+     * @param clog log object to which to append
+     */
     void
     timerEntry(
         NetClock::time_point const& now,
         std::unique_ptr<std::stringstream> const& clog = {});
 
-    /** Process a transaction set acquired from the network
-
-        @param now The network adjusted time
-        @param txSet the transaction set
-    */
+    /**
+     * Process a transaction set acquired from the network
+     *
+     * @param now The network adjusted time
+     * @param txSet the transaction set
+     */
     void
     gotTxSet(NetClock::time_point const& now, TxSet_t const& txSet);
 
-    /** Simulate the consensus process without any network traffic.
-
-       The end result, is that consensus begins and completes as if everyone
-       had agreed with whatever we propose.
-
-       This function is only called from the rpc "ledger_accept" path with the
-       server in standalone mode and SHOULD NOT be used during the normal
-       consensus process.
-
-       Simulate will call onForceAccept since clients are manually driving
-       consensus to the accept phase.
-
-       @param now The current network adjusted time.
-       @param consensusDelay Duration to delay between closing and accepting the
-                             ledger. Uses 100ms if unspecified.
-    */
+    /**
+     * Simulate the consensus process without any network traffic.
+     *
+     * The end result, is that consensus begins and completes as if everyone
+     * had agreed with whatever we propose.
+     *
+     * This function is only called from the rpc "ledger_accept" path with the
+     * server in standalone mode and SHOULD NOT be used during the normal
+     * consensus process.
+     *
+     * Simulate will call onForceAccept since clients are manually driving
+     * consensus to the accept phase.
+     *
+     * @param now The current network adjusted time.
+     * @param consensusDelay Duration to delay between closing and accepting the
+     *                       ledger. Uses 100ms if unspecified.
+     */
     void
     simulate(
         NetClock::time_point const& now,
         std::optional<std::chrono::milliseconds> consensusDelay);
 
-    /** Get the previous ledger ID.
-
-        The previous ledger is the last ledger seen by the consensus code and
-        should correspond to the most recent validated ledger seen by this peer.
-
-        @return ID of previous ledger
-    */
+    /**
+     * Get the previous ledger ID.
+     *
+     * The previous ledger is the last ledger seen by the consensus code and
+     * should correspond to the most recent validated ledger seen by this peer.
+     *
+     * @return ID of previous ledger
+     */
     Ledger_t::ID
     prevLedgerID() const
     {
@@ -423,13 +435,14 @@ public:
         return phase_;
     }
 
-    /** Get the Json state of the consensus process.
-
-        Called by the consensus_info RPC.
-
-        @param full True if verbose response desired.
-        @return     The Json state.
-    */
+    /**
+     * Get the Json state of the consensus process.
+     *
+     * Called by the consensus_info RPC.
+     *
+     * @param full True if verbose response desired.
+     * @return     The Json state.
+     */
     [[nodiscard]] json::Value
     getJson(bool full) const;
 
@@ -446,46 +459,52 @@ private:
     void
     handleWrongLedger(Ledger_t::ID const& lgrId, std::unique_ptr<std::stringstream> const& clog);
 
-    /** Check if our previous ledger matches the network's.
-
-        If the previous ledger differs, we are no longer in sync with
-        the network and need to bow out/switch modes.
-    */
+    /**
+     * Check if our previous ledger matches the network's.
+     *
+     * If the previous ledger differs, we are no longer in sync with
+     * the network and need to bow out/switch modes.
+     */
     void
     checkLedger(std::unique_ptr<std::stringstream> const& clog);
 
-    /** If we radically changed our consensus context for some reason,
-        we need to replay recent proposals so that they're not lost.
-    */
+    /**
+     * If we radically changed our consensus context for some reason,
+     * we need to replay recent proposals so that they're not lost.
+     */
     void
     playbackProposals();
 
-    /** Handle a replayed or a new peer proposal.
+    /**
+     * Handle a replayed or a new peer proposal.
      */
     bool
     peerProposalInternal(NetClock::time_point const& now, PeerPosition_t const& newProposal);
 
-    /** Handle pre-close phase.
-
-        In the pre-close phase, the ledger is open as we wait for new
-        transactions.  After enough time has elapsed, we will close the ledger,
-        switch to the establish phase and start the consensus process.
-    */
+    /**
+     * Handle pre-close phase.
+     *
+     * In the pre-close phase, the ledger is open as we wait for new
+     * transactions.  After enough time has elapsed, we will close the ledger,
+     * switch to the establish phase and start the consensus process.
+     */
     void
     phaseOpen(std::unique_ptr<std::stringstream> const& clog);
 
-    /** Handle establish phase.
-
-        In the establish phase, the ledger has closed and we work with peers
-        to reach consensus. Update our position only on the timer, and in this
-        phase.
-
-        If we have consensus, move to the accepted phase.
-    */
+    /**
+     * Handle establish phase.
+     *
+     * In the establish phase, the ledger has closed and we work with peers
+     * to reach consensus. Update our position only on the timer, and in this
+     * phase.
+     *
+     * If we have consensus, move to the accepted phase.
+     */
     void
     phaseEstablish(std::unique_ptr<std::stringstream> const& clog);
 
-    /** Evaluate whether pausing increases likelihood of validation.
+    /**
+     * Evaluate whether pausing increases likelihood of validation.
      *
      *  As a validator that has previously synced to the network, if our most
      *  recent locally-validated ledger did not also achieve
@@ -1245,7 +1264,8 @@ Consensus<Adaptor>::shouldPause(std::unique_ptr<std::stringstream> const& clog)
 
     bool willPause = false;
 
-    /** Maximum phase with distinct thresholds to determine how
+    /**
+     * Maximum phase with distinct thresholds to determine how
      *  many validators must be on our same ledger sequence number.
      *  The threshold for the 1st (0) phase is >= the minimum number that
      *  can achieve quorum. Threshold for the maximum phase is 100%
@@ -1429,18 +1449,19 @@ Consensus<Adaptor>::closeLedger(std::unique_ptr<std::stringstream> const& clog)
     }
 }
 
-/** How many of the participants must agree to reach a given threshold?
-
-Note that the number may not precisely yield the requested percentage.
-For example, with with size = 5 and percent = 70, we return 3, but
-3 out of 5 works out to 60%. There are no security implications to
-this.
-
-@param participants The number of participants (i.e. validators)
-@param percent The percent that we want to reach
-
-@return the number of participants which must agree
-*/
+/**
+ * How many of the participants must agree to reach a given threshold?
+ *
+ * Note that the number may not precisely yield the requested percentage.
+ * For example, with with size = 5 and percent = 70, we return 3, but
+ * 3 out of 5 works out to 60%. There are no security implications to
+ * this.
+ *
+ * @param participants The number of participants (i.e. validators)
+ * @param percent The percent that we want to reach
+ *
+ * @return the number of participants which must agree
+ */
 inline int
 participantsNeeded(int participants, int percent)
 {
diff --git a/src/xrpld/consensus/ConsensusParms.h b/src/xrpld/consensus/ConsensusParms.h
index d00a5dc3c7..5fdbaa38bf 100644
--- a/src/xrpld/consensus/ConsensusParms.h
+++ b/src/xrpld/consensus/ConsensusParms.h
@@ -10,11 +10,12 @@
 
 namespace xrpl {
 
-/** Consensus algorithm parameters
-
-    Parameters which control the consensus algorithm.  This are not
-    meant to be changed arbitrarily.
-*/
+/**
+ * Consensus algorithm parameters
+ *
+ * Parameters which control the consensus algorithm.  This are not
+ * meant to be changed arbitrarily.
+ */
 struct ConsensusParms
 {
     explicit ConsensusParms() = default;
@@ -22,49 +23,63 @@ struct ConsensusParms
     //-------------------------------------------------------------------------
     // Validation and proposal durations are relative to NetClock times, so use
     // second resolution
-    /** The duration a validation remains current after its ledger's
-       close time.
-
-        This is a safety to protect against very old validations and the time
-        it takes to adjust the close time accuracy window.
-    */
+    /**
+     * The duration a validation remains current after its ledger's
+     * close time.
+     *
+     *  This is a safety to protect against very old validations and the time
+     *  it takes to adjust the close time accuracy window.
+     */
     std::chrono::seconds const validationValidWall = std::chrono::minutes{5};
 
-    /** Duration a validation remains current after first observed.
-
-       The duration a validation remains current after the time we
-       first saw it. This provides faster recovery in very rare cases where the
-       number of validations produced by the network is lower than normal
-    */
+    /**
+     * Duration a validation remains current after first observed.
+     *
+     * The duration a validation remains current after the time we
+     * first saw it. This provides faster recovery in very rare cases where the
+     * number of validations produced by the network is lower than normal
+     */
     std::chrono::seconds const validationValidLocal = std::chrono::minutes{3};
 
-    /**  Duration pre-close in which validations are acceptable.
-
-        The number of seconds before a close time that we consider a validation
-        acceptable. This protects against extreme clock errors
-    */
+    /**
+     * Duration pre-close in which validations are acceptable.
+     *
+     * The number of seconds before a close time that we consider a validation
+     * acceptable. This protects against extreme clock errors
+     */
     std::chrono::seconds const validationValidEarly = std::chrono::minutes{3};
 
-    //! How long we consider a proposal fresh
+    /**
+     * How long we consider a proposal fresh
+     */
     std::chrono::seconds const proposeFRESHNESS = std::chrono::seconds{20};
 
-    //! How often we force generating a new proposal to keep ours fresh
+    /**
+     * How often we force generating a new proposal to keep ours fresh
+     */
     std::chrono::seconds const proposeINTERVAL = std::chrono::seconds{12};
 
     //-------------------------------------------------------------------------
     // Consensus durations are relative to the internal Consensus clock and use
     // millisecond resolution.
 
-    //! The percentage threshold above which we can declare consensus.
+    /**
+     * The percentage threshold above which we can declare consensus.
+     */
     std::size_t const minConsensusPct = 80;
 
-    //! The duration a ledger may remain idle before closing
+    /**
+     * The duration a ledger may remain idle before closing
+     */
     std::chrono::milliseconds const ledgerIdleInterval = std::chrono::seconds{15};
 
-    //! The number of seconds we wait minimum to ensure participation
+    /**
+     * The number of seconds we wait minimum to ensure participation
+     */
     std::chrono::milliseconds const ledgerMinConsensus = std::chrono::milliseconds{1950};
 
-    /** The maximum amount of time to spend pausing for laggards.
+    /**
+     * The maximum amount of time to spend pausing for laggards.
      *
      *  This should be sufficiently less than validationFRESHNESS so that
      *  validators don't appear to be offline that are merely waiting for
@@ -72,13 +87,19 @@ struct ConsensusParms
      */
     std::chrono::milliseconds const ledgerMaxConsensus = std::chrono::seconds{15};
 
-    //! Minimum number of seconds to wait to ensure others have computed the LCL
+    /**
+     * Minimum number of seconds to wait to ensure others have computed the LCL
+     */
     std::chrono::milliseconds const ledgerMinClose = std::chrono::seconds{2};
 
-    //! How often we check state or change positions
+    /**
+     * How often we check state or change positions
+     */
     std::chrono::milliseconds const ledgerGRANULARITY = std::chrono::seconds{1};
 
-    //! How long to wait before completely abandoning consensus
+    /**
+     * How long to wait before completely abandoning consensus
+     */
     std::size_t const ledgerAbandonConsensusFactor = 10;
 
     /**
@@ -89,16 +110,17 @@ struct ConsensusParms
      */
     std::chrono::milliseconds const ledgerAbandonConsensus = std::chrono::seconds{120};
 
-    /** The minimum amount of time to consider the previous round
-        to have taken.
-
-        The minimum amount of time to consider the previous round
-        to have taken. This ensures that there is an opportunity
-        for a round at each avalanche threshold even if the
-        previous consensus was very fast. This should be at least
-        twice the interval between proposals (0.7s) divided by
-        the interval between mid and late consensus ([85-50]/100).
-    */
+    /**
+     * The minimum amount of time to consider the previous round
+     * to have taken.
+     *
+     * The minimum amount of time to consider the previous round
+     * to have taken. This ensures that there is an opportunity
+     * for a round at each avalanche threshold even if the
+     * previous consensus was very fast. This should be at least
+     * twice the interval between proposals (0.7s) divided by
+     * the interval between mid and late consensus ([85-50]/100).
+     */
     std::chrono::milliseconds const avMinConsensusTime = std::chrono::seconds{5};
 
     //------------------------------------------------------------------------------
@@ -113,11 +135,13 @@ struct ConsensusParms
         std::size_t const consensusPct;
         AvalancheState const next;
     };
-    //! Map the consensus requirement avalanche state to the amount of time that
-    //! must pass before moving to that state, the agreement percentage required
-    //! at that state, and the next state. "stuck" loops back on itself because
-    //! once we're stuck, we're stuck.
-    //! This structure allows for "looping" of states if needed.
+    /**
+     * Map the consensus requirement avalanche state to the amount of time that
+     * must pass before moving to that state, the agreement percentage required
+     * at that state, and the next state. "stuck" loops back on itself because
+     * once we're stuck, we're stuck.
+     * This structure allows for "looping" of states if needed.
+     */
     std::map<AvalancheState, AvalancheCutoff> const avalancheCutoffs{
         // {state, {time, percent, nextState}},
         // Initial state: 50% of nodes must vote yes
@@ -135,16 +159,22 @@ struct ConsensusParms
          {.consensusTime = 200, .consensusPct = 95, .next = AvalancheState::Stuck}},
     };
 
-    //! Percentage of nodes required to reach agreement on ledger close time
+    /**
+     * Percentage of nodes required to reach agreement on ledger close time
+     */
     std::size_t const avCtConsensusPct = 75;
 
-    //! Number of rounds before certain actions can happen.
+    /**
+     * Number of rounds before certain actions can happen.
+     */
     // (Moving to the next avalanche level, considering that votes are stalled
     // without consensus.)
     std::size_t const avMinRounds = 2;
 
-    //! Number of rounds before a stuck vote is considered unlikely to change
-    //! because voting stalled
+    /**
+     * Number of rounds before a stuck vote is considered unlikely to change
+     * because voting stalled
+     */
     std::size_t const avStalledRounds = 4;
 };
 
diff --git a/src/xrpld/consensus/ConsensusProposal.h b/src/xrpld/consensus/ConsensusProposal.h
index c27d5c2819..4586479286 100644
--- a/src/xrpld/consensus/ConsensusProposal.h
+++ b/src/xrpld/consensus/ConsensusProposal.h
@@ -13,28 +13,29 @@
 #include <string>
 
 namespace xrpl {
-/** Represents a proposed position taken during a round of consensus.
-
-    During consensus, peers seek agreement on a set of transactions to
-    apply to the prior ledger to generate the next ledger.  Each peer takes a
-    position on whether to include or exclude potential transactions.
-    The position on the set of transactions is proposed to its peers as an
-    instance of the ConsensusProposal class.
-
-    An instance of ConsensusProposal can be either our own proposal or one of
-    our peer's.
-
-    As consensus proceeds, peers may change their position on the transaction,
-    or choose to abstain. Each successive proposal includes a strictly
-    monotonically increasing number (or, if a peer is choosing to abstain,
-    the special value `kSeqLeave`).
-
-    Refer to @ref Consensus for requirements of the template arguments.
-
-    @tparam NodeId Type used to uniquely identify nodes/peers
-    @tparam LedgerId Type used to uniquely identify ledgers
-    @tparam Position Type used to represent the position taken on transactions
-                       under consideration during this round of consensus
+/**
+ * Represents a proposed position taken during a round of consensus.
+ *
+ * During consensus, peers seek agreement on a set of transactions to
+ * apply to the prior ledger to generate the next ledger.  Each peer takes a
+ * position on whether to include or exclude potential transactions.
+ * The position on the set of transactions is proposed to its peers as an
+ * instance of the ConsensusProposal class.
+ *
+ * An instance of ConsensusProposal can be either our own proposal or one of
+ * our peer's.
+ *
+ * As consensus proceeds, peers may change their position on the transaction,
+ * or choose to abstain. Each successive proposal includes a strictly
+ * monotonically increasing number (or, if a peer is choosing to abstain,
+ * the special value `kSeqLeave`).
+ *
+ * Refer to @ref Consensus for requirements of the template arguments.
+ *
+ * @tparam NodeId Type used to uniquely identify nodes/peers
+ * @tparam LedgerId Type used to uniquely identify ledgers
+ * @tparam Position Type used to represent the position taken on transactions
+ *                  under consideration during this round of consensus
  */
 template <class NodeId, class LedgerId, class Position>
 class ConsensusProposal
@@ -48,15 +49,16 @@ public:
     //< Sequence number when  a peer wants to bow out and leave consensus
     static std::uint32_t const kSeqLeave = 0xffffffff;
 
-    /** Constructor
-
-        @param prevLedger The previous ledger this proposal is building on.
-        @param seq The sequence number of this proposal.
-        @param position The position taken on transactions in this round.
-        @param closeTime Position of when this ledger closed.
-        @param now Time when the proposal was taken.
-        @param nodeID ID of node/peer taking this position.
-    */
+    /**
+     * Constructor
+     *
+     * @param prevLedger The previous ledger this proposal is building on.
+     * @param seq The sequence number of this proposal.
+     * @param position The position taken on transactions in this round.
+     * @param closeTime Position of when this ledger closed.
+     * @param now Time when the proposal was taken.
+     * @param nodeID ID of node/peer taking this position.
+     */
     ConsensusProposal(
         LedgerId const& prevLedger,
         std::uint32_t seq,
@@ -73,83 +75,100 @@ public:
     {
     }
 
-    //! Identifying which peer took this position.
+    /**
+     * Identifying which peer took this position.
+     */
     NodeId const&
     nodeID() const
     {
         return nodeID_;
     }
 
-    //! Get the proposed position.
+    /**
+     * Get the proposed position.
+     */
     Position const&
     position() const
     {
         return position_;
     }
 
-    //! Get the prior accepted ledger this position is based on.
+    /**
+     * Get the prior accepted ledger this position is based on.
+     */
     LedgerId const&
     prevLedger() const
     {
         return previousLedger_;
     }
 
-    /** Get the sequence number of this proposal
-
-        Starting with an initial sequence number of `kSeqJoin`, successive
-        proposals from a peer will increase the sequence number.
-
-        @return the sequence number
-    */
+    /**
+     * Get the sequence number of this proposal
+     *
+     * Starting with an initial sequence number of `kSeqJoin`, successive
+     * proposals from a peer will increase the sequence number.
+     *
+     * @return the sequence number
+     */
     std::uint32_t
     proposeSeq() const
     {
         return proposeSeq_;
     }
 
-    //! The current position on the consensus close time.
+    /**
+     * The current position on the consensus close time.
+     */
     NetClock::time_point const&
     closeTime() const
     {
         return closeTime_;
     }
 
-    //! Get when this position was taken.
+    /**
+     * Get when this position was taken.
+     */
     NetClock::time_point const&
     seenTime() const
     {
         return time_;
     }
 
-    /** Whether this is the first position taken during the current
-        consensus round.
-    */
+    /**
+     * Whether this is the first position taken during the current
+     * consensus round.
+     */
     bool
     isInitial() const
     {
         return proposeSeq_ == kSeqJoin;
     }
 
-    //! Get whether this node left the consensus process
+    /**
+     * Get whether this node left the consensus process
+     */
     bool
     isBowOut() const
     {
         return proposeSeq_ == kSeqLeave;
     }
 
-    //! Get whether this position is stale relative to the provided cutoff
+    /**
+     * Get whether this position is stale relative to the provided cutoff
+     */
     bool
     isStale(NetClock::time_point cutoff) const
     {
         return time_ <= cutoff;
     }
 
-    /** Update the position during the consensus process. This will increment
-        the proposal's sequence number if it has not already bowed out.
-
-        @param newPosition The new position taken.
-        @param newCloseTime The new close time.
-        @param now the time The new position was taken
+    /**
+     * Update the position during the consensus process. This will increment
+     * the proposal's sequence number if it has not already bowed out.
+     *
+     * @param newPosition The new position taken.
+     * @param newCloseTime The new close time.
+     * @param now the time The new position was taken
      */
     void
     changePosition(
@@ -165,11 +184,12 @@ public:
             ++proposeSeq_;
     }
 
-    /** Leave consensus
-
-        Update position to indicate the node left consensus.
-
-        @param now Time when this node left consensus.
+    /**
+     * Leave consensus
+     *
+     * Update position to indicate the node left consensus.
+     *
+     * @param now Time when this node left consensus.
      */
     void
     bowOut(NetClock::time_point now)
@@ -190,7 +210,9 @@ public:
         return ss.str();
     }
 
-    //! Get JSON representation for debugging
+    /**
+     * Get JSON representation for debugging
+     */
     json::Value
     getJson() const
     {
@@ -210,7 +232,9 @@ public:
         return ret;
     }
 
-    //! The digest for this proposal, used for signing purposes.
+    /**
+     * The digest for this proposal, used for signing purposes.
+     */
     uint256 const&
     signingHash() const
     {
@@ -228,25 +252,37 @@ public:
     }
 
 private:
-    //! Unique identifier of prior ledger this proposal is based on
+    /**
+     * Unique identifier of prior ledger this proposal is based on
+     */
     LedgerId previousLedger_;
 
-    //! Unique identifier of the position this proposal is taking
+    /**
+     * Unique identifier of the position this proposal is taking
+     */
     Position position_;
 
-    //! The ledger close time this position is taking
+    /**
+     * The ledger close time this position is taking
+     */
     NetClock::time_point closeTime_;
 
     // !The time this position was last updated
     NetClock::time_point time_;
 
-    //! The sequence number of these positions taken by this node
+    /**
+     * The sequence number of these positions taken by this node
+     */
     std::uint32_t proposeSeq_;
 
-    //! The identifier of the node taking this position
+    /**
+     * The identifier of the node taking this position
+     */
     NodeId nodeID_;
 
-    //! The signing hash for this proposal
+    /**
+     * The signing hash for this proposal
+     */
     mutable std::optional<uint256> signingHash_;
 };
 
diff --git a/src/xrpld/consensus/ConsensusTypes.h b/src/xrpld/consensus/ConsensusTypes.h
index 6b33f50662..4553e46f48 100644
--- a/src/xrpld/consensus/ConsensusTypes.h
+++ b/src/xrpld/consensus/ConsensusTypes.h
@@ -14,41 +14,50 @@
 
 namespace xrpl {
 
-/** Represents how a node currently participates in Consensus.
-
-    A node participates in consensus in varying modes, depending on how
-    the node was configured by its operator and how well it stays in sync
-    with the network during consensus.
-
-    @code
-      proposing               observing
-         \                       /
-          \---> wrongLedger <---/
-                     ^
-                     |
-                     |
-                     v
-                switchedLedger
-   @endcode
-
-   We enter the round proposing or observing. If we detect we are working
-   on the wrong prior ledger, we go to wrongLedger and attempt to acquire
-   the right one. Once we acquire the right one, we go to the switchedLedger
-   mode.  It is possible we fall behind again and find there is a new better
-   ledger, moving back and forth between wrongLedger and switchLedger as
-   we attempt to catch up.
-*/
+/**
+ * Represents how a node currently participates in Consensus.
+ *
+ *  A node participates in consensus in varying modes, depending on how
+ *  the node was configured by its operator and how well it stays in sync
+ *  with the network during consensus.
+ *
+ *  @code
+ *    proposing               observing
+ *       \                       /
+ *        \---> wrongLedger <---/
+ *                   ^
+ *                   |
+ *                   |
+ *                   v
+ *              switchedLedger
+ * @endcode
+ *
+ * We enter the round proposing or observing. If we detect we are working
+ * on the wrong prior ledger, we go to wrongLedger and attempt to acquire
+ * the right one. Once we acquire the right one, we go to the switchedLedger
+ * mode.  It is possible we fall behind again and find there is a new better
+ * ledger, moving back and forth between wrongLedger and switchLedger as
+ * we attempt to catch up.
+ */
 enum class ConsensusMode {
-    //! We are normal participant in consensus and propose our position
+    /**
+     * We are normal participant in consensus and propose our position
+     */
     Proposing,
-    //! We are observing peer positions, but not proposing our position
+    /**
+     * We are observing peer positions, but not proposing our position
+     */
     Observing,
-    //! We have the wrong ledger and are attempting to acquire it
+    /**
+     * We have the wrong ledger and are attempting to acquire it
+     */
     WrongLedger,
-    //! We switched ledgers since we started this consensus round but are now
-    //! running on what we believe is the correct ledger.  This mode is as
-    //! if we entered the round observing, but is used to indicate we did
-    //! have the wrongLedger at some point.
+    /**
+     * We switched ledgers since we started this consensus round but are now
+     * running on what we believe is the correct ledger.  This mode is as
+     * if we entered the round observing, but is used to indicate we did
+     * have the wrongLedger at some point.
+     */
     SwitchedLedger
 };
 
@@ -70,32 +79,39 @@ to_string(ConsensusMode m)
     }
 }
 
-/** Phases of consensus for a single ledger round.
-
-    @code
-          "close"             "accept"
-     open ------- > establish ---------> accepted
-       ^               |                    |
-       |---------------|                    |
-       ^                     "startRound"   |
-       |------------------------------------|
-   @endcode
-
-   The typical transition goes from open to establish to accepted and
-   then a call to startRound begins the process anew. However, if a wrong prior
-   ledger is detected and recovered during the establish or accept phase,
-   consensus will internally go back to open (see Consensus::handleWrongLedger).
-*/
+/**
+ * Phases of consensus for a single ledger round.
+ *
+ *  @code
+ *        "close"             "accept"
+ *   open ------- > establish ---------> accepted
+ *     ^               |                    |
+ *     |---------------|                    |
+ *     ^                     "startRound"   |
+ *     |------------------------------------|
+ * @endcode
+ *
+ * The typical transition goes from open to establish to accepted and
+ * then a call to startRound begins the process anew. However, if a wrong prior
+ * ledger is detected and recovered during the establish or accept phase,
+ * consensus will internally go back to open (see Consensus::handleWrongLedger).
+ */
 enum class ConsensusPhase {
-    //! We haven't closed our ledger yet, but others might have
+    /**
+     * We haven't closed our ledger yet, but others might have
+     */
     Open,
 
-    //! Establishing consensus by exchanging proposals with our peers
+    /**
+     * Establishing consensus by exchanging proposals with our peers
+     */
     Establish,
 
-    //! We have accepted a new last closed ledger and are waiting on a call
-    //! to startRound to begin the next consensus round.  No changes
-    //! to consensus phase occur while in this phase.
+    /**
+     * We have accepted a new last closed ledger and are waiting on a call
+     * to startRound to begin the next consensus round.  No changes
+     * to consensus phase occur while in this phase.
+     */
     Accepted,
 };
 
@@ -115,7 +131,8 @@ to_string(ConsensusPhase p)
     }
 }
 
-/** Measures the duration of phases of consensus
+/**
+ * Measures the duration of phases of consensus
  */
 class ConsensusTimer
 {
@@ -151,39 +168,47 @@ public:
     }
 };
 
-/** Stores the set of initial close times
-
-    The initial consensus proposal from each peer has that peer's view of
-    when the ledger closed.  This object stores all those close times for
-    analysis of clock drift between peers.
-*/
+/**
+ * Stores the set of initial close times
+ *
+ * The initial consensus proposal from each peer has that peer's view of
+ * when the ledger closed.  This object stores all those close times for
+ * analysis of clock drift between peers.
+ */
 struct ConsensusCloseTimes
 {
     explicit ConsensusCloseTimes() = default;
 
-    //! Close time estimates, keep ordered for predictable traverse
+    /**
+     * Close time estimates, keep ordered for predictable traverse
+     */
     std::map<NetClock::time_point, int> peers;
 
-    //! Our close time estimate
+    /**
+     * Our close time estimate
+     */
     NetClock::time_point self;
 };
 
-/** Whether we have or don't have a consensus */
+/**
+ * Whether we have or don't have a consensus
+ */
 enum class ConsensusState {
-    No,       //!< We do not have consensus
-    MovedOn,  //!< The network has consensus without us
-    Expired,  //!< Consensus time limit has hard-expired
-    Yes       //!< We have consensus along with the network
+    No,       ///< We do not have consensus
+    MovedOn,  ///< The network has consensus without us
+    Expired,  ///< Consensus time limit has hard-expired
+    Yes       ///< We have consensus along with the network
 };
 
-/** Encapsulates the result of consensus.
-
-    Stores all relevant data for the outcome of consensus on a single
-   ledger.
-
-    @tparam Traits Traits class defining the concrete consensus types used
-                   by the application.
-*/
+/**
+ * Encapsulates the result of consensus.
+ *
+ * Stores all relevant data for the outcome of consensus on a single
+ * ledger.
+ *
+ * @tparam Traits Traits class defining the concrete consensus types used
+ *                by the application.
+ */
 template <class Traits>
 struct ConsensusResult
 {
@@ -200,13 +225,19 @@ struct ConsensusResult
         XRPL_ASSERT(txns.id() == position.position(), "xrpl::ConsensusResult : valid inputs");
     }
 
-    //! The set of transactions consensus agrees go in the ledger
+    /**
+     * The set of transactions consensus agrees go in the ledger
+     */
     TxSet_t txns;
 
-    //! Our proposed position on transactions/close time
+    /**
+     * Our proposed position on transactions/close time
+     */
     Proposal_t position;
 
-    //! Transactions which are under dispute with our peers
+    /**
+     * Transactions which are under dispute with our peers
+     */
     hash_map<typename Tx_t::ID, Dispute_t> disputes;
 
     // Set of TxSet ids we have already compared/created disputes
diff --git a/src/xrpld/consensus/DisputedTx.h b/src/xrpld/consensus/DisputedTx.h
index 96df1536f5..12ed00d460 100644
--- a/src/xrpld/consensus/DisputedTx.h
+++ b/src/xrpld/consensus/DisputedTx.h
@@ -17,19 +17,20 @@
 
 namespace xrpl {
 
-/** A transaction discovered to be in dispute during consensus.
-
-    During consensus, a @ref DisputedTx is created when a transaction
-    is discovered to be disputed. The object persists only as long as
-    the dispute.
-
-    Undisputed transactions have no corresponding @ref DisputedTx object.
-
-    Refer to @ref Consensus for details on the template type requirements.
-
-    @tparam Tx The type for a transaction
-    @tparam NodeId The type for a node identifier
-*/
+/**
+ * A transaction discovered to be in dispute during consensus.
+ *
+ * During consensus, a @ref DisputedTx is created when a transaction
+ * is discovered to be disputed. The object persists only as long as
+ * the dispute.
+ *
+ * Undisputed transactions have no corresponding @ref DisputedTx object.
+ *
+ * Refer to @ref Consensus for details on the template type requirements.
+ *
+ * @tparam Tx The type for a transaction
+ * @tparam NodeId The type for a node identifier
+ */
 
 template <class Tx, class NodeId>
 class DisputedTx
@@ -38,35 +39,42 @@ class DisputedTx
     using Map_t = boost::container::flat_map<NodeId, bool>;
 
 public:
-    /** Constructor
-
-        @param tx The transaction under dispute
-        @param ourVote Our vote on whether tx should be included
-        @param numPeers Anticipated number of peer votes
-        @param j Journal for debugging
-    */
+    /**
+     * Constructor
+     *
+     * @param tx The transaction under dispute
+     * @param ourVote Our vote on whether tx should be included
+     * @param numPeers Anticipated number of peer votes
+     * @param j Journal for debugging
+     */
     DisputedTx(Tx tx, bool ourVote, std::size_t numPeers, beast::Journal j)
         : ourVote_(ourVote), tx_(std::move(tx)), j_(j)
     {
         votes_.reserve(numPeers);
     }
 
-    //! The unique id/hash of the disputed transaction.
+    /**
+     * The unique id/hash of the disputed transaction.
+     */
     [[nodiscard]] TxID_t const&
     id() const
     {
         return tx_.id();
     }
 
-    //! Our vote on whether the transaction should be included.
+    /**
+     * Our vote on whether the transaction should be included.
+     */
     [[nodiscard]] bool
     getOurVote() const
     {
         return ourVote_;
     }
 
-    //! Are we and our peers "stalled" where we probably won't change
-    //! our vote?
+    /**
+     * Are we and our peers "stalled" where we probably won't change
+     * our vote?
+     */
     [[nodiscard]] bool
     stalled(
         ConsensusParms const& p,
@@ -131,53 +139,62 @@ public:
         return stalled;
     }
 
-    //! The disputed transaction.
+    /**
+     * The disputed transaction.
+     */
     [[nodiscard]] Tx const&
     tx() const
     {
         return tx_;
     }
 
-    //! Change our vote
+    /**
+     * Change our vote
+     */
     void
     setOurVote(bool o)
     {
         ourVote_ = o;
     }
 
-    /** Change a peer's vote
-
-        @param peer Identifier of peer.
-        @param votesYes Whether peer votes to include the disputed transaction.
-
-        @return bool Whether the peer changed its vote. (A new vote counts as a
-       change.)
-    */
+    /**
+     * Change a peer's vote
+     *
+     * @param peer Identifier of peer.
+     * @param votesYes Whether peer votes to include the disputed transaction.
+     *
+     * @return bool Whether the peer changed its vote. (A new vote counts as a
+     * change.)
+     */
     [[nodiscard]] bool
     setVote(NodeId const& peer, bool votesYes);
 
-    /** Remove a peer's vote
-
-        @param peer Identifier of peer.
-    */
+    /**
+     * Remove a peer's vote
+     *
+     * @param peer Identifier of peer.
+     */
     void
     unVote(NodeId const& peer);
 
-    /** Update our vote given progression of consensus.
-
-        Updates our vote on this disputed transaction based on our peers' votes
-        and how far along consensus has proceeded.
-
-        @param percentTime Percentage progress through consensus, e.g. 50%
-               through or 90%.
-        @param proposing Whether we are proposing to our peers in this round.
-        @param p Consensus parameters controlling thresholds for voting
-        @return Whether our vote changed
-    */
+    /**
+     * Update our vote given progression of consensus.
+     *
+     * Updates our vote on this disputed transaction based on our peers' votes
+     * and how far along consensus has proceeded.
+     *
+     * @param percentTime Percentage progress through consensus, e.g. 50%
+     *        through or 90%.
+     * @param proposing Whether we are proposing to our peers in this round.
+     * @param p Consensus parameters controlling thresholds for voting
+     * @return Whether our vote changed
+     */
     bool
     updateVote(int percentTime, bool proposing, ConsensusParms const& p);
 
-    //! JSON representation of dispute, used for debugging
+    /**
+     * JSON representation of dispute, used for debugging
+     */
     [[nodiscard]] json::Value
     getJson() const;
 
@@ -187,11 +204,17 @@ private:
     bool ourVote_;  //< Our vote (true is yes)
     Tx tx_;         //< Transaction under dispute
     Map_t votes_;   //< Map from NodeID to vote
-    //! The number of rounds we've gone without changing our vote
+    /**
+     * The number of rounds we've gone without changing our vote
+     */
     std::size_t currentVoteCounter_ = 0;
-    //! Which minimum acceptance percentage phase we are currently in
+    /**
+     * Which minimum acceptance percentage phase we are currently in
+     */
     ConsensusParms::AvalancheState avalancheState_ = ConsensusParms::AvalancheState::Init;
-    //! How long we have been in the current acceptance phase
+    /**
+     * How long we have been in the current acceptance phase
+     */
     std::size_t avalancheCounter_ = 0;
     beast::Journal const j_;
 };
diff --git a/src/xrpld/consensus/LedgerTrie.h b/src/xrpld/consensus/LedgerTrie.h
index a21eea2a8a..8b6d9b5bdb 100644
--- a/src/xrpld/consensus/LedgerTrie.h
+++ b/src/xrpld/consensus/LedgerTrie.h
@@ -19,7 +19,8 @@
 
 namespace xrpl {
 
-/** The tip of a span of ledger ancestry
+/**
+ * The tip of a span of ledger ancestry
  */
 template <class Ledger>
 class SpanTip
@@ -37,14 +38,15 @@ public:
     // The ID of the tip ledger
     ID id;
 
-    /** Lookup the ID of an ancestor of the tip ledger
-
-        @param s The sequence number of the ancestor
-        @return The ID of the ancestor with that sequence number
-
-        @note s must be less than or equal to the sequence number of the
-              tip ledger
-    */
+    /**
+     * Lookup the ID of an ancestor of the tip ledger
+     *
+     * @param s The sequence number of the ancestor
+     * @return The ID of the ancestor with that sequence number
+     *
+     * @note s must be less than or equal to the sequence number of the
+     *       tip ledger
+     */
     [[nodiscard]] ID
     ancestor(Seq const& s) const
     {
@@ -199,12 +201,13 @@ struct Node
     std::vector<std::unique_ptr<Node>> children;
     Node* parent = nullptr;
 
-    /** Remove the given node from this Node's children
-
-        @param child The address of the child node to remove
-        @note The child must be a member of the vector. The passed pointer
-              will be dangling as a result of this call
-    */
+    /**
+     * Remove the given node from this Node's children
+     *
+     * @param child The address of the child node to remove
+     * @note The child must be a member of the vector. The passed pointer
+     *       will be dangling as a result of this call
+     */
     void
     erase(Node const* child)
     {
@@ -245,83 +248,84 @@ struct Node
 };
 }  // namespace ledger_trie_detail
 
-/** Ancestry trie of ledgers
-
-    A compressed trie tree that maintains validation support of recent ledgers
-    based on their ancestry.
-
-    The compressed trie structure comes from recognizing that ledger history
-    can be viewed as a string over the alphabet of ledger ids. That is,
-    a given ledger with sequence number `seq` defines a length `seq` string,
-    with i-th entry equal to the id of the ancestor ledger with sequence
-    number i. "Sequence" strings with a common prefix share those ancestor
-    ledgers in common. Tracking this ancestry information and relations across
-    all validated ledgers is done conveniently in a compressed trie. A node in
-    the trie is an ancestor of all its children. If a parent node has sequence
-    number `seq`, each child node has a different ledger starting at `seq+1`.
-    The compression comes from the invariant that any non-root node with 0 tip
-    support has either no children or multiple children. In other words, a
-    non-root 0-tip-support node can be combined with its single child.
-
-    Each node has a tipSupport, which is the number of current validations for
-    that particular ledger. The node's branch support is the sum of the tip
-    support and the branch support of that node's children:
-
-        @code
-        node->branchSupport = node->tipSupport;
-        for (child : node->children)
-           node->branchSupport += child->branchSupport;
-        @endcode
-
-    The templated Ledger type represents a ledger which has a unique history.
-    It should be lightweight and cheap to copy.
-
-       @code
-       // Identifier types that should be equality-comparable and copyable
-       struct ID;
-       struct Seq;
-
-       struct Ledger
-       {
-          struct MakeGenesis{};
-
-          // The genesis ledger represents a ledger that prefixes all other
-          // ledgers
-          Ledger(MakeGenesis{});
-
-          Ledger(Ledger const&);
-          Ledger& operator=(Ledger const&);
-
-          // Return the sequence number of this ledger
-          Seq seq() const;
-
-          // Return the ID of this ledger's ancestor with given sequence number
-          // or ID{0} if unknown
-          ID
-          operator[](Seq s);
-
-       };
-
-       // Return the sequence number of the first possible mismatching ancestor
-       // between two ledgers
-       Seq
-       mismatch(ledgerA, ledgerB);
-       @endcode
-
-    The unique history invariant of ledgers requires any ledgers that agree
-    on the id of a given sequence number agree on ALL ancestors before that
-    ledger:
-
-        @code
-        Ledger a,b;
-        // For all Seq s:
-        if(a[s] == b[s]);
-            for(Seq p = 0; p < s; ++p)
-                assert(a[p] == b[p]);
-        @endcode
-
-    @tparam Ledger A type representing a ledger and its history
-*/
+/**
+ * Ancestry trie of ledgers
+ *
+ * A compressed trie tree that maintains validation support of recent ledgers
+ * based on their ancestry.
+ *
+ * The compressed trie structure comes from recognizing that ledger history
+ * can be viewed as a string over the alphabet of ledger ids. That is,
+ * a given ledger with sequence number `seq` defines a length `seq` string,
+ * with i-th entry equal to the id of the ancestor ledger with sequence
+ * number i. "Sequence" strings with a common prefix share those ancestor
+ * ledgers in common. Tracking this ancestry information and relations across
+ * all validated ledgers is done conveniently in a compressed trie. A node in
+ * the trie is an ancestor of all its children. If a parent node has sequence
+ * number `seq`, each child node has a different ledger starting at `seq+1`.
+ * The compression comes from the invariant that any non-root node with 0 tip
+ * support has either no children or multiple children. In other words, a
+ * non-root 0-tip-support node can be combined with its single child.
+ *
+ * Each node has a tipSupport, which is the number of current validations for
+ * that particular ledger. The node's branch support is the sum of the tip
+ * support and the branch support of that node's children:
+ *
+ *     @code
+ *     node->branchSupport = node->tipSupport;
+ *     for (child : node->children)
+ *        node->branchSupport += child->branchSupport;
+ *     @endcode
+ *
+ * The templated Ledger type represents a ledger which has a unique history.
+ * It should be lightweight and cheap to copy.
+ *
+ *    @code
+ *    // Identifier types that should be equality-comparable and copyable
+ *    struct ID;
+ *    struct Seq;
+ *
+ *    struct Ledger
+ *    {
+ *       struct MakeGenesis{};
+ *
+ *       // The genesis ledger represents a ledger that prefixes all other
+ *       // ledgers
+ *       Ledger(MakeGenesis{});
+ *
+ *       Ledger(Ledger const&);
+ *       Ledger& operator=(Ledger const&);
+ *
+ *       // Return the sequence number of this ledger
+ *       Seq seq() const;
+ *
+ *       // Return the ID of this ledger's ancestor with given sequence number
+ *       // or ID{0} if unknown
+ *       ID
+ *       operator[](Seq s);
+ *
+ *    };
+ *
+ *    // Return the sequence number of the first possible mismatching ancestor
+ *    // between two ledgers
+ *    Seq
+ *    mismatch(ledgerA, ledgerB);
+ *    @endcode
+ *
+ * The unique history invariant of ledgers requires any ledgers that agree
+ * on the id of a given sequence number agree on ALL ancestors before that
+ * ledger:
+ *
+ *     @code
+ *     Ledger a,b;
+ *     // For all Seq s:
+ *     if(a[s] == b[s]);
+ *         for(Seq p = 0; p < s; ++p)
+ *             assert(a[p] == b[p]);
+ *     @endcode
+ *
+ * @tparam Ledger A type representing a ledger and its history
+ */
 template <class Ledger>
 class LedgerTrie
 {
@@ -338,12 +342,13 @@ class LedgerTrie
     // Count of the tip support for each sequence number
     std::map<Seq, std::uint32_t> seqSupport_;
 
-    /** Find the node in the trie that represents the longest common ancestry
-        with the given ledger.
-
-        @return Pair of the found node and the sequence number of the first
-                ledger difference.
-    */
+    /**
+     * Find the node in the trie that represents the longest common ancestry
+     * with the given ledger.
+     *
+     * @return Pair of the found node and the sequence number of the first
+     *         ledger difference.
+     */
     [[nodiscard]] std::pair<Node*, Seq>
     find(Ledger const& ledger) const
     {
@@ -377,12 +382,13 @@ class LedgerTrie
         return std::make_pair(curr, pos);
     }
 
-    /** Find the node in the trie with an exact match to the given ledger ID
-
-        @return the found node or nullptr if an exact match was not found.
-
-        @note O(n) since this searches all nodes until a match is found
-    */
+    /**
+     * Find the node in the trie with an exact match to the given ledger ID
+     *
+     * @return the found node or nullptr if an exact match was not found.
+     *
+     * @note O(n) since this searches all nodes until a match is found
+     */
     Node*
     findByLedgerID(Ledger const& ledger, Node* parent = nullptr) const
     {
@@ -420,10 +426,11 @@ public:
     {
     }
 
-    /** Insert and/or increment the support for the given ledger.
-
-        @param ledger A ledger and its ancestry
-        @param count The count of support for this ledger
+    /**
+     * Insert and/or increment the support for the given ledger.
+     *
+     * @param ledger A ledger and its ancestry
+     * @param count The count of support for this ledger
      */
     void
     insert(Ledger const& ledger, std::uint32_t count = 1)
@@ -504,13 +511,14 @@ public:
         seqSupport_[ledger.seq()] += count;
     }
 
-    /** Decrease support for a ledger, removing and compressing if possible.
-
-        @param ledger The ledger history to remove
-        @param count The amount of tip support to remove
-
-        @return Whether a matching node was decremented and possibly removed.
-    */
+    /**
+     * Decrease support for a ledger, removing and compressing if possible.
+     *
+     * @param ledger The ledger history to remove
+     * @param count The amount of tip support to remove
+     *
+     * @return Whether a matching node was decremented and possibly removed.
+     */
     bool
     remove(Ledger const& ledger, std::uint32_t count = 1)
     {
@@ -564,10 +572,11 @@ public:
         return true;
     }
 
-    /** Return count of tip support for the specific ledger.
-
-        @param ledger The ledger to lookup
-        @return The number of entries in the trie for this *exact* ledger
+    /**
+     * Return count of tip support for the specific ledger.
+     *
+     * @param ledger The ledger to lookup
+     * @return The number of entries in the trie for this *exact* ledger
      */
     [[nodiscard]] std::uint32_t
     tipSupport(Ledger const& ledger) const
@@ -577,11 +586,12 @@ public:
         return 0;
     }
 
-    /** Return the count of branch support for the specific ledger
-
-        @param ledger The ledger to lookup
-        @return The number of entries in the trie for this ledger or a
-                descendant
+    /**
+     * Return the count of branch support for the specific ledger
+     *
+     * @param ledger The ledger to lookup
+     * @return The number of entries in the trie for this ledger or a
+     *         descendant
      */
     [[nodiscard]] std::uint32_t
     branchSupport(Ledger const& ledger) const
@@ -598,65 +608,66 @@ public:
         return loc ? loc->branchSupport : 0;
     }
 
-    /** Return the preferred ledger ID
-
-        The preferred ledger is used to determine the working ledger
-        for consensus amongst competing alternatives.
-
-        Recall that each validator is normally validating a chain of ledgers,
-        e.g. A->B->C->D. However, if due to network connectivity or other
-        issues, validators generate different chains
-
-        @code
-               /->C
-           A->B
-               \->D->E
-        @endcode
-
-        we need a way for validators to converge on the chain with the most
-        support. We call this the preferred ledger.  Intuitively, the idea is to
-        be conservative and only switch to a different branch when you see
-        enough peer validations to *know* another branch won't have preferred
-        support.
-
-        The preferred ledger is found by walking this tree of validated ledgers
-        starting from the common ancestor ledger.
-
-        At each sequence number, we have
-
-           - The prior sequence preferred ledger, e.g. B.
-           - The (tip) support of ledgers with this sequence number,e.g. the
-             number of validators whose last validation was for C or D.
-           - The (branch) total support of all descendants of the current
-             sequence number ledgers, e.g. the branch support of D is the
-             tip support of D plus the tip support of E; the branch support of
-             C is just the tip support of C.
-           - The number of validators that have yet to validate a ledger
-             with this sequence number (uncommitted support). Uncommitted
-             includes all validators whose last sequence number is smaller than
-             our last issued sequence number, since due to asynchrony, we may
-             not have heard from those nodes yet.
-
-        The preferred ledger for this sequence number is then the ledger
-        with relative majority of support, where uncommitted support
-        can be given to ANY ledger at that sequence number
-        (including one not yet known). If no such preferred ledger exists, then
-        the prior sequence preferred ledger is the overall preferred ledger.
-
-        In this example, for D to be preferred, the number of validators
-        supporting it or a descendant must exceed the number of validators
-        supporting C _plus_ the current uncommitted support. This is because if
-        all uncommitted validators end up validating C, that new support must
-        be less than that for D to be preferred.
-
-        If a preferred ledger does exist, then we continue with the next
-        sequence using that ledger as the root.
-
-        @param largestIssued The sequence number of the largest validation
-                             issued by this node.
-        @return Pair with the sequence number and ID of the preferred ledger or
-                std::nullopt if no preferred ledger exists
-    */
+    /**
+     * Return the preferred ledger ID
+     *
+     * The preferred ledger is used to determine the working ledger
+     * for consensus amongst competing alternatives.
+     *
+     * Recall that each validator is normally validating a chain of ledgers,
+     * e.g. A->B->C->D. However, if due to network connectivity or other
+     * issues, validators generate different chains
+     *
+     * @code
+     *        /->C
+     *    A->B
+     *        \->D->E
+     * @endcode
+     *
+     * we need a way for validators to converge on the chain with the most
+     * support. We call this the preferred ledger.  Intuitively, the idea is to
+     * be conservative and only switch to a different branch when you see
+     * enough peer validations to *know* another branch won't have preferred
+     * support.
+     *
+     * The preferred ledger is found by walking this tree of validated ledgers
+     * starting from the common ancestor ledger.
+     *
+     * At each sequence number, we have
+     *
+     *    - The prior sequence preferred ledger, e.g. B.
+     *    - The (tip) support of ledgers with this sequence number,e.g. the
+     *      number of validators whose last validation was for C or D.
+     *    - The (branch) total support of all descendants of the current
+     *      sequence number ledgers, e.g. the branch support of D is the
+     *      tip support of D plus the tip support of E; the branch support of
+     *      C is just the tip support of C.
+     *    - The number of validators that have yet to validate a ledger
+     *      with this sequence number (uncommitted support). Uncommitted
+     *      includes all validators whose last sequence number is smaller than
+     *      our last issued sequence number, since due to asynchrony, we may
+     *      not have heard from those nodes yet.
+     *
+     * The preferred ledger for this sequence number is then the ledger
+     * with relative majority of support, where uncommitted support
+     * can be given to ANY ledger at that sequence number
+     * (including one not yet known). If no such preferred ledger exists, then
+     * the prior sequence preferred ledger is the overall preferred ledger.
+     *
+     * In this example, for D to be preferred, the number of validators
+     * supporting it or a descendant must exceed the number of validators
+     * supporting C _plus_ the current uncommitted support. This is because if
+     * all uncommitted validators end up validating C, that new support must
+     * be less than that for D to be preferred.
+     *
+     * If a preferred ledger does exist, then we continue with the next
+     * sequence using that ledger as the root.
+     *
+     * @param largestIssued The sequence number of the largest validation
+     *                      issued by this node.
+     * @return Pair with the sequence number and ID of the preferred ledger or
+     *         std::nullopt if no preferred ledger exists
+     */
     [[nodiscard]] std::optional<SpanTip<Ledger>>
     getPreferred(Seq const largestIssued) const
     {
@@ -758,7 +769,8 @@ public:
         return curr->span.tip();
     }
 
-    /** Return whether the trie is tracking any ledgers
+    /**
+     * Return whether the trie is tracking any ledgers
      */
     [[nodiscard]] bool
     empty() const
@@ -766,7 +778,8 @@ public:
         return !root_ || root_->branchSupport == 0;
     }
 
-    /** Dump an ascii representation of the trie to the stream
+    /**
+     * Dump an ascii representation of the trie to the stream
      */
     void
     dump(std::ostream& o) const
@@ -774,7 +787,8 @@ public:
         dumpImpl(o, root_, 0);
     }
 
-    /** Dump JSON representation of trie state
+    /**
+     * Dump JSON representation of trie state
      */
     [[nodiscard]] json::Value
     getJson() const
@@ -787,7 +801,8 @@ public:
         return res;
     }
 
-    /** Check the compressed trie and support invariants.
+    /**
+     * Check the compressed trie and support invariants.
      */
     [[nodiscard]] bool
     checkInvariants() const
diff --git a/src/xrpld/consensus/Validations.h b/src/xrpld/consensus/Validations.h
index a204cd0c78..2696804c86 100644
--- a/src/xrpld/consensus/Validations.h
+++ b/src/xrpld/consensus/Validations.h
@@ -26,48 +26,54 @@
 
 namespace xrpl {
 
-/** Timing parameters to control validation staleness and expiration.
-
-    @note These are protocol level parameters that should not be changed without
-          careful consideration.  They are *not* implemented as static constexpr
-          to allow simulation code to test alternate parameter settings.
+/**
+ * Timing parameters to control validation staleness and expiration.
+ *
+ * @note These are protocol level parameters that should not be changed without
+ *       careful consideration.  They are *not* implemented as static constexpr
+ *       to allow simulation code to test alternate parameter settings.
  */
 struct ValidationParms
 {
     explicit ValidationParms() = default;
 
-    /** The number of seconds a validation remains current after its ledger's
-        close time.
-
-        This is a safety to protect against very old validations and the time
-        it takes to adjust the close time accuracy window.
-    */
+    /**
+     * The number of seconds a validation remains current after its ledger's
+     * close time.
+     *
+     * This is a safety to protect against very old validations and the time
+     * it takes to adjust the close time accuracy window.
+     */
     std::chrono::seconds validationCurrentWall = std::chrono::minutes{5};
 
-    /** Duration a validation remains current after first observed.
-
-        The number of seconds a validation remains current after the time we
-        first saw it. This provides faster recovery in very rare cases where the
-        number of validations produced by the network is lower than normal
-    */
+    /**
+     * Duration a validation remains current after first observed.
+     *
+     * The number of seconds a validation remains current after the time we
+     * first saw it. This provides faster recovery in very rare cases where the
+     * number of validations produced by the network is lower than normal
+     */
     std::chrono::seconds validationCurrentLocal = std::chrono::minutes{3};
 
-    /** Duration pre-close in which validations are acceptable.
-
-        The number of seconds before a close time that we consider a validation
-        acceptable. This protects against extreme clock errors
-    */
+    /**
+     * Duration pre-close in which validations are acceptable.
+     *
+     * The number of seconds before a close time that we consider a validation
+     * acceptable. This protects against extreme clock errors
+     */
     std::chrono::seconds validationCurrentEarly = std::chrono::minutes{3};
 
-    /** Duration a set of validations for a given ledger hash remain valid
-
-        The number of seconds before a set of validations for a given ledger
-        hash can expire.  This keeps validations for recent ledgers available
-        for a reasonable interval.
-    */
+    /**
+     * Duration a set of validations for a given ledger hash remain valid
+     *
+     * The number of seconds before a set of validations for a given ledger
+     * hash can expire.  This keeps validations for recent ledgers available
+     * for a reasonable interval.
+     */
     std::chrono::seconds validationSetExpires = std::chrono::minutes{10};
 
-    /** How long we consider a validation fresh.
+    /**
+     * How long we consider a validation fresh.
      *
      *  The number of seconds since a validation has been seen for it to
      *  be considered to accurately represent a live proposer's most recent
@@ -78,12 +84,13 @@ struct ValidationParms
     std::chrono::seconds validationFRESHNESS = std::chrono::seconds{20};
 };
 
-/** Enforce validation increasing sequence requirement.
-
-    Helper class for enforcing that a validation must be larger than all
-    unexpired validation sequence numbers previously issued by the validator
-    tracked by the instance of this class.
-*/
+/**
+ * Enforce validation increasing sequence requirement.
+ *
+ * Helper class for enforcing that a validation must be larger than all
+ * unexpired validation sequence numbers previously issued by the validator
+ * tracked by the instance of this class.
+ */
 template <class Seq>
 class SeqEnforcer
 {
@@ -92,18 +99,19 @@ class SeqEnforcer
     time_point when_;
 
 public:
-    /** Try advancing the largest observed validation ledger sequence
-
-        Try setting the largest validation sequence observed, but return false
-        if it violates the invariant that a validation must be larger than all
-        unexpired validation sequence numbers.
-
-        @param now The current time
-        @param s The sequence number we want to validate
-        @param p Validation parameters
-
-        @return Whether the validation satisfies the invariant
-    */
+    /**
+     * Try advancing the largest observed validation ledger sequence
+     *
+     * Try setting the largest validation sequence observed, but return false
+     * if it violates the invariant that a validation must be larger than all
+     * unexpired validation sequence numbers.
+     *
+     * @param now The current time
+     * @param s The sequence number we want to validate
+     * @param p Validation parameters
+     *
+     * @return Whether the validation satisfies the invariant
+     */
     bool
     operator()(time_point now, Seq s, ValidationParms const& p)
     {
@@ -123,17 +131,18 @@ public:
     }
 };
 
-/** Whether a validation is still current
-
-    Determines whether a validation can still be considered the current
-    validation from a node based on when it was signed by that node and first
-    seen by this node.
-
-    @param p ValidationParms with timing parameters
-    @param now Current time
-    @param signTime When the validation was signed
-    @param seenTime When the validation was first seen locally
-*/
+/**
+ * Whether a validation is still current
+ *
+ * Determines whether a validation can still be considered the current
+ * validation from a node based on when it was signed by that node and first
+ * seen by this node.
+ *
+ * @param p ValidationParms with timing parameters
+ * @param now Current time
+ * @param signTime When the validation was signed
+ * @param seenTime When the validation was first seen locally
+ */
 inline bool
 isCurrent(
     ValidationParms const& p,
@@ -153,17 +162,29 @@ isCurrent(
         ((seenTime == NetClock::time_point{}) || (seenTime < (now + p.validationCurrentLocal)));
 }
 
-/** Status of validation we received */
+/**
+ * Status of validation we received
+ */
 enum class ValStatus {
-    /// This was a new validation and was added
+    /**
+     * This was a new validation and was added
+     */
     Current,
-    /// Not current or was older than current from this node
+    /**
+     * Not current or was older than current from this node
+     */
     Stale,
-    /// A validation violates the increasing seq requirement
+    /**
+     * A validation violates the increasing seq requirement
+     */
     BadSeq,
-    /// Multiple validations by a validator for the same ledger
+    /**
+     * Multiple validations by a validator for the same ledger
+     */
     Multiple,
-    /// Multiple validations by a validator for different ledgers
+    /**
+     * Multiple validations by a validator for different ledgers
+     */
     Conflicting
 };
 
@@ -187,92 +208,93 @@ to_string(ValStatus m)
     }
 }
 
-/** Maintains current and recent ledger validations.
-
-    Manages storage and queries related to validations received on the network.
-    Stores the most current validation from nodes and sets of recent
-    validations grouped by ledger identifier.
-
-    Stored validations are not necessarily from trusted nodes, so clients
-    and implementations should take care to use `trusted` member functions or
-    check the validation's trusted status.
-
-    This class uses a generic interface to allow adapting Validations for
-    specific applications. The Adaptor template implements a set of helper
-    functions and type definitions. The code stubs below outline the
-    interface and type requirements.
-
-
-    @warning The Adaptor::MutexType is used to manage concurrent access to
-             private members of Validations but does not manage any data in the
-             Adaptor instance itself.
-
-    @code
-
-    // Conforms to the Ledger type requirements of LedgerTrie
-    struct Ledger;
-
-    struct Validation
-    {
-        using NodeID = ...;
-        using NodeKey = ...;
-
-        // Ledger ID associated with this validation
-        Ledger::ID ledgerID() const;
-
-        // Sequence number of validation's ledger (0 means no sequence number)
-        Ledger::Seq seq() const
-
-        // When the validation was signed
-        NetClock::time_point signTime() const;
-
-        // When the validation was first observed by this node
-        NetClock::time_point seenTime() const;
-
-        // Signing key of node that published the validation
-        NodeKey key() const;
-
-        // Whether the publishing node was trusted at the time the validation
-        // arrived
-        bool trusted() const;
-
-        // Set the validation as trusted
-        void setTrusted();
-
-        // Set the validation as untrusted
-        void setUntrusted();
-
-        // Whether this is a full or partial validation
-        bool full() const;
-
-        // Identifier for this node that remains fixed even when rotating
-        // signing keys
-        NodeID nodeID()  const;
-
-        implementation_specific_t
-        unwrap() -> return the implementation-specific type being wrapped
-
-        // ... implementation specific
-    };
-
-    class Adaptor
-    {
-        using Mutex = std::mutex;
-        using Validation = Validation;
-        using Ledger = Ledger;
-
-        // Return the current network time (used to determine staleness)
-        NetClock::time_point now() const;
-
-        // Attempt to acquire a specific ledger.
-        std::optional<Ledger> acquire(Ledger::ID const & ledgerID);
-
-        // ... implementation specific
-    };
-    @endcode
-
-    @tparam Adaptor Provides type definitions and callbacks
-*/
+/**
+ * Maintains current and recent ledger validations.
+ *
+ * Manages storage and queries related to validations received on the network.
+ * Stores the most current validation from nodes and sets of recent
+ * validations grouped by ledger identifier.
+ *
+ * Stored validations are not necessarily from trusted nodes, so clients
+ * and implementations should take care to use `trusted` member functions or
+ * check the validation's trusted status.
+ *
+ * This class uses a generic interface to allow adapting Validations for
+ * specific applications. The Adaptor template implements a set of helper
+ * functions and type definitions. The code stubs below outline the
+ * interface and type requirements.
+ *
+ *
+ * @warning The Adaptor::MutexType is used to manage concurrent access to
+ *          private members of Validations but does not manage any data in the
+ *          Adaptor instance itself.
+ *
+ * @code
+ *
+ * // Conforms to the Ledger type requirements of LedgerTrie
+ * struct Ledger;
+ *
+ * struct Validation
+ * {
+ *     using NodeID = ...;
+ *     using NodeKey = ...;
+ *
+ *     // Ledger ID associated with this validation
+ *     Ledger::ID ledgerID() const;
+ *
+ *     // Sequence number of validation's ledger (0 means no sequence number)
+ *     Ledger::Seq seq() const
+ *
+ *     // When the validation was signed
+ *     NetClock::time_point signTime() const;
+ *
+ *     // When the validation was first observed by this node
+ *     NetClock::time_point seenTime() const;
+ *
+ *     // Signing key of node that published the validation
+ *     NodeKey key() const;
+ *
+ *     // Whether the publishing node was trusted at the time the validation
+ *     // arrived
+ *     bool trusted() const;
+ *
+ *     // Set the validation as trusted
+ *     void setTrusted();
+ *
+ *     // Set the validation as untrusted
+ *     void setUntrusted();
+ *
+ *     // Whether this is a full or partial validation
+ *     bool full() const;
+ *
+ *     // Identifier for this node that remains fixed even when rotating
+ *     // signing keys
+ *     NodeID nodeID()  const;
+ *
+ *     implementation_specific_t
+ *     unwrap() -> return the implementation-specific type being wrapped
+ *
+ *     // ... implementation specific
+ * };
+ *
+ * class Adaptor
+ * {
+ *     using Mutex = std::mutex;
+ *     using Validation = Validation;
+ *     using Ledger = Ledger;
+ *
+ *     // Return the current network time (used to determine staleness)
+ *     NetClock::time_point now() const;
+ *
+ *     // Attempt to acquire a specific ledger.
+ *     std::optional<Ledger> acquire(Ledger::ID const & ledgerID);
+ *
+ *     // ... implementation specific
+ * };
+ * @endcode
+ *
+ * @tparam Adaptor Provides type definitions and callbacks
+ */
 template <class Adaptor>
 class Validations
 {
@@ -299,7 +321,9 @@ class Validations
     // Sequence of the largest validation received from each node
     hash_map<NodeID, SeqEnforcer<Seq>> seqEnforcers_;
 
-    //! Validations from listed nodes, indexed by ledger id (partial and full)
+    /**
+     * Validations from listed nodes, indexed by ledger id (partial and full)
+     */
     beast::aged_unordered_map<
         ID,
         hash_map<NodeID, Validation>,
@@ -397,19 +421,20 @@ private:
         trie_.insert(ledger);
     }
 
-    /** Process a new validation
-
-        Process a new trusted validation from a validator. This will be
-        reflected only after the validated ledger is successfully acquired by
-        the local node. In the interim, the prior validated ledger from this
-        node remains.
-
-        @param lock Existing lock of mutex_
-        @param nodeID The node identifier of the validating node
-        @param val The trusted validation issued by the node
-        @param prior If not none, the last current validated ledger Seq,ID of
-                     key
-    */
+    /**
+     * Process a new validation
+     *
+     * Process a new trusted validation from a validator. This will be
+     * reflected only after the validated ledger is successfully acquired by
+     * the local node. In the interim, the prior validated ledger from this
+     * node remains.
+     *
+     * @param lock Existing lock of mutex_
+     * @param nodeID The node identifier of the validating node
+     * @param val The trusted validation issued by the node
+     * @param prior If not none, the last current validated ledger Seq,ID of
+     *              key
+     */
     void
     updateTrie(
         std::scoped_lock<Mutex> const& lock,
@@ -452,18 +477,18 @@ private:
         }
     }
 
-    /** Use the trie for a calculation
-
-        Accessing the trie through this helper ensures acquiring validations
-        are checked and any stale validations are flushed from the trie.
-
-        @param lock Existing lock of mutex_
-        @param f Invocable with signature (LedgerTrie<Ledger> &)
-
-        @warning The invocable `f` is expected to be a simple transformation of
-                 its arguments and will be called with mutex_ under lock.
-
-    */
+    /**
+     * Use the trie for a calculation
+     *
+     * Accessing the trie through this helper ensures acquiring validations
+     * are checked and any stale validations are flushed from the trie.
+     *
+     * @param lock Existing lock of mutex_
+     * @param f Invocable with signature (LedgerTrie<Ledger> &)
+     *
+     * @warning The invocable `f` is expected to be a simple transformation of
+     *          its arguments and will be called with mutex_ under lock.
+     */
     template <class F>
     auto
     withTrie(std::scoped_lock<Mutex> const& lock, F&& f)
@@ -474,21 +499,22 @@ private:
         return f(trie_);
     }
 
-    /** Iterate current validations.
-
-        Iterate current validations, flushing any which are stale.
-
-        @param lock Existing lock of mutex_
-        @param pre Invocable with signature (std::size_t) called prior to
-                   looping.
-        @param f Invocable with signature (NodeID const &, Validations const &)
-                 for each current validation.
-
-        @note The invocable `pre` is called _prior_ to checking for staleness
-              and reflects an upper-bound on the number of calls to `f.
-        @warning The invocable `f` is expected to be a simple transformation of
-                 its arguments and will be called with mutex_ under lock.
-    */
+    /**
+     * Iterate current validations.
+     *
+     * Iterate current validations, flushing any which are stale.
+     *
+     * @param lock Existing lock of mutex_
+     * @param pre Invocable with signature (std::size_t) called prior to
+     *            looping.
+     * @param f Invocable with signature (NodeID const &, Validations const &)
+     *          for each current validation.
+     *
+     * @note The invocable `pre` is called _prior_ to checking for staleness
+     *       and reflects an upper-bound on the number of calls to `f.
+     * @warning The invocable `f` is expected to be a simple transformation of
+     *          its arguments and will be called with mutex_ under lock.
+     */
 
     template <class Pre, class F>
     void
@@ -515,18 +541,19 @@ private:
         }
     }
 
-    /** Iterate the set of validations associated with a given ledger id
-
-        @param lock Existing lock on mutex_
-        @param ledgerID The identifier of the ledger
-        @param pre Invocable with signature(std::size_t)
-        @param f Invocable with signature (NodeID const &, Validation const &)
-
-        @note The invocable `pre` is called prior to iterating validations. The
-              argument is the number of times `f` will be called.
-        @warning The invocable f is expected to be a simple transformation of
-       its arguments and will be called with mutex_ under lock.
-    */
+    /**
+     * Iterate the set of validations associated with a given ledger id
+     *
+     * @param lock Existing lock on mutex_
+     * @param ledgerID The identifier of the ledger
+     * @param pre Invocable with signature(std::size_t)
+     * @param f Invocable with signature (NodeID const &, Validation const &)
+     *
+     * @note The invocable `pre` is called prior to iterating validations. The
+     *       argument is the number of times `f` will be called.
+     * @warning The invocable f is expected to be a simple transformation of
+     * its arguments and will be called with mutex_ under lock.
+     */
     template <class Pre, class F>
     void
     byLedger(std::scoped_lock<Mutex> const&, ID const& ledgerID, Pre&& pre, F&& f)
@@ -543,12 +570,13 @@ private:
     }
 
 public:
-    /** Constructor
-
-        @param p ValidationParms to control staleness/expiration of validations
-        @param c Clock to use for expiring validations stored by ledger
-        @param ts Parameters for constructing Adaptor instance
-    */
+    /**
+     * Constructor
+     *
+     * @param p ValidationParms to control staleness/expiration of validations
+     * @param c Clock to use for expiring validations stored by ledger
+     * @param ts Parameters for constructing Adaptor instance
+     */
     template <class... Ts>
     Validations(
         ValidationParms const& p,
@@ -558,7 +586,8 @@ public:
     {
     }
 
-    /** Return the adaptor instance
+    /**
+     * Return the adaptor instance
      */
     Adaptor const&
     adaptor() const
@@ -566,7 +595,8 @@ public:
         return adaptor_;
     }
 
-    /** Return the validation timing parameters
+    /**
+     * Return the validation timing parameters
      */
     ValidationParms const&
     parms() const
@@ -574,13 +604,14 @@ public:
         return parms_;
     }
 
-    /** Return whether the local node can issue a validation for the given
-       sequence number
-
-        @param s The sequence number of the ledger the node wants to validate
-        @return Whether the validation satisfies the invariant, updating the
-                largest sequence number seen accordingly
-    */
+    /**
+     * Return whether the local node can issue a validation for the given
+     * sequence number
+     *
+     * @param s The sequence number of the ledger the node wants to validate
+     * @return Whether the validation satisfies the invariant, updating the
+     *         largest sequence number seen accordingly
+     */
     bool
     canValidateSeq(Seq const s)
     {
@@ -588,14 +619,15 @@ public:
         return localSeqEnforcer_(byLedger_.clock().now(), s, parms_);
     }
 
-    /** Add a new validation
-
-        Attempt to add a new validation.
-
-        @param nodeID The identity of the node issuing this validation
-        @param val The validation to store
-        @return The outcome
-    */
+    /**
+     * Add a new validation
+     *
+     * Attempt to add a new validation.
+     *
+     * @param nodeID The identity of the node issuing this validation
+     * @param val The validation to store
+     * @return The outcome
+     */
     ValStatus
     add(NodeID const& nodeID, Validation const& val)
     {
@@ -696,11 +728,12 @@ public:
         toKeep_ = {low, high};
     }
 
-    /** Expire old validation sets
-
-        Remove validation sets that were accessed more than
-        validationSET_EXPIRES ago and were not asked to keep.
-    */
+    /**
+     * Expire old validation sets
+     *
+     * Remove validation sets that were accessed more than
+     * validationSET_EXPIRES ago and were not asked to keep.
+     */
     void
     expire(beast::Journal const& j)
     {
@@ -751,15 +784,16 @@ public:
                         << "ms";
     }
 
-    /** Update trust status of validations
-
-        Updates the trusted status of known validations to account for nodes
-        that have been added or removed from the UNL. This also updates the trie
-        to ensure only currently trusted nodes' validations are used.
-
-        @param added Identifiers of nodes that are now trusted
-        @param removed Identifiers of nodes that are no longer trusted
-    */
+    /**
+     * Update trust status of validations
+     *
+     * Updates the trusted status of known validations to account for nodes
+     * that have been added or removed from the UNL. This also updates the trie
+     * to ensure only currently trusted nodes' validations are used.
+     *
+     * @param added Identifiers of nodes that are now trusted
+     * @param removed Identifiers of nodes that are no longer trusted
+     */
     void
     trustChanged(hash_set<NodeID> const& added, hash_set<NodeID> const& removed)
     {
@@ -803,18 +837,19 @@ public:
         return trie_.getJson();
     }
 
-    /** Return the sequence number and ID of the preferred working ledger
-
-        A ledger is preferred if it has more support amongst trusted validators
-        and is *not* an ancestor of the current working ledger; otherwise it
-        remains the current working ledger.
-
-        @param curr The local node's current working ledger
-
-        @return The sequence and id of the preferred working ledger,
-                or std::nullopt if no trusted validations are available to
-                determine the preferred ledger.
-    */
+    /**
+     * Return the sequence number and ID of the preferred working ledger
+     *
+     * A ledger is preferred if it has more support amongst trusted validators
+     * and is *not* an ancestor of the current working ledger; otherwise it
+     * remains the current working ledger.
+     *
+     * @param curr The local node's current working ledger
+     *
+     * @return The sequence and id of the preferred working ledger,
+     *         or std::nullopt if no trusted validations are available to
+     *         determine the preferred ledger.
+     */
     std::optional<std::pair<Seq, ID>>
     getPreferred(Ledger const& curr)
     {
@@ -859,15 +894,16 @@ public:
         return std::make_pair(curr.seq(), curr.id());
     }
 
-    /** Get the ID of the preferred working ledger that exceeds a minimum valid
-        ledger sequence number
-
-        @param curr Current working ledger
-        @param minValidSeq Minimum allowed sequence number
-
-        @return ID Of the preferred ledger, or curr if the preferred ledger
-                   is not valid
-    */
+    /**
+     * Get the ID of the preferred working ledger that exceeds a minimum valid
+     * ledger sequence number
+     *
+     * @param curr Current working ledger
+     * @param minValidSeq Minimum allowed sequence number
+     *
+     * @return ID Of the preferred ledger, or curr if the preferred ledger
+     *            is not valid
+     */
     ID
     getPreferred(Ledger const& curr, Seq minValidSeq)
     {
@@ -877,22 +913,23 @@ public:
         return curr.id();
     }
 
-    /** Determine the preferred last closed ledger for the next consensus round.
-
-        Called before starting the next round of ledger consensus to determine
-        the preferred working ledger. Uses the dominant peerCount ledger if no
-        trusted validations are available.
-
-        @param lcl Last closed ledger by this node
-        @param minSeq Minimum allowed sequence number of the trusted preferred
-                      ledger
-        @param peerCounts Map from ledger ids to count of peers with that as the
-                          last closed ledger
-        @return The preferred last closed ledger ID
-
-        @note The minSeq does not apply to the peerCounts, since this function
-              does not know their sequence number
-    */
+    /**
+     * Determine the preferred last closed ledger for the next consensus round.
+     *
+     * Called before starting the next round of ledger consensus to determine
+     * the preferred working ledger. Uses the dominant peerCount ledger if no
+     * trusted validations are available.
+     *
+     * @param lcl Last closed ledger by this node
+     * @param minSeq Minimum allowed sequence number of the trusted preferred
+     *               ledger
+     * @param peerCounts Map from ledger ids to count of peers with that as the
+     *                   last closed ledger
+     * @return The preferred last closed ledger ID
+     *
+     * @note The minSeq does not apply to the peerCounts, since this function
+     *       does not know their sequence number
+     */
     ID
     getPreferredLCL(Ledger const& lcl, Seq minSeq, hash_map<ID, std::uint32_t> const& peerCounts)
     {
@@ -915,17 +952,18 @@ public:
         return lcl.id();
     }
 
-    /** Count the number of current trusted validators working on a ledger
-        after the specified one.
-
-        @param ledger The working ledger
-        @param ledgerID The preferred ledger
-        @return The number of current trusted validators working on a descendant
-                of the preferred ledger
-
-        @note If ledger.id() != ledgerID, only counts immediate child ledgers of
-              ledgerID
-    */
+    /**
+     * Count the number of current trusted validators working on a ledger
+     * after the specified one.
+     *
+     * @param ledger The working ledger
+     * @param ledgerID The preferred ledger
+     * @return The number of current trusted validators working on a descendant
+     *         of the preferred ledger
+     *
+     * @note If ledger.id() != ledgerID, only counts immediate child ledgers of
+     *       ledgerID
+     */
     std::size_t
     getNodesAfter(Ledger const& ledger, ID const& ledgerID)
     {
@@ -946,10 +984,11 @@ public:
         });
     }
 
-    /** Get the currently trusted full validations
-
-        @return Vector of validations from currently trusted validators
-    */
+    /**
+     * Get the currently trusted full validations
+     *
+     * @return Vector of validations from currently trusted validators
+     */
     std::vector<WrappedValidationType>
     currentTrusted()
     {
@@ -965,10 +1004,11 @@ public:
         return ret;
     }
 
-    /** Get the set of node ids associated with current validations
-
-        @return The set of node ids for active, listed validators
-    */
+    /**
+     * Get the set of node ids associated with current validations
+     *
+     * @return The set of node ids for active, listed validators
+     */
     auto
     getCurrentNodeIDs() -> hash_set<NodeID>
     {
@@ -982,11 +1022,12 @@ public:
         return ret;
     }
 
-    /** Count the number of trusted full validations for the given ledger
-
-        @param ledgerID The identifier of ledger of interest
-        @return The number of trusted validations
-    */
+    /**
+     * Count the number of trusted full validations for the given ledger
+     *
+     * @param ledgerID The identifier of ledger of interest
+     * @return The number of trusted validations
+     */
     std::size_t
     numTrustedForLedger(ID const& ledgerID)
     {
@@ -1003,12 +1044,13 @@ public:
         return count;
     }
 
-    /**  Get trusted full validations for a specific ledger
-
-         @param ledgerID The identifier of ledger of interest
-         @param seq The sequence number of ledger of interest
-         @return Trusted validations associated with ledger
-    */
+    /**
+     * Get trusted full validations for a specific ledger
+     *
+     * @param ledgerID The identifier of ledger of interest
+     * @param seq The sequence number of ledger of interest
+     * @return Trusted validations associated with ledger
+     */
     std::vector<WrappedValidationType>
     getTrustedForLedger(ID const& ledgerID, Seq const& seq)
     {
@@ -1026,12 +1068,13 @@ public:
         return res;
     }
 
-    /** Returns fees reported by trusted full validators in the given ledger
-
-        @param ledgerID The identifier of ledger of interest
-        @param baseFee The fee to report if not present in the validation
-        @return Vector of fees
-    */
+    /**
+     * Returns fees reported by trusted full validators in the given ledger
+     *
+     * @param ledgerID The identifier of ledger of interest
+     * @param baseFee The fee to report if not present in the validation
+     * @return Vector of fees
+     */
     std::vector<std::uint32_t>
     fees(ID const& ledgerID, std::uint32_t baseFee)
     {
@@ -1058,7 +1101,8 @@ public:
         return res;
     }
 
-    /** Flush all current validations
+    /**
+     * Flush all current validations
      */
     void
     flush()
@@ -1067,7 +1111,8 @@ public:
         current_.clear();
     }
 
-    /** Return quantity of lagging proposers, and remove online proposers
+    /**
+     * Return quantity of lagging proposers, and remove online proposers
      *  for purposes of evaluating whether to pause.
      *
      *  Laggards are the trusted proposers whose sequence number is lower
diff --git a/src/xrpld/core/Config.h b/src/xrpld/core/Config.h
index 285ea7b9ac..852e46218a 100644
--- a/src/xrpld/core/Config.h
+++ b/src/xrpld/core/Config.h
@@ -44,26 +44,35 @@ enum class SizedItem : std::size_t {
     AccountIdCacheSize,
 };
 
-/** Fee schedule for startup / standalone, and to vote for.
-During voting ledgers, the FeeVote logic will try to move towards
-these values when injecting fee-setting transactions.
-A default-constructed Setup contains recommended values.
-*/
+/**
+ * Fee schedule for startup / standalone, and to vote for.
+ * During voting ledgers, the FeeVote logic will try to move towards
+ * these values when injecting fee-setting transactions.
+ * A default-constructed Setup contains recommended values.
+ */
 struct FeeSetup
 {
-    /** The cost of a reference transaction in drops. */
+    /**
+     * The cost of a reference transaction in drops.
+     */
     XRPAmount referenceFee{10};
 
-    /** The account reserve requirement in drops. */
+    /**
+     * The account reserve requirement in drops.
+     */
     XRPAmount accountReserve{10 * kDropsPerXrp};
 
-    /** The per-owned item reserve requirement in drops. */
+    /**
+     * The per-owned item reserve requirement in drops.
+     */
     XRPAmount ownerReserve{2 * kDropsPerXrp};
 
     /* (Remember to update the example cfg files when changing any of these
      * values.) */
 
-    /** Convert to a Fees object for use with Ledger construction. */
+    /**
+     * Convert to a Fees object for use with Ledger construction.
+     */
     [[nodiscard]] Fees
     toFees() const
     {
@@ -85,7 +94,9 @@ public:
     static char const* const kDatabaseDirName;
     static char const* const kValidatorsFileName;
 
-    /** Returns the full path and filename of the debug log file. */
+    /**
+     * Returns the full path and filename of the debug log file.
+     */
     [[nodiscard]] boost::filesystem::path
     getDebugLogFile() const;
 
@@ -104,25 +115,27 @@ private:
 
     bool quiet_ = false;   // Minimize logging verbosity.
     bool silent_ = false;  // No output to console after startup.
-    /** Operate in stand-alone mode.
-
-        In stand alone mode:
-
-        - Peer connections are not attempted or accepted
-        - The ledger is not advanced automatically.
-        - If no ledger is loaded, the default ledger with the root
-          account is created.
-    */
+    /**
+     * Operate in stand-alone mode.
+     *
+     * In stand alone mode:
+     *
+     * - Peer connections are not attempted or accepted
+     * - The ledger is not advanced automatically.
+     * - If no ledger is loaded, the default ledger with the root
+     *   account is created.
+     */
     bool runStandalone_ = false;
 
     bool useTxTables_ = true;
 
-    /** Determines if the server will sign a tx, given an account's secret seed.
-
-        In the past, this was allowed, but this functionality can have security
-        implications. The new default is to not allow this functionality, but
-        a config option is included to enable this.
-    */
+    /**
+     * Determines if the server will sign a tx, given an account's secret seed.
+     *
+     * In the past, this was allowed, but this functionality can have security
+     * implications. The new default is to not allow this functionality, but
+     * a config option is included to enable this.
+     */
     bool signingEnabled_ = false;
 
     // The amount of RAM, in bytes, that we detected on this system.
@@ -236,12 +249,16 @@ public:
     // Enable base squelching of duplicate validation/proposal messages
     bool vpReduceRelayBaseSquelchEnable = false;
 
-    /////////////////////  !!TEMPORARY CODE BLOCK!! ////////////////////////
+    /**
+     * //////////////////  !!TEMPORARY CODE BLOCK!! ////////////////////////
+     */
     // Temporary squelching config for the peers selected as a source of  //
     // validator messages. The config must be removed once squelching is  //
     // made the default routing algorithm                                 //
     std::size_t vpReduceRelaySquelchMaxSelectedPeers = 5;
-    /////////////////    END OF TEMPORARY CODE BLOCK    /////////////////////
+    /**
+     * //////////////    END OF TEMPORARY CODE BLOCK    /////////////////////
+     */
 
     // Transaction reduce-relay feature
     bool txReduceRelayEnable = false;
@@ -299,9 +316,9 @@ public:
     setupControl(bool bQuiet, bool bSilent, bool bStandalone);
 
     /**
-     *  Load the config from the contents of the string.
+     * Load the config from the contents of the string.
      *
-     *  @param fileContents String representing the config contents.
+     * @param fileContents String representing the config contents.
      */
     void
     loadFromString(std::string const& fileContents);
@@ -334,23 +351,24 @@ public:
         return signingEnabled_;
     }
 
-    /** Retrieve the default value for the item at the specified node size
-
-        @param item The item for which the default value is needed
-        @param node Optional value, used to adjust the result to match the
-                    size of a node (0: tiny, ..., 4: huge). If unseated,
-                    uses the configured size (NODE_SIZE).
-
-        @throw This method can throw std::out_of_range if you ask for values
-               that it does not recognize or request a non-default node-size.
-
-        @return The value for the requested item.
-
-        @note The defaults are selected so as to be reasonable, but the node
-              size is an imprecise metric that combines multiple aspects of
-              the underlying system; this means that we can't provide optimal
-              defaults in the code for every case.
-    */
+    /**
+     * Retrieve the default value for the item at the specified node size
+     *
+     * @param item The item for which the default value is needed
+     * @param node Optional value, used to adjust the result to match the
+     *             size of a node (0: tiny, ..., 4: huge). If unseated,
+     *             uses the configured size (NODE_SIZE).
+     *
+     * @throws This method can throw std::out_of_range if you ask for values
+     *         that it does not recognize or request a non-default node-size.
+     *
+     * @return The value for the requested item.
+     *
+     * @note The defaults are selected so as to be reasonable, but the node
+     *       size is an imprecise metric that combines multiple aspects of
+     *       the underlying system; this means that we can't provide optimal
+     *       defaults in the code for every case.
+     */
     [[nodiscard]] int
     getValueFor(SizedItem item, std::optional<std::size_t> node = std::nullopt) const;
 
diff --git a/src/xrpld/core/NetworkIDServiceImpl.h b/src/xrpld/core/NetworkIDServiceImpl.h
index 2236a854ff..7977566ef8 100644
--- a/src/xrpld/core/NetworkIDServiceImpl.h
+++ b/src/xrpld/core/NetworkIDServiceImpl.h
@@ -9,12 +9,13 @@ namespace xrpl {
 // Forward declaration
 class Config;
 
-/** Implementation of NetworkIDService that reads from Config.
-
-    This class provides a NetworkIDService interface that wraps
-    the network ID from the application Config. It caches the
-    network ID at construction time.
-*/
+/**
+ * Implementation of NetworkIDService that reads from Config.
+ *
+ * This class provides a NetworkIDService interface that wraps
+ * the network ID from the application Config. It caches the
+ * network ID at construction time.
+ */
 class NetworkIDServiceImpl final : public NetworkIDService
 {
 public:
diff --git a/src/xrpld/core/TimeKeeper.h b/src/xrpld/core/TimeKeeper.h
index 9e067759ec..8ee9d17a06 100644
--- a/src/xrpld/core/TimeKeeper.h
+++ b/src/xrpld/core/TimeKeeper.h
@@ -8,7 +8,9 @@
 
 namespace xrpl {
 
-/** Manages various times used by the server. */
+/**
+ * Manages various times used by the server.
+ */
 class TimeKeeper : public beast::AbstractClock<NetClock>
 {
 private:
@@ -25,34 +27,36 @@ private:
 public:
     ~TimeKeeper() override = default;
 
-    /** Returns the current time, using the server's clock.
-
-        It's possible for servers to have a different value for network
-        time, especially if they do not use some external mechanism for
-        time synchronization (e.g. NTP or SNTP). This is fine.
-
-        This estimate is not directly visible to other servers over the
-        protocol, but it is possible for them to make an educated guess
-        if this server publishes proposals or validations.
-
-        @note The network time is adjusted for the "XRPL epoch" which
-              was arbitrarily defined as 2000-01-01T00:00:00Z by Arthur
-              Britto and David Schwartz during early development of the
-              code. No rationale has been provided for this curious and
-              annoying, but otherwise unimportant, choice.
-    */
+    /**
+     * Returns the current time, using the server's clock.
+     *
+     * It's possible for servers to have a different value for network
+     * time, especially if they do not use some external mechanism for
+     * time synchronization (e.g. NTP or SNTP). This is fine.
+     *
+     * This estimate is not directly visible to other servers over the
+     * protocol, but it is possible for them to make an educated guess
+     * if this server publishes proposals or validations.
+     *
+     * @note The network time is adjusted for the "XRPL epoch" which
+     *       was arbitrarily defined as 2000-01-01T00:00:00Z by Arthur
+     *       Britto and David Schwartz during early development of the
+     *       code. No rationale has been provided for this curious and
+     *       annoying, but otherwise unimportant, choice.
+     */
     [[nodiscard]] time_point
     now() const override
     {
         return adjust(std::chrono::system_clock::now());
     }
 
-    /** Returns the predicted close time, in network time.
-
-        The predicted close time represents the notional "center" of the
-        network. Each server assumes that its clock is correct and tries
-        to pull the close time towards its measure of network time.
-    */
+    /**
+     * Returns the predicted close time, in network time.
+     *
+     * The predicted close time represents the notional "center" of the
+     * network. Each server assumes that its clock is correct and tries
+     * to pull the close time towards its measure of network time.
+     */
     [[nodiscard]] time_point
     closeTime() const
     {
@@ -66,7 +70,9 @@ public:
         return closeOffset_.load();
     }
 
-    /** Adjust the close time, based on the network's view of time. */
+    /**
+     * Adjust the close time, based on the network's view of time.
+     */
     std::chrono::seconds
     adjustCloseTime(std::chrono::seconds by)
     {
diff --git a/src/xrpld/core/detail/Config.cpp b/src/xrpld/core/detail/Config.cpp
index 0706163ab1..3b7b57328b 100644
--- a/src/xrpld/core/detail/Config.cpp
+++ b/src/xrpld/core/detail/Config.cpp
@@ -793,7 +793,9 @@ Config::loadFromString(std::string const& fileContents)
     {
         auto sec = section(Sections::kReduceRelay);
 
-        /////////////////////  !!TEMPORARY CODE BLOCK!! ////////////////////////
+        /**
+         * //////////////////  !!TEMPORARY CODE BLOCK!! ////////////////////////
+         */
         // vp_enable config option is deprecated by vp_base_squelch_enable    //
         // This option is kept for backwards compatibility. When squelching   //
         // is the default algorithm, it must be replaced with:                //
@@ -821,9 +823,13 @@ Config::loadFromString(std::string const& fileContents)
         {
             vpReduceRelayBaseSquelchEnable = false;
         }
-        /////////////////  !!END OF TEMPORARY CODE BLOCK!! /////////////////////
+        /**
+         * //////////////  !!END OF TEMPORARY CODE BLOCK!! /////////////////////
+         */
 
-        /////////////////////  !!TEMPORARY CODE BLOCK!! ///////////////////////
+        /**
+         * //////////////////  !!TEMPORARY CODE BLOCK!! ///////////////////////
+         */
         // Temporary squelching config for the peers selected as a source of //
         // validator messages. The config must be removed once squelching is //
         // made the default routing algorithm.                               //
@@ -835,7 +841,9 @@ Config::loadFromString(std::string const& fileContents)
                 " vp_base_squelch_max_selected_peers must be "
                 "greater than or equal to 3");
         }
-        /////////////////  !!END OF TEMPORARY CODE BLOCK!! /////////////////////
+        /**
+         * //////////////  !!END OF TEMPORARY CODE BLOCK!! /////////////////////
+         */
 
         txReduceRelayEnable = sec.valueOr(Keys::kTxEnable, false);
         txReduceRelayMetrics = sec.valueOr(Keys::kTxMetrics, false);
diff --git a/src/xrpld/overlay/Cluster.h b/src/xrpld/overlay/Cluster.h
index b3864e0fc6..703e1601aa 100644
--- a/src/xrpld/overlay/Cluster.h
+++ b/src/xrpld/overlay/Cluster.h
@@ -53,23 +53,27 @@ private:
 public:
     Cluster(beast::Journal j);
 
-    /** Determines whether a node belongs in the cluster
-        @return std::nullopt if the node isn't a member,
-                otherwise, the comment associated with the
-                node (which may be an empty string).
-    */
+    /**
+     * Determines whether a node belongs in the cluster
+     * @return std::nullopt if the node isn't a member,
+     *         otherwise, the comment associated with the
+     *         node (which may be an empty string).
+     */
     std::optional<std::string>
     member(PublicKey const& node) const;
 
-    /** The number of nodes in the cluster list. */
+    /**
+     * The number of nodes in the cluster list.
+     */
     std::size_t
     size() const;
 
-    /** Store information about the state of a cluster node.
-        @param identity The node's public identity
-        @param name The node's name (may be empty)
-        @return true if we updated our information
-    */
+    /**
+     * Store information about the state of a cluster node.
+     * @param identity The node's public identity
+     * @param name The node's name (may be empty)
+     * @return true if we updated our information
+     */
     bool
     update(
         PublicKey const& identity,
@@ -77,23 +81,25 @@ public:
         std::uint32_t loadFee = 0,
         NetClock::time_point reportTime = NetClock::time_point{});
 
-    /** Invokes the callback once for every cluster node.
-        @note You are not allowed to call `update` from
-              within the callback.
-    */
+    /**
+     * Invokes the callback once for every cluster node.
+     * @note You are not allowed to call `update` from
+     *       within the callback.
+     */
     void
     forEach(std::function<void(ClusterNode const&)> func) const;
 
-    /** Load the list of cluster nodes.
-
-        The section contains entries consisting of a base58
-        encoded node public key, optionally followed by
-        a comment.
-
-        @return false if an entry could not be parsed or
-                contained an invalid node public key,
-                true otherwise.
-    */
+    /**
+     * Load the list of cluster nodes.
+     *
+     * The section contains entries consisting of a base58
+     * encoded node public key, optionally followed by
+     * a comment.
+     *
+     * @return false if an entry could not be parsed or
+     *         contained an invalid node public key,
+     *         true otherwise.
+     */
     bool
     load(Section const& nodes);
 };
diff --git a/src/xrpld/overlay/Compression.h b/src/xrpld/overlay/Compression.h
index 4b7493e7e6..8d4a1d56c8 100644
--- a/src/xrpld/overlay/Compression.h
+++ b/src/xrpld/overlay/Compression.h
@@ -18,7 +18,8 @@ enum class Algorithm : std::uint8_t { None = 0x00, LZ4 = 0x90 };
 
 enum class Compressed : std::uint8_t { On, Off };
 
-/** Decompress input stream.
+/**
+ * Decompress input stream.
  * @tparam InputStream ZeroCopyInputStream
  * @param in Input source stream
  * @param inSize Size of compressed data
@@ -57,7 +58,8 @@ decompress(
     return 0;
 }
 
-/** Compress input data.
+/**
+ * Compress input data.
  * @tparam BufferFactory Callable object or lambda.
  *     Takes the requested buffer size and returns allocated buffer pointer.
  * @param in Data to compress
diff --git a/src/xrpld/overlay/Message.h b/src/xrpld/overlay/Message.h
index 63aa360f92..2e187a2a4d 100644
--- a/src/xrpld/overlay/Message.h
+++ b/src/xrpld/overlay/Message.h
@@ -39,7 +39,8 @@ class Message : public std::enable_shared_from_this<Message>
     using Algorithm = compression::Algorithm;
 
 public:
-    /** Constructor
+    /**
+     * Constructor
      * @param message Protocol message to serialize
      * @param type Protocol message type
      * @param validator Public Key of the source validator for Validation or
@@ -50,7 +51,9 @@ public:
         protocol::MessageType type,
         std::optional<PublicKey> const& validator = {});
 
-    /** Retrieve the size of the packed but uncompressed message data. */
+    /**
+     * Retrieve the size of the packed but uncompressed message data.
+     */
     std::size_t
     getBufferSize();
 
@@ -60,7 +63,8 @@ public:
     static std::size_t
     totalSize(::google::protobuf::Message const& message);
 
-    /** Retrieve the packed message data. If compressed message is requested but
+    /**
+     * Retrieve the packed message data. If compressed message is requested but
      * the message is not compressible then the uncompressed buffer is returned.
      * @param compressed Request compressed (Compress::On) or
      *     uncompressed (Compress::Off) payload buffer
@@ -69,14 +73,18 @@ public:
     std::vector<uint8_t> const&
     getBuffer(Compressed tryCompressed);
 
-    /** Get the traffic category */
+    /**
+     * Get the traffic category
+     */
     std::size_t
     getCategory() const
     {
         return category_;
     }
 
-    /** Get the validator's key */
+    /**
+     * Get the validator's key
+     */
     std::optional<PublicKey> const&
     getValidatorKey() const
     {
@@ -90,7 +98,8 @@ private:
     std::once_flag onceFlag_;
     std::optional<PublicKey> validatorKey_;
 
-    /** Set the payload header
+    /**
+     * Set the payload header
      * @param in Pointer to the payload
      * @param payloadBytes Size of the payload excluding the header size
      * @param type Protocol message type
@@ -106,14 +115,16 @@ private:
         Algorithm compression,
         std::uint32_t uncompressedBytes);
 
-    /** Try to compress the payload.
+    /**
+     * Try to compress the payload.
      * Can be called concurrently by multiple peers but is compressed once.
      * If the message is not compressible then the serialized buffer_ is used.
      */
     void
     compress();
 
-    /** Get the message type from the payload header.
+    /**
+     * Get the message type from the payload header.
      * First four bytes are the compression/algorithm flag and the payload size.
      * Next two bytes are the message type
      * @param in Payload header pointer
diff --git a/src/xrpld/overlay/Overlay.h b/src/xrpld/overlay/Overlay.h
index cc5be791a7..6cc229f5a0 100644
--- a/src/xrpld/overlay/Overlay.h
+++ b/src/xrpld/overlay/Overlay.h
@@ -31,7 +31,9 @@ class context;
 
 namespace xrpl {
 
-/** Manages the set of connected peers. */
+/**
+ * Manages the set of connected peers.
+ */
 class Overlay : public beast::PropertyStream::Source
 {
 protected:
@@ -75,66 +77,84 @@ public:
     {
     }
 
-    /** Conditionally accept an incoming HTTP request. */
+    /**
+     * Conditionally accept an incoming HTTP request.
+     */
     virtual Handoff
     onHandoff(
         std::unique_ptr<stream_type>&& bundle,
         http_request_type&& request,
         boost::asio::ip::tcp::endpoint remoteAddress) = 0;
 
-    /** Establish a peer connection to the specified endpoint.
-        The call returns immediately, the connection attempt is
-        performed asynchronously.
-    */
+    /**
+     * Establish a peer connection to the specified endpoint.
+     * The call returns immediately, the connection attempt is
+     * performed asynchronously.
+     */
     virtual void
     connect(beast::IP::Endpoint const& address) = 0;
 
-    /** Returns the maximum number of peers we are configured to allow. */
+    /**
+     * Returns the maximum number of peers we are configured to allow.
+     */
     virtual int
     limit() = 0;
 
-    /** Returns the number of active peers.
-        Active peers are only those peers that have completed the
-        handshake and are using the peer protocol.
-    */
+    /**
+     * Returns the number of active peers.
+     * Active peers are only those peers that have completed the
+     * handshake and are using the peer protocol.
+     */
     [[nodiscard]] virtual std::size_t
     size() const = 0;
 
-    /** Return diagnostics on the status of all peers.
-        @deprecated This is superseded by PropertyStream
-    */
+    /**
+     * Return diagnostics on the status of all peers.
+     * @deprecated This is superseded by PropertyStream
+     */
     virtual json::Value
     json() = 0;
 
-    /** Returns a sequence representing the current list of peers.
-        The snapshot is made at the time of the call.
-    */
+    /**
+     * Returns a sequence representing the current list of peers.
+     * The snapshot is made at the time of the call.
+     */
     [[nodiscard]] virtual PeerSequence
     getActivePeers() const = 0;
 
-    /** Calls the checkTracking function on each peer
-        @param index the value to pass to the peer's checkTracking function
-    */
+    /**
+     * Calls the checkTracking function on each peer
+     * @param index the value to pass to the peer's checkTracking function
+     */
     virtual void
     checkTracking(std::uint32_t index) = 0;
 
-    /** Returns the peer with the matching short id, or null. */
+    /**
+     * Returns the peer with the matching short id, or null.
+     */
     [[nodiscard]] virtual std::shared_ptr<Peer>
     findPeerByShortID(Peer::id_t const& id) const = 0;
 
-    /** Returns the peer with the matching public key, or null. */
+    /**
+     * Returns the peer with the matching public key, or null.
+     */
     virtual std::shared_ptr<Peer>
     findPeerByPublicKey(PublicKey const& pubKey) = 0;
 
-    /** Broadcast a proposal. */
+    /**
+     * Broadcast a proposal.
+     */
     virtual void
     broadcast(protocol::TMProposeSet const& m) = 0;
 
-    /** Broadcast a validation. */
+    /**
+     * Broadcast a validation.
+     */
     virtual void
     broadcast(protocol::TMValidation const& m) = 0;
 
-    /** Relay a proposal.
+    /**
+     * Relay a proposal.
      * @param m the serialized proposal
      * @param uid the id used to identify this proposal
      * @param validator The pubkey of the validator that issued this proposal
@@ -143,7 +163,8 @@ public:
     virtual std::set<Peer::id_t>
     relay(protocol::TMProposeSet const& m, uint256 const& uid, PublicKey const& validator) = 0;
 
-    /** Relay a validation.
+    /**
+     * Relay a validation.
      * @param m the serialized validation
      * @param uid the id used to identify this validation
      * @param validator The pubkey of the validator that issued this validation
@@ -152,7 +173,8 @@ public:
     virtual std::set<Peer::id_t>
     relay(protocol::TMValidation const& m, uint256 const& uid, PublicKey const& validator) = 0;
 
-    /** Relay a transaction. If the tx reduce-relay feature is enabled then
+    /**
+     * Relay a transaction. If the tx reduce-relay feature is enabled then
      * randomly select peers to relay to and queue transaction's hash
      * for the rest of the peers.
      * @param hash transaction's hash
@@ -165,7 +187,8 @@ public:
         std::optional<std::reference_wrapper<protocol::TMTransaction>> m,
         std::set<Peer::id_t> const& toSkip) = 0;
 
-    /** Visit every active peer.
+    /**
+     * Visit every active peer.
      *
      * The visitor must be invocable as:
      *     Function(std::shared_ptr<Peer> const& peer);
@@ -180,13 +203,16 @@ public:
             f(p);
     }
 
-    /** Increment and retrieve counter for transaction job queue overflows. */
+    /**
+     * Increment and retrieve counter for transaction job queue overflows.
+     */
     virtual void
     incJqTransOverflow() = 0;
     [[nodiscard]] virtual std::uint64_t
     getJqTransOverflow() const = 0;
 
-    /** Increment and retrieve counters for total peer disconnects, and
+    /**
+     * Increment and retrieve counters for total peer disconnects, and
      * disconnects we initiate for excessive resource consumption.
      */
     virtual void
@@ -198,19 +224,21 @@ public:
     [[nodiscard]] virtual std::uint64_t
     getPeerDisconnectCharges() const = 0;
 
-    /** Returns the ID of the network this server is configured for, if any.
-
-        The ID is just a numerical identifier, with the IDs 0, 1 and 2 used to
-        identify the mainnet, the testnet and the devnet respectively.
-
-        @return The numerical identifier configured by the administrator of the
-                server. An unseated optional, otherwise.
-    */
+    /**
+     * Returns the ID of the network this server is configured for, if any.
+     *
+     * The ID is just a numerical identifier, with the IDs 0, 1 and 2 used to
+     * identify the mainnet, the testnet and the devnet respectively.
+     *
+     * @return The numerical identifier configured by the administrator of the
+     *         server. An unseated optional, otherwise.
+     */
     [[nodiscard]] virtual std::optional<std::uint32_t>
     networkID() const = 0;
 
-    /** Returns tx reduce-relay metrics
-        @return json value of tx reduce-relay metrics
+    /**
+     * Returns tx reduce-relay metrics
+     * @return json value of tx reduce-relay metrics
      */
     [[nodiscard]] virtual json::Value
     txMetrics() const = 0;
diff --git a/src/xrpld/overlay/Peer.h b/src/xrpld/overlay/Peer.h
index 29778b42a6..23a45dc512 100644
--- a/src/xrpld/overlay/Peer.h
+++ b/src/xrpld/overlay/Peer.h
@@ -25,17 +25,20 @@ enum class ProtocolFeature {
     LedgerReplay,
 };
 
-/** Represents a peer connection in the overlay. */
+/**
+ * Represents a peer connection in the overlay.
+ */
 class Peer
 {
 public:
     using ptr = std::shared_ptr<Peer>;
 
-    /** Uniquely identifies a peer.
-        This can be stored in tables to find the peer later. Callers
-        can discover if the peer is no longer connected and make
-        adjustments as needed.
-    */
+    /**
+     * Uniquely identifies a peer.
+     * This can be stored in tables to find the peer later. Callers
+     * can discover if the peer is no longer connected and make
+     * adjustments as needed.
+     */
     using id_t = std::uint32_t;
 
     virtual ~Peer() = default;
@@ -50,19 +53,27 @@ public:
     [[nodiscard]] virtual beast::IP::Endpoint
     getRemoteAddress() const = 0;
 
-    /** Send aggregated transactions' hashes. */
+    /**
+     * Send aggregated transactions' hashes.
+     */
     virtual void
     sendTxQueue() = 0;
 
-    /** Aggregate transaction's hash. */
+    /**
+     * Aggregate transaction's hash.
+     */
     virtual void
     addTxQueue(uint256 const&) = 0;
 
-    /** Remove hash from the transactions' hashes queue. */
+    /**
+     * Remove hash from the transactions' hashes queue.
+     */
     virtual void
     removeTxQueue(uint256 const&) = 0;
 
-    /** Adjust this peer's load balance based on the type of load imposed. */
+    /**
+     * Adjust this peer's load balance based on the type of load imposed.
+     */
     virtual void
     charge(Resource::Charge const& fee, std::string const& context) = 0;
 
@@ -73,7 +84,9 @@ public:
     [[nodiscard]] virtual id_t
     id() const = 0;
 
-    /** Returns `true` if this connection is a member of the cluster. */
+    /**
+     * Returns `true` if this connection is a member of the cluster.
+     */
     [[nodiscard]] virtual bool
     cluster() const = 0;
 
diff --git a/src/xrpld/overlay/PeerSet.h b/src/xrpld/overlay/PeerSet.h
index 4670ec9783..ffba7932de 100644
--- a/src/xrpld/overlay/PeerSet.h
+++ b/src/xrpld/overlay/PeerSet.h
@@ -15,16 +15,17 @@
 
 namespace xrpl {
 
-/** Supports data retrieval by managing a set of peers.
-
-    When desired data (such as a ledger or a transaction set)
-    is missing locally it can be obtained by querying connected
-    peers. This class manages common aspects of the retrieval.
-    Callers maintain the set by adding and removing peers depending
-    on whether the peers have useful information.
-
-    The data is represented by its hash.
-*/
+/**
+ * Supports data retrieval by managing a set of peers.
+ *
+ * When desired data (such as a ledger or a transaction set)
+ * is missing locally it can be obtained by querying connected
+ * peers. This class manages common aspects of the retrieval.
+ * Callers maintain the set by adding and removing peers depending
+ * on whether the peers have useful information.
+ *
+ * The data is represented by its hash.
+ */
 class PeerSet
 {
 public:
@@ -42,7 +43,9 @@ public:
         std::function<bool(std::shared_ptr<Peer> const&)> hasItem,
         std::function<void(std::shared_ptr<Peer> const&)> onPeerAdded) = 0;
 
-    /** send a message */
+    /**
+     * send a message
+     */
     template <typename MessageType>
     void
     sendRequest(MessageType const& message, std::shared_ptr<Peer> const& peer)
@@ -56,7 +59,9 @@ public:
         protocol::MessageType type,
         std::shared_ptr<Peer> const& peer) = 0;
 
-    /** get the set of ids of previously added peers */
+    /**
+     * get the set of ids of previously added peers
+     */
     [[nodiscard]] virtual std::set<Peer::id_t> const&
     getPeerIds() const = 0;
 };
diff --git a/src/xrpld/overlay/Slot.h b/src/xrpld/overlay/Slot.h
index a29020e03a..4b5026414b 100644
--- a/src/xrpld/overlay/Slot.h
+++ b/src/xrpld/overlay/Slot.h
@@ -38,13 +38,17 @@ namespace xrpl::reduce_relay {
 template <typename ClockType>
 class Slots;
 
-/** Peer's State */
+/**
+ * Peer's State
+ */
 enum class PeerState : uint8_t {
     Counting,   // counting messages
     Selected,   // selected to relay, counting if Slot in Counting
     Squelched,  // squelched, doesn't relay
 };
-/** Slot's State */
+/**
+ * Slot's State
+ */
 enum class SlotState : uint8_t {
     Counting,  // counting messages
     Selected,  // peers selected, stop counting
@@ -57,22 +61,26 @@ epoch(TP const& t)
     return std::chrono::duration_cast<Unit>(t.time_since_epoch());
 }
 
-/** Abstract class. Declares squelch and unsquelch handlers.
+/**
+ * Abstract class. Declares squelch and unsquelch handlers.
  * OverlayImpl inherits from this class. Motivation is
  * for easier unit tests to facilitate on the fly
- * changing callbacks. */
+ * changing callbacks.
+ */
 class SquelchHandler
 {
 public:
     virtual ~SquelchHandler() = default;
-    /** Squelch handler
+    /**
+     * Squelch handler
      * @param validator Public key of the source validator
      * @param id Peer's id to squelch
      * @param duration Squelch duration in seconds
      */
     virtual void
     squelch(PublicKey const& validator, Peer::id_t id, std::uint32_t duration) const = 0;
-    /** Unsquelch handler
+    /**
+     * Unsquelch handler
      * @param validator Public key of the source validator
      * @param id Peer's id to unsquelch
      */
@@ -101,9 +109,10 @@ private:
     // a callback to report ignored squelches
     using ignored_squelch_callback = std::function<void()>;
 
-    /** Constructor
-     * @param journal Journal for logging
+    /**
+     * Constructor
      * @param handler Squelch/Unsquelch implementation
+     * @param journal Journal for logging
      * @param maxSelectedPeers the maximum number of peers to be selected as
      * validator message source
      */
@@ -115,7 +124,8 @@ private:
     {
     }
 
-    /** Update peer info. If the message is from a new
+    /**
+     * Update peer info. If the message is from a new
      * peer or from a previously expired squelched peer then switch
      * the peer's and slot's state to Counting. If time of last
      * selection round is > 2 * kMaxUnsquelchExpireDefault then switch the
@@ -141,7 +151,8 @@ private:
         protocol::MessageType type,
         ignored_squelch_callback callback);
 
-    /** Handle peer deletion when a peer disconnects.
+    /**
+     * Handle peer deletion when a peer disconnects.
      * If the peer is in Selected state then
      * call unsquelch handler for every peer in squelched state and reset
      * every peer's state to Counting. Switch Slot's state to Counting.
@@ -154,39 +165,51 @@ private:
     void
     deletePeer(PublicKey const& validator, id_t id, bool erase);
 
-    /** Get the time of the last peer selection round */
+    /**
+     * Get the time of the last peer selection round
+     */
     [[nodiscard]] time_point const&
     getLastSelected() const
     {
         return lastSelected_;
     }
 
-    /** Return number of peers in state */
+    /**
+     * Return number of peers in state
+     */
     [[nodiscard]] std::uint16_t
     inState(PeerState state) const;
 
-    /** Return number of peers not in state */
+    /**
+     * Return number of peers not in state
+     */
     [[nodiscard]] std::uint16_t
     notInState(PeerState state) const;
 
-    /** Return Slot's state */
+    /**
+     * Return Slot's state
+     */
     [[nodiscard]] SlotState
     getState() const
     {
         return state_;
     }
 
-    /** Return selected peers */
+    /**
+     * Return selected peers
+     */
     [[nodiscard]] std::set<id_t>
     getSelected() const;
 
-    /** Get peers info. Return map of peer's state, count, squelch
+    /**
+     * Get peers info. Return map of peer's state, count, squelch
      * expiration milsec, and last message time milsec.
      */
     [[nodiscard]] std::unordered_map<id_t, std::tuple<PeerState, uint16_t, uint32_t, uint32_t>>
     getPeers() const;
 
-    /** Check if peers stopped relaying messages. If a peer is
+    /**
+     * Check if peers stopped relaying messages. If a peer is
      * selected peer then call unsquelch handler for all
      * currently squelched peers and switch the slot to
      * Counting state.
@@ -195,7 +218,8 @@ private:
     void
     deleteIdlePeer(PublicKey const& validator);
 
-    /** Get random squelch duration between kMinUnsquelchExpire and
+    /**
+     * Get random squelch duration between kMinUnsquelchExpire and
      * min(max(kMaxUnsquelchExpireDefault, kSquelchPerPeer * npeers),
      *     kMaxUnsquelchExpirePeers)
      * @param npeers number of peers that can be squelched in the Slot
@@ -204,15 +228,21 @@ private:
     getSquelchDuration(std::size_t npeers);
 
 private:
-    /** Reset counts of peers in Selected or Counting state */
+    /**
+     * Reset counts of peers in Selected or Counting state
+     */
     void
     resetCounts();
 
-    /** Initialize slot to Counting state */
+    /**
+     * Initialize slot to Counting state
+     */
     void
     initCounting();
 
-    /** Data maintained for each peer */
+    /**
+     * Data maintained for each peer
+     */
     struct PeerInfo
     {
         PeerState state;         // peer's state
@@ -533,7 +563,8 @@ Slot<ClockType>::getPeers() const
     return r;
 }
 
-/** Slots is a container for validator's Slot and handles Slot update
+/**
+ * Slots is a container for validator's Slot and handles Slot update
  * when a message is received from a validator. It also handles Slot aging
  * and checks for peers which are disconnected or stopped relaying the messages.
  */
@@ -564,14 +595,18 @@ public:
     }
     ~Slots() = default;
 
-    /** Check if base squelching feature is enabled and ready */
+    /**
+     * Check if base squelching feature is enabled and ready
+     */
     bool
     baseSquelchReady()
     {
         return baseSquelchEnabled_ && reduceRelayReady();
     }
 
-    /** Check if reduce_relay::kWaitOnBootup time passed since startup */
+    /**
+     * Check if reduce_relay::kWaitOnBootup time passed since startup
+     */
     bool
     reduceRelayReady()
     {
@@ -584,7 +619,8 @@ public:
         return reduceRelayReady_;
     }
 
-    /** Calls Slot::update of Slot associated with the validator, with a noop
+    /**
+     * Calls Slot::update of Slot associated with the validator, with a noop
      * callback.
      * @param key Message's hash
      * @param validator Validator's public key
@@ -601,7 +637,8 @@ public:
         updateSlotAndSquelch(key, validator, id, type, []() {});
     }
 
-    /** Calls Slot::update of Slot associated with the validator.
+    /**
+     * Calls Slot::update of Slot associated with the validator.
      * @param key Message's hash
      * @param validator Validator's public key
      * @param id Peer's id which received the message
@@ -616,13 +653,16 @@ public:
         protocol::MessageType type,
         Slot<ClockType>::ignored_squelch_callback callback);
 
-    /** Check if peers stopped relaying messages
+    /**
+     * Check if peers stopped relaying messages
      * and if slots stopped receiving messages from the validator.
      */
     void
     deleteIdlePeers();
 
-    /** Return number of peers in state */
+    /**
+     * Return number of peers in state
+     */
     [[nodiscard]] std::optional<std::uint16_t>
     inState(PublicKey const& validator, PeerState state) const
     {
@@ -632,7 +672,9 @@ public:
         return {};
     }
 
-    /** Return number of peers not in state */
+    /**
+     * Return number of peers not in state
+     */
     [[nodiscard]] std::optional<std::uint16_t>
     notInState(PublicKey const& validator, PeerState state) const
     {
@@ -642,7 +684,9 @@ public:
         return {};
     }
 
-    /** Return true if Slot is in state */
+    /**
+     * Return true if Slot is in state
+     */
     [[nodiscard]] bool
     inState(PublicKey const& validator, SlotState state) const
     {
@@ -652,7 +696,9 @@ public:
         return false;
     }
 
-    /** Get selected peers */
+    /**
+     * Get selected peers
+     */
     std::set<id_t>
     getSelected(PublicKey const& validator)
     {
@@ -662,7 +708,8 @@ public:
         return {};
     }
 
-    /** Get peers info. Return map of peer's state, count, and squelch
+    /**
+     * Get peers info. Return map of peer's state, count, and squelch
      * expiration milliseconds.
      */
     std::unordered_map<Peer::id_t, std::tuple<PeerState, uint16_t, uint32_t, std::uint32_t>>
@@ -674,7 +721,9 @@ public:
         return {};
     }
 
-    /** Get Slot's state */
+    /**
+     * Get Slot's state
+     */
     std::optional<SlotState>
     getState(PublicKey const& validator)
     {
@@ -684,7 +733,8 @@ public:
         return {};
     }
 
-    /** Called when a peer is deleted. If the peer was selected to be the
+    /**
+     * Called when a peer is deleted. If the peer was selected to be the
      * source of messages from the validator then squelched peers have to be
      * unsquelched.
      * @param id Peer's id
@@ -694,9 +744,11 @@ public:
     deletePeer(id_t id, bool erase);
 
 private:
-    /** Add message/peer if have not seen this message
+    /**
+     * Add message/peer if have not seen this message
      * from the peer. A message is aged after IDLED seconds.
-     * Return true if added */
+     * Return true if added
+     */
     bool
     addPeerMessage(uint256 const& key, id_t id);
 
diff --git a/src/xrpld/overlay/Squelch.h b/src/xrpld/overlay/Squelch.h
index 0485c91c81..6899bf39f0 100644
--- a/src/xrpld/overlay/Squelch.h
+++ b/src/xrpld/overlay/Squelch.h
@@ -11,7 +11,9 @@
 
 namespace xrpl::reduce_relay {
 
-/** Maintains squelching of relaying messages from validators */
+/**
+ * Maintains squelching of relaying messages from validators
+ */
 template <typename ClockType>
 class Squelch
 {
@@ -23,7 +25,8 @@ public:
     }
     virtual ~Squelch() = default;
 
-    /** Squelch validation/proposal relaying for the validator
+    /**
+     * Squelch validation/proposal relaying for the validator
      * @param validator The validator's public key
      * @param squelchDuration Squelch duration in seconds
      * @return false if invalid squelch duration
@@ -31,13 +34,15 @@ public:
     bool
     addSquelch(PublicKey const& validator, std::chrono::seconds const& squelchDuration);
 
-    /** Remove the squelch
+    /**
+     * Remove the squelch
      * @param validator The validator's public key
      */
     void
     removeSquelch(PublicKey const& validator);
 
-    /** Remove expired squelch
+    /**
+     * Remove expired squelch
      * @param validator Validator's public key
      * @return true if removed or doesn't exist, false if still active
      */
@@ -45,8 +50,10 @@ public:
     expireSquelch(PublicKey const& validator);
 
 private:
-    /** Maintains the list of squelched relaying to downstream peers.
-     * Expiration time is included in the TMSquelch message. */
+    /**
+     * Maintains the list of squelched relaying to downstream peers.
+     * Expiration time is included in the TMSquelch message.
+     */
     hash_map<PublicKey, time_point> squelched_;
     beast::Journal const journal_;
 };
diff --git a/src/xrpld/overlay/detail/ConnectAttempt.h b/src/xrpld/overlay/detail/ConnectAttempt.h
index bed3f672be..d7836e3c84 100644
--- a/src/xrpld/overlay/detail/ConnectAttempt.h
+++ b/src/xrpld/overlay/detail/ConnectAttempt.h
@@ -19,7 +19,9 @@
 
 namespace xrpl {
 
-/** Manages an outbound connection attempt. */
+/**
+ * Manages an outbound connection attempt.
+ */
 class ConnectAttempt : public OverlayImpl::Child,
                        public std::enable_shared_from_this<ConnectAttempt>
 {
diff --git a/src/xrpld/overlay/detail/Handshake.cpp b/src/xrpld/overlay/detail/Handshake.cpp
index 39fd93f1d4..a860d2d604 100644
--- a/src/xrpld/overlay/detail/Handshake.cpp
+++ b/src/xrpld/overlay/detail/Handshake.cpp
@@ -118,20 +118,21 @@ makeFeaturesResponseHeader(
     return str.str();
 }
 
-/** Hashes the latest finished message from an SSL stream.
-
-    @param ssl the session to get the message from.
-    @param get a pointer to the function to call to retrieve the finished
-               message. This can be either:
-               - `SSL_get_finished` or
-               - `SSL_get_peer_finished`.
-    @return `true` if successful, `false` otherwise.
-
-    @note This construct is non-standard. There are potential "standard"
-          alternatives that should be considered. For a discussion, on
-          this topic, see https://github.com/openssl/openssl/issues/5509 and
-          https://github.com/XRPLF/rippled/issues/2413.
-*/
+/**
+ * Hashes the latest finished message from an SSL stream.
+ *
+ * @param ssl the session to get the message from.
+ * @param get a pointer to the function to call to retrieve the finished
+ *            message. This can be either:
+ *            - `SSL_get_finished` or
+ *            - `SSL_get_peer_finished`.
+ * @return `true` if successful, `false` otherwise.
+ *
+ * @note This construct is non-standard. There are potential "standard"
+ *       alternatives that should be considered. For a discussion, on
+ *       this topic, see https://github.com/openssl/openssl/issues/5509 and
+ *       https://github.com/XRPLF/rippled/issues/2413.
+ */
 static std::optional<BaseUInt<512>>
 hashLastMessage(SSL const* ssl, size_t (*get)(const SSL*, void*, size_t))
 {
diff --git a/src/xrpld/overlay/detail/Handshake.h b/src/xrpld/overlay/detail/Handshake.h
index 6dcc06bbf1..9a4e5ba507 100644
--- a/src/xrpld/overlay/detail/Handshake.h
+++ b/src/xrpld/overlay/detail/Handshake.h
@@ -26,19 +26,21 @@ using request_type = boost::beast::http::request<boost::beast::http::empty_body>
 using http_request_type = boost::beast::http::request<boost::beast::http::dynamic_body>;
 using http_response_type = boost::beast::http::response<boost::beast::http::dynamic_body>;
 
-/** Computes a shared value based on the SSL connection state.
-
-    When there is no man in the middle, both sides will compute the same
-    value. In the presence of an attacker, the computed values will be
-    different.
-
-    @param ssl the SSL/TLS connection state.
-    @return A 256-bit value on success; an unseated optional otherwise.
-*/
+/**
+ * Computes a shared value based on the SSL connection state.
+ *
+ * When there is no man in the middle, both sides will compute the same
+ * value. In the presence of an attacker, the computed values will be
+ * different.
+ *
+ * @param ssl the SSL/TLS connection state.
+ * @return A 256-bit value on success; an unseated optional otherwise.
+ */
 std::optional<uint256>
 makeSharedValue(stream_type& ssl, beast::Journal journal);
 
-/** Insert fields headers necessary for upgrading the link to the peer protocol.
+/**
+ * Insert fields headers necessary for upgrading the link to the peer protocol.
  */
 void
 buildHandshake(
@@ -49,17 +51,18 @@ buildHandshake(
     beast::IP::Address remoteIp,
     Application& app);
 
-/** Validate header fields necessary for upgrading the link to the peer
-   protocol.
-
-    This performs critical security checks that ensure that prevent
-    MITM attacks on our peer-to-peer links and that the remote peer
-    has the private keys that correspond to the public identity it
-    claims.
-
-    @return The public key of the remote peer.
-    @throw A class derived from std::exception.
-*/
+/**
+ * Validate header fields necessary for upgrading the link to the peer
+ * protocol.
+ *
+ * This performs critical security checks that ensure that prevent
+ * MITM attacks on our peer-to-peer links and that the remote peer
+ * has the private keys that correspond to the public identity it
+ * claims.
+ *
+ * @return The public key of the remote peer.
+ * @throws A class derived from std::exception.
+ */
 PublicKey
 verifyHandshake(
     boost::beast::http::fields const& headers,
@@ -69,16 +72,17 @@ verifyHandshake(
     beast::IP::Address remote,
     Application& app);
 
-/** Make outbound http request
-
-   @param crawlPublic if true then server's IP/Port are included in crawl
-   @param comprEnabled if true then compression feature is enabled
-   @param ledgerReplayEnabled if true then ledger-replay feature is enabled
-   @param txReduceRelayEnabled if true then transaction reduce-relay feature is
-   enabled
-   @param vpReduceRelayEnabled if true then validation/proposal reduce-relay
-   feature is enabled
-   @return http request with empty body
+/**
+ * Make outbound http request
+ *
+ * @param crawlPublic if true then server's IP/Port are included in crawl
+ * @param comprEnabled if true then compression feature is enabled
+ * @param ledgerReplayEnabled if true then ledger-replay feature is enabled
+ * @param txReduceRelayEnabled if true then transaction reduce-relay feature is
+ * enabled
+ * @param vpReduceRelayEnabled if true then validation/proposal reduce-relay
+ * feature is enabled
+ * @return http request with empty body
  */
 request_type
 makeRequest(
@@ -88,17 +92,18 @@ makeRequest(
     bool txReduceRelayEnabled,
     bool vpReduceRelayEnabled);
 
-/** Make http response
-
-   @param crawlPublic if true then server's IP/Port are included in crawl
-   @param req incoming http request
-   @param publicIp server's public IP
-   @param remoteIp peer's IP
-   @param sharedValue shared value based on the SSL connection state
-   @param networkID specifies what network we intend to connect to
-   @param version supported protocol version
-   @param app Application's reference to access some common properties
-   @return http response
+/**
+ * Make http response
+ *
+ * @param crawlPublic if true then server's IP/Port are included in crawl
+ * @param req incoming http request
+ * @param publicIp server's public IP
+ * @param remoteIp peer's IP
+ * @param sharedValue shared value based on the SSL connection state
+ * @param networkID specifies what network we intend to connect to
+ * @param version supported protocol version
+ * @param app Application's reference to access some common properties
+ * @return http response
  */
 http_response_type
 makeResponse(
@@ -127,22 +132,24 @@ static constexpr char kFeatureLedgerReplay[] = "ledgerreplay";
 static constexpr char kDelimFeature[] = ";";
 static constexpr char kDelimValue[] = ",";
 
-/** Get feature's header value
-   @param headers request/response header
-   @param feature name
-   @return seated optional with feature's value if the feature
-      is found in the header, unseated optional otherwise
+/**
+ * Get feature's header value
+ * @param headers request/response header
+ * @param feature name
+ * @return seated optional with feature's value if the feature
+ *    is found in the header, unseated optional otherwise
  */
 std::optional<std::string>
 getFeatureValue(boost::beast::http::fields const& headers, std::string const& feature);
 
-/** Check if a feature's value is equal to the specified value
-   @param headers request/response header
-   @param feature to check
-   @param value of the feature to check, must be a single value; i.e. not
-        value1,value2...
-   @return true if the feature's value matches the specified value, false if
-   doesn't match or the feature is not found in the header
+/**
+ * Check if a feature's value is equal to the specified value
+ * @param headers request/response header
+ * @param feature to check
+ * @param value of the feature to check, must be a single value; i.e. not
+ *      value1,value2...
+ * @return true if the feature's value matches the specified value, false if
+ * doesn't match or the feature is not found in the header
  */
 bool
 isFeatureValue(
@@ -150,23 +157,25 @@ isFeatureValue(
     std::string const& feature,
     std::string const& value);
 
-/** Check if a feature is enabled
-   @param headers request/response header
-   @param feature to check
-   @return true if enabled
+/**
+ * Check if a feature is enabled
+ * @param headers request/response header
+ * @param feature to check
+ * @return true if enabled
  */
 bool
 featureEnabled(boost::beast::http::fields const& headers, std::string const& feature);
 
-/** Check if a feature should be enabled for a peer. The feature
-    is enabled if its configured value is true and the http header
-    has the specified feature value.
-   @tparam headers request (inbound) or response (outbound) header
-   @param request http headers
-   @param feature to check
-   @param config feature's configuration value
-   @param value feature's value to check in the headers
-   @return true if the feature is enabled
+/**
+ * Check if a feature should be enabled for a peer. The feature
+ *  is enabled if its configured value is true and the http header
+ *  has the specified feature value.
+ * @tparam Headers request (inbound) or response (outbound) header
+ * @param request http headers
+ * @param feature to check
+ * @param value feature's value to check in the headers
+ * @param config feature's configuration value
+ * @return true if the feature is enabled
  */
 template <typename Headers>
 bool
@@ -179,7 +188,9 @@ peerFeatureEnabled(
     return config && isFeatureValue(request, feature, value);
 }
 
-/** Wrapper for enable(1)/disable type(0) of feature */
+/**
+ * Wrapper for enable(1)/disable type(0) of feature
+ */
 template <typename Headers>
 bool
 peerFeatureEnabled(Headers const& request, std::string const& feature, bool config)
@@ -187,14 +198,15 @@ peerFeatureEnabled(Headers const& request, std::string const& feature, bool conf
     return config && peerFeatureEnabled(request, feature, "1", config);
 }
 
-/** Make request header X-Protocol-Ctl value with supported features
-   @param comprEnabled if true then compression feature is enabled
-   @param ledgerReplayEnabled if true then ledger-replay feature is enabled
-   @param txReduceRelayEnabled if true then transaction reduce-relay feature is
-   enabled
-   @param vpReduceRelayEnabled if true then validation/proposal reduce-relay
-   base squelch feature is enabled
-   @return X-Protocol-Ctl header value
+/**
+ * Make request header X-Protocol-Ctl value with supported features
+ * @param comprEnabled if true then compression feature is enabled
+ * @param ledgerReplayEnabled if true then ledger-replay feature is enabled
+ * @param txReduceRelayEnabled if true then transaction reduce-relay feature is
+ * enabled
+ * @param vpReduceRelayEnabled if true then validation/proposal reduce-relay
+ * base squelch feature is enabled
+ * @return X-Protocol-Ctl header value
  */
 std::string
 makeFeaturesRequestHeader(
@@ -203,18 +215,19 @@ makeFeaturesRequestHeader(
     bool txReduceRelayEnabled,
     bool vpReduceRelayEnabled);
 
-/** Make response header X-Protocol-Ctl value with supported features.
-    If the request has a feature that we support enabled
-    and the feature's configuration is enabled then enable this feature in
-    the response header.
-   @param header request's header
-   @param comprEnabled if true then compression feature is enabled
-   @param ledgerReplayEnabled if true then ledger-replay feature is enabled
-   @param txReduceRelayEnabled if true then transaction reduce-relay feature is
-   enabled
-   @param vpReduceRelayEnabled if true then validation/proposal reduce-relay
-   base squelch feature is enabled
-   @return X-Protocol-Ctl header value
+/**
+ * Make response header X-Protocol-Ctl value with supported features.
+ *  If the request has a feature that we support enabled
+ *  and the feature's configuration is enabled then enable this feature in
+ *  the response header.
+ * @param header request's header
+ * @param comprEnabled if true then compression feature is enabled
+ * @param ledgerReplayEnabled if true then ledger-replay feature is enabled
+ * @param txReduceRelayEnabled if true then transaction reduce-relay feature is
+ * enabled
+ * @param vpReduceRelayEnabled if true then validation/proposal reduce-relay
+ * base squelch feature is enabled
+ * @return X-Protocol-Ctl header value
  */
 std::string
 makeFeaturesResponseHeader(
diff --git a/src/xrpld/overlay/detail/Message.cpp b/src/xrpld/overlay/detail/Message.cpp
index 120b34c78c..c6e0511515 100644
--- a/src/xrpld/overlay/detail/Message.cpp
+++ b/src/xrpld/overlay/detail/Message.cpp
@@ -127,41 +127,42 @@ Message::compress()
     }
 }
 
-/** Set payload header
-
-    The header is a variable-sized structure that contains information about
-    the type of the message and the length and encoding of the payload.
-
-    The first bit determines whether a message is compressed or uncompressed;
-    for compressed messages, the next three bits identify the compression
-    algorithm.
-
-    All multi-byte values are represented in big endian.
-
-    For uncompressed messages (6 bytes), numbering bits from left to right:
-
-        - The first 6 bits are set to 0.
-        - The next 26 bits represent the payload size.
-        - The remaining 16 bits represent the message type.
-
-    For compressed messages (10 bytes), numbering bits from left to right:
-
-        - The first 32 bits, together, represent the compression algorithm
-          and payload size:
-            - The first bit is set to 1 to indicate the message is compressed.
-            - The next 3 bits indicate the compression algorithm.
-            - The next 2 bits are reserved at this time and set to 0.
-            - The remaining 26 bits represent the payload size.
-        - The next 16 bits represent the message type.
-        - The remaining 32 bits are the uncompressed message size.
-
-    The maximum size of a message at this time is 64 MB. Messages larger than
-    this will be dropped and the recipient may, at its option, sever the link.
-
-    @note While nominally a part of the wire protocol, the framing is subject
-          to change; future versions of the code may negotiate the use of
-          substantially different framing.
-*/
+/**
+ * Set payload header
+ *
+ * The header is a variable-sized structure that contains information about
+ * the type of the message and the length and encoding of the payload.
+ *
+ * The first bit determines whether a message is compressed or uncompressed;
+ * for compressed messages, the next three bits identify the compression
+ * algorithm.
+ *
+ * All multi-byte values are represented in big endian.
+ *
+ * For uncompressed messages (6 bytes), numbering bits from left to right:
+ *
+ *     - The first 6 bits are set to 0.
+ *     - The next 26 bits represent the payload size.
+ *     - The remaining 16 bits represent the message type.
+ *
+ * For compressed messages (10 bytes), numbering bits from left to right:
+ *
+ *     - The first 32 bits, together, represent the compression algorithm
+ *       and payload size:
+ *         - The first bit is set to 1 to indicate the message is compressed.
+ *         - The next 3 bits indicate the compression algorithm.
+ *         - The next 2 bits are reserved at this time and set to 0.
+ *         - The remaining 26 bits represent the payload size.
+ *     - The next 16 bits represent the message type.
+ *     - The remaining 32 bits are the uncompressed message size.
+ *
+ * The maximum size of a message at this time is 64 MB. Messages larger than
+ * this will be dropped and the recipient may, at its option, sever the link.
+ *
+ * @note While nominally a part of the wire protocol, the framing is subject
+ *       to change; future versions of the code may negotiate the use of
+ *       substantially different framing.
+ */
 void
 Message::setHeader(
     std::uint8_t* in,
diff --git a/src/xrpld/overlay/detail/OverlayImpl.cpp b/src/xrpld/overlay/detail/OverlayImpl.cpp
index b7af3b6ace..6a6a6edace 100644
--- a/src/xrpld/overlay/detail/OverlayImpl.cpp
+++ b/src/xrpld/overlay/detail/OverlayImpl.cpp
@@ -624,11 +624,12 @@ OverlayImpl::onWrite(beast::PropertyStream::Map& stream)
 }
 
 //------------------------------------------------------------------------------
-/** A peer has connected successfully
-    This is called after the peer handshake has been completed and during
-    peer activation. At this point, the peer address and the public key
-    are known.
-*/
+/**
+ * A peer has connected successfully
+ * This is called after the peer handshake has been completed and during
+ * peer activation. At this point, the peer address and the public key
+ * are known.
+ */
 void
 OverlayImpl::activate(std::shared_ptr<PeerImp> const& peer)
 {
@@ -725,10 +726,11 @@ OverlayImpl::reportOutboundTraffic(TrafficCount::Category cat, int size)
 {
     traffic_.addCount(cat, false, size);
 }
-/** The number of active peers on the network
-    Active peers are only those peers that have completed the handshake
-    and are running the XRPL protocol.
-*/
+/**
+ * The number of active peers on the network
+ * Active peers are only those peers that have completed the handshake
+ * and are running the XRPL protocol.
+ */
 std::size_t
 OverlayImpl::size() const
 {
diff --git a/src/xrpld/overlay/detail/OverlayImpl.h b/src/xrpld/overlay/detail/OverlayImpl.h
index 83d5a81a89..092ac86a6d 100644
--- a/src/xrpld/overlay/detail/OverlayImpl.h
+++ b/src/xrpld/overlay/detail/OverlayImpl.h
@@ -194,14 +194,15 @@ public:
     PeerSequence
     getActivePeers() const override;
 
-    /** Get active peers excluding peers in toSkip.
-       @param toSkip peers to skip
-       @param active a number of active peers
-       @param disabled a number of peers with tx reduce-relay
-           feature disabled
-       @param enabledInSkip a number of peers with tx reduce-relay
-           feature enabled and in toSkip
-       @return active peers less peers in toSkip
+    /**
+     * Get active peers excluding peers in toSkip.
+     * @param toSkip peers to skip
+     * @param active a number of active peers
+     * @param disabled a number of peers with tx reduce-relay
+     *     feature disabled
+     * @param enabledInSkip a number of peers with tx reduce-relay
+     *     feature enabled and in toSkip
+     * @return active peers less peers in toSkip
      */
     PeerSequence
     getActivePeers(
@@ -251,11 +252,12 @@ public:
     void
     remove(std::shared_ptr<PeerFinder::Slot> const& slot);
 
-    /** Called when a peer has connected successfully
-        This is called after the peer handshake has been completed and during
-        peer activation. At this point, the peer address and the public key
-        are known.
-    */
+    /**
+     * Called when a peer has connected successfully
+     * This is called after the peer handshake has been completed and during
+     * peer activation. At this point, the peer address and the public key
+     * are known.
+     */
     void
     activate(std::shared_ptr<PeerImp> const& peer);
 
@@ -382,7 +384,8 @@ public:
         return setup_.networkID;
     }
 
-    /** Updates message count for validator/peer. Sends TMSquelch if the number
+    /**
+     * Updates message count for validator/peer. Sends TMSquelch if the number
      * of messages for N peers reaches threshold T. A message is counted
      * if a peer receives the message for the first time and if
      * the message has been  relayed.
@@ -398,7 +401,8 @@ public:
         std::set<Peer::id_t>&& peers,
         protocol::MessageType type);
 
-    /** Overload to reduce allocation in case of single peer
+    /**
+     * Overload to reduce allocation in case of single peer
      */
     void
     updateSlotAndSquelch(
@@ -407,7 +411,8 @@ public:
         Peer::id_t peer,
         protocol::MessageType type);
 
-    /** Called when the peer is deleted. If the peer was selected to be the
+    /**
+     * Called when the peer is deleted. If the peer was selected to be the
      * source of messages from the validator then squelched peers have to be
      * unsquelched.
      * @param id Peer's id
@@ -421,7 +426,9 @@ public:
         return txMetrics_.json();
     }
 
-    /** Add tx reduce-relay metrics. */
+    /**
+     * Add tx reduce-relay metrics.
+     */
     template <typename... Args>
     void
     addTxMetrics(Args... args)
@@ -453,64 +460,72 @@ private:
         address_type remoteAddress,
         std::string const& msg);
 
-    /** Handles crawl requests. Crawl returns information about the
-        node and its peers so crawlers can map the network.
-
-        @return true if the request was handled.
-    */
+    /**
+     * Handles crawl requests. Crawl returns information about the
+     * node and its peers so crawlers can map the network.
+     *
+     * @return true if the request was handled.
+     */
     bool
     processCrawl(http_request_type const& req, Handoff& handoff);
 
-    /** Handles validator list requests.
-        Using a /vl/<hex-encoded public key> URL, will retrieve the
-        latest validator list (or UNL) that this node has for that
-        public key, if the node trusts that public key.
-
-        @return true if the request was handled.
-    */
+    /**
+     * Handles validator list requests.
+     * Using a /vl/<hex-encoded public key> URL, will retrieve the
+     * latest validator list (or UNL) that this node has for that
+     * public key, if the node trusts that public key.
+     *
+     * @return true if the request was handled.
+     */
     bool
     processValidatorList(http_request_type const& req, Handoff& handoff);
 
-    /** Handles health requests. Health returns information about the
-        health of the node.
-
-        @return true if the request was handled.
-    */
+    /**
+     * Handles health requests. Health returns information about the
+     * health of the node.
+     *
+     * @return true if the request was handled.
+     */
     bool
     processHealth(http_request_type const& req, Handoff& handoff);
 
-    /** Handles non-peer protocol requests.
-
-        @return true if the request was handled.
-    */
+    /**
+     * Handles non-peer protocol requests.
+     *
+     * @return true if the request was handled.
+     */
     bool
     processRequest(http_request_type const& req, Handoff& handoff);
 
-    /** Returns information about peers on the overlay network.
-        Reported through the /crawl API
-        Controlled through the config section [crawl] overlay=[0|1]
-    */
+    /**
+     * Returns information about peers on the overlay network.
+     * Reported through the /crawl API
+     * Controlled through the config section [crawl] overlay=[0|1]
+     */
     json::Value
     getOverlayInfo() const;
 
-    /** Returns information about the local server.
-        Reported through the /crawl API
-        Controlled through the config section [crawl] server=[0|1]
-    */
+    /**
+     * Returns information about the local server.
+     * Reported through the /crawl API
+     * Controlled through the config section [crawl] server=[0|1]
+     */
     json::Value
     getServerInfo();
 
-    /** Returns information about the local server's performance counters.
-        Reported through the /crawl API
-        Controlled through the config section [crawl] counts=[0|1]
-    */
+    /**
+     * Returns information about the local server's performance counters.
+     * Reported through the /crawl API
+     * Controlled through the config section [crawl] counts=[0|1]
+     */
     json::Value
     getServerCounts();
 
-    /** Returns information about the local server's UNL.
-        Reported through the /crawl API
-        Controlled through the config section [crawl] unl=[0|1]
-    */
+    /**
+     * Returns information about the local server's UNL.
+     * Reported through the /crawl API
+     * Controlled through the config section [crawl] unl=[0|1]
+     */
     json::Value
     getUnlInfo();
 
@@ -537,12 +552,16 @@ private:
     void
     sendEndpoints();
 
-    /** Send once a second transactions' hashes aggregated by peers. */
+    /**
+     * Send once a second transactions' hashes aggregated by peers.
+     */
     void
     sendTxQueue() const;
 
-    /** Check if peers stopped relaying messages
-     * and if slots stopped receiving messages from the validator */
+    /**
+     * Check if peers stopped relaying messages
+     * and if slots stopped receiving messages from the validator
+     */
     void
     deleteIdlePeers();
 
diff --git a/src/xrpld/overlay/detail/PeerImp.cpp b/src/xrpld/overlay/detail/PeerImp.cpp
index 4e42d46f46..8838970b5f 100644
--- a/src/xrpld/overlay/detail/PeerImp.cpp
+++ b/src/xrpld/overlay/detail/PeerImp.cpp
@@ -105,10 +105,14 @@ using namespace std::chrono_literals;
 namespace xrpl {
 
 namespace {
-/** The threshold above which we treat a peer connection as high latency */
+/**
+ * The threshold above which we treat a peer connection as high latency
+ */
 constexpr std::chrono::milliseconds kPeerHighLatency{300};
 
-/** How often we PING the peer to check for latency and sendq probe */
+/**
+ * How often we PING the peer to check for latency and sendq probe
+ */
 constexpr std::chrono::seconds kPeerTimerInterval{60};
 
 }  // namespace
diff --git a/src/xrpld/overlay/detail/PeerImp.h b/src/xrpld/overlay/detail/PeerImp.h
index e9ef948d48..ea6eccd656 100644
--- a/src/xrpld/overlay/detail/PeerImp.h
+++ b/src/xrpld/overlay/detail/PeerImp.h
@@ -64,7 +64,9 @@ class SHAMap;
 class PeerImp : public Peer, public std::enable_shared_from_this<PeerImp>, public OverlayImpl::Child
 {
 public:
-    /** Whether the peer's view of the ledger converges or diverges from ours */
+    /**
+     * Whether the peer's view of the ledger converges or diverges from ours
+     */
     enum class Tracking { Diverged, Unknown, Converged };
 
 private:
@@ -249,7 +251,9 @@ public:
     PeerImp&
     operator=(PeerImp const&) = delete;
 
-    /** Create an active incoming peer from an established ssl connection. */
+    /**
+     * Create an active incoming peer from an established ssl connection.
+     */
     PeerImp(
         Application& app,
         id_t id,
@@ -261,7 +265,9 @@ public:
         std::unique_ptr<stream_type>&& streamPtr,
         OverlayImpl& overlay);
 
-    /** Create outgoing, handshaked peer. */
+    /**
+     * Create outgoing, handshaked peer.
+     */
     // VFALCO legacyPublicKey should be implied by the Slot
     template <class Buffers>
     PeerImp(
@@ -305,23 +311,29 @@ public:
     void
     send(std::shared_ptr<Message> const& m) override;
 
-    /** Send aggregated transactions' hashes */
+    /**
+     * Send aggregated transactions' hashes
+     */
     void
     sendTxQueue() override;
 
-    /** Add transaction's hash to the transactions' hashes queue
-       @param hash transaction's hash
+    /**
+     * Add transaction's hash to the transactions' hashes queue
+     * @param hash transaction's hash
      */
     void
     addTxQueue(uint256 const& hash) override;
 
-    /** Remove transaction's hash from the transactions' hashes queue
-       @param hash transaction's hash
+    /**
+     * Remove transaction's hash from the transactions' hashes queue
+     * @param hash transaction's hash
      */
     void
     removeTxQueue(uint256 const& hash) override;
 
-    /** Send a set of PeerFinder endpoints as a protocol message. */
+    /**
+     * Send a set of PeerFinder endpoints as a protocol message.
+     */
     template <class FwdIt>
     void
     sendEndpoints(FwdIt first, FwdIt last)
@@ -347,16 +359,19 @@ public:
         return id_;
     }
 
-    /** Returns `true` if this connection will publicly share its IP address. */
+    /**
+     * Returns `true` if this connection will publicly share its IP address.
+     */
     bool
     crawl() const;
 
     bool
     cluster() const override;
 
-    /** Check if the peer is tracking
-        @param validationSeq The ledger sequence of a recently-validated ledger
-    */
+    /**
+     * Check if the peer is tracking
+     * @param validationSeq The ledger sequence of a recently-validated ledger
+     */
     void
     checkTracking(std::uint32_t validationSeq);
 
@@ -369,7 +384,9 @@ public:
         return publicKey_;
     }
 
-    /** Return the version of xrpld that the peer is running, if reported. */
+    /**
+     * Return the version of xrpld that the peer is running, if reported.
+     */
     std::string
     getVersion() const;
 
@@ -504,17 +521,18 @@ private:
     void
     onWriteMessage(error_code ec, std::size_t bytesTransferred);
 
-    /** Called from onMessage(TMTransaction(s)).
-       @param m Transaction protocol message
-       @param eraseTxQueue is true when called from onMessage(TMTransaction)
-       and is false when called from onMessage(TMTransactions). If true then
-       the transaction hash is erased from txQueue_. Don't need to erase from
-       the queue when called from onMessage(TMTransactions) because this
-       message is a response to the missing transactions request and the queue
-       would not have any of these transactions.
-       @param batch is false when called from onMessage(TMTransaction)
-       and is true when called from onMessage(TMTransactions). If true, then the
-       transaction is part of a batch, and should not be charged an extra fee.
+    /**
+     * Called from onMessage(TMTransaction(s)).
+     * @param m Transaction protocol message
+     * @param eraseTxQueue is true when called from onMessage(TMTransaction)
+     * and is false when called from onMessage(TMTransactions). If true then
+     * the transaction hash is erased from txQueue_. Don't need to erase from
+     * the queue when called from onMessage(TMTransactions) because this
+     * message is a response to the missing transactions request and the queue
+     * would not have any of these transactions.
+     * @param batch is false when called from onMessage(TMTransaction)
+     * and is true when called from onMessage(TMTransactions). If true, then the
+     * transaction is part of a batch, and should not be charged an extra fee.
      */
     void
     handleTransaction(
@@ -522,10 +540,11 @@ private:
         bool eraseTxQueue,
         bool batch);
 
-    /** Handle protocol message with hashes of transactions that have not
-       been relayed by an upstream node down to its peers - request
-       transactions, which have not been relayed to this peer.
-       @param m protocol message with transactions' hashes
+    /**
+     * Handle protocol message with hashes of transactions that have not
+     * been relayed by an upstream node down to its peers - request
+     * transactions, which have not been relayed to this peer.
+     * @param m protocol message with transactions' hashes
      */
     void
     handleHaveTransactions(std::shared_ptr<protocol::TMHaveTransactions> const& m);
@@ -623,9 +642,10 @@ private:
         std::uint32_t version,
         std::vector<ValidatorBlobInfo> const& blobs);
 
-    /** Process peer's request to send missing transactions. The request is
-        sent in response to TMHaveTransactions.
-        @param packet protocol message containing missing transactions' hashes.
+    /**
+     * Process peer's request to send missing transactions. The request is
+     * sent in response to TMHaveTransactions.
+     * @param packet protocol message containing missing transactions' hashes.
      */
     void
     doTransactions(std::shared_ptr<protocol::TMGetObjectByHash> const& packet);
@@ -669,52 +689,55 @@ protected:
     // Production callers reach these members only via
     // `onMessage(TMGetObjectByHash)` → JobQueue → `processGetObjectByHash`.
 
-    /** Process a generic-query TMGetObjectByHash message.
-
-        Dispatched from `onMessage(TMGetObjectByHash)` to the JobQueue
-        (`JtLedgerReq`) so synchronous NodeStore lookups do not block the
-        peer's I/O strand. Caps iteration at `Tuning::kHardMaxReplyNodes`
-        regardless of hit/miss outcome and applies differential pricing
-        via `computeGetObjectByHashFee()` after the fetch loop completes.
-
-        @param m The protocol message containing requested object hashes.
+    /**
+     * Process a generic-query TMGetObjectByHash message.
+     *
+     * Dispatched from `onMessage(TMGetObjectByHash)` to the JobQueue
+     * (`JtLedgerReq`) so synchronous NodeStore lookups do not block the
+     * peer's I/O strand. Caps iteration at `Tuning::kHardMaxReplyNodes`
+     * regardless of hit/miss outcome and applies differential pricing
+     * via `computeGetObjectByHashFee()` after the fetch loop completes.
+     *
+     * @param m The protocol message containing requested object hashes.
      */
     void
     processGetObjectByHash(std::shared_ptr<protocol::TMGetObjectByHash> const& m);
 
-    /** Compute the per-message resource charge for a TMGetObjectByHash
-        request based on how much work was actually performed.
-
-        The charge has three components on top of the base
-        `Resource::kFeeModerateBurdenPeer`:
-          - per-hit lookup cost (cheap; usually served from cache)
-          - per-miss lookup cost (expensive node store seeks)
-          - request-size band surcharge (escalates abusive batch sizes)
-
-        The first `Tuning::kFreeObjectsPerRequest` objects are free so
-        that legitimate `InboundLedger::getNeededHashes()` traffic
-        (at most 8 objects) is unaffected.
-
-        @param requested Number of objects requested by the message. This
-                          value is used for request-size pricing and may
-                          exceed `Tuning::kHardMaxReplyNodes` when this
-                          helper is called directly, even though processing
-                          caps the iterations to `Tuning::kHardMaxReplyNodes`.
-        @param found     Number of objects successfully returned in the
-                         reply.
-        @return A `Resource::Charge` whose cost reflects the work performed.
+    /**
+     * Compute the per-message resource charge for a TMGetObjectByHash
+     * request based on how much work was actually performed.
+     *
+     * The charge has three components on top of the base
+     * `Resource::kFeeModerateBurdenPeer`:
+     *   - per-hit lookup cost (cheap; usually served from cache)
+     *   - per-miss lookup cost (expensive node store seeks)
+     *   - request-size band surcharge (escalates abusive batch sizes)
+     *
+     * The first `Tuning::kFreeObjectsPerRequest` objects are free so
+     * that legitimate `InboundLedger::getNeededHashes()` traffic
+     * (at most 8 objects) is unaffected.
+     *
+     * @param requested Number of objects requested by the message. This
+     *                  value is used for request-size pricing and may
+     *                  exceed `Tuning::kHardMaxReplyNodes` when this
+     *                  helper is called directly, even though processing
+     *                  caps the iterations to `Tuning::kHardMaxReplyNodes`.
+     * @param found     Number of objects successfully returned in the
+     *                  reply.
+     * @return A `Resource::Charge` whose cost reflects the work performed.
      */
     static Resource::Charge
     computeGetObjectByHashFee(int const requested, int const found);
 
-    /** Read-only accessor for the accumulated peer-message charge.
-
-        Exposed at `protected` scope so test subclasses can verify the
-        oversized-request rejection path (Layer 1) without invoking the
-        full JobQueue handler. Production callers should never read this back —
-        the value is consumed by `charge()`/`disconnect()` internally.
-
-        @return The current `Resource::Charge` accumulated on `fee_`.
+    /**
+     * Read-only accessor for the accumulated peer-message charge.
+     *
+     * Exposed at `protected` scope so test subclasses can verify the
+     * oversized-request rejection path (Layer 1) without invoking the
+     * full JobQueue handler. Production callers should never read this back —
+     * the value is consumed by `charge()`/`disconnect()` internally.
+     *
+     * @return The current `Resource::Charge` accumulated on `fee_`.
      */
     Resource::Charge
     currentFeeCharge() const
diff --git a/src/xrpld/overlay/detail/PeerSet.cpp b/src/xrpld/overlay/detail/PeerSet.cpp
index 463b68bb6c..61bede37fe 100644
--- a/src/xrpld/overlay/detail/PeerSet.cpp
+++ b/src/xrpld/overlay/detail/PeerSet.cpp
@@ -33,7 +33,9 @@ public:
         std::function<bool(std::shared_ptr<Peer> const&)> hasItem,
         std::function<void(std::shared_ptr<Peer> const&)> onPeerAdded) override;
 
-    /** Send a message to one or all peers. */
+    /**
+     * Send a message to one or all peers.
+     */
     void
     sendRequest(
         ::google::protobuf::Message const& message,
@@ -49,7 +51,9 @@ private:
     Application& app_;
     beast::Journal journal_;
 
-    /** The identifiers of the peers we are tracking. */
+    /**
+     * The identifiers of the peers we are tracking.
+     */
     std::set<Peer::id_t> peers_;
 };
 
diff --git a/src/xrpld/overlay/detail/ProtocolMessage.h b/src/xrpld/overlay/detail/ProtocolMessage.h
index 156fcfc104..ef1bc8cb2b 100644
--- a/src/xrpld/overlay/detail/ProtocolMessage.h
+++ b/src/xrpld/overlay/detail/ProtocolMessage.h
@@ -42,7 +42,9 @@ protocolMessageType(protocol::TMProofPathRequest const&)
     return protocol::mtPROOF_PATH_REQ;
 }
 
-/** Returns the name of a protocol message given its type. */
+/**
+ * Returns the name of a protocol message given its type.
+ */
 template <class = void>
 std::string
 protocolMessageName(int type)
@@ -101,25 +103,35 @@ namespace detail {
 
 struct MessageHeader
 {
-    /** The size of the message on the wire.
-
-        @note This is the sum of sizes of the header and the payload.
-    */
+    /**
+     * The size of the message on the wire.
+     *
+     * @note This is the sum of sizes of the header and the payload.
+     */
     std::uint32_t totalWireSize = 0;
 
-    /** The size of the header associated with this message. */
+    /**
+     * The size of the header associated with this message.
+     */
     std::uint32_t headerSize = 0;
 
-    /** The size of the payload on the wire. */
+    /**
+     * The size of the payload on the wire.
+     */
     std::uint32_t payloadWireSize = 0;
 
-    /** Uncompressed message size if the message is compressed. */
+    /**
+     * Uncompressed message size if the message is compressed.
+     */
     std::uint32_t uncompressedSize = 0;
 
-    /** The type of the message. */
+    /**
+     * The type of the message.
+     */
     std::uint16_t messageType = 0;
 
-    /** Indicates which compression algorithm the payload is compressed with.
+    /**
+     * Indicates which compression algorithm the payload is compressed with.
      * Currently only lz4 is supported. If None then the message is not
      * compressed.
      */
@@ -140,14 +152,15 @@ buffersEnd(BufferSequence const& bufs)
     return boost::asio::buffers_iterator<BufferSequence, std::uint8_t>::end(bufs);
 }
 
-/** Parse a message header
- * @return a seated optional if the message header was successfully
- *         parsed. An unseated optional otherwise, in which case
- *         @param ec contains more information:
- *         - set to `errc::success` if not enough bytes were present
- *         - set to `errc::no_message` if a valid header was not present
- *         @bufs - sequence of input buffers, can't be empty
- *         @size input data size
+/**
+ * Parse a message header.
+ *
+ * @param ec On failure, set to `errc::success` if not enough bytes were
+ *           present, or `errc::no_message` if a valid header was not present.
+ * @param bufs Sequence of input buffers; can't be empty.
+ * @param size Input data size.
+ * @return A seated optional if the message header was successfully parsed, or
+ *         an unseated optional otherwise (see @p ec).
  */
 template <class BufferSequence>
 std::optional<MessageHeader>
@@ -294,18 +307,19 @@ invoke(MessageHeader const& header, Buffers const& buffers, Handler& handler)
 
 }  // namespace detail
 
-/** Calls the handler for up to one protocol message in the passed buffers.
-
-    If there is insufficient data to produce a complete protocol
-    message, zero is returned for the number of bytes consumed.
-
-    @param buffers The buffer that contains the data we've received
-    @param handler The handler that will be used to process the message
-    @param hint If possible, a hint as to the amount of data to read next. The
-                returned value MAY be zero, which means "no hint"
-
-    @return The number of bytes consumed, or the error code if any.
-*/
+/**
+ * Calls the handler for up to one protocol message in the passed buffers.
+ *
+ * If there is insufficient data to produce a complete protocol
+ * message, zero is returned for the number of bytes consumed.
+ *
+ * @param buffers The buffer that contains the data we've received
+ * @param handler The handler that will be used to process the message
+ * @param hint If possible, a hint as to the amount of data to read next. The
+ *             returned value MAY be zero, which means "no hint"
+ *
+ * @return The number of bytes consumed, or the error code if any.
+ */
 template <class Buffers, class Handler>
 std::pair<std::size_t, boost::system::error_code>
 invokeProtocolMessage(Buffers const& buffers, Handler& handler, std::size_t& hint)
diff --git a/src/xrpld/overlay/detail/ProtocolVersion.cpp b/src/xrpld/overlay/detail/ProtocolVersion.cpp
index 62660b0e01..347e59accb 100644
--- a/src/xrpld/overlay/detail/ProtocolVersion.cpp
+++ b/src/xrpld/overlay/detail/ProtocolVersion.cpp
@@ -19,11 +19,12 @@
 
 namespace xrpl {
 
-/** The list of protocol versions we speak and we prefer to use.
-
-    @note The list must be sorted in strictly ascending order (and so
-          it may not contain any duplicates!)
-*/
+/**
+ * The list of protocol versions we speak and we prefer to use.
+ *
+ * @note The list must be sorted in strictly ascending order (and so
+ *       it may not contain any duplicates!)
+ */
 
 constexpr ProtocolVersion const kSupportedProtocolList[]{
     {2, 1},
diff --git a/src/xrpld/overlay/detail/ProtocolVersion.h b/src/xrpld/overlay/detail/ProtocolVersion.h
index d6d9da7ad3..b56871318a 100644
--- a/src/xrpld/overlay/detail/ProtocolVersion.h
+++ b/src/xrpld/overlay/detail/ProtocolVersion.h
@@ -10,11 +10,12 @@
 
 namespace xrpl {
 
-/** Represents a particular version of the peer-to-peer protocol.
-
-    The protocol is represented as two pairs of 16-bit integers; a major
-    and a minor.
- * */
+/**
+ * Represents a particular version of the peer-to-peer protocol.
+ *
+ * The protocol is represented as two pairs of 16-bit integers; a major
+ * and a minor.
+ */
 using ProtocolVersion = std::pair<std::uint16_t, std::uint16_t>;
 
 constexpr ProtocolVersion
@@ -23,37 +24,48 @@ makeProtocol(std::uint16_t major, std::uint16_t minor)
     return {major, minor};
 }
 
-/** Print a protocol version a human-readable string. */
+/**
+ * Print a protocol version a human-readable string.
+ */
 std::string
 to_string(ProtocolVersion const& p);
 
-/** Parse a set of protocol versions.
-
-    Given a comma-separated string, extract and return all those that look
-    like valid protocol versions (i.e. XRPL/2.0 and later). Strings that are
-    not parsable as valid protocol strings are excluded from the result set.
-
-    @return A list of all apparently valid protocol versions.
-
-    @note The returned list of protocol versions is guaranteed to contain
-          no duplicates and will be sorted in ascending protocol order.
-*/
+/**
+ * Parse a set of protocol versions.
+ *
+ * Given a comma-separated string, extract and return all those that look
+ * like valid protocol versions (i.e. XRPL/2.0 and later). Strings that are
+ * not parsable as valid protocol strings are excluded from the result set.
+ *
+ * @return A list of all apparently valid protocol versions.
+ *
+ * @note The returned list of protocol versions is guaranteed to contain
+ *       no duplicates and will be sorted in ascending protocol order.
+ */
 std::vector<ProtocolVersion>
 parseProtocolVersions(boost::beast::string_view const& s);
 
-/** Given a list of supported protocol versions, choose the one we prefer. */
+/**
+ * Given a list of supported protocol versions, choose the one we prefer.
+ */
 std::optional<ProtocolVersion>
 negotiateProtocolVersion(std::vector<ProtocolVersion> const& versions);
 
-/** Given a list of supported protocol versions, choose the one we prefer. */
+/**
+ * Given a list of supported protocol versions, choose the one we prefer.
+ */
 std::optional<ProtocolVersion>
 negotiateProtocolVersion(boost::beast::string_view const& versions);
 
-/** The list of all the protocol versions we support. */
+/**
+ * The list of all the protocol versions we support.
+ */
 std::string const&
 supportedProtocolVersions();
 
-/** Determine whether we support a specific protocol version. */
+/**
+ * Determine whether we support a specific protocol version.
+ */
 bool
 isProtocolSupported(ProtocolVersion const& v);
 
diff --git a/src/xrpld/overlay/detail/TrafficCount.h b/src/xrpld/overlay/detail/TrafficCount.h
index b96ee022d6..8dc8ddb08e 100644
--- a/src/xrpld/overlay/detail/TrafficCount.h
+++ b/src/xrpld/overlay/detail/TrafficCount.h
@@ -15,23 +15,23 @@
 namespace xrpl {
 
 /**
-    TrafficCount is used to count ingress and egress wire bytes and number of
-   messages. The general intended usage is as follows:
-        1. Determine the message category by callin TrafficCount::categorize
-        2. Increment the counters for incoming or outgoing traffic by calling
-   TrafficCount::addCount
-        3. Optionally, TrafficCount::addCount can be called at any time to
-   increment additional traffic categories, not captured by
-   TrafficCount::categorize.
-
-   There are two special categories:
-        1. category::total - this category is used to report the total traffic
-   amount. It should be incremented once just after receiving a new message, and
-   once just before sending a message to a peer. Messages whose category is not
-   in TrafficCount::categorize are not included in the total.
-        2. category::unknown - this category is used to report traffic for
-   messages of unknown type.
-*/
+ * TrafficCount is used to count ingress and egress wire bytes and number of
+ * messages. The general intended usage is as follows:
+ *     1. Determine the message category by callin TrafficCount::categorize
+ *     2. Increment the counters for incoming or outgoing traffic by calling
+ * TrafficCount::addCount
+ *     3. Optionally, TrafficCount::addCount can be called at any time to
+ * increment additional traffic categories, not captured by
+ * TrafficCount::categorize.
+ *
+ * There are two special categories:
+ *     1. category::total - this category is used to report the total traffic
+ * amount. It should be incremented once just after receiving a new message, and
+ * once just before sending a message to a peer. Messages whose category is not
+ * in TrafficCount::categorize are not included in the total.
+ *     2. category::unknown - this category is used to report traffic for
+ * messages of unknown type.
+ */
 class TrafficCount
 {
 public:
@@ -186,7 +186,8 @@ public:
 
     TrafficCount() = default;
 
-    /** Given a protocol message, determine which traffic category it belongs to
+    /**
+     * Given a protocol message, determine which traffic category it belongs to
      */
     static Category
     categorize(
@@ -194,7 +195,9 @@ public:
         protocol::MessageType type,
         bool inbound);
 
-    /** Account for traffic associated with the given category */
+    /**
+     * Account for traffic associated with the given category
+     */
     void
     addCount(Category cat, bool inbound, int bytes)
     {
@@ -219,9 +222,10 @@ public:
         }
     }
 
-    /** An up-to-date copy of all the counters
-
-        @return an object which satisfies the requirements of Container
+    /**
+     * An up-to-date copy of all the counters
+     *
+     * @return an object which satisfies the requirements of Container
      */
     [[nodiscard]] auto const&
     getCounts() const
diff --git a/src/xrpld/overlay/detail/Tuning.h b/src/xrpld/overlay/detail/Tuning.h
index 8357fcd130..5488fab07b 100644
--- a/src/xrpld/overlay/detail/Tuning.h
+++ b/src/xrpld/overlay/detail/Tuning.h
@@ -7,126 +7,161 @@
 
 namespace xrpl::Tuning {
 
-/** How many ledgers off a server can be and we will
-    still consider it converged */
+/**
+ * How many ledgers off a server can be and we will
+ * still consider it converged
+ */
 static constexpr std::uint32_t kConvergedLedgerLimit = 24;
 
-/** How many ledgers off a server has to be before we
-    consider it diverged */
+/**
+ * How many ledgers off a server has to be before we
+ * consider it diverged
+ */
 static constexpr std::uint32_t kDivergedLedgerLimit = 128;
 
-/** The soft cap on the number of ledger entries in a single reply. */
+/**
+ * The soft cap on the number of ledger entries in a single reply.
+ */
 static constexpr auto kSoftMaxReplyNodes = 8192;
 
-/** The hard cap on the number of ledger entries in a single reply. */
+/**
+ * The hard cap on the number of ledger entries in a single reply.
+ */
 static constexpr auto kHardMaxReplyNodes = 12288;
 
-/** How many timer intervals a sendq has to stay large before we disconnect */
+/**
+ * How many timer intervals a sendq has to stay large before we disconnect
+ */
 static constexpr auto kSendqIntervals = 4;
 
-/** How many messages on a send queue before we refuse queries */
+/**
+ * How many messages on a send queue before we refuse queries
+ */
 static constexpr auto kDropSendQueue = 192;
 
-/** How many messages we consider reasonable sustained on a send queue */
+/**
+ * How many messages we consider reasonable sustained on a send queue
+ */
 static constexpr auto kTargetSendQueue = 128;
 
-/** How often to log send queue size */
+/**
+ * How often to log send queue size
+ */
 static constexpr auto kSendQueueLogFreq = 64;
 
-/** How often we check for idle peers (seconds) */
+/**
+ * How often we check for idle peers (seconds)
+ */
 static constexpr auto kCheckIdlePeers = 4;
 
-/** The maximum number of levels to search */
+/**
+ * The maximum number of levels to search
+ */
 static constexpr auto kMaxQueryDepth = 3;
 
-/** Size of buffer used to read from the socket. */
+/**
+ * Size of buffer used to read from the socket.
+ */
 constexpr std::size_t kReadBufferBytes = 16384;
 
-/** TMGetObjectByHash differential pricing.
+/**
+ * TMGetObjectByHash differential pricing.
+ *
+ * Honest peers ask for at most 8 hashes per call (the header, or up to
+ * 4 state + 4 tx hashes from `InboundLedger::getNeededHashes()`). The
+ * free tier covers them at zero cost. Beyond that, each lookup is billed:
+ * 'misses' cost much more than 'hits' because a miss does a node store seek
+ * while a hit is usually served from cache. On top of that, a size-band
+ * surcharge kicks in for larger requests so an attacker who crams a
+ * single message with thousands of hashes blows past
+ * `Resource::kDropThreshold` and gets disconnected.
+ *
+ * The numbers below are picked to keep three things true given
+ * `kDropThreshold = 25000`:
+ *
+ *   - Honest traffic (<= 8 objects per request) is free.
+ *   - A single all-miss request at `kHardMaxReplyNodes` (12288) costs
+ *     more than the drop threshold, so an attacker gets dropped in one
+ *     message.
+ *   - A peer spamming 1024-object hit-only requests gets dropped in
+ *     ~19 messages — fast enough to be useful, slow enough that an
+ *     honest peer momentarily sending oversized requests has time to
+ *     back off.
+ */
 
-    Honest peers ask for at most 8 hashes per call (the header, or up to
-    4 state + 4 tx hashes from `InboundLedger::getNeededHashes()`). The
-    free tier covers them at zero cost. Beyond that, each lookup is billed:
-    'misses' cost much more than 'hits' because a miss does a node store seek
-    while a hit is usually served from cache. On top of that, a size-band
-    surcharge kicks in for larger requests so an attacker who crams a
-    single message with thousands of hashes blows past
-    `Resource::kDropThreshold` and gets disconnected.
-
-    The numbers below are picked to keep three things true given
-    `kDropThreshold = 25000`:
-
-      - Honest traffic (<= 8 objects per request) is free.
-      - A single all-miss request at `kHardMaxReplyNodes` (12288) costs
-        more than the drop threshold, so an attacker gets dropped in one
-        message.
-      - A peer spamming 1024-object hit-only requests gets dropped in
-        ~19 messages — fast enough to be useful, slow enough that an
-        honest peer momentarily sending oversized requests has time to
-        back off. */
-
-/** How many objects a request can ask for before per-lookup billing
-    begins?
-    Twice the honest peak (8) so a peer that occasionally retries a hash
-    never trips pricing. Same value as `SHAMapInnerNode::kBranchFactor`;
-    that's a coincidence, not a requirement. */
+/**
+ * How many objects a request can ask for before per-lookup billing
+ * begins?
+ * Twice the honest peak (8) so a peer that occasionally retries a hash
+ * never trips pricing. Same value as `SHAMapInnerNode::kBranchFactor`;
+ * that's a coincidence, not a requirement.
+ */
 static constexpr auto kFreeObjectsPerRequest = 16;
 
-/** Cost of one cache-hit lookup. The unit; everything else is a
-    multiple of this. */
+/**
+ * Cost of one cache-hit lookup. The unit; everything else is a
+ * multiple of this.
+ */
 static constexpr auto kCostPerLookupHit = 1;
 
-/** Cost of one node-store miss, in units of `kCostPerLookupHit`.
-
-    A miss does a node store disk seek; a hit usually comes from cache.
-    The 8x ratio is an order-of-magnitude guess at the latency gap on
-    SSD-backed nodes, not a measured number. The math only requires this
-    to be at least 2 — any smaller and a full-miss request at the hard
-    cap wouldn't trip the drop threshold. 8 leaves headroom: if
-    `kDropThreshold` goes up or `kHardMaxReplyNodes` comes down, the
-    drop-on-attack property still holds without a code change. */
+/**
+ * Cost of one node-store miss, in units of `kCostPerLookupHit`.
+ *
+ * A miss does a node store disk seek; a hit usually comes from cache.
+ * The 8x ratio is an order-of-magnitude guess at the latency gap on
+ * SSD-backed nodes, not a measured number. The math only requires this
+ * to be at least 2 — any smaller and a full-miss request at the hard
+ * cap wouldn't trip the drop threshold. 8 leaves headroom: if
+ * `kDropThreshold` goes up or `kHardMaxReplyNodes` comes down, the
+ * drop-on-attack property still holds without a code change.
+ */
 static constexpr auto kCostPerLookupMiss = 8;
 
-/** Size-band surcharges. Whichever band a request's size falls into,
-    its surcharge is added once on top of the per-lookup cost.
-
-    The job of the surcharge is to make crossing a band edge feel like
-    a step, not a slope. With these values, the cost roughly doubles or triples at each cliff:
-
-        n=64: costs 48 => n=65 costs 149 (~3x jump)
-        n=1024: costs 1108 => n=1025 costs 2009 (~2x jump)
-
-    The 10x step between medium and large mirrors the ~16x step
-    between the band edges (64 -> 1024) so the cliff feels comparable
-    at both scales.
+/**
+ * Size-band surcharges. Whichever band a request's size falls into,
+ * its surcharge is added once on top of the per-lookup cost.
+ *
+ * The job of the surcharge is to make crossing a band edge feel like
+ * a step, not a slope. With these values, the cost roughly doubles or triples at each cliff:
+ *
+ *     n=64: costs 48 => n=65 costs 149 (~3x jump)
+ *     n=1024: costs 1108 => n=1025 costs 2009 (~2x jump)
+ *
+ * The 10x step between medium and large mirrors the ~16x step
+ * between the band edges (64 -> 1024) so the cliff feels comparable
+ * at both scales.
  */
 static constexpr auto kCostBandSmall = 0;
 static constexpr auto kCostBandMedium = 100;
 static constexpr auto kCostBandLarge = 1000;
 
-/** How many hashes per type an honest peer asks for at a time.
-
-    Matches the `4` passed to `neededStateHashes(4)` and
-    `neededTxHashes(4)` in `InboundLedger::getNeededHashes()`. Kept here
-    instead of imported from the ledger module so overlay stays
-    self-contained; if that `4` ever changes, update this in lockstep or
-    the band thresholds below will start charging honest peers. */
+/**
+ * How many hashes per type an honest peer asks for at a time.
+ *
+ * Matches the `4` passed to `neededStateHashes(4)` and
+ * `neededTxHashes(4)` in `InboundLedger::getNeededHashes()`. Kept here
+ * instead of imported from the ledger module so overlay stays
+ * self-contained; if that `4` ever changes, update this in lockstep or
+ * the band thresholds below will start charging honest peers.
+ */
 static constexpr auto kLegitHashesPerType = 4;
 
-/** Cutoffs that decide which size band a request falls into.
-
-    A SHAMap inner node has 16 children; an honest peer asks for 4
-    hashes per type. So:
-
-      kBandSmallMax  = 4 * 16    =   64  // one inner node's worth
-      kBandMediumMax = 4 * 16^2  = 1024  // a depth-2 subtree's worth
-
-    A request up to 64 objects is small (no surcharge); up to 1024 is
-    medium; anything larger is large. The bounds are inclusive: a
-    request of exactly 64 is small, 65 is medium. Anything past 1024 is
-    well beyond what the honest sync path produces, so it's billed at
-    the large rate to drive attack-shaped traffic over the drop
-    threshold quickly. */
+/**
+ * Cutoffs that decide which size band a request falls into.
+ *
+ * A SHAMap inner node has 16 children; an honest peer asks for 4
+ * hashes per type. So:
+ *
+ *   kBandSmallMax  = 4 * 16    =   64  // one inner node's worth
+ *   kBandMediumMax = 4 * 16^2  = 1024  // a depth-2 subtree's worth
+ *
+ * A request up to 64 objects is small (no surcharge); up to 1024 is
+ * medium; anything larger is large. The bounds are inclusive: a
+ * request of exactly 64 is small, 65 is medium. Anything past 1024 is
+ * well beyond what the honest sync path produces, so it's billed at
+ * the large rate to drive attack-shaped traffic over the drop
+ * threshold quickly.
+ */
 static constexpr auto kBandSmallMax = kLegitHashesPerType * SHAMapInnerNode::kBranchFactor;
 static constexpr auto kBandMediumMax = kBandSmallMax * SHAMapInnerNode::kBranchFactor;
 
diff --git a/src/xrpld/overlay/detail/TxMetrics.h b/src/xrpld/overlay/detail/TxMetrics.h
index 44cd0272ee..a9afa1d6b2 100644
--- a/src/xrpld/overlay/detail/TxMetrics.h
+++ b/src/xrpld/overlay/detail/TxMetrics.h
@@ -12,17 +12,19 @@
 
 namespace xrpl::metrics {
 
-/** Run single metrics rolling average. Can be either average of a value
-    per second or average of a value's sample per second. For instance,
-    for transaction it makes sense to have transaction bytes and count
-    per second, but for a number of selected peers to relay per transaction
-    it makes sense to have sample's average.
+/**
+ * Run single metrics rolling average. Can be either average of a value
+ * per second or average of a value's sample per second. For instance,
+ * for transaction it makes sense to have transaction bytes and count
+ * per second, but for a number of selected peers to relay per transaction
+ * it makes sense to have sample's average.
  */
 struct SingleMetrics
 {
-    /** Class constructor
-       @param ptu if true then calculate metrics per second, otherwise
-           sample's average
+    /**
+     * Class constructor
+     * @param ptu if true then calculate metrics per second, otherwise
+     *     sample's average
      */
     SingleMetrics(bool ptu = true) : perTimeUnit(ptu)
     {
@@ -34,15 +36,18 @@ struct SingleMetrics
     std::uint32_t n{0};
     bool perTimeUnit{true};
     boost::circular_buffer<std::uint64_t> rollingAvgAggregate{30, 0ull};
-    /** Add metrics value
+    /**
+     * Add metrics value
      * @param val metrics value, either bytes or count
      */
     void
     addMetrics(std::uint32_t val);
 };
 
-/** Run two metrics. For instance message size and count for
-    protocol messages. */
+/**
+ * Run two metrics. For instance message size and count for
+ * protocol messages.
+ */
 struct MultipleMetrics
 {
     MultipleMetrics(bool ptu1 = true, bool ptu2 = true) : m1(ptu1), m2(ptu2)
@@ -51,12 +56,14 @@ struct MultipleMetrics
 
     SingleMetrics m1;
     SingleMetrics m2;
-    /** Add metrics to m2. m1 in this case aggregates the frequency.
-       @param val2 m2 metrics value
+    /**
+     * Add metrics to m2. m1 in this case aggregates the frequency.
+     * @param val2 m2 metrics value
      */
     void
     addMetrics(std::uint32_t val2);
-    /** Add metrics to m1 and m2.
+    /**
+     * Add metrics to m1 and m2.
      * @param val1 m1 metrics value
      * @param val2 m2 metrics value
      */
@@ -64,7 +71,9 @@ struct MultipleMetrics
     addMetrics(std::uint32_t val1, std::uint32_t val2);
 };
 
-/** Run transaction reduce-relay feature related metrics */
+/**
+ * Run transaction reduce-relay feature related metrics
+ */
 struct TxMetrics
 {
     mutable std::mutex mutex;
@@ -86,26 +95,30 @@ struct TxMetrics
     SingleMetrics notEnabled{false};
     // TMTransactions number of transactions count per second
     SingleMetrics missingTx;
-    /** Add protocol message metrics
-       @param type protocol message type
-       @param val message size in bytes
+    /**
+     * Add protocol message metrics
+     * @param type protocol message type
+     * @param val message size in bytes
      */
     void
     addMetrics(protocol::MessageType type, std::uint32_t val);
-    /** Add peers selected for relaying and suppressed peers metrics.
-       @param selected number of selected peers to relay
-       @param suppressed number of suppressed peers
-       @param notEnabled number of peers with tx reduce-relay featured disabled
+    /**
+     * Add peers selected for relaying and suppressed peers metrics.
+     * @param selected number of selected peers to relay
+     * @param suppressed number of suppressed peers
+     * @param notEnabled number of peers with tx reduce-relay featured disabled
      */
     void
     addMetrics(std::uint32_t selected, std::uint32_t suppressed, std::uint32_t notEnabled);
-    /** Add number of missing transactions that a node requested
-       @param missing number of missing transactions
+    /**
+     * Add number of missing transactions that a node requested
+     * @param missing number of missing transactions
      */
     void
     addMetrics(std::uint32_t missing);
-    /** Get json representation of the metrics
-       @return json object
+    /**
+     * Get json representation of the metrics
+     * @return json object
      */
     json::Value
     json() const;
diff --git a/src/xrpld/overlay/detail/ZeroCopyStream.h b/src/xrpld/overlay/detail/ZeroCopyStream.h
index deccb627b9..9bbe69910b 100644
--- a/src/xrpld/overlay/detail/ZeroCopyStream.h
+++ b/src/xrpld/overlay/detail/ZeroCopyStream.h
@@ -11,11 +11,12 @@
 
 namespace xrpl {
 
-/** Implements ZeroCopyInputStream around a buffer sequence.
-    @tparam Buffers A type meeting the requirements of ConstBufferSequence.
-    @see
-   https://developers.google.com/protocol-buffers/docs/reference/cpp/google.protobuf.io.zero_copy_stream
-*/
+/**
+ * Implements ZeroCopyInputStream around a buffer sequence.
+ * @tparam Buffers A type meeting the requirements of ConstBufferSequence.
+ * @see
+ * https://developers.google.com/protocol-buffers/docs/reference/cpp/google.protobuf.io.zero_copy_stream
+ */
 template <class Buffers>
 class ZeroCopyInputStream : public ::google::protobuf::io::ZeroCopyInputStream
 {
@@ -105,10 +106,11 @@ ZeroCopyInputStream<Buffers>::Skip(int count)
 
 //------------------------------------------------------------------------------
 
-/** Implements ZeroCopyOutputStream around a Streambuf.
-    Streambuf matches the public interface defined by boost::asio::streambuf.
-    @tparam Streambuf A type meeting the requirements of Streambuf.
-*/
+/**
+ * Implements ZeroCopyOutputStream around a Streambuf.
+ * Streambuf matches the public interface defined by boost::asio::streambuf.
+ * @tparam Streambuf A type meeting the requirements of Streambuf.
+ */
 template <class Streambuf>
 class ZeroCopyOutputStream : public ::google::protobuf::io::ZeroCopyOutputStream
 {
diff --git a/src/xrpld/overlay/make_Overlay.h b/src/xrpld/overlay/make_Overlay.h
index f0dfa429c0..a62d4b49de 100644
--- a/src/xrpld/overlay/make_Overlay.h
+++ b/src/xrpld/overlay/make_Overlay.h
@@ -19,7 +19,9 @@ namespace xrpl {
 Overlay::Setup
 setupOverlay(BasicConfig const& config, beast::Journal j);
 
-/** Creates the implementation of Overlay. */
+/**
+ * Creates the implementation of Overlay.
+ */
 std::unique_ptr<Overlay>
 makeOverlay(
     Application& app,
diff --git a/src/xrpld/overlay/predicates.h b/src/xrpld/overlay/predicates.h
index 2527b8c728..56f4c80291 100644
--- a/src/xrpld/overlay/predicates.h
+++ b/src/xrpld/overlay/predicates.h
@@ -8,7 +8,9 @@
 
 namespace xrpl {
 
-/** Sends a message to all peers */
+/**
+ * Sends a message to all peers
+ */
 struct SendAlways
 {
     using return_type = void;
@@ -28,7 +30,9 @@ struct SendAlways
 
 //------------------------------------------------------------------------------
 
-/** Sends a message to match peers */
+/**
+ * Sends a message to match peers
+ */
 template <typename Predicate>
 struct SendIfPred
 {
@@ -49,7 +53,9 @@ struct SendIfPred
     }
 };
 
-/** Helper function to aid in type deduction */
+/**
+ * Helper function to aid in type deduction
+ */
 template <typename Predicate>
 SendIfPred<Predicate>
 sendIf(std::shared_ptr<Message> const& m, Predicate const& f)
@@ -59,7 +65,9 @@ sendIf(std::shared_ptr<Message> const& m, Predicate const& f)
 
 //------------------------------------------------------------------------------
 
-/** Sends a message to non-matching peers */
+/**
+ * Sends a message to non-matching peers
+ */
 template <typename Predicate>
 struct SendIfNotPred
 {
@@ -80,7 +88,9 @@ struct SendIfNotPred
     }
 };
 
-/** Helper function to aid in type deduction */
+/**
+ * Helper function to aid in type deduction
+ */
 template <typename Predicate>
 SendIfNotPred<Predicate>
 sendIfNot(std::shared_ptr<Message> const& m, Predicate const& f)
@@ -90,7 +100,9 @@ sendIfNot(std::shared_ptr<Message> const& m, Predicate const& f)
 
 //------------------------------------------------------------------------------
 
-/** Select the specific peer */
+/**
+ * Select the specific peer
+ */
 struct MatchPeer
 {
     Peer const* matchPeer;
@@ -108,7 +120,9 @@ struct MatchPeer
 
 //------------------------------------------------------------------------------
 
-/** Select all peers (except optional excluded) that are in our cluster */
+/**
+ * Select all peers (except optional excluded) that are in our cluster
+ */
 struct PeerInCluster
 {
     MatchPeer skipPeer;
@@ -132,7 +146,9 @@ struct PeerInCluster
 
 //------------------------------------------------------------------------------
 
-/** Select all peers that are in the specified set */
+/**
+ * Select all peers that are in the specified set
+ */
 struct PeerInSet
 {
     std::set<Peer::id_t> const& peerSet;
diff --git a/src/xrpld/peerfinder/PeerfinderManager.h b/src/xrpld/peerfinder/PeerfinderManager.h
index d482ae7241..0530343641 100644
--- a/src/xrpld/peerfinder/PeerfinderManager.h
+++ b/src/xrpld/peerfinder/PeerfinderManager.h
@@ -24,71 +24,101 @@ namespace xrpl::PeerFinder {
 
 using clock_type = beast::AbstractClock<std::chrono::steady_clock>;
 
-/** Represents a set of addresses. */
+/**
+ * Represents a set of addresses.
+ */
 using IPAddresses = std::vector<beast::IP::Endpoint>;
 
 //------------------------------------------------------------------------------
 
-/** PeerFinder configuration settings. */
+/**
+ * PeerFinder configuration settings.
+ */
 struct Config
 {
-    /** The largest number of public peer slots to allow.
-        This includes both inbound and outbound, but does not include
-        fixed peers.
-    */
+    /**
+     * The largest number of public peer slots to allow.
+     * This includes both inbound and outbound, but does not include
+     * fixed peers.
+     */
     std::size_t maxPeers{Tuning::kDefaultMaxPeers};
 
-    /** The number of automatic outbound connections to maintain.
-        Outbound connections are only maintained if autoConnect
-        is `true`.
-    */
+    /**
+     * The number of automatic outbound connections to maintain.
+     * Outbound connections are only maintained if autoConnect
+     * is `true`.
+     */
     std::size_t outPeers;
 
-    /** The number of automatic inbound connections to maintain.
-        Inbound connections are only maintained if wantIncoming
-        is `true`.
-    */
+    /**
+     * The number of automatic inbound connections to maintain.
+     * Inbound connections are only maintained if wantIncoming
+     * is `true`.
+     */
     std::size_t inPeers{0};
 
-    /** `true` if we want our IP address kept private. */
+    /**
+     * `true` if we want our IP address kept private.
+     */
     bool peerPrivate = true;
 
-    /** `true` if we want to accept incoming connections. */
+    /**
+     * `true` if we want to accept incoming connections.
+     */
     bool wantIncoming{true};
 
-    /** `true` if we want to establish connections automatically */
+    /**
+     * `true` if we want to establish connections automatically
+     */
     bool autoConnect{true};
 
-    /** The listening port number. */
+    /**
+     * The listening port number.
+     */
     std::uint16_t listeningPort{0};
 
-    /** The set of features we advertise. */
+    /**
+     * The set of features we advertise.
+     */
     std::string features;
 
-    /** Limit how many incoming connections we allow per IP */
+    /**
+     * Limit how many incoming connections we allow per IP
+     */
     int ipLimit{0};
 
-    /** `true` if we want to verify endpoints in TMEndpoints messages */
+    /**
+     * `true` if we want to verify endpoints in TMEndpoints messages
+     */
     bool verifyEndpoints = true;
 
     //--------------------------------------------------------------------------
 
-    /** Create a configuration with default values. */
+    /**
+     * Create a configuration with default values.
+     */
     Config();
 
-    /** Returns a suitable value for outPeers according to the rules. */
+    /**
+     * Returns a suitable value for outPeers according to the rules.
+     */
     [[nodiscard]] std::size_t
     calcOutPeers() const;
 
-    /** Adjusts the values so they follow the business rules. */
+    /**
+     * Adjusts the values so they follow the business rules.
+     */
     void
     applyTuning();
 
-    /** Write the configuration into a property stream */
+    /**
+     * Write the configuration into a property stream
+     */
     void
     onWrite(beast::PropertyStream::Map& map) const;
 
-    /** Make PeerFinder::Config from configuration parameters
+    /**
+     * Make PeerFinder::Config from configuration parameters
      * @param config server's configuration
      * @param port server's listening port
      * @param validationPublicKey true if validation public key is not empty
@@ -111,7 +141,9 @@ struct Config
 
 //------------------------------------------------------------------------------
 
-/** Describes a connectable peer address along with some metadata. */
+/**
+ * Describes a connectable peer address along with some metadata.
+ */
 struct Endpoint
 {
     Endpoint() = default;
@@ -128,12 +160,16 @@ operator<(Endpoint const& lhs, Endpoint const& rhs)
     return lhs.address < rhs.address;
 }
 
-/** A set of Endpoint used for connecting. */
+/**
+ * A set of Endpoint used for connecting.
+ */
 using Endpoints = std::vector<Endpoint>;
 
 //------------------------------------------------------------------------------
 
-/** Possible results from activating a slot. */
+/**
+ * Possible results from activating a slot.
+ */
 enum class Result { InboundDisabled, DuplicatePeer, IpLimitExceeded, Full, Success };
 
 /**
@@ -170,57 +206,70 @@ to_string(Result result) noexcept
     return "unknown";
 }
 
-/** Maintains a set of IP addresses used for getting into the network. */
+/**
+ * Maintains a set of IP addresses used for getting into the network.
+ */
 class Manager : public beast::PropertyStream::Source
 {
 protected:
     Manager() noexcept;
 
 public:
-    /** Destroy the object.
-        Any pending source fetch operations are aborted.
-        There may be some listener calls made before the
-        destructor returns.
-    */
+    /**
+     * Destroy the object.
+     * Any pending source fetch operations are aborted.
+     * There may be some listener calls made before the
+     * destructor returns.
+     */
     ~Manager() override = default;
 
-    /** Set the configuration for the manager.
-        The new settings will be applied asynchronously.
-        Thread safety:
-            Can be called from any threads at any time.
-    */
+    /**
+     * Set the configuration for the manager.
+     * The new settings will be applied asynchronously.
+     * Thread safety:
+     *     Can be called from any threads at any time.
+     */
     virtual void
     setConfig(Config const& config) = 0;
 
-    /** Transition to the started state, synchronously. */
+    /**
+     * Transition to the started state, synchronously.
+     */
     virtual void
     start() = 0;
 
-    /** Transition to the stopped state, synchronously. */
+    /**
+     * Transition to the stopped state, synchronously.
+     */
     virtual void
     stop() = 0;
 
-    /** Returns the configuration for the manager. */
+    /**
+     * Returns the configuration for the manager.
+     */
     virtual Config
     config() = 0;
 
-    /** Add a peer that should always be connected.
-        This is useful for maintaining a private cluster of peers.
-        The string is the name as specified in the configuration
-        file, along with the set of corresponding IP addresses.
-    */
+    /**
+     * Add a peer that should always be connected.
+     * This is useful for maintaining a private cluster of peers.
+     * The string is the name as specified in the configuration
+     * file, along with the set of corresponding IP addresses.
+     */
     virtual void
     addFixedPeer(std::string_view name, std::vector<beast::IP::Endpoint> const& addresses) = 0;
 
-    /** Add a set of strings as fallback IP::Endpoint sources.
-        @param name A label used for diagnostics.
-    */
+    /**
+     * Add a set of strings as fallback IP::Endpoint sources.
+     * @param name A label used for diagnostics.
+     */
     virtual void
     addFallbackStrings(std::string const& name, std::vector<std::string> const& strings) = 0;
 
-    /** Add a URL as a fallback location to obtain IP::Endpoint sources.
-        @param name A label used for diagnostics.
-    */
+    /**
+     * Add a URL as a fallback location to obtain IP::Endpoint sources.
+     * @param name A label used for diagnostics.
+     */
     /* VFALCO NOTE Unimplemented
     virtual void addFallbackURL (std::string const& name,
         std::string const& url) = 0;
@@ -228,38 +277,47 @@ public:
 
     //--------------------------------------------------------------------------
 
-    /** Create a new inbound slot with the specified remote endpoint.
-        If nullptr is returned, then the slot could not be assigned.
-        Usually this is because of a detected self-connection.
-    */
+    /**
+     * Create a new inbound slot with the specified remote endpoint.
+     * If nullptr is returned, then the slot could not be assigned.
+     * Usually this is because of a detected self-connection.
+     */
     virtual std::pair<std::shared_ptr<Slot>, Result>
     newInboundSlot(
         beast::IP::Endpoint const& localEndpoint,
         beast::IP::Endpoint const& remoteEndpoint) = 0;
 
-    /** Create a new outbound slot with the specified remote endpoint.
-        If nullptr is returned, then the slot could not be assigned.
-        Usually this is because of a duplicate connection.
-    */
+    /**
+     * Create a new outbound slot with the specified remote endpoint.
+     * If nullptr is returned, then the slot could not be assigned.
+     * Usually this is because of a duplicate connection.
+     */
     virtual std::pair<std::shared_ptr<Slot>, Result>
     newOutboundSlot(beast::IP::Endpoint const& remoteEndpoint) = 0;
 
-    /** Called when mtENDPOINTS is received. */
+    /**
+     * Called when mtENDPOINTS is received.
+     */
     virtual void
     onEndpoints(std::shared_ptr<Slot> const& slot, Endpoints const& endpoints) = 0;
 
-    /** Called when the slot is closed.
-        This always happens when the socket is closed, unless the socket
-        was canceled.
-    */
+    /**
+     * Called when the slot is closed.
+     * This always happens when the socket is closed, unless the socket
+     * was canceled.
+     */
     virtual void
     onClosed(std::shared_ptr<Slot> const& slot) = 0;
 
-    /** Called when an outbound connection is deemed to have failed */
+    /**
+     * Called when an outbound connection is deemed to have failed
+     */
     virtual void
     onFailure(std::shared_ptr<Slot> const& slot) = 0;
 
-    /** Called when we received redirect IPs from a busy peer. */
+    /**
+     * Called when we received redirect IPs from a busy peer.
+     */
     virtual void
     onRedirects(
         boost::asio::ip::tcp::endpoint const& remoteAddress,
@@ -267,34 +325,42 @@ public:
 
     //--------------------------------------------------------------------------
 
-    /** Called when an outbound connection attempt succeeds.
-        The local endpoint must be valid. If the caller receives an error
-        when retrieving the local endpoint from the socket, it should
-        proceed as if the connection attempt failed by calling on_closed
-        instead of on_connected.
-        @return `true` if the connection should be kept
-    */
+    /**
+     * Called when an outbound connection attempt succeeds.
+     * The local endpoint must be valid. If the caller receives an error
+     * when retrieving the local endpoint from the socket, it should
+     * proceed as if the connection attempt failed by calling on_closed
+     * instead of on_connected.
+     * @return `true` if the connection should be kept
+     */
     virtual bool
     onConnected(std::shared_ptr<Slot> const& slot, beast::IP::Endpoint const& localEndpoint) = 0;
 
-    /** Request an active slot type. */
+    /**
+     * Request an active slot type.
+     */
     virtual Result
     activate(std::shared_ptr<Slot> const& slot, PublicKey const& key, bool reserved) = 0;
 
-    /** Returns a set of endpoints suitable for redirection. */
+    /**
+     * Returns a set of endpoints suitable for redirection.
+     */
     virtual std::vector<Endpoint>
     redirect(std::shared_ptr<Slot> const& slot) = 0;
 
-    /** Return a set of addresses we should connect to. */
+    /**
+     * Return a set of addresses we should connect to.
+     */
     virtual std::vector<beast::IP::Endpoint>
     autoconnect() = 0;
 
     virtual std::vector<std::pair<std::shared_ptr<Slot>, std::vector<Endpoint>>>
     buildEndpointsForPeers() = 0;
 
-    /** Perform periodic activity.
-        This should be called once per second.
-    */
+    /**
+     * Perform periodic activity.
+     * This should be called once per second.
+     */
     virtual void
     oncePerSecond() = 0;
 };
diff --git a/src/xrpld/peerfinder/Slot.h b/src/xrpld/peerfinder/Slot.h
index f43b7d1009..9db39ac94c 100644
--- a/src/xrpld/peerfinder/Slot.h
+++ b/src/xrpld/peerfinder/Slot.h
@@ -9,7 +9,9 @@
 
 namespace xrpl::PeerFinder {
 
-/** Properties and state associated with a peer to peer overlay connection. */
+/**
+ * Properties and state associated with a peer to peer overlay connection.
+ */
 class Slot
 {
 public:
@@ -19,42 +21,53 @@ public:
 
     virtual ~Slot() = 0;
 
-    /** Returns `true` if this is an inbound connection. */
+    /**
+     * Returns `true` if this is an inbound connection.
+     */
     [[nodiscard]] virtual bool
     inbound() const = 0;
 
-    /** Returns `true` if this is a fixed connection.
-        A connection is fixed if its remote endpoint is in the list of
-        remote endpoints for fixed connections.
-    */
+    /**
+     * Returns `true` if this is a fixed connection.
+     * A connection is fixed if its remote endpoint is in the list of
+     * remote endpoints for fixed connections.
+     */
     [[nodiscard]] virtual bool
     fixed() const = 0;
 
-    /** Returns `true` if this is a reserved connection.
-        It might be a cluster peer, or a peer with a reservation.
-        This is only known after then handshake completes.
+    /**
+     * Returns `true` if this is a reserved connection.
+     * It might be a cluster peer, or a peer with a reservation.
+     * This is only known after then handshake completes.
      */
     [[nodiscard]] virtual bool
     reserved() const = 0;
 
-    /** Returns the state of the connection. */
+    /**
+     * Returns the state of the connection.
+     */
     [[nodiscard]] virtual State
     state() const = 0;
 
-    /** The remote endpoint of socket. */
+    /**
+     * The remote endpoint of socket.
+     */
     [[nodiscard]] virtual beast::IP::Endpoint const&
     remoteEndpoint() const = 0;
 
-    /** The local endpoint of the socket, when known. */
+    /**
+     * The local endpoint of the socket, when known.
+     */
     [[nodiscard]] virtual std::optional<beast::IP::Endpoint> const&
     localEndpoint() const = 0;
 
     [[nodiscard]] virtual std::optional<std::uint16_t>
     listeningPort() const = 0;
 
-    /** The peer's public key, when known.
-        The public key is established when the handshake is complete.
-    */
+    /**
+     * The peer's public key, when known.
+     * The public key is established when the handshake is complete.
+     */
     [[nodiscard]] virtual std::optional<PublicKey> const&
     publicKey() const = 0;
 };
diff --git a/src/xrpld/peerfinder/detail/Bootcache.h b/src/xrpld/peerfinder/detail/Bootcache.h
index cee03fa322..c84fed42c7 100644
--- a/src/xrpld/peerfinder/detail/Bootcache.h
+++ b/src/xrpld/peerfinder/detail/Bootcache.h
@@ -16,21 +16,22 @@
 
 namespace xrpl::PeerFinder {
 
-/** Stores IP addresses useful for gaining initial connections.
-
-    This is one of the caches that is consulted when additional outgoing
-    connections are needed. Along with the address, each entry has this
-    additional metadata:
-
-    Valence
-        A signed integer which represents the number of successful
-        consecutive connection attempts when positive, and the number of
-        failed consecutive connection attempts when negative.
-
-    When choosing addresses from the boot cache for the purpose of
-    establishing outgoing connections, addresses are ranked in decreasing
-    order of high uptime, with valence as the tie breaker.
-*/
+/**
+ * Stores IP addresses useful for gaining initial connections.
+ *
+ * This is one of the caches that is consulted when additional outgoing
+ * connections are needed. Along with the address, each entry has this
+ * additional metadata:
+ *
+ * Valence
+ *     A signed integer which represents the number of successful
+ *     consecutive connection attempts when positive, and the number of
+ *     failed consecutive connection attempts when negative.
+ *
+ * When choosing addresses from the boot cache for the purpose of
+ * establishing outgoing connections, addresses are ranked in decreasing
+ * order of high uptime, with valence as the tie breaker.
+ */
 class Bootcache
 {
 private:
@@ -107,15 +108,21 @@ public:
 
     ~Bootcache();
 
-    /** Returns `true` if the cache is empty. */
+    /**
+     * Returns `true` if the cache is empty.
+     */
     [[nodiscard]] bool
     empty() const;
 
-    /** Returns the number of entries in the cache. */
+    /**
+     * Returns the number of entries in the cache.
+     */
     [[nodiscard]] map_type::size_type
     size() const;
 
-    /** IP::Endpoint iterators that traverse in decreasing valence. */
+    /**
+     * IP::Endpoint iterators that traverse in decreasing valence.
+     */
     /** @{ */
     [[nodiscard]] const_iterator
     begin() const;
@@ -129,31 +136,45 @@ public:
     clear();
     /** @} */
 
-    /** Load the persisted data from the Store into the container. */
+    /**
+     * Load the persisted data from the Store into the container.
+     */
     void
     load();
 
-    /** Add a newly-learned address to the cache. */
+    /**
+     * Add a newly-learned address to the cache.
+     */
     bool
     insert(beast::IP::Endpoint const& endpoint);
 
-    /** Add a staticallyconfigured address to the cache. */
+    /**
+     * Add a staticallyconfigured address to the cache.
+     */
     bool
     insertStatic(beast::IP::Endpoint const& endpoint);
 
-    /** Called when an outbound connection handshake completes. */
+    /**
+     * Called when an outbound connection handshake completes.
+     */
     void
     onSuccess(beast::IP::Endpoint const& endpoint);
 
-    /** Called when an outbound connection attempt fails to handshake. */
+    /**
+     * Called when an outbound connection attempt fails to handshake.
+     */
     void
     onFailure(beast::IP::Endpoint const& endpoint);
 
-    /** Stores the cache in the persistent database on a timer. */
+    /**
+     * Stores the cache in the persistent database on a timer.
+     */
     void
     periodicActivity();
 
-    /** Write the cache state to the property stream. */
+    /**
+     * Write the cache state to the property stream.
+     */
     void
     onWrite(beast::PropertyStream::Map& map);
 
diff --git a/src/xrpld/peerfinder/detail/Checker.h b/src/xrpld/peerfinder/detail/Checker.h
index 208bad390c..28ec83adb1 100644
--- a/src/xrpld/peerfinder/detail/Checker.h
+++ b/src/xrpld/peerfinder/detail/Checker.h
@@ -13,7 +13,9 @@
 
 namespace xrpl::PeerFinder {
 
-/** Tests remote listening sockets to make sure they are connectable. */
+/**
+ * Tests remote listening sockets to make sure they are connectable.
+ */
 template <class Protocol = boost::asio::ip::tcp>
 class Checker
 {
@@ -70,31 +72,36 @@ private:
 public:
     explicit Checker(boost::asio::io_context& ioContext);
 
-    /** Destroy the service.
-        Any pending I/O operations will be canceled. This call blocks until
-        all pending operations complete (either with success or with
-        operation_aborted) and the associated thread and io_context have
-        no more work remaining.
-    */
+    /**
+     * Destroy the service.
+     * Any pending I/O operations will be canceled. This call blocks until
+     * all pending operations complete (either with success or with
+     * operation_aborted) and the associated thread and io_context have
+     * no more work remaining.
+     */
     ~Checker();
 
-    /** Stop the service.
-        Pending I/O operations will be canceled.
-        This issues cancel orders for all pending I/O operations and then
-        returns immediately. Handlers will receive operation_aborted errors,
-        or if they were already queued they will complete normally.
-    */
+    /**
+     * Stop the service.
+     * Pending I/O operations will be canceled.
+     * This issues cancel orders for all pending I/O operations and then
+     * returns immediately. Handlers will receive operation_aborted errors,
+     * or if they were already queued they will complete normally.
+     */
     void
     stop();
 
-    /** Block until all pending I/O completes. */
+    /**
+     * Block until all pending I/O completes.
+     */
     void
     wait();
 
-    /** Performs an async connection test on the specified endpoint.
-        The port must be non-zero. Note that the execution guarantees
-        offered by asio handlers are NOT enforced.
-    */
+    /**
+     * Performs an async connection test on the specified endpoint.
+     * The port must be non-zero. Note that the execution guarantees
+     * offered by asio handlers are NOT enforced.
+     */
     template <class Handler>
     void
     asyncConnect(beast::IP::Endpoint const& endpoint, Handler&& handler);
diff --git a/src/xrpld/peerfinder/detail/Counts.h b/src/xrpld/peerfinder/detail/Counts.h
index 0d8bf1c56e..c90598c1a1 100644
--- a/src/xrpld/peerfinder/detail/Counts.h
+++ b/src/xrpld/peerfinder/detail/Counts.h
@@ -13,28 +13,38 @@
 
 namespace xrpl::PeerFinder {
 
-/** Direction of a slot count adjustment. */
+/**
+ * Direction of a slot count adjustment.
+ */
 enum class CountAdjustment : int { Decrement = -1, Increment = 1 };
 
-/** Manages the count of available connections for the various slots. */
+/**
+ * Manages the count of available connections for the various slots.
+ */
 class Counts
 {
 public:
-    /** Adds the slot state and properties to the slot counts. */
+    /**
+     * Adds the slot state and properties to the slot counts.
+     */
     void
     add(Slot const& s)
     {
         adjust(s, CountAdjustment::Increment);
     }
 
-    /** Removes the slot state and properties from the slot counts. */
+    /**
+     * Removes the slot state and properties from the slot counts.
+     */
     void
     remove(Slot const& s)
     {
         adjust(s, CountAdjustment::Decrement);
     }
 
-    /** Returns `true` if the slot can become active. */
+    /**
+     * Returns `true` if the slot can become active.
+     */
     [[nodiscard]] bool
     canActivate(Slot const& s) const
     {
@@ -52,7 +62,9 @@ public:
         return outActive_ < outMax_;
     }
 
-    /** Returns the number of attempts needed to bring us to the max. */
+    /**
+     * Returns the number of attempts needed to bring us to the max.
+     */
     [[nodiscard]] std::size_t
     attemptsNeeded() const
     {
@@ -61,37 +73,46 @@ public:
         return Tuning::kMaxConnectAttempts - attempts_;
     }
 
-    /** Returns the number of outbound connection attempts. */
+    /**
+     * Returns the number of outbound connection attempts.
+     */
     [[nodiscard]] std::size_t
     attempts() const
     {
         return attempts_;
     }
 
-    /** Returns the total number of outbound slots. */
+    /**
+     * Returns the total number of outbound slots.
+     */
     [[nodiscard]] int
     outMax() const
     {
         return outMax_;
     }
 
-    /** Returns the number of outbound peers assigned an open slot.
-        Fixed peers do not count towards outbound slots used.
-    */
+    /**
+     * Returns the number of outbound peers assigned an open slot.
+     * Fixed peers do not count towards outbound slots used.
+     */
     [[nodiscard]] int
     outActive() const
     {
         return outActive_;
     }
 
-    /** Returns the number of fixed connections. */
+    /**
+     * Returns the number of fixed connections.
+     */
     [[nodiscard]] std::size_t
     fixed() const
     {
         return fixed_;
     }
 
-    /** Returns the number of active fixed connections. */
+    /**
+     * Returns the number of active fixed connections.
+     */
     [[nodiscard]] std::size_t
     fixedActive() const
     {
@@ -100,7 +121,9 @@ public:
 
     //--------------------------------------------------------------------------
 
-    /** Called when the config is set or changed. */
+    /**
+     * Called when the config is set or changed.
+     */
     void
     onConfig(Config const& config)
     {
@@ -109,51 +132,64 @@ public:
             inMax_ = config.inPeers;
     }
 
-    /** Returns the number of accepted connections that haven't handshaked. */
+    /**
+     * Returns the number of accepted connections that haven't handshaked.
+     */
     [[nodiscard]] int
     acceptCount() const
     {
         return acceptCount_;
     }
 
-    /** Returns the number of connection attempts currently active. */
+    /**
+     * Returns the number of connection attempts currently active.
+     */
     [[nodiscard]] int
     connectCount() const
     {
         return attempts_;
     }
 
-    /** Returns the number of connections that are gracefully closing. */
+    /**
+     * Returns the number of connections that are gracefully closing.
+     */
     [[nodiscard]] int
     closingCount() const
     {
         return closingCount_;
     }
 
-    /** Returns the total number of inbound slots. */
+    /**
+     * Returns the total number of inbound slots.
+     */
     [[nodiscard]] int
     inMax() const
     {
         return inMax_;
     }
 
-    /** Returns the number of inbound peers assigned an open slot. */
+    /**
+     * Returns the number of inbound peers assigned an open slot.
+     */
     [[nodiscard]] int
     inboundActive() const
     {
         return inActive_;
     }
 
-    /** Returns the total number of active peers excluding fixed peers. */
+    /**
+     * Returns the total number of active peers excluding fixed peers.
+     */
     [[nodiscard]] int
     totalActive() const
     {
         return inActive_ + outActive_;
     }
 
-    /** Returns the number of unused inbound slots.
-        Fixed peers do not deduct from inbound slots or count towards totals.
-    */
+    /**
+     * Returns the number of unused inbound slots.
+     * Fixed peers do not deduct from inbound slots or count towards totals.
+     */
     [[nodiscard]] int
     inboundSlotsFree() const
     {
@@ -162,9 +198,10 @@ public:
         return 0;
     }
 
-    /** Returns the number of unused outbound slots.
-        Fixed peers do not deduct from outbound slots or count towards totals.
-    */
+    /**
+     * Returns the number of unused outbound slots.
+     * Fixed peers do not deduct from outbound slots or count towards totals.
+     */
     [[nodiscard]] int
     outboundSlotsFree() const
     {
@@ -175,7 +212,8 @@ public:
 
     //--------------------------------------------------------------------------
 
-    /** Returns true if the slot logic considers us "connected" to the network.
+    /**
+     * Returns true if the slot logic considers us "connected" to the network.
      */
     [[nodiscard]] bool
     isConnectedToNetwork() const
@@ -189,7 +227,9 @@ public:
         return outMax_ <= 0;
     }
 
-    /** Output statistics. */
+    /**
+     * Output statistics.
+     */
     void
     onWrite(beast::PropertyStream::Map& map) const
     {
@@ -203,7 +243,9 @@ public:
         map["total"] = active_;
     }
 
-    /** Records the state for diagnostics. */
+    /**
+     * Records the state for diagnostics.
+     */
     [[nodiscard]] std::string
     stateString() const
     {
@@ -215,7 +257,9 @@ public:
 
     //--------------------------------------------------------------------------
 private:
-    /** Increments or decrements a counter based on the adjustment direction. */
+    /**
+     * Increments or decrements a counter based on the adjustment direction.
+     */
     template <typename T>
     static void
     adjustCounter(T& counter, CountAdjustment dir)
@@ -295,31 +339,49 @@ private:
     }
 
 private:
-    /** Outbound connection attempts. */
+    /**
+     * Outbound connection attempts.
+     */
     int attempts_{0};
 
-    /** Active connections, including fixed and reserved. */
+    /**
+     * Active connections, including fixed and reserved.
+     */
     std::size_t active_{0};
 
-    /** Total number of inbound slots. */
+    /**
+     * Total number of inbound slots.
+     */
     std::size_t inMax_{0};
 
-    /** Number of inbound slots assigned to active peers. */
+    /**
+     * Number of inbound slots assigned to active peers.
+     */
     std::size_t inActive_{0};
 
-    /** Maximum desired outbound slots. */
+    /**
+     * Maximum desired outbound slots.
+     */
     std::size_t outMax_{0};
 
-    /** Active outbound slots. */
+    /**
+     * Active outbound slots.
+     */
     std::size_t outActive_{0};
 
-    /** Fixed connections. */
+    /**
+     * Fixed connections.
+     */
     std::size_t fixed_{0};
 
-    /** Active fixed connections. */
+    /**
+     * Active fixed connections.
+     */
     std::size_t fixedActive_{0};
 
-    /** Reserved connections. */
+    /**
+     * Reserved connections.
+     */
     std::size_t reserved_{0};
 
     // Number of inbound connections that are
diff --git a/src/xrpld/peerfinder/detail/Fixed.h b/src/xrpld/peerfinder/detail/Fixed.h
index 3319994251..24d54775ef 100644
--- a/src/xrpld/peerfinder/detail/Fixed.h
+++ b/src/xrpld/peerfinder/detail/Fixed.h
@@ -9,7 +9,9 @@
 
 namespace xrpl::PeerFinder {
 
-/** Metadata for a Fixed slot. */
+/**
+ * Metadata for a Fixed slot.
+ */
 class Fixed
 {
 public:
@@ -19,14 +21,18 @@ public:
 
     Fixed(Fixed const&) = default;
 
-    /** Returns the time after which we should allow a connection attempt. */
+    /**
+     * Returns the time after which we should allow a connection attempt.
+     */
     [[nodiscard]] clock_type::time_point const&
     when() const
     {
         return when_;
     }
 
-    /** Updates metadata to reflect a failed connection. */
+    /**
+     * Updates metadata to reflect a failed connection.
+     */
     void
     failure(clock_type::time_point const& now)
     {
@@ -34,7 +40,9 @@ public:
         when_ = now + std::chrono::minutes(Tuning::kConnectionBackoff[failures_]);
     }
 
-    /** Updates metadata to reflect a successful connection. */
+    /**
+     * Updates metadata to reflect a successful connection.
+     */
     void
     success(clock_type::time_point const& now)
     {
diff --git a/src/xrpld/peerfinder/detail/Handouts.h b/src/xrpld/peerfinder/detail/Handouts.h
index faadb51fd2..757f1a8e1b 100644
--- a/src/xrpld/peerfinder/detail/Handouts.h
+++ b/src/xrpld/peerfinder/detail/Handouts.h
@@ -17,10 +17,11 @@ namespace xrpl::PeerFinder {
 
 namespace detail {
 
-/** Try to insert one object in the target.
-    When an item is handed out it is moved to the end of the container.
-    @return The number of objects inserted
-*/
+/**
+ * Try to insert one object in the target.
+ * When an item is handed out it is moved to the end of the container.
+ * @return The number of objects inserted
+ */
 // VFALCO TODO specialization that handles std::list for SequenceContainer
 //             using splice for optimization over erase/push_back
 //
@@ -43,10 +44,11 @@ handoutOne(Target& t, HopContainer& h)
 
 }  // namespace detail
 
-/** Distributes objects to targets according to business rules.
-    A best effort is made to evenly distribute items in the sequence
-    container list into the target sequence list.
-*/
+/**
+ * Distributes objects to targets according to business rules.
+ * A best effort is made to evenly distribute items in the sequence
+ * container list into the target sequence list.
+ */
 template <class TargetFwdIter, class SeqFwdIter>
 void
 handout(TargetFwdIter first, TargetFwdIter last, SeqFwdIter seqFirst, SeqFwdIter seqLast)
@@ -77,9 +79,10 @@ handout(TargetFwdIter first, TargetFwdIter last, SeqFwdIter seqFirst, SeqFwdIter
 
 //------------------------------------------------------------------------------
 
-/** Receives handouts for redirecting a connection.
-    An incoming connection request is redirected when we are full on slots.
-*/
+/**
+ * Receives handouts for redirecting a connection.
+ * An incoming connection request is redirected when we are full on slots.
+ */
 class RedirectHandouts
 {
 public:
@@ -163,7 +166,9 @@ RedirectHandouts::tryInsert(Endpoint const& ep)
 
 //------------------------------------------------------------------------------
 
-/** Receives endpoints for a slot during periodic handouts. */
+/**
+ * Receives endpoints for a slot during periodic handouts.
+ */
 class SlotHandouts
 {
 public:
@@ -247,7 +252,9 @@ SlotHandouts::tryInsert(Endpoint const& ep)
 
 //------------------------------------------------------------------------------
 
-/** Receives handouts for making automatic connections. */
+/**
+ * Receives handouts for making automatic connections.
+ */
 class ConnectHandouts
 {
 public:
diff --git a/src/xrpld/peerfinder/detail/Livecache.h b/src/xrpld/peerfinder/detail/Livecache.h
index 1dcc8f6daf..2015098847 100644
--- a/src/xrpld/peerfinder/detail/Livecache.h
+++ b/src/xrpld/peerfinder/detail/Livecache.h
@@ -55,10 +55,11 @@ protected:
         boost::intrusive::make_list<Element, boost::intrusive::constant_time_size<false>>::type;
 
 public:
-    /** A list of Endpoint at the same hops
-        This is a lightweight wrapper around a reference to the underlying
-        container.
-    */
+    /**
+     * A list of Endpoint at the same hops
+     * This is a lightweight wrapper around a reference to the underlying
+     * container.
+     */
     template <bool IsConst>
     class Hop
     {
@@ -169,18 +170,19 @@ protected:
 
 //------------------------------------------------------------------------------
 
-/** The Livecache holds the short-lived relayed Endpoint messages.
-
-    Since peers only advertise themselves when they have open slots,
-    we want these messages to expire rather quickly after the peer becomes
-    full.
-
-    Addresses added to the cache are not connection-tested to see if
-    they are connectable (with one small exception regarding neighbors).
-    Therefore, these addresses are not suitable for persisting across
-    launches or for bootstrapping, because they do not have verifiable
-    and locally observed uptime and connectability information.
-*/
+/**
+ * The Livecache holds the short-lived relayed Endpoint messages.
+ *
+ * Since peers only advertise themselves when they have open slots,
+ * we want these messages to expire rather quickly after the peer becomes
+ * full.
+ *
+ * Addresses added to the cache are not connection-tested to see if
+ * they are connectable (with one small exception regarding neighbors).
+ * Therefore, these addresses are not suitable for persisting across
+ * launches or for bootstrapping, because they do not have verifiable
+ * and locally observed uptime and connectability information.
+ */
 template <class Allocator = std::allocator<char>>
 class Livecache : protected detail::LivecacheBase
 {
@@ -198,7 +200,9 @@ private:
 public:
     using allocator_type = Allocator;
 
-    /** Create the cache. */
+    /**
+     * Create the cache.
+     */
     Livecache(clock_type& clock, beast::Journal journal, Allocator alloc = Allocator());
 
     //
@@ -318,7 +322,9 @@ public:
             return const_reverse_iterator(lists_.crend(), Transform<true>());
         }
 
-        /** Shuffle each hop list. */
+        /**
+         * Shuffle each hop list.
+         */
         void
         shuffle();
 
@@ -343,29 +349,39 @@ public:
         Histogram hist_{};
     } hops;
 
-    /** Returns `true` if the cache is empty. */
+    /**
+     * Returns `true` if the cache is empty.
+     */
     [[nodiscard]] bool
     empty() const
     {
         return cache_.empty();
     }
 
-    /** Returns the number of entries in the cache. */
+    /**
+     * Returns the number of entries in the cache.
+     */
     cache_type::size_type
     size() const
     {
         return cache_.size();
     }
 
-    /** Erase entries whose time has expired. */
+    /**
+     * Erase entries whose time has expired.
+     */
     void
     expire();
 
-    /** Creates or updates an existing Element based on a new message. */
+    /**
+     * Creates or updates an existing Element based on a new message.
+     */
     void
     insert(Endpoint const& ep);
 
-    /** Output statistics. */
+    /**
+     * Output statistics.
+     */
     void
     onWrite(beast::PropertyStream::Map& map);
 };
diff --git a/src/xrpld/peerfinder/detail/Logic.h b/src/xrpld/peerfinder/detail/Logic.h
index 8ea348f560..b0047b1ea3 100644
--- a/src/xrpld/peerfinder/detail/Logic.h
+++ b/src/xrpld/peerfinder/detail/Logic.h
@@ -41,10 +41,11 @@
 
 namespace xrpl::PeerFinder {
 
-/** The Logic for maintaining the list of Slot addresses.
-    We keep this in a separate class so it can be instantiated
-    for unit tests.
-*/
+/**
+ * The Logic for maintaining the list of Slot addresses.
+ * We keep this in a separate class so it can be instantiated
+ * for unit tests.
+ */
 template <class Checker>
 class Logic
 {
@@ -127,12 +128,13 @@ public:
         bootcache.load();
     }
 
-    /** Stop the logic.
-        This will cancel the current fetch and set the stopping flag
-        to `true` to prevent further fetches.
-        Thread safety:
-            Safe to call from any thread.
-    */
+    /**
+     * Stop the logic.
+     * This will cancel the current fetch and set the stopping flag
+     * to `true` to prevent further fetches.
+     * Thread safety:
+     *     Safe to call from any thread.
+     */
     void
     stop()
     {
@@ -448,10 +450,11 @@ public:
         return Result::Success;
     }
 
-    /** Return a list of addresses suitable for redirection.
-        This is a legacy function, redirects should be returned in
-        the HTTP handshake and not via TMEndpoints.
-    */
+    /**
+     * Return a list of addresses suitable for redirection.
+     * This is a legacy function, redirects should be returned in
+     * the HTTP handshake and not via TMEndpoints.
+     */
     std::vector<Endpoint>
     redirect(SlotImp::ptr const& slot)
     {
@@ -462,9 +465,10 @@ public:
         return std::move(h.list());
     }
 
-    /** Create new outbound connection attempts as needed.
-        This implements PeerFinder's "Outbound Connection Strategy"
-    */
+    /**
+     * Create new outbound connection attempts as needed.
+     * This implements PeerFinder's "Outbound Connection Strategy"
+     */
     // VFALCO TODO This should add the returned addresses to the
     //             squelch list in one go once the list is built,
     //             rather than having each module add to the squelch list.
@@ -989,7 +993,9 @@ public:
     //
     //--------------------------------------------------------------------------
 
-    /** Adds eligible Fixed addresses for outbound attempts. */
+    /**
+     * Adds eligible Fixed addresses for outbound attempts.
+     */
     template <class Container>
     void
     getFixed(std::size_t needed, Container& c, ConnectHandouts::Squelches& squelches)
diff --git a/src/xrpld/peerfinder/detail/SlotImp.h b/src/xrpld/peerfinder/detail/SlotImp.h
index cf1915268f..898941b157 100644
--- a/src/xrpld/peerfinder/detail/SlotImp.h
+++ b/src/xrpld/peerfinder/detail/SlotImp.h
@@ -135,14 +135,17 @@ public:
     public:
         explicit RecentT(clock_type& clock);
 
-        /** Called for each valid endpoint received for a slot.
-            We also insert messages that we send to the slot to prevent
-            sending a slot the same address too frequently.
-        */
+        /**
+         * Called for each valid endpoint received for a slot.
+         * We also insert messages that we send to the slot to prevent
+         * sending a slot the same address too frequently.
+         */
         void
         insert(beast::IP::Endpoint const& ep, std::uint32_t hops);
 
-        /** Returns `true` if we should not send endpoint to the slot. */
+        /**
+         * Returns `true` if we should not send endpoint to the slot.
+         */
         bool
         filter(beast::IP::Endpoint const& ep, std::uint32_t hops);
 
diff --git a/src/xrpld/peerfinder/detail/Source.h b/src/xrpld/peerfinder/detail/Source.h
index cf8920e056..b205dc8dfb 100644
--- a/src/xrpld/peerfinder/detail/Source.h
+++ b/src/xrpld/peerfinder/detail/Source.h
@@ -10,18 +10,21 @@
 
 namespace xrpl::PeerFinder {
 
-/** A static or dynamic source of peer addresses.
-    These are used as fallbacks when we are bootstrapping and don't have
-    a local cache, or when none of our addresses are functioning. Typically
-    sources will represent things like static text in the config file, a
-    separate local file with addresses, or a remote HTTPS URL that can
-    be updated automatically. Another solution is to use a custom DNS server
-    that hands out peer IP addresses when name lookups are performed.
-*/
+/**
+ * A static or dynamic source of peer addresses.
+ * These are used as fallbacks when we are bootstrapping and don't have
+ * a local cache, or when none of our addresses are functioning. Typically
+ * sources will represent things like static text in the config file, a
+ * separate local file with addresses, or a remote HTTPS URL that can
+ * be updated automatically. Another solution is to use a custom DNS server
+ * that hands out peer IP addresses when name lookups are performed.
+ */
 class Source
 {
 public:
-    /** The results of a fetch. */
+    /**
+     * The results of a fetch.
+     */
     struct Results
     {
         explicit Results() = default;
diff --git a/src/xrpld/peerfinder/detail/SourceStrings.h b/src/xrpld/peerfinder/detail/SourceStrings.h
index 618970fa03..b79cf0df03 100644
--- a/src/xrpld/peerfinder/detail/SourceStrings.h
+++ b/src/xrpld/peerfinder/detail/SourceStrings.h
@@ -8,7 +8,9 @@
 
 namespace xrpl::PeerFinder {
 
-/** Provides addresses from a static set of strings. */
+/**
+ * Provides addresses from a static set of strings.
+ */
 class SourceStrings : public Source
 {
 public:
diff --git a/src/xrpld/peerfinder/detail/Store.h b/src/xrpld/peerfinder/detail/Store.h
index 570dba0523..9393ef6c2b 100644
--- a/src/xrpld/peerfinder/detail/Store.h
+++ b/src/xrpld/peerfinder/detail/Store.h
@@ -8,7 +8,9 @@
 
 namespace xrpl::PeerFinder {
 
-/** Abstract persistence for PeerFinder data. */
+/**
+ * Abstract persistence for PeerFinder data.
+ */
 class Store
 {
 public:
diff --git a/src/xrpld/peerfinder/detail/StoreSqdb.h b/src/xrpld/peerfinder/detail/StoreSqdb.h
index f868e89ff7..b17d2fdc5b 100644
--- a/src/xrpld/peerfinder/detail/StoreSqdb.h
+++ b/src/xrpld/peerfinder/detail/StoreSqdb.h
@@ -16,7 +16,9 @@
 
 namespace xrpl::PeerFinder {
 
-/** Database persistence for PeerFinder using SQLite */
+/**
+ * Database persistence for PeerFinder using SQLite
+ */
 class StoreSqdb : public Store
 {
 private:
diff --git a/src/xrpld/peerfinder/detail/Tuning.h b/src/xrpld/peerfinder/detail/Tuning.h
index 1bf9df382e..ea4637dd9d 100644
--- a/src/xrpld/peerfinder/detail/Tuning.h
+++ b/src/xrpld/peerfinder/detail/Tuning.h
@@ -5,7 +5,9 @@
 #include <chrono>
 #include <cstdint>
 
-/** Heuristically tuned constants. */
+/**
+ * Heuristically tuned constants.
+ */
 /** @{ */
 namespace xrpl::PeerFinder::Tuning {
 
@@ -15,32 +17,41 @@ namespace xrpl::PeerFinder::Tuning {
 //
 //---------------------------------------------------------
 
-/** Time to wait between making batches of connection attempts */
+/**
+ * Time to wait between making batches of connection attempts
+ */
 static constexpr auto kSecondsPerConnect = 10;
 
-/** Maximum number of simultaneous connection attempts. */
+/**
+ * Maximum number of simultaneous connection attempts.
+ */
 static constexpr auto kMaxConnectAttempts = 20;
 
-/** The percentage of total peer slots that are outbound.
-    The number of outbound peers will be the larger of the
-    minOutCount and outPercent * Config::maxPeers specially
-    rounded.
-*/
+/**
+ * The percentage of total peer slots that are outbound.
+ * The number of outbound peers will be the larger of the
+ * minOutCount and outPercent * Config::maxPeers specially
+ * rounded.
+ */
 static constexpr auto kOutPercent = 15;
 
-/** A hard minimum on the number of outgoing connections.
-    This is enforced outside the Logic, so that the unit test
-    can use any settings it wants.
-*/
+/**
+ * A hard minimum on the number of outgoing connections.
+ * This is enforced outside the Logic, so that the unit test
+ * can use any settings it wants.
+ */
 static constexpr auto kMinOutCount = 10;
 
-/** The default value of Config::maxPeers. */
+/**
+ * The default value of Config::maxPeers.
+ */
 static constexpr auto kDefaultMaxPeers = 21;
 
-/** Max redirects we will accept from one connection.
-    Redirects are limited for security purposes, to prevent
-    the address caches from getting flooded.
-*/
+/**
+ * Max redirects we will accept from one connection.
+ * Redirects are limited for security purposes, to prevent
+ * the address caches from getting flooded.
+ */
 static constexpr auto kMaxRedirects = 30;
 
 //------------------------------------------------------------------------------
diff --git a/src/xrpld/peerfinder/detail/iosformat.h b/src/xrpld/peerfinder/detail/iosformat.h
index a0b9ff537a..46c69ef602 100644
--- a/src/xrpld/peerfinder/detail/iosformat.h
+++ b/src/xrpld/peerfinder/detail/iosformat.h
@@ -12,7 +12,9 @@ namespace beast {
 // A collection of handy stream manipulators and
 // functions to produce nice looking log output.
 
-/** Left justifies a field at the specified width. */
+/**
+ * Left justifies a field at the specified width.
+ */
 struct Leftw
 {
     explicit Leftw(int width) : width(width)
@@ -29,7 +31,9 @@ struct Leftw
     }
 };
 
-/** Produce a section heading and fill the rest of the line with dashes. */
+/**
+ * Produce a section heading and fill the rest of the line with dashes.
+ */
 template <class CharT, class Traits, class Allocator>
 std::basic_string<CharT, Traits, Allocator>
 heading(std::basic_string<CharT, Traits, Allocator> title, int width = 80, CharT fill = CharT('-'))
@@ -40,7 +44,9 @@ heading(std::basic_string<CharT, Traits, Allocator> title, int width = 80, CharT
     return title;
 }
 
-/** Produce a dashed line separator, with a specified or default size. */
+/**
+ * Produce a dashed line separator, with a specified or default size.
+ */
 struct Divider
 {
     using CharT = char;
@@ -58,7 +64,9 @@ struct Divider
     }
 };
 
-/** Creates a padded field with an optional fill character. */
+/**
+ * Creates a padded field with an optional fill character.
+ */
 struct Fpad
 {
     explicit Fpad(int width, int pad = 0, char fill = ' ') : width(width + pad), fill(fill)
@@ -90,7 +98,9 @@ to_string(T const& t)
 
 }  // namespace detail
 
-/** Justifies a field at the specified width. */
+/**
+ * Justifies a field at the specified width.
+ */
 /** @{ */
 template <
     class CharT,
diff --git a/src/xrpld/peerfinder/make_Manager.h b/src/xrpld/peerfinder/make_Manager.h
index 1f3f226397..1c13d7a4ca 100644
--- a/src/xrpld/peerfinder/make_Manager.h
+++ b/src/xrpld/peerfinder/make_Manager.h
@@ -12,7 +12,9 @@
 
 namespace xrpl::PeerFinder {
 
-/** Create a new Manager. */
+/**
+ * Create a new Manager.
+ */
 std::unique_ptr<Manager>
 makeManager(
     boost::asio::io_context& ioContext,
diff --git a/src/xrpld/perflog/detail/PerfLogImp.h b/src/xrpld/perflog/detail/PerfLogImp.h
index 88bf473554..14477512ff 100644
--- a/src/xrpld/perflog/detail/PerfLogImp.h
+++ b/src/xrpld/perflog/detail/PerfLogImp.h
@@ -24,7 +24,9 @@
 
 namespace xrpl::perf {
 
-/** A box coupling data with a mutex for locking access to it. */
+/**
+ * A box coupling data with a mutex for locking access to it.
+ */
 template <typename T>
 struct Locked
 {
diff --git a/src/xrpld/rpc/Context.h b/src/xrpld/rpc/Context.h
index fe6bb81ce3..81ba068d8f 100644
--- a/src/xrpld/rpc/Context.h
+++ b/src/xrpld/rpc/Context.h
@@ -20,7 +20,9 @@ class LedgerMaster;
 
 namespace RPC {
 
-/** The context of information needed to call an RPC. */
+/**
+ * The context of information needed to call an RPC.
+ */
 struct Context
 {
     beast::Journal const j;
diff --git a/src/xrpld/rpc/DeliveredAmount.h b/src/xrpld/rpc/DeliveredAmount.h
index bba045d494..dc635c6861 100644
--- a/src/xrpld/rpc/DeliveredAmount.h
+++ b/src/xrpld/rpc/DeliveredAmount.h
@@ -24,14 +24,13 @@ struct JsonContext;
 struct Context;
 
 /**
-   Add a `delivered_amount` field to the `meta` input/output parameter.
-   The field is only added to successful payment and check cash transactions.
-   If a delivered amount field is available in the TxMeta parameter, that value
-   is used. Otherwise, the transaction's `Amount` field is used. If neither is
-   available, then the delivered amount is set to "unavailable".
-
-   @{
+ * Add a `delivered_amount` field to the `meta` input/output parameter.
+ * The field is only added to successful payment and check cash transactions.
+ * If a delivered amount field is available in the TxMeta parameter, that value
+ * is used. Otherwise, the transaction's `Amount` field is used. If neither is
+ * available, then the delivered amount is set to "unavailable".
  */
+/** @{ */
 void
 insertDeliveredAmount(
     json::Value& meta,
diff --git a/src/xrpld/rpc/MPTokenIssuanceID.h b/src/xrpld/rpc/MPTokenIssuanceID.h
index cb2bfd1bdc..f56826bfb8 100644
--- a/src/xrpld/rpc/MPTokenIssuanceID.h
+++ b/src/xrpld/rpc/MPTokenIssuanceID.h
@@ -11,13 +11,12 @@
 namespace xrpl::RPC {
 
 /**
-   Add a `mpt_issuance_id` field to the `meta` input/output parameter.
-   The field is only added to successful MPTokenIssuanceCreate transactions.
-   The mpt_issuance_id is parsed from the sequence and the issuer in the
-   MPTokenIssuance object.
-
-   @{
+ * Add a `mpt_issuance_id` field to the `meta` input/output parameter.
+ * The field is only added to successful MPTokenIssuanceCreate transactions.
+ * The mpt_issuance_id is parsed from the sequence and the issuer in the
+ * MPTokenIssuance object.
  */
+/** @{ */
 bool
 canHaveMPTokenIssuanceID(
     std::shared_ptr<STTx const> const& serializedTx,
diff --git a/src/xrpld/rpc/RPCCall.h b/src/xrpld/rpc/RPCCall.h
index a06eca4413..a72b35e344 100644
--- a/src/xrpld/rpc/RPCCall.h
+++ b/src/xrpld/rpc/RPCCall.h
@@ -23,7 +23,9 @@ namespace xrpl {
 //
 // Improvements to be more strict and to provide better diagnostics are welcome.
 
-/** Processes XRPL RPC calls. */
+/**
+ * Processes XRPL RPC calls.
+ */
 namespace RPCCall {
 
 int
@@ -54,7 +56,8 @@ rpcCmdToJson(
     unsigned int apiVersion,
     beast::Journal j);
 
-/** Internal invocation of RPC client.
+/**
+ * Internal invocation of RPC client.
  *  Used by both xrpld command line as well as xrpld unit tests
  */
 std::pair<int, json::Value>
diff --git a/src/xrpld/rpc/RPCHandler.h b/src/xrpld/rpc/RPCHandler.h
index d1cd54145d..fcd0f54265 100644
--- a/src/xrpld/rpc/RPCHandler.h
+++ b/src/xrpld/rpc/RPCHandler.h
@@ -12,7 +12,9 @@ namespace xrpl::RPC {
 
 struct JsonContext;
 
-/** Execute an RPC command and store the results in a json::Value. */
+/**
+ * Execute an RPC command and store the results in a json::Value.
+ */
 Status
 doCommand(RPC::JsonContext&, json::Value&);
 
diff --git a/src/xrpld/rpc/RPCSub.h b/src/xrpld/rpc/RPCSub.h
index 95206e5cf6..bf31536bc5 100644
--- a/src/xrpld/rpc/RPCSub.h
+++ b/src/xrpld/rpc/RPCSub.h
@@ -11,7 +11,9 @@
 
 namespace xrpl {
 
-/** Subscription object for JSON RPC. */
+/**
+ * Subscription object for JSON RPC.
+ */
 class RPCSub : public InfoSub
 {
 public:
diff --git a/src/xrpld/rpc/Role.h b/src/xrpld/rpc/Role.h
index 660fb92c7c..2c2ae6b781 100644
--- a/src/xrpld/rpc/Role.h
+++ b/src/xrpld/rpc/Role.h
@@ -17,7 +17,8 @@
 
 namespace xrpl {
 
-/** Indicates the level of administrative permission to grant.
+/**
+ * Indicates the level of administrative permission to grant.
  * IDENTIFIED role has unlimited resources but cannot perform some
  *            RPC commands.
  * ADMIN role has unlimited resources and is able to perform all RPC
@@ -25,14 +26,15 @@ namespace xrpl {
  */
 enum class Role { GUEST, USER, IDENTIFIED, ADMIN, PROXY, FORBID };
 
-/** Return the allowed privilege role.
-    params must meet the requirements of the JSON-RPC
-    specification. It must be of type Object, containing the key params
-    which is an array with at least one object. Inside this object
-    are the optional keys 'admin_user' and 'admin_password' used to
-    validate the credentials. If user is non-blank, it's username
-    passed in the HTTP header by a secureGateway proxy.
-*/
+/**
+ * Return the allowed privilege role.
+ * params must meet the requirements of the JSON-RPC
+ * specification. It must be of type Object, containing the key params
+ * which is an array with at least one object. Inside this object
+ * are the optional keys 'admin_user' and 'admin_password' used to
+ * validate the credentials. If user is non-blank, it's username
+ * passed in the HTTP header by a secureGateway proxy.
+ */
 Role
 requestRole(
     Role const& required,
diff --git a/src/xrpld/rpc/Status.h b/src/xrpld/rpc/Status.h
index ff77f2ace7..dda1e89d31 100644
--- a/src/xrpld/rpc/Status.h
+++ b/src/xrpld/rpc/Status.h
@@ -13,14 +13,15 @@
 
 namespace xrpl::RPC {
 
-/** Status represents the results of an operation that might fail.
-
-    It wraps the legacy codes TER and error_code_i, providing both a uniform
-    interface and a way to attach additional information to existing status
-    returns.
-
-    A Status can also be used to fill a json::Value with a JSON-RPC 2.0
-    error response:  see http://www.jsonrpc.org/specification#error_object
+/**
+ * Status represents the results of an operation that might fail.
+ *
+ * It wraps the legacy codes TER and error_code_i, providing both a uniform
+ * interface and a way to attach additional information to existing status
+ * returns.
+ *
+ * A Status can also be used to fill a json::Value with a JSON-RPC 2.0
+ * error response:  see http://www.jsonrpc.org/specification#error_object
  */
 struct Status : public std::exception
 {
@@ -61,21 +62,27 @@ public:
     [[nodiscard]] std::string
     codeString() const;
 
-    /** Returns true if the Status is *not* OK. */
+    /**
+     * Returns true if the Status is *not* OK.
+     */
     operator bool() const
     {
         return code_ != kOK;
     }
 
-    /** Returns true if the Status is OK. */
+    /**
+     * Returns true if the Status is OK.
+     */
     bool
     operator!() const
     {
         return !bool(*this);
     }
 
-    /** Returns the Status as a TER.
-        This may only be called if type() == Type::TER. */
+    /**
+     * Returns the Status as a TER.
+     * This may only be called if type() == Type::TER.
+     */
     [[nodiscard]] TER
     toTER() const
     {
@@ -83,8 +90,10 @@ public:
         return TER::fromInt(code_);
     }
 
-    /** Returns the Status as an error_code_i.
-        This may only be called if type() == Type::ErrorCodeI. */
+    /**
+     * Returns the Status as an error_code_i.
+     * This may only be called if type() == Type::ErrorCodeI.
+     */
     [[nodiscard]] ErrorCodeI
     toErrorCode() const
     {
@@ -92,7 +101,8 @@ public:
         return ErrorCodeI(code_);
     }
 
-    /** Apply the Status to a JsonObject
+    /**
+     * Apply the Status to a JsonObject
      */
     void
     inject(json::Value& object) const
@@ -116,7 +126,9 @@ public:
         return messages_;
     }
 
-    /** Return the first message, if any. */
+    /**
+     * Return the first message, if any.
+     */
     [[nodiscard]] std::string
     message() const;
 
@@ -129,9 +141,11 @@ public:
     [[nodiscard]] std::string
     toString() const;
 
-    /** Fill a json::Value with an RPC 2.0 response.
-        If the Status is OK, fillJson has no effect.
-        Not currently used. */
+    /**
+     * Fill a json::Value with an RPC 2.0 response.
+     * If the Status is OK, fillJson has no effect.
+     * Not currently used.
+     */
     void
     fillJson(json::Value&);
 
diff --git a/src/xrpld/rpc/detail/AssetCache.h b/src/xrpld/rpc/detail/AssetCache.h
index 4b89487526..71a7c262d4 100644
--- a/src/xrpld/rpc/detail/AssetCache.h
+++ b/src/xrpld/rpc/detail/AssetCache.h
@@ -30,18 +30,19 @@ public:
         return ledger_;
     }
 
-    /** Find the trust lines associated with an account.
-
-       @param accountID The account
-       @param direction Whether the account is an "outgoing" link on the path.
-       "Outgoing" is defined as the source account, or an account found via a
-       trustline that has rippling enabled on the @accountID's side. If an
-       account is "outgoing", all trust lines will be returned. If an account is
-       not "outgoing", then any trust lines that don't have rippling enabled are
-       not usable, so only return trust lines that have rippling enabled on
-       @accountID's side.
-       @return Returns a vector of the usable trust lines.
-    */
+    /**
+     * Find the trust lines associated with an account.
+     *
+     * @param accountID The account
+     * @param direction Whether the account is an "outgoing" link on the path.
+     * "Outgoing" is defined as the source account, or an account found via a
+     * trustline that has rippling enabled on the @accountID's side. If an
+     * account is "outgoing", all trust lines will be returned. If an account is
+     * not "outgoing", then any trust lines that don't have rippling enabled are
+     * not usable, so only return trust lines that have rippling enabled on
+     * @accountID's side.
+     * @return Returns a vector of the usable trust lines.
+     */
     std::shared_ptr<std::vector<PathFindTrustLine>>
     getRippleLines(AccountID const& accountID, LineDirection direction);
 
diff --git a/src/xrpld/rpc/detail/Handler.cpp b/src/xrpld/rpc/detail/Handler.cpp
index 23eb8fdeec..4f5ce34c1f 100644
--- a/src/xrpld/rpc/detail/Handler.cpp
+++ b/src/xrpld/rpc/detail/Handler.cpp
@@ -21,7 +21,9 @@
 namespace xrpl::RPC {
 namespace {
 
-/** Adjust an old-style handler to be call-by-reference. */
+/**
+ * Adjust an old-style handler to be call-by-reference.
+ */
 template <typename Function>
 Handler::Method<json::Value>
 byRef(Function const& f)
diff --git a/src/xrpld/rpc/detail/Handler.h b/src/xrpld/rpc/detail/Handler.h
index 5e583aa5bb..37259c8648 100644
--- a/src/xrpld/rpc/detail/Handler.h
+++ b/src/xrpld/rpc/detail/Handler.h
@@ -47,7 +47,9 @@ struct Handler
 Handler const*
 getHandler(unsigned int version, bool betaEnabled, std::string const&);
 
-/** Return a json::ValueType::Object with a single entry. */
+/**
+ * Return a json::ValueType::Object with a single entry.
+ */
 template <class Value>
 json::Value
 makeObjectValue(Value const& value, json::StaticString const& field = jss::message)
@@ -57,7 +59,9 @@ makeObjectValue(Value const& value, json::StaticString const& field = jss::messa
     return result;
 }
 
-/** Return names of all methods. */
+/**
+ * Return names of all methods.
+ */
 std::set<char const*>
 getHandlerNames();
 
diff --git a/src/xrpld/rpc/detail/PathRequest.h b/src/xrpld/rpc/detail/PathRequest.h
index 64bc6ef181..d40d9c82d6 100644
--- a/src/xrpld/rpc/detail/PathRequest.h
+++ b/src/xrpld/rpc/detail/PathRequest.h
@@ -114,9 +114,10 @@ private:
         int const,
         std::function<bool(void)> const&);
 
-    /** Finds and sets a PathSet in the JSON argument.
-        Returns false if the source currencies are invalid.
-    */
+    /**
+     * Finds and sets a PathSet in the JSON argument.
+     * Returns false if the source currencies are invalid.
+     */
     bool
     findPaths(
         std::shared_ptr<AssetCache> const&,
diff --git a/src/xrpld/rpc/detail/PathRequestManager.cpp b/src/xrpld/rpc/detail/PathRequestManager.cpp
index 7013353cb1..4953634181 100644
--- a/src/xrpld/rpc/detail/PathRequestManager.cpp
+++ b/src/xrpld/rpc/detail/PathRequestManager.cpp
@@ -26,9 +26,10 @@
 
 namespace xrpl {
 
-/** Get the current AssetCache, updating it if necessary.
-    Get the correct ledger to use.
-*/
+/**
+ * Get the current AssetCache, updating it if necessary.
+ * Get the correct ledger to use.
+ */
 std::shared_ptr<AssetCache>
 PathRequestManager::getAssetCache(std::shared_ptr<ReadView const> const& ledger, bool authoritative)
 {
diff --git a/src/xrpld/rpc/detail/PathRequestManager.h b/src/xrpld/rpc/detail/PathRequestManager.h
index 94d126ed23..f6eb80d291 100644
--- a/src/xrpld/rpc/detail/PathRequestManager.h
+++ b/src/xrpld/rpc/detail/PathRequestManager.h
@@ -23,7 +23,9 @@ namespace xrpl {
 class PathRequestManager
 {
 public:
-    /** A collection of all PathRequest instances. */
+    /**
+     * A collection of all PathRequest instances.
+     */
     PathRequestManager(
         Application& app,
         beast::Journal journal,
@@ -34,9 +36,10 @@ public:
         full_ = collector->makeEvent("pathfind_full");
     }
 
-    /** Update all of the contained PathRequest instances.
-
-        @param ledger Ledger we are pathfinding in.
+    /**
+     * Update all of the contained PathRequest instances.
+     *
+     * @param ledger Ledger we are pathfinding in.
      */
     void
     updateAll(std::shared_ptr<ReadView const> const& ledger);
diff --git a/src/xrpld/rpc/detail/Pathfinder.h b/src/xrpld/rpc/detail/Pathfinder.h
index 5ef6c31b25..aeacd218d2 100644
--- a/src/xrpld/rpc/detail/Pathfinder.h
+++ b/src/xrpld/rpc/detail/Pathfinder.h
@@ -26,16 +26,19 @@
 
 namespace xrpl {
 
-/** Calculates payment paths.
-
-    The @ref RippleCalc determines the quality of the found paths.
-
-    @see RippleCalc
-*/
+/**
+ * Calculates payment paths.
+ *
+ * The @ref RippleCalc determines the quality of the found paths.
+ *
+ * @see RippleCalc
+ */
 class Pathfinder : public CountedObject<Pathfinder>
 {
 public:
-    /** Construct a pathfinder without an issuer.*/
+    /**
+     * Construct a pathfinder without an issuer.
+     */
     Pathfinder(
         std::shared_ptr<AssetCache> const& cache,
         AccountID const& srcAccount,
@@ -57,7 +60,9 @@ public:
     bool
     findPaths(int searchLevel, std::function<bool(void)> const& continueCallback = {});
 
-    /** Compute the rankings of the paths. */
+    /**
+     * Compute the rankings of the paths.
+     */
     void
     computePathRanks(int maxPaths, std::function<bool(void)> const& continueCallback = {});
 
@@ -189,8 +194,10 @@ private:
     PathAsset srcPathAsset_;
     std::optional<AccountID> srcIssuer_;
     STAmount srcAmount_;
-    /** The amount remaining from srcAccount_ after the default liquidity has
-        been removed. */
+    /**
+     * The amount remaining from srcAccount_ after the default liquidity has
+     * been removed.
+     */
     STAmount remainingAmount_;
     bool convertAll_;
     std::optional<uint256> domain_;
diff --git a/src/xrpld/rpc/detail/RPCHandler.cpp b/src/xrpld/rpc/detail/RPCHandler.cpp
index e839d9d78d..6f46aed62d 100644
--- a/src/xrpld/rpc/detail/RPCHandler.cpp
+++ b/src/xrpld/rpc/detail/RPCHandler.cpp
@@ -29,83 +29,82 @@ namespace xrpl::RPC {
 namespace {
 
 /**
-   This code is called from both the HTTP RPC handler and Websockets.
-
-   The form of the Json returned is somewhat different between the two services.
-
-   HTML:
-     Success:
-        {
-           "result" : {
-              "ledger" : {
-                 "accepted" : false,
-                 "transaction_hash" : "..."
-              },
-              "ledger_index" : 10300865,
-              "validated" : false,
-              "status" : "success"  # Status is inside the result.
-           }
-        }
-
-     Failure:
-        {
-           "result" : {
-              // api_version == 1
-              "error" : "noNetwork",
-              "error_code" : 17,
-              "error_message" : "Not synced to the network.",
-
-              // api_version == 2
-              "error" : "notSynced",
-              "error_code" : 18,
-              "error_message" : "Not synced to the network.",
-
-              "request" : {
-                 "command" : "ledger",
-                 "ledger_index" : 10300865
-              },
-              "status" : "error"
-           }
-        }
-
-   Websocket:
-     Success:
-        {
-           "result" : {
-              "ledger" : {
-                 "accepted" : false,
-                 "transaction_hash" : "..."
-              },
-              "ledger_index" : 10300865,
-              "validated" : false
-           }
-           "type": "response",
-           "status": "success",   # Status is OUTside the result!
-           "id": "client's ID",   # Optional
-           "warning": 3.14        # Optional
-        }
-
-     Failure:
-        {
-          // api_version == 1
-          "error" : "noNetwork",
-          "error_code" : 17,
-          "error_message" : "Not synced to the network.",
-
-          // api_version == 2
-          "error" : "notSynced",
-          "error_code" : 18,
-          "error_message" : "Not synced to the network.",
-
-          "request" : {
-             "command" : "ledger",
-             "ledger_index" : 10300865
-          },
-          "type": "response",
-          "status" : "error",
-          "id": "client's ID"   # Optional
-        }
-
+ * This code is called from both the HTTP RPC handler and Websockets.
+ *
+ * The form of the Json returned is somewhat different between the two services.
+ *
+ * HTML:
+ *   Success:
+ *      {
+ *         "result" : {
+ *            "ledger" : {
+ *               "accepted" : false,
+ *               "transaction_hash" : "..."
+ *            },
+ *            "ledger_index" : 10300865,
+ *            "validated" : false,
+ *            "status" : "success"  # Status is inside the result.
+ *         }
+ *      }
+ *
+ *   Failure:
+ *      {
+ *         "result" : {
+ *            // api_version == 1
+ *            "error" : "noNetwork",
+ *            "error_code" : 17,
+ *            "error_message" : "Not synced to the network.",
+ *
+ *            // api_version == 2
+ *            "error" : "notSynced",
+ *            "error_code" : 18,
+ *            "error_message" : "Not synced to the network.",
+ *
+ *            "request" : {
+ *               "command" : "ledger",
+ *               "ledger_index" : 10300865
+ *            },
+ *            "status" : "error"
+ *         }
+ *      }
+ *
+ * Websocket:
+ *   Success:
+ *      {
+ *         "result" : {
+ *            "ledger" : {
+ *               "accepted" : false,
+ *               "transaction_hash" : "..."
+ *            },
+ *            "ledger_index" : 10300865,
+ *            "validated" : false
+ *         }
+ *         "type": "response",
+ *         "status": "success",   # Status is OUTside the result!
+ *         "id": "client's ID",   # Optional
+ *         "warning": 3.14        # Optional
+ *      }
+ *
+ *   Failure:
+ *      {
+ *        // api_version == 1
+ *        "error" : "noNetwork",
+ *        "error_code" : 17,
+ *        "error_message" : "Not synced to the network.",
+ *
+ *        // api_version == 2
+ *        "error" : "notSynced",
+ *        "error_code" : 18,
+ *        "error_message" : "Not synced to the network.",
+ *
+ *        "request" : {
+ *           "command" : "ledger",
+ *           "ledger_index" : 10300865
+ *        },
+ *        "type": "response",
+ *        "status" : "error",
+ *        "id": "client's ID"   # Optional
+ *      }
  */
 
 ErrorCodeI
diff --git a/src/xrpld/rpc/detail/RPCHelpers.h b/src/xrpld/rpc/detail/RPCHelpers.h
index 4a4dca42e5..881b758487 100644
--- a/src/xrpld/rpc/detail/RPCHelpers.h
+++ b/src/xrpld/rpc/detail/RPCHelpers.h
@@ -162,7 +162,8 @@ keypairForSignature(
     json::Value& error,
     unsigned int apiVersion = kApiVersionIfUnspecified);
 
-/** Parse subscribe/unsubscribe parameters
+/**
+ * Parse subscribe/unsubscribe parameters
  */
 ErrorCodeI
 parseSubUnsubJson(
diff --git a/src/xrpld/rpc/detail/TransactionSign.cpp b/src/xrpld/rpc/detail/TransactionSign.cpp
index b8731a2289..e1c5180b5c 100644
--- a/src/xrpld/rpc/detail/TransactionSign.cpp
+++ b/src/xrpld/rpc/detail/TransactionSign.cpp
@@ -993,7 +993,9 @@ checkFee(
 
 //------------------------------------------------------------------------------
 
-/** Returns a json::ValueType::Object. */
+/**
+ * Returns a json::ValueType::Object.
+ */
 json::Value
 transactionSign(
     json::Value jvRequest,
@@ -1027,7 +1029,9 @@ transactionSign(
     return transactionFormatResultImpl(txn.second, apiVersion);
 }
 
-/** Returns a json::ValueType::Object. */
+/**
+ * Returns a json::ValueType::Object.
+ */
 json::Value
 transactionSubmit(
     json::Value jvRequest,
@@ -1150,7 +1154,9 @@ sortAndValidateSigners(STArray& signers, AccountID const& signingForID)
 
 }  // namespace detail
 
-/** Returns a json::ValueType::Object. */
+/**
+ * Returns a json::ValueType::Object.
+ */
 json::Value
 transactionSignFor(
     json::Value jvRequest,
@@ -1271,7 +1277,9 @@ transactionSignFor(
     return transactionFormatResultImpl(txn.second, apiVersion);
 }
 
-/** Returns a json::ValueType::Object. */
+/**
+ * Returns a json::ValueType::Object.
+ */
 json::Value
 transactionSubmitMultiSigned(
     json::Value jvRequest,
diff --git a/src/xrpld/rpc/detail/TransactionSign.h b/src/xrpld/rpc/detail/TransactionSign.h
index cb3fb176dc..dcb417dd16 100644
--- a/src/xrpld/rpc/detail/TransactionSign.h
+++ b/src/xrpld/rpc/detail/TransactionSign.h
@@ -33,33 +33,34 @@ getCurrentNetworkFee(
     int mult = Tuning::kDefaultAutoFillFeeMultiplier,
     int div = Tuning::kDefaultAutoFillFeeDivisor);
 
-/** Fill in the fee on behalf of the client.
-    This is called when the client does not explicitly specify the fee.
-    The client may also put a ceiling on the amount of the fee. This ceiling
-    is expressed as a multiplier based on the current ledger's fee schedule.
-
-    JSON fields
-
-    "Fee"   The fee paid by the transaction. Omitted when the client
-            wants the fee filled in.
-
-    "fee_mult_max"  A multiplier applied to the current ledger's transaction
-                    fee that caps the maximum fee the server should auto fill.
-                    If this optional field is not specified, then a default
-                    multiplier is used.
-    "fee_div_max"   A divider applied to the current ledger's transaction
-                    fee that caps the maximum fee the server should auto fill.
-                    If this optional field is not specified, then a default
-                    divider (1) is used. "fee_mult_max" and "fee_div_max"
-                    are both used such that the maximum fee will be
-                    `base * fee_mult_max / fee_div_max` as an integer.
-
-    @param tx       The JSON corresponding to the transaction to fill in.
-    @param ledger   A ledger for retrieving the current fee schedule.
-    @param roll     Identifies if this is called by an administrative endpoint.
-
-    @return         A JSON object containing the error results, if any
-*/
+/**
+ * Fill in the fee on behalf of the client.
+ * This is called when the client does not explicitly specify the fee.
+ * The client may also put a ceiling on the amount of the fee. This ceiling
+ * is expressed as a multiplier based on the current ledger's fee schedule.
+ *
+ * JSON fields
+ *
+ * "Fee"   The fee paid by the transaction. Omitted when the client
+ *         wants the fee filled in.
+ *
+ * "fee_mult_max"  A multiplier applied to the current ledger's transaction
+ *                 fee that caps the maximum fee the server should auto fill.
+ *                 If this optional field is not specified, then a default
+ *                 multiplier is used.
+ * "fee_div_max"   A divider applied to the current ledger's transaction
+ *                 fee that caps the maximum fee the server should auto fill.
+ *                 If this optional field is not specified, then a default
+ *                 divider (1) is used. "fee_mult_max" and "fee_div_max"
+ *                 are both used such that the maximum fee will be
+ *                 `base * fee_mult_max / fee_div_max` as an integer.
+ *
+ * @param tx       The JSON corresponding to the transaction to fill in.
+ * @param ledger   A ledger for retrieving the current fee schedule.
+ * @param roll     Identifies if this is called by an administrative endpoint.
+ *
+ * @return         A JSON object containing the error results, if any
+ */
 json::Value
 checkFee(
     json::Value& request,
@@ -89,7 +90,9 @@ getProcessTxnFn(NetworkOPs& netOPs)
     };
 }
 
-/** Returns a json::ValueType::Object. */
+/**
+ * Returns a json::ValueType::Object.
+ */
 json::Value
 transactionSign(
     json::Value params,  // Passed by value so it can be modified locally.
@@ -99,7 +102,9 @@ transactionSign(
     std::chrono::seconds validatedLedgerAge,
     Application& app);
 
-/** Returns a json::ValueType::Object. */
+/**
+ * Returns a json::ValueType::Object.
+ */
 json::Value
 transactionSubmit(
     json::Value params,  // Passed by value so it can be modified locally.
@@ -110,7 +115,9 @@ transactionSubmit(
     Application& app,
     ProcessTransactionFn const& processTransaction);
 
-/** Returns a json::ValueType::Object. */
+/**
+ * Returns a json::ValueType::Object.
+ */
 json::Value
 transactionSignFor(
     json::Value params,  // Passed by value so it can be modified locally.
@@ -120,7 +127,9 @@ transactionSignFor(
     std::chrono::seconds validatedLedgerAge,
     Application& app);
 
-/** Returns a json::ValueType::Object. */
+/**
+ * Returns a json::ValueType::Object.
+ */
 json::Value
 transactionSubmitMultiSigned(
     json::Value params,  // Passed by value so it can be modified locally.
diff --git a/src/xrpld/rpc/detail/TrustLine.h b/src/xrpld/rpc/detail/TrustLine.h
index a80d81e4ae..c3f76784ba 100644
--- a/src/xrpld/rpc/detail/TrustLine.h
+++ b/src/xrpld/rpc/detail/TrustLine.h
@@ -16,25 +16,27 @@
 
 namespace xrpl {
 
-/** Describes how an account was found in a path, and how to find the next set
-of paths. "Outgoing" is defined as the source account, or an account found via a
-trustline that has rippling enabled on the account's side.
-"Incoming" is defined as an account found via a trustline that has rippling
-disabled on the account's side. Any trust lines for an incoming account that
-have rippling disabled are unusable in paths.
-*/
+/**
+ * Describes how an account was found in a path, and how to find the next set
+ * of paths. "Outgoing" is defined as the source account, or an account found via a
+ * trustline that has rippling enabled on the account's side.
+ * "Incoming" is defined as an account found via a trustline that has rippling
+ * disabled on the account's side. Any trust lines for an incoming account that
+ * have rippling disabled are unusable in paths.
+ */
 enum class LineDirection : bool { Incoming = false, Outgoing = true };
 
-/** Wraps a trust line SLE for convenience.
-    The complication of trust lines is that there is a
-    "low" account and a "high" account. This wraps the
-    SLE and expresses its data from the perspective of
-    a chosen account on the line.
-
-    This wrapper is primarily used in the path finder and there can easily be
-    tens of millions of instances of this class. When modifying this class think
-    carefully about the memory implications.
-*/
+/**
+ * Wraps a trust line SLE for convenience.
+ * The complication of trust lines is that there is a
+ * "low" account and a "high" account. This wraps the
+ * SLE and expresses its data from the perspective of
+ * a chosen account on the line.
+ *
+ * This wrapper is primarily used in the path finder and there can easily be
+ * tens of millions of instances of this class. When modifying this class think
+ * carefully about the memory implications.
+ */
 class TrustLineBase
 {
 public:
@@ -51,7 +53,9 @@ protected:
     TrustLineBase(TrustLineBase&&) = default;
 
 public:
-    /** Returns the state map key for the ledger entry. */
+    /**
+     * Returns the state map key for the ledger entry.
+     */
     [[nodiscard]] uint256 const&
     key() const
     {
@@ -109,28 +113,36 @@ public:
         return getNoRipplePeer() ? LineDirection::Incoming : LineDirection::Outgoing;
     }
 
-    /** Have we set the freeze flag on our peer */
+    /**
+     * Have we set the freeze flag on our peer
+     */
     [[nodiscard]] bool
     getFreeze() const
     {
         return (flags_ & (viewLowest_ ? lsfLowFreeze : lsfHighFreeze)) != 0u;
     }
 
-    /** Have we set the deep freeze flag on our peer */
+    /**
+     * Have we set the deep freeze flag on our peer
+     */
     [[nodiscard]] bool
     getDeepFreeze() const
     {
         return (flags_ & (viewLowest_ ? lsfLowDeepFreeze : lsfHighDeepFreeze)) != 0u;
     }
 
-    /** Has the peer set the freeze flag on us */
+    /**
+     * Has the peer set the freeze flag on us
+     */
     [[nodiscard]] bool
     getFreezePeer() const
     {
         return (flags_ & (!viewLowest_ ? lsfLowFreeze : lsfHighFreeze)) != 0u;
     }
 
-    /** Has the peer set the deep freeze flag on us */
+    /**
+     * Has the peer set the deep freeze flag on us
+     */
     [[nodiscard]] bool
     getDeepFreezePeer() const
     {
diff --git a/src/xrpld/rpc/detail/Tuning.h b/src/xrpld/rpc/detail/Tuning.h
index 5a9d546472..b904822698 100644
--- a/src/xrpld/rpc/detail/Tuning.h
+++ b/src/xrpld/rpc/detail/Tuning.h
@@ -2,41 +2,63 @@
 
 #include <chrono>
 
-/** Tuned constants. */
+/**
+ * Tuned constants.
+ */
 /** @{ */
 namespace xrpl::RPC::Tuning {
 
-/** Represents RPC limit parameter values that have a min, default and max. */
+/**
+ * Represents RPC limit parameter values that have a min, default and max.
+ */
 struct LimitRange
 {
     unsigned int rmin, rDefault, rmax;
 };
 
-/** Limits for the account_lines command. */
+/**
+ * Limits for the account_lines command.
+ */
 static constexpr LimitRange kAccountLines = {.rmin = 10, .rDefault = 200, .rmax = 400};
 
-/** Limits for the account_channels command. */
+/**
+ * Limits for the account_channels command.
+ */
 static constexpr LimitRange kAccountChannels = {.rmin = 10, .rDefault = 200, .rmax = 400};
 
-/** Limits for the account_objects command. */
+/**
+ * Limits for the account_objects command.
+ */
 static constexpr LimitRange kAccountObjects = {.rmin = 10, .rDefault = 200, .rmax = 400};
 
-/** Limits for the account_offers command. */
+/**
+ * Limits for the account_offers command.
+ */
 static constexpr LimitRange kAccountOffers = {.rmin = 10, .rDefault = 200, .rmax = 400};
 
-/** Limits for the account_tx command. */
+/**
+ * Limits for the account_tx command.
+ */
 static constexpr LimitRange kAccountTx = {.rmin = 10, .rDefault = 200, .rmax = 400};
 
-/** Limits for the book_offers command. */
+/**
+ * Limits for the book_offers command.
+ */
 static constexpr LimitRange kBookOffers = {.rmin = 1, .rDefault = 60, .rmax = 100};
 
-/** Limits for the no_ripple_check command. */
+/**
+ * Limits for the no_ripple_check command.
+ */
 static constexpr LimitRange kNoRippleCheck = {.rmin = 10, .rDefault = 300, .rmax = 400};
 
-/** Limits for the account_nftokens command, in pages. */
+/**
+ * Limits for the account_nftokens command, in pages.
+ */
 static constexpr LimitRange kAccountNfTokens = {.rmin = 20, .rDefault = 100, .rmax = 400};
 
-/** Limits for the nft_buy_offers & nft_sell_offers commands. */
+/**
+ * Limits for the nft_buy_offers & nft_sell_offers commands.
+ */
 static constexpr LimitRange kNftOffers = {.rmin = 50, .rDefault = 250, .rmax = 500};
 
 static constexpr int kDefaultAutoFillFeeMultiplier = 10;
@@ -47,23 +69,33 @@ static constexpr int kMaxJobQueueClients = 500;
 constexpr auto kMaxValidatedLedgerAge = std::chrono::minutes{2};
 static constexpr int kMaxRequestSize = 1000000;
 
-/** Maximum number of pages in one response from a binary LedgerData request. */
+/**
+ * Maximum number of pages in one response from a binary LedgerData request.
+ */
 static constexpr int kBinaryPageLength = 2048;
 
-/** Maximum number of pages in one response from a Json LedgerData request. */
+/**
+ * Maximum number of pages in one response from a Json LedgerData request.
+ */
 static constexpr int kJsonPageLength = 256;
 
-/** Maximum number of pages in a LedgerData response. */
+/**
+ * Maximum number of pages in a LedgerData response.
+ */
 constexpr int
 pageLength(bool isBinary)
 {
     return isBinary ? kBinaryPageLength : kJsonPageLength;
 }
 
-/** Maximum number of source currencies allowed in a path find request. */
+/**
+ * Maximum number of source currencies allowed in a path find request.
+ */
 static constexpr int kMaxSrcCur = 18;
 
-/** Maximum number of auto source currencies in a path find request. */
+/**
+ * Maximum number of auto source currencies in a path find request.
+ */
 static constexpr int kMaxAutoSrcCur = 88;
 
 }  // namespace xrpl::RPC::Tuning
diff --git a/src/xrpld/rpc/handlers/account/AccountNFTs.cpp b/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
index 5ce10f6121..ea9bec0f45 100644
--- a/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountNFTs.cpp
@@ -23,16 +23,17 @@
 
 namespace xrpl {
 
-/** General RPC command that can retrieve objects in the account root.
-    {
-      account: <account>
-      ledger_hash: <string> // optional
-      ledger_index: <string | unsigned integer> // optional
-      type: <string> // optional, defaults to all account objects types
-      limit: <integer> // optional
-      marker: <opaque> // optional, resume previous query
-    }
-*/
+/**
+ * General RPC command that can retrieve objects in the account root.
+ * {
+ *   account: <account>
+ *   ledger_hash: <string> // optional
+ *   ledger_index: <string | unsigned integer> // optional
+ *   type: <string> // optional, defaults to all account objects types
+ *   limit: <integer> // optional
+ *   marker: <opaque> // optional, resume previous query
+ * }
+ */
 json::Value
 doAccountNFTs(RPC::JsonContext& context)
 {
diff --git a/src/xrpld/rpc/handlers/account/AccountObjects.cpp b/src/xrpld/rpc/handlers/account/AccountObjects.cpp
index 8967509262..4a34ff02fc 100644
--- a/src/xrpld/rpc/handlers/account/AccountObjects.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountObjects.cpp
@@ -27,16 +27,17 @@
 
 namespace xrpl {
 
-/** Gathers all objects for an account in a ledger.
-    @param ledger Ledger to search account objects.
-    @param account AccountID to find objects for.
-    @param typeFilter Gathers objects of these types. empty gathers all types.
-    @param dirIndex Begin gathering account objects from this directory.
-    @param entryIndex Begin gathering objects from this directory node.
-    @param limit Maximum number of objects to find.
-    @param sponsoredFilter If set, only return objects whose sponsored state matches the value.
-    @param jvResult A JSON result that holds the request objects.
-*/
+/**
+ * Gathers all objects for an account in a ledger.
+ * @param ledger Ledger to search account objects.
+ * @param account AccountID to find objects for.
+ * @param typeFilter Gathers objects of these types. empty gathers all types.
+ * @param dirIndex Begin gathering account objects from this directory.
+ * @param entryIndex Begin gathering objects from this directory node.
+ * @param limit Maximum number of objects to find.
+ * @param sponsoredFilter If set, only return objects whose sponsored state matches the value.
+ * @param jvResult A JSON result that holds the request objects.
+ */
 bool
 getAccountObjects(
     ReadView const& ledger,
diff --git a/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp b/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
index d2f596ed8e..632456a3fa 100644
--- a/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
+++ b/src/xrpld/rpc/handlers/orderbook/GetAggregatePrice.cpp
@@ -42,7 +42,8 @@ using namespace boost::bimaps;
 // sorted descending by lastUpdateTime, ascending by AssetPrice
 using Prices = bimap<multiset_of<std::uint32_t, std::greater<>>, multiset_of<STAmount>>;
 
-/** Calls callback "f" on the ledger-object sle and up to three previous
+/**
+ * Calls callback "f" on the ledger-object sle and up to three previous
  * metadata objects. Stops early if the callback returns true.
  */
 static void
diff --git a/src/xrpld/rpc/json_body.h b/src/xrpld/rpc/json_body.h
index 49c2b0e6e0..0f56b852f7 100644
--- a/src/xrpld/rpc/json_body.h
+++ b/src/xrpld/rpc/json_body.h
@@ -13,7 +13,9 @@
 
 namespace xrpl {
 
-/// Body that holds JSON
+/**
+ * Body that holds JSON
+ */
 struct JsonBody
 {
     explicit JsonBody() = default;

From 62634463f4adbe21d77206c75d0d7201e301e6fa Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:27:14 +0100
Subject: [PATCH 061/100] style: Add pre-commit hook to check doxygen style
 (#7794)

---
 .cspell.config.yaml                   |   1 +
 .pre-commit-config.yaml               |   5 +
 bin/pre-commit/check_doxygen_style.py | 430 ++++++++++++++++++++++++++
 3 files changed, 436 insertions(+)
 create mode 100755 bin/pre-commit/check_doxygen_style.py

diff --git a/.cspell.config.yaml b/.cspell.config.yaml
index dc24bf833b..3c5191f5e1 100644
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -302,6 +302,7 @@ words:
   - takerpays
   - ters
   - TMEndpointv2
+  - tparam
   - trixie
   - tx
   - txid
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 910bda8d4c..d3bf0209fb 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -43,6 +43,11 @@ repos:
         language: python
         entry: ./bin/pre-commit/fix_pragma_once.py
         files: \.(h|hpp)$
+      - id: check-doxygen-style
+        name: check Doxygen comment style
+        entry: ./bin/pre-commit/check_doxygen_style.py
+        language: python
+        types_or: [c++, c]
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
     rev: dd18dad857d6133e90bbe478f4f2f22ec0030269 # frozen: v22.1.5
diff --git a/bin/pre-commit/check_doxygen_style.py b/bin/pre-commit/check_doxygen_style.py
new file mode 100755
index 0000000000..fd37450113
--- /dev/null
+++ b/bin/pre-commit/check_doxygen_style.py
@@ -0,0 +1,430 @@
+#!/usr/bin/env python3
+"""
+Check C++ Doxygen comment style.
+
+Enforces the house convention for documentation comments:
+
+  * Use ``/** ... */`` blocks, not ``///``, ``//!`` or ``/*! ... */``; a plain
+    ``/* ... */`` that contains Doxygen commands is a doc comment missing its
+    second star. Trailing member-after comments use ``///<`` (not ``//!<`` or
+    ``/**< ... */`` -- the block form gets reflowed/mis-attached by
+    clang-format on packed enum values, the line form does not).
+  * ``/**`` sits alone on its line; the closing ``*/`` sits alone on its line.
+  * Every content line is prefixed with `` * `` (no bare-indented continuation).
+  * The first content line is flush (not over-indented).
+  * Doxygen commands use the ``@cmd`` form, not ``\\cmd``.
+  * Use ``@return`` / ``@throws`` rather than prose ``Returns:`` / ``Throws:``.
+  * A plain ``//`` comment carrying a block-level ``@command`` (``@param``,
+    ``@return``, ``@see``, ...) is documentation and must be a ``/** ... */``
+    block (Doxygen ignores ``//``).
+  * Use canonical command spellings: ``@return`` (not ``@returns``),
+    ``@throws`` (not ``@throw``), ``@see`` (not ``@sa``).
+  * Order block tags ``@tparam`` -> ``@param`` -> ``@return``. (Whether
+    ``@param`` order matches the signature is not checked here -- too fragile to
+    parse; Doxygen's WARN_IF_DOC_ERROR covers name mismatches.)
+  * One-liners are expanded to three lines, EXCEPT bare markers ``@{`` / ``@}``
+    / ``@cond [label]`` / ``@endcond`` / ``@file [name]`` which stay on one line.
+
+Left intentionally alone (recognized, valid Doxygen that is not this style's
+concern):
+
+  * ``///<`` trailing "member-after" comments (the house form).
+  * Divider lines made only of slashes (``//////////``).
+  * Plain ``/* ... */`` (non-Doxygen) comments.
+
+Usage:
+    check_doxygen_style.py [FILE ...]      # explicit files
+    check_doxygen_style.py                 # default: src/ and include/ trees
+
+Exit status is non-zero if any violation is found.
+"""
+
+import argparse
+import re
+import sys
+from collections.abc import Iterable, Iterator
+from dataclasses import dataclass
+from enum import Enum
+from pathlib import Path
+
+
+class Category(Enum):
+    """A kind of style violation: a printed ``label`` and its ``description``.
+
+    The description is the default message; a few categories whose wording
+    depends on the offending text (see ``Finding.detail``) override it.
+    """
+
+    def __init__(self, label: str, description: str) -> None:
+        self.label = label
+        self.description = description
+
+    BACKSLASH_COMMAND = ("backslash-command", "use the @cmd form, not \\cmd")
+    WRONG_COMMAND = ("wrong-command", "use the canonical command spelling")
+    TRIPLE_SLASH = ("triple-slash", "use a /** ... */ block instead of ///")
+    QT_MEMBER = ("qt-member", "use ///< instead of //!<")
+    QT_LINE = ("qt-line", "use a /** ... */ block instead of //!")
+    BLOCK_MEMBER = ("block-member", "use ///< instead of /**<")
+    DOC_IN_LINE_COMMENT = (
+        "doc-in-line-comment",
+        "use a /** ... */ block for documentation, not //",
+    )
+    QT_COMMENT = ("qt-comment", "use /** instead of /*!")
+    SINGLE_LINE_BLOCK = (
+        "single-line-block",
+        "expand one-line /** ... */ to a multi-line block "
+        "(markers @{ @} @cond @endcond @file may stay)",
+    )
+    TEXT_ON_OPENER = ("text-on-opener", "move text off the /** opener line")
+    BARE_CONTINUATION = ("bare-continuation", 'prefix continuation lines with " * "')
+    OVER_INDENTED = ("over-indented", "first content line is over-indented")
+    OVER_INDENTED_TAG = (
+        "over-indented-tag",
+        'Doxygen tag over-indented; use a single space after "*"',
+    )
+    COMBINED_MARKER = (
+        "combined-marker",
+        "scope marker @{ / @} should be its own single-line /** @{ */ block",
+    )
+    PROSE_LABEL = ("prose-label", "use a Doxygen tag instead of a prose label")
+    CONTENT_ON_CLOSER = ("content-on-closer", "move content off the closing */ line")
+    PLAIN_BLOCK_DOC = (
+        "plain-block-doc",
+        "documentation comment must open with /** not /*",
+    )
+    TAG_ORDER = (
+        "tag-order",
+        "block tags out of order; expected @tparam, then @param, then @return",
+    )
+
+
+@dataclass(frozen=True)
+class Finding:
+    """A single style violation at a 1-based line number.
+
+    ``detail`` overrides the category's default description when the message
+    depends on the offending text (e.g. which command was misspelled).
+    """
+
+    line: int
+    category: Category
+    detail: str | None = None
+
+    @property
+    def message(self) -> str:
+        return self.detail if self.detail is not None else self.category.description
+
+
+DEFAULT_ROOTS = ("src", "include")
+EXTS = {".h", ".hpp", ".cpp", ".ipp", ".cxx", ".cc"}
+
+# Every Doxygen command we recognize when written with a backslash (\cmd).
+_ALL_COMMANDS = (
+    "brief|param|tparam|return|returns|retval|note|warning|pre|post|see|sa|ref|"
+    "throw|throws|exception|deprecated|details|code|endcode|verbatim|endverbatim|"
+    "li|arg|c|internal|since|todo|attention|remark|remarks|ingroup|defgroup"
+)
+# Block-level tags whose over-indentation we flag inside a block body.
+_BLOCK_TAGS = (
+    "param|tparam|returns?|retval|brief|throws?|note|warning|"
+    "pre|post|see|sa|details|deprecated"
+)
+# Tags that, appearing anywhere in a comment, mark it as documentation.
+_ANY_DOC_TAGS = (
+    "param|tparam|returns?|retval|brief|throws?|note|warning|pre|post|see|sa"
+)
+# Tags that make a plain // comment a mis-styled doc comment.
+_LINE_DOC_TAGS = "brief|param|tparam|returns?|retval|throws?|note|see|pre|post"
+
+# \cmd that should be @cmd.
+RE_BACKSLASH_CMD = re.compile(r"\\(" + _ALL_COMMANDS + r")\b")
+# Bare markers that may legitimately stay on a single line.
+RE_MARKER = re.compile(r"^@(\{|\}|cond(\s.*)?|endcond|file(\s.*)?)$")
+# Prose section labels that should be Doxygen tags.
+RE_PROSE_LABEL = re.compile(r"^\*\s(Returns|Throws|Exceptions):\s*$")
+# An over-indented block tag: "*" followed by 2+ spaces then the tag.
+RE_OVERINDENTED_TAG = re.compile(r"^\*\s{2,}@(" + _BLOCK_TAGS + r")\b")
+# Any documentation tag (used to spot a doc comment hiding in a plain /* */).
+RE_ANY_DOC_TAG = re.compile(r"@(" + _ANY_DOC_TAGS + r")\b")
+# A documentation tag inside a // comment.
+RE_LINE_DOC_TAG = re.compile(r"@(" + _LINE_DOC_TAGS + r")\b")
+# Order-relevant tags, for the @tparam -> @param -> @return ordering check.
+RE_ORDER_TAG = re.compile(r"^\*\s*@(param|tparam|returns?|retval)\b")
+# First content line indented by 2+ spaces after the "*".
+RE_FIRST_OVERINDENT = re.compile(r"^\s*\*\s{2,}\S")
+# A scope marker @{ / @} sharing a comment with other text.
+RE_COMBINED_MARKER = re.compile(r"^\*\s*@[{}]\s*$")
+
+# Non-canonical command spellings -> house spelling.
+WRONG_SPELLINGS = [
+    (re.compile(r"@returns\b"), "@return"),
+    (re.compile(r"@throw\b"), "@throws"),
+    (re.compile(r"@sa\b"), "@see"),
+]
+
+# Order block tags should appear in; a body out of this order is a violation.
+EXPECTED_TAG_ORDER = ("tparam", "param", "return")
+
+
+def is_doxy_open(stripped: str) -> bool:
+    """True for a line-start Doxygen block opener we should normalize."""
+    if stripped.startswith("/*!"):  # Qt-style Doxygen
+        return not stripped.startswith("/*!<")  # member-after, leave inline
+    return (
+        stripped.startswith("/**")
+        and not stripped.startswith("/***")
+        and not stripped.startswith("/**/")
+        and not stripped.startswith("/**<")
+    )
+
+
+def _flag_commands(raw_line: str, stripped: str, index: int) -> list[Finding]:
+    """Non-terminal: flag \\cmd and misspelled @cmd on any comment-ish line."""
+    if not stripped.startswith(("*", "//", "/*")):
+        return []
+    findings: list[Finding] = []
+    backslash = RE_BACKSLASH_CMD.search(raw_line)
+    if backslash:
+        command = backslash.group(1)
+        findings.append(
+            Finding(
+                index + 1,
+                Category.BACKSLASH_COMMAND,
+                f"use @{command} instead of \\{command}",
+            )
+        )
+    for pattern, replacement in WRONG_SPELLINGS:
+        wrong = pattern.search(raw_line)
+        if wrong:
+            findings.append(
+                Finding(
+                    index + 1,
+                    Category.WRONG_COMMAND,
+                    f"use {replacement} instead of {wrong.group(0)}",
+                )
+            )
+    return findings
+
+
+def _flag_line_comment(raw_line: str, stripped: str, index: int) -> Finding | None:
+    """Return the finding for a terminal single-line comment form, else None."""
+    if stripped.startswith("///") and not stripped.startswith(("////", "///<")):
+        return Finding(index + 1, Category.TRIPLE_SLASH)
+    if "//!<" in raw_line:
+        return Finding(index + 1, Category.QT_MEMBER)
+    if stripped.startswith("//!"):
+        return Finding(index + 1, Category.QT_LINE)
+    if "/**<" in raw_line:
+        return Finding(index + 1, Category.BLOCK_MEMBER)
+    if stripped.startswith("//") and RE_LINE_DOC_TAG.search(stripped):
+        return Finding(index + 1, Category.DOC_IN_LINE_COMMENT)
+    return None
+
+
+def _flag_single_line_block(stripped: str, line_no: int, is_qt: bool) -> list[Finding]:
+    """Findings for a whole /** ... */ or /*! ... */ block on one line."""
+    inner = re.sub(r"^/\*[*!]", "", stripped)
+    inner = re.sub(r"\*/\s*$", "", inner).strip()
+    findings: list[Finding] = []
+    if is_qt:
+        findings.append(Finding(line_no, Category.QT_COMMENT))
+    if inner and not RE_MARKER.match(inner):
+        findings.append(Finding(line_no, Category.SINGLE_LINE_BLOCK))
+    return findings
+
+
+def _canonical_order_tag(body: str) -> str | None:
+    """The order-relevant tag (tparam/param/return) a body line opens with, if any."""
+    match = RE_ORDER_TAG.match(body)
+    if match is None:
+        return None
+    command = match.group(1)
+    return "return" if command in ("return", "returns", "retval") else command
+
+
+def _flag_body_line(
+    body_line: str, line_no: int, is_first_content: bool
+) -> list[Finding]:
+    """Findings for one interior line of a multi-line block."""
+    body = body_line.strip()
+    findings: list[Finding] = []
+    if body and not body.startswith("*"):
+        findings.append(Finding(line_no, Category.BARE_CONTINUATION))
+    if body.startswith("*"):
+        if is_first_content and RE_FIRST_OVERINDENT.match(body_line):
+            findings.append(Finding(line_no, Category.OVER_INDENTED))
+        if RE_OVERINDENTED_TAG.match(body):
+            findings.append(Finding(line_no, Category.OVER_INDENTED_TAG))
+        if RE_COMBINED_MARKER.match(body):
+            findings.append(Finding(line_no, Category.COMBINED_MARKER))
+        label = RE_PROSE_LABEL.match(body)
+        if label:
+            suggested_tag = "@return" if label.group(1) == "Returns" else "@throws"
+            findings.append(
+                Finding(
+                    line_no,
+                    Category.PROSE_LABEL,
+                    f'use {suggested_tag} instead of prose "{label.group(1)}:"',
+                )
+            )
+    return findings
+
+
+def _flag_closer(closer_line: str, line_no: int) -> list[Finding]:
+    """Findings for content sharing the closing */ line."""
+    before = closer_line[: closer_line.index("*/")].strip()
+    if before and before != "*":
+        return [Finding(line_no, Category.CONTENT_ON_CLOSER)]
+    return []
+
+
+def _flag_tag_order(first_tag_line: dict[str, int]) -> list[Finding]:
+    """One finding if the present block tags are not in EXPECTED_TAG_ORDER."""
+    tag_lines = [
+        first_tag_line[tag] for tag in EXPECTED_TAG_ORDER if tag in first_tag_line
+    ]
+    if tag_lines != sorted(tag_lines):
+        return [Finding(min(tag_lines), Category.TAG_ORDER)]
+    return []
+
+
+def _flag_doxy_block(lines: list[str], start: int) -> tuple[int, list[Finding]]:
+    """Handle a /** or /*! block opening at ``start``; return (next index, findings)."""
+    raw_line = lines[start]
+    stripped = raw_line.lstrip()
+    open_pos = raw_line.index("/*")
+    is_qt = stripped.startswith("/*!")
+
+    # A whole block on one line: /** ... */.
+    if "*/" in raw_line[open_pos + 2 :]:
+        return start + 1, _flag_single_line_block(stripped, start + 1, is_qt)
+
+    # Multi-line block: opener, then scan the body to the closer.
+    findings: list[Finding] = []
+    if is_qt:
+        findings.append(Finding(start + 1, Category.QT_COMMENT))
+    if raw_line[open_pos + 3 :].strip():
+        findings.append(Finding(start + 1, Category.TEXT_ON_OPENER))
+
+    line_count = len(lines)
+    cursor = start + 1
+    is_first_content = True
+    first_tag_line: dict[str, int] = {}  # canonical tag -> 1-based first line
+    while cursor < line_count and "*/" not in lines[cursor]:
+        body_line = lines[cursor]
+        body = body_line.strip()
+        findings.extend(_flag_commands(body_line, body, cursor))
+        tag = _canonical_order_tag(body)
+        if tag is not None:
+            first_tag_line.setdefault(tag, cursor + 1)
+        findings.extend(_flag_body_line(body_line, cursor + 1, is_first_content))
+        if body.startswith("*"):
+            is_first_content = False
+        cursor += 1
+
+    if cursor < line_count:
+        closer_line = lines[cursor]
+        findings.extend(_flag_commands(closer_line, closer_line.strip(), cursor))
+        findings.extend(_flag_closer(closer_line, cursor + 1))
+    findings.extend(_flag_tag_order(first_tag_line))
+
+    return cursor + 1, findings
+
+
+def _flag_plain_block(lines: list[str], start: int) -> tuple[int, list[Finding]]:
+    """Handle a line-start plain /* ... */ block; return (next index, findings).
+
+    Only flagged when it hides a documentation command (a missing second star).
+    """
+    line_count = len(lines)
+    cursor = start
+    while cursor < line_count and "*/" not in lines[cursor]:
+        cursor += 1
+    findings: list[Finding] = []
+    # The opener (start) is command-checked by check_file; check the rest here.
+    for i in range(start + 1, min(cursor + 1, line_count)):
+        findings.extend(_flag_commands(lines[i], lines[i].strip(), i))
+    block_text = "\n".join(
+        lines[start : cursor + 1] if cursor < line_count else lines[start:]
+    )
+    if RE_ANY_DOC_TAG.search(block_text):
+        findings.append(Finding(start + 1, Category.PLAIN_BLOCK_DOC))
+    next_index = cursor + 1 if cursor < line_count else line_count
+    return next_index, findings
+
+
+def check_file(path: Path) -> list[Finding]:
+    """Return all style violations found in one file."""
+    lines = path.read_text(encoding="utf-8").split("\n")
+    findings: list[Finding] = []
+    line_count = len(lines)
+    index = 0
+    in_plain_block = False  # inside a mid-line, non-Doxygen /* ... */
+    while index < line_count:
+        raw_line = lines[index]
+        stripped = raw_line.lstrip()
+
+        # Skip the interior of a plain block opened on an earlier line.
+        if in_plain_block:
+            in_plain_block = "*/" not in raw_line
+            index += 1
+            continue
+
+        findings.extend(_flag_commands(raw_line, stripped, index))
+
+        line_finding = _flag_line_comment(raw_line, stripped, index)
+        if line_finding is not None:
+            findings.append(line_finding)
+            index += 1
+        elif is_doxy_open(stripped):
+            index, block_findings = _flag_doxy_block(lines, index)
+            findings.extend(block_findings)
+        elif stripped.startswith("/*"):
+            index, block_findings = _flag_plain_block(lines, index)
+            findings.extend(block_findings)
+        else:
+            # A /* that opens mid-line without closing starts a plain block.
+            if "/*" in raw_line and not stripped.startswith("//"):
+                if "*/" not in raw_line[raw_line.index("/*") + 2 :]:
+                    in_plain_block = True
+            index += 1
+    return findings
+
+
+def iter_files(paths: Iterable[str]) -> Iterator[Path]:
+    """Yield every C++ source file among the given files and directories."""
+    for raw_path in paths:
+        path = Path(raw_path)
+        if path.is_dir():
+            for candidate in path.rglob("*"):
+                if candidate.is_file() and candidate.suffix in EXTS:
+                    yield candidate
+        elif path.suffix in EXTS:
+            yield path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Check Doxygen comment style.")
+    parser.add_argument(
+        "files", nargs="*", help="files or directories (default: src/ include/)"
+    )
+    parser.add_argument(
+        "-q", "--quiet", action="store_true", help="only print the summary count"
+    )
+    args = parser.parse_args()
+    roots = args.files or [root for root in DEFAULT_ROOTS if Path(root).is_dir()]
+
+    total = 0
+    for path in sorted(set(iter_files(roots)), key=str):
+        for finding in check_file(path):
+            total += 1
+            if not args.quiet:
+                print(
+                    f"{path}:{finding.line}: {finding.category.label}: {finding.message}"
+                )
+    print(f"\n{total} doc-style violation(s)", file=sys.stderr)
+    return 1 if total else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

From 2b4d067acebabe97d46e00dd42d6eae369fe3654 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 13 Jul 2026 15:38:33 +0100
Subject: [PATCH 062/100] test: Add tests for check doxygen style (#7795)

---
 bin/pre-commit/check_doxygen_style.py      |  38 +-
 bin/pre-commit/test_check_doxygen_style.py | 406 +++++++++++++++++++++
 2 files changed, 430 insertions(+), 14 deletions(-)
 create mode 100755 bin/pre-commit/test_check_doxygen_style.py

diff --git a/bin/pre-commit/check_doxygen_style.py b/bin/pre-commit/check_doxygen_style.py
index fd37450113..6a9af9399f 100755
--- a/bin/pre-commit/check_doxygen_style.py
+++ b/bin/pre-commit/check_doxygen_style.py
@@ -6,9 +6,9 @@ Enforces the house convention for documentation comments:
 
   * Use ``/** ... */`` blocks, not ``///``, ``//!`` or ``/*! ... */``; a plain
     ``/* ... */`` that contains Doxygen commands is a doc comment missing its
-    second star. Trailing member-after comments use ``///<`` (not ``//!<`` or
-    ``/**< ... */`` -- the block form gets reflowed/mis-attached by
-    clang-format on packed enum values, the line form does not).
+    second star. Trailing member-after comments use ``///<`` (not ``//!<``,
+    ``/*!< ... */`` or ``/**< ... */`` -- the block forms get reflowed and
+    mis-attached by clang-format on packed enum values, the line form does not).
   * ``/**`` sits alone on its line; the closing ``*/`` sits alone on its line.
   * Every content line is prefixed with `` * `` (no bare-indented continuation).
   * The first content line is flush (not over-indented).
@@ -65,6 +65,7 @@ class Category(Enum):
     QT_MEMBER = ("qt-member", "use ///< instead of //!<")
     QT_LINE = ("qt-line", "use a /** ... */ block instead of //!")
     BLOCK_MEMBER = ("block-member", "use ///< instead of /**<")
+    QT_BLOCK_MEMBER = ("qt-block-member", "use ///< instead of /*!<")
     DOC_IN_LINE_COMMENT = (
         "doc-in-line-comment",
         "use a /** ... */ block for documentation, not //",
@@ -155,11 +156,12 @@ RE_FIRST_OVERINDENT = re.compile(r"^\s*\*\s{2,}\S")
 # A scope marker @{ / @} sharing a comment with other text.
 RE_COMBINED_MARKER = re.compile(r"^\*\s*@[{}]\s*$")
 
-# Non-canonical command spellings -> house spelling.
+# Non-canonical command spellings -> the house spelling (bare command names).
+# Used both to flag a wrong @form and to suggest the right @form for a \wrong.
+CANONICAL_COMMAND = {"returns": "return", "throw": "throws", "sa": "see"}
 WRONG_SPELLINGS = [
-    (re.compile(r"@returns\b"), "@return"),
-    (re.compile(r"@throw\b"), "@throws"),
-    (re.compile(r"@sa\b"), "@see"),
+    (re.compile(rf"@{wrong}\b"), f"@{right}")
+    for wrong, right in CANONICAL_COMMAND.items()
 ]
 
 # Order block tags should appear in; a body out of this order is a violation.
@@ -179,18 +181,19 @@ def is_doxy_open(stripped: str) -> bool:
 
 
 def _flag_commands(raw_line: str, stripped: str, index: int) -> list[Finding]:
-    """Non-terminal: flag \\cmd and misspelled @cmd on any comment-ish line."""
+    """Flag \\cmd and misspelled @cmd on a comment line (opener, body, or closer)."""
     if not stripped.startswith(("*", "//", "/*")):
         return []
     findings: list[Finding] = []
     backslash = RE_BACKSLASH_CMD.search(raw_line)
     if backslash:
         command = backslash.group(1)
+        canonical = CANONICAL_COMMAND.get(command, command)
         findings.append(
             Finding(
                 index + 1,
                 Category.BACKSLASH_COMMAND,
-                f"use @{command} instead of \\{command}",
+                f"use @{canonical} instead of \\{command}",
             )
         )
     for pattern, replacement in WRONG_SPELLINGS:
@@ -207,7 +210,7 @@ def _flag_commands(raw_line: str, stripped: str, index: int) -> list[Finding]:
 
 
 def _flag_line_comment(raw_line: str, stripped: str, index: int) -> Finding | None:
-    """Return the finding for a terminal single-line comment form, else None."""
+    """Return the finding for a single-line comment form (///, //!, /**<, ...), else None."""
     if stripped.startswith("///") and not stripped.startswith(("////", "///<")):
         return Finding(index + 1, Category.TRIPLE_SLASH)
     if "//!<" in raw_line:
@@ -216,6 +219,8 @@ def _flag_line_comment(raw_line: str, stripped: str, index: int) -> Finding | No
         return Finding(index + 1, Category.QT_LINE)
     if "/**<" in raw_line:
         return Finding(index + 1, Category.BLOCK_MEMBER)
+    if "/*!<" in raw_line:
+        return Finding(index + 1, Category.QT_BLOCK_MEMBER)
     if stripped.startswith("//") and RE_LINE_DOC_TAG.search(stripped):
         return Finding(index + 1, Category.DOC_IN_LINE_COMMENT)
     return None
@@ -353,9 +358,9 @@ def _flag_plain_block(lines: list[str], start: int) -> tuple[int, list[Finding]]
     return next_index, findings
 
 
-def check_file(path: Path) -> list[Finding]:
-    """Return all style violations found in one file."""
-    lines = path.read_text(encoding="utf-8").split("\n")
+def check_source(text: str) -> list[Finding]:
+    """Return all style violations found in the given source text."""
+    lines = text.split("\n")
     findings: list[Finding] = []
     line_count = len(lines)
     index = 0
@@ -391,6 +396,11 @@ def check_file(path: Path) -> list[Finding]:
     return findings
 
 
+def check_file(path: Path) -> list[Finding]:
+    """Return all style violations found in one file."""
+    return check_source(path.read_text(encoding="utf-8"))
+
+
 def iter_files(paths: Iterable[str]) -> Iterator[Path]:
     """Yield every C++ source file among the given files and directories."""
     for raw_path in paths:
@@ -422,7 +432,7 @@ def main() -> int:
                 print(
                     f"{path}:{finding.line}: {finding.category.label}: {finding.message}"
                 )
-    print(f"\n{total} doc-style violation(s)", file=sys.stderr)
+    print(f"\n{total} doxygen-style violation(s)", file=sys.stderr)
     return 1 if total else 0
 
 
diff --git a/bin/pre-commit/test_check_doxygen_style.py b/bin/pre-commit/test_check_doxygen_style.py
new file mode 100755
index 0000000000..861414f46d
--- /dev/null
+++ b/bin/pre-commit/test_check_doxygen_style.py
@@ -0,0 +1,406 @@
+#!/usr/bin/env python3
+"""
+Tests for check_doxygen_style.py.
+
+Run directly (no test framework needed):
+    ./bin/pre-commit/test_check_doxygen_style.py
+or under pytest:
+    pytest bin/pre-commit/test_check_doxygen_style.py
+"""
+
+import sys
+import textwrap
+
+from check_doxygen_style import Finding, check_source
+
+
+def findings_for(text: str) -> list[Finding]:
+    """Return the style violations for the given source text.
+
+    The text is dedented and its leading newline stripped, so fixtures can be
+    written as indented triple-quoted here-docs while keeping honest 1-based
+    line numbers.
+    """
+    text = textwrap.dedent(text).lstrip("\n")
+    return check_source(text)
+
+
+def labels_for(text: str) -> list[str]:
+    return [f.category.label for f in findings_for(text)]
+
+
+def messages_for(text: str) -> list[str]:
+    return [f.message for f in findings_for(text)]
+
+
+# --- well-formed input produces nothing -------------------------------------
+
+
+def test_clean_block_ok() -> None:
+    code = """
+    /**
+     * Brief.
+     *
+     * @tparam T a type
+     * @param x the x
+     * @return the result
+     */
+    """
+    assert findings_for(code) == []
+
+
+def test_blank_lines_inside_block_ok() -> None:
+    code = """
+    /**
+     * a
+     *
+     * b
+     */
+    """
+    assert findings_for(code) == []
+
+
+def test_member_and_divider_allowed() -> None:
+    assert findings_for("int x;  ///< ok member\n") == []
+    assert findings_for("//////////\n") == []
+    assert findings_for("//// text\n") == []
+
+
+# --- line-comment forms ------------------------------------------------------
+
+
+def test_triple_slash() -> None:
+    code = "/// doc\n"
+    assert labels_for(code) == ["triple-slash"]
+
+
+def test_qt_line() -> None:
+    code = "//! doc\n"
+    assert labels_for(code) == ["qt-line"]
+
+
+def test_qt_member() -> None:
+    code = "int x;  //!< doc\n"
+    assert labels_for(code) == ["qt-member"]
+
+
+def test_block_member() -> None:
+    code = "int x;  /**< doc */\n"
+    assert labels_for(code) == ["block-member"]
+
+
+def test_qt_block_member() -> None:
+    code = "int x;  /*!< doc */\n"
+    assert labels_for(code) == ["qt-block-member"]
+
+
+def test_doc_in_line_comment() -> None:
+    code = "// @param x\n"
+    assert labels_for(code) == ["doc-in-line-comment"]
+
+
+# --- block forms -------------------------------------------------------------
+
+
+def test_qt_comment() -> None:
+    code = """
+    /*!
+     * brief
+     */
+    """
+    assert labels_for(code) == ["qt-comment"]
+
+
+def test_qt_comment_single_line() -> None:
+    # /*! ... */ on one line -> qt-comment (plus single-line-block)
+    code = "/*! brief */\n"
+    assert labels_for(code) == ["qt-comment", "single-line-block"]
+
+
+def test_single_line_block() -> None:
+    code = "/** brief */\n"
+    assert labels_for(code) == ["single-line-block"]
+
+
+def test_single_line_markers_allowed() -> None:
+    for marker in ("@{", "@}", "@cond LABEL", "@endcond", "@file foo.h"):
+        code = f"/** {marker} */\n"
+        assert findings_for(code) == [], marker
+
+
+def test_text_on_opener() -> None:
+    code = """
+    /** text here
+     * more
+     */
+    """
+    assert labels_for(code) == ["text-on-opener"]
+
+
+def test_bare_continuation() -> None:
+    code = """
+    /**
+     * a
+       bare line
+     */
+    """
+    assert labels_for(code) == ["bare-continuation"]
+
+
+def test_over_indented_first_line() -> None:
+    code = """
+    /**
+     *   over
+     */
+    """
+    assert labels_for(code) == ["over-indented"]
+
+
+def test_over_indented_tag() -> None:
+    # a flush first line consumes "first content", isolating the tag check
+    code = """
+    /**
+     * brief
+     *   @param x
+     */
+    """
+    assert labels_for(code) == ["over-indented-tag"]
+
+
+def test_combined_marker() -> None:
+    code = """
+    /**
+     * @{
+     */
+    """
+    assert labels_for(code) == ["combined-marker"]
+
+
+def test_prose_label() -> None:
+    for word in ("Returns", "Throws", "Exceptions"):
+        code = f"""
+        /**
+         * {word}:
+         */
+        """
+        assert labels_for(code) == ["prose-label"], word
+
+
+def test_content_on_closer() -> None:
+    code = """
+    /**
+     * a
+     * b */
+    """
+    assert labels_for(code) == ["content-on-closer"]
+
+
+def test_plain_block_doc() -> None:
+    assert labels_for("/* @param x */\n") == ["plain-block-doc"]
+    assert findings_for("/* just an ordinary note */\n") == []
+
+
+def test_tag_order() -> None:
+    out_of_order = """
+    /**
+     * @param x
+     * @tparam T
+     */
+    """
+    assert labels_for(out_of_order) == ["tag-order"]
+
+    correct = """
+    /**
+     * @tparam T
+     * @param x
+     * @return r
+     */
+    """
+    assert findings_for(correct) == []
+
+    single = """
+    /**
+     * @param x
+     */
+    """
+    assert findings_for(single) == []  # single tag: never out of order
+
+
+# --- command spelling (must work on body/closer lines, not just the opener) --
+
+
+def test_backslash_command_on_body_line() -> None:
+    code = r"""
+    /**
+     * \brief x
+     */
+    """
+    assert labels_for(code) == ["backslash-command"]
+
+
+def test_backslash_command_suggests_canonical_spelling() -> None:
+    # a backslash + non-canonical spelling is fixed in one pass, not two:
+    # \sa -> @see (not @sa), \returns -> @return (not @returns)
+    sa = r"""
+    /**
+     * \sa other
+     */
+    """
+    assert messages_for(sa) == [r"use @see instead of \sa"]
+
+    returns = r"""
+    /**
+     * \returns x
+     */
+    """
+    assert messages_for(returns) == [r"use @return instead of \returns"]
+
+
+def test_wrong_command_on_body_line() -> None:
+    code = """
+    /**
+     * @returns x
+     */
+    """
+    assert labels_for(code) == ["wrong-command"]
+
+
+def test_body_line_commands_regression() -> None:
+    # regression: these live on body lines of a multi-line block
+    code = r"""
+    /**
+     * @returns bad
+     * @throw ex
+     * @sa other
+     * \param y
+     */
+    """
+    assert labels_for(code) == [
+        "wrong-command",
+        "wrong-command",
+        "wrong-command",
+        "backslash-command",
+    ]
+
+
+def test_command_on_closer_line() -> None:
+    code = """
+    /**
+     * a
+     * @sa b */
+    """
+    assert labels_for(code) == ["wrong-command", "content-on-closer"]
+
+
+def test_no_double_count_across_opener_body_closer() -> None:
+    code = """
+    /** @returns opener
+     * @throw body
+     * @sa closer */
+    """
+    assert labels_for(code).count("wrong-command") == 3
+
+
+def test_code_with_word_allowed() -> None:
+    # @code{.cpp} is valid Doxygen and must not be flagged
+    code = """
+    /**
+     * @code{.cpp}
+     * int x;
+     * @endcode
+     */
+    """
+    assert findings_for(code) == []
+
+
+# --- rendered message text ---------------------------------------------------
+
+
+def test_message_uses_category_description() -> None:
+    # a static category renders its default description
+    code = "/// doc\n"
+    assert messages_for(code) == ["use a /** ... */ block instead of ///"]
+
+
+def test_message_detail_overrides() -> None:
+    # dynamic categories render the offending text via Finding.detail
+    backslash = r"""
+    /**
+     * \param y
+     */
+    """
+    assert messages_for(backslash) == [r"use @param instead of \param"]
+
+    wrong = """
+    /**
+     * @returns x
+     */
+    """
+    assert messages_for(wrong) == ["use @return instead of @returns"]
+
+    prose = """
+    /**
+     * Throws:
+     */
+    """
+    assert messages_for(prose) == ['use @throws instead of prose "Throws:"']
+
+
+# --- robustness --------------------------------------------------------------
+
+
+def test_empty_file_no_crash() -> None:
+    assert findings_for("") == []
+
+
+def test_mid_line_plain_block_skipped() -> None:
+    # a /* opened mid-line (after code) and spanning lines is skipped, so its
+    # comment-like contents are not analyzed
+    code = """
+    int x = 0;  /* note: @returns is not a real tag here
+     * @param also not real
+     */
+    int y = 0;
+    """
+    assert findings_for(code) == []
+
+
+def test_unclosed_block_scanned_to_eof() -> None:
+    # an unterminated /** block is still scanned to EOF (no crash, body checked)
+    code = """
+    /**
+     * @returns x
+    """
+    assert labels_for(code) == ["wrong-command"]
+
+
+def test_banner_and_empty_comment_not_flagged() -> None:
+    code = """
+    /***
+     * banner
+     ***/
+    """
+    assert findings_for(code) == []
+    assert findings_for("/**/\n") == []
+
+
+def main() -> int:
+    tests = sorted(
+        (name, fn)
+        for name, fn in globals().items()
+        if name.startswith("test_") and callable(fn)
+    )
+    failed = 0
+    for name, fn in tests:
+        try:
+            fn()
+            print(f"PASS {name}")
+        except AssertionError as exc:
+            failed += 1
+            print(f"FAIL {name}: {exc!r}")
+    print(f"\n{len(tests) - failed}/{len(tests)} passed")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

From 86583bc34e89ae9e3d07a74404b0827ccc1607c6 Mon Sep 17 00:00:00 2001
From: Mayukha Vadari <mvadari@ripple.com>
Date: Mon, 13 Jul 2026 13:44:47 -0400
Subject: [PATCH 063/100] refactor: Move `jss.h` `include` out of `Indexes.h`
 (#7799)

---
 include/xrpl/protocol/Indexes.h  | 18 ++----------------
 src/libxrpl/protocol/Indexes.cpp | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/include/xrpl/protocol/Indexes.h b/include/xrpl/protocol/Indexes.h
index 5a76119649..07493da0bd 100644
--- a/include/xrpl/protocol/Indexes.h
+++ b/include/xrpl/protocol/Indexes.h
@@ -13,7 +13,6 @@
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STXChainBridge.h>
 #include <xrpl/protocol/UintTypes.h>
-#include <xrpl/protocol/jss.h>
 
 #include <array>
 #include <cstdint>
@@ -423,21 +422,8 @@ struct KeyletDesc
     bool includeInTests{};
 };
 
-// This list should include all of the keylet functions that take a single
-// AccountID parameter.
-std::array<KeyletDesc<AccountID const&>, 6> const kDirectAccountKeylets{
-    {{.function = &keylet::account, .expectedLEName = jss::AccountRoot, .includeInTests = false},
-     {.function = &keylet::ownerDir, .expectedLEName = jss::DirectoryNode, .includeInTests = true},
-     {.function = &keylet::signerList, .expectedLEName = jss::SignerList, .includeInTests = true},
-     // It's normally impossible to create an item at nftpage_min, but
-     // test it anyway, since the invariant checks for it.
-     {.function = &keylet::nftokenPageMin,
-      .expectedLEName = jss::NFTokenPage,
-      .includeInTests = true},
-     {.function = &keylet::nftokenPageMax,
-      .expectedLEName = jss::NFTokenPage,
-      .includeInTests = true},
-     {.function = &keylet::did, .expectedLEName = jss::DID, .includeInTests = true}}};
+// This list should include all of the keylet functions that take a single AccountID parameter.
+extern std::array<KeyletDesc<AccountID const&>, 6> const kDirectAccountKeylets;
 
 MPTID
 makeMptID(std::uint32_t sequence, AccountID const& account);
diff --git a/src/libxrpl/protocol/Indexes.cpp b/src/libxrpl/protocol/Indexes.cpp
index 02a4932526..95416d0f2a 100644
--- a/src/libxrpl/protocol/Indexes.cpp
+++ b/src/libxrpl/protocol/Indexes.cpp
@@ -17,6 +17,7 @@
 #include <xrpl/protocol/SeqProxy.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/digest.h>
+#include <xrpl/protocol/jss.h>
 #include <xrpl/protocol/nftPageMask.h>
 
 #include <boost/endian/conversion.hpp>
@@ -32,6 +33,23 @@
 
 namespace xrpl {
 
+// This list should include all of the keylet functions that take a single
+// AccountID parameter. Declared in Indexes.h; defined here so the header need
+// not include jss.h.
+std::array<KeyletDesc<AccountID const&>, 6> const kDirectAccountKeylets{
+    {{.function = &keylet::account, .expectedLEName = jss::AccountRoot, .includeInTests = false},
+     {.function = &keylet::ownerDir, .expectedLEName = jss::DirectoryNode, .includeInTests = true},
+     {.function = &keylet::signerList, .expectedLEName = jss::SignerList, .includeInTests = true},
+     // It's normally impossible to create an item at nftpage_min, but
+     // test it anyway, since the invariant checks for it.
+     {.function = &keylet::nftokenPageMin,
+      .expectedLEName = jss::NFTokenPage,
+      .includeInTests = true},
+     {.function = &keylet::nftokenPageMax,
+      .expectedLEName = jss::NFTokenPage,
+      .includeInTests = true},
+     {.function = &keylet::did, .expectedLEName = jss::DID, .includeInTests = true}}};
+
 /**
  * Type-specific prefix for calculating ledger indices.
  *

From 752dab8b308d6b526eb3a6c4bf307111bc7b89a6 Mon Sep 17 00:00:00 2001
From: Peter Chen <34582813+PeterChen13579@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:44:59 -0700
Subject: [PATCH 064/100] feat: Add delegate filter param for account_tx RPC
 (#6126)

---
 API-CHANGELOG.md                              |   3 +
 include/xrpl/protocol/jss.h                   |   4 +
 include/xrpl/rdb/RelationalDatabase.h         |  19 +
 .../suppressions/sanitizer-ignorelist.txt     |   2 +-
 src/test/rpc/AccountTx_test.cpp               | 426 ++++++++++++++++++
 src/xrpld/app/misc/NetworkOPs.cpp             |   3 +-
 src/xrpld/app/rdb/backend/detail/Node.cpp     | 102 ++++-
 src/xrpld/rpc/handlers/account/AccountTx.cpp  |  91 +++-
 8 files changed, 646 insertions(+), 4 deletions(-)

diff --git a/API-CHANGELOG.md b/API-CHANGELOG.md
index 56a45c132a..a04f265328 100644
--- a/API-CHANGELOG.md
+++ b/API-CHANGELOG.md
@@ -28,6 +28,9 @@ This section contains changes targeting a future version.
 
 ### Additions
 
+- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
+  When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
+
 - `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
 
 - `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):
diff --git a/include/xrpl/protocol/jss.h b/include/xrpl/protocol/jss.h
index b20b71661a..63e877ca31 100644
--- a/include/xrpl/protocol/jss.h
+++ b/include/xrpl/protocol/jss.h
@@ -110,6 +110,7 @@ JSS(accounts);                    // in: LedgerEntry, Subscribe, handlers/Ledger
 JSS(accounts_proposed);           // in: Subscribe, Unsubscribe
 JSS(action);                      //
 JSS(active);                      // out: OverlayImpl
+JSS(actor);                       // in/out: AccountTx
 JSS(acquiring);                   // out: LedgerRequest
 JSS(address);                     // out: PeerImp
 JSS(affected);                    // out: AcceptedLedgerTx
@@ -133,6 +134,7 @@ JSS(attestation_reward_account);  //
 JSS(auction_slot);                // out: amm_info
 JSS(authorized);                  // out: AccountLines
 JSS(authorize);                   // out: delegate
+JSS(authorizer);                  // in/out: AccountTx
 JSS(authorized_credentials);      // in: ledger_entry DepositPreauth
 JSS(auth_accounts);               // out: amm_info
 JSS(auth_change);                 // out: AccountInfo
@@ -191,6 +193,7 @@ JSS(converge_time);                  // out: NetworkOPs
 JSS(converge_time_s);                // out: NetworkOPs
 JSS(cookie);                         // out: NetworkOPs
 JSS(count);                          // in: AccountTx*, ValidatorList
+JSS(counter_party);                  // in/out: AccountTx
 JSS(counters);                       // in/out: retrieve counters
 JSS(credentials);                    // in: deposit_authorized
 JSS(credential_type);                // in: LedgerEntry DepositPreauth
@@ -270,6 +273,7 @@ JSS(freeze);                         // out: AccountLines
 JSS(freeze_peer);                    // out: AccountLines
 JSS(deep_freeze);                    // out: AccountLines
 JSS(deep_freeze_peer);               // out: AccountLines
+JSS(delegate_filter);                // in/out: AccountTx
 JSS(frozen_balances);                // out: GatewayBalances
 JSS(full);                           // in: LedgerClearer, handlers/Ledger
 JSS(full_reply);                     // out: PathFind
diff --git a/include/xrpl/rdb/RelationalDatabase.h b/include/xrpl/rdb/RelationalDatabase.h
index c77c8a7ed3..e5784c7418 100644
--- a/include/xrpl/rdb/RelationalDatabase.h
+++ b/include/xrpl/rdb/RelationalDatabase.h
@@ -46,6 +46,22 @@ struct LedgerRange
     uint32_t max;
 };
 
+/**
+ * @brief Enumeration of possible delegate types that can occur during filtering in account_tx
+ */
+enum class DelegateType {
+    Actor,  ///< Another account signed and submitted transactions on behalf of this account (this
+            ///< account is the owner/delegator).
+    Authorizer  ///< This account signed and submitted transactions on behalf of another account
+                ///< (this account is the signer/delegatee).
+};
+
+struct DelegateFilter
+{
+    DelegateType type = DelegateType::Actor;
+    std::optional<AccountID> counterparty;
+};
+
 class RelationalDatabase
 {
 public:
@@ -82,6 +98,7 @@ public:
         std::optional<AccountTxMarker> marker;
         std::uint32_t limit = 0;
         bool bAdmin = false;
+        std::optional<DelegateFilter> delegate;
     };
 
     using AccountTx = std::pair<std::shared_ptr<Transaction>, std::shared_ptr<TxMeta>>;
@@ -101,6 +118,7 @@ public:
         bool forward = false;
         uint32_t limit = 0;
         std::optional<AccountTxMarker> marker;
+        std::optional<DelegateFilter> delegate;
     };
 
     struct AccountTxResult
@@ -109,6 +127,7 @@ public:
         LedgerRange ledgerRange{};
         uint32_t limit = 0;
         std::optional<AccountTxMarker> marker;
+        std::optional<DelegateFilter> delegate;
     };
 
     virtual ~RelationalDatabase() = default;
diff --git a/sanitizers/suppressions/sanitizer-ignorelist.txt b/sanitizers/suppressions/sanitizer-ignorelist.txt
index dc9a31f8e4..ffd9b4103a 100644
--- a/sanitizers/suppressions/sanitizer-ignorelist.txt
+++ b/sanitizers/suppressions/sanitizer-ignorelist.txt
@@ -29,7 +29,7 @@ src:test/beast/beast_PropertyStream_test.cpp
 src:src/test/app/Invariants_test.cpp
 
 # ASan false positive: stack-use-after-scope in ErrorCodes.h inline functions.
-# When Clang inlines the StaticString overloads (e.g. invalid_field_error(StaticString)),
+# When Clang inlines the StaticString overloads (e.g. invalidFieldError(StaticString)),
 # ASan scope-poisons the temporary std::string before the inlined callee finishes reading
 # through the const ref. This corrupts the coroutine stack and crashes the Simulate test.
 # See asan.supp comments for full explanation and planned fix.
diff --git a/src/test/rpc/AccountTx_test.cpp b/src/test/rpc/AccountTx_test.cpp
index a7f37d39b9..f1fbc2871b 100644
--- a/src/test/rpc/AccountTx_test.cpp
+++ b/src/test/rpc/AccountTx_test.cpp
@@ -5,6 +5,7 @@
 #include <test/jtx/amount.h>
 #include <test/jtx/balance.h>  // IWYU pragma: keep
 #include <test/jtx/check.h>
+#include <test/jtx/delegate.h>
 #include <test/jtx/deposit.h>
 #include <test/jtx/envconfig.h>
 #include <test/jtx/fee.h>
@@ -28,6 +29,7 @@
 #include <xrpl/beast/unit_test/suite.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/to_string.h>
+#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/ApiVersion.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/Indexes.h>
@@ -45,6 +47,7 @@
 #include <initializer_list>
 #include <iterator>
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
 
@@ -889,6 +892,426 @@ class AccountTx_test : public beast::unit_test::Suite
         checkAliceAcctTx(9, jss::Payment);
     }
 
+    void
+    testDelegation()
+    {
+        testcase("Delegation Filtering");
+
+        using namespace test::jtx;
+
+        Env env(*this);
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        Account const carol{"carol"};
+
+        env.fund(XRP(10000), alice, bob, carol);
+        env.close();
+
+        // Normal TX: Alice pays Carol (Signed by Alice's Master Key)
+        env(pay(alice, carol, XRP(10)));
+        env.close();
+
+        // Setup Delegation: Alice allows Bob to sign Payments for her
+        env(delegate::set(alice, bob, {"Payment"}));
+        env.close();
+
+        // Delegated TX: Alice pays Bob (Signed by Bob using Delegation)
+        env(pay(alice, bob, XRP(20)), delegate::As(bob));
+        env.close();
+
+        // Normal TX: Bob pays Carol (Signed by Bob for himself)
+        env(pay(bob, carol, XRP(30)));
+        env.close();
+
+        auto const countTxs = [&](AccountID const& account,
+                                  json::Value const& delegateParams,
+                                  std::optional<std::uint32_t> const limit = std::nullopt) -> int {
+            int count = 0;
+            json::Value marker;
+            bool haveMarker = false;
+            int pages = 0;
+
+            while (true)
+            {
+                json::Value params;
+                params[jss::account] = toBase58(account);
+                params[jss::ledger_index_min] = -1;
+                params[jss::ledger_index_max] = -1;
+
+                if (!delegateParams.isNull())
+                    params[jss::delegate] = delegateParams;
+                if (limit)
+                    params[jss::limit] = *limit;
+                if (haveMarker)
+                    params[jss::marker] = marker;
+
+                auto const res = env.rpc("json", "account_tx", to_string(params));
+                auto const& result = res[jss::result];
+
+                if (result.isMember(jss::transactions))
+                    count += result[jss::transactions].size();
+
+                if (!limit || !result.isMember(jss::marker))
+                    break;
+
+                marker = result[jss::marker];
+                haveMarker = true;
+                ++pages;
+                if (!BEAST_EXPECT(pages < 20))
+                    break;
+            }
+
+            return count;
+        };
+
+        auto const checkError = [&](json::Value const& delegateParams,
+                                    std::string const& errToken) {
+            json::Value params;
+            params[jss::account] = alice.human();
+            params[jss::delegate] = delegateParams;
+            auto res = env.rpc("json", "account_tx", to_string(params));
+            BEAST_EXPECT(res[jss::result][jss::error] == errToken);
+        };
+
+        // Filter: Delegatee. Expects TX #2 (Signed by Bob)
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            BEAST_EXPECT(countTxs(alice.id(), p) == 1);
+        }
+
+        // Filter: Delegatee + Counterparty Bob. Expects TX #2.
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            p[jss::counter_party] = bob.human();
+            BEAST_EXPECT(countTxs(alice.id(), p) == 1);
+        }
+
+        // Filter: Delegatee + Counterparty Carol. Expects 0.
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            p[jss::counter_party] = carol.human();
+            BEAST_EXPECT(countTxs(alice.id(), p) == 0);
+        }
+
+        // Filter: Delegator. Expects TX #2.
+        // (Bob signed it, but Alice is the owner).
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "authorizer";
+            BEAST_EXPECT(countTxs(bob.id(), p) == 1);
+        }
+
+        // Filter: Delegator + Counterparty Alice. Expects TX #2.
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "authorizer";
+            p[jss::counter_party] = alice.human();
+            BEAST_EXPECT(countTxs(bob.id(), p) == 1);
+        }
+
+        // Filter: Authorizer. Expect: None.
+        // TX #2 has sfDelegate present, but Alice is the delegator/owner, not
+        // the delegate signer
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "authorizer";
+            BEAST_EXPECT(countTxs(alice.id(), p) == 0);
+        }
+
+        // Query Bob (Signer), Filter: Delegator, Counterparty: Carol
+        // Expect: None (Alice is Owner, not Carol)
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "authorizer";
+            p[jss::counter_party] = carol.human();
+            BEAST_EXPECT(countTxs(bob.id(), p) == 0);
+        }
+
+        // Query Bob (Signer), Filter: Delegatee
+        // Expect: None. Bob did not employ a delegatee for his own TXs (TX C).
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            BEAST_EXPECT(countTxs(bob.id(), p) == 0);
+        }
+
+        // "delegate" is not an object (e.g., string)
+        {
+            json::Value const p = "not_an_object";
+            checkError(p, "invalidParams");
+        }
+
+        // Missing "delegate_filter" inside object
+        {
+            json::Value const p(json::ValueType::Object);
+            checkError(p, "invalidParams");
+        }
+
+        // "delegate_filter" is not a string (e.g., int)
+        {
+            json::Value p;
+            p[jss::delegate_filter] = 123;
+            checkError(p, "invalidParams");
+        }
+
+        // "delegate_filter" has invalid value
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "random_string";
+            checkError(p, "invalidParams");
+        }
+
+        // "counterparty" is not a string
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            p[jss::counter_party] = 123;
+            checkError(p, "invalidParams");
+        }
+
+        // "counterparty" is malformed base58
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            p[jss::counter_party] = "not_an_account";
+            checkError(p, "actMalformed");
+        }
+
+        // Multi-signed non-delegated TX: Alice pays Carol via multi-sig.
+        // sfDelegate is absent and sfSigningPubKey is empty — the filter
+        // must skip it without crashing.
+        {
+            Account const daria{"daria"};
+            Account const edward{"edward"};
+            env.fund(XRP(1000), daria, edward);
+            env.close();
+            env(signers(alice, 2, {{daria, 1}, {edward, 1}}));
+            env.close();
+            env(pay(alice, carol, XRP(1)),
+                Fee(drops(env.current()->fees().increment * 2)),
+                Msig(daria, edward));
+            env.close();
+
+            // Alice's actor filter should still see only the 1 delegated tx,
+            // not the multi-signed one.
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            BEAST_EXPECT(countTxs(alice.id(), p) == 1);
+        }
+
+        // Regular-key-signed non-delegated TX: Alice pays Bob, signed by Bob
+        // as Alice's regular key. This must not be treated as delegation.
+        {
+            env(regkey(alice, bob));
+            env.close();
+            env(pay(alice, bob, XRP(1)));
+            env.close();
+
+            json::Value actorFilter;
+            actorFilter[jss::delegate_filter] = "actor";
+            BEAST_EXPECT(countTxs(alice.id(), actorFilter) == 1);
+            // limit: 1 forces pagination past newer non-delegated rows.
+            BEAST_EXPECT(countTxs(alice.id(), actorFilter, 1) == 1);
+
+            actorFilter[jss::counter_party] = bob.human();
+            BEAST_EXPECT(countTxs(alice.id(), actorFilter) == 1);
+            BEAST_EXPECT(countTxs(alice.id(), actorFilter, 1) == 1);
+
+            json::Value authorizerFilter;
+            authorizerFilter[jss::delegate_filter] = "authorizer";
+            BEAST_EXPECT(countTxs(bob.id(), authorizerFilter) == 1);
+            BEAST_EXPECT(countTxs(bob.id(), authorizerFilter, 1) == 1);
+
+            authorizerFilter[jss::counter_party] = alice.human();
+            BEAST_EXPECT(countTxs(bob.id(), authorizerFilter) == 1);
+            BEAST_EXPECT(countTxs(bob.id(), authorizerFilter, 1) == 1);
+        }
+
+        // Pagination marker/delegate-filter consistency. A marker returned by a
+        // delegate-filtered query carries a `delegate` flag and is only valid
+        // for a follow-up request that repeats the filter; mixing the two
+        // marker conventions must be rejected with invalidParams.
+        {
+            json::Value actorFilter;
+            actorFilter[jss::delegate_filter] = "actor";
+
+            // Obtain a delegate-filtered marker (limit 1 forces pagination).
+            json::Value dp;
+            dp[jss::account] = alice.human();
+            dp[jss::ledger_index_min] = -1;
+            dp[jss::ledger_index_max] = -1;
+            dp[jss::delegate] = actorFilter;
+            dp[jss::limit] = 1;
+            auto const dRes = env.rpc("json", "account_tx", to_string(dp));
+            BEAST_EXPECT(dRes[jss::result].isMember(jss::marker));
+            json::Value const delegateMarker = dRes[jss::result][jss::marker];
+            BEAST_EXPECT(
+                delegateMarker.isMember(jss::delegate) && delegateMarker[jss::delegate].asBool());
+
+            // Reusing a delegate marker without the delegate filter is rejected.
+            {
+                json::Value p;
+                p[jss::account] = alice.human();
+                p[jss::ledger_index_min] = -1;
+                p[jss::ledger_index_max] = -1;
+                p[jss::limit] = 1;
+                p[jss::marker] = delegateMarker;
+                auto const r = env.rpc("json", "account_tx", to_string(p));
+                BEAST_EXPECT(r[jss::result][jss::error] == "invalidParams");
+            }
+
+            // Obtain a non-delegate marker; it must not carry the flag.
+            json::Value np;
+            np[jss::account] = alice.human();
+            np[jss::ledger_index_min] = -1;
+            np[jss::ledger_index_max] = -1;
+            np[jss::limit] = 1;
+            auto const nRes = env.rpc("json", "account_tx", to_string(np));
+            BEAST_EXPECT(nRes[jss::result].isMember(jss::marker));
+            json::Value const normalMarker = nRes[jss::result][jss::marker];
+            BEAST_EXPECT(!normalMarker.isMember(jss::delegate));
+
+            // Reusing a non-delegate marker with a delegate filter is rejected.
+            {
+                json::Value p;
+                p[jss::account] = alice.human();
+                p[jss::ledger_index_min] = -1;
+                p[jss::ledger_index_max] = -1;
+                p[jss::limit] = 1;
+                p[jss::delegate] = actorFilter;
+                p[jss::marker] = normalMarker;
+                auto const r = env.rpc("json", "account_tx", to_string(p));
+                BEAST_EXPECT(r[jss::result][jss::error] == "invalidParams");
+            }
+        }
+    }
+
+    void
+    testDelegationMultiSign()
+    {
+        testcase("Delegation filter with multi-signed delegatee");
+        using namespace test::jtx;
+
+        Env env(*this);
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        Account const carol{"carol"};
+        Account const daria{"daria"};
+        Account const edward{"edward"};
+
+        env.fund(XRP(10000), alice, bob, carol, daria, edward);
+        env.close();
+
+        // Bob's identity is established via multi-sig (daria + edward)
+        env(signers(bob, 2, {{daria, 1}, {edward, 1}}));
+        env.close();
+
+        env(delegate::set(alice, bob, {"Payment"}));
+        env.close();
+
+        // Delegated tx: Alice pays Carol, Bob signs via multi-sig
+        env(pay(alice, carol, XRP(10)), Fee(XRP(1)), delegate::As(bob), Msig(daria, edward));
+        env.close();
+
+        auto const countTxs = [&](AccountID const& account,
+                                  json::Value const& delegateParams) -> int {
+            json::Value params;
+            params[jss::account] = toBase58(account);
+            params[jss::ledger_index_min] = -1;
+            params[jss::ledger_index_max] = -1;
+            params[jss::delegate] = delegateParams;
+
+            auto const res = env.rpc("json", "account_tx", to_string(params));
+
+            if (res[jss::result].isMember(jss::transactions))
+                return res[jss::result][jss::transactions].size();
+            return 0;
+        };
+
+        // Alice (owner) finds the tx with actor filter
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            BEAST_EXPECT(countTxs(alice.id(), p) == 1);
+        }
+
+        // Alice (owner) + counterparty Bob finds the tx
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "actor";
+            p[jss::counter_party] = bob.human();
+            BEAST_EXPECT(countTxs(alice.id(), p) == 1);
+        }
+
+        // Bob (delegatee) finds the tx with authorizer filter
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "authorizer";
+            BEAST_EXPECT(countTxs(bob.id(), p) == 1);
+        }
+
+        // Bob (delegatee) + counterparty Alice finds the tx
+        {
+            json::Value p;
+            p[jss::delegate_filter] = "authorizer";
+            p[jss::counter_party] = alice.human();
+            BEAST_EXPECT(countTxs(bob.id(), p) == 1);
+        }
+    }
+
+    void
+    testDelegationMarkerWithinPage()
+    {
+        testcase("Delegation filter marker within a single query page");
+
+        using namespace test::jtx;
+
+        Env env(*this);
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        Account const carol{"carol"};
+
+        env.fund(XRP(10000), alice, bob, carol);
+        env.close();
+
+        env(delegate::set(alice, bob, {"Payment"}));
+        env.close();
+
+        auto const startLedger = env.closed()->header().seq + 1;
+
+        env(pay(alice, carol, XRP(1)), delegate::As(bob));
+        env.close();
+        env(pay(alice, carol, XRP(1)), delegate::As(bob));
+        env.close();
+
+        json::Value p;
+        p[jss::delegate_filter] = "actor";
+
+        json::Value params;
+        params[jss::account] = alice.human();
+        params[jss::ledger_index_min] = startLedger;
+        params[jss::ledger_index_max] = -1;
+        params[jss::delegate] = p;
+        params[jss::limit] = 1;
+
+        auto const res = env.rpc("json", "account_tx", to_string(params));
+        auto const& result = res[jss::result];
+
+        // The first page emits only the first delegated payment. (as page limit is set to 1)
+        BEAST_EXPECT(result[jss::transactions].size() == 1);
+        BEAST_EXPECT(result.isMember(jss::marker));
+
+        // Following the marker resumes right after the first payment and
+        // returns the second one.
+        json::Value page2 = params;
+        page2[jss::marker] = result[jss::marker];
+        auto const res2 = env.rpc("json", "account_tx", to_string(page2));
+        BEAST_EXPECT(res2[jss::result][jss::transactions].size() == 1);
+    }
+
     void
     testSponsorship()
     {
@@ -973,6 +1396,9 @@ public:
         testContents();
         testAccountDelete();
         testMPT();
+        testDelegation();
+        testDelegationMultiSign();
+        testDelegationMarkerWithinPage();
         testSponsorship();
     }
 };
diff --git a/src/xrpld/app/misc/NetworkOPs.cpp b/src/xrpld/app/misc/NetworkOPs.cpp
index 14d23b26d5..12d63c6210 100644
--- a/src/xrpld/app/misc/NetworkOPs.cpp
+++ b/src/xrpld/app/misc/NetworkOPs.cpp
@@ -3880,7 +3880,8 @@ NetworkOPsImp::addAccountHistoryJob(SubAccountHistoryInfoWeak subInfo)
                 .ledgerRange = {.min = minLedger, .max = maxLedger},
                 .marker = marker,
                 .limit = 0,
-                .bAdmin = true};
+                .bAdmin = true,
+                .delegate = std::nullopt};
             return db.newestAccountTxPage(options);
         };
 
diff --git a/src/xrpld/app/rdb/backend/detail/Node.cpp b/src/xrpld/app/rdb/backend/detail/Node.cpp
index f8dc4a6981..b2f14c71ea 100644
--- a/src/xrpld/app/rdb/backend/detail/Node.cpp
+++ b/src/xrpld/app/rdb/backend/detail/Node.cpp
@@ -11,6 +11,7 @@
 #include <xrpl/basics/ByteUtilities.h>
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/RangeSet.h>
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/basics/contract.h>
@@ -28,6 +29,7 @@
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/LedgerHeader.h>
 #include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/TxMeta.h>
@@ -990,6 +992,57 @@ getNewestAccountTxsB(
     return getAccountTxsB(session, app, options, true, j);
 }
 
+/**
+ * @brief Determines whether a transaction should be included in account_tx
+ *        results based on a delegation filter.
+ * @param rawData Serialized transaction blob.
+ * @param filter The delegate filter specifying the role of the queried account
+ *        (Actor or Authorizer) and an optional counterparty to match against.
+ * @param contextAccount The account passed to account_tx (the queried account).
+ * @return True if the transaction passes the filter and should be included,
+ *         false if it should be skipped.
+ */
+static bool
+passesDelegateFilter(
+    Blob const& rawData,
+    DelegateFilter const& filter,
+    AccountID const& contextAccount)
+{
+    SerialIter sit{makeSlice(rawData)};
+    STTx const tx{sit};
+
+    AccountID const txOwner = tx.getAccountID(sfAccount);
+
+    if (!tx.isFieldPresent(sfDelegate))
+        return false;
+
+    AccountID const txSigner = tx.getAccountID(sfDelegate);
+
+    switch (filter.type)
+    {
+        case DelegateType::Actor: {
+            // Keep txns where the queried account (A) is the owner but
+            // another account (C) was the delegatee that signed.
+            bool const isDelegated = (txOwner == contextAccount) && (txSigner != contextAccount);
+            if (!isDelegated)
+                return false;
+            return !filter.counterparty || (txSigner == *filter.counterparty);
+        }
+
+        case DelegateType::Authorizer: {
+            // Keep txns where the queried account (C) is the signer acting
+            // on behalf of another account (A, the delegator/owner).
+            bool const isActingAsDelegate =
+                (txSigner == contextAccount) && (txOwner != contextAccount);
+            if (!isActingAsDelegate)
+                return false;
+            return !filter.counterparty || (txOwner == *filter.counterparty);
+        }
+    }
+
+    return false;  // LCOV_EXCL_LINE
+}
+
 /**
  * @brief accountTxPage Searches for the oldest or newest transactions for the
  *        account that matches the given criteria starting from the provided
@@ -1020,6 +1073,7 @@ accountTxPage(
 {
     int total = 0;
 
+    bool const hasDelegateFilter = options.delegate.has_value();
     bool lookingForMarker = options.marker.has_value();
 
     std::uint32_t numberOfResults = 0;
@@ -1107,6 +1161,11 @@ accountTxPage(
     {
         Blob rawData;
         Blob rawMeta;
+        // Delegate filtering happens after SQL, so skipped rows need their own
+        // continuation marker accounting.
+        std::uint32_t fetchedRows = 0;
+        std::optional<RelationalDatabase::AccountTxMarker> lastEmitted;
+        std::optional<RelationalDatabase::AccountTxMarker> lastScanned;
 
         // SOCI requires boost::optional (not std::optional) as parameters.
         boost::optional<std::uint64_t> ledgerSeq;
@@ -1128,18 +1187,31 @@ accountTxPage(
 
         while (st.fetch())
         {
+            if (hasDelegateFilter)
+            {
+                ++fetchedRows;
+                lastScanned = {
+                    .ledgerSeq = rangeCheckedCast<std::uint32_t>(ledgerSeq.value_or(0)),
+                    .txnSeq = txnSeq.value_or(0)};
+            }
+
             if (lookingForMarker)
             {
                 if (findLedger == ledgerSeq.value_or(0) && findSeq == txnSeq.value_or(0))
                 {
                     lookingForMarker = false;
+                    // Delegate markers are continuation cursors for the last
+                    // scanned row, so resume after the marker row.
+                    if (hasDelegateFilter)
+                        continue;
                 }
                 else
                 {
                     continue;
                 }
             }
-            else if (numberOfResults == 0)
+
+            if (!hasDelegateFilter && numberOfResults == 0)
             {
                 newmarker = {
                     .ledgerSeq = rangeCheckedCast<std::uint32_t>(ledgerSeq.value_or(0)),
@@ -1165,6 +1237,23 @@ accountTxPage(
                 rawMeta.clear();
             }
 
+            if (hasDelegateFilter)
+            {
+                if (rawData.empty() ||
+                    !passesDelegateFilter(rawData, options.delegate.value(), options.account))
+                {
+                    rawData.clear();
+                    rawMeta.clear();
+                    continue;
+                }
+
+                if (numberOfResults == 0)
+                {
+                    newmarker = lastEmitted;
+                    break;
+                }
+            }
+
             // Work around a bug that could leave the metadata missing
             if (rawMeta.empty())
                 onUnsavedLedger(ledgerSeq.value_or(0));
@@ -1186,7 +1275,18 @@ accountTxPage(
 
             --numberOfResults;
             total++;
+            if (hasDelegateFilter)
+            {
+                lastEmitted = {
+                    .ledgerSeq = rangeCheckedCast<std::uint32_t>(ledgerSeq.value_or(0)),
+                    .txnSeq = txnSeq.value_or(0)};
+            }
         }
+
+        // If this filtered page did not fill the requested number of results,
+        // still return a marker so the caller can continue scanning later rows.
+        if (hasDelegateFilter && !newmarker && !lookingForMarker && fetchedRows == queryLimit)
+            newmarker = lastScanned;
     }
 
     return {newmarker, total};
diff --git a/src/xrpld/rpc/handlers/account/AccountTx.cpp b/src/xrpld/rpc/handlers/account/AccountTx.cpp
index 6c6d2bb6fd..c43f560861 100644
--- a/src/xrpld/rpc/handlers/account/AccountTx.cpp
+++ b/src/xrpld/rpc/handlers/account/AccountTx.cpp
@@ -30,6 +30,7 @@
 #include <xrpl/resource/Fees.h>
 
 #include <cstdint>
+#include <expected>
 #include <memory>
 #include <optional>
 #include <type_traits>
@@ -38,6 +39,48 @@
 
 namespace xrpl {
 
+static std::expected<DelegateFilter, json::Value>
+parseDelegateFilter(json::Value const& delegateNode)
+{
+    if (!delegateNode.isObject())
+        return std::unexpected(RPC::invalidFieldError(jss::delegate));
+
+    if (!delegateNode.isMember(jss::delegate_filter) ||
+        !delegateNode[jss::delegate_filter].isString())
+        return std::unexpected(RPC::invalidFieldError(jss::delegate_filter));
+
+    auto const& delegateFilterStr = delegateNode[jss::delegate_filter].asString();
+
+    auto typeResult = [&] -> std::expected<DelegateType, json::Value> {
+        if (delegateFilterStr == "actor")
+            return DelegateType::Actor;
+
+        if (delegateFilterStr == "authorizer")
+            return DelegateType::Authorizer;
+
+        return std::unexpected(RPC::invalidFieldError(jss::delegate_filter));
+    }();
+
+    if (!typeResult)
+        return std::unexpected(typeResult.error());
+
+    DelegateType const type = *typeResult;
+
+    std::optional<AccountID> counterparty;
+    if (delegateNode.isMember(jss::counter_party))
+    {
+        if (!delegateNode[jss::counter_party].isString())
+            return std::unexpected(RPC::invalidFieldError(jss::counter_party));
+
+        counterparty = parseBase58<AccountID>(delegateNode[jss::counter_party].asString());
+
+        if (!counterparty)
+            return std::unexpected(rpcError(RpcActMalformed));
+    }
+
+    return DelegateFilter{.type = type, .counterparty = counterparty};
+}
+
 using TxnsData = RelationalDatabase::AccountTxs;
 using TxnsDataBinary = RelationalDatabase::MetaTxsList;
 using TxnDataBinary = RelationalDatabase::txnMetaLedgerType;
@@ -231,7 +274,8 @@ doAccountTxHelp(RPC::Context& context, AccountTxArgs const& args)
         .ledgerRange = result.ledgerRange,
         .marker = result.marker,
         .limit = args.limit,
-        .bAdmin = isUnlimited(context.role)};
+        .bAdmin = isUnlimited(context.role),
+        .delegate = args.delegate};
 
     auto& db = context.app.getRelationalDatabase();
 
@@ -370,6 +414,9 @@ populateJsonResponse(
             response[jss::marker] = json::ValueType::Object;
             response[jss::marker][jss::ledger] = result.marker->ledgerSeq;
             response[jss::marker][jss::seq] = result.marker->txnSeq;
+
+            if (args.delegate)
+                response[jss::marker][jss::delegate] = true;
         }
     }
 
@@ -386,7 +433,17 @@ populateJsonResponse(
 //   limit: integer,                 // optional
 //   marker: object {ledger: ledger_index, seq: txn_sequence} // optional,
 //   resume previous query
+//   delegate: object {              // optional
+//     delegate_filter: string,      // required; "actor" or "authorizer"
+//     counter_party: account        // optional
+//   }
 // }
+//
+// Pagination note for delegate-filtered queries: the `delegate` object (both
+// `delegate_filter` and `counter_party`) must be supplied unchanged on every
+// paginated request until the query completes. A marker returned by a
+// delegate-filtered query is only valid for a follow-up request that repeats
+// the same `delegate` object
 json::Value
 doAccountTx(RPC::JsonContext& context)
 {
@@ -454,6 +511,38 @@ doAccountTx(RPC::JsonContext& context)
             .ledgerSeq = token[jss::ledger].asUInt(), .txnSeq = token[jss::seq].asUInt()};
     }
 
+    if (params.isMember(jss::delegate))
+    {
+        if (auto const filter = parseDelegateFilter(params[jss::delegate]); filter.has_value())
+        {
+            args.delegate = *filter;
+        }
+        else
+        {
+            return filter.error();
+        }
+    }
+
+    // A marker produced by a delegate-filtered query uses a different
+    // pagination cursor than a normal query, so it is only valid when the same
+    // `delegate` object is supplied again. Reject any mismatch so pagination
+    // cannot silently skip or duplicate results.
+    if (args.marker)
+    {
+        bool const markerFromDelegate = params[jss::marker].isMember(jss::delegate) &&
+            params[jss::marker][jss::delegate].isBool() &&
+            params[jss::marker][jss::delegate].asBool();
+        if (markerFromDelegate != args.delegate.has_value())
+        {
+            RPC::Status const status{
+                RpcInvalidParams,
+                "Do not mix delegate and non-delegate pagination markers in account_tx; "
+                "repeat the same `delegate` object when using a delegate marker."};
+            status.inject(response);
+            return response;
+        }
+    }
+
     auto res = doAccountTxHelp(context, args);
     JLOG(context.j.debug()) << __func__ << " populating response";
     return populateJsonResponse(res, args, context);

From cd06ee221d69d5afc56513fb49bc7da9316aaf61 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 13 Jul 2026 20:19:18 +0100
Subject: [PATCH 065/100] chore: Run clang_tidy_check with `pass_filenames:
 false` from pre-commit (#7800)

---
 .cspell.config.yaml                |   1 +
 .pre-commit-config.yaml            |   5 ++
 bin/pre-commit/clang_tidy_check.py | 128 +++++++++++++++++++++++------
 3 files changed, 107 insertions(+), 27 deletions(-)

diff --git a/.cspell.config.yaml b/.cspell.config.yaml
index 3c5191f5e1..19b3970865 100644
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -65,6 +65,7 @@ words:
   - Btrfs
   - Buildx
   - canonicality
+  - canonicalised
   - changespq
   - checkme
   - choco
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d3bf0209fb..8a689c0f8b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -32,6 +32,11 @@ repos:
         # as standalone translation units, so they have no compile_commands.json
         # entry to lint (verify_headers checks them transitively).
         exclude: '^include/xrpl/protocol_autogen|\.ipp$'
+        # run-clang-tidy --fix may edit headers included by files it is not run on,
+        # so pre-commit must not split the files across parallel hook invocations.
+        # The script determines the staged files itself and lets run-clang-tidy
+        # handle parallelism internally.
+        pass_filenames: false
       - id: fix-include-style
         name: fix include style
         entry: ./bin/pre-commit/fix_include_style.py
diff --git a/bin/pre-commit/clang_tidy_check.py b/bin/pre-commit/clang_tidy_check.py
index 5b5792b405..cf4808d2ea 100755
--- a/bin/pre-commit/clang_tidy_check.py
+++ b/bin/pre-commit/clang_tidy_check.py
@@ -1,27 +1,46 @@
 #!/usr/bin/env python3
-"""Pre-commit hook that runs clang-tidy on changed files using run-clang-tidy.
+"""Pre-commit hook that runs clang-tidy on staged files using run-clang-tidy.
 
-The set of files is chosen by pre-commit (see .pre-commit-config.yaml), which
-filters to C/C++ sources and excludes `.ipp` fragments. Headers are linted
-directly: the `verify_headers` build option (ON by default) compiles every
-`.h`/`.hpp` on its own, so each header is the main file of its own
-compile_commands.json entry and run-clang-tidy can analyse it just like a
-`.cpp`.
+The script determines the staged files itself (see `pass_filenames: false` in
+.pre-commit-config.yaml) so run-clang-tidy is run once and handles parallelism
+internally: pre-commit would otherwise split the files across parallel hook
+invocations that race when fixes edit a shared header.
+
+Fixes are collected with `-export-fixes` and applied by clang-apply-replacements
+in a separate step rather than with run-clang-tidy's `-fix`. The `add_module`
+build isolates each module's headers behind a per-module symlink directory
+(build/modules/<module>/...), so a header reachable from several translation
+units is referenced through different paths that all resolve to the same source
+file. clang-apply-replacements deduplicates identical replacements by their
+literal path, so those paths must be canonicalised to the real source path
+first; otherwise the same fix is applied once per path and corrupts the header.
 """
 
 from __future__ import annotations
 
 import os
+import re
 import shutil
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 
 CLANG_TIDY_VERSION = 22
 
+# Extensions run-clang-tidy can analyse: `.cpp` translation units and, thanks to
+# the `verify_headers` build option, `.h`/`.hpp` headers (each has its own
+# compile_commands.json entry). `.ipp` fragments have no entry and are skipped.
+TIDY_EXTENSIONS = {".cpp", ".h", ".hpp"}
 
-def find_run_clang_tidy() -> str | None:
-    for candidate in (f"run-clang-tidy-{CLANG_TIDY_VERSION}", "run-clang-tidy"):
+# A single-quoted `FilePath:` entry in an -export-fixes YAML file, allowing the
+# `- ` marker that precedes it inside a `Replacements:` sequence. clang-tidy
+# emits paths single-quoted and doubles any embedded quote per YAML rules.
+FILEPATH_RE = re.compile(r"^(\s*(?:-\s+)?FilePath:\s*)'((?:[^']|'')*)'\s*$")
+
+
+def find_tool(name: str) -> str | None:
+    for candidate in (f"{name}-{CLANG_TIDY_VERSION}", name):
         if path := shutil.which(candidate):
             return path
     return None
@@ -35,23 +54,43 @@ def find_build_dir(repo_root: Path) -> Path | None:
     return None
 
 
+def staged_files(repo_root: Path) -> list[Path]:
+    """Return absolute paths of staged, lint-able C/C++ files.
+
+    `--diff-filter=d` excludes deletions so we never lint a removed file.
+    """
+    output = subprocess.check_output(
+        ["git", "diff", "--staged", "--name-only", "--diff-filter=d", "--"]
+        + [f"*{ext}" for ext in TIDY_EXTENSIONS],
+        text=True,
+        cwd=repo_root,
+    )
+    return [repo_root / rel for rel in output.splitlines() if rel]
+
+
+def canonicalize_fix_paths(fixes_dir: Path) -> None:
+    """Rewrite every `FilePath` in the exported fixes to its real source path.
+
+    A header included through a module's isolation symlink is recorded under that
+    symlink's path; collapsing all paths to the same real file lets
+    clang-apply-replacements recognise the per-translation-unit duplicates and
+    apply each fix once.
+    """
+    for yaml in fixes_dir.glob("*.yaml"):
+        lines = []
+        for line in yaml.read_text().splitlines():
+            if m := FILEPATH_RE.match(line):
+                path = m.group(2).replace("''", "'")
+                real = os.path.realpath(path).replace("'", "''")
+                line = f"{m.group(1)}'{real}'"
+            lines.append(line)
+        yaml.write_text("\n".join(lines) + "\n")
+
+
 def main():
     if not os.environ.get("TIDY"):
         return 0
 
-    files = sys.argv[1:]
-    if not files:
-        return 0
-
-    run_clang_tidy = find_run_clang_tidy()
-    if not run_clang_tidy:
-        print(
-            f"clang-tidy check failed: TIDY is enabled but neither "
-            f"'run-clang-tidy-{CLANG_TIDY_VERSION}' nor 'run-clang-tidy' was found in PATH.",
-            file=sys.stderr,
-        )
-        return 1
-
     repo_root = Path(
         subprocess.check_output(
             ["git", "rev-parse", "--show-toplevel"],
@@ -59,6 +98,29 @@ def main():
             text=True,
         ).strip()
     )
+
+    files = staged_files(repo_root)
+    if not files:
+        return 0
+
+    run_clang_tidy = find_tool("run-clang-tidy")
+    clang_apply_replacements = find_tool("clang-apply-replacements")
+    missing = [
+        name
+        for name, path in (
+            ("run-clang-tidy", run_clang_tidy),
+            ("clang-apply-replacements", clang_apply_replacements),
+        )
+        if not path
+    ]
+    if missing:
+        print(
+            f"clang-tidy check failed: TIDY is enabled but {' and '.join(missing)} "
+            f"was not found in PATH (tried the '-{CLANG_TIDY_VERSION}' suffix too).",
+            file=sys.stderr,
+        )
+        return 1
+
     build_dir = find_build_dir(repo_root)
     if not build_dir:
         print(
@@ -68,11 +130,23 @@ def main():
         )
         return 1
 
-    result = subprocess.run(
-        [run_clang_tidy, "-quiet", "-p", str(build_dir), "-fix", "-allow-no-checks"]
-        + files
-    )
-    return result.returncode
+    with tempfile.TemporaryDirectory() as fixes_dir:
+        result = subprocess.run(
+            [
+                run_clang_tidy,
+                "-quiet",
+                "-p",
+                build_dir,
+                "-export-fixes",
+                fixes_dir,
+                "-allow-no-checks",
+            ]
+            + files
+        )
+        canonicalize_fix_paths(Path(fixes_dir))
+        applied = subprocess.run([clang_apply_replacements, fixes_dir])
+
+    return result.returncode or applied.returncode
 
 
 if __name__ == "__main__":

From acd54fd6275fdf04dd024900dde6693accd1d955 Mon Sep 17 00:00:00 2001
From: Bart <bthomee@users.noreply.github.com>
Date: Tue, 14 Jul 2026 06:22:49 -0400
Subject: [PATCH 066/100] ci: Do not run conflict checker when label is applied
 (#7774)

Co-authored-by: Bart <11445373+bthomee@users.noreply.github.com>
---
 .github/workflows/conflicting-pr.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/conflicting-pr.yml b/.github/workflows/conflicting-pr.yml
index 772d46fd7d..cf65640954 100644
--- a/.github/workflows/conflicting-pr.yml
+++ b/.github/workflows/conflicting-pr.yml
@@ -14,6 +14,7 @@ permissions:
 
 jobs:
   main:
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'IgnoreConflicts') }}
     runs-on: ubuntu-latest
     steps:
       - name: Check if PRs are dirty

From e1d4f357dc58641e2f4c1d41b286bbb9e2f38552 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:21:40 +0100
Subject: [PATCH 067/100] chore: Enable most readability checks (#7772)

---
 .clang-tidy                                   |  17 +-
 include/xrpl/beast/rfc2616.h                  |  13 +-
 include/xrpl/rdb/SociDB.h                     |   4 +-
 src/libxrpl/core/detail/Workers.cpp           |  12 +-
 src/libxrpl/json/json_value.cpp               |   3 +-
 src/libxrpl/ledger/helpers/MPTokenHelpers.cpp |  11 +-
 src/libxrpl/ledger/helpers/TokenHelpers.cpp   |  10 +-
 src/libxrpl/protocol/STObject.cpp             |   2 +-
 src/libxrpl/protocol/STPathSet.cpp            |  12 +-
 src/libxrpl/protocol/UintTypes.cpp            |   2 +-
 src/libxrpl/rdb/SociDB.cpp                    |   4 +-
 .../tx/invariants/DirectoryInvariant.cpp      |  10 +-
 src/libxrpl/tx/invariants/FreezeInvariant.cpp |  20 +-
 .../tx/invariants/LoanBrokerInvariant.cpp     |  10 +-
 src/test/app/CheckMPT_test.cpp                |  24 -
 src/test/app/Invariants_test.cpp              |   2 +-
 src/test/app/MPToken_test.cpp                 |   2 +-
 src/test/app/NFTokenDir_test.cpp              | 505 ------------------
 src/test/app/PayStrand_test.cpp               |   8 +-
 src/test/app/PermissionedDEX_test.cpp         |  11 +-
 src/test/app/ReducedOffer_test.cpp            |  49 --
 src/test/app/ValidatorList_test.cpp           |   2 +-
 src/test/app/XChain_test.cpp                  |  10 +-
 src/test/consensus/Consensus_test.cpp         |  10 -
 src/test/core/SociDB_test.cpp                 |  58 +-
 src/test/csf/Peer.h                           |   8 +-
 src/test/jtx/TestHelpers.h                    |   8 +-
 src/test/jtx/impl/AMM.cpp                     |  11 +-
 src/test/nodestore/Timing_test.cpp            |   3 -
 src/test/overlay/cluster_test.cpp             |   7 +-
 src/test/overlay/reduce_relay_test.cpp        |   8 +-
 src/test/protocol/STAmount_test.cpp           |  45 --
 src/test/rpc/ServerDefinitions_test.cpp       |  15 +-
 src/test/server/ServerStatus_test.cpp         |   4 -
 src/tests/libxrpl/basics/Buffer.cpp           |   4 +-
 src/tests/libxrpl/basics/base_uint_test.cpp   |  19 -
 src/xrpld/app/misc/NetworkOPs.cpp             |  10 +-
 src/xrpld/app/misc/SHAMapStoreImp.cpp         |   6 +-
 src/xrpld/app/misc/detail/ValidatorSite.cpp   |   2 +-
 src/xrpld/peerfinder/detail/Logic.h           |  16 +-
 src/xrpld/rpc/detail/RPCCall.cpp              |  10 +-
 .../server_info/ServerDefinitions.cpp         |   2 +-
 42 files changed, 102 insertions(+), 887 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index 88dd6f4e57..68fc9e75fc 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -56,32 +56,17 @@ Checks: "-*,
 
   readability-*,
   -readability-avoid-const-params-in-decls,
-  -readability-avoid-unconditional-preprocessor-if,
   -readability-container-data-pointer,
-  -readability-delete-null-pointer,
   -readability-function-cognitive-complexity,
-  -readability-function-size,
   -readability-identifier-length,
   -readability-inconsistent-declaration-parameter-name,
   -readability-isolate-declaration,
   -readability-magic-numbers,
-  -readability-misplaced-array-index,
   -readability-named-parameter,
-  -readability-operators-representation,
   -readability-qualified-auto,
   -readability-redundant-access-specifiers,
-  -readability-redundant-control-flow,
-  -readability-redundant-function-ptr-dereference,
-  -readability-redundant-preprocessor,
-  -readability-redundant-smartptr-get,
-  -readability-redundant-string-cstr,
-  -readability-simplify-subscript-expr,
   -readability-static-accessed-through-instance,
-  -readability-string-compare,
-  -readability-uniqueptr-delete-release,
-  -readability-uppercase-literal-suffix,
-  -readability-use-anyofallof,
-  -readability-use-concise-preprocessor-directives
+  -readability-uppercase-literal-suffix
   "
 # ---
 # bugprone-narrowing-conversions,                      # This will break a lot of code but we should enable it in the future because it can eliminate a lot of bugs
diff --git a/include/xrpl/beast/rfc2616.h b/include/xrpl/beast/rfc2616.h
index bd9a78fddb..1986568553 100644
--- a/include/xrpl/beast/rfc2616.h
+++ b/include/xrpl/beast/rfc2616.h
@@ -358,12 +358,13 @@ template <class = void>
 bool
 tokenInList(boost::string_ref const& value, boost::string_ref const& token)
 {
-    for (auto const& item : makeList(value))
-    {
-        if (ciEqual(item, token))
-            return true;
-    }
-    return false;
+    auto const list = makeList(value);
+    // ListIterator is not default-constructible, so it does not model a std::ranges
+    // sentinel/range; the classic std::any_of (which only needs an input iterator)
+    // is used instead.
+    // NOLINTNEXTLINE(modernize-use-ranges)
+    return std::any_of(
+        list.begin(), list.end(), [&token](auto const& item) { return ciEqual(item, token); });
 }
 
 template <bool IsRequest, class Body, class Fields>
diff --git a/include/xrpl/rdb/SociDB.h b/include/xrpl/rdb/SociDB.h
index 61edcf2263..80d83f0f75 100644
--- a/include/xrpl/rdb/SociDB.h
+++ b/include/xrpl/rdb/SociDB.h
@@ -13,7 +13,7 @@
 #include <soci/session.h>
 
 #include <memory>
-#if defined(__clang__)
+#ifdef __clang__
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated"
 #endif
@@ -120,6 +120,6 @@ makeCheckpointer(std::uintptr_t id, std::weak_ptr<soci::session>, JobQueue&, Ser
 
 }  // namespace xrpl
 
-#if defined(__clang__)
+#ifdef __clang__
 #pragma clang diagnostic pop
 #endif
diff --git a/src/libxrpl/core/detail/Workers.cpp b/src/libxrpl/core/detail/Workers.cpp
index 0d9c1afd26..abbbb2f25c 100644
--- a/src/libxrpl/core/detail/Workers.cpp
+++ b/src/libxrpl/core/detail/Workers.cpp
@@ -127,15 +127,11 @@ Workers::deleteWorkers(beast::LockFreeStack<Worker>& stack)
     {
         Worker const* const worker = stack.popFront();
 
-        if (worker != nullptr)
-        {
-            // This call blocks until the thread orderly exits
-            delete worker;
-        }
-        else
-        {
+        if (worker == nullptr)
             break;
-        }
+
+        // This call blocks until the thread orderly exits
+        delete worker;
     }
 }
 
diff --git a/src/libxrpl/json/json_value.cpp b/src/libxrpl/json/json_value.cpp
index cf95d873fb..e7ebb04495 100644
--- a/src/libxrpl/json/json_value.cpp
+++ b/src/libxrpl/json/json_value.cpp
@@ -314,8 +314,7 @@ Value::~Value()
 
         case ValueType::Array:
         case ValueType::Object:
-            if (value_.mapVal != nullptr)
-                delete value_.mapVal;
+            delete value_.mapVal;
             break;
 
         // LCOV_EXCL_START
diff --git a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
index ac14c3b66d..6fe7328fa7 100644
--- a/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
@@ -28,6 +28,7 @@
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <algorithm>
 #include <cstdint>
 #include <initializer_list>
 #include <limits>
@@ -80,13 +81,9 @@ isAnyFrozen(
             return true;
     }
 
-    for (auto const& account : accounts)
-    {
-        if (isVaultPseudoAccountFrozen(view, account, mptIssue, depth))
-            return true;
-    }
-
-    return false;
+    return std::ranges::any_of(accounts, [&](auto const& account) {
+        return isVaultPseudoAccountFrozen(view, account, mptIssue, depth);
+    });
 }
 
 Rate
diff --git a/src/libxrpl/ledger/helpers/TokenHelpers.cpp b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
index 06e366847d..79e10cdf79 100644
--- a/src/libxrpl/ledger/helpers/TokenHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/TokenHelpers.cpp
@@ -28,6 +28,7 @@
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <algorithm>
 #include <cstdint>
 #include <initializer_list>
 #include <limits>
@@ -105,12 +106,9 @@ isAnyFrozen(
     std::initializer_list<AccountID> const& accounts,
     Issue const& issue)
 {
-    for (auto const& account : accounts)
-    {
-        if (isFrozen(view, account, issue.currency, issue.account))
-            return true;
-    }
-    return false;
+    return std::ranges::any_of(accounts, [&](auto const& account) {
+        return isFrozen(view, account, issue.currency, issue.account);
+    });
 }
 
 bool
diff --git a/src/libxrpl/protocol/STObject.cpp b/src/libxrpl/protocol/STObject.cpp
index e86b3fb6e6..ab9ae7d4d7 100644
--- a/src/libxrpl/protocol/STObject.cpp
+++ b/src/libxrpl/protocol/STObject.cpp
@@ -710,7 +710,7 @@ STObject::getFieldNumber(SField const& field) const
 void
 STObject::set(std::unique_ptr<STBase> v)
 {
-    set(std::move(*v.get()));
+    set(std::move(*v));
 }
 
 void
diff --git a/src/libxrpl/protocol/STPathSet.cpp b/src/libxrpl/protocol/STPathSet.cpp
index d61f17ecc6..8987d05f1e 100644
--- a/src/libxrpl/protocol/STPathSet.cpp
+++ b/src/libxrpl/protocol/STPathSet.cpp
@@ -13,6 +13,7 @@
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/jss.h>
 
+#include <algorithm>
 #include <cstddef>
 #include <stdexcept>
 #include <utility>
@@ -159,13 +160,10 @@ STPathSet::isDefault() const
 bool
 STPath::hasSeen(AccountID const& account, PathAsset const& asset, AccountID const& issuer) const
 {
-    for (auto& p : path_)
-    {
-        if (p.getAccountID() == account && p.getPathAsset() == asset && p.getIssuerID() == issuer)
-            return true;
-    }
-
-    return false;
+    return std::ranges::any_of(path_, [&](auto& p) {
+        return p.getAccountID() == account && p.getPathAsset() == asset &&
+            p.getIssuerID() == issuer;
+    });
 }
 
 json::Value
diff --git a/src/libxrpl/protocol/UintTypes.cpp b/src/libxrpl/protocol/UintTypes.cpp
index 486c11ba45..e1b8895f44 100644
--- a/src/libxrpl/protocol/UintTypes.cpp
+++ b/src/libxrpl/protocol/UintTypes.cpp
@@ -64,7 +64,7 @@ to_string(Currency const& currency)
 bool
 toCurrency(Currency& currency, std::string const& code)
 {
-    if (code.empty() || (code.compare(systemCurrencyCode()) == 0))
+    if (code.empty() || code == systemCurrencyCode())
     {
         currency = beast::kZero;
         return true;
diff --git a/src/libxrpl/rdb/SociDB.cpp b/src/libxrpl/rdb/SociDB.cpp
index 7354ef9b23..2c3fb1bde1 100644
--- a/src/libxrpl/rdb/SociDB.cpp
+++ b/src/libxrpl/rdb/SociDB.cpp
@@ -17,7 +17,7 @@
 #include <string>
 #include <utility>
 #include <vector>
-#if defined(__clang__)
+#ifdef __clang__
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated"
 #endif
@@ -342,6 +342,6 @@ makeCheckpointer(
 
 }  // namespace xrpl
 
-#if defined(__clang__)
+#ifdef __clang__
 #pragma clang diagnostic pop
 #endif
diff --git a/src/libxrpl/tx/invariants/DirectoryInvariant.cpp b/src/libxrpl/tx/invariants/DirectoryInvariant.cpp
index 1624a19830..b850f02ab5 100644
--- a/src/libxrpl/tx/invariants/DirectoryInvariant.cpp
+++ b/src/libxrpl/tx/invariants/DirectoryInvariant.cpp
@@ -5,6 +5,7 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STLedgerEntry.h>
@@ -12,6 +13,7 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <algorithm>
 #include <memory>
 
 namespace xrpl {
@@ -88,17 +90,15 @@ ValidBookDirectory::finalize(
         return false;
     }
 
-    for (auto const& rootIndex : rootIndexes_)
-    {
+    return std::ranges::all_of(rootIndexes_, [&](auto const& rootIndex) {
         auto const root = view.read(Keylet(ltDIR_NODE, rootIndex));
         if (!root)
         {
             JLOG(j.fatal()) << "Invariant failed: book directory root missing";
             return false;
         }
-    }
-
-    return true;
+        return true;
+    });
 }
 
 }  // namespace xrpl
diff --git a/src/libxrpl/tx/invariants/FreezeInvariant.cpp b/src/libxrpl/tx/invariants/FreezeInvariant.cpp
index 0293d42e97..0a604d4c39 100644
--- a/src/libxrpl/tx/invariants/FreezeInvariant.cpp
+++ b/src/libxrpl/tx/invariants/FreezeInvariant.cpp
@@ -16,6 +16,7 @@
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/invariants/InvariantCheckPrivilege.h>
 
+#include <algorithm>
 #include <utility>
 
 namespace xrpl {
@@ -73,8 +74,8 @@ TransfersNotFrozen::finalize(
      */
     [[maybe_unused]] bool const enforce = view.rules().enabled(featureDeepFreeze);
 
-    for (auto const& [issue, changes] : balanceChanges_)
-    {
+    return std::ranges::all_of(balanceChanges_, [&](auto const& entry) {
+        auto const& [issue, changes] = entry;
         auto const issuerSle = findIssuer(issue.account, view);
         // It should be impossible for the issuer to not be found, but check
         // just in case so xrpld doesn't crash in release.
@@ -86,20 +87,11 @@ TransfersNotFrozen::finalize(
                 enforce,
                 "xrpl::TransfersNotFrozen::finalize : enforce "
                 "invariant.");
-            if (enforce)
-            {
-                return false;
-            }
-            continue;
+            return !enforce;
         }
 
-        if (!validateIssuerChanges(issuerSle, changes, tx, j, enforce))
-        {
-            return false;
-        }
-    }
-
-    return true;
+        return validateIssuerChanges(issuerSle, changes, tx, j, enforce);
+    });
 }
 
 bool
diff --git a/src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp b/src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp
index d239acd417..b70c02947f 100644
--- a/src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp
+++ b/src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp
@@ -15,6 +15,8 @@
 #include <xrpl/protocol/TxFormats.h>
 #include <xrpl/protocol/XRPAmount.h>
 
+#include <algorithm>
+
 namespace xrpl {
 
 void
@@ -127,8 +129,8 @@ ValidLoanBroker::finalize(
         }
     }
 
-    for (auto const& [brokerID, broker] : brokers_)
-    {
+    return std::ranges::all_of(brokers_, [&](auto const& entry) {
+        auto const& [brokerID, broker] = entry;
         auto const& after =
             broker.brokerAfter ? broker.brokerAfter : view.read(keylet::loanBroker(brokerID));
 
@@ -204,8 +206,8 @@ ValidLoanBroker::finalize(
                 return false;
             }
         }
-    }
-    return true;
+        return true;
+    });
 }
 
 }  // namespace xrpl
diff --git a/src/test/app/CheckMPT_test.cpp b/src/test/app/CheckMPT_test.cpp
index 6370be7b6f..66cc582201 100644
--- a/src/test/app/CheckMPT_test.cpp
+++ b/src/test/app/CheckMPT_test.cpp
@@ -793,15 +793,6 @@ class CheckMPT_test : public beast::unit_test::Suite
         env(check::create(alice, bob, usd(125)));
         env.close();
 
-        // alice writes another check that won't get cashed until the transfer
-        // rate changes so we can see the rate applies when the check is
-        // cashed, not when it is created.
-#if 0
-        uint256 const chkId120{getCheckIndex(alice, env.Seq(alice))};
-        env(check::create(alice, bob, USD(120)));
-        env.close();
-#endif
-
         // bob attempts to cash the check for face value.  Should fail.
         env(check::cash(bob, chkId125, usd(125)), Ter(tecPATH_PARTIAL));
         env.close();
@@ -816,21 +807,6 @@ class CheckMPT_test : public beast::unit_test::Suite
         env.require(Balance(bob, usd(0 + 100)));
         BEAST_EXPECT(checksOnAccount(env, alice).empty());
         BEAST_EXPECT(checksOnAccount(env, bob).empty());
-
-#if 0
-        // Adjust gw's rate...
-        env(rate(gw, 1.2));
-        env.close();
-
-        // bob cashes the second check for less than the face value.  The new
-        // rate applies to the actual value transferred.
-        env(check::cash(bob, chkId120, USD(50)));
-        env.close();
-        env.Require(Balance(alice, USD(1000 - 125 - 60)));
-        env.Require(Balance(bob, USD(0 + 100 + 50)));
-        BEAST_EXPECT(checksOnAccount(env, alice).size() == 0);
-        BEAST_EXPECT(checksOnAccount(env, bob).size() == 0);
-#endif
     }
 
     void
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 461a151d8e..569eecb27b 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -2741,7 +2741,7 @@ class Invariants_test : public beast::unit_test::Suite
     }
 
     void
-    testVault()
+    testVault()  // NOLINT(readability-function-size)
     {
         using namespace test::jtx;
 
diff --git a/src/test/app/MPToken_test.cpp b/src/test/app/MPToken_test.cpp
index 7543db7364..befc46e2ae 100644
--- a/src/test/app/MPToken_test.cpp
+++ b/src/test/app/MPToken_test.cpp
@@ -2115,7 +2115,7 @@ class MPToken_test : public beast::unit_test::Suite
                 jv[jss::Account] = alice.human();
                 jv[sfSponsee.fieldName] = carol.human();
                 jv[sfFeeAmount.fieldName] = mpt.getJson(JsonOptions::Values::None);
-                test(jv, sfFeeAmount.fieldName.c_str());
+                test(jv, sfFeeAmount.fieldName);
             }
         }
         BEAST_EXPECT(txWithAmounts.empty());
diff --git a/src/test/app/NFTokenDir_test.cpp b/src/test/app/NFTokenDir_test.cpp
index 19bf58f247..7dd0b14fe5 100644
--- a/src/test/app/NFTokenDir_test.cpp
+++ b/src/test/app/NFTokenDir_test.cpp
@@ -1052,508 +1052,3 @@ BEAST_DEFINE_TESTSUITE_PRIO(NFTokenDir, app, xrpl, 1);
 //
 //   sp6JS7f14BuwFY8MwFe95Vpi9Znjs
 //
-
-// Sets of related accounts.
-//
-// Identifying the seeds of accounts that generate account IDs with the
-// same low 32 bits takes a while.  However several sets of accounts with
-// that relationship have been located.  In case these sets of accounts are
-// needed for future testing scenarios they are recorded below.
-#if 0
-34 account seeds that produce account IDs with low 32-bits 0x399187e9:
-  sp6JS7f14BuwFY8Mw5EYu5z86hKDL
-  sp6JS7f14BuwFY8Mw5PUAMwc5ygd7
-  sp6JS7f14BuwFY8Mw5R3xUBcLSeTs
-  sp6JS7f14BuwFY8Mw5W6oS5sdC3oF
-  sp6JS7f14BuwFY8Mw5pYc3D9iuLcw
-  sp6JS7f14BuwFY8Mw5pfGVnhcdp3b
-  sp6JS7f14BuwFY8Mw6jS6RdEqXqrN
-  sp6JS7f14BuwFY8Mw6krt6AKbvRXW
-  sp6JS7f14BuwFY8Mw6mnVBQq7cAN2
-  sp6JS7f14BuwFY8Mw8ECJxPjmkufQ
-  sp6JS7f14BuwFY8Mw8asgzcceGWYm
-  sp6JS7f14BuwFY8MwF6J3FXnPCgL8
-  sp6JS7f14BuwFY8MwFEud2w5czv5q
-  sp6JS7f14BuwFY8MwFNxKVqJnx8P5
-  sp6JS7f14BuwFY8MwFnTCXg3eRidL
-  sp6JS7f14BuwFY8Mwj47hv1vrDge6
-  sp6JS7f14BuwFY8Mwj6TYekeeyukh
-  sp6JS7f14BuwFY8MwjFjsRDerz7jb
-  sp6JS7f14BuwFY8Mwjrj9mHTLBrcX
-  sp6JS7f14BuwFY8MwkKcJi3zMzAea
-  sp6JS7f14BuwFY8MwkYTDdnYRm9z4
-  sp6JS7f14BuwFY8Mwkq8ei4D8uPNd
-  sp6JS7f14BuwFY8Mwm2pFruxbnJRd
-  sp6JS7f14BuwFY8MwmJV2ZnAjpC2g
-  sp6JS7f14BuwFY8MwmTFMPHQHfVYF
-  sp6JS7f14BuwFY8MwmkG2jXEgqiud
-  sp6JS7f14BuwFY8Mwms3xEh5tMDTw
-  sp6JS7f14BuwFY8MwmtipW4D8giZ9
-  sp6JS7f14BuwFY8MwoRQBZm4KUUeE
-  sp6JS7f14BuwFY8MwoVey94QpXcrc
-  sp6JS7f14BuwFY8MwoZiuUoUTo3VG
-  sp6JS7f14BuwFY8MwonFFDLT4bHAZ
-  sp6JS7f14BuwFY8MwooGphD4hefBQ
-  sp6JS7f14BuwFY8MwoxDp3dmX6q5N
-
-34 account seeds that produce account IDs with low 32-bits 0x473f2c9a:
-  sp6JS7f14BuwFY8Mw53ktgqmv5Bmz
-  sp6JS7f14BuwFY8Mw5KPb2Kz7APFX
-  sp6JS7f14BuwFY8Mw5Xx4A6HRTPEE
-  sp6JS7f14BuwFY8Mw5y6qZFNAo358
-  sp6JS7f14BuwFY8Mw6kdaBg1QrZfn
-  sp6JS7f14BuwFY8Mw8QmTfLMAZ5K1
-  sp6JS7f14BuwFY8Mw8cbRRVcCEELr
-  sp6JS7f14BuwFY8Mw8gQvJebmxvDG
-  sp6JS7f14BuwFY8Mw8qPQurwu3P7Y
-  sp6JS7f14BuwFY8MwFS4PEVKmuPy5
-  sp6JS7f14BuwFY8MwFUQM1rAsQ8tS
-  sp6JS7f14BuwFY8MwjJBZCkuwsRnM
-  sp6JS7f14BuwFY8MwjTdS8vZhX5E9
-  sp6JS7f14BuwFY8MwjhSmWCbNhd25
-  sp6JS7f14BuwFY8MwjwkpqwZsDBw9
-  sp6JS7f14BuwFY8MwjyET4p6eqd5J
-  sp6JS7f14BuwFY8MwkMNAe4JhnG7E
-  sp6JS7f14BuwFY8MwkRRpnT93UWWS
-  sp6JS7f14BuwFY8MwkY9CvB22RvUe
-  sp6JS7f14BuwFY8Mwkhw9VxXqmTr7
-  sp6JS7f14BuwFY8MwkmgaTat7eFa7
-  sp6JS7f14BuwFY8Mwkq5SxGGv1oLH
-  sp6JS7f14BuwFY8MwmCBM5p5bTg6y
-  sp6JS7f14BuwFY8MwmmmXaVah64dB
-  sp6JS7f14BuwFY8Mwo7R7Cn614v9V
-  sp6JS7f14BuwFY8MwoCAG1na7GR2M
-  sp6JS7f14BuwFY8MwoDuPvJS4gG7C
-  sp6JS7f14BuwFY8MwoMMowSyPQLfy
-  sp6JS7f14BuwFY8MwoRqDiwTNsTBm
-  sp6JS7f14BuwFY8MwoWbBWtjpB7pg
-  sp6JS7f14BuwFY8Mwoi1AEeELGecF
-  sp6JS7f14BuwFY8MwopGP6Lo5byuj
-  sp6JS7f14BuwFY8MwoufkXGHp2VW8
-  sp6JS7f14BuwFY8MwowGeagFQY32k
-
-34 account seeds that produce account IDs with low 32-bits 0x4d59f0d1:
-  sp6JS7f14BuwFY8Mw5CsNgH64zxK7
-  sp6JS7f14BuwFY8Mw5Dg4wi2E344h
-  sp6JS7f14BuwFY8Mw5ErV949Zh2PX
-  sp6JS7f14BuwFY8Mw5p4nsQvEUE1s
-  sp6JS7f14BuwFY8Mw8LGnkbaP68Gn
-  sp6JS7f14BuwFY8Mw8aq6RCBc3iHo
-  sp6JS7f14BuwFY8Mw8bkWaGoKYT6e
-  sp6JS7f14BuwFY8Mw8qrCuXnzAXVj
-  sp6JS7f14BuwFY8MwFDKcPAHPHJTm
-  sp6JS7f14BuwFY8MwFUXJs4unfgNu
-  sp6JS7f14BuwFY8MwFj9Yv5LjshD9
-  sp6JS7f14BuwFY8Mwj3H73nmq5UaC
-  sp6JS7f14BuwFY8MwjHSYShis1Yhk
-  sp6JS7f14BuwFY8MwjpfE1HVo8UP1
-  sp6JS7f14BuwFY8Mwk6JE1SXUuiNc
-  sp6JS7f14BuwFY8MwkASgxEjEnFmU
-  sp6JS7f14BuwFY8MwkGNY8kg7R6RK
-  sp6JS7f14BuwFY8MwkHinNZ8SYBQu
-  sp6JS7f14BuwFY8MwkXLCW1hbhGya
-  sp6JS7f14BuwFY8MwkZ7mWrYK9YtU
-  sp6JS7f14BuwFY8MwkdFSqNB5DbKL
-  sp6JS7f14BuwFY8Mwm3jdBaCAx8H6
-  sp6JS7f14BuwFY8Mwm3rk5hEwDRtY
-  sp6JS7f14BuwFY8Mwm77a2ULuwxu4
-  sp6JS7f14BuwFY8MwmJpY7braKLaN
-  sp6JS7f14BuwFY8MwmKHQjG4XiZ6g
-  sp6JS7f14BuwFY8Mwmmv8Y3wyUDzs
-  sp6JS7f14BuwFY8MwmucFe1WgqtwG
-  sp6JS7f14BuwFY8Mwo1EjdU1bznZR
-  sp6JS7f14BuwFY8MwoJiqankkU5uR
-  sp6JS7f14BuwFY8MwoLnvQ6zdqbKw
-  sp6JS7f14BuwFY8MwoUGeJ319eu48
-  sp6JS7f14BuwFY8MwoYf135tQjHP4
-  sp6JS7f14BuwFY8MwogeF6M6SAyid
-
-34 account seeds that produce account IDs with low 32-bits 0xabb11898:
-  sp6JS7f14BuwFY8Mw5DgiYaNVSb1G
-  sp6JS7f14BuwFY8Mw5k6e94TMvuox
-  sp6JS7f14BuwFY8Mw5tTSN7KzYxiT
-  sp6JS7f14BuwFY8Mw61XV6m33utif
-  sp6JS7f14BuwFY8Mw87jKfrjiENCb
-  sp6JS7f14BuwFY8Mw8AFtxxFiRtJG
-  sp6JS7f14BuwFY8Mw8cosAVExzbeE
-  sp6JS7f14BuwFY8Mw8fmkQ63zE8WQ
-  sp6JS7f14BuwFY8Mw8iYSsxNbDN6D
-  sp6JS7f14BuwFY8Mw8wTZdGRJyyM1
-  sp6JS7f14BuwFY8Mw8z7xEh3qBGr7
-  sp6JS7f14BuwFY8MwFL5gpKQWZj7g
-  sp6JS7f14BuwFY8MwFPeZchXQnRZ5
-  sp6JS7f14BuwFY8MwFSPxWSJVoU29
-  sp6JS7f14BuwFY8MwFYyVkqX8kvRm
-  sp6JS7f14BuwFY8MwFcbVikUEwJvk
-  sp6JS7f14BuwFY8MwjF7NcZk1NctK
-  sp6JS7f14BuwFY8MwjJCwYr9zSfAv
-  sp6JS7f14BuwFY8MwjYa5yLkgCLuT
-  sp6JS7f14BuwFY8MwjenxuJ3TH2Bc
-  sp6JS7f14BuwFY8MwjriN7Ui11NzB
-  sp6JS7f14BuwFY8Mwk3AuoJNSEo34
-  sp6JS7f14BuwFY8MwkT36hnRv8hTo
-  sp6JS7f14BuwFY8MwkTQixEXfi1Cr
-  sp6JS7f14BuwFY8MwkYJaZM1yTJBF
-  sp6JS7f14BuwFY8Mwkc4k1uo85qp2
-  sp6JS7f14BuwFY8Mwkf7cFhF1uuxx
-  sp6JS7f14BuwFY8MwmCK2un99wb4e
-  sp6JS7f14BuwFY8MwmETztNHYu2Bx
-  sp6JS7f14BuwFY8MwmJws9UwRASfR
-  sp6JS7f14BuwFY8MwoH5PQkGK8tEb
-  sp6JS7f14BuwFY8MwoVXtP2yCzjJV
-  sp6JS7f14BuwFY8MwobxRXA9vsTeX
-  sp6JS7f14BuwFY8Mwos3pc5Gb3ihU
-
-34 account seeds that produce account IDs with low 32-bits 0xce627322:
-  sp6JS7f14BuwFY8Mw5Ck6i83pGNh3
-  sp6JS7f14BuwFY8Mw5FKuwTxjAdH1
-  sp6JS7f14BuwFY8Mw5FVKkEn6TkLH
-  sp6JS7f14BuwFY8Mw5NbQwLwHDd5v
-  sp6JS7f14BuwFY8Mw5X1dbz3msZaZ
-  sp6JS7f14BuwFY8Mw6qv6qaXNeP74
-  sp6JS7f14BuwFY8Mw81SXagUeutCw
-  sp6JS7f14BuwFY8Mw84Ph7Qa8kwwk
-  sp6JS7f14BuwFY8Mw8Hp4gFyU3Qko
-  sp6JS7f14BuwFY8Mw8Kt8bAKredSx
-  sp6JS7f14BuwFY8Mw8XHK3VKRQ7v7
-  sp6JS7f14BuwFY8Mw8eGyWxZGHY6v
-  sp6JS7f14BuwFY8Mw8iU5CLyHVcD2
-  sp6JS7f14BuwFY8Mw8u3Zr26Ar914
-  sp6JS7f14BuwFY8MwF2Kcdxtjzjv8
-  sp6JS7f14BuwFY8MwFLmPWb6rbxNg
-  sp6JS7f14BuwFY8MwFUu8s7UVuxuJ
-  sp6JS7f14BuwFY8MwFYBaatwHxAJ8
-  sp6JS7f14BuwFY8Mwjg6hFkeHwoqG
-  sp6JS7f14BuwFY8MwjjycJojy2ufk
-  sp6JS7f14BuwFY8MwkEWoxcSKGPXv
-  sp6JS7f14BuwFY8MwkMe7wLkEUsQT
-  sp6JS7f14BuwFY8MwkvyKLaPUc4FS
-  sp6JS7f14BuwFY8Mwm8doqXPKZmVQ
-  sp6JS7f14BuwFY8Mwm9r3No8yQ8Tx
-  sp6JS7f14BuwFY8Mwm9w6dks68W9B
-  sp6JS7f14BuwFY8MwmMPrv9sCdbpS
-  sp6JS7f14BuwFY8MwmPAvs3fcQNja
-  sp6JS7f14BuwFY8MwmS5jasapfcnJ
-  sp6JS7f14BuwFY8MwmU2L3qJEhnuA
-  sp6JS7f14BuwFY8MwoAQYmiBnW7fM
-  sp6JS7f14BuwFY8MwoBkkkXrPmkKF
-  sp6JS7f14BuwFY8MwonfmxPo6tkvC
-  sp6JS7f14BuwFY8MwouZFwhiNcYq6
-
-34 account seeds that produce account IDs with low 32-bits 0xe29643e8:
-  sp6JS7f14BuwFY8Mw5EfAavcXAh2k
-  sp6JS7f14BuwFY8Mw5LhFjLkFSCVF
-  sp6JS7f14BuwFY8Mw5bRfEv5HgdBh
-  sp6JS7f14BuwFY8Mw5d6sPcKzypKN
-  sp6JS7f14BuwFY8Mw5rcqDtk1fACP
-  sp6JS7f14BuwFY8Mw5xkxRq1Notzv
-  sp6JS7f14BuwFY8Mw66fbkdw5WYmt
-  sp6JS7f14BuwFY8Mw6diEG8sZ7Fx7
-  sp6JS7f14BuwFY8Mw6v2r1QhG7xc1
-  sp6JS7f14BuwFY8Mw6zP6DHCTx2Fd
-  sp6JS7f14BuwFY8Mw8B3n39JKuFkk
-  sp6JS7f14BuwFY8Mw8FmBvqYw7uqn
-  sp6JS7f14BuwFY8Mw8KEaftb1eRwu
-  sp6JS7f14BuwFY8Mw8WJ1qKkegj9N
-  sp6JS7f14BuwFY8Mw8r8cAZEkq2BS
-  sp6JS7f14BuwFY8MwFKPxxwF65gZh
-  sp6JS7f14BuwFY8MwFKhaF8APcN5H
-  sp6JS7f14BuwFY8MwFN2buJn4BgYC
-  sp6JS7f14BuwFY8MwFUTe175MjP3x
-  sp6JS7f14BuwFY8MwFZhmRDb53NNb
-  sp6JS7f14BuwFY8MwFa2Azn5nU2WS
-  sp6JS7f14BuwFY8MwjNNt91hwgkn7
-  sp6JS7f14BuwFY8MwjdiYt6ChACe7
-  sp6JS7f14BuwFY8Mwk5qFVQ48Mmr9
-  sp6JS7f14BuwFY8MwkGvCj7pNf1zG
-  sp6JS7f14BuwFY8MwkY9UcN2D2Fzs
-  sp6JS7f14BuwFY8MwkpGvSk9G9RyT
-  sp6JS7f14BuwFY8MwmGQ7nJf1eEzV
-  sp6JS7f14BuwFY8MwmQLjGsYdyAmV
-  sp6JS7f14BuwFY8MwmZ8usztKvikT
-  sp6JS7f14BuwFY8MwobyMLC2hQdFR
-  sp6JS7f14BuwFY8MwoiRtwUecZeJ5
-  sp6JS7f14BuwFY8MwojHjKsUzj1KJ
-  sp6JS7f14BuwFY8Mwop29anGAjidU
-
-33 account seeds that produce account IDs with low 32-bits 0x115d0525:
-  sp6JS7f14BuwFY8Mw56vZeiBuhePx
-  sp6JS7f14BuwFY8Mw5BodF9tGuTUe
-  sp6JS7f14BuwFY8Mw5EnhC1cg84J7
-  sp6JS7f14BuwFY8Mw5P913Cunr2BK
-  sp6JS7f14BuwFY8Mw5Pru7eLo1XzT
-  sp6JS7f14BuwFY8Mw61SLUC8UX2m8
-  sp6JS7f14BuwFY8Mw6AsBF9TpeMpq
-  sp6JS7f14BuwFY8Mw84XqrBZkU2vE
-  sp6JS7f14BuwFY8Mw89oSU6dBk3KB
-  sp6JS7f14BuwFY8Mw89qUKCyDmyzj
-  sp6JS7f14BuwFY8Mw8GfqQ9VRZ8tm
-  sp6JS7f14BuwFY8Mw8LtW3VqrqMks
-  sp6JS7f14BuwFY8Mw8ZrAkJc2sHew
-  sp6JS7f14BuwFY8Mw8jpkYSNrD3ah
-  sp6JS7f14BuwFY8MwF2mshd786m3V
-  sp6JS7f14BuwFY8MwFHfXq9x5NbPY
-  sp6JS7f14BuwFY8MwFrjWq5LAB8NT
-  sp6JS7f14BuwFY8Mwj4asgSh6hQZd
-  sp6JS7f14BuwFY8Mwj7ipFfqBSRrE
-  sp6JS7f14BuwFY8MwjHqtcvGav8uW
-  sp6JS7f14BuwFY8MwjLp4sk5fmzki
-  sp6JS7f14BuwFY8MwjioHuYb3Ytkx
-  sp6JS7f14BuwFY8MwkRjHPXWi7fGN
-  sp6JS7f14BuwFY8MwkdVdPV3LjNN1
-  sp6JS7f14BuwFY8MwkxUtVY5AXZFk
-  sp6JS7f14BuwFY8Mwm4jQzdfTbY9F
-  sp6JS7f14BuwFY8MwmCucYAqNp4iF
-  sp6JS7f14BuwFY8Mwo2bgdFtxBzpF
-  sp6JS7f14BuwFY8MwoGwD7v4U6qBh
-  sp6JS7f14BuwFY8MwoUczqFADMoXi
-  sp6JS7f14BuwFY8MwoY1xZeGd3gAr
-  sp6JS7f14BuwFY8MwomVCbfkv4kYZ
-  sp6JS7f14BuwFY8MwoqbrPSr4z13F
-
-33 account seeds that produce account IDs with low 32-bits 0x304033aa:
-  sp6JS7f14BuwFY8Mw5DaUP9agF5e1
-  sp6JS7f14BuwFY8Mw5ohbtmPN4yGN
-  sp6JS7f14BuwFY8Mw5rRsA5fcoTAQ
-  sp6JS7f14BuwFY8Mw6zpYHMY3m6KT
-  sp6JS7f14BuwFY8Mw86BzQq4sTnoW
-  sp6JS7f14BuwFY8Mw8CCpnfvmGdV7
-  sp6JS7f14BuwFY8Mw8DRjUDaBcFco
-  sp6JS7f14BuwFY8Mw8cL7GPo3zZN7
-  sp6JS7f14BuwFY8Mw8y6aeYVtH6qt
-  sp6JS7f14BuwFY8MwFZR3PtVTCdUH
-  sp6JS7f14BuwFY8MwFcdcdbgz7m3s
-  sp6JS7f14BuwFY8MwjdnJDiUxEBRR
-  sp6JS7f14BuwFY8MwjhxWgSntqrFe
-  sp6JS7f14BuwFY8MwjrSHEhZ8CUM1
-  sp6JS7f14BuwFY8MwjzkEeSTc9ZYf
-  sp6JS7f14BuwFY8MwkBZSk9JhaeCB
-  sp6JS7f14BuwFY8MwkGfwNY4i2iiU
-  sp6JS7f14BuwFY8MwknjtZd2oU2Ff
-  sp6JS7f14BuwFY8Mwkszsqd3ok9NE
-  sp6JS7f14BuwFY8Mwm58A81MAMvgZ
-  sp6JS7f14BuwFY8MwmiPTWysuDJCH
-  sp6JS7f14BuwFY8MwmxhiNeLfD76r
-  sp6JS7f14BuwFY8Mwo7SPdkwpGrFH
-  sp6JS7f14BuwFY8MwoANq4F1Sj3qH
-  sp6JS7f14BuwFY8MwoVjcHufAkd6L
-  sp6JS7f14BuwFY8MwoVxHBXdaxzhm
-  sp6JS7f14BuwFY8MwoZ2oTjBNfLpm
-  sp6JS7f14BuwFY8Mwoc9swzyotFVD
-  sp6JS7f14BuwFY8MwogMqVRwVEcQ9
-  sp6JS7f14BuwFY8MwohMm7WxwnFqH
-  sp6JS7f14BuwFY8MwopUcpZHuF8BH
-  sp6JS7f14BuwFY8Mwor6rW6SS7tiB
-  sp6JS7f14BuwFY8MwoxyaqYz4Ngsb
-
-33 account seeds that produce account IDs with low 32-bits 0x42d4e09c:
-  sp6JS7f14BuwFY8Mw58NSZH9EaUxQ
-  sp6JS7f14BuwFY8Mw5JByk1pgPpL7
-  sp6JS7f14BuwFY8Mw5YrJJuXnkHVB
-  sp6JS7f14BuwFY8Mw5kZe2ZzNSnKR
-  sp6JS7f14BuwFY8Mw6eXHTsbwi1U7
-  sp6JS7f14BuwFY8Mw6gqN7HHDDKSh
-  sp6JS7f14BuwFY8Mw6zw8L1sSSR53
-  sp6JS7f14BuwFY8Mw8E4WqSKKbksy
-  sp6JS7f14BuwFY8MwF3V9gemqJtND
-  sp6JS7f14BuwFY8Mwj4j46LHWZuY6
-  sp6JS7f14BuwFY8MwjF5i8vh4Ezjy
-  sp6JS7f14BuwFY8MwjJZpEKgMpUAt
-  sp6JS7f14BuwFY8MwjWL7LfnzNUuh
-  sp6JS7f14BuwFY8Mwk7Y1csGuqAhX
-  sp6JS7f14BuwFY8MwkB1HVH17hN5W
-  sp6JS7f14BuwFY8MwkBntH7BZZupu
-  sp6JS7f14BuwFY8MwkEy4rMbNHG9P
-  sp6JS7f14BuwFY8MwkKz4LYesZeiN
-  sp6JS7f14BuwFY8MwkUrXyo9gMDPM
-  sp6JS7f14BuwFY8MwkV2hySsxej1G
-  sp6JS7f14BuwFY8MwkozhTVN12F9C
-  sp6JS7f14BuwFY8MwkpkzGB3sFJw5
-  sp6JS7f14BuwFY8Mwks3zDZLGrhdn
-  sp6JS7f14BuwFY8MwktG1KCS7L2wW
-  sp6JS7f14BuwFY8Mwm1jVFsafwcYx
-  sp6JS7f14BuwFY8Mwm8hmrU6g5Wd6
-  sp6JS7f14BuwFY8MwmFvstfRF7e2f
-  sp6JS7f14BuwFY8MwmeRohi6m5fs8
-  sp6JS7f14BuwFY8MwmmU96RHUaRZL
-  sp6JS7f14BuwFY8MwoDFzteYqaUh4
-  sp6JS7f14BuwFY8MwoPkTf5tDykPF
-  sp6JS7f14BuwFY8MwoSbMaDtiMoDN
-  sp6JS7f14BuwFY8MwoVL1vY1CysjR
-
-33 account seeds that produce account IDs with low 32-bits 0x9a8ebed3:
-  sp6JS7f14BuwFY8Mw5FnqmbciPvH6
-  sp6JS7f14BuwFY8Mw5MBGbyMSsXLp
-  sp6JS7f14BuwFY8Mw5S4PnDyBdKKm
-  sp6JS7f14BuwFY8Mw6kcXpM2enE35
-  sp6JS7f14BuwFY8Mw6tuuSMMwyJ44
-  sp6JS7f14BuwFY8Mw8E8JWLQ1P8pt
-  sp6JS7f14BuwFY8Mw8WwdgWkCHhEx
-  sp6JS7f14BuwFY8Mw8XDUYvU6oGhQ
-  sp6JS7f14BuwFY8Mw8ceVGL4M1zLQ
-  sp6JS7f14BuwFY8Mw8fdSwLCZWDFd
-  sp6JS7f14BuwFY8Mw8zuF6Fg65i1E
-  sp6JS7f14BuwFY8MwF2k7bihVfqes
-  sp6JS7f14BuwFY8MwF6X24WXGn557
-  sp6JS7f14BuwFY8MwFMpn7strjekg
-  sp6JS7f14BuwFY8MwFSdy9sYVrwJs
-  sp6JS7f14BuwFY8MwFdMcLy9UkrXn
-  sp6JS7f14BuwFY8MwFdbwFm1AAboa
-  sp6JS7f14BuwFY8MwFdr5AhKThVtU
-  sp6JS7f14BuwFY8MwjFc3Q9YatvAw
-  sp6JS7f14BuwFY8MwjRXcNs1ozEXn
-  sp6JS7f14BuwFY8MwkQGUKL7v1FBt
-  sp6JS7f14BuwFY8Mwkamsoxx1wECt
-  sp6JS7f14BuwFY8Mwm3hus1dG6U8y
-  sp6JS7f14BuwFY8Mwm589M8vMRpXF
-  sp6JS7f14BuwFY8MwmJTRJ4Fqz1A3
-  sp6JS7f14BuwFY8MwmRfy8fer4QbL
-  sp6JS7f14BuwFY8MwmkkFx1HtgWRx
-  sp6JS7f14BuwFY8MwmwP9JFdKa4PS
-  sp6JS7f14BuwFY8MwoXWJLB3ciHfo
-  sp6JS7f14BuwFY8MwoYc1gTtT2mWL
-  sp6JS7f14BuwFY8MwogXtHH7FNVoo
-  sp6JS7f14BuwFY8MwoqYoA9P8gf3r
-  sp6JS7f14BuwFY8MwoujwMJofGnsA
-
-33 account seeds that produce account IDs with low 32-bits 0xa1dcea4a:
-  sp6JS7f14BuwFY8Mw5Ccov2N36QTy
-  sp6JS7f14BuwFY8Mw5CuSemVb5p7w
-  sp6JS7f14BuwFY8Mw5Ep8wpsTfpSz
-  sp6JS7f14BuwFY8Mw5WtutJc2H45M
-  sp6JS7f14BuwFY8Mw6vsDeaSKeUJZ
-  sp6JS7f14BuwFY8Mw83t5BPWUAzzF
-  sp6JS7f14BuwFY8Mw8FYGnK35mgkV
-  sp6JS7f14BuwFY8Mw8huo1x5pfKKJ
-  sp6JS7f14BuwFY8Mw8mPStxfMDrZa
-  sp6JS7f14BuwFY8Mw8yC3A7aQJytK
-  sp6JS7f14BuwFY8MwFCWCDmo9o3t8
-  sp6JS7f14BuwFY8MwFjapa4gKxPhR
-  sp6JS7f14BuwFY8Mwj8CWtG29uw71
-  sp6JS7f14BuwFY8MwjHyU5KpEMLVT
-  sp6JS7f14BuwFY8MwjMZSN7LZuWD8
-  sp6JS7f14BuwFY8Mwja2TXJNBhKHU
-  sp6JS7f14BuwFY8Mwjf3xNTopHKTF
-  sp6JS7f14BuwFY8Mwjn5RAhedPeuM
-  sp6JS7f14BuwFY8MwkJdr4d6QoE8K
-  sp6JS7f14BuwFY8MwkmBryo3SUoLm
-  sp6JS7f14BuwFY8MwkrPdsc4tR8yw
-  sp6JS7f14BuwFY8Mwkttjcw2a65Fi
-  sp6JS7f14BuwFY8Mwm19n3rSaNx5S
-  sp6JS7f14BuwFY8Mwm3ryr4Xp2aQX
-  sp6JS7f14BuwFY8MwmBnDmgnJLB6B
-  sp6JS7f14BuwFY8MwmHgPjzrYjthq
-  sp6JS7f14BuwFY8MwmeV55DAnWKdd
-  sp6JS7f14BuwFY8Mwo49hK6BGrauT
-  sp6JS7f14BuwFY8Mwo56vfKY9aoWu
-  sp6JS7f14BuwFY8MwoU7tTTXLQTrh
-  sp6JS7f14BuwFY8MwoXpogSF2KaZB
-  sp6JS7f14BuwFY8MwoY9JYQAR16pc
-  sp6JS7f14BuwFY8MwoozLzKNAEXKM
-
-33 account seeds that produce account IDs with low 32-bits 0xbd2116db:
-  sp6JS7f14BuwFY8Mw5GrpkmPuA3Bw
-  sp6JS7f14BuwFY8Mw5r1sLoQJZDc6
-  sp6JS7f14BuwFY8Mw68zzRmezLdd6
-  sp6JS7f14BuwFY8Mw6jDSyaiF1mRp
-  sp6JS7f14BuwFY8Mw813wU9u5D6Uh
-  sp6JS7f14BuwFY8Mw8BBvpf2JFGoJ
-  sp6JS7f14BuwFY8Mw8F7zXxAiT263
-  sp6JS7f14BuwFY8Mw8XG7WuVGHP2N
-  sp6JS7f14BuwFY8Mw8eyWrcz91cz6
-  sp6JS7f14BuwFY8Mw8yNVKFVYyk9u
-  sp6JS7f14BuwFY8MwF2oA6ePqvZWP
-  sp6JS7f14BuwFY8MwF9VkcSNh3keq
-  sp6JS7f14BuwFY8MwFYsMWajgEf2j
-  sp6JS7f14BuwFY8Mwj3Gu43jYoJ4n
-  sp6JS7f14BuwFY8MwjJ5iRmYDHrW4
-  sp6JS7f14BuwFY8MwjaUSSga93CiM
-  sp6JS7f14BuwFY8MwjxgLh2FY4Lvt
-  sp6JS7f14BuwFY8Mwk9hQdNZUgmTB
-  sp6JS7f14BuwFY8MwkcMXqtFp1sMx
-  sp6JS7f14BuwFY8MwkzZCDc56jsUB
-  sp6JS7f14BuwFY8Mwm5Zz7fP24Qym
-  sp6JS7f14BuwFY8MwmDWqizXSoJRG
-  sp6JS7f14BuwFY8MwmKHmkNYdMqqi
-  sp6JS7f14BuwFY8MwmRfAWHxWpGNK
-  sp6JS7f14BuwFY8MwmjCdXwyhphZ1
-  sp6JS7f14BuwFY8MwmmukDAm1w6FL
-  sp6JS7f14BuwFY8Mwmmz2SzaR9TRH
-  sp6JS7f14BuwFY8Mwmz2z5mKHXzfn
-  sp6JS7f14BuwFY8Mwo2xNe5629r5k
-  sp6JS7f14BuwFY8MwoKy8tZxZrfJw
-  sp6JS7f14BuwFY8MwoLyQ9aMsq8Dm
-  sp6JS7f14BuwFY8MwoqqYkewuyZck
-  sp6JS7f14BuwFY8MwouvvhREVp6Pp
-
-33 account seeds that produce account IDs with low 32-bits 0xd80df065:
-  sp6JS7f14BuwFY8Mw5B7ERyhAfgHA
-  sp6JS7f14BuwFY8Mw5VuW3cF7bm2v
-  sp6JS7f14BuwFY8Mw5py3t1j7YbFT
-  sp6JS7f14BuwFY8Mw5qc84SzB6RHr
-  sp6JS7f14BuwFY8Mw5vGHW1G1hAy8
-  sp6JS7f14BuwFY8Mw6gVa8TYukws6
-  sp6JS7f14BuwFY8Mw8K9w1RoUAv1w
-  sp6JS7f14BuwFY8Mw8KvKtB7787CA
-  sp6JS7f14BuwFY8Mw8Y7WhRbuFzRq
-  sp6JS7f14BuwFY8Mw8cipw7inRmMn
-  sp6JS7f14BuwFY8MwFM5fAUNLNB13
-  sp6JS7f14BuwFY8MwFSe1zAsht3X3
-  sp6JS7f14BuwFY8MwFYNdigqQuHZM
-  sp6JS7f14BuwFY8MwjWkejj7V4V5Q
-  sp6JS7f14BuwFY8Mwjd2JGpsjvynq
-  sp6JS7f14BuwFY8Mwjg1xkducn751
-  sp6JS7f14BuwFY8Mwjsp6LnaJvL1W
-  sp6JS7f14BuwFY8MwjvSbLc9593yH
-  sp6JS7f14BuwFY8Mwjw2h5wx7U6vZ
-  sp6JS7f14BuwFY8MwjxKUjtRsmPLH
-  sp6JS7f14BuwFY8Mwk1Yy8ginDfqv
-  sp6JS7f14BuwFY8Mwk2HrWhWwZP12
-  sp6JS7f14BuwFY8Mwk4SsqiexvpWs
-  sp6JS7f14BuwFY8Mwk66zCs5ACpE6
-  sp6JS7f14BuwFY8MwkCwx6vY97Nwh
-  sp6JS7f14BuwFY8MwknrbjnhTTWU8
-  sp6JS7f14BuwFY8MwkokDy2ShRzQx
-  sp6JS7f14BuwFY8Mwm3BxnRPNxsuu
-  sp6JS7f14BuwFY8MwmY9EWdQQsFVr
-  sp6JS7f14BuwFY8MwmYTWjrDhmk8S
-  sp6JS7f14BuwFY8Mwo9skXt9Y5BVS
-  sp6JS7f14BuwFY8MwoZYKZybJ1Crp
-  sp6JS7f14BuwFY8MwoyXqkhySfSmF
-
-33 account seeds that produce account IDs with low 32-bits 0xe2e44294:
-  sp6JS7f14BuwFY8Mw53dmvTgNtBwi
-  sp6JS7f14BuwFY8Mw5Wrxsqn6WrXW
-  sp6JS7f14BuwFY8Mw5fGDT31RCXgC
-  sp6JS7f14BuwFY8Mw5nKRkubwrLWM
-  sp6JS7f14BuwFY8Mw5nXMajwKjriB
-  sp6JS7f14BuwFY8Mw5xZybggrC9NG
-  sp6JS7f14BuwFY8Mw5xea8f6dBMV5
-  sp6JS7f14BuwFY8Mw5zDGofAHy5Lb
-  sp6JS7f14BuwFY8Mw6eado41rQNVG
-  sp6JS7f14BuwFY8Mw6yqKXQsQJPuU
-  sp6JS7f14BuwFY8Mw83MSN4FDzSGH
-  sp6JS7f14BuwFY8Mw8B3pUbzQqHe2
-  sp6JS7f14BuwFY8Mw8WwRLnhBRvfk
-  sp6JS7f14BuwFY8Mw8hDBpKbpJwJX
-  sp6JS7f14BuwFY8Mw8jggRSZACe7M
-  sp6JS7f14BuwFY8Mw8mJRpU3qWbwC
-  sp6JS7f14BuwFY8MwFDnVozykN21u
-  sp6JS7f14BuwFY8MwFGGRGY9fctgv
-  sp6JS7f14BuwFY8MwjKznfChH9DQb
-  sp6JS7f14BuwFY8MwjbC5GvngRCk6
-  sp6JS7f14BuwFY8Mwk3Lb7FPe1629
-  sp6JS7f14BuwFY8MwkCeS41BwVrBD
-  sp6JS7f14BuwFY8MwkDnnvRyuWJ7d
-  sp6JS7f14BuwFY8MwkbkRNnzDEFpf
-  sp6JS7f14BuwFY8MwkiNhaVhGNk6v
-  sp6JS7f14BuwFY8Mwm1X4UJXRZx3p
-  sp6JS7f14BuwFY8Mwm7da9q5vfq7J
-  sp6JS7f14BuwFY8MwmPLqfBPrHw5H
-  sp6JS7f14BuwFY8MwmbJpxvVjEwm2
-  sp6JS7f14BuwFY8MwoAVeA7ka37cD
-  sp6JS7f14BuwFY8MwoTFFTAwFKmVM
-  sp6JS7f14BuwFY8MwoYsne51VpDE3
-  sp6JS7f14BuwFY8MwohLVnU1VTk5h
-
-#endif  // 0
diff --git a/src/test/app/PayStrand_test.cpp b/src/test/app/PayStrand_test.cpp
index 967f84f275..2a4b884668 100644
--- a/src/test/app/PayStrand_test.cpp
+++ b/src/test/app/PayStrand_test.cpp
@@ -37,6 +37,7 @@
 #include <xrpl/tx/paths/detail/Steps.h>
 #include <xrpl/tx/transactors/dex/AMMContext.h>
 
+#include <algorithm>
 #include <cassert>
 #include <cstddef>
 #include <cstdint>
@@ -126,12 +127,7 @@ class ElementComboIter
     [[nodiscard]] bool
     hasAny(std::initializer_list<SB> sb) const
     {
-        for (auto const s : sb)
-        {
-            if (has(s))
-                return true;
-        }
-        return false;
+        return std::ranges::any_of(sb, [this](auto const s) { return has(s); });
     }
 
     [[nodiscard]] size_t
diff --git a/src/test/app/PermissionedDEX_test.cpp b/src/test/app/PermissionedDEX_test.cpp
index 8578b8a9ba..998b7b1c7f 100644
--- a/src/test/app/PermissionedDEX_test.cpp
+++ b/src/test/app/PermissionedDEX_test.cpp
@@ -39,6 +39,7 @@
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/jss.h>
 
+#include <algorithm>
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
@@ -82,13 +83,9 @@ class PermissionedDEX_test : public beast::unit_test::Suite
                 return false;
 
             auto const& indexes = page->getFieldV256(sfIndexes);
-            for (auto const& index : indexes)
-            {
-                if (index == keylet::offer(account, offerSeq).key)
-                    return true;
-            }
-
-            return false;
+            return std::ranges::any_of(indexes, [&](auto const& index) {
+                return index == keylet::offer(account, offerSeq).key;
+            });
         };
 
         auto const sle = env.le(keylet::offer(account.id(), offerSeq));
diff --git a/src/test/app/ReducedOffer_test.cpp b/src/test/app/ReducedOffer_test.cpp
index 47a2c1294c..dea197590c 100644
--- a/src/test/app/ReducedOffer_test.cpp
+++ b/src/test/app/ReducedOffer_test.cpp
@@ -144,20 +144,6 @@ public:
                             Quality(Amounts{tweakedTakerPays, reducedTakerGets}).rate();
                         BEAST_EXPECT(tweakedRate > initialRate);
                     }
-#if 0
-                    std::cout << "Placed rate: " << initialRate
-                              << "; in-ledger rate: " << inLedgerRate
-                              << "; TakerPays: " << reducedTakerPays
-                              << "; TakerGets: " << reducedTakerGets
-                              << "; bob already got: " << bobGot << std::endl;
-// #else
-                    std::string_view filler =
-                        inLedgerRate > initialRate ? "**" : "  ";
-                    std::cout << "| `" << reducedTakerGets << "` | `"
-                              << reducedTakerPays << "` | `" << initialRate
-                              << "` | " << filler << "`" << inLedgerRate << "`"
-                              << filler << " |`" << std::endl;
-#endif
                 }
 
                 // In preparation for the next iteration make sure the two
@@ -275,21 +261,6 @@ public:
                             Quality(Amounts{tweakedTakerPays, reducedTakerGets}).rate();
                         BEAST_EXPECT(tweakedRate > initialRate);
                     }
-#if 0
-                    std::cout << "Placed rate: " << initialRate
-                              << "; in-ledger rate: " << inLedgerRate
-                              << "; TakerPays: " << reducedTakerPays
-                              << "; TakerGets: " << reducedTakerGets
-                              << "; alice already got: " << aliceGot
-                              << std::endl;
-// #else
-                    std::string_view filler = badRate ? "**" : "  ";
-                    std::cout << "| `" << reducedTakerGets << "` | `"
-                              << reducedTakerPays << "` | `" << initialRate
-                              << "` | " << filler << "`" << inLedgerRate << "`"
-                              << filler << " | `" << aliceGot << "` |"
-                              << std::endl;
-#endif
                 }
 
                 // In preparation for the next iteration make sure the two
@@ -463,13 +434,6 @@ public:
                 {
                     bool const bobOfferGone = !offerInLedger(env, bob, bobOfferSeq);
                     STAmount const aliceBalanceUSD = env.balance(alice, usd);
-#if 0
-                    std::cout
-                        << "bob initial: " << initialBobUSD
-                        << "; alice final: " << aliceBalanceUSD
-                        << "; bob offer: " << bobOfferJson.toStyledString()
-                        << std::endl;
-#endif
                     // Sanity check the ledger if alice got USD.
                     if (aliceBalanceUSD.signum() > 0)
                     {
@@ -619,19 +583,6 @@ public:
                             Quality(Amounts{aliceReducedOffer.in, tweakedTakerGets}).rate();
                         BEAST_EXPECT(tweakedRate > initialRate);
                     }
-#if 0
-                    std::cout << "Placed rate: " << initialRate
-                              << "; in-ledger rate: " << inLedgerRate
-                              << "; TakerPays: " << aliceReducedOffer.in
-                              << "; TakerGets: " << aliceReducedOffer.out
-                              << std::endl;
-// #else
-                    std::string_view filler = badRate ? "**" : "  ";
-                    std::cout << "| " << aliceReducedOffer.in << "` | `"
-                              << aliceReducedOffer.out << "` | `" << initialRate
-                              << "` | " << filler << "`" << inLedgerRate << "`"
-                              << filler << std::endl;
-#endif
                 }
 
                 // In preparation for the next iteration make sure all three
diff --git a/src/test/app/ValidatorList_test.cpp b/src/test/app/ValidatorList_test.cpp
index 8077c21863..60228f6723 100644
--- a/src/test/app/ValidatorList_test.cpp
+++ b/src/test/app/ValidatorList_test.cpp
@@ -2596,7 +2596,7 @@ private:
     }
 
     void
-    testQuorumDisabled()
+    testQuorumDisabled()  // NOLINT(readability-function-size)
     {
         testcase("Test quorum disabled");
 
diff --git a/src/test/app/XChain_test.cpp b/src/test/app/XChain_test.cpp
index 4b007eea13..d1f9cd2722 100644
--- a/src/test/app/XChain_test.cpp
+++ b/src/test/app/XChain_test.cpp
@@ -3923,12 +3923,10 @@ private:
         [[nodiscard]] bool
         verify() const
         {
-            for (auto const& [acct, state] : accounts)
-            {
-                if (!state.verify(env, acct))
-                    return false;
-            }
-            return true;
+            return std::ranges::all_of(accounts, [&](auto const& entry) {
+                auto const& [acct, state] = entry;
+                return state.verify(env, acct);
+            });
         }
 
         struct BridgeCounters
diff --git a/src/test/consensus/Consensus_test.cpp b/src/test/consensus/Consensus_test.cpp
index 92a4c67e32..45f58d16ba 100644
--- a/src/test/consensus/Consensus_test.cpp
+++ b/src/test/consensus/Consensus_test.cpp
@@ -1034,16 +1034,6 @@ public:
         // slow ledger is generated
         UndoDelay undoDelay{behind};
         sim.collectors.add(undoDelay);
-
-#if 0
-        // Have all beast::journal output printed to stdout
-        for (Peer* p : network)
-            p->sink.threshold(beast::Severity::All);
-
-        // Print ledger accept and fully validated events to stdout
-        StreamCollector sc{std::cout};
-        sim.collectors.add(sc);
-#endif
         // Run the simulation for 100 seconds of simulation time with
         std::chrono::nanoseconds const simDuration = 100s;
 
diff --git a/src/test/core/SociDB_test.cpp b/src/test/core/SociDB_test.cpp
index d37569d6cd..373ec66cd1 100644
--- a/src/test/core/SociDB_test.cpp
+++ b/src/test/core/SociDB_test.cpp
@@ -229,63 +229,7 @@ public:
                 fail();
             }
             // There are too many issues when working with soci::row and
-            // boost::tuple. DO NOT USE soci row! I had a set of workarounds to
-            // make soci row less error prone, I'm keeping these tests in case I
-            // try to add soci::row and boost::tuple back into soci.
-#if 0
-            try
-            {
-                std::int32_t ig = 0;
-                std::uint32_t uig = 0;
-                std::int64_t big = 0;
-                std::uint64_t ubig = 0;
-                soci::row r;
-                s << "SELECT I, UI, BI, UBI from STT", soci::into (r);
-                ig = r.get<std::int32_t>(0);
-                uig = r.get<std::uint32_t>(1);
-                big = r.get<std::int64_t>(2);
-                ubig = r.get<std::uint64_t>(3);
-                BEAST_EXPECT(ig == id[0] && uig == uid[0] && big == bid[0] &&
-                        ubig == ubid[0]);
-            }
-            catch (std::exception&)
-            {
-                fail ();
-            }
-            try
-            {
-                std::int32_t ig = 0;
-                std::uint32_t uig = 0;
-                std::int64_t big = 0;
-                std::uint64_t ubig = 0;
-                soci::row r;
-                s << "SELECT I, UI, BI, UBI from STT", soci::into (r);
-                ig = r.get<std::int32_t>("I");
-                uig = r.get<std::uint32_t>("UI");
-                big = r.get<std::int64_t>("BI");
-                ubig = r.get<std::uint64_t>("UBI");
-                BEAST_EXPECT(ig == id[0] && uig == uid[0] && big == bid[0] &&
-                        ubig == ubid[0]);
-            }
-            catch (std::exception&)
-            {
-                fail ();
-            }
-            try
-            {
-                boost::tuple<std::int32_t,
-                             std::uint32_t,
-                             std::int64_t,
-                             std::uint64_t> d;
-                s << "SELECT I, UI, BI, UBI from STT", soci::into (d);
-                BEAST_EXPECT(get<0>(d) == id[0] && get<1>(d) == uid[0] &&
-                        get<2>(d) == bid[0] && get<3>(d) == ubid[0]);
-            }
-            catch (std::exception&)
-            {
-                fail ();
-            }
-#endif
+            // boost::tuple. DO NOT USE soci row!
         }
         {
             namespace bfs = boost::filesystem;
diff --git a/src/test/csf/Peer.h b/src/test/csf/Peer.h
index 53b26d05cf..79bffec9cb 100644
--- a/src/test/csf/Peer.h
+++ b/src/test/csf/Peer.h
@@ -413,12 +413,8 @@ struct Peer
     bool
     trusts(PeerID const& oId)
     {
-        for (auto const p : trustGraph.trustedPeers(this))
-        {
-            if (p->id == oId)
-                return true;
-        }
-        return false;
+        return std::ranges::any_of(
+            trustGraph.trustedPeers(this), [&oId](auto const p) { return p->id == oId; });
     }
 
     /**
diff --git a/src/test/jtx/TestHelpers.h b/src/test/jtx/TestHelpers.h
index c4991c4ff3..e7a2808f07 100644
--- a/src/test/jtx/TestHelpers.h
+++ b/src/test/jtx/TestHelpers.h
@@ -464,12 +464,8 @@ same(STPathSet const& st1, Args const&... args)
     if (st1.size() != st2.size())
         return false;
 
-    for (auto const& p : st2)
-    {
-        if (std::ranges::find(st1, p) == st1.end())
-            return false;
-    }
-    return true;
+    return std::ranges::all_of(
+        st2, [&st1](auto const& p) { return std::ranges::find(st1, p) != st1.end(); });
 }
 
 json::Value
diff --git a/src/test/jtx/impl/AMM.cpp b/src/test/jtx/impl/AMM.cpp
index 5c815d4226..8effce288e 100644
--- a/src/test/jtx/impl/AMM.cpp
+++ b/src/test/jtx/impl/AMM.cpp
@@ -326,13 +326,10 @@ AMM::expectAuctionSlot(std::vector<AccountID> const& authAccounts) const
 {
     return expectAuctionSlot(
         [&](std::uint32_t, std::optional<std::uint8_t>, IOUAmount const&, STArray const& accounts) {
-            for (auto const& account : accounts)
-            {
-                if (std::ranges::find(authAccounts, account.getAccountID(sfAccount)) ==
-                    authAccounts.end())
-                    return false;
-            }
-            return true;
+            return std::ranges::all_of(accounts, [&](auto const& account) {
+                return std::ranges::find(authAccounts, account.getAccountID(sfAccount)) !=
+                    authAccounts.end();
+            });
         });
 }
 
diff --git a/src/test/nodestore/Timing_test.cpp b/src/test/nodestore/Timing_test.cpp
index 1c296ca44c..1f282d9d7f 100644
--- a/src/test/nodestore/Timing_test.cpp
+++ b/src/test/nodestore/Timing_test.cpp
@@ -692,9 +692,6 @@ public:
 #if XRPL_ROCKSDB_AVAILABLE
             ";type=rocksdb,open_files=2000,filter_bits=12,cache_mb=256,"
             "file_size_mb=8,file_size_mult=2"
-#endif
-#if 0
-            ";type=memory|path=NodeStore"
 #endif
             ;
 
diff --git a/src/test/overlay/cluster_test.cpp b/src/test/overlay/cluster_test.cpp
index 6c2114b7de..0a51f98594 100644
--- a/src/test/overlay/cluster_test.cpp
+++ b/src/test/overlay/cluster_test.cpp
@@ -150,7 +150,7 @@ public:
         {
             auto member = c->member(node);
             BEAST_EXPECT(static_cast<bool>(member));
-            BEAST_EXPECT(member->compare(name) == 0);  // NOLINT(bugprone-unchecked-optional-access)
+            BEAST_EXPECT(*member == name);  // NOLINT(bugprone-unchecked-optional-access)
         }
 
         // Updating the name (non-empty doesn't go to empty)
@@ -159,7 +159,7 @@ public:
         {
             auto member = c->member(node);
             BEAST_EXPECT(static_cast<bool>(member));
-            BEAST_EXPECT(member->compare(name) == 0);  // NOLINT(bugprone-unchecked-optional-access)
+            BEAST_EXPECT(*member == name);  // NOLINT(bugprone-unchecked-optional-access)
         }
 
         // Updating the name (non-empty updates to new non-empty)
@@ -168,8 +168,7 @@ public:
         {
             auto member = c->member(node);
             BEAST_EXPECT(static_cast<bool>(member));
-            BEAST_EXPECT(
-                member->compare("test") == 0);  // NOLINT(bugprone-unchecked-optional-access)
+            BEAST_EXPECT(*member == "test");  // NOLINT(bugprone-unchecked-optional-access)
         }
     }
 
diff --git a/src/test/overlay/reduce_relay_test.cpp b/src/test/overlay/reduce_relay_test.cpp
index c55729a45a..2f42313037 100644
--- a/src/test/overlay/reduce_relay_test.cpp
+++ b/src/test/overlay/reduce_relay_test.cpp
@@ -858,12 +858,8 @@ public:
     bool
     isSelected(Peer::id_t id)
     {
-        for (auto& v : validators_)
-        {
-            if (overlay_.isSelected(v, id))
-                return true;
-        }
-        return false;
+        return std::ranges::any_of(
+            validators_, [&](auto& v) { return overlay_.isSelected(v, id); });
     }
 
     /**
diff --git a/src/test/protocol/STAmount_test.cpp b/src/test/protocol/STAmount_test.cpp
index 720fafa8f2..f6c5a94752 100644
--- a/src/test/protocol/STAmount_test.cpp
+++ b/src/test/protocol/STAmount_test.cpp
@@ -537,51 +537,6 @@ public:
     {
         // VFALCO TODO There are no actual tests here, just printed output?
         //             Change this to actually do something.
-
-#if 0
-        beginTestCase ("rounding ");
-
-        std::uint64_t value = 25000000000000000ull;
-        int offset = -14;
-        canonicalizeRound (false, value, offset, true);
-
-        STAmount one (noIssue(), 1);
-        STAmount two (noIssue(), 2);
-        STAmount three (noIssue(), 3);
-
-        STAmount oneThird1 = divRound (one, three, noIssue(), false);
-        STAmount oneThird2 = divide (one, three, noIssue());
-        STAmount oneThird3 = divRound (one, three, noIssue(), true);
-        log << oneThird1;
-        log << oneThird2;
-        log << oneThird3;
-
-        STAmount twoThird1 = divRound (two, three, noIssue(), false);
-        STAmount twoThird2 = divide (two, three, noIssue());
-        STAmount twoThird3 = divRound (two, three, noIssue(), true);
-        log << twoThird1;
-        log << twoThird2;
-        log << twoThird3;
-
-        STAmount oneA = mulRound (oneThird1, three, noIssue(), false);
-        STAmount oneB = multiply (oneThird2, three, noIssue());
-        STAmount oneC = mulRound (oneThird3, three, noIssue(), true);
-        log << oneA;
-        log << oneB;
-        log << oneC;
-
-        STAmount fourThirdsB = twoThird2 + twoThird2;
-        log << fourThirdsA;
-        log << fourThirdsB;
-        log << fourThirdsC;
-
-        STAmount dripTest1 = mulRound (twoThird2, two, xrpIssue (), false);
-        STAmount dripTest2 = multiply (twoThird2, two, xrpIssue ());
-        STAmount dripTest3 = mulRound (twoThird2, two, xrpIssue (), true);
-        log << dripTest1;
-        log << dripTest2;
-        log << dripTest3;
-#endif
     }
 
     void
diff --git a/src/test/rpc/ServerDefinitions_test.cpp b/src/test/rpc/ServerDefinitions_test.cpp
index bf345e6fdf..0cf6b315e0 100644
--- a/src/test/rpc/ServerDefinitions_test.cpp
+++ b/src/test/rpc/ServerDefinitions_test.cpp
@@ -8,6 +8,7 @@
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/jss.h>
 
+#include <algorithm>
 #include <set>
 #include <string>
 
@@ -61,14 +62,12 @@ public:
             // check exception SFields
             {
                 auto const fieldExists = [&](std::string name) {
-                    for (auto& field : result[jss::result][jss::FIELDS])
-                    {
-                        if (field[0u].asString() == name)
-                        {
-                            return true;
-                        }
-                    }
-                    return false;
+                    auto& fields = result[jss::result][jss::FIELDS];
+                    // json::Value is not a std::ranges range, so the iterator form is used.
+                    // NOLINTNEXTLINE(modernize-use-ranges)
+                    return std::any_of(fields.begin(), fields.end(), [&](auto& field) {
+                        return field[0u].asString() == name;
+                    });
                 };
                 BEAST_EXPECT(fieldExists("Generic"));
                 BEAST_EXPECT(fieldExists("Invalid"));
diff --git a/src/test/server/ServerStatus_test.cpp b/src/test/server/ServerStatus_test.cpp
index 4a9c12c96b..60ea622616 100644
--- a/src/test/server/ServerStatus_test.cpp
+++ b/src/test/server/ServerStatus_test.cpp
@@ -202,8 +202,6 @@ class ServerStatus_test : public beast::unit_test::Suite, public beast::test::En
             if (ec)
                 return;
         }
-
-        return;
     }
 
     void
@@ -218,7 +216,6 @@ class ServerStatus_test : public beast::unit_test::Suite, public beast::test::En
         auto ip = env.app().config()[Sections::kPortWs].get<std::string>(Keys::kIp);
         // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
         doRequest(yield, makeWSUpgrade(*ip, *port), *ip, *port, secure, resp, ec);
-        return;
     }
 
     void
@@ -235,7 +232,6 @@ class ServerStatus_test : public beast::unit_test::Suite, public beast::test::En
         auto const ip = env.app().config()[Sections::kPortRpc].get<std::string>(Keys::kIp);
         // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
         doRequest(yield, makeHTTPRequest(*ip, *port, body, fields), *ip, *port, secure, resp, ec);
-        return;
     }
 
     static auto
diff --git a/src/tests/libxrpl/basics/Buffer.cpp b/src/tests/libxrpl/basics/Buffer.cpp
index 5b34585fcf..9cdf610282 100644
--- a/src/tests/libxrpl/basics/Buffer.cpp
+++ b/src/tests/libxrpl/basics/Buffer.cpp
@@ -83,7 +83,7 @@ TEST_F(BufferTest, buffer)
         x = b0;
         EXPECT_EQ(x, b0);
         EXPECT_TRUE(sane(x));
-#if defined(__clang__)
+#ifdef __clang__
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wself-assign-overloaded"
 #endif
@@ -95,7 +95,7 @@ TEST_F(BufferTest, buffer)
         EXPECT_EQ(y, b3);
         EXPECT_TRUE(sane(y));
 
-#if defined(__clang__)
+#ifdef __clang__
 #pragma clang diagnostic pop
 #endif
     }
diff --git a/src/tests/libxrpl/basics/base_uint_test.cpp b/src/tests/libxrpl/basics/base_uint_test.cpp
index 365b43930c..eefbff158d 100644
--- a/src/tests/libxrpl/basics/base_uint_test.cpp
+++ b/src/tests/libxrpl/basics/base_uint_test.cpp
@@ -271,25 +271,6 @@ TEST_F(BaseUintTest, base_uint)
         static_assert(BaseUInt96("000000000000000000000001").signum() == 1);
         static_assert(BaseUInt96("800000000000000000000000").signum() == 1);
 
-// Everything within the #if should fail during compilation.
-#if 0
-            // Too few characters
-            static_assert(BaseUInt96("00000000000000000000000").signum() == 0);
-
-            // Too many characters
-            static_assert(BaseUInt96("0000000000000000000000000").signum() == 0);
-
-            // Non-hex characters
-            static_assert(BaseUInt96("00000000000000000000000 ").signum() == 1);
-            static_assert(BaseUInt96("00000000000000000000000/").signum() == 1);
-            static_assert(BaseUInt96("00000000000000000000000:").signum() == 1);
-            static_assert(BaseUInt96("00000000000000000000000@").signum() == 1);
-            static_assert(BaseUInt96("00000000000000000000000G").signum() == 1);
-            static_assert(BaseUInt96("00000000000000000000000`").signum() == 1);
-            static_assert(BaseUInt96("00000000000000000000000g").signum() == 1);
-            static_assert(BaseUInt96("00000000000000000000000~").signum() == 1);
-#endif  // 0
-
         // Using the constexpr constructor in a non-constexpr context
         // with an error in the parsing throws an exception.
         {
diff --git a/src/xrpld/app/misc/NetworkOPs.cpp b/src/xrpld/app/misc/NetworkOPs.cpp
index 12d63c6210..4b0091dff6 100644
--- a/src/xrpld/app/misc/NetworkOPs.cpp
+++ b/src/xrpld/app/misc/NetworkOPs.cpp
@@ -3819,10 +3819,9 @@ NetworkOPsImp::addAccountHistoryJob(SubAccountHistoryInfoWeak subInfo)
                     return true;
             }
 
-            for (auto& node : meta->getNodes())
-            {
+            return std::ranges::any_of(meta->getNodes(), [&](auto& node) {
                 if (node.getFieldU16(sfLedgerEntryType) != ltACCOUNT_ROOT)
-                    continue;
+                    return false;
 
                 if (node.isFieldPresent(sfNewFields))
                 {
@@ -3836,9 +3835,8 @@ NetworkOPsImp::addAccountHistoryJob(SubAccountHistoryInfoWeak subInfo)
                         }
                     }
                 }
-            }
-
-            return false;
+                return false;
+            });
         };
 
         auto send = [&](json::Value const& jvObj, bool unsubscribe) -> bool {
diff --git a/src/xrpld/app/misc/SHAMapStoreImp.cpp b/src/xrpld/app/misc/SHAMapStoreImp.cpp
index 0e0099cdbf..6167b5d772 100644
--- a/src/xrpld/app/misc/SHAMapStoreImp.cpp
+++ b/src/xrpld/app/misc/SHAMapStoreImp.cpp
@@ -437,15 +437,15 @@ SHAMapStoreImp::dbPaths()
          it != boost::filesystem::directory_iterator();
          ++it)
     {
-        if (state.writableDb.compare(it->path().string()) == 0)
+        if (state.writableDb == it->path().string())
         {
             writableDbExists = true;
         }
-        else if (state.archiveDb.compare(it->path().string()) == 0)
+        else if (state.archiveDb == it->path().string())
         {
             archiveDbExists = true;
         }
-        else if (dbPrefix_.compare(it->path().stem().string()) == 0)
+        else if (dbPrefix_ == it->path().stem().string())
         {
             pathsToDelete.push_back(it->path());
         }
diff --git a/src/xrpld/app/misc/detail/ValidatorSite.cpp b/src/xrpld/app/misc/detail/ValidatorSite.cpp
index 7b51fbd597..73ec3e0d6f 100644
--- a/src/xrpld/app/misc/detail/ValidatorSite.cpp
+++ b/src/xrpld/app/misc/detail/ValidatorSite.cpp
@@ -389,7 +389,7 @@ ValidatorSite::parseJsonResponse(
     json::Value const body = [&res, siteIdx, this]() {
         json::Reader r;
         json::Value body;
-        if (!r.parse(res.data(), body))
+        if (!r.parse(res, body))
         {
             JLOG(j_.warn()) << "Unable to parse JSON response from  "
                             << sites_[siteIdx].activeResource->uri;
diff --git a/src/xrpld/peerfinder/detail/Logic.h b/src/xrpld/peerfinder/detail/Logic.h
index b0047b1ea3..a7dbbf850d 100644
--- a/src/xrpld/peerfinder/detail/Logic.h
+++ b/src/xrpld/peerfinder/detail/Logic.h
@@ -965,12 +965,8 @@ public:
     bool
     fixed(beast::IP::Endpoint const& endpoint) const
     {
-        for (auto const& entry : fixed_)
-        {
-            if (entry.first == endpoint)
-                return true;
-        }
-        return false;
+        return std::ranges::any_of(
+            fixed_, [&endpoint](auto const& entry) { return entry.first == endpoint; });
     }
 
     // Returns `true` if the address matches a fixed slot address
@@ -979,12 +975,8 @@ public:
     bool
     fixed(beast::IP::Address const& address) const
     {
-        for (auto const& entry : fixed_)
-        {
-            if (entry.first.address() == address)
-                return true;
-        }
-        return false;
+        return std::ranges::any_of(
+            fixed_, [&address](auto const& entry) { return entry.first.address() == address; });
     }
 
     //--------------------------------------------------------------------------
diff --git a/src/xrpld/rpc/detail/RPCCall.cpp b/src/xrpld/rpc/detail/RPCCall.cpp
index af5677008d..b5d5c680cd 100644
--- a/src/xrpld/rpc/detail/RPCCall.cpp
+++ b/src/xrpld/rpc/detail/RPCCall.cpp
@@ -569,12 +569,10 @@ private:
         {
             if (jv.size() == 0)
                 return false;
-            for (auto const& j : jv)
-            {
-                if (!isValidJson2(j))
-                    return false;
-            }
-            return true;
+            // json::Value is not a std::ranges range, so the iterator form is used.
+            // NOLINTNEXTLINE(modernize-use-ranges)
+            return std::all_of(
+                jv.begin(), jv.end(), [this](auto const& j) { return isValidJson2(j); });
         }
         if (jv.isObject())
         {
diff --git a/src/xrpld/rpc/handlers/server_info/ServerDefinitions.cpp b/src/xrpld/rpc/handlers/server_info/ServerDefinitions.cpp
index 1e9e0ddc14..cce1b3e07f 100644
--- a/src/xrpld/rpc/handlers/server_info/ServerDefinitions.cpp
+++ b/src/xrpld/rpc/handlers/server_info/ServerDefinitions.cpp
@@ -108,7 +108,7 @@ ServerDefinitions::translate(std::string const& inp)
         if (token.size() > 1)
         {
             boost::algorithm::to_lower(token);
-            token.data()[0] -= ('a' - 'A');
+            token[0] -= ('a' - 'A');
             out += token;
         }
         else

From 73e97b8b843de76ee6810d7a30592022177d8256 Mon Sep 17 00:00:00 2001
From: Alex Kremer <akremer@ripple.com>
Date: Tue, 14 Jul 2026 13:35:04 +0100
Subject: [PATCH 068/100] test: Add JSON array size tests (#7592)

---
 src/test/protocol/STParsedJSON_test.cpp | 191 +++++++++++++++++++++++-
 1 file changed, 189 insertions(+), 2 deletions(-)

diff --git a/src/test/protocol/STParsedJSON_test.cpp b/src/test/protocol/STParsedJSON_test.cpp
index 24981053f5..c2030627c7 100644
--- a/src/test/protocol/STParsedJSON_test.cpp
+++ b/src/test/protocol/STParsedJSON_test.cpp
@@ -19,6 +19,7 @@
 
 #include <algorithm>
 #include <array>
+#include <cstddef>
 #include <cstdint>
 #include <memory>
 #include <stdexcept>
@@ -1979,7 +1980,7 @@ class STParsedJSON_test : public beast::unit_test::Suite
             json::Value j;
             json::Value obj(json::ValueType::Object);
             json::Value* current = &obj;
-            for (int i = 0; i < 63; ++i)
+            for (std::size_t i = 1; i < kMaxParsedJsonDepth; ++i)
             {
                 json::Value const next(json::ValueType::Object);
                 (*current)[sfTransactionMetaData] = next;
@@ -1998,7 +1999,7 @@ class STParsedJSON_test : public beast::unit_test::Suite
             json::Value j;
             json::Value obj(json::ValueType::Object);
             json::Value* current = &obj;
-            for (int i = 0; i < 64; ++i)
+            for (std::size_t i = 1; i <= kMaxParsedJsonDepth; ++i)
             {
                 json::Value const next(json::ValueType::Object);
                 (*current)[sfTransactionMetaData] = next;
@@ -2153,6 +2154,191 @@ class STParsedJSON_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testArrayBoundsChecking()
+    {
+        testcase("Array bounds checking");
+
+        auto const limitStr = std::to_string(kMaxParsedJsonArraySize) + " elements per field.";
+
+        // parseArray rejects oversized STI_ARRAY (SignerEntries)
+        {
+            json::Value jv;
+            json::Value entries(json::ValueType::Array);
+            for (std::size_t i = 0; i <= kMaxParsedJsonArraySize; ++i)
+            {
+                json::Value entry;
+                entry["SignerEntry"]["Account"] = "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh";
+                entry["SignerEntry"]["SignerWeight"] = 1;
+                entries.append(entry);
+            }
+            jv[sfSignerEntries] = entries;
+
+            STParsedJSONObject parsed("test", jv);
+            BEAST_EXPECT(!parsed.object);
+            BEAST_EXPECT(parsed.error[jss::error] == "invalidParams");
+            BEAST_EXPECT(
+                parsed.error[jss::error_message] ==
+                "Field 'test.SignerEntries' exceeds allowed JSON array size of " + limitStr);
+        }
+
+        // parseObject rejects oversized STI_VECTOR256 (Amendments)
+        {
+            json::Value jv;
+            json::Value amendments(json::ValueType::Array);
+            std::string const hash(64, '0');
+            for (std::size_t i = 0; i <= kMaxParsedJsonArraySize; ++i)
+                amendments.append(hash);
+            jv[sfAmendments] = amendments;
+
+            STParsedJSONObject parsed("test", jv);
+            BEAST_EXPECT(!parsed.object);
+            BEAST_EXPECT(parsed.error[jss::error] == "invalidParams");
+            BEAST_EXPECT(
+                parsed.error[jss::error_message] ==
+                "Field 'test.Amendments' exceeds allowed JSON array size of " + limitStr);
+        }
+
+        // parseObject accepts exactly kMaxParsedJsonArraySize STI_VECTOR256 (Amendments)
+        {
+            json::Value jv;
+            json::Value amendments(json::ValueType::Array);
+            std::string const hash(64, '0');
+            for (std::size_t i = 0; i < kMaxParsedJsonArraySize; ++i)
+                amendments.append(hash);
+            jv[sfAmendments] = amendments;
+
+            STParsedJSONObject const parsed("test", jv);
+            BEAST_EXPECT(parsed.object);
+            // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
+            auto const arrSize = parsed.object->getFieldV256(sfAmendments).size();
+            BEAST_EXPECT(arrSize == kMaxParsedJsonArraySize);
+        }
+
+        // parseObject rejects oversized STI_PATHSET (outer array)
+        {
+            json::Value jv;
+            json::Value paths(json::ValueType::Array);
+            for (std::size_t i = 0; i <= kMaxParsedJsonArraySize; ++i)
+            {
+                json::Value path(json::ValueType::Array);
+                json::Value hop;
+                hop["account"] = "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh";
+                path.append(hop);
+                paths.append(path);
+            }
+            jv[sfPaths] = paths;
+
+            STParsedJSONObject parsed("test", jv);
+            BEAST_EXPECT(!parsed.object);
+            BEAST_EXPECT(parsed.error[jss::error] == "invalidParams");
+            BEAST_EXPECT(
+                parsed.error[jss::error_message] ==
+                "Field 'test.Paths' exceeds allowed JSON array size of " + limitStr);
+        }
+
+        // parseObject accepts exactly kMaxParsedJsonArraySize STI_PATHSET (outer array)
+        {
+            json::Value jv;
+            json::Value paths(json::ValueType::Array);
+            for (std::size_t i = 0; i < kMaxParsedJsonArraySize; ++i)
+            {
+                json::Value path(json::ValueType::Array);
+                json::Value hop;
+                hop["account"] = "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh";
+                path.append(hop);
+                paths.append(path);
+            }
+            jv[sfPaths] = paths;
+
+            STParsedJSONObject const parsed("test", jv);
+            BEAST_EXPECT(parsed.object);
+            // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
+            auto const arrSize = parsed.object->getFieldPathSet(sfPaths).size();
+            BEAST_EXPECT(arrSize == kMaxParsedJsonArraySize);
+        }
+
+        // parseObject rejects oversized STI_PATHSET (inner path hop array)
+        {
+            json::Value jv;
+            json::Value paths(json::ValueType::Array);
+            json::Value path(json::ValueType::Array);
+            json::Value hop;
+            hop["account"] = "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh";
+            for (std::size_t i = 0; i <= kMaxParsedJsonArraySize; ++i)
+                path.append(hop);
+            paths.append(path);
+            jv[sfPaths] = paths;
+
+            STParsedJSONObject parsed("test", jv);
+            BEAST_EXPECT(!parsed.object);
+            BEAST_EXPECT(parsed.error[jss::error] == "invalidParams");
+            BEAST_EXPECT(
+                parsed.error[jss::error_message] ==
+                "Field 'test.Paths[0]' exceeds allowed JSON array size of " + limitStr);
+        }
+
+        // parseObject accepts exactly kMaxParsedJsonArraySize hops in a single STI_PATHSET path
+        {
+            json::Value jv;
+            json::Value paths(json::ValueType::Array);
+            json::Value path(json::ValueType::Array);
+            json::Value hop;
+            hop["account"] = "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh";
+            for (std::size_t i = 0; i < kMaxParsedJsonArraySize; ++i)
+                path.append(hop);
+            paths.append(path);
+            jv[sfPaths] = paths;
+
+            STParsedJSONObject const parsed("test", jv);
+            BEAST_EXPECT(parsed.object);
+            // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
+            auto const arrSize = parsed.object->getFieldPathSet(sfPaths)[0].size();
+            BEAST_EXPECT(arrSize == kMaxParsedJsonArraySize);
+        }
+
+        // parseArray accepts exactly kMaxParsedJsonArraySize Memos (boundary)
+        {
+            json::Value jv;
+            json::Value memos(json::ValueType::Array);
+            for (std::size_t i = 0; i < kMaxParsedJsonArraySize; ++i)
+            {
+                json::Value memo;
+                memo["Memo"] = json::Value(json::ValueType::Object);
+                memo["Memo"]["MemoData"] = "00";
+                memos.append(memo);
+            }
+            jv[sfMemos] = memos;
+
+            STParsedJSONObject const parsed("test", jv);
+            BEAST_EXPECT(parsed.object);
+            // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
+            auto const arrSize = parsed.object->getFieldArray(sfMemos).size();
+            BEAST_EXPECT(arrSize == kMaxParsedJsonArraySize);
+        }
+
+        // parseArray rejects one more than kMaxParsedJsonArraySize Memos
+        {
+            json::Value jv;
+            json::Value memos(json::ValueType::Array);
+            for (std::size_t i = 0; i <= kMaxParsedJsonArraySize; ++i)
+            {
+                json::Value memo;
+                memo["Memo"] = json::Value(json::ValueType::Object);
+                memo["Memo"]["MemoData"] = "00";
+                memos.append(memo);
+            }
+            jv[sfMemos] = memos;
+
+            STParsedJSONObject parsed("test", jv);
+            BEAST_EXPECT(!parsed.object);
+            BEAST_EXPECT(parsed.error[jss::error] == "invalidParams");
+            BEAST_EXPECT(
+                parsed.error[jss::error_message] ==
+                "Field 'test.Memos' exceeds allowed JSON array size of " + limitStr);
+        }
+    }
+
     void
     testEdgeCases()
     {
@@ -2420,6 +2606,7 @@ class STParsedJSON_test : public beast::unit_test::Suite
         testNumber();
         testObject();
         testArray();
+        testArrayBoundsChecking();
         testEdgeCases();
     }
 };

From ab3ff66cd9a4360c84849f40bc51f7f0d2c588a6 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:55:34 +0100
Subject: [PATCH 069/100] docs: Add more information about pre-commit hooks and
 how to set them up (#7802)

---
 CONTRIBUTING.md | 85 ++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 70 insertions(+), 15 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index fc93223925..9929b2eb39 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -84,7 +84,9 @@ If you create new source files, they must be organized as follows:
 - All other non-test files must go under `src/xrpld`.
 - All test source files must go under `src/test`.
 
-The source must be formatted according to the style guide below.
+The source must be formatted according to the style guide below. The easiest
+way to satisfy this is to install the [`pre-commit`](#pre-commit-hooks) hooks,
+which format and lint your changes automatically on every commit.
 
 Header includes must be [levelized](.github/scripts/levelization).
 
@@ -212,13 +214,61 @@ This is a non-exhaustive list of recommended style guidelines. These are
 not always strictly enforced and serve as a way to keep the codebase
 coherent rather than a set of _thou shalt not_ commandments.
 
+## Pre-commit hooks
+
+We use the [`pre-commit`](https://pre-commit.com/) framework to run the
+formatting and linting tools that keep the codebase consistent. `pre-commit`
+runs each tool configured in
+[`.pre-commit-config.yaml`](./.pre-commit-config.yaml) in its own isolated
+environment, so you don't need to install most of the individual tools
+yourself. The version of each hook sourced from an external repository
+(`clang-format`, `gersemi`, etc.) is pinned in that file, so running the hooks
+locally uses exactly the same versions as CI. A few `local` hooks — most notably
+`clang-tidy` — run tools from your own environment; see
+[Installing clang-tidy](#installing-clang-tidy) for how to get those.
+
+To get started, install `pre-commit` and enable the git hook scripts:
+
+```bash
+pip install pre-commit
+pre-commit install
+```
+
+Once installed, the hooks run automatically on your staged files every time you
+`git commit`. You can also run them on demand:
+
+```bash
+# Run all hooks against only the staged files
+pre-commit run
+
+# Run all hooks against every file in the repository
+pre-commit run --all-files
+
+# Run a single hook (e.g. clang-format) against all files
+pre-commit run clang-format --all-files
+```
+
+The hooks configured in this repository include, among others:
+
+- `clang-format` — C++/proto formatting (see [Formatting](#formatting))
+- `clang-tidy` — C++ static analysis (see [Clang-tidy](#clang-tidy)); opt in with `TIDY=1`
+- `fix-include-style`, `fix-pragma-once`, `check-doxygen-style` — C++ hygiene
+- `gersemi` — CMake formatting
+- `prettier`, `black`, `shfmt` — formatting for JavaScript/JSON/Markdown, Python, and shell
+- `cspell` — spell checking
+
+The same hooks run in CI on every pull request, so running them locally before
+you push helps you avoid CI failures.
+
 ## Formatting
 
-All code must conform to `clang-format` version 22,
-according to the settings in [`.clang-format`](./.clang-format),
-unless the result would be unreasonably difficult to read or maintain.
-To demarcate lines that should be left as-is, surround them with comments like
-this:
+All code must conform to `clang-format`, according to the settings in
+[`.clang-format`](./.clang-format), unless the result would be unreasonably
+difficult to read or maintain. The `clang-format` version is pinned in
+[`.pre-commit-config.yaml`](./.pre-commit-config.yaml), so the
+[`pre-commit`](#pre-commit-hooks) hook always formats with the same version as
+CI. To demarcate lines that should be left as-is, surround them with comments
+like this:
 
 ```
 // clang-format off
@@ -226,9 +276,21 @@ this:
 // clang-format on
 ```
 
-You can format individual files in place by running `clang-format -i <file>...`
+The easiest way to format your changes is to let the `pre-commit` hook run
+automatically on commit, or to run it manually:
+
+```bash
+pre-commit run clang-format --all-files
+```
+
+You can also format individual files in place by running `clang-format -i <file>...`
 from any directory within this project.
 
+> [!NOTE]
+> This uses whatever `clang-format` version is installed locally, which may
+> differ from the pinned version used by `pre-commit` and CI, so the results
+> can vary.
+
 There is a Continuous Integration job that runs clang-format on pull requests. If the code doesn't comply, a patch file that corrects auto-fixable formatting issues is generated.
 
 To download the patch file:
@@ -239,13 +301,6 @@ To download the patch file:
 4. Download the zip file and extract it to your local git repository. Run `git apply [patch-file-name]`.
 5. Commit and push.
 
-You can install a pre-commit hook to automatically run `clang-format` before every commit:
-
-```
-pip3 install pre-commit
-pre-commit install
-```
-
 ## Clang-tidy
 
 All code must pass `clang-tidy` checks according to the settings in [`.clang-tidy`](./.clang-tidy).
@@ -267,7 +322,7 @@ Before running clang-tidy, you must build the project to generate required files
 
 #### Via pre-commit (recommended)
 
-If you have already installed the pre-commit hooks (see above), you can run clang-tidy on your staged files using:
+If you have already installed the [`pre-commit`](#pre-commit-hooks) hooks, you can run clang-tidy on your staged files using:
 
 ```
 TIDY=1 pre-commit run clang-tidy

From 2e25435a4a16bd8310b62eceae010dd1abb3b12c Mon Sep 17 00:00:00 2001
From: Sergey Kuznetsov <skuznetsov@ripple.com>
Date: Tue, 14 Jul 2026 14:28:55 +0100
Subject: [PATCH 070/100] ci: Add Rust to Nix docker image (#7571)

---
 .cspell.config.yaml                           |  2 +
 .../workflows/reusable-build-test-config.yml  |  2 +-
 bin/check-tools.sh                            | 17 +++++
 nix/docker/Dockerfile                         | 19 +++--
 nix/docker/README.md                          | 21 ++++--
 .../compile-sources.sh}                       |  0
 .../run-binaries.sh}                          |  0
 .../{cpp_sources => cpp/sources}/asan.cpp     |  0
 .../{cpp_sources => cpp/sources}/regular.cpp  |  0
 .../{cpp_sources => cpp/sources}/tsan.cpp     |  0
 .../{cpp_sources => cpp/sources}/ubsan.cpp    |  0
 nix/docker/test_files/rust/compile-sources.sh | 45 +++++++++++
 nix/docker/test_files/rust/run-binaries.sh    | 74 +++++++++++++++++++
 nix/docker/test_files/rust/sources/hello.rs   | 16 ++++
 .../test_files/rust/sources/overflow.rs       | 13 ++++
 nix/docker/test_files/rust/sources/panic.rs   |  5 ++
 nix/packages.nix                              | 10 +++
 17 files changed, 209 insertions(+), 15 deletions(-)
 rename nix/docker/test_files/{compile-cpp-sources.sh => cpp/compile-sources.sh} (100%)
 rename nix/docker/test_files/{run-test-binaries.sh => cpp/run-binaries.sh} (100%)
 rename nix/docker/test_files/{cpp_sources => cpp/sources}/asan.cpp (100%)
 rename nix/docker/test_files/{cpp_sources => cpp/sources}/regular.cpp (100%)
 rename nix/docker/test_files/{cpp_sources => cpp/sources}/tsan.cpp (100%)
 rename nix/docker/test_files/{cpp_sources => cpp/sources}/ubsan.cpp (100%)
 create mode 100755 nix/docker/test_files/rust/compile-sources.sh
 create mode 100755 nix/docker/test_files/rust/run-binaries.sh
 create mode 100644 nix/docker/test_files/rust/sources/hello.rs
 create mode 100644 nix/docker/test_files/rust/sources/overflow.rs
 create mode 100644 nix/docker/test_files/rust/sources/panic.rs

diff --git a/.cspell.config.yaml b/.cspell.config.yaml
index 19b3970865..13da132b90 100644
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -73,6 +73,7 @@ words:
   - citardauq
   - clawback
   - clawbacks
+  - clippy
   - cmaketoolchain
   - coeffs
   - coldwallet
@@ -260,6 +261,7 @@ words:
   - rocksdb
   - Rohrs
   - roundings
+  - rustc
   - sahyadri
   - Satoshi
   - scons
diff --git a/.github/workflows/reusable-build-test-config.yml b/.github/workflows/reusable-build-test-config.yml
index e7a88a0e66..b2327f67ea 100644
--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -124,7 +124,7 @@ jobs:
       - name: Check tools
         env:
           CHECK_TOOLS_SKIP_CLONE: "1"
-        run: ./bin/check-tools.sh
+        run: ./bin/check-tools.sh || true
 
       - name: Print build environment
         uses: XRPLF/actions/print-build-env@59dec886e4afb05a1724443af08baccbc045b574
diff --git a/bin/check-tools.sh b/bin/check-tools.sh
index 808f384d5b..7886bcf8b0 100755
--- a/bin/check-tools.sh
+++ b/bin/check-tools.sh
@@ -110,6 +110,23 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     fi
 fi
 
+# Rust toolchain. Part of the Nix commonPackages, so available on both Linux
+# and macOS. The cargo plugins are invoked through cargo (`cargo <sub>`), which
+# resolves the matching `cargo-<sub>` binary on PATH; `--version` is offline and
+# does not need a Cargo project.
+if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
+    echo
+    echo "Rust toolchain:"
+    check cargo
+    check cargo-audit cargo audit --version
+    check cargo-llvm-cov cargo llvm-cov --version
+    check cargo-nextest cargo nextest --version
+    check clippy clippy-driver --version
+    check rust-analyzer
+    check rustc
+    check rustfmt
+fi
+
 # GCC is the default compiler on Linux. macOS uses the system Apple Clang
 # instead, so GCC/g++/gcov are not expected there.
 if [ "${os}" = "linux" ]; then
diff --git a/nix/docker/Dockerfile b/nix/docker/Dockerfile
index 6d8980f897..7222cc8fa8 100644
--- a/nix/docker/Dockerfile
+++ b/nix/docker/Dockerfile
@@ -75,9 +75,13 @@ COPY bin/check-tools.sh /tmp/check-tools.sh
 RUN /tmp/check-tools.sh
 
 # Sanity-check that the g++/clang++ are able to build binaries, including sanitizer-instrumented ones.
-COPY nix/docker/test_files/cpp_sources/ /tmp/cpp_sources/
-COPY nix/docker/test_files/compile-cpp-sources.sh /tmp/compile-cpp-sources.sh
-RUN /tmp/compile-cpp-sources.sh /tmp/cpp_sources /tmp/bins
+COPY nix/docker/test_files/cpp/ /tmp/test_files/cpp/
+RUN /tmp/test_files/cpp/compile-sources.sh /tmp/test_files/cpp/sources /tmp/cpp-bins
+
+# Sanity-check that rustc is able to build binaries, including ones that rely on
+# the runtime overflow check.
+COPY nix/docker/test_files/rust/ /tmp/test_files/rust/
+RUN /tmp/test_files/rust/compile-sources.sh /tmp/test_files/rust/sources /tmp/rust-bins
 
 # Tester: start from a clean BASE_IMAGE, install sanitizer runtime libraries,
 # and run the compiled test binaries to verify they execute correctly.
@@ -94,15 +98,18 @@ SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
 
 # Sanity-check that the built binaries run correctly in the vanilla base image, with the necessary sanitizer runtime libraries installed.
 COPY bin/install-sanitizer-libs.sh /tmp/install-sanitizer-libs.sh
-COPY nix/docker/test_files/run-test-binaries.sh /tmp/run-test-binaries.sh
-COPY --from=final /tmp/bins /tmp/bins
+COPY nix/docker/test_files/cpp/run-binaries.sh /tmp/test_files/cpp/run-binaries.sh
+COPY nix/docker/test_files/rust/run-binaries.sh /tmp/test_files/rust/run-binaries.sh
+COPY --from=final /tmp/cpp-bins /tmp/cpp-bins
+COPY --from=final /tmp/rust-bins /tmp/rust-bins
 
 RUN <<EOF
 if echo "${BASE_IMAGE}" | grep -qiE 'nixos'; then
     echo "Skipping runnning binaries on NixOS."
 else
     /tmp/install-sanitizer-libs.sh
-    /tmp/run-test-binaries.sh /tmp/bins
+    /tmp/test_files/cpp/run-binaries.sh /tmp/cpp-bins
+    /tmp/test_files/rust/run-binaries.sh /tmp/rust-bins
 fi
 touch /tmp/tests-passed
 EOF
diff --git a/nix/docker/README.md b/nix/docker/README.md
index 085433b758..23ad05049e 100644
--- a/nix/docker/README.md
+++ b/nix/docker/README.md
@@ -42,9 +42,12 @@ work without `ca-certificates` being installed in the base image.
    - installs the dynamic linker if the base image lacks one (see
      [How libc is handled](#how-libc-is-handled)),
    - runs [`bin/check-tools.sh`](../../bin/check-tools.sh) to verify every
-     expected tool is present and runnable, and
+     expected tool is present and runnable.
    - compiles the C++ test programs in
-     [`test_files/`](./test_files) with both `g++` and `clang++`, and sanitizers.
+     [`test_files/cpp/sources/`](./test_files/cpp/sources) with both `g++` and
+     `clang++`, and sanitizers, and
+   - compiles the Rust test programs in
+     [`test_files/rust/sources/`](./test_files/rust/sources) with `rustc`.
 3. **`tester`** — Start again from a clean `BASE_IMAGE` (no Nix toolchain),
    install only the sanitizer runtime libraries
    ([`install-sanitizer-libs.sh`](./install-sanitizer-libs.sh)), and run the
@@ -73,11 +76,12 @@ toolchain being present at runtime. Two pieces make that work:
   [`loader-path.sh`](./loader-path.sh) reports the expected loader path for the
   current architecture, so we can patch the binaries to use the correct loader.
 
-The build then verifies all of this end to end: the test programs in
-`test_files/` (a regular binary plus ASan/TSan/UBSan variants) are compiled in
-`final`, their `PT_INTERP` is patched to the target loader, and they are run in
-the clean `tester` stage to confirm each emits the expected sanitizer
-diagnostic on a stock base image.
+The build then verifies all of this end to end: the C++ test programs in
+`test_files/cpp/sources/` (a regular binary plus ASan/TSan/UBSan variants) and
+the Rust test programs in `test_files/rust/sources/` (a hello binary plus panic
+and overflow-check variants) are compiled in `final`, their `PT_INTERP` is
+patched to the target loader, and they are run in the clean `tester` stage to
+confirm each emits the expected diagnostic on a stock base image.
 
 ## Files
 
@@ -85,6 +89,7 @@ diagnostic on a stock base image.
 | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
 | [`./Dockerfile`](./Dockerfile)                                          | Multi-stage build described above.                                            |
 | [`./loader-path.sh`](./loader-path.sh)                                  | Print the dynamic-linker (`PT_INTERP`) path for the current architecture.     |
-| [`./test_files/`](./test_files)                                         | C++ sources and scripts to compile and run the sanitizer smoke tests.         |
+| [`./test_files/cpp/`](./test_files/cpp)                                 | C++ sanitizer smoke test: sources + compile/run scripts.                      |
+| [`./test_files/rust/`](./test_files/rust)                               | Rust rustc smoke test: sources + compile/run scripts.                         |
 | [`/bin/check-tools.sh`](../../bin/check-tools.sh)                       | Verify every expected tools are present and runnable.                         |
 | [`/bin/install-sanitizer-libs.sh`](../../bin/install-sanitizer-libs.sh) | Install `libasan`/`libtsan`/`libubsan` runtimes on the supported base images. |
diff --git a/nix/docker/test_files/compile-cpp-sources.sh b/nix/docker/test_files/cpp/compile-sources.sh
similarity index 100%
rename from nix/docker/test_files/compile-cpp-sources.sh
rename to nix/docker/test_files/cpp/compile-sources.sh
diff --git a/nix/docker/test_files/run-test-binaries.sh b/nix/docker/test_files/cpp/run-binaries.sh
similarity index 100%
rename from nix/docker/test_files/run-test-binaries.sh
rename to nix/docker/test_files/cpp/run-binaries.sh
diff --git a/nix/docker/test_files/cpp_sources/asan.cpp b/nix/docker/test_files/cpp/sources/asan.cpp
similarity index 100%
rename from nix/docker/test_files/cpp_sources/asan.cpp
rename to nix/docker/test_files/cpp/sources/asan.cpp
diff --git a/nix/docker/test_files/cpp_sources/regular.cpp b/nix/docker/test_files/cpp/sources/regular.cpp
similarity index 100%
rename from nix/docker/test_files/cpp_sources/regular.cpp
rename to nix/docker/test_files/cpp/sources/regular.cpp
diff --git a/nix/docker/test_files/cpp_sources/tsan.cpp b/nix/docker/test_files/cpp/sources/tsan.cpp
similarity index 100%
rename from nix/docker/test_files/cpp_sources/tsan.cpp
rename to nix/docker/test_files/cpp/sources/tsan.cpp
diff --git a/nix/docker/test_files/cpp_sources/ubsan.cpp b/nix/docker/test_files/cpp/sources/ubsan.cpp
similarity index 100%
rename from nix/docker/test_files/cpp_sources/ubsan.cpp
rename to nix/docker/test_files/cpp/sources/ubsan.cpp
diff --git a/nix/docker/test_files/rust/compile-sources.sh b/nix/docker/test_files/rust/compile-sources.sh
new file mode 100755
index 0000000000..5e5ecc0dcb
--- /dev/null
+++ b/nix/docker/test_files/rust/compile-sources.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+# Compile all Rust test binaries during the Docker image build.
+# Each binary has the target system's ELF PT_INTERP (dynamic-linker path)
+# baked in so it can run on the (potentially minimal) final BASE_IMAGE.
+
+set -eo pipefail
+
+src_dir="${1:?usage: $0 <src_dir> <dst_dir>}"
+dst_dir="${2:?usage: $0 <src_dir> <dst_dir>}"
+
+loader="$(/tmp/loader-path.sh)"
+
+mkdir -p "${dst_dir}"
+
+function compile() {
+    local name="${1}"
+    local extra_flags="${2:-}"
+
+    local src="${src_dir}/${name}.rs"
+    local binary="${dst_dir}/${name}"
+
+    echo "=== Compiling ${name} with rustc ==="
+    # -O optimizes (opt-level 2); Rust statically links its own std, so the
+    # only dynamic dependency left is the system glibc (+ libgcc_s), exactly
+    # like the C++ binaries.
+    local compile_cmd="rustc --edition 2021 -O -g ${extra_flags} \
+        ${src} -o ${binary}"
+    echo "Compile cmd: ${compile_cmd}"
+    eval "${compile_cmd}"
+
+    echo "=== Patching ${binary} to use ${loader} as PT_INTERP ==="
+    local patch_cmd="patchelf --set-interpreter ${loader} --remove-rpath ${binary}"
+    echo "Patch cmd: ${patch_cmd}"
+    eval "${patch_cmd}"
+}
+
+# `-O` disables overflow checks by default, so `overflow` re-enables them
+# explicitly to exercise the runtime overflow check.
+compile hello
+compile panic
+compile overflow "-C overflow-checks=on"
+
+echo "=== All binaries compiled ==="
+
+ls -la "${dst_dir}"
diff --git a/nix/docker/test_files/rust/run-binaries.sh b/nix/docker/test_files/rust/run-binaries.sh
new file mode 100755
index 0000000000..b627c12609
--- /dev/null
+++ b/nix/docker/test_files/rust/run-binaries.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+# Run pre-compiled Rust binaries and confirm each emits its expected diagnostic.
+# Binaries must already exist in <bins_dir> as <name> for name in
+# {hello,panic,overflow}.
+
+set -eo pipefail
+
+bins_dir="${1:?usage: $0 <bins_dir>}"
+
+failed_binaries=()
+
+# Run a binary and verify its exit code and output.
+# Usage: run <binary> <expected_output> <expected_rc>
+function run() {
+    local binary="${1}"
+    local expected_output="${2}"
+    local expected_rc="${3}"
+
+    local out_file
+    out_file="$(mktemp)"
+
+    echo "=== Run ${binary} ==="
+    set +e
+    "${binary}" >"${out_file}" 2>&1
+    local rc=$?
+    set -e
+
+    cat "${out_file}"
+
+    local failed=0
+    if [ "${expected_rc}" = "nonzero" ]; then
+        if [ "${rc}" -eq 0 ]; then
+            echo "ERROR: expected non-zero exit code from ${binary}, got ${rc}" >&2
+            failed=1
+        fi
+    elif [ "${rc}" -ne "${expected_rc}" ]; then
+        echo "ERROR: expected exit code ${expected_rc} from ${binary}, got ${rc}" >&2
+        failed=1
+    fi
+
+    if ! grep -q "${expected_output}" "${out_file}"; then
+        echo "ERROR: expected '${expected_output}' from ${binary}" >&2
+        failed=1
+    fi
+
+    if [ "${failed}" -eq 0 ]; then
+        echo "OK: '${expected_output}' detected"
+    else
+        failed_binaries+=("${binary}")
+    fi
+}
+
+declare -A expect=(
+    [hello]="Hello from main thread"
+    [panic]="explicit panic from test"
+    [overflow]="attempt to add with overflow"
+)
+
+for name in hello panic overflow; do
+    binary="${bins_dir}/${name}"
+
+    if [ "${name}" = "hello" ]; then
+        expected_rc=0
+    else
+        expected_rc=nonzero
+    fi
+    run "${binary}" "${expect[$name]}" "${expected_rc}"
+done
+
+if [ "${#failed_binaries[@]}" -gt 0 ]; then
+    echo "ERROR: the following binaries failed:" >&2
+    printf '  %s\n' "${failed_binaries[@]}" >&2
+    exit 1
+fi
diff --git a/nix/docker/test_files/rust/sources/hello.rs b/nix/docker/test_files/rust/sources/hello.rs
new file mode 100644
index 0000000000..78e32c17f3
--- /dev/null
+++ b/nix/docker/test_files/rust/sources/hello.rs
@@ -0,0 +1,16 @@
+use std::thread;
+
+fn main() {
+    const NUM_THREADS: usize = 10;
+    let mut handles = Vec::with_capacity(NUM_THREADS);
+    for id in 0..NUM_THREADS {
+        handles.push(thread::spawn(move || {
+            println!("Hello from thread {id}");
+        }));
+    }
+    for handle in handles {
+        handle.join().expect("worker thread panicked");
+    }
+
+    println!("Hello from main thread");
+}
diff --git a/nix/docker/test_files/rust/sources/overflow.rs b/nix/docker/test_files/rust/sources/overflow.rs
new file mode 100644
index 0000000000..2a4a54472c
--- /dev/null
+++ b/nix/docker/test_files/rust/sources/overflow.rs
@@ -0,0 +1,13 @@
+use std::hint::black_box;
+
+// Rust analogue of the C++ UBSan check: with overflow checks enabled the
+// compiler inserts a runtime check that panics on signed integer overflow.
+// `black_box` keeps the operands opaque so the addition is evaluated at
+// runtime rather than being rejected by the compile-time overflow lint.
+fn main() {
+    let max = black_box(i32::MAX);
+    let one = black_box(1);
+    println!("Current max: {max}");
+    let overflowed = max + one;
+    println!("Overflowed result: {overflowed}");
+}
diff --git a/nix/docker/test_files/rust/sources/panic.rs b/nix/docker/test_files/rust/sources/panic.rs
new file mode 100644
index 0000000000..38779ff515
--- /dev/null
+++ b/nix/docker/test_files/rust/sources/panic.rs
@@ -0,0 +1,5 @@
+fn main() {
+    // Verify the panic runtime works: a panic must print its message to stderr
+    // and exit with a non-zero status (Rust's default panic exit code is 101).
+    panic!("explicit panic from test");
+}
diff --git a/nix/packages.nix b/nix/packages.nix
index bf10ee3712..41d7e97328 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -62,5 +62,15 @@ in
     runClangTidy
     vim
     zip
+    # Rust packages
+    cargo
+    cargo-audit
+    cargo-llvm-cov
+    cargo-nextest
+    clippy
+    corrosion
+    rust-analyzer
+    rustc
+    rustfmt
   ];
 }

From c6211367483db5be0ffb0b9b79f59f1725d5cd3b Mon Sep 17 00:00:00 2001
From: Jingchen <a1q123456@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:29:18 +0100
Subject: [PATCH 071/100] test: Add unit tests for IP address related functions
 (#7744)

Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Ed Hennis <ed@ripple.com>
---
 src/test/beast/IPEndpoint_test.cpp      |   9 +
 src/test/peerfinder/PeerFinder_test.cpp | 259 +++++++++++++++++++++++-
 2 files changed, 267 insertions(+), 1 deletion(-)

diff --git a/src/test/beast/IPEndpoint_test.cpp b/src/test/beast/IPEndpoint_test.cpp
index b1cd4709b4..bc04087891 100644
--- a/src/test/beast/IPEndpoint_test.cpp
+++ b/src/test/beast/IPEndpoint_test.cpp
@@ -305,6 +305,15 @@ public:
         BEAST_EXPECT(!isLoopback(ep));
         BEAST_EXPECTS(to_string(ep) == "fd00::1", to_string(ep));
 
+        // unspecified IPv6 (::)
+        ep = Endpoint(AddressV6{});
+        BEAST_EXPECT(isUnspecified(ep));
+        BEAST_EXPECT(!isPublic(ep));
+        BEAST_EXPECT(!isPrivate(ep));
+        BEAST_EXPECT(!isMulticast(ep));
+        BEAST_EXPECT(!isLoopback(ep));
+        BEAST_EXPECTS(to_string(ep) == "::", to_string(ep));
+
         {
             ep = Endpoint::fromString("192.0.2.112");
             BEAST_EXPECT(!isUnspecified(ep));
diff --git a/src/test/peerfinder/PeerFinder_test.cpp b/src/test/peerfinder/PeerFinder_test.cpp
index c4f129c1a3..cf91800951 100644
--- a/src/test/peerfinder/PeerFinder_test.cpp
+++ b/src/test/peerfinder/PeerFinder_test.cpp
@@ -21,6 +21,7 @@
 #include <optional>
 #include <stdexcept>
 #include <string>
+#include <utility>
 #include <vector>
 
 namespace xrpl::PeerFinder {
@@ -64,8 +65,9 @@ public:
         void
         asyncConnect(beast::IP::Endpoint const& ep, Handler&& handler)
         {
+            // NOLINTNEXTLINE(misc-const-correctness)
             boost::system::error_code ec;
-            handler(ep, ep, ec);
+            handler(ec);
         }
     };
 
@@ -368,6 +370,259 @@ public:
         }
     }
 
+    void
+    testIsValidAddress()
+    {
+        testcase("is_valid_address");
+        TestStore store;
+        TestChecker checker;
+        TestStopwatch clock;
+        Logic<TestChecker> logic(clock, store, checker, journal_);
+
+        auto const pass = [&](std::string const& s) {
+            BEAST_EXPECT(logic.isValidAddress(beast::IP::Endpoint::fromString(s)));
+        };
+        auto const fail = [&](std::string const& s) {
+            BEAST_EXPECT(!logic.isValidAddress(beast::IP::Endpoint::fromString(s)));
+        };
+
+        // Invalid: port 0
+        fail("65.0.0.1:0");
+
+        // --- IPv4 ranges ---
+        // For each range: 1 before (pass), first (fail), last (fail),
+        // 1 after (pass)
+
+        // 0.0.0.0/8 - "This network"
+        // No "before" - nothing before 0.0.0.0
+        fail("0.0.0.0:8080");
+        fail("0.255.255.255:8080");
+        pass("1.0.0.0:8080");
+
+        // 10.0.0.0/8 - Private (RFC 1918)
+        pass("9.255.255.255:8080");
+        fail("10.0.0.0:8080");
+        fail("10.255.255.255:8080");
+        pass("11.0.0.0:8080");
+
+        // 100.64.0.0/10 - Shared Address Space / CGNAT (RFC 6598)
+        pass("100.63.255.255:8080");
+        fail("100.64.0.0:8080");
+        fail("100.127.255.255:8080");
+        pass("100.128.0.0:8080");
+
+        // 127.0.0.0/8 - Loopback
+        pass("126.255.255.255:8080");
+        fail("127.0.0.0:8080");
+        fail("127.255.255.255:8080");
+        pass("128.0.0.0:8080");
+
+        // 169.254.0.0/16 - Link-local
+        pass("169.253.255.255:8080");
+        fail("169.254.0.0:8080");
+        fail("169.254.255.255:8080");
+        pass("169.255.0.0:8080");
+
+        // 172.16.0.0/12 - Private (RFC 1918)
+        pass("172.15.255.255:8080");
+        fail("172.16.0.0:8080");
+        fail("172.31.255.255:8080");
+        pass("172.32.0.0:8080");
+
+        // 192.0.0.0/24 - IETF Protocol Assignments (RFC 6890)
+        pass("191.255.255.255:8080");
+        fail("192.0.0.0:8080");
+        fail("192.0.0.255:8080");
+        pass("192.0.1.0:8080");
+
+        // 192.0.2.0/24 - TEST-NET-1 (RFC 5737)
+        pass("192.0.1.255:8080");
+        fail("192.0.2.0:8080");
+        fail("192.0.2.255:8080");
+        pass("192.0.3.0:8080");
+
+        // 192.88.99.0/24 - 6to4 Relay Anycast (RFC 7526)
+        pass("192.88.98.255:8080");
+        fail("192.88.99.0:8080");
+        fail("192.88.99.255:8080");
+        pass("192.88.100.0:8080");
+
+        // 192.168.0.0/16 - Private (RFC 1918)
+        pass("192.167.255.255:8080");
+        fail("192.168.0.0:8080");
+        fail("192.168.255.255:8080");
+        pass("192.169.0.0:8080");
+
+        // 198.18.0.0/15 - Benchmarking (RFC 2544)
+        pass("198.17.255.255:8080");
+        fail("198.18.0.0:8080");
+        fail("198.19.255.255:8080");
+        pass("198.20.0.0:8080");
+
+        // 198.51.100.0/24 - TEST-NET-2 (RFC 5737)
+        pass("198.51.99.255:8080");
+        fail("198.51.100.0:8080");
+        fail("198.51.100.255:8080");
+        pass("198.51.101.0:8080");
+
+        // 203.0.113.0/24 - TEST-NET-3 (RFC 5737)
+        pass("203.0.112.255:8080");
+        fail("203.0.113.0:8080");
+        fail("203.0.113.255:8080");
+        pass("203.0.114.0:8080");
+
+        // 224.0.0.0/4 - Multicast
+        pass("223.255.255.255:8080");
+        fail("224.0.0.0:8080");
+        fail("239.255.255.255:8080");
+        // 240.0.0.0 (after multicast) is also blocked (reserved)
+
+        // 240.0.0.0/4 - Reserved (RFC 1112)
+        // 239.255.255.255 (before reserved) is also blocked (multicast)
+        fail("240.0.0.0:8080");
+        fail("255.255.255.255:8080");
+
+        // --- IPv6 ranges ---
+
+        // ::1 - Loopback (single address)
+        fail("[::1]:8080");
+
+        // :: - Unspecified (single address)
+        fail("[::]:8080");
+
+        // fc00::/7 - Unique Local Address (ULA)
+        pass("[fb00::1]:8080");
+        fail("[fc00::1]:8080");
+        fail("[fdff::1]:8080");
+        pass("[fe00::1]:8080");
+
+        // fe80::/10 - Link-local
+        pass("[fe7f::1]:8080");
+        fail("[fe80::1]:8080");
+        fail("[febf::1]:8080");
+        pass("[fec0::1]:8080");
+
+        // ff00::/8 - Multicast
+        pass("[feff::1]:8080");
+        fail("[ff00::1]:8080");
+        fail("[ffff::1]:8080");
+        // No "after" - ffff:... is the highest IPv6 range
+
+        // 100::/64 - Discard prefix (RFC 6666)
+        pass("[ff::1]:8080");
+        fail("[100::]:8080");
+        fail("[100::ffff:ffff:ffff:ffff]:8080");
+        pass("[100:0:0:1::1]:8080");
+
+        // 2001::/32 - IETF Protocol Assignments / Teredo (RFC 4380)
+        pass("[2000:ffff::1]:8080");
+        fail("[2001::]:8080");
+        fail("[2001:0:ffff::1]:8080");
+        pass("[2001:1::1]:8080");
+
+        // 2001:20::/28 - ORCHIDv2 (RFC 7343)
+        pass("[2001:1f::1]:8080");
+        fail("[2001:20::1]:8080");
+        fail("[2001:2f::1]:8080");
+        pass("[2001:30::1]:8080");
+
+        // 2001:db8::/32 - Documentation (RFC 3849)
+        pass("[2001:db7::1]:8080");
+        fail("[2001:db8::1]:8080");
+        fail("[2001:db8:ffff::1]:8080");
+        pass("[2001:db9::1]:8080");
+
+        // 2002::/16 - 6to4 (RFC 3056, deprecated)
+        pass("[2001:ffff::1]:8080");
+        fail("[2002::1]:8080");
+        fail("[2002:ffff::1]:8080");
+        pass("[2003::1]:8080");
+
+        // --- IPv6 v4-mapped (delegates to IPv4 checks) ---
+        fail("[::ffff:10.0.0.1]:8080");
+        fail("[::ffff:100.64.0.1]:8080");
+        fail("[::ffff:169.254.1.1]:8080");
+        fail("[::ffff:192.0.2.1]:8080");
+        fail("[::ffff:198.18.0.1]:8080");
+        fail("[::ffff:224.0.0.1]:8080");
+        fail("[::ffff:240.0.0.1]:8080");
+
+        // --- Valid public addresses ---
+        pass("8.8.8.8:443");
+        pass("65.0.0.1:8080");
+        pass("[2001:4860:4860::8888]:8080");
+        pass("[2606:4700:4700::1111]:8080");
+    }
+
+    void
+    testVerifyEndpoints()
+    {
+        // Helper that sets up a Logic instance, creates and activates a slot,
+        // then calls on_endpoints with the given list and returns the
+        // livecache size afterwards.
+        auto run = [&](bool verifyEndpoints, Endpoints eps) -> std::size_t {
+            TestStore store;
+            TestChecker checker;
+            TestStopwatch clock;
+            Logic<TestChecker> logic(clock, store, checker, journal_);
+            {
+                Config c;
+                c.autoConnect = false;
+                c.listeningPort = 1024;
+                c.ipLimit = 2;
+                c.verifyEndpoints = verifyEndpoints;
+                logic.config(c);
+            }
+
+            auto const remote = beast::IP::Endpoint::fromString("65.0.0.1:5");
+            auto const local = beast::IP::Endpoint::fromString("65.0.0.2:1024");
+
+            auto const [slot, r] = logic.newOutboundSlot(remote);
+            BEAST_EXPECT(slot != nullptr);
+            BEAST_EXPECT(r == Result::Success);
+            BEAST_EXPECT(logic.onConnected(slot, local));
+
+            PublicKey const pk(randomKeyPair(KeyType::Secp256k1).first);
+            BEAST_EXPECT(logic.activate(slot, pk, false) == Result::Success);
+
+            logic.onEndpoints(slot, std::move(eps));
+
+            auto const size = logic.livecache.size();
+            logic.onClosed(slot);
+            return size;
+        };
+
+        {
+            testcase("verify_endpoints enabled");
+
+            // Valid public addresses
+            Endpoints eps;
+            eps.emplace_back(beast::IP::Endpoint::fromString("44.0.0.1:5"), 1);
+            eps.emplace_back(beast::IP::Endpoint::fromString("44.0.0.2:6"), 1);
+            // Invalid: private address
+            eps.emplace_back(beast::IP::Endpoint::fromString("10.0.0.1:5"), 1);
+            // Invalid: port 0
+            eps.emplace_back(beast::IP::Endpoint::fromString("44.0.0.3:0"), 1);
+
+            // With verification enabled, only the 2 valid endpoints survive
+            BEAST_EXPECT(run(true, eps) == 2);
+        }
+        {
+            testcase("verify_endpoints disabled");
+
+            Endpoints eps;
+            eps.emplace_back(beast::IP::Endpoint::fromString("44.0.0.1:5"), 1);
+            eps.emplace_back(beast::IP::Endpoint::fromString("44.0.0.2:6"), 1);
+            // Private address — kept when verification is off
+            eps.emplace_back(beast::IP::Endpoint::fromString("10.0.0.1:5"), 1);
+            // Port 0 — kept when verification is off
+            eps.emplace_back(beast::IP::Endpoint::fromString("44.0.0.3:0"), 1);
+
+            // Without verification, all 4 endpoints survive
+            BEAST_EXPECT(run(false, eps) == 4);
+        }
+    }
+
     void
     testOnConnectedSelfConnection()
     {
@@ -524,6 +779,8 @@ public:
         testActivateInboundDisabled();
         testAddFixedPeerNoPort();
         testOnConnectedSelfConnection();
+        testIsValidAddress();
+        testVerifyEndpoints();
     }
 };
 

From 2403670da94eafe8d073111f6fc15f4a796115cf Mon Sep 17 00:00:00 2001
From: Gregory Tsipenyuk <gregtatcam@users.noreply.github.com>
Date: Tue, 14 Jul 2026 10:31:06 -0400
Subject: [PATCH 072/100] fix: Strengthen Clawback invariant checks for MPT
 balances (#7285)

---
 include/xrpl/tx/invariants/InvariantCheck.h  |  17 +-
 include/xrpl/tx/invariants/MPTInvariant.h    |   2 +-
 src/libxrpl/tx/invariants/InvariantCheck.cpp | 149 +++++-
 src/libxrpl/tx/invariants/MPTInvariant.cpp   |   4 +-
 src/test/app/Invariants_test.cpp             | 519 +++++++++++++++++++
 5 files changed, 666 insertions(+), 25 deletions(-)

diff --git a/include/xrpl/tx/invariants/InvariantCheck.h b/include/xrpl/tx/invariants/InvariantCheck.h
index bb51105de2..150c0ed510 100644
--- a/include/xrpl/tx/invariants/InvariantCheck.h
+++ b/include/xrpl/tx/invariants/InvariantCheck.h
@@ -316,17 +316,26 @@ public:
 };
 
 /**
- * @brief Invariant: Token holder's trustline balance cannot be negative after
- * Clawback.
+ * @brief Invariant: Token holder's trustline/MPT balance cannot be invalid
+ * after Clawback.
  *
  * We iterate all the trust lines affected by this transaction and ensure
  * that no more than one trustline is modified, and also holder's balance is
- * non-negative.
+ * non-negative. When featureMPTokensV2 is enabled, also verify the holder's
+ * raw trustline/MPToken balance decreased by the clawed amount.
  */
 class ValidClawback
 {
+    struct EntryChange
+    {
+        SLE::const_pointer before;
+        SLE::const_pointer after;
+    };
+
     std::uint32_t trustlinesChanged_ = 0;
     std::uint32_t mptokensChanged_ = 0;
+    EntryChange iou_;
+    EntryChange mpt_;
 
 public:
     void
@@ -440,7 +449,7 @@ using InvariantChecks = std::tuple<
     ValidLoan,
     ValidVault,
     ValidConfidentialMPToken,
-    ValidMPTPayment,
+    ValidMPTBalanceChanges,
     ValidAmounts,
     ValidMPTTransfer,
     ObjectHasPseudoAccount,
diff --git a/include/xrpl/tx/invariants/MPTInvariant.h b/include/xrpl/tx/invariants/MPTInvariant.h
index 9a546fa400..5740cd5be2 100644
--- a/include/xrpl/tx/invariants/MPTInvariant.h
+++ b/include/xrpl/tx/invariants/MPTInvariant.h
@@ -87,7 +87,7 @@ public:
  * OutstandingAmount after application equals OutstandingAmount before
  * application plus the net holder balance delta.
  */
-class ValidMPTPayment
+class ValidMPTBalanceChanges
 {
     enum class Order { Before = 0, After = 1 };
     struct MPTData
diff --git a/src/libxrpl/tx/invariants/InvariantCheck.cpp b/src/libxrpl/tx/invariants/InvariantCheck.cpp
index 220a7a8e41..1032644132 100644
--- a/src/libxrpl/tx/invariants/InvariantCheck.cpp
+++ b/src/libxrpl/tx/invariants/InvariantCheck.cpp
@@ -799,14 +799,49 @@ ValidNewAccountRoot::finalize(
 
 //------------------------------------------------------------------------------
 
+static std::optional<STAmount>
+clawbackTrustLineBalanceInHolderTerms(
+    SLE::const_pointer const& sle,
+    AccountID const& holder,
+    AccountID const& issuer,
+    Currency const& currency)
+{
+    if (!sle)
+        return STAmount{Issue{currency, issuer}};
+
+    if (sle->getType() != ltRIPPLE_STATE ||
+        sle->key() != keylet::trustLine(holder, issuer, currency).key)
+    {
+        return std::nullopt;
+    }
+
+    STAmount balance = sle->getFieldAmount(sfBalance);
+    if (holder > issuer)
+        balance.negate();
+    balance.get<Issue>().account = issuer;
+    return balance;
+}
+
 void
-ValidClawback::visitEntry(bool, SLE::const_ref before, SLE::const_ref)
+ValidClawback::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after)
 {
     if (before && before->getType() == ltRIPPLE_STATE)
+    {
         trustlinesChanged_++;
+        iou_.before = before;
+    }
+
+    if (!isDelete && after && after->getType() == ltRIPPLE_STATE)
+        iou_.after = after;
 
     if (before && before->getType() == ltMPTOKEN)
+    {
         mptokensChanged_++;
+        mpt_.before = before;
+    }
+
+    if (!isDelete && after && after->getType() == ltMPTOKEN)
+        mpt_.after = after;
 }
 
 bool
@@ -835,31 +870,109 @@ ValidClawback::finalize(
         }
 
         bool const mptV2Enabled = view.rules().enabled(featureMPTokensV2);
+        if (trustlinesChanged_ != 0 && mptokensChanged_ != 0)
+        {
+            JLOG(j.fatal()) << "Invariant failed: trustline and MPToken both changed.";
+            if (mptV2Enabled)
+                return false;
+        }
+
         if (trustlinesChanged_ == 1 || (mptV2Enabled && mptokensChanged_ == 1))
         {
-            AccountID const issuer = tx.getAccountID(sfAccount);
             STAmount const& amount = tx.getFieldAmount(sfAmount);
-            AccountID const& holder = amount.getIssuer();
-            STAmount const holderBalance = amount.asset().visit(
+
+            return amount.asset().visit(
                 [&](Issue const& issue) {
-                    return accountHolds(
+                    AccountID const issuer = tx.getAccountID(sfAccount);
+                    AccountID const& holder = amount.getIssuer();
+                    STAmount const holderBalance = accountHolds(
                         view, holder, issue.currency, issuer, FreezeHandling::IgnoreFreeze, j);
+
+                    if (holderBalance.signum() < 0)
+                    {
+                        JLOG(j.fatal()) << "Invariant failed: trustline or MPT balance is negative";
+                        return false;
+                    }
+
+                    if (!iou_.before)
+                    {
+                        JLOG(j.fatal())
+                            << "Invariant failed: trustline clawback changed the wrong line";
+                        return !mptV2Enabled;
+                    }
+
+                    auto const beforeBalance = clawbackTrustLineBalanceInHolderTerms(
+                        iou_.before, holder, issuer, issue.currency);
+                    auto const afterBalance = clawbackTrustLineBalanceInHolderTerms(
+                        iou_.after, holder, issuer, issue.currency);
+                    if (!beforeBalance || !afterBalance)
+                    {
+                        JLOG(j.fatal())
+                            << "Invariant failed: trustline clawback changed the wrong line";
+                        return !mptV2Enabled;
+                    }
+
+                    STAmount clawAmount = amount;
+                    clawAmount.get<Issue>().account = issuer;
+                    if (clawAmount <= beast::kZero)
+                    {
+                        JLOG(j.fatal()) << "Invariant failed: trustline clawback amount is invalid";
+                        return !mptV2Enabled;
+                    }
+
+                    if (*afterBalance > *beforeBalance ||
+                        (*beforeBalance - *afterBalance) != std::min(*beforeBalance, clawAmount))
+                    {
+                        JLOG(j.fatal())
+                            << "Invariant failed: trustline clawback balance change is invalid";
+                        return !mptV2Enabled;
+                    }
+
+                    return true;
                 },
                 [&](MPTIssue const& issue) {
-                    return accountHolds(
-                        view,
-                        holder,
-                        issue,
-                        FreezeHandling::IgnoreFreeze,
-                        AuthHandling::IgnoreAuth,
-                        j);
-                });
+                    auto const holder = tx[~sfHolder];
+                    if (!holder)
+                    {
+                        JLOG(j.fatal()) << "Invariant failed: MPT clawback missing holder";
+                        return !mptV2Enabled;
+                    }
 
-            if (holderBalance.signum() < 0)
-            {
-                JLOG(j.fatal()) << "Invariant failed: trustline or MPT balance is negative";
-                return false;
-            }
+                    if (!mpt_.before || !mpt_.after)
+                    {
+                        JLOG(j.fatal()) << "Invariant failed: MPT clawback token is missing";
+                        return !mptV2Enabled;
+                    }
+
+                    if (mpt_.before->getAccountID(sfAccount) != *holder ||
+                        mpt_.after->getAccountID(sfAccount) != *holder ||
+                        (*mpt_.before)[sfMPTokenIssuanceID] != issue.getMptID() ||
+                        (*mpt_.after)[sfMPTokenIssuanceID] != issue.getMptID())
+                    {
+                        JLOG(j.fatal()) << "Invariant failed: MPT clawback changed the wrong token";
+                        return !mptV2Enabled;
+                    }
+
+                    auto const before = mpt_.before->getFieldU64(sfMPTAmount);
+                    auto const after = mpt_.after->getFieldU64(sfMPTAmount);
+                    if (amount.negative() || amount.mantissa() == 0)
+                    {
+                        JLOG(j.fatal()) << "Invariant failed: MPT clawback amount is invalid";
+                        return !mptV2Enabled;
+                    }
+                    auto const clawAmount = amount.mantissa();
+
+                    // MPT balances are unsigned, so validate the raw holder
+                    // debit instead of routing through accountHolds().
+                    if (after > before || (before - after) != std::min(before, clawAmount))
+                    {
+                        JLOG(j.fatal())
+                            << "Invariant failed: MPT clawback balance change is invalid";
+                        return !mptV2Enabled;
+                    }
+
+                    return true;
+                });
         }
     }
     else
diff --git a/src/libxrpl/tx/invariants/MPTInvariant.cpp b/src/libxrpl/tx/invariants/MPTInvariant.cpp
index d8f7fcc27d..77c5ad781e 100644
--- a/src/libxrpl/tx/invariants/MPTInvariant.cpp
+++ b/src/libxrpl/tx/invariants/MPTInvariant.cpp
@@ -403,7 +403,7 @@ ValidMPTIssuance::finalize(
 }
 
 void
-ValidMPTPayment::visitEntry(bool, SLE::const_ref before, SLE::const_ref after)
+ValidMPTBalanceChanges::visitEntry(bool, SLE::const_ref before, SLE::const_ref after)
 {
     if (overflow_)
         return;
@@ -465,7 +465,7 @@ ValidMPTPayment::visitEntry(bool, SLE::const_ref before, SLE::const_ref after)
 }
 
 bool
-ValidMPTPayment::finalize(
+ValidMPTBalanceChanges::finalize(
     STTx const& tx,
     TER const result,
     XRPAmount const,
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 569eecb27b..9c90ade72f 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -4441,6 +4441,525 @@ class Invariants_test : public beast::unit_test::Suite
                 return true;
             });
 
+        // Invalid IOU clawback delta must fail once MPTokensV2 enforces before/after validation.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            auto const usd = issuer["USD"];
+            env.trust(usd(100), holder);
+            env(pay(issuer, holder, usd(100)));
+            env.close();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: trustline clawback balance change is invalid"}},
+                [issuer, usd](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto sle =
+                        ac.view().peek(keylet::trustLine(holder.id(), issuer.id(), usd.currency));
+                    if (!sle)
+                        return false;
+
+                    STAmount balance{Issue{usd.currency, issuer.id()}, 80};
+                    if (holder.id() > issuer.id())
+                        balance.negate();
+                    sle->setFieldAmount(sfBalance, balance);
+                    ac.view().update(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfAmount] = STAmount{Issue{usd.currency, holder.id()}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // Full IOU clawback may delete the trustline; missing after-SLE represents zero balance.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            auto const usd = issuer["USD"];
+            env.trust(usd(100), holder);
+            env(pay(issuer, holder, usd(100)));
+            env.close();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {},
+                [issuer, usd](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto const sle =
+                        ac.view().peek(keylet::trustLine(holder.id(), issuer.id(), usd.currency));
+                    if (!sle)
+                        return false;
+
+                    ac.view().erase(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfAmount] = STAmount{Issue{usd.currency, holder.id()}, 100};
+                    }},
+                {tesSUCCESS, tesSUCCESS});
+        }
+
+        // Pre-MPTokensV2 invalid IOU clawback delta logs but remains non-enforcing.
+        {
+            Env env(*this, defaultAmendments() - featureMPTokensV2);
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            auto const usd = issuer["USD"];
+            env.trust(usd(100), holder);
+            env(pay(issuer, holder, usd(100)));
+            env.close();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: trustline clawback balance change is invalid"}},
+                [issuer, usd](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto sle =
+                        ac.view().peek(keylet::trustLine(holder.id(), issuer.id(), usd.currency));
+                    if (!sle)
+                        return false;
+
+                    STAmount balance{Issue{usd.currency, issuer.id()}, 80};
+                    if (holder.id() > issuer.id())
+                        balance.negate();
+                    sle->setFieldAmount(sfBalance, balance);
+                    ac.view().update(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfAmount] = STAmount{Issue{usd.currency, holder.id()}, 10};
+                    }},
+                {tesSUCCESS, tesSUCCESS});
+        }
+
+        // Invalid MPT clawback delta must fail when raw MPToken debit mismatches sfAmount.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            MPTTester const mpt(
+                {.env = env, .issuer = issuer, .holders = {holder}, .pay = 100, .maxAmt = 100});
+            auto const id = mpt.issuanceID();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: MPT clawback balance change is invalid"}},
+                [id](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto const sleToken = ac.view().peek(keylet::mptoken(id, holder));
+                    auto const sleIssuance = ac.view().peek(keylet::mptokenIssuance(id));
+                    if (!sleToken || !sleIssuance)
+                        return false;
+
+                    sleToken->setFieldU64(sfMPTAmount, 80);
+                    sleIssuance->setFieldU64(sfOutstandingAmount, 80);
+                    ac.view().update(sleToken);
+                    ac.view().update(sleIssuance);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfHolder] = holder.id();
+                        tx[sfAmount] = STAmount{MPTIssue{id}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // A clawback that mutates both IOU and MPT entries must fail under MPTokensV2.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            auto const usd = issuer["USD"];
+            env.trust(usd(100), holder);
+            env(pay(issuer, holder, usd(100)));
+            MPTTester const mpt(
+                {.env = env, .issuer = issuer, .holders = {holder}, .pay = 100, .maxAmt = 100});
+            auto const id = mpt.issuanceID();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: trustline and MPToken both changed"}},
+                [issuer, usd, id](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto const sleLine =
+                        ac.view().peek(keylet::trustLine(holder.id(), issuer.id(), usd.currency));
+                    auto const sleToken = ac.view().peek(keylet::mptoken(id, holder.id()));
+                    auto const sleIssuance = ac.view().peek(keylet::mptokenIssuance(id));
+                    if (!sleLine || !sleToken || !sleIssuance)
+                        return false;
+
+                    STAmount balance{Issue{usd.currency, issuer.id()}, 90};
+                    if (holder.id() > issuer.id())
+                        balance.negate();
+                    sleLine->setFieldAmount(sfBalance, balance);
+                    sleToken->setFieldU64(sfMPTAmount, 90);
+                    sleIssuance->setFieldU64(sfOutstandingAmount, 90);
+                    ac.view().update(sleLine);
+                    ac.view().update(sleToken);
+                    ac.view().update(sleIssuance);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfHolder] = holder.id();
+                        tx[sfAmount] = STAmount{MPTIssue{id}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // Clawback that modifies a trustline other than the one implied by the
+        // tx amount: clawbackTrustLineBalanceInHolderTerms returns nullopt for
+        // the mismatched line.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            auto const usd = issuer["USD"];
+            auto const eur = issuer["EUR"];
+            env.trust(eur(100), holder);
+            env(pay(issuer, holder, eur(100)));
+            env.close();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: trustline clawback changed the wrong line"}},
+                [issuer, eur](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto sle =
+                        ac.view().peek(keylet::trustLine(holder.id(), issuer.id(), eur.currency));
+                    if (!sle)
+                        return false;
+                    STAmount balance{Issue{eur.currency, issuer.id()}, 90};
+                    if (holder.id() > issuer.id())
+                        balance.negate();
+                    sle->setFieldAmount(sfBalance, balance);
+                    ac.view().update(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfAmount] = STAmount{Issue{usd.currency, holder.id()}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // Clawback leaving the holder's balance negative.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            auto const usd = issuer["USD"];
+            env.trust(usd(100), holder);
+            env(pay(issuer, holder, usd(100)));
+            env.close();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: trustline or MPT balance is negative"}},
+                [issuer, usd](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto sle =
+                        ac.view().peek(keylet::trustLine(holder.id(), issuer.id(), usd.currency));
+                    if (!sle)
+                        return false;
+                    // Make the holder's balance negative from their perspective.
+                    STAmount balance{Issue{usd.currency, issuer.id()}, 80};
+                    if (holder.id() < issuer.id())
+                        balance.negate();
+                    sle->setFieldAmount(sfBalance, balance);
+                    ac.view().update(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfAmount] = STAmount{Issue{usd.currency, holder.id()}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // IOU-amount clawback while only an MPToken changed: no trustline was
+        // recorded, so iou_.before is empty.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            auto const usd = issuer["USD"];
+            MPTTester const mpt(
+                {.env = env, .issuer = issuer, .holders = {holder}, .pay = 100, .maxAmt = 100});
+            auto const id = mpt.issuanceID();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: trustline clawback changed the wrong line"}},
+                [id](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto const sleToken = ac.view().peek(keylet::mptoken(id, holder));
+                    auto const sleIssuance = ac.view().peek(keylet::mptokenIssuance(id));
+                    if (!sleToken || !sleIssuance)
+                        return false;
+                    sleToken->setFieldU64(sfMPTAmount, 90);
+                    sleIssuance->setFieldU64(sfOutstandingAmount, 90);
+                    ac.view().update(sleToken);
+                    ac.view().update(sleIssuance);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfAmount] = STAmount{Issue{usd.currency, holder.id()}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // Valid trustline change but a zero clawback amount.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            auto const usd = issuer["USD"];
+            env.trust(usd(100), holder);
+            env(pay(issuer, holder, usd(100)));
+            env.close();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: trustline clawback amount is invalid"}},
+                [issuer, usd](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto sle =
+                        ac.view().peek(keylet::trustLine(holder.id(), issuer.id(), usd.currency));
+                    if (!sle)
+                        return false;
+                    STAmount balance{Issue{usd.currency, issuer.id()}, 90};
+                    if (holder.id() > issuer.id())
+                        balance.negate();
+                    sle->setFieldAmount(sfBalance, balance);
+                    ac.view().update(sle);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfAmount] = STAmount{Issue{usd.currency, holder.id()}, 0};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // MPT clawback tx missing the Holder field.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            MPTTester const mpt(
+                {.env = env, .issuer = issuer, .holders = {holder}, .pay = 100, .maxAmt = 100});
+            auto const id = mpt.issuanceID();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: MPT clawback missing holder"}},
+                [id](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto const sleToken = ac.view().peek(keylet::mptoken(id, holder));
+                    auto const sleIssuance = ac.view().peek(keylet::mptokenIssuance(id));
+                    if (!sleToken || !sleIssuance)
+                        return false;
+                    sleToken->setFieldU64(sfMPTAmount, 90);
+                    sleIssuance->setFieldU64(sfOutstandingAmount, 90);
+                    ac.view().update(sleToken);
+                    ac.view().update(sleIssuance);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfAmount] = STAmount{MPTIssue{id}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // MPT clawback where the holder's MPToken was deleted (after is empty).
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            MPTTester const mpt(
+                {.env = env, .issuer = issuer, .holders = {holder}, .pay = 100, .maxAmt = 100});
+            auto const id = mpt.issuanceID();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: MPT clawback token is missing"}},
+                [id](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto const sleToken = ac.view().peek(keylet::mptoken(id, holder));
+                    auto const sleIssuance = ac.view().peek(keylet::mptokenIssuance(id));
+                    if (!sleToken || !sleIssuance)
+                        return false;
+                    // Keep the issuance consistent after removing the token.
+                    sleIssuance->setFieldU64(sfOutstandingAmount, 0);
+                    ac.view().update(sleIssuance);
+                    ac.view().erase(sleToken);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfHolder] = holder.id();
+                        tx[sfAmount] = STAmount{MPTIssue{id}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // MPT clawback that changed a different holder's MPToken.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            MPTTester const mpt(
+                {.env = env,
+                 .issuer = issuer,
+                 .holders = {holder, other},
+                 .pay = 100,
+                 .maxAmt = 200});
+            auto const id = mpt.issuanceID();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: MPT clawback changed the wrong token"}},
+                [id](Account const&, Account const& other, ApplyContext& ac) {
+                    auto const sleToken = ac.view().peek(keylet::mptoken(id, other));
+                    auto const sleIssuance = ac.view().peek(keylet::mptokenIssuance(id));
+                    if (!sleToken || !sleIssuance)
+                        return false;
+                    sleToken->setFieldU64(sfMPTAmount, 90);
+                    sleIssuance->setFieldU64(sfOutstandingAmount, 190);
+                    ac.view().update(sleToken);
+                    ac.view().update(sleIssuance);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfHolder] = holder.id();
+                        tx[sfAmount] = STAmount{MPTIssue{id}, 10};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
+        // Valid MPToken change but a zero MPT clawback amount.
+        {
+            Env env(*this, defaultAmendments());
+            Account const issuer{"issuer"};
+            Account const holder{"holder"};
+            Account const other{"other"};
+            env.fund(XRP(1'000), issuer, holder, other);
+            MPTTester const mpt(
+                {.env = env, .issuer = issuer, .holders = {holder}, .pay = 100, .maxAmt = 100});
+            auto const id = mpt.issuanceID();
+
+            doInvariantCheck(
+                std::move(env),
+                holder,
+                other,
+                {{"Invariant failed: MPT clawback amount is invalid"}},
+                [id](Account const& holder, Account const&, ApplyContext& ac) {
+                    auto const sleToken = ac.view().peek(keylet::mptoken(id, holder));
+                    auto const sleIssuance = ac.view().peek(keylet::mptokenIssuance(id));
+                    if (!sleToken || !sleIssuance)
+                        return false;
+                    sleToken->setFieldU64(sfMPTAmount, 90);
+                    sleIssuance->setFieldU64(sfOutstandingAmount, 90);
+                    ac.view().update(sleToken);
+                    ac.view().update(sleIssuance);
+                    return true;
+                },
+                XRPAmount{},
+                STTx{
+                    ttCLAWBACK,
+                    [&](STObject& tx) {
+                        tx[sfAccount] = issuer.id();
+                        tx[sfHolder] = holder.id();
+                        tx[sfAmount] = STAmount{MPTIssue{id}, 0};
+                    }},
+                {tecINVARIANT_FAILED, tefINVARIANT_FAILED});
+        }
+
         // More MPTokens created than expected
         std::array<std::pair<xrpl::TxType, std::uint8_t>, 4> const tests = {
             std::make_pair(ttAMM_WITHDRAW, 2),

From 0dc942508e207dc78292ac95ee092ca85a147e54 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 14 Jul 2026 17:09:20 +0100
Subject: [PATCH 073/100] ci: Run full matrix only on `Ready to merge` or `Full
 CI build` labeled PRs (#7689)

Co-authored-by: Bart <bthomee@users.noreply.github.com>
---
 .github/scripts/strategy-matrix/generate.py   | 62 +++++++------------
 .github/scripts/strategy-matrix/linux.json    | 31 ++++++++--
 .github/scripts/strategy-matrix/macos.json    |  5 +-
 .github/scripts/strategy-matrix/windows.json  |  4 +-
 .github/workflows/on-pr.yml                   | 55 +++++++++++++---
 .../workflows/reusable-strategy-matrix.yml    |  7 ++-
 6 files changed, 104 insertions(+), 60 deletions(-)

diff --git a/.github/scripts/strategy-matrix/generate.py b/.github/scripts/strategy-matrix/generate.py
index a269cb25d4..c783f32fb7 100755
--- a/.github/scripts/strategy-matrix/generate.py
+++ b/.github/scripts/strategy-matrix/generate.py
@@ -25,24 +25,16 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
     return " ".join(args)
 
 
-def runs_on_event(exclude_event_types: list[str], event: str | None) -> bool:
-    """Whether a config should run for the current event.
-
-    'exclude_event_types' is a list of GitHub event names (e.g.
-    ["pull_request"]) on which the config should NOT run; an empty list means
-    the config runs on every event. When no event is given (event is None), no
-    filtering is applied.
-    """
-    if event is None:
-        return True
-    return event not in exclude_event_types
-
-
 # ---------------------------------------------------------------------------
 # Input types — shapes of the JSON config files
 # ---------------------------------------------------------------------------
 
 
+# Every config must declare 'minimal'. Minimal configs form the reduced matrix
+# built for pull requests by default; the full matrix adds the rest. Packaging
+# configs declare it too, but packaging is gated in the workflow, not by it.
+
+
 @dataclasses.dataclass
 class LinuxConfig:
     """One entry in linux.json's 'configs' or 'package_configs' arrays."""
@@ -50,13 +42,11 @@ class LinuxConfig:
     compiler: list[str]
     build_type: list[str]
     arch: list[str]
+    minimal: bool
     sanitizers: list[str] = dataclasses.field(default_factory=list)
     suffix: str = ""
     extra_cmake_args: str = ""
     image: str = ""  # only used by package_configs entries
-    # List of GitHub event names (e.g. "pull_request") on which this config
-    # should NOT run. Empty means it runs on every event.
-    exclude_event_types: list[str] = dataclasses.field(default_factory=list)
 
 
 @dataclasses.dataclass
@@ -89,11 +79,9 @@ class PlatformConfig:
     """One entry in macos.json's or windows.json's 'configs' array."""
 
     build_type: list[str]
+    minimal: bool
     build_only: bool = False  # if true, skip tests (e.g. macos/Windows Debug)
     extra_cmake_args: str = ""
-    # List of GitHub event names (e.g. "pull_request") on which this config
-    # should NOT run. Empty means it runs on every event.
-    exclude_event_types: list[str] = dataclasses.field(default_factory=list)
 
     def __post_init__(self) -> None:
         if isinstance(self.build_type, str):
@@ -168,20 +156,18 @@ _ARCHS: dict[str, Architecture] = {
 }
 
 
-def expand_linux_matrix(
-    linux: LinuxFile, event: str | None = None
-) -> list[MatrixEntry]:
+def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
     """Expand a LinuxFile into a flat list of matrix entries.
 
     Each config entry is expanded over the cross-product of its
-    compiler, build_type, sanitizers, and architecture lists. Configs that
-    exclude the current event are skipped.
+    compiler, build_type, sanitizers, and architecture lists. When 'minimal' is
+    true, only configs flagged as minimal are included.
     """
     entries: list[MatrixEntry] = []
 
     for distro, configs in linux.configs.items():
         for cfg in configs:
-            if not runs_on_event(cfg.exclude_event_types, event):
+            if minimal and not cfg.minimal:
                 continue
             # An empty sanitizers list means "one entry with no sanitizer".
             effective_sanitizers = cfg.sanitizers or [""]
@@ -240,19 +226,17 @@ def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
     return entries
 
 
-def expand_platform_matrix(
-    pf: PlatformFile, event: str | None = None
-) -> list[MatrixEntry]:
+def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]:
     """Expand a PlatformFile (macOS or Windows) into matrix entries.
 
-    Configs that exclude the current event are skipped.
+    When 'minimal' is true, only configs flagged as minimal are included.
     """
     platform_name, arch = pf.platform.split("/")
     is_windows = platform_name == "windows"
 
     entries: list[MatrixEntry] = []
     for cfg in pf.configs:
-        if not runs_on_event(cfg.exclude_event_types, event):
+        if minimal and not cfg.minimal:
             continue
         for build_type in cfg.build_type:
             entries.append(
@@ -292,12 +276,12 @@ if __name__ == "__main__":
         action="store_true",
     )
     parser.add_argument(
-        "-e",
-        "--event",
-        help="The GitHub event name that triggered the workflow (e.g. 'push', "
-        "'pull_request'). Configs are filtered by their 'event_type'. If "
-        "omitted, no filtering is applied.",
-        default=None,
+        "-m",
+        "--minimal",
+        help="Emit only the minimal matrix (the configs flagged 'minimal'), "
+        "used for pull requests by default. If omitted, the full matrix is "
+        "emitted.",
+        action="store_true",
     )
     args = parser.parse_args()
 
@@ -308,15 +292,15 @@ if __name__ == "__main__":
     else:
         if args.config in ("linux", None):
             matrix += expand_linux_matrix(
-                LinuxFile.load(THIS_DIR / "linux.json"), args.event
+                LinuxFile.load(THIS_DIR / "linux.json"), args.minimal
             )
         if args.config in ("macos", None):
             matrix += expand_platform_matrix(
-                PlatformFile.load(THIS_DIR / "macos.json"), args.event
+                PlatformFile.load(THIS_DIR / "macos.json"), args.minimal
             )
         if args.config in ("windows", None):
             matrix += expand_platform_matrix(
-                PlatformFile.load(THIS_DIR / "windows.json"), args.event
+                PlatformFile.load(THIS_DIR / "windows.json"), args.minimal
             )
 
     print(f"matrix={json.dumps({'include': [dataclasses.asdict(e) for e in matrix]})}")
diff --git a/.github/scripts/strategy-matrix/linux.json b/.github/scripts/strategy-matrix/linux.json
index 863b910dda..03ac1c6334 100644
--- a/.github/scripts/strategy-matrix/linux.json
+++ b/.github/scripts/strategy-matrix/linux.json
@@ -2,16 +2,30 @@
   "image_tag": "sha-e29b523",
   "configs": {
     "ubuntu": [
+      {
+        "compiler": ["clang"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": true
+      },
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false
+      },
       {
         "compiler": ["gcc", "clang"],
         "build_type": ["Debug", "Release"],
-        "arch": ["amd64", "arm64"]
+        "arch": ["arm64"],
+        "minimal": false
       },
 
       {
         "compiler": ["gcc", "clang"],
         "build_type": ["Debug", "Release"],
         "arch": ["amd64"],
+        "minimal": false,
         "sanitizers": ["address", "undefinedbehavior"]
       },
 
@@ -19,6 +33,7 @@
         "compiler": ["gcc"],
         "build_type": ["Debug"],
         "arch": ["amd64"],
+        "minimal": true,
         "suffix": "coverage",
         "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=500 -Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0"
       },
@@ -26,6 +41,7 @@
         "compiler": ["clang"],
         "build_type": ["Debug"],
         "arch": ["amd64"],
+        "minimal": false,
         "suffix": "voidstar",
         "extra_cmake_args": "-Dvoidstar=ON"
       },
@@ -33,6 +49,7 @@
         "compiler": ["clang"],
         "build_type": ["Release"],
         "arch": ["amd64"],
+        "minimal": false,
         "suffix": "reffee",
         "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=1000"
       },
@@ -40,9 +57,9 @@
         "compiler": ["gcc"],
         "build_type": ["Debug"],
         "arch": ["amd64"],
+        "minimal": false,
         "suffix": "unity",
-        "extra_cmake_args": "-Dunity=ON",
-        "exclude_event_types": ["pull_request"]
+        "extra_cmake_args": "-Dunity=ON"
       }
     ],
 
@@ -50,7 +67,8 @@
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
-        "arch": ["amd64"]
+        "arch": ["amd64"],
+        "minimal": false
       }
     ],
 
@@ -58,7 +76,8 @@
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
-        "arch": ["amd64"]
+        "arch": ["amd64"],
+        "minimal": false
       }
     ]
   },
@@ -68,6 +87,7 @@
         "compiler": ["gcc"],
         "build_type": ["Release"],
         "arch": ["amd64"],
+        "minimal": false,
         "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-577d745"
       }
     ],
@@ -77,6 +97,7 @@
         "compiler": ["gcc"],
         "build_type": ["Release"],
         "arch": ["amd64"],
+        "minimal": false,
         "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-577d745"
       }
     ]
diff --git a/.github/scripts/strategy-matrix/macos.json b/.github/scripts/strategy-matrix/macos.json
index 2d3cc75c7b..98e0f13141 100644
--- a/.github/scripts/strategy-matrix/macos.json
+++ b/.github/scripts/strategy-matrix/macos.json
@@ -4,13 +4,14 @@
   "configs": [
     {
       "build_type": "Release",
-      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
+      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
+      "minimal": true
     },
     {
       "build_type": "Debug",
       "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
       "build_only": true,
-      "exclude_event_types": ["pull_request"]
+      "minimal": false
     }
   ]
 }
diff --git a/.github/scripts/strategy-matrix/windows.json b/.github/scripts/strategy-matrix/windows.json
index 370e9f5bc7..6b926e85f5 100644
--- a/.github/scripts/strategy-matrix/windows.json
+++ b/.github/scripts/strategy-matrix/windows.json
@@ -2,11 +2,11 @@
   "platform": "windows/amd64",
   "runner": ["self-hosted", "Windows", "dev-box-windows-2026"],
   "configs": [
-    { "build_type": "Release" },
+    { "build_type": "Release", "minimal": true },
     {
       "build_type": "Debug",
       "build_only": true,
-      "exclude_event_types": ["pull_request"]
+      "minimal": false
     }
   ]
 }
diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 19fb170b92..bbf6f8c39e 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -1,7 +1,11 @@
-# This workflow runs all workflows to check, build and test the project on
-# various Linux flavors, as well as on MacOS and Windows, on every push to a
-# user branch. However, it will not run if the pull request is a draft unless it
-# has the 'DraftRunCI' label. For commits to PRs that target a release branch,
+# This workflow runs workflows to check, build and test the project
+# on every meaningful change on pull_request.
+# However, it will not run if the PR is a draft
+# unless it has the 'DraftRunCI' or 'Full CI build' label.
+#
+# By default a PR builds only a minimal matrix.
+# The full matrix runs once the PR is labeled "Ready to merge" or "Full CI build".
+# For commits to PRs that target a release branch,
 # it also uploads the libxrpl recipe to the Conan remote.
 name: PR
 
@@ -15,9 +19,24 @@ on:
       - reopened
       - synchronize
       - ready_for_review
+      # Trigger on label changes so toggling "Ready to merge" or "Full CI build"
+      # switches between the minimal and full matrix without needing a new push.
+      - labeled
+      - unlabeled
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  # Use a per-ref group so a newer run (a push, or a change to a label below)
+  # supersedes the in-progress one for that ref. Label events we don't act on get
+  # their own unique group (per run id) instead, keeping them out of the shared
+  # group so real builds keep running. Keep this list in sync with `should-run`.
+  group: >-
+    ${{ github.workflow }}-${{ github.ref }}${{
+      ((github.event.action == 'labeled' || github.event.action == 'unlabeled')
+      && github.event.label.name != 'Ready to merge'
+      && github.event.label.name != 'DraftRunCI'
+      && github.event.label.name != 'Full CI build')
+      && format('-{0}', github.run_id) || ''
+    }}
   cancel-in-progress: true
 
 defaults:
@@ -26,10 +45,21 @@ defaults:
 
 jobs:
   # This job determines whether the rest of the workflow should run. It runs
-  # when the PR is not a draft (which should also cover merge-group) or
-  # has the 'DraftRunCI' label.
+  # when the PR is not a draft (which should also cover merge-group) or has the
+  # 'DraftRunCI' or 'Full CI build' label. For label events it only runs when the
+  # label added or removed is one we act on ('Ready to merge', 'DraftRunCI' or
+  # 'Full CI build'), so unrelated label changes do not trigger a redundant run.
   should-run:
-    if: ${{ !github.event.pull_request.draft || contains(github.event.pull_request.labels.*.name, 'DraftRunCI') }}
+    if: >-
+      ${{
+        ((github.event.action != 'labeled' && github.event.action != 'unlabeled')
+          || github.event.label.name == 'Ready to merge'
+          || github.event.label.name == 'DraftRunCI'
+          || github.event.label.name == 'Full CI build')
+        && (!github.event.pull_request.draft
+          || contains(github.event.pull_request.labels.*.name, 'DraftRunCI')
+          || contains(github.event.pull_request.labels.*.name, 'Full CI build'))
+      }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -91,15 +121,17 @@ jobs:
         # least one of:
         # * Any of the files checked in the `changes` step were modified
         # * The PR is NOT a draft and is labeled "Ready to merge"
+        # * The PR is labeled "Full CI build" (draft or not)
         # * The workflow is running from the merge queue
         id: go
         env:
           FILES: ${{ steps.changes.outputs.any_changed }}
           DRAFT: ${{ github.event.pull_request.draft }}
           READY: ${{ contains(github.event.pull_request.labels.*.name, 'Ready to merge') }}
+          FULL: ${{ contains(github.event.pull_request.labels.*.name, 'Full CI build') }}
           MERGE: ${{ github.event_name == 'merge_group' }}
         run: |
-          echo "go=${{ (env.DRAFT != 'true' && env.READY == 'true') || env.FILES == 'true' || env.MERGE == 'true' }}" >>"${GITHUB_OUTPUT}"
+          echo "go=${{ (env.DRAFT != 'true' && env.READY == 'true') || env.FULL == 'true' || env.FILES == 'true' || env.MERGE == 'true' }}" >>"${GITHUB_OUTPUT}"
           cat "${GITHUB_OUTPUT}"
     outputs:
       go: ${{ steps.go.outputs.go == 'true' }}
@@ -142,7 +174,10 @@ jobs:
 
   package:
     needs: [should-run, build-test]
-    if: ${{ needs.should-run.outputs.go == 'true' }}
+    # Packaging consumes the debian/rhel release binaries, which are only built
+    # by the full matrix. Skip it for pull requests that ran only the minimal
+    # matrix (i.e. not yet labeled "Ready to merge" or "Full CI build").
+    if: ${{ needs.should-run.outputs.go == 'true' && (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'Ready to merge') || contains(github.event.pull_request.labels.*.name, 'Full CI build')) }}
     uses: ./.github/workflows/reusable-package.yml
 
   upload-recipe:
diff --git a/.github/workflows/reusable-strategy-matrix.yml b/.github/workflows/reusable-strategy-matrix.yml
index 690aa3d423..b6091b99d9 100644
--- a/.github/workflows/reusable-strategy-matrix.yml
+++ b/.github/workflows/reusable-strategy-matrix.yml
@@ -35,5 +35,8 @@ jobs:
         id: generate
         env:
           GENERATE_CONFIG: ${{ inputs.os != '' && format('--config={0}', inputs.os) || '' }}
-          GENERATE_EVENT: ${{ github.event_name }}
-        run: ./generate.py ${GENERATE_CONFIG} --event="${GENERATE_EVENT}" >>"${GITHUB_OUTPUT}"
+          # Run only the minimal matrix for pull requests that are not yet
+          # labeled "Ready to merge" or "Full CI build". Any other event (merge
+          # queue, push, schedule, manual dispatch) runs the full matrix.
+          GENERATE_MINIMAL: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'Ready to merge') && !contains(github.event.pull_request.labels.*.name, 'Full CI build')) && '--minimal' || '' }}
+        run: ./generate.py ${GENERATE_CONFIG} ${GENERATE_MINIMAL} >>"${GITHUB_OUTPUT}"

From 0a4676d947d1e65a09c3002a2c4681895c69a413 Mon Sep 17 00:00:00 2001
From: Ed Hennis <ed@ripple.com>
Date: Tue, 14 Jul 2026 14:16:46 -0400
Subject: [PATCH 074/100] fix: Document and assert "after" is never null in
 invariants (#7354)

Co-authored-by: Bart <bthomee@users.noreply.github.com>
---
 include/xrpl/tx/invariants/InvariantCheck.h  | 15 ++++--
 src/libxrpl/tx/invariants/InvariantCheck.cpp | 56 +++++++++++---------
 2 files changed, 42 insertions(+), 29 deletions(-)

diff --git a/include/xrpl/tx/invariants/InvariantCheck.h b/include/xrpl/tx/invariants/InvariantCheck.h
index 150c0ed510..1239305e79 100644
--- a/include/xrpl/tx/invariants/InvariantCheck.h
+++ b/include/xrpl/tx/invariants/InvariantCheck.h
@@ -71,9 +71,18 @@ public:
     /**
      * @brief called for each ledger entry in the current transaction.
      *
-     * @param isDelete true if the SLE is being deleted
-     * @param before ledger entry before modification by the transaction
-     * @param after ledger entry after modification by the transaction
+     * @param isDelete true if the SLE is being deleted.
+     * @param before ledger entry before modification by the transaction. `before` will be null if
+     *  the entry is new.
+     * @param after ledger entry after modification by the transaction. Always non-null. When
+     *  deleting, `after` may differ from `before`. Whether that is important is up to the
+     *  individual invariant check.
+     *
+     * @note `after` IS NEVER NULL. `isDelete` is the only correct way to check for deletions.
+     *  Do not make logic or branching decisions on whether on `after` is set, because it will
+     *  always be set. Treat a null `after` as a programming error (with XRPL_ASSERT). An
+     *  invariant MAY check for null defensively, if it makes more sense, but an assertion is
+     *  preferred for new invariants.
      */
     void
     visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after);
diff --git a/src/libxrpl/tx/invariants/InvariantCheck.cpp b/src/libxrpl/tx/invariants/InvariantCheck.cpp
index 1032644132..3615594d19 100644
--- a/src/libxrpl/tx/invariants/InvariantCheck.cpp
+++ b/src/libxrpl/tx/invariants/InvariantCheck.cpp
@@ -162,33 +162,37 @@ XRPNotCreated::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref a
         }
     }
 
-    if (after)
+    if (!after)
     {
-        switch (after->getType())
-        {
-            case ltACCOUNT_ROOT:
-                drops_ += (*after)[sfBalance].xrp().drops();
-                break;
-            case ltPAYCHAN:
-                if (!isDelete)
-                    drops_ += ((*after)[sfAmount] - (*after)[sfBalance]).xrp().drops();
-                break;
-            case ltESCROW:
-                if (!isDelete && isXRP((*after)[sfAmount]))
-                    drops_ += (*after)[sfAmount].xrp().drops();
-                break;
-            case ltSPONSORSHIP:
-                if (!isDelete && after->isFieldPresent(sfFeeAmount))
-                {
-                    XRPL_ASSERT(
-                        isXRP((*after)[sfFeeAmount]),
-                        "XRPNotCreated::visitEntry : Sponsorship.FeeAmount is XRP");
-                    drops_ += (*after)[sfFeeAmount].xrp().drops();
-                }
-                break;
-            default:
-                break;
-        }
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::XRPNotCreated::visitEntry : after can't be null");
+        return;
+        // LCOV_EXCL_STOP
+    }
+    switch (after->getType())
+    {
+        case ltACCOUNT_ROOT:
+            drops_ += (*after)[sfBalance].xrp().drops();
+            break;
+        case ltPAYCHAN:
+            if (!isDelete)
+                drops_ += ((*after)[sfAmount] - (*after)[sfBalance]).xrp().drops();
+            break;
+        case ltESCROW:
+            if (!isDelete && isXRP((*after)[sfAmount]))
+                drops_ += (*after)[sfAmount].xrp().drops();
+            break;
+        case ltSPONSORSHIP:
+            if (!isDelete && after->isFieldPresent(sfFeeAmount))
+            {
+                XRPL_ASSERT(
+                    isXRP((*after)[sfFeeAmount]),
+                    "XRPNotCreated::visitEntry : Sponsorship.FeeAmount is XRP");
+                drops_ += (*after)[sfFeeAmount].xrp().drops();
+            }
+            break;
+        default:
+            break;
     }
 }
 

From f10dd7b450b574109f70f651b7035e736cad7df1 Mon Sep 17 00:00:00 2001
From: Ed Hennis <ed@ripple.com>
Date: Tue, 14 Jul 2026 14:47:41 -0400
Subject: [PATCH 075/100] fix: Handle rounding just above kMaxRep more
 accurately (#7389)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Vito Tumas <5780819+Tapanito@users.noreply.github.com>
Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>
---
 include/xrpl/basics/Number.h        |  16 +-
 src/libxrpl/basics/Number.cpp       | 207 +++++++---
 src/libxrpl/protocol/Rules.cpp      |   2 +-
 src/libxrpl/protocol/STNumber.cpp   |  43 +-
 src/test/app/LoanBroker_test.cpp    |  76 +++-
 src/test/app/Vault_test.cpp         | 166 +++++---
 src/test/protocol/STNumber_test.cpp |  54 ++-
 src/tests/libxrpl/basics/Number.cpp | 585 ++++++++++++++++++++++++----
 8 files changed, 946 insertions(+), 203 deletions(-)

diff --git a/include/xrpl/basics/Number.h b/include/xrpl/basics/Number.h
index 0026e7f006..f90800c715 100644
--- a/include/xrpl/basics/Number.h
+++ b/include/xrpl/basics/Number.h
@@ -364,6 +364,8 @@ public:
     static constexpr internalrep kMaxRep = std::numeric_limits<rep>::max();
     static_assert(kMaxRep == 9'223'372'036'854'775'807);
     static_assert(-kMaxRep == std::numeric_limits<rep>::min() + 1);
+    static constexpr internalrep kMaxRepUp = ((kMaxRep / 10) + 1) * 10;
+    static_assert(kMaxRepUp == 9'223'372'036'854'775'810ULL);
 
     // May need to make unchecked private
     struct Unchecked
@@ -591,6 +593,13 @@ public:
     std::pair<T, int>
     normalizeToRange() const;
 
+    // Safely convert rep (int64) mantissa to internalrep (uint64). If the rep
+    // is negative, returns the positive value. This takes a little extra work
+    // because converting std::numeric_limits<std::int64_t>::min() flirts with
+    // UB, and can vary across compilers.
+    static internalrep
+    externalToInternal(rep mantissa);
+
 private:
     static thread_local RoundingMode mode;
     // The available ranges for mantissa
@@ -645,13 +654,6 @@ private:
     // exponent could go out of range, so it will be checked.
     [[nodiscard]] Number
     shiftExponent(int exponentDelta) const;
-
-    // Safely convert rep (int64) mantissa to internalrep (uint64). If the rep
-    // is negative, returns the positive value. This takes a little extra work
-    // because converting std::numeric_limits<std::int64_t>::min() flirts with
-    // UB, and can vary across compilers.
-    static internalrep
-    externalToInternal(rep mantissa);
 };
 
 constexpr Number::Number(bool negative, internalrep mantissa, int exponent, Unchecked) noexcept
diff --git a/src/libxrpl/basics/Number.cpp b/src/libxrpl/basics/Number.cpp
index d08fd23016..1f2c41809a 100644
--- a/src/libxrpl/basics/Number.cpp
+++ b/src/libxrpl/basics/Number.cpp
@@ -277,6 +277,25 @@ public:
     void
     doDropDigit(T& mantissa, int& exponent) noexcept;
 
+    // Modify the result to the correctly rounded value
+    template <UnsignedMantissa T>
+    void
+    doRoundUp(bool& negative, T& mantissa, int& exponent, std::string location);
+
+    // Modify the result to the correctly rounded value
+    template <UnsignedMantissa T>
+    void
+    doRoundDown(bool& negative, T& mantissa, int& exponent) const;
+
+    // Modify the result to the correctly rounded value
+    void
+    doRound(rep& drops, std::string location) const;
+
+private:
+    template <UnsignedMantissa T>
+    void
+    pushOverflow(T mantissa);
+
     enum class Round {
         // The result is exact. No rounding is needed. Only used if cuspRoundingFix is Enabled330 or
         // higher.
@@ -289,37 +308,22 @@ public:
         // The result was exactly half-way between two integers. This will round to even.
         Even = 0,
         // Round up. Always adds 1 (or subtracts 1 in some cases if cuspRoundingFix is not
-        // Enabled)
+        // Enabled330)
         Up = 1,
     };
 
-    // Indicate round direction:  1 is up, -1 is down, 0 is even
+    // Indicate round direction. See Round enum above.
     // This enables the client to round towards nearest, and on
     // tie, round towards even.
     [[nodiscard]] Round
     round() const noexcept;
 
-    // Modify the result to the correctly rounded value
-    template <UnsignedMantissa T>
-    void
-    doRoundUp(bool& negative, T& mantissa, int& exponent, std::string location);
-
-    // Modify the result to the correctly rounded value
-    template <UnsignedMantissa T>
-    void
-    doRoundDown(bool& negative, T& mantissa, int& exponent);
-
-    // Modify the result to the correctly rounded value
-    void
-    doRound(rep& drops, std::string location) const;
-
-private:
     void
     doPush(unsigned d) noexcept;
 
     template <UnsignedMantissa T>
     void
-    bringIntoRange(bool& negative, T& mantissa, int& exponent);
+    bringIntoRange(bool& negative, T& mantissa, int& exponent) const;
 };
 
 inline void
@@ -349,6 +353,7 @@ Number::Guard::isNegative() const noexcept
 inline void
 Number::Guard::doPush(unsigned d) noexcept
 {
+    XRPL_ASSERT(d < 10, "xrpl::Number::Guard::doPush : valid digit");
     xbit_ = xbit_ || ((digits_ & 0x0000'0000'0000'000F) != 0);
     digits_ >>= 4;
     digits_ |= (d & 0x0000'0000'0000'000FULL) << 60;
@@ -396,10 +401,69 @@ Number::Guard::doDropDigit<uint128_t>(uint128_t& mantissa, int& exponent) noexce
     ++exponent;
 }
 
+template <UnsignedMantissa T>
+void
+Number::Guard::pushOverflow(T mantissa)
+{
+    XRPL_ASSERT(mantissa <= kMaxRepUp, "xrpl::Number::Guard::pushOverflow : valid mantissa");
+    if (cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330 && mantissa >= kMaxRep &&
+        mantissa < kMaxRepUp)
+    {
+        // Special case rounding rules for the values in the range [kMaxRep, kMaxRepUp).
+
+        auto constexpr spread = kMaxRepUp - kMaxRep;
+        static_assert(spread == 3);
+
+        // Round in two steps.
+
+        // The first step uses the digits _already_ in the Guard to possibly round the mantissa up.
+        // Ultimately, the purpose of this step is to capture rounding where the stored digits would
+        // change the decision without those digits. (e.g. From just _below_ the midpoint to just
+        // _above_ the midpoint for ToNearest, or from kMaxRep into the in-between for Upward. Make
+        // an exception if the final digit is 9, because it can only get larger, and we don't want
+        // to bump up to kMaxRepUp.
+        if (mantissa % 10 < 9)
+        {
+            // Intentionally use integer math to get the largest value under the midpoint.
+            auto constexpr kMidpoint = kMaxRep + (spread / 2);
+            static_assert(kMidpoint == kMaxRep + 1);
+            auto const r = round();
+            if (r == Round::Up || (r == Round::Even && mantissa == kMidpoint))
+            {
+                ++mantissa;
+            }
+        }
+
+        // The second step scales the final digit of the updated mantissa proportionally, converting
+        // from (kMaxRep, kMaxRepUp) to (0 to 9]. It then pushes that scaled digit onto the guard as
+        // if it was a digit that got removed, but doesn't actually remove it. This method should be
+        // future-proof in case the number of mantissa bits ever changes. (Though for integer values
+        // of the form 2^(2^x-1), the spread will always be the same.) Effects:
+        // * For round to nearest
+        //      * if the updated mantissa is below the midpoint, it'll round "down" to kMaxRep
+        //      * if above the midpoint, it'll round "up" to kMaxRepUp
+        //      * it can never be exactly at the midpoint, because kMaxRepUp is always even, and
+        //        kMaxRep is always odd, so don't worry about that case.
+        // * For round upward, will round up to kMaxRepUp for positive values, down to kMaxRep for
+        //   negative.
+        // * For round downward, does the opposite of upward.
+        // * For round toward zero, always rounds down to kMaxRep.
+
+        auto const diff = mantissa - kMaxRep;
+        auto const digit = static_cast<unsigned>((diff * 10) / spread);
+        XRPL_ASSERT(
+            digit < 10u && digit != 5, "xrpl::Number::Guard::pushOverflow : valid overflow digit");
+
+        // Don't remove the digit from the mantissa, but add it to the guard as if it was.
+        push(digit);
+    }
+}
+
 // Returns:
-//     -1 if Guard is less than half
-//      0 if Guard is exactly half
-//      1 if Guard is greater than half
+//     Exact if Guard is _zero_, and appropriate amendments are enabled
+//     Down  if Guard is less than half
+//     Even  if Guard is exactly half
+//     Up    if Guard is greater than half
 Number::Guard::Round
 Number::Guard::round() const noexcept
 {
@@ -445,17 +509,23 @@ Number::Guard::round() const noexcept
 
 template <UnsignedMantissa T>
 void
-Number::Guard::bringIntoRange(bool& negative, T& mantissa, int& exponent)
+Number::Guard::bringIntoRange(bool& negative, T& mantissa, int& exponent) const
 {
     // Bring mantissa back into the minMantissa / maxMantissa range AFTER
-    // rounding
-    if (mantissa < minMantissa)
+    // rounding.
+    if (mantissa < minMantissa &&
+        (cuspRoundingFix < MantissaRange::CuspRoundingFix::Enabled330 || mantissa != 0))
     {
         mantissa *= 10;
         --exponent;
     }
-    if (exponent < kMinExponent)
+    // mantissa should never be 0, but if it _is_ assert, but fall back to making the result kZero.
+    if (exponent < kMinExponent ||
+        (cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330 && mantissa == 0))
     {
+        // Engineers: If you hit this assert, you probably did something wrong in the operation
+        // leading up to the rounding work.
+        XRPL_ASSERT(mantissa != 0, "xrpl::Number::Guard::bringIntoRange : valid mantissa");
         static constexpr Number kZero = Number{};
 
         negative = kZero.negative_;
@@ -468,7 +538,9 @@ template <UnsignedMantissa T>
 void
 Number::Guard::doRoundUp(bool& negative, T& mantissa, int& exponent, std::string location)
 {
-    auto r = round();
+    pushOverflow(mantissa);
+
+    auto const r = round();
     if (r == Round::Up || (r == Round::Even && (mantissa & 1) == 1))
     {
         auto const safeToIncrement = [this](auto const& mantissa) {
@@ -485,18 +557,29 @@ Number::Guard::doRoundUp(bool& negative, T& mantissa, int& exponent, std::string
             }
             else
             {
-                // Incrementing the mantissa will require dividing, which will require rounding. So
-                // _don't_ increment the mantissa. Instead, divide and round recursively. It should
-                // be impossible to recurse more than once, because once the mantissa is divided by
-                // 10, it will be _well_ under maxMantissa and kMaxRep, so adding 1 will have no
-                // chance of bringing it back over.
-                doDropDigit(mantissa, exponent);
-                XRPL_ASSERT_PARTS(
-                    safeToIncrement(mantissa),
-                    "xrpl::Number::Guard::doRoundUp",
-                    "can't recurse more than once");
-                doRoundUp(negative, mantissa, exponent, location);
-                return;
+                if (cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330 &&
+                    mantissa > kMaxRep && mantissa < kMaxRepUp)
+                {
+                    // When rounding up a value in between kMaxRep, and kMaxRepUp, round to
+                    // kMaxRepUp. Note that the decision for this rounding is dominated by the
+                    // results of pushOverflow.
+                    mantissa = kMaxRepUp;
+                }
+                else
+                {
+                    // Incrementing the mantissa will require dividing, which will require rounding.
+                    // So _don't_ increment the mantissa. Instead, divide and round recursively. It
+                    // should be impossible to recurse more than once, because once the mantissa is
+                    // divided by 10, it will be _well_ under maxMantissa and kMaxRep, so adding 1
+                    // will have no chance of bringing it back over.
+                    doDropDigit(mantissa, exponent);
+                    XRPL_ASSERT_PARTS(
+                        safeToIncrement(mantissa),
+                        "xrpl::Number::Guard::doRoundUp",
+                        "can't recurse more than once");
+                    doRoundUp(negative, mantissa, exponent, location);
+                    return;
+                }
             }
         }
         else
@@ -514,6 +597,14 @@ Number::Guard::doRoundUp(bool& negative, T& mantissa, int& exponent, std::string
             }
         }
     }
+    else if (
+        cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330 && mantissa > kMaxRep &&
+        mantissa < kMaxRepUp)
+    {
+        // When rounding down a value in between kMaxRep, and kMaxRepUp, round to kMaxRep.
+        // Note that the decision for this rounding is dominated by the results of pushOverflow.
+        mantissa = kMaxRep;
+    }
     bringIntoRange(negative, mantissa, exponent);
     if (exponent > kMaxExponent)
         Throw<std::overflow_error>(std::string(location));
@@ -521,8 +612,10 @@ Number::Guard::doRoundUp(bool& negative, T& mantissa, int& exponent, std::string
 
 template <UnsignedMantissa T>
 void
-Number::Guard::doRoundDown(bool& negative, T& mantissa, int& exponent)
+Number::Guard::doRoundDown(bool& negative, T& mantissa, int& exponent) const
 {
+    // Do not pushOverflow here.
+
     auto r = round();
     if (cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330)
     {
@@ -557,6 +650,8 @@ Number::Guard::doRoundDown(bool& negative, T& mantissa, int& exponent)
 void
 Number::Guard::doRound(rep& drops, std::string location) const
 {
+    // Do not pushOverflow here.
+
     auto r = round();
     if (r == Round::Up || (r == Round::Even && (drops & 1) == 1))
     {
@@ -573,6 +668,8 @@ Number::Guard::doRound(rep& drops, std::string location) const
         }
         ++drops;
     }
+    XRPL_ASSERT(drops >= 0, "xrpl::Number::Guard::doRound : positive magnitude");
+
     if (isNegative())
         drops = -drops;
 }
@@ -622,7 +719,9 @@ doNormalize(
 {
     static constexpr auto kMinExponent = Number::kMinExponent;
     static constexpr auto kMaxExponent = Number::kMaxExponent;
-    static constexpr auto kMaxRep = Number::kMaxRep;
+    auto const repLimit = cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330
+        ? Number::kMaxRepUp
+        : Number::kMaxRep;
 
     using Guard = Number::Guard;
 
@@ -672,17 +771,17 @@ doNormalize(
     //      9,900,000,000,000,123,450 or 9,900,000,000,000,123,460.
     // mantissa() will return mantissa / 10, and exponent() will return
     // exponent + 1.
-    if (m > kMaxRep)
+    if (m > repLimit)
     {
         if (exponent >= kMaxExponent)
             throw std::overflow_error("Number::normalize 1.5");
         g.doDropDigit(m, exponent);
     }
     // Before modification, m should be within the min/max range. After
-    // modification, it must be less than kMaxRep. In other words, the original
-    // value should have been no more than kMaxRep * 10.
-    // (kMaxRep * 10 > maxMantissa)
-    XRPL_ASSERT_PARTS(m <= kMaxRep, "xrpl::doNormalize", "intermediate mantissa fits in int64");
+    // modification, it must be less than repLimit. In other words, the original
+    // value should have been no more than repLimit * 10.
+    // (repLimit * 10 > maxMantissa)
+    XRPL_ASSERT_PARTS(m <= repLimit, "xrpl::doNormalize", "intermediate mantissa fits in limit");
     mantissa = m;
 
     g.doRoundUp(negative, mantissa, exponent, "Number::normalize 2");
@@ -814,6 +913,9 @@ Number::operator+=(Number const& y)
     auto const& maxMantissa = g.maxMantissa;
     auto const cuspRoundingFix = g.cuspRoundingFix;
 
+    auto const repLimit =
+        cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330 ? kMaxRepUp : kMaxRep;
+
     // Bring the exponents of both values into agreement, so the mantissas are on the same scale
     //   and can be added directly together.
 
@@ -898,7 +1000,7 @@ Number::operator+=(Number const& y)
         }
         else
         {
-            if (xm > maxMantissa || xm > kMaxRep)
+            if (xm > maxMantissa || xm > repLimit)
             {
                 g.doDropDigit(xm, xe);
             }
@@ -942,7 +1044,7 @@ Number::operator+=(Number const& y)
         {
             // Grow xm/xe and pull digits out of the Guard until it's back in the
             // minMantissa/maxMantissa range.
-            while (xm < minMantissa && xm * 10 <= kMaxRep)
+            while (xm < minMantissa && xm * 10 <= repLimit)
             {
                 xm *= 10;
                 xm -= g.pop();
@@ -1016,8 +1118,10 @@ Number::operator*=(Number const& y)
         g.setNegative();
 
     auto const& maxMantissa = g.maxMantissa;
+    auto const repLimit =
+        g.cuspRoundingFix >= MantissaRange::CuspRoundingFix::Enabled330 ? kMaxRepUp : kMaxRep;
 
-    while (zm > maxMantissa || zm > kMaxRep)
+    while (zm > maxMantissa || zm > repLimit)
     {
         g.doDropDigit(zm, ze);
     }
@@ -1282,8 +1386,11 @@ to_string(Number const& amount)
         }
         std::string ret = negative ? "-" : "";
         ret.append(std::to_string(mantissa));
-        ret.append(1, 'e');
-        ret.append(std::to_string(exponent));
+        if (exponent != 0)
+        {
+            ret.append(1, 'e');
+            ret.append(std::to_string(exponent));
+        }
         return ret;
     }
 
diff --git a/src/libxrpl/protocol/Rules.cpp b/src/libxrpl/protocol/Rules.cpp
index d71bb77f66..197139027a 100644
--- a/src/libxrpl/protocol/Rules.cpp
+++ b/src/libxrpl/protocol/Rules.cpp
@@ -45,7 +45,7 @@ setCurrentTransactionRules(std::optional<Rules> r)
         // amendments must also be added to useRulesGuards.
         bool const enableLargeNumbers =
             !r || (r->enabled(featureSingleAssetVault) || r->enabled(featureLendingProtocol));
-        // If enableLargeNumbers is true, then useRulesGuard must also return true.
+        // If enableLargeNumbers is true, then useRulesGuards must also return true.
         // However, the reverse is not true. Other amendments can cause the rules guard to be used,
         // even though large numbers are _not_ used.
         XRPL_ASSERT(
diff --git a/src/libxrpl/protocol/STNumber.cpp b/src/libxrpl/protocol/STNumber.cpp
index bd7f67649b..7bf98f270c 100644
--- a/src/libxrpl/protocol/STNumber.cpp
+++ b/src/libxrpl/protocol/STNumber.cpp
@@ -255,8 +255,47 @@ numberFromJson(SField const& field, json::Value const& value)
         Throw<std::runtime_error>("not a number");
     }
 
-    return STNumber{
-        field, Number{parts.negative, parts.mantissa, parts.exponent, Number::Normalized{}}};
+    Number const num{parts.negative, parts.mantissa, parts.exponent, Number::Normalized{}};
+
+    // Canonicalize "parts" and "num" with each other by getting rid of trailing 0s until either the
+    // exponents match, or there are no more 0s. If the two results don't match exactly, then the
+    // value has been rounded one way or another, and should not be used, because it may lead to an
+    // unexpected result. canonicalizeParts is not to be confused with Number::canonicalize, because
+    // they have completely different goals.
+    auto canonicalizeParts = [](NumberParts p, int otherExponent) {
+        if (p.mantissa == 0)
+            return NumberParts{};
+
+        while (p.exponent < otherExponent && p.mantissa % 10 == 0)
+        {
+            p.mantissa /= 10;
+            ++p.exponent;
+        }
+
+        return p;
+    };
+
+    auto const numberMantissa = num.mantissa();
+    auto const numberExponent = num.exponent();
+
+    auto const canonicalParts = canonicalizeParts(parts, numberExponent);
+
+    auto const canonicalNum = canonicalizeParts(
+        NumberParts{
+            .mantissa = Number::externalToInternal(numberMantissa),
+            .exponent = numberExponent,
+            .negative = numberMantissa < 0,
+        },
+        canonicalParts.exponent);
+
+    if (canonicalParts.mantissa != canonicalNum.mantissa ||
+        canonicalParts.exponent != canonicalNum.exponent ||
+        canonicalParts.negative != canonicalNum.negative)
+    {
+        Throw<std::runtime_error>("number cannot be represented");
+    }
+
+    return STNumber{field, num};
 }
 
 }  // namespace xrpl
diff --git a/src/test/app/LoanBroker_test.cpp b/src/test/app/LoanBroker_test.cpp
index b0b0924c6e..f6f85a0cca 100644
--- a/src/test/app/LoanBroker_test.cpp
+++ b/src/test/app/LoanBroker_test.cpp
@@ -53,6 +53,7 @@
 
 #include <array>
 #include <cstdint>
+#include <exception>
 #include <functional>
 #include <memory>
 #include <optional>
@@ -1437,18 +1438,77 @@ class LoanBroker_test : public beast::unit_test::Suite
             env(tx2, Ter(temINVALID));
         }
 
+        env.setParseFailureExpected(true);
+        try
         {
-            auto const dm = power(2, 63) - 1;
-            BEAST_EXPECTS(dm > kMaxMpTokenAmount, to_string(dm));
-            tx2[sfDebtMaximum] = dm;
+            tx2[sfDebtMaximum] = "9223372036854775808";
             env(tx2, Ter(temINVALID));
+            // should throw in parser
+            fail();
         }
-
+        catch (std::exception const& e)
         {
-            auto const dm = power(2, 63) - 3;
-            BEAST_EXPECTS(dm == kMaxMpTokenAmount, to_string(dm));
-            tx2[sfDebtMaximum] = dm;
-            env(tx2, Ter(tesSUCCESS));
+            BEAST_EXPECT(
+                std::string(e.what()) ==
+                "invalidParamsField 'tx_json.DebtMaximum' has invalid data.");
+        }
+        env.setParseFailureExpected(false);
+
+        if (Number::getMantissaScale() >= MantissaRange::MantissaScale::Large330)
+        {
+            // For the Large330 scale, 2^63 rounds _down_ to Number::kMaxRep
+            {
+                auto const dm = power(2, 63);
+                BEAST_EXPECTS(dm == kMaxMpTokenAmount, to_string(dm));
+                tx2[sfDebtMaximum] = dm;
+                env(tx2, Ter(tesSUCCESS));
+            }
+
+            {
+                auto const dm = power(2, 63) + Number{1, -1};
+                BEAST_EXPECTS(dm == kMaxMpTokenAmount, to_string(dm));
+                tx2[sfDebtMaximum] = dm;
+                env(tx2, Ter(tesSUCCESS));
+            }
+
+            {
+                auto const dm = power(2, 63) - 1;
+                BEAST_EXPECTS(dm < kMaxMpTokenAmount, to_string(dm));
+                tx2[sfDebtMaximum] = dm;
+                env(tx2, Ter(tesSUCCESS));
+            }
+
+            {
+                auto const dm = power(2, 63) - 3;
+                BEAST_EXPECTS(dm < kMaxMpTokenAmount, to_string(dm));
+                tx2[sfDebtMaximum] = dm;
+                env(tx2, Ter(tesSUCCESS));
+            }
+
+            {
+                auto const dm = power(2, 63) + 3;
+                BEAST_EXPECTS(dm > kMaxMpTokenAmount, to_string(dm));
+                tx2[sfDebtMaximum] = dm;
+                env(tx2, Ter(temINVALID));
+            }
+        }
+        else
+        {
+            // For other scales, 2^63 rounds _up_ to Number::kMaxRepUp. Subtracting 1 rounds up
+            // again.
+            {
+                auto const dm = power(2, 63) - 1;
+                BEAST_EXPECTS(dm > kMaxMpTokenAmount, to_string(dm));
+                tx2[sfDebtMaximum] = dm;
+                env(tx2, Ter(temINVALID));
+            }
+
+            {
+                auto const dm = power(2, 63) - 3;
+                BEAST_EXPECTS(dm == kMaxMpTokenAmount, to_string(dm));
+                tx2[sfDebtMaximum] = dm;
+                env(tx2, Ter(tesSUCCESS));
+            }
         }
 
         {
diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index 4de8c9c616..617820c89c 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -61,6 +61,7 @@
 
 #include <chrono>
 #include <cstdint>
+#include <exception>
 #include <functional>
 #include <limits>
 #include <memory>
@@ -5246,11 +5247,15 @@ class Vault_test : public beast::unit_test::Suite
         auto const maxInt64 = std::to_string(std::numeric_limits<std::int64_t>::max());
         BEAST_EXPECT(maxInt64 == "9223372036854775807");
 
-        // Naming things is hard
         auto const maxInt64Plus1 = std::to_string(
             static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max()) + 1);
         BEAST_EXPECT(maxInt64Plus1 == "9223372036854775808");
 
+        // Naming things is hard
+        auto const maxInt64Plus2 = std::to_string(
+            static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max()) + 2);
+        BEAST_EXPECT(maxInt64Plus2 == "9223372036854775809");
+
         auto const initialXRP = to_string(kInitialXrp);
         BEAST_EXPECT(initialXRP == "100000000000000000");
 
@@ -5277,25 +5282,58 @@ class Vault_test : public beast::unit_test::Suite
             env(tx);
             env.close();
 
-            tx[sfAssetsMaximum] = maxInt64Plus1;
-            env(tx, Ter(tefEXCEPTION));
-            env.close();
+            // There are several parse failures expected in this function, so just disable it once.
+            env.setParseFailureExpected(true);
+            try
+            {
+                tx[sfAssetsMaximum] = maxInt64Plus1;
+                env(tx, Ter(tefEXCEPTION));
+                env.close();
+                // should throw in parser
+                fail();
+            }
+            catch (std::exception const& e)
+            {
+                BEAST_EXPECT(
+                    std::string(e.what()) ==
+                    "invalidParamsField 'tx_json.AssetsMaximum' has invalid data.");
+            }
+
+            try
+            {
+                tx[sfAssetsMaximum] = maxInt64Plus2;
+                env(tx, Ter(tefEXCEPTION));
+                // should throw in parser
+                fail();
+            }
+            catch (std::exception const& e)
+            {
+                BEAST_EXPECT(
+                    std::string(e.what()) ==
+                    "invalidParamsField 'tx_json.AssetsMaximum' has invalid data.");
+            }
 
-            // This value will be rounded
-            auto const insertAt = maxInt64Plus1.size() - 3;
-            auto const decimalTest = maxInt64Plus1.substr(0, insertAt) + "." +
-                maxInt64Plus1.substr(insertAt);  // (max int64+1) / 1000
-            BEAST_EXPECT(decimalTest == "9223372036854775.808");
-            tx[sfAssetsMaximum] = decimalTest;
             auto const newKeylet = keylet::vault(owner.id(), env.seq(owner));
-            env(tx);
-            env.close();
+            try
+            {
+                auto const insertAt = maxInt64Plus2.size() - 3;
+                auto const decimalTest = maxInt64Plus2.substr(0, insertAt) + "." +
+                    maxInt64Plus2.substr(insertAt);  // (max int64+2) / 1000
+                BEAST_EXPECT(decimalTest == "9223372036854775.809");
+                tx[sfAssetsMaximum] = decimalTest;
+                env(tx);
+                // should throw in parser
+                fail();
+            }
+            catch (std::exception const& e)
+            {
+                BEAST_EXPECT(
+                    std::string(e.what()) ==
+                    "invalidParamsField 'tx_json.AssetsMaximum' has invalid data.");
+            }
 
             auto const vaultSle = env.le(newKeylet);
-            if (!BEAST_EXPECT(vaultSle))
-                return;
-
-            BEAST_EXPECT(vaultSle->at(sfAssetsMaximum) == 9223372036854776);
+            BEAST_EXPECT(!vaultSle);
         }
 
         {
@@ -5329,25 +5367,41 @@ class Vault_test : public beast::unit_test::Suite
             env(tx);
             env.close();
 
-            tx[sfAssetsMaximum] = maxInt64Plus1;
-            env(tx, Ter(tefEXCEPTION));
-            env.close();
+            try
+            {
+                tx[sfAssetsMaximum] = maxInt64Plus2;
+                env(tx, Ter(tefEXCEPTION));
+                // should throw in parser
+                fail();
+            }
+            catch (std::exception const& e)
+            {
+                BEAST_EXPECT(
+                    std::string(e.what()) ==
+                    "invalidParamsField 'tx_json.AssetsMaximum' has invalid data.");
+            }
 
-            // This value will be rounded
-            auto const insertAt = maxInt64Plus1.size() - 1;
-            auto const decimalTest = maxInt64Plus1.substr(0, insertAt) + "." +
-                maxInt64Plus1.substr(insertAt);  // (max int64+1) / 10
-            BEAST_EXPECT(decimalTest == "922337203685477580.8");
-            tx[sfAssetsMaximum] = decimalTest;
             auto const newKeylet = keylet::vault(owner.id(), env.seq(owner));
-            env(tx);
-            env.close();
+            try
+            {
+                auto const insertAt = maxInt64Plus2.size() - 1;
+                auto const decimalTest = maxInt64Plus2.substr(0, insertAt) + "." +
+                    maxInt64Plus2.substr(insertAt);  // (max int64+2) / 10
+                BEAST_EXPECT(decimalTest == "922337203685477580.9");
+                tx[sfAssetsMaximum] = decimalTest;
+                env(tx);
+                // should throw in parser
+                fail();
+            }
+            catch (std::exception const& e)
+            {
+                BEAST_EXPECT(
+                    std::string(e.what()) ==
+                    "invalidParamsField 'tx_json.AssetsMaximum' has invalid data.");
+            }
 
             auto const vaultSle = env.le(newKeylet);
-            if (!BEAST_EXPECT(vaultSle))
-                return;
-
-            BEAST_EXPECT(vaultSle->at(sfAssetsMaximum) == 922337203685477581);
+            BEAST_EXPECT(!vaultSle);
         }
 
         {
@@ -5374,9 +5428,22 @@ class Vault_test : public beast::unit_test::Suite
             env(tx);
             env.close();
 
-            tx[sfAssetsMaximum] = maxInt64Plus1;
-            env(tx);
-            env.close();
+            // Since several tests are expected to have parser failures, leave this flag set for the
+            // remainder of this function.
+            env.setParseFailureExpected(true);
+            try
+            {
+                tx[sfAssetsMaximum] = maxInt64Plus2;
+                env(tx);
+                // should throw in parser
+                fail();
+            }
+            catch (std::exception const& e)
+            {
+                BEAST_EXPECT(
+                    std::string(e.what()) ==
+                    "invalidParamsField 'tx_json.AssetsMaximum' has invalid data.");
+            }
 
             tx[sfAssetsMaximum] = "1000000000000000e80";
             env.close();
@@ -5386,22 +5453,27 @@ class Vault_test : public beast::unit_test::Suite
 
             // These values will be rounded to 15 significant digits
             {
-                auto const insertAt = maxInt64Plus1.size() - 1;
-                auto const decimalTest = maxInt64Plus1.substr(0, insertAt) + "." +
-                    maxInt64Plus1.substr(insertAt);  // (max int64+1) / 10
-                BEAST_EXPECT(decimalTest == "922337203685477580.8");
-                tx[sfAssetsMaximum] = decimalTest;
                 auto const newKeylet = keylet::vault(owner.id(), env.seq(owner));
-                env(tx);
-                env.close();
+                try
+                {
+                    auto const insertAt = maxInt64Plus2.size() - 1;
+                    auto const decimalTest = maxInt64Plus2.substr(0, insertAt) + "." +
+                        maxInt64Plus2.substr(insertAt);  // (max int64+2) / 10
+                    BEAST_EXPECT(decimalTest == "922337203685477580.9");
+                    tx[sfAssetsMaximum] = decimalTest;
+                    env(tx);
+                    // should throw in parser
+                    fail();
+                }
+                catch (std::exception const& e)
+                {
+                    BEAST_EXPECT(
+                        std::string(e.what()) ==
+                        "invalidParamsField 'tx_json.AssetsMaximum' has invalid data.");
+                }
 
                 auto const vaultSle = env.le(newKeylet);
-                if (!BEAST_EXPECT(vaultSle))
-                    return;
-
-                BEAST_EXPECT(
-                    (vaultSle->at(sfAssetsMaximum) ==
-                     Number{9223372036854776, 2, Number::Normalized{}}));
+                BEAST_EXPECT(!vaultSle);
             }
             {
                 tx[sfAssetsMaximum] = "9223372036854775807e40";  // max int64 * 10^40
diff --git a/src/test/protocol/STNumber_test.cpp b/src/test/protocol/STNumber_test.cpp
index 5c9c3fd83c..74792e0a70 100644
--- a/src/test/protocol/STNumber_test.cpp
+++ b/src/test/protocol/STNumber_test.cpp
@@ -9,6 +9,7 @@
 #include <xrpl/protocol/Serializer.h>
 
 #include <cstdint>
+#include <exception>
 #include <initializer_list>
 #include <limits>
 #include <stdexcept>
@@ -101,6 +102,39 @@ struct STNumber_test : public beast::unit_test::Suite
             BEAST_EXPECT(numberFromJson(sfNumber, "-0.000e6") == STNumber(sfNumber, 0));
 
             {
+                auto const parseNumber = [](std::string const& boundary) {
+                    return numberFromJson(sfNumber, boundary);
+                };
+                auto const expectParseThrows = [this, &parseNumber](std::string const& boundary) {
+                    try
+                    {
+                        parseNumber(boundary);
+                        fail();
+                    }
+                    catch (std::exception const& e)
+                    {
+                        BEAST_EXPECT(std::string(e.what()) == "number cannot be represented");
+                    }
+                };
+
+                // Small rejects this; large scales parse it as 9223372036854775800e-1.
+                auto constexpr positiveBoundary = "922337203685477580";
+                auto constexpr negativeBoundary = "-922337203685477580";
+                if (Number::getMantissaScale() == MantissaRange::MantissaScale::Small)
+                {
+                    expectParseThrows(positiveBoundary);
+                    expectParseThrows(negativeBoundary);
+                }
+                else
+                {
+                    BEAST_EXPECT(
+                        parseNumber(positiveBoundary) ==
+                        STNumber(sfNumber, Number{922'337'203'685'477'580, 0}));
+                    BEAST_EXPECT(
+                        parseNumber(negativeBoundary) ==
+                        STNumber(sfNumber, Number{-922'337'203'685'477'580, 0}));
+                }
+
                 NumberRoundModeGuard const mg(Number::RoundingMode::TowardsZero);
                 // maxint64 9,223,372,036,854,775,807
                 auto const maxInt = std::to_string(std::numeric_limits<std::int64_t>::max());
@@ -108,23 +142,19 @@ struct STNumber_test : public beast::unit_test::Suite
                 auto const minInt = std::to_string(std::numeric_limits<std::int64_t>::min());
                 if (Number::getMantissaScale() == MantissaRange::MantissaScale::Small)
                 {
-                    BEAST_EXPECT(
-                        numberFromJson(sfNumber, maxInt) ==
-                        STNumber(sfNumber, Number{9'223'372'036'854'775, 3}));
-                    BEAST_EXPECT(
-                        numberFromJson(sfNumber, minInt) ==
-                        STNumber(sfNumber, Number{-9'223'372'036'854'775, 3}));
+                    // min/maxInt can't be exactly represented with the small mantissa, so they
+                    // don't parse, and are expected to throw.
+                    expectParseThrows(maxInt);
+                    expectParseThrows(minInt);
                 }
                 else
                 {
+                    // with large mantissas, maxint is fine
                     BEAST_EXPECT(
-                        numberFromJson(sfNumber, maxInt) ==
+                        parseNumber(maxInt) ==
                         STNumber(sfNumber, Number{9'223'372'036'854'775'807, 0}));
-                    BEAST_EXPECT(
-                        numberFromJson(sfNumber, minInt) ==
-                        STNumber(
-                            sfNumber,
-                            Number{true, 9'223'372'036'854'775'808ULL, 0, Number::Normalized{}}));
+                    // but minint's mantissa is > kMaxRep, and so rounds, and thus can't be parsed
+                    expectParseThrows(minInt);
                 }
             }
 
diff --git a/src/tests/libxrpl/basics/Number.cpp b/src/tests/libxrpl/basics/Number.cpp
index 70d6be2da5..36e1b4a700 100644
--- a/src/tests/libxrpl/basics/Number.cpp
+++ b/src/tests/libxrpl/basics/Number.cpp
@@ -182,6 +182,35 @@ TEST(NumberTest, limits)
             caught = true;
         }
         EXPECT_TRUE(caught);
+
+        if (scale == MantissaRange::MantissaScale::Large330)
+        {
+            // Normalization with the other scales, including the older large mantissa scales, will
+            // overflow.
+            Number const bigNum{Number::kMaxRepUp, Number::kMaxExponent, Number::Normalized{}};
+            // The display of large exponents won't go above kMaxExponent
+            EXPECT_EQ(to_string(bigNum), "9223372036854775810e32768") << bigNum;
+            // Perhaps surprisingly, this is ok, because the exponent range is related to when the
+            // number is _normalized_, and for mantissas > kMaxRep, the accessors return values that
+            // are not normalized.
+            EXPECT_EQ(bigNum.mantissa(), 922337203685477581ULL) << bigNum.mantissa();
+            EXPECT_EQ(bigNum.exponent(), 32769) << bigNum.exponent();
+        }
+        else
+        {
+            try
+            {
+                Number{Number::kMaxRepUp, Number::kMaxExponent, Number::Normalized{}};
+                ADD_FAILURE();
+            }
+            catch (std::overflow_error const& e)
+            {
+                std::string const expected =
+                    (scale == MantissaRange::MantissaScale::Small ? "Number::normalize 1"
+                                                                  : "Number::normalize 1.5");
+                EXPECT_EQ(e.what(), expected) << e.what();
+            }
+        }
     }
 }
 
@@ -193,7 +222,11 @@ TEST(NumberTest, add)
 
         auto const scale = Number::getMantissaScale();
 
+        EXPECT_EQ(Number::getround(), Number::RoundingMode::ToNearest)
+            << to_string(Number::getround());
+
         using Case = std::tuple<Number, Number, Number, int>;
+        // TODO: Move these to the blocks where they're used
         auto const cSmall = std::to_array<Case>({
             {Number{1'000'000'000'000'000, -15},
              Number{6'555'555'555'555'555, -29},
@@ -304,12 +337,15 @@ TEST(NumberTest, add)
         auto const cLargeLegacy = std::to_array<Case>({
             {Number{Number::kMaxRep}, Number{6, -1}, Number{Number::kMaxRep / 10, 1}, __LINE__},
         });
-        auto const cLargeCorrected = std::to_array<Case>({
+        auto const cLarge320 = std::to_array<Case>({
             {Number{Number::kMaxRep},
              Number{6, -1},
              Number{(Number::kMaxRep / 10) + 1, 1},
              __LINE__},
         });
+        auto const cLargeCorrected = std::to_array<Case>({
+            {Number{Number::kMaxRep}, Number{6, -1}, Number{Number::kMaxRep}, __LINE__},
+        });
         auto test = [](auto const& c) {
             for (auto const& [x, y, z, line] : c)
             {
@@ -330,9 +366,28 @@ TEST(NumberTest, add)
             {
                 test(cLargeLegacy);
             }
+            else if (scale == MantissaRange::MantissaScale::Large320)
+            {
+                test(cLarge320);
+            }
             else
             {
                 test(cLargeCorrected);
+
+                // This has to be created in this block, because normalization with the other
+                // scales, including the older large mantissa scales, will overflow.
+                Number const bigResult{
+                    Number::kMaxRepUp, Number::kMaxExponent, Number::Normalized{}};
+                auto const cBigNums = std::to_array<Case>({
+                    {
+                        // Add 3 to the mantissa to avoid rounding
+                        Number::max(),
+                        Number{3, Number::kMaxExponent},
+                        bigResult,
+                        __LINE__,
+                    },
+                });
+                test(cBigNums);
             }
         }
         {
@@ -381,7 +436,7 @@ TEST(NumberTest, sub)
               Number{1'000'000'000'000'000, -15},
               Number{1'000'000'000'000'000, -30},
               __LINE__}});
-        auto const cLarge = std::to_array<Case>(
+        auto const cLargeAll = std::to_array<Case>(
             // Note that items with extremely large mantissas need to be
             // calculated, because otherwise they overflow uint64. Items from C
             // with larger mantissa
@@ -428,16 +483,55 @@ TEST(NumberTest, sub)
                  Number{1'000'000'000'000'000'000, -36},
                  __LINE__},
                 {Number{Number::kMaxRep}, Number{6, -1}, Number{Number::kMaxRep - 1}, __LINE__},
-                {Number{false, Number::kMaxRep + 1, 0, Number::Normalized{}},
-                 Number{1, 0},
-                 Number{(Number::kMaxRep / 10) + 1, 1},
-                 __LINE__},
-                {Number{false, Number::kMaxRep + 1, 0, Number::Normalized{}},
-                 Number{3, 0},
-                 Number{Number::kMaxRep},
-                 __LINE__},
-                {power(2, 63), Number{3, 0}, Number{Number::kMaxRep}, __LINE__},
             });
+        // Note that items with extremely large mantissas need to be
+        // calculated, because otherwise they overflow uint64. Items from C
+        // with larger mantissa
+        auto const cLarge = std::to_array<Case>({
+            // Anything larger than kMaxRep rounds up
+            {Number{false, Number::kMaxRep + 1, 0, Number::Normalized{}},
+             Number{1, 0},
+             Number{(Number::kMaxRep / 10) + 1, 1},
+             __LINE__},
+            {Number{false, Number::kMaxRep + 1, 0, Number::Normalized{}},
+             Number{3, 0},
+             Number{Number::kMaxRep},
+             __LINE__},
+            {Number{false, Number::kMaxRep + 2, 0, Number::Normalized{}},
+             Number{1, 0},
+             Number{(Number::kMaxRep / 10) + 1, 1},
+             __LINE__},
+            {Number{false, Number::kMaxRep + 2, 0, Number::Normalized{}},
+             Number{3, 0},
+             Number{Number::kMaxRep},
+             __LINE__},
+            {power(2, 63), Number{3, 0}, Number{Number::kMaxRep}, __LINE__},
+        });
+        auto const cLarge330 = std::to_array<Case>({
+            // kMaxRep + 1 is below the half-way point, so it rounds down to kMaxRep when the Number
+            // is created.
+            {Number{false, Number::kMaxRep + 1, 0, Number::Normalized{}},
+             Number{1, 0},
+             Number{Number::kMaxRep - 1},
+             __LINE__},
+            {Number{false, Number::kMaxRep + 1, 0, Number::Normalized{}},
+             Number{3, 0},
+             Number{Number::kMaxRep - 3},
+             __LINE__},
+            // kMaxRepUp -1 is above the half-way point, so it rounds up to kMaxRepUp when the
+            // Number is created. Subtracting 1 from that rounds up again. A little non-intuitive.
+            {Number{false, Number::kMaxRepUp - 1, 0, Number::Normalized{}},
+             Number{1, 0},
+             Number{(Number::kMaxRep / 10) + 1, 1},
+             __LINE__},
+            // Subtracting 3 gets back down to kMaxRep
+            {Number{false, Number::kMaxRepUp - 1, 0, Number::Normalized{}},
+             Number{3, 0},
+             Number{Number::kMaxRep},
+             __LINE__},
+            // 2^63 is the same as kMaxRep+1
+            {power(2, 63), Number{3, 0}, Number{Number::kMaxRep - 3}, __LINE__},
+        });
         auto test = [](auto const& c) {
             for (auto const& [x, y, z, line] : c)
             {
@@ -447,13 +541,23 @@ TEST(NumberTest, sub)
                 EXPECT_EQ(result, z) << ss.str() << " Line: " << line;
             }
         };
-        if (scale == MantissaRange::MantissaScale::Small)
+        switch (scale)
         {
-            test(cSmall);
-        }
-        else
-        {
-            test(cLarge);
+            case MantissaRange::MantissaScale::Small:
+                test(cSmall);
+                break;
+            case MantissaRange::MantissaScale::LargeLegacy:
+            case MantissaRange::MantissaScale::Large320:
+                test(cLargeAll);
+                test(cLarge);
+                break;
+            case MantissaRange::MantissaScale::Large330:
+                test(cLargeAll);
+                test(cLarge330);
+                break;
+            default:
+                ADD_FAILURE();
+                break;
         }
     }
 }
@@ -1370,38 +1474,39 @@ TEST(NumberTest, to_string)
 
         auto const scale = Number::getMantissaScale();
 
-        auto test = [](Number const& n, std::string const& expected) {
+        auto test = [](Number const& n, std::string const& expected, int line) {
             auto const result = to_string(n);
             std::stringstream ss;
             ss << "to_string(" << result << "). Expected: " << expected;
-            EXPECT_EQ(result, expected) << ss.str();
+            EXPECT_EQ(result, expected) << ss.str() << " Line: " << line;
         };
 
-        test(Number(-2, 0), "-2");
-        test(Number(0, 0), "0");
-        test(Number(2, 0), "2");
-        test(Number(25, -3), "0.025");
-        test(Number(-25, -3), "-0.025");
-        test(Number(25, 1), "250");
-        test(Number(-25, 1), "-250");
-        test(Number(2, 20), "2e20");
-        test(Number(-2, -20), "-2e-20");
+        test(Number(-2, 0), "-2", __LINE__);
+        test(Number(0, 0), "0", __LINE__);
+        test(Number(2, 0), "2", __LINE__);
+        test(Number(25, -3), "0.025", __LINE__);
+        test(Number(-25, -3), "-0.025", __LINE__);
+        test(Number(25, 1), "250", __LINE__);
+        test(Number(-25, 1), "-250", __LINE__);
+        test(Number(2, 20), "2e20", __LINE__);
+        test(Number(-2, -20), "-2e-20", __LINE__);
         // Test the edges
         // ((exponent < -(25)) || (exponent > -(5)))))
         // or ((exponent < -(28)) || (exponent > -(8)))))
-        test(Number(2, -10), "0.0000000002");
-        test(Number(2, -11), "2e-11");
+        test(Number(2, -10), "0.0000000002", __LINE__);
+        test(Number(2, -11), "2e-11", __LINE__);
 
-        test(Number(-2, 10), "-20000000000");
-        test(Number(-2, 11), "-2e11");
+        test(Number(-2, 10), "-20000000000", __LINE__);
+        test(Number(-2, 11), "-2e11", __LINE__);
+        test(Number(-2, 11) - 1, "-200000000001", __LINE__);
 
         switch (scale)
         {
             case MantissaRange::MantissaScale::Small:
 
-                test(Number::min(), "1e-32753");
-                test(Number::max(), "9999999999999999e32768");
-                test(Number::lowest(), "-9999999999999999e32768");
+                test(Number::min(), "1e-32753", __LINE__);
+                test(Number::max(), "9999999999999999e32768", __LINE__);
+                test(Number::lowest(), "-9999999999999999e32768", __LINE__);
                 {
                     NumberRoundModeGuard const mg(Number::RoundingMode::TowardsZero);
 
@@ -1409,61 +1514,131 @@ TEST(NumberTest, to_string)
                     EXPECT_EQ(maxMantissa, (9'999'999'999'999'999));
                     test(
                         Number{false, (maxMantissa * 1000) + 999, -3, Number::Normalized()},
-                        "9999999999999999");
+                        "9999999999999999",
+                        __LINE__);
                     test(
                         Number{true, (maxMantissa * 1000) + 999, -3, Number::Normalized()},
-                        "-9999999999999999");
+                        "-9999999999999999",
+                        __LINE__);
 
-                    test(Number{std::numeric_limits<std::int64_t>::max(), -3}, "9223372036854775");
+                    test(
+                        Number{std::numeric_limits<std::int64_t>::max(), -3},
+                        "9223372036854775",
+                        __LINE__);
                     test(
                         -(Number{std::numeric_limits<std::int64_t>::max(), -3}),
-                        "-9223372036854775");
+                        "-9223372036854775",
+                        __LINE__);
 
                     test(
-                        Number{std::numeric_limits<std::int64_t>::min(), 0}, "-9223372036854775e3");
+                        Number{std::numeric_limits<std::int64_t>::min(), 0},
+                        "-9223372036854775e3",
+                        __LINE__);
                     test(
                         -(Number{std::numeric_limits<std::int64_t>::min(), 0}),
-                        "9223372036854775e3");
+                        "9223372036854775e3",
+                        __LINE__);
                 }
                 break;
             default:
                 // Test the edges
                 // ((exponent < -(28)) || (exponent > -(8)))))
-                test(Number::min(), "1e-32750");
-                test(Number::max(), "9223372036854775807e32768");
-                test(Number::lowest(), "-9223372036854775807e32768");
+                test(Number::min(), "1e-32750", __LINE__);
+                test(Number::max(), "9223372036854775807e32768", __LINE__);
+                test(Number::lowest(), "-9223372036854775807e32768", __LINE__);
                 {
                     NumberRoundModeGuard const mg(Number::RoundingMode::TowardsZero);
 
                     auto const maxMantissa = Number::maxMantissa();
                     EXPECT_EQ((maxMantissa), (9'999'999'999'999'999'999ULL));
                     test(
-                        Number{false, maxMantissa, 0, Number::Normalized{}}, "9999999999999999990");
+                        Number{false, maxMantissa, 0, Number::Normalized{}},
+                        "9999999999999999990",
+                        __LINE__);
                     test(
-                        Number{true, maxMantissa, 0, Number::Normalized{}}, "-9999999999999999990");
+                        Number{true, maxMantissa, 0, Number::Normalized{}},
+                        "-9999999999999999990",
+                        __LINE__);
 
                     test(
-                        Number{std::numeric_limits<std::int64_t>::max(), 0}, "9223372036854775807");
+                        Number{std::numeric_limits<std::int64_t>::max(), 0},
+                        "9223372036854775807",
+                        __LINE__);
                     test(
                         -(Number{std::numeric_limits<std::int64_t>::max(), 0}),
-                        "-9223372036854775807");
+                        "-9223372036854775807",
+                        __LINE__);
 
-                    // Because the absolute value of min is larger than max, it
-                    // will be scaled down to fit under max. Since we're
-                    // rounding towards zero, the 8 at the end is dropped.
-                    test(
-                        Number{std::numeric_limits<std::int64_t>::min(), 0},
-                        "-9223372036854775800");
-                    test(
-                        -(Number{std::numeric_limits<std::int64_t>::min(), 0}),
-                        "9223372036854775800");
+                    switch (scale)
+                    {
+                        case MantissaRange::MantissaScale::Large330:
+                            // Because the absolute value of min() is larger than max(), it
+                            // will be rounded down toward max()
+                            test(
+                                Number{std::numeric_limits<std::int64_t>::min(), 0},
+                                "-9223372036854775807",
+                                __LINE__);
+                            test(
+                                -(Number{std::numeric_limits<std::int64_t>::min(), 0}),
+                                "9223372036854775807",
+                                __LINE__);
+                            break;
+                        default:
+                            // Because the absolute value of min() is larger than max(), it
+                            // will be scaled down to fit under max(). Since we're
+                            // rounding towards zero, the 8 at the end is dropped.
+                            test(
+                                Number{std::numeric_limits<std::int64_t>::min(), 0},
+                                "-9223372036854775800",
+                                __LINE__);
+                            test(
+                                -(Number{std::numeric_limits<std::int64_t>::min(), 0}),
+                                "9223372036854775800",
+                                __LINE__);
+                            break;
+                    }
                 }
 
+                switch (scale)
+                {
+                    case MantissaRange::MantissaScale::Large330:
+                        // Rounding to nearest, since the mantissa is below the halfway point from
+                        // kMaxRep to kMaxRepUp, it will be rounded down to kMaxRep
+                        test(
+                            Number{std::numeric_limits<std::int64_t>::max(), 0} + 1,
+                            "9223372036854775807",
+                            __LINE__);
+                        test(
+                            -(Number{std::numeric_limits<std::int64_t>::max(), 0} + 1),
+                            "-9223372036854775807",
+                            __LINE__);
+                        break;
+                    default:
+                        // Rounding to nearest, since the mantissa is bigger than kMaxRep, the 8
+                        // will be dropped, and since that is bigger than 5, the result will be
+                        // rounded up from 0 to 1.
+                        test(
+                            Number{std::numeric_limits<std::int64_t>::max(), 0} + 1,
+                            "9223372036854775810",
+                            __LINE__);
+                        test(
+                            -(Number{std::numeric_limits<std::int64_t>::max(), 0} + 1),
+                            "-9223372036854775810",
+                            __LINE__);
+                        break;
+                }
+                // Rounding to nearest, will be rounded up to kMaxRepUp, but for different reasons
+                // depending on the scale. If older than "Large", it rounds up for the same reason
+                // "+1" rounds up. For "Large", since the mantissa is above the halfway point from
+                // kMaxRep to kMaxRepUp, it will be rounded up to kMaxRepUp.
                 test(
-                    Number{std::numeric_limits<std::int64_t>::max(), 0} + 1, "9223372036854775810");
+                    Number{std::numeric_limits<std::int64_t>::max(), 0} + 2,
+                    "9223372036854775810",
+                    __LINE__);
                 test(
-                    -(Number{std::numeric_limits<std::int64_t>::max(), 0} + 1),
-                    "-9223372036854775810");
+                    -(Number{std::numeric_limits<std::int64_t>::max(), 0} + 2),
+                    "-9223372036854775810",
+                    __LINE__);
                 break;
         }
     }
@@ -1851,15 +2026,14 @@ TEST(NumberTest, upward_rounding_produces_value_not_below_exact_at_k_max_rep_cus
 
         auto const message = [&] {
             std::ostringstream os;
-            os << "\n"
-               << "  a              = " << fmt(BigInt(kAValue)) << "\n"
+            os << "  a              = " << fmt(BigInt(kAValue)) << "\n"
                << "  b              = " << fmt(BigInt(kBValue)) << "\n"
                << "  exact a*b      = " << fmt(exactProduct) << "\n"
                << "  stored         = " << fmt(storedValue) << "\n"
                << "  stored - exact = " << fmt(signedDifference) << "\n"
                << "  upward         = " << (signedDifference >= 0 ? "held" : "VIOLATED") << "\n"
                << " stored.mantissa = " << product.mantissa() << "\n"
-               << " stored.exponent = " << product.exponent() << "\n";
+               << " stored.exponent = " << product.exponent() << "\n\n";
             return os.str();
         };
 
@@ -1939,15 +2113,14 @@ TEST(NumberTest, upward_division_returns_value_not_below_exact_on_large_scale)
 
         auto const message = [&] {
             std::ostringstream os;
-            os << "\n"
-               << "  a                 = " << kAValue << "\n"
+            os << "  a                 = " << kAValue << "\n"
                << "  b                 = " << kBValue << "\n"
                << "  exact a/b         = " << fmt(exact) << "\n"
                << "  stored a/b        = " << fmt(stored) << "\n"
                << "  stored - exact    = " << fmt(diff)
                << "    (negative => Upward gave value BELOW truth)\n"
                << "  quotient.mantissa = " << quotient.mantissa() << "\n"
-               << "  quotient.exponent = " << quotient.exponent() << "\n";
+               << "  quotient.exponent = " << quotient.exponent() << "\n\n";
             return os.str();
         };
 
@@ -1997,15 +2170,14 @@ TEST(NumberTest, downward_division_returns_value_not_above_exact_on_large_scale)
 
         auto const message = [&] {
             std::ostringstream os;
-            os << "\n"
-               << "  a                 = " << kAValue << "\n"
+            os << "  a                 = " << kAValue << "\n"
                << "  b                 = " << kBValue << "\n"
                << "  exact a/b         = " << fmt(exact) << "\n"
                << "  stored a/b        = " << fmt(stored) << "\n"
                << "  stored - exact    = " << fmt(diff)
                << "    (positive => Downward gave value ABOVE truth)\n"
                << "  quotient.mantissa = " << quotient.mantissa() << "\n"
-               << "  quotient.exponent = " << quotient.exponent() << "\n";
+               << "  quotient.exponent = " << quotient.exponent() << "\n\n";
             return os.str();
         };
 
@@ -2065,15 +2237,14 @@ TEST(NumberTest, to_nearest_division_uses_dropped_digits_on_large_scale)
 
         auto const message = [&] {
             std::ostringstream os;
-            os << "\n"
-               << "  a                 = " << kAValue << "\n"
+            os << "  a                 = " << kAValue << "\n"
                << "  b                 = " << kBValue << "\n"
                << "  exact a/b         = " << fmt(exact) << "\n"
                << "  stored a/b        = " << fmt(stored) << "\n"
                << "  stored - exact    = " << fmt(diff)
                << "    (negative => ToNearest gave value BELOW truth)\n"
                << "  quotient.mantissa = " << quotient.mantissa() << "\n"
-               << "  quotient.exponent = " << quotient.exponent() << "\n";
+               << "  quotient.exponent = " << quotient.exponent() << "\n\n";
             return os.str();
         };
 
@@ -2169,14 +2340,13 @@ TEST(NumberTest, subtraction_rounding)
 
             auto const message = [&](auto const& r, auto const& sum) {
                 std::ostringstream os;
-                os << "\n              a = " << a << " (" << fmt(bigA)
-                   << ")\n              b = " << b << " (" << fmt(bigB)
-                   << ")\n    exact a + b = " << fmt(exact) << "\n";
+                os << "              a = " << a << " (" << fmt(bigA) << ")\n              b = " << b
+                   << " (" << fmt(bigB) << ")\n    exact a + b = " << fmt(exact) << "\n";
 
                 auto const diff = sum.first - exact;
                 auto const rLabel = to_string(r);
                 os << std::string(15 - rLabel.length(), ' ') << rLabel << " = " << fmt(sum.first)
-                   << "\n     difference = " << fmt(diff) << "\n";
+                   << "\n     difference = " << fmt(diff) << "\n\n";
 
                 return os.str();
             };
@@ -2228,6 +2398,93 @@ TEST(NumberTest, subtraction_rounding)
     }
 }
 
+TEST(NumberTest, normalization_cusp_tonearest_and_downward)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
+    {
+        NumberMantissaScaleGuard const mg{mantissaScale};
+        NumberRoundModeGuard const rg{Number::RoundingMode::ToNearest};
+
+        auto const scale = Number::getMantissaScale();
+
+        constexpr auto kMaxRep = Number::kMaxRep;
+
+        // Both ToNearest and Downward should round to `below`
+        auto constexpr actual = static_cast<std::uint64_t>(kMaxRep) + 1;
+        Number const below{static_cast<std::int64_t>(kMaxRep), 0};
+        Number const above{false, static_cast<std::uint64_t>(kMaxRep) + 3, 0, Number::Normalized{}};
+
+        auto construct = [](Number::RoundingMode mode) {
+            NumberRoundModeGuard const roundGuard{mode};
+            return Number(false, actual, 0, Number::Normalized{});
+        };
+        Number const upward = construct(Number::RoundingMode::Upward);
+
+        Number const toNearest = construct(Number::RoundingMode::ToNearest);
+
+        Number const downward = construct(Number::RoundingMode::Downward);
+
+        auto message = [&] {
+            std::ostringstream log;
+            log << "  actual     = " << actual << "  (kMaxRep + 1)\n"
+                << "  below      = " << below << "  (kMaxRep, distance 1)\n"
+                << "  above      = " << above << "  (kMaxRep + 3, distance 2)\n"
+                << "  Upward     = " << upward << "\n"
+                << "  ToNearest  = " << toNearest << "\n"
+                << "  Downward   = " << downward << "\n\n";
+            return log.str();
+        };
+
+        switch (scale)
+        {
+            case MantissaRange::MantissaScale::Small:
+                // With the small mantissa, everything but Downward rounds UP, including the
+                // reference values, "above" and "below"
+
+                EXPECT_EQ(below, above) << message();
+                EXPECT_EQ(upward, above) << message();
+                EXPECT_EQ(toNearest, above) << message();
+
+                EXPECT_LT(downward, below) << message();
+
+                break;
+
+            case MantissaRange::MantissaScale::LargeLegacy:
+            case MantissaRange::MantissaScale::Large320:
+                // Upward round UP
+                EXPECT_EQ(upward, above) << message();
+
+                // ToNearest rounds UP when the DOWN neighbor is strictly closer
+                EXPECT_EQ(toNearest, above) << message();
+                EXPECT_GT(toNearest, below) << message();
+
+                // Downward undershoots: it returns a value below `below`
+                EXPECT_LT(downward, below) << message();
+
+                // Both should have given the same answer, but they differ
+                EXPECT_GT(toNearest, downward) << message();
+
+                break;
+            default:
+                // Covers "Large" and any newly added scales
+
+                // Upward round UP
+                EXPECT_EQ(upward, above) << message();
+
+                // ToNearest rounds to the strictly closer DOWN neighbor
+                EXPECT_NE(toNearest, above) << message();
+                EXPECT_EQ(toNearest, below) << message();
+
+                // Downward also rounds to `below`
+                EXPECT_EQ(downward, below) << message();
+
+                // ToNearest rounds to downward
+                EXPECT_EQ(toNearest, downward) << message();
+                break;
+        }
+    }
+}
+
 TEST(NumberTest, number_add_directed_sign_wrong)
 {
     for (auto const mantissaScale : MantissaRange::getAllScales())
@@ -2460,4 +2717,180 @@ TEST(NumberTest, number_add_to_nearest_picks_farther)
     }
 }
 
+TEST(NumberTest, number_cusp_rounding_with_fractional_parts)
+{
+    for (auto const mantissaScale : MantissaRange::getAllScales())
+    {
+        NumberMantissaScaleGuard const mg{mantissaScale};
+
+        auto const scale = Number::getMantissaScale();
+
+        Number const below{static_cast<std::int64_t>(Number::kMaxRep), 0};
+        Number const above{false, Number::kMaxRepUp, 0, Number::Normalized{}};
+
+        auto header = [&] {
+            std::ostringstream log;
+            log << "Scale: " << to_string(mantissaScale) << ", Below: " << below
+                << ", Above: " << above << "\n";
+            return log.str();
+        };
+
+        auto const zeroPointFour = Number(4, -1);
+        auto const zeroPointFive = Number(5, -1);
+        auto const zeroPointSix = Number(6, -1);
+        auto const onePointFour = Number(14, -1);
+        auto const onePointFive = Number(15, -1);
+        auto const onePointSix = Number(16, -1);
+        auto const twoPointFour = Number(24, -1);
+        auto const twoPointFive = Number(25, -1);
+        auto const twoPointSix = Number(26, -1);
+
+        auto const operands = std::to_array<Number>({
+            zeroPointFour,
+            zeroPointFive,
+            zeroPointSix,
+            onePointFour,
+            onePointFive,
+            onePointSix,
+            twoPointFour,
+            twoPointFive,
+            twoPointSix,
+        });
+
+        auto const modes = std::to_array<Number::RoundingMode>({
+            Number::RoundingMode::ToNearest,
+            Number::RoundingMode::TowardsZero,
+            Number::RoundingMode::Downward,
+            Number::RoundingMode::Upward,
+        });
+
+        // Addition cases test kMaxRep + Operand
+        for (auto const& mode : modes)
+        {
+            for (auto const& operand : operands)
+            {
+                NumberRoundModeGuard const rg{mode};
+
+                auto const expectedValue = [&]() {
+                    // Returns "above" by default. The checks here are for exceptions.
+                    if (scale >= MantissaRange::MantissaScale::Large330)
+                    {
+                        if (mode == Number::RoundingMode::ToNearest && operand < onePointFive)
+                            return below;
+                        if (mode == Number::RoundingMode::TowardsZero ||
+                            mode == Number::RoundingMode::Downward)
+                            return below;
+                    }
+                    if (scale == MantissaRange::MantissaScale::Large320)
+                    {
+                        if (mode == Number::RoundingMode::ToNearest)
+                        {
+                            if (operand < zeroPointFive)
+                                return below;
+                        }
+                        if (mode == Number::RoundingMode::TowardsZero ||
+                            mode == Number::RoundingMode::Downward)
+                        {
+                            if (operand >= onePointFour)
+                                return below - 7;
+                            return below;
+                        }
+                    }
+                    if (scale == MantissaRange::MantissaScale::LargeLegacy)
+                    {
+                        if (mode == Number::RoundingMode::ToNearest)
+                        {
+                            if (operand < zeroPointFive)
+                                return below;
+                            if (operand <= zeroPointSix)
+                                return below - 7;
+                        }
+                        if (mode == Number::RoundingMode::TowardsZero ||
+                            mode == Number::RoundingMode::Downward)
+                        {
+                            if (operand >= onePointFour)
+                                return below - 7;
+                            return below;
+                        }
+                        if (mode == Number::RoundingMode::Upward && operand <= zeroPointSix)
+                            return below - 7;
+                    }
+                    if (scale == MantissaRange::MantissaScale::Small &&
+                        mode == Number::RoundingMode::Upward)
+                        return above + 1000;
+                    return above;
+                }();
+
+                Number const actual = below + operand;
+
+                auto message = [&] {
+                    std::stringstream ss;
+                    ss << header() << "kMaxRep + " << operand << " rounded " << to_string(mode)
+                       << " to " << actual << ". Expected: " << expectedValue;
+                    return ss.str();
+                };
+                EXPECT_EQ(actual, expectedValue) << message();
+            }
+        }
+
+        // Subtraction cases test kMaxRepUp - Operand
+        for (auto const& mode : modes)
+        {
+            for (auto const& operand : operands)
+            {
+                NumberRoundModeGuard const rg{mode};
+
+                auto const expectedValue = [&]() {
+                    if (scale >= MantissaRange::MantissaScale::Large330)
+                    {
+                        if (mode == Number::RoundingMode::ToNearest && operand > onePointFive)
+                            return below;
+                        if (mode == Number::RoundingMode::TowardsZero ||
+                            mode == Number::RoundingMode::Downward)
+                            return below;
+                    }
+                    if (scale == MantissaRange::MantissaScale::LargeLegacy ||
+                        scale == MantissaRange::MantissaScale::Large320)
+                    {
+                        if (mode == Number::RoundingMode::ToNearest)
+                        {
+                            if (operand >= twoPointSix)
+                                return below;
+                        }
+                        if (mode == Number::RoundingMode::TowardsZero)
+                        {
+                            if (operand >= onePointFour)
+                                return below - 7;
+                        }
+                        if (mode == Number::RoundingMode::Downward)
+                        {
+                            if (operand <= onePointSix)
+                                return below - 7;
+                            return below;
+                        }
+                    }
+                    if (scale == MantissaRange::MantissaScale::Small)
+                    {
+                        if (mode == Number::RoundingMode::Downward)
+                            return below - 1000;
+                        if (mode == Number::RoundingMode::Upward)
+                            return below;
+                    }
+                    return above;
+                }();
+
+                Number const actual = above - operand;
+
+                auto message = [&] {
+                    std::stringstream ss;
+                    ss << header() << "kMaxRepUp - " << operand << " rounded " << to_string(mode)
+                       << " to " << actual << ". Expected: " << expectedValue;
+                    return ss.str();
+                };
+                EXPECT_EQ(actual, expectedValue) << message();
+            }
+        }
+    }
+}
+
 }  // namespace xrpl

From 530e09dbe8982ade14b8d469ab6323d7a65f0594 Mon Sep 17 00:00:00 2001
From: Ed Hennis <ed@ripple.com>
Date: Tue, 14 Jul 2026 14:48:10 -0400
Subject: [PATCH 076/100] fix: Update base_uint and test changes released in
 3.1.3 (#7570)

Co-authored-by: Sergey Kuznetsov <skuznetsov@ripple.com>
Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
---
 .../scripts/levelization/results/ordering.txt |   1 +
 include/xrpl/basics/base_uint.h               |  10 +-
 src/test/protocol/Issue_test.cpp              | 100 +++++++++++++
 src/test/protocol/STIssue_test.cpp            | 140 ++++++++++++++++++
 src/test/rpc/AccountObjects_test.cpp          |  83 +++++++++++
 src/test/rpc/Transaction_test.cpp             | 122 +++++++++++++++
 src/tests/libxrpl/basics/base_uint_test.cpp   |  80 ++++++++++
 7 files changed, 534 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/levelization/results/ordering.txt b/.github/scripts/levelization/results/ordering.txt
index aee6f4c579..b31e6ae961 100644
--- a/.github/scripts/levelization/results/ordering.txt
+++ b/.github/scripts/levelization/results/ordering.txt
@@ -159,6 +159,7 @@ test.peerfinder > xrpl.protocol
 test.protocol > test.jtx
 test.protocol > test.unit_test
 test.protocol > xrpl.basics
+test.protocol > xrpld.core
 test.protocol > xrpl.json
 test.protocol > xrpl.protocol
 test.rpc > test.jtx
diff --git a/include/xrpl/basics/base_uint.h b/include/xrpl/basics/base_uint.h
index 96cfa343e3..bee8b8b945 100644
--- a/include/xrpl/basics/base_uint.h
+++ b/include/xrpl/basics/base_uint.h
@@ -308,7 +308,9 @@ public:
         XRPL_ASSERT(
             c.size() * sizeof(typename Container::value_type) == size(),
             "xrpl::BaseUInt::fromRaw(Container auto) : input size match");
-        std::memcpy(result.data_.data(), c.data(), size());
+        std::size_t const canCopy =
+            std::min(size(), c.size() * sizeof(typename Container::value_type));
+        std::memcpy(result.data_.data(), c.data(), canCopy);
         return result;
     }
 
@@ -322,7 +324,11 @@ public:
         XRPL_ASSERT(
             c.size() * sizeof(typename Container::value_type) == size(),
             "xrpl::BaseUInt::operator=(Container auto) : input size match");
-        std::memcpy(data_.data(), c.data(), size());
+        std::size_t const canCopy =
+            std::min(size(), c.size() * sizeof(typename Container::value_type));
+        if (canCopy < size())
+            *this = beast::kZero;
+        std::memcpy(data_.data(), c.data(), canCopy);
         return *this;
     }
 
diff --git a/src/test/protocol/Issue_test.cpp b/src/test/protocol/Issue_test.cpp
index 44a36b7dcf..a6a1fdd341 100644
--- a/src/test/protocol/Issue_test.cpp
+++ b/src/test/protocol/Issue_test.cpp
@@ -1,10 +1,12 @@
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Book.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/jss.h>
 
 #include <functional>
 #include <map>
@@ -863,6 +865,101 @@ public:
 
     //--------------------------------------------------------------------------
 
+    void
+    testIssueFromJson()
+    {
+        testcase("issueFromJson");
+
+        // Valid XRP — no issuer field
+        {
+            json::Value jv;
+            jv[jss::currency] = "XRP";
+            auto const issue = issueFromJson(jv);
+            BEAST_EXPECT(isXRP(issue));
+        }
+
+        // Valid IOU — legitimate issuer
+        {
+            json::Value jv;
+            jv[jss::currency] = "USD";
+            jv[jss::issuer] = "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh";
+            auto const issue = issueFromJson(jv);
+            BEAST_EXPECT(!isXRP(issue));
+            BEAST_EXPECT(issue.account != noAccount());
+        }
+
+        // noAccount() is the MPT sentinel in binary serialization - must be
+        // rejected
+        try
+        {
+            json::Value jv;
+            jv[jss::currency] = "USD";
+            jv[jss::issuer] = to_string(noAccount());
+            issueFromJson(jv);
+            fail("noAccount() accepted as IOU issuer");
+        }
+        catch (...)
+        {
+            pass();
+        }
+
+        // xrpAccount() is the XRP sentinel (all zeros) - must be rejected
+        // as IOU issuer
+        try
+        {
+            json::Value jv;
+            jv[jss::currency] = "USD";
+            jv[jss::issuer] = to_string(xrpAccount());
+            issueFromJson(jv);
+            fail("xrpAccount() accepted as IOU issuer");
+        }
+        catch (...)
+        {
+            pass();
+        }
+
+        // Invalid base58 — must be rejected
+        try
+        {
+            json::Value jv;
+            jv[jss::currency] = "USD";
+            jv[jss::issuer] = "not_a_valid_address";
+            issueFromJson(jv);
+            fail("invalid base58 accepted as IOU issuer");
+        }
+        catch (...)
+        {
+            pass();
+        }
+
+        // Non-XRP currency with no issuer field — must be rejected
+        try
+        {
+            json::Value jv;
+            jv[jss::currency] = "USD";
+            issueFromJson(jv);
+            fail("missing issuer accepted");
+        }
+        catch (...)
+        {
+            pass();
+        }
+
+        // XRP with an issuer field — must be rejected
+        try
+        {
+            json::Value jv;
+            jv[jss::currency] = "XRP";
+            jv[jss::issuer] = "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh";
+            issueFromJson(jv);
+            fail("XRP with issuer accepted");
+        }
+        catch (...)
+        {
+            pass();
+        }
+    }
+
     void
     run() override
     {
@@ -897,6 +994,9 @@ public:
         // ---
         testIssueDomainSets();
         testIssueDomainMaps();
+
+        // ---
+        testIssueFromJson();
     }
 };
 
diff --git a/src/test/protocol/STIssue_test.cpp b/src/test/protocol/STIssue_test.cpp
index 1d6d750355..b7cc944e6b 100644
--- a/src/test/protocol/STIssue_test.cpp
+++ b/src/test/protocol/STIssue_test.cpp
@@ -1,15 +1,24 @@
 
 #include <test/jtx/Account.h>
+#include <test/jtx/Env.h>
 #include <test/jtx/amount.h>  // IWYU pragma: keep
+#include <test/jtx/envconfig.h>
+
+#include <xrpld/core/Config.h>
 
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/unit_test/suite.h>
+#include <xrpl/json/json_value.h>
+#include <xrpl/json/to_string.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STIssue.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/UintTypes.h>
+#include <xrpl/protocol/jss.h>
+
+#include <memory>
 
 namespace xrpl::test {
 
@@ -137,12 +146,143 @@ public:
             "000000000000000000000000000000000000000000000002");
     }
 
+    void
+    testNoAccountIssuerRpc()
+    {
+        testcase("noAccount issuer rejected via RPC sign");
+
+        using namespace jtx;
+        Env env{*this, envconfig([](std::unique_ptr<Config> cfg) {
+                    cfg->loadFromString("[signing_support]\ntrue");
+                    return cfg;
+                })};
+
+        Account const alice{"alice"};
+        env.fund(XRP(10000), alice);
+        env.close();
+
+        json::Value txJson;
+        txJson[jss::TransactionType] = "AMMDelete";
+        txJson[jss::Account] = alice.human();
+        txJson[jss::Asset][jss::currency] = "USD";
+        txJson[jss::Asset][jss::issuer] = to_string(noAccount());
+        txJson[jss::Asset2][jss::currency] = "XRP";
+
+        json::Value req;
+        req[jss::tx_json] = txJson;
+        req[jss::secret] = alice.name();
+
+        auto const result = env.rpc("json", "sign", to_string(req))[jss::result];
+
+        BEAST_EXPECT(result[jss::error] == "invalidParams");
+        BEAST_EXPECT(result[jss::error_message] == "Field 'tx_json.Asset' has invalid data.");
+    }
+
+    void
+    testNoAccountIssuer()
+    {
+        testcase("noAccount issuer rejection");
+
+        {
+            json::Value jv;
+            jv[jss::currency] = "USD";
+            jv[jss::issuer] = to_string(noAccount());
+
+            try
+            {
+                issueFromJson(sfAsset, jv);
+                fail("issueFromJson accepted noAccount() as IOU issuer");
+            }
+            catch (...)
+            {
+                pass();
+            }
+        }
+
+        {
+            Serializer s;
+            s.addBitString(toCurrency("USD"));
+            s.addBitString(noAccount());
+            SerialIter iter(s.slice());
+
+            try
+            {
+                STIssue const stissue(iter, sfAsset);
+                fail(
+                    "STIssue deserialization of [USD][noAccount()] should "
+                    "throw");
+            }
+            catch (...)
+            {
+                pass();
+            }
+        }
+    }
+
+    void
+    testXrpAccountIssuerRpc()
+    {
+        testcase("xrpAccount issuer rejected via RPC sign");
+
+        using namespace jtx;
+        Env env{*this, envconfig([](std::unique_ptr<Config> cfg) {
+                    cfg->loadFromString("[signing_support]\ntrue");
+                    return cfg;
+                })};
+
+        Account const alice{"alice"};
+        env.fund(XRP(10000), alice);
+        env.close();
+
+        json::Value txJson;
+        txJson[jss::TransactionType] = "AMMDelete";
+        txJson[jss::Account] = alice.human();
+        txJson[jss::Asset][jss::currency] = "USD";
+        txJson[jss::Asset][jss::issuer] = to_string(xrpAccount());
+        txJson[jss::Asset2][jss::currency] = "XRP";
+
+        json::Value req;
+        req[jss::tx_json] = txJson;
+        req[jss::secret] = alice.name();
+
+        auto const result = env.rpc("json", "sign", to_string(req))[jss::result];
+
+        BEAST_EXPECT(result[jss::error] == "invalidParams");
+        BEAST_EXPECT(result[jss::error_message] == "Field 'tx_json.Asset' has invalid data.");
+    }
+
+    void
+    testXrpAccountIssuer()
+    {
+        testcase("xrpAccount issuer rejection");
+
+        {
+            json::Value jv;
+            jv[jss::currency] = "USD";
+            jv[jss::issuer] = to_string(xrpAccount());
+
+            try
+            {
+                issueFromJson(sfAsset, jv);
+                fail("issueFromJson accepted xrpAccount() as IOU issuer");
+            }
+            catch (...)
+            {
+                pass();
+            }
+        }
+    }
+
     void
     run() override
     {
         // compliments other unit tests to ensure complete coverage
         testConstructor();
         testCompare();
+        testNoAccountIssuerRpc();
+        testNoAccountIssuer();
+        testXrpAccountIssuerRpc();
+        testXrpAccountIssuer();
     }
 };
 
diff --git a/src/test/rpc/AccountObjects_test.cpp b/src/test/rpc/AccountObjects_test.cpp
index 6ba6e7de9f..c656c97a4c 100644
--- a/src/test/rpc/AccountObjects_test.cpp
+++ b/src/test/rpc/AccountObjects_test.cpp
@@ -27,6 +27,7 @@
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/Seed.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/jss.h>
 #include <xrpl/protocol/nft.h>
@@ -36,6 +37,7 @@
 #include <cstdint>
 #include <iterator>
 #include <optional>
+#include <ranges>
 #include <vector>
 
 namespace xrpl::test {
@@ -1616,6 +1618,86 @@ public:
         }
     }
 
+    void
+    testAccountObjectDoesntShowCancelledOffers()
+    {
+        testcase("AccountObjectDoesntShowCancelledOffers");
+
+        using namespace jtx;
+        Env env(*this);
+
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        auto const eur = bob["EUR"];
+        env.fund(XRP(10000), alice, bob);
+        env.close();
+
+        auto const rpcAccountObjects = [&](std::optional<uint32_t> limit = std::nullopt) {
+            json::Value params;
+            params[jss::account] = alice.human();
+            if (limit.has_value())
+            {
+                params[jss::limit] = *limit;
+            }
+            return env.rpc("json", "account_objects", to_string(params));
+        };
+
+        auto const numEntries = 33;
+        std::vector<uint32_t> seqs;
+        seqs.reserve(numEntries);
+        for ([[maybe_unused]] auto _ : std::ranges::iota_view{0, numEntries})
+        {
+            json::Value params;
+            params[jss::secret] = toBase58(generateSeed("alice"));
+            params[jss::tx_json] = offer(alice, eur(1), XRP(2));
+            auto const res = env.rpc("json", "submit", to_string(params))[jss::result];
+            BEAST_EXPECT(res[jss::engine_result].asString() == "tesSUCCESS");
+            seqs.push_back(env.seq(alice));
+        }
+
+        auto res = rpcAccountObjects();
+        BEAST_EXPECT(res[jss::result][jss::account_objects].size() == numEntries);
+        BEAST_EXPECT(not res[jss::result].isMember(jss::limit));
+        BEAST_EXPECT(not res[jss::result].isMember(jss::marker));
+
+        for (auto const s : std::views::all(seqs) | std::views::take(numEntries - 1))
+        {
+            json::Value params;
+            params[jss::secret] = toBase58(generateSeed("alice"));
+            params[jss::tx_json] = offerCancel(alice, s - 1);
+            auto const res = env.rpc("json", "submit", to_string(params))[jss::result];
+            BEAST_EXPECT(res[jss::engine_result].asString() == "tesSUCCESS");
+        }
+
+        res = rpcAccountObjects();
+        BEAST_EXPECT(res[jss::result][jss::account_objects].size() == 1);
+        BEAST_EXPECT(not res[jss::result].isMember(jss::limit));
+        BEAST_EXPECT(not res[jss::result].isMember(jss::marker));
+
+        {
+            json::Value params;
+            params[jss::secret] = toBase58(generateSeed("alice"));
+            json::Value txJson;
+            txJson[jss::TransactionType] = jss::NFTokenMint;
+            txJson[jss::Account] = to_string(alice.id());
+            txJson["NFTokenTaxon"] = 1;
+            params[jss::tx_json] = txJson;
+            auto const res = env.rpc("json", "submit", to_string(params))[jss::result];
+            BEAST_EXPECT(res[jss::engine_result].asString() == "tesSUCCESS");
+        }
+        env.close();
+
+        res = rpcAccountObjects();
+        BEAST_EXPECT(res[jss::result][jss::account_objects].size() == 2);
+        BEAST_EXPECT(not res[jss::result].isMember(jss::limit));
+        BEAST_EXPECT(not res[jss::result].isMember(jss::marker));
+
+        res = rpcAccountObjects(1);
+        BEAST_EXPECT(res[jss::result][jss::account_objects].size() == 1);
+        BEAST_EXPECT(res[jss::result][jss::limit].asUInt() == 1);
+        BEAST_EXPECT(res[jss::result].isMember(jss::marker));
+    }
+
     void
     run() override
     {
@@ -1627,6 +1709,7 @@ public:
         testAccountNFTs();
         testAccountObjectMarker();
         testSponsoredFilter();
+        testAccountObjectDoesntShowCancelledOffers();
     }
 };
 
diff --git a/src/test/rpc/Transaction_test.cpp b/src/test/rpc/Transaction_test.cpp
index c3bf707ec4..4dae475b63 100644
--- a/src/test/rpc/Transaction_test.cpp
+++ b/src/test/rpc/Transaction_test.cpp
@@ -2,6 +2,7 @@
 #include <test/jtx/Env.h>
 #include <test/jtx/amount.h>
 #include <test/jtx/envconfig.h>
+#include <test/jtx/multisign.h>
 #include <test/jtx/noop.h>
 #include <test/jtx/pay.h>
 #include <test/jtx/seq.h>
@@ -880,6 +881,125 @@ class Transaction_test : public beast::unit_test::Suite
         }
     }
 
+    void
+    testSignForNetworkIDValidation()
+    {
+        testcase("SignFor NetworkID validation");
+        using namespace test::jtx;
+
+        Account const owner{"owner"};
+        Account const signer{"signer"};
+
+        auto makeConfig = [](std::uint32_t networkID) {
+            return envconfig([networkID](std::unique_ptr<Config> cfg) {
+                cfg->networkId = networkID;
+                return cfg;
+            });
+        };
+
+        auto setupEnv = [&](Env& env) {
+            env.fund(XRP(10'000), owner, signer);
+            env.close();
+            env(signers(owner, 1, {{signer, 1}}));
+            env.close();
+        };
+
+        auto makeTx = [&](Env& env) {
+            json::Value tx;
+            tx[jss::TransactionType] = jss::AccountSet;
+            tx[jss::Account] = owner.human();
+            tx[jss::Sequence] = env.seq(owner);
+            tx[jss::Fee] = "100";
+            tx[jss::SigningPubKey] = "";
+            return tx;
+        };
+
+        auto signFor = [&](Env& env, json::Value const& tx) {
+            json::Value signReq;
+            signReq[jss::tx_json] = tx;
+            signReq[jss::account] = signer.human();
+            signReq[jss::secret] = signer.name();
+            return env.rpc("json", "sign_for", to_string(signReq))[jss::result];
+        };
+
+        // Test case: NetworkID < 1024 - field is not required
+        {
+            Env env{*this, makeConfig(500)};
+            setupEnv(env);
+
+            auto tx = makeTx(env);
+            auto result = signFor(env, tx);
+
+            BEAST_EXPECT(result[jss::status] == "success");
+            BEAST_EXPECT(!result[jss::tx_json].isMember(jss::NetworkID));
+        }
+
+        // Test case: NetworkID > 1024 - missing NetworkID field
+        {
+            Env env{*this, makeConfig(2040)};
+            setupEnv(env);
+
+            auto tx = makeTx(env);
+            auto result = signFor(env, tx);
+
+            BEAST_EXPECT(result[jss::error] == "invalidParams");
+            BEAST_EXPECT(result[jss::error_message] == "Missing field 'tx_json.NetworkID'.");
+        }
+
+        // Test case: NetworkID > 1024 - NetworkID field is not a number
+        {
+            Env env{*this, makeConfig(2040)};
+            setupEnv(env);
+
+            auto tx = makeTx(env);
+            tx[jss::NetworkID] = "not_a_number";
+            auto result = signFor(env, tx);
+
+            BEAST_EXPECT(result[jss::error] == "invalidParams");
+            BEAST_EXPECT(result[jss::error_message] == "Invalid field 'tx_json.NetworkID'.");
+        }
+
+        // Test case: NetworkID > 1024 - NetworkID field is not integral
+        {
+            Env env{*this, makeConfig(2040)};
+            setupEnv(env);
+
+            auto tx = makeTx(env);
+            tx[jss::NetworkID] = 2040.1;
+            auto result = signFor(env, tx);
+
+            BEAST_EXPECT(result[jss::error] == "invalidParams");
+            BEAST_EXPECT(result[jss::error_message] == "Invalid field 'tx_json.NetworkID'.");
+        }
+
+        // Test case: NetworkID > 1024 - NetworkID field is different from
+        // actual NetworkID
+        {
+            Env env{*this, makeConfig(2040)};
+            setupEnv(env);
+
+            auto tx = makeTx(env);
+            tx[jss::NetworkID] = 9999;
+            auto result = signFor(env, tx);
+
+            BEAST_EXPECT(result[jss::error] == "invalidParams");
+            BEAST_EXPECT(result[jss::error_message] == "Invalid field 'tx_json.NetworkID'.");
+        }
+
+        // Test case: NetworkID > 1024 - NetworkID field is correct
+        {
+            Env env{*this, makeConfig(2040)};
+            setupEnv(env);
+
+            auto tx = makeTx(env);
+            tx[jss::NetworkID] = 2040;
+            auto result = signFor(env, tx);
+
+            BEAST_EXPECT(result[jss::status] == "success");
+            BEAST_EXPECT(result[jss::tx_json][jss::NetworkID].asUInt() == 2040);
+        }
+    }
+
 public:
     void
     run() override
@@ -889,6 +1009,8 @@ public:
 
         FeatureBitset const all{testableAmendments()};
         testWithFeats(all);
+
+        testSignForNetworkIDValidation();
     }
 
     void
diff --git a/src/tests/libxrpl/basics/base_uint_test.cpp b/src/tests/libxrpl/basics/base_uint_test.cpp
index eefbff158d..c9bfc35c94 100644
--- a/src/tests/libxrpl/basics/base_uint_test.cpp
+++ b/src/tests/libxrpl/basics/base_uint_test.cpp
@@ -122,6 +122,73 @@ struct BaseUintTest : public ::testing::Test
     }
 };
 
+using BaseUintDeathTest = BaseUintTest;
+
+TEST_F(BaseUintDeathTest, fromRaw_size_mismatch)
+{
+    // ENABLE_VOIDSTAR is a debug build, but does not crash on failed asserts. Rather than twist
+    // these tests into knots to make them work, just skip them.
+#ifdef ENABLE_VOIDSTAR
+    GTEST_SKIP() << "ENABLE_VOIDSTAR is a debug build, but does not crash on failed asserts.";
+#else
+    auto smallConstruct = [] {
+        // Container smaller than the base_uint (8 bytes vs 12 bytes for
+        // test96). Only the first 8 bytes are copied; the remaining 4 bytes
+        // stay zero.
+        Blob const tooSmall{1, 2, 3, 4, 5, 6, 7, 8};
+        BaseUInt96 const result = BaseUInt96::fromRaw(tooSmall);
+        auto const resultText = to_string(result);
+        EXPECT_EQ(resultText, "010203040506070800000000") << resultText;
+    };
+    EXPECT_DEBUG_DEATH(smallConstruct(), "input size match");
+
+    auto largeConstruct = [] {
+        // Container larger than the base_uint (16 bytes vs 12 bytes for
+        // test96). Only the first 12 bytes are copied; the extra bytes are
+        // ignored.
+        Blob const tooBig{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
+        BaseUInt96 const result = BaseUInt96::fromRaw(tooBig);
+        auto const resultText = to_string(result);
+        EXPECT_EQ(resultText, "0102030405060708090A0B0C") << resultText;
+    };
+    EXPECT_DEBUG_DEATH(largeConstruct(), "input size match");
+
+    auto smallCopy = [] {
+        // Container smaller than the base_uint (8 bytes vs 12 bytes for
+        // test96). Only the first 8 bytes are copied; the remaining 4 bytes
+        // stay zero.
+        Blob const tooSmall{1, 2, 3, 4, 5, 6, 7, 8};
+        BaseUInt96 result{};
+        --result;
+        {
+            auto const originalText = to_string(result);
+            EXPECT_EQ(originalText, "FFFFFFFFFFFFFFFFFFFFFFFF") << originalText;
+        }
+        result = tooSmall;
+        auto const resultText = to_string(result);
+        EXPECT_EQ(resultText, "010203040506070800000000") << resultText;
+    };
+    EXPECT_DEBUG_DEATH(smallCopy(), "input size match");
+
+    auto const largeCopy = [] {
+        // Container larger than the base_uint (16 bytes vs 12 bytes for
+        // test96). Only the first 12 bytes are copied; the extra bytes are
+        // ignored.
+        Blob const tooBig{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
+        BaseUInt96 result{};
+        --result;
+        {
+            auto const originalText = to_string(result);
+            EXPECT_EQ(originalText, "FFFFFFFFFFFFFFFFFFFFFFFF") << originalText;
+        }
+        result = tooBig;
+        auto const resultText = to_string(result);
+        EXPECT_EQ(resultText, "0102030405060708090A0B0C") << resultText;
+    };
+    EXPECT_DEBUG_DEATH(largeCopy(), "input size match");
+#endif
+}
+
 TEST_F(BaseUintTest, base_uint)
 {
     static_assert(!std::is_constructible_v<BaseUInt96, std::complex<double>>);
@@ -198,6 +265,19 @@ TEST_F(BaseUintTest, base_uint)
         EXPECT_EQ(d, 0);
     }
 
+    {
+        // There are several ways to create a zero. beast::kZero is tested above. Test some
+        // others.
+        BaseUInt96 const z1;
+        EXPECT_EQ(z1, z) << to_string(z1);
+
+        BaseUInt96 const z2{};
+        EXPECT_EQ(z2, z) << to_string(z2);
+
+        BaseUInt96 const z3{0u};
+        EXPECT_EQ(z3, z) << to_string(z3);
+    }
+
     BaseUInt96 n{z};
     n++;
     EXPECT_EQ(n, BaseUInt96(1));

From cda63d00a29ef7fd42f88d7296655bf951410ca0 Mon Sep 17 00:00:00 2001
From: Kassaking7 <96991820+Kassaking7@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:41:53 -0400
Subject: [PATCH 077/100] fix: Add amendment sponsor for
 AccountRootsDeletedClean (#7801)

---
 src/libxrpl/tx/invariants/InvariantCheck.cpp |  2 +-
 src/test/app/Invariants_test.cpp             | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/libxrpl/tx/invariants/InvariantCheck.cpp b/src/libxrpl/tx/invariants/InvariantCheck.cpp
index 3615594d19..9b997e06dd 100644
--- a/src/libxrpl/tx/invariants/InvariantCheck.cpp
+++ b/src/libxrpl/tx/invariants/InvariantCheck.cpp
@@ -489,7 +489,7 @@ AccountRootsDeletedClean::finalize(
     // feature is enabled. Enabled, or not, though, a fatal-level message will
     // be logged
     [[maybe_unused]] bool const enforce = view.rules().enabled(fixCleanup3_2_0) ||
-        view.rules().enabled(featureSingleAssetVault) ||
+        view.rules().enabled(featureSponsor) || view.rules().enabled(featureSingleAssetVault) ||
         view.rules().enabled(featureLendingProtocol);
 
     auto const objectExists = [&view, enforce, &j](auto const& keylet) {
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 9c90ade72f..076e39a42b 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -412,6 +412,23 @@ class Invariants_test : public beast::unit_test::Suite
             XRPAmount{},
             STTx{ttACCOUNT_DELETE, [](STObject& tx) {}});
 
+        doInvariantCheck(
+            Env{*this, FeatureBitset{featureSponsor}},
+            {{"account deletion left behind a sponsorship field"}},
+            [&](Account const& a1, Account const& a2, ApplyContext& ac) {
+                auto const sleA1 = ac.view().peek(keylet::account(a1.id()));
+                if (!sleA1)
+                    return false;
+                sleA1->at(sfBalance) = beast::kZero;
+                sleA1->setAccountID(sfSponsor, a2.id());
+
+                ac.view().erase(sleA1);
+
+                return true;
+            },
+            XRPAmount{},
+            STTx{ttACCOUNT_DELETE, [](STObject& tx) {}});
+
         for (auto const& keyletInfo : kDirectAccountKeylets)
         {
             // TODO: Use structured binding once LLVM 16 is the minimum

From a0fd1cce542f2ab9e43b9d9857d5173927966b50 Mon Sep 17 00:00:00 2001
From: Sophia Xie <106177003+sophiax851@users.noreply.github.com>
Date: Tue, 14 Jul 2026 16:42:40 -0700
Subject: [PATCH 078/100] fix: Re-store nodes missing from both backends during
 online_delete rotation (#7763)

Co-authored-by: Valentin Balaschenko <13349202+vlntb@users.noreply.github.com>
---
 include/xrpl/nodestore/DatabaseRotating.h     | 13 +++++++
 .../nodestore/detail/DatabaseRotatingImp.h    | 12 ++++++
 src/libxrpl/nodestore/DatabaseRotatingImp.cpp | 32 +++++++++++++++-
 src/xrpld/app/misc/SHAMapStoreImp.cpp         | 37 ++++++++++++++++++-
 4 files changed, 91 insertions(+), 3 deletions(-)

diff --git a/include/xrpl/nodestore/DatabaseRotating.h b/include/xrpl/nodestore/DatabaseRotating.h
index 1c5bb0efaf..5381b5c435 100644
--- a/include/xrpl/nodestore/DatabaseRotating.h
+++ b/include/xrpl/nodestore/DatabaseRotating.h
@@ -41,6 +41,19 @@ public:
         std::unique_ptr<NodeStore::Backend>&& newBackend,
         std::function<void(std::string const& writableName, std::string const& archiveName)> const&
             f) = 0;
+
+    /**
+     * Marks an online-delete rotation as in progress (or completed).
+     *
+     * While in flight, a read served by the archive backend is copied
+     * forward into the writable backend even for ordinary
+     * (duplicate == false) fetches: the archive is about to be deleted,
+     * and a node body canonicalized into caches during the rotation
+     * window would otherwise survive only in RAM once the archive is
+     * dropped.
+     */
+    virtual void
+    setRotationInFlight(bool inFlight) = 0;
 };
 
 }  // namespace xrpl::NodeStore
diff --git a/include/xrpl/nodestore/detail/DatabaseRotatingImp.h b/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
index 6343275c76..ecbe9a513d 100644
--- a/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
+++ b/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
@@ -9,6 +9,7 @@
 #include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/nodestore/Scheduler.h>
 
+#include <atomic>
 #include <cstdint>
 #include <functional>
 #include <memory>
@@ -69,11 +70,22 @@ public:
     void
     sweep() override;
 
+    void
+    setRotationInFlight(bool inFlight) override;
+
 private:
     std::shared_ptr<Backend> writableBackend_;
     std::shared_ptr<Backend> archiveBackend_;
     mutable std::mutex mutex_;
 
+    // True between SHAMapStore starting the cache-freshen phase and the
+    // completion of rotate(). While true, archive hits on ordinary
+    // (duplicate == false) fetches are copied forward into the writable
+    // backend; copyForwardCount_ tallies them per rotation for the
+    // summary line logged at swap.
+    std::atomic<bool> rotationInFlight_{false};
+    std::atomic<std::uint64_t> copyForwardCount_{0};
+
     std::shared_ptr<NodeObject>
     fetchNodeObject(uint256 const& hash, std::uint32_t, FetchReport& fetchReport, bool duplicate)
         override;
diff --git a/src/libxrpl/nodestore/DatabaseRotatingImp.cpp b/src/libxrpl/nodestore/DatabaseRotatingImp.cpp
index 7f4dca3ed1..23a48a3bf3 100644
--- a/src/libxrpl/nodestore/DatabaseRotatingImp.cpp
+++ b/src/libxrpl/nodestore/DatabaseRotatingImp.cpp
@@ -13,6 +13,7 @@
 #include <xrpl/nodestore/Scheduler.h>
 #include <xrpl/nodestore/Types.h>
 
+#include <atomic>
 #include <cstdint>
 #include <exception>
 #include <functional>
@@ -52,6 +53,7 @@ DatabaseRotatingImp::rotate(
     // callback finishes. Only then will the archive directory be
     // deleted.
     std::shared_ptr<NodeStore::Backend> oldArchiveBackend;
+    std::uint64_t copyForwards = 0;
     {
         std::scoped_lock const lock(mutex_);
 
@@ -62,11 +64,28 @@ DatabaseRotatingImp::rotate(
         newArchiveBackendName = archiveBackend_->getName();
 
         writableBackend_ = std::move(newBackend);
+
+        copyForwards = copyForwardCount_.exchange(0, std::memory_order_relaxed);
+    }
+
+    if (copyForwards > 0)
+    {
+        JLOG(j_.warn()) << "Rotating: copied forward " << copyForwards
+                        << " archive-served reads into the writable backend "
+                           "during the rotation window";
     }
 
     f(newWritableBackendName, newArchiveBackendName);
 }
 
+void
+DatabaseRotatingImp::setRotationInFlight(bool inFlight)
+{
+    rotationInFlight_.store(inFlight, std::memory_order_release);
+    JLOG(j_.debug()) << "Rotating: copy-forward on archive reads "
+                     << (inFlight ? "enabled" : "disabled");
+}
+
 std::string
 DatabaseRotatingImp::getName() const
 {
@@ -177,9 +196,18 @@ DatabaseRotatingImp::fetchNodeObject(
                 writable = writableBackend_;
             }
 
-            // Update writable backend with data from the archive backend
-            if (duplicate)
+            // Update writable backend with data from the archive backend.
+            // While a rotation is in flight, ordinary (duplicate == false)
+            // reads served by the archive are copied forward too: the
+            // archive is about to be deleted, and a body canonicalized
+            // into the cache after the freshen getKeys() snapshot would
+            // otherwise survive only in RAM once the archive is dropped.
+            if (duplicate || rotationInFlight_.load(std::memory_order_acquire))
+            {
+                if (!duplicate)
+                    copyForwardCount_.fetch_add(1, std::memory_order_relaxed);
                 writable->store(nodeObject);
+            }
         }
     }
 
diff --git a/src/xrpld/app/misc/SHAMapStoreImp.cpp b/src/xrpld/app/misc/SHAMapStoreImp.cpp
index 6167b5d772..9b5f412fc5 100644
--- a/src/xrpld/app/misc/SHAMapStoreImp.cpp
+++ b/src/xrpld/app/misc/SHAMapStoreImp.cpp
@@ -16,9 +16,11 @@
 #include <xrpl/ledger/Ledger.h>
 #include <xrpl/nodestore/Database.h>
 #include <xrpl/nodestore/Manager.h>
+#include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/nodestore/Scheduler.h>
 #include <xrpl/nodestore/detail/DatabaseRotatingImp.h>
 #include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/server/NetworkOPs.h>
 #include <xrpl/server/State.h>
 #include <xrpl/shamap/SHAMapMissingNode.h>
@@ -254,8 +256,24 @@ bool
 SHAMapStoreImp::copyNode(std::uint64_t& nodeCount, SHAMapTreeNode const& node)
 {
     // Copy a single record from node to dbRotating_
-    dbRotating_->fetchNodeObject(
+    auto obj = dbRotating_->fetchNodeObject(
         node.getHash().asUInt256(), 0, NodeStore::FetchType::Synchronous, true);
+    if (!obj)
+    {
+        XRPL_ASSERT(node.cowid() == 0, "SHAMapStoreImp::copyNode : rescued node must be clean");
+        // Reachable from the validated state map in memory, but present in
+        // neither backend: its only on-disk copy lived in a backend removed by
+        // an earlier rotation, and it was never rewritten because it is clean
+        // (cowid == 0, so flushDirty skips it). Persist the in-memory body
+        // directly into the writable backend so it survives this rotation
+        // instead of later surfacing as an unresolvable SHAMapMissingNode.
+        auto const hash = node.getHash().asUInt256();
+        Serializer s;
+        node.serializeWithPrefix(s);
+        dbRotating_->store(NodeObjectType::AccountNode, std::move(s.modData()), hash, 0);
+        JLOG(journal_.warn()) << "copyNode: re-stored node missing from both backends, hash="
+                              << hash << " type=" << static_cast<int>(node.getType());
+    }
     if ((++nodeCount % checkHealthInterval_) == 0u)
     {
         if (healthWait() == HealthResult::Stopping)
@@ -348,6 +366,23 @@ SHAMapStoreImp::run()
             JLOG(journal_.debug())
                 << "copied ledger " << validatedSeq << " nodecount " << nodeCount;
 
+            // Close the getKeys()->swap exposure window: from here until
+            // rotate() completes, an ordinary read served by the archive is
+            // copied forward into the writable backend, so a node fetched
+            // from the doomed archive cannot be left RAM-only when the
+            // archive is deleted. RAII so the early returns below (and any
+            // exception) also clear the flag.
+            struct RotationExposureGuard
+            {
+                NodeStore::DatabaseRotating& db;
+                ~RotationExposureGuard()
+                {
+                    db.setRotationInFlight(false);
+                }
+            };
+            RotationExposureGuard const rotationExposureGuard{*dbRotating_};
+            dbRotating_->setRotationInFlight(true);
+
             JLOG(journal_.debug()) << "freshening caches";
             freshenCaches();
             if (healthWait() == HealthResult::Stopping)

From a24e543af3b1aaa25803835bae54df2b1a743349 Mon Sep 17 00:00:00 2001
From: Ed Hennis <ed@ripple.com>
Date: Wed, 15 Jul 2026 09:30:20 -0400
Subject: [PATCH 079/100] fix: Allocate TaggedCache::getKeys() memory outside
 of lock (#7567)

Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>
---
 include/xrpl/basics/TaggedCache.ipp | 41 +++++++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 2 deletions(-)

diff --git a/include/xrpl/basics/TaggedCache.ipp b/include/xrpl/basics/TaggedCache.ipp
index b79561c71a..447743a7b7 100644
--- a/include/xrpl/basics/TaggedCache.ipp
+++ b/include/xrpl/basics/TaggedCache.ipp
@@ -3,6 +3,9 @@
 #include <xrpl/basics/IntrusivePointer.ipp>
 #include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/scope.h>
+
+#include <algorithm>
 
 namespace xrpl {
 
@@ -601,8 +604,42 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     std::vector<key_type> v;
 
     {
-        std::scoped_lock const lock(mutex_);
-        v.reserve(cache_.size());
+        // Keep track of how many iterations are needed. Exit the loop if the number of retries gets
+        // absurd. (Note that if this somehow ever happens, one more allocation will be done under
+        // lock, which is undesirable, but really should be almost impossible.)
+        std::size_t allocationIterations = 0;
+        std::unique_lock lock(mutex_);
+        for (auto size = cache_.size(); v.capacity() < size && allocationIterations < 20;
+             size = cache_.size())
+        {
+            ScopeUnlock const unlock(lock);
+            if (allocationIterations > 0)
+            {
+                JLOG(journal_.info())
+                    << "getKeys(): Cache grew beyond allocated capacity after "
+                    << allocationIterations << " prior attempt(s). Have " << v.capacity()
+                    << ", need " << size << ". Retrying allocation";
+            }
+            // Allocate the current size plus a little extra, in case the cache grows while
+            // allocating. Each time another allocation is needed, the extra also gets bigger until
+            // it ultimately doubles the size + 1.
+            constexpr std::size_t baseShift = 5;
+            auto const bufferOffset = std::min(allocationIterations, std::size_t{baseShift});
+            auto const bufferShift = baseShift - bufferOffset;
+            size += (size >> bufferShift) + 1;
+            v.reserve(size);
+            ++allocationIterations;
+        }
+        if (v.capacity() < cache_.size())
+        {
+            // LCOV_EXCL_START
+            UNREACHABLE("xrpl::TaggedCache::getKeys(): failed to allocate sufficient capacity");
+            v.reserve(cache_.size());
+            // LCOV_EXCL_STOP
+        }
+        XRPL_ASSERT(lock.owns_lock(), "xrpl::TaggedCache::getKeys(): owns lock");
+        XRPL_ASSERT(
+            v.capacity() >= cache_.size(), "xrpl::TaggedCache::getKeys(): sufficient capacity");
         for (auto const& _ : cache_)
             v.push_back(_.first);
     }

From 781ab723afb1a55748405f91447a40d69c5442f7 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 15 Jul 2026 19:24:31 +0100
Subject: [PATCH 080/100] ci: Fix workflow launch on matrix-unrelated labels
 (#7812)

---
 .github/workflows/on-pr.yml | 37 +++++++++++++------------------------
 1 file changed, 13 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index bbf6f8c39e..442a202a44 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -25,18 +25,11 @@ on:
       - unlabeled
 
 concurrency:
-  # Use a per-ref group so a newer run (a push, or a change to a label below)
-  # supersedes the in-progress one for that ref. Label events we don't act on get
-  # their own unique group (per run id) instead, keeping them out of the shared
-  # group so real builds keep running. Keep this list in sync with `should-run`.
-  group: >-
-    ${{ github.workflow }}-${{ github.ref }}${{
-      ((github.event.action == 'labeled' || github.event.action == 'unlabeled')
-      && github.event.label.name != 'Ready to merge'
-      && github.event.label.name != 'DraftRunCI'
-      && github.event.label.name != 'Full CI build')
-      && format('-{0}', github.run_id) || ''
-    }}
+  # A single per-ref group with cancel-in-progress means any newer run (a push
+  # or a label change) supersedes the in-progress one for that ref. Keeping
+  # exactly one authoritative run per ref ensures a fast do-nothing run can never
+  # mask a real build's checks.
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 defaults:
@@ -44,21 +37,17 @@ defaults:
     shell: bash
 
 jobs:
-  # This job determines whether the rest of the workflow should run. It runs
-  # when the PR is not a draft (which should also cover merge-group) or has the
-  # 'DraftRunCI' or 'Full CI build' label. For label events it only runs when the
-  # label added or removed is one we act on ('Ready to merge', 'DraftRunCI' or
-  # 'Full CI build'), so unrelated label changes do not trigger a redundant run.
+  # This job determines whether the rest of the workflow should run at all,
+  # based on the current set of labels: it runs when the PR is not a draft
+  # (which should also cover merge-group) or has the 'DraftRunCI' or
+  # 'Full CI build' label. Whether a build then happens, and whether it is the
+  # minimal or full matrix, is decided further below and in the strategy matrix.
   should-run:
     if: >-
       ${{
-        ((github.event.action != 'labeled' && github.event.action != 'unlabeled')
-          || github.event.label.name == 'Ready to merge'
-          || github.event.label.name == 'DraftRunCI'
-          || github.event.label.name == 'Full CI build')
-        && (!github.event.pull_request.draft
-          || contains(github.event.pull_request.labels.*.name, 'DraftRunCI')
-          || contains(github.event.pull_request.labels.*.name, 'Full CI build'))
+        !github.event.pull_request.draft
+        || contains(github.event.pull_request.labels.*.name, 'DraftRunCI')
+        || contains(github.event.pull_request.labels.*.name, 'Full CI build')
       }}
     runs-on: ubuntu-latest
     steps:

From 433e5f68968ea295abaae4948676e9be3879a0e2 Mon Sep 17 00:00:00 2001
From: Vlad <129996061+vvysokikh1@users.noreply.github.com>
Date: Wed, 15 Jul 2026 23:08:45 +0100
Subject: [PATCH 081/100] fix: Reject zero CheckID in CheckCancel and CheckCash
 (#7685)

---
 src/libxrpl/tx/transactors/check/CheckCancel.cpp |  5 +++++
 src/libxrpl/tx/transactors/check/CheckCash.cpp   |  4 ++++
 src/test/app/Check_test.cpp                      | 14 ++++++++++++++
 3 files changed, 23 insertions(+)

diff --git a/src/libxrpl/tx/transactors/check/CheckCancel.cpp b/src/libxrpl/tx/transactors/check/CheckCancel.cpp
index ed60817224..f4602f98c6 100644
--- a/src/libxrpl/tx/transactors/check/CheckCancel.cpp
+++ b/src/libxrpl/tx/transactors/check/CheckCancel.cpp
@@ -1,10 +1,12 @@
 #include <xrpl/tx/transactors/check/CheckCancel.h>
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STLedgerEntry.h>
@@ -19,6 +21,9 @@ namespace xrpl {
 NotTEC
 CheckCancel::preflight(PreflightContext const& ctx)
 {
+    if (ctx.rules.enabled(fixCleanup3_3_0) && ctx.tx[sfCheckID] == beast::kZero)
+        return temMALFORMED;
+
     return tesSUCCESS;
 }
 
diff --git a/src/libxrpl/tx/transactors/check/CheckCash.cpp b/src/libxrpl/tx/transactors/check/CheckCash.cpp
index 4e810d94cf..a8c989f4df 100644
--- a/src/libxrpl/tx/transactors/check/CheckCash.cpp
+++ b/src/libxrpl/tx/transactors/check/CheckCash.cpp
@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/scope.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/PaymentSandbox.h>
@@ -51,6 +52,9 @@ CheckCash::checkExtraFeatures(xrpl::PreflightContext const& ctx)
 NotTEC
 CheckCash::preflight(PreflightContext const& ctx)
 {
+    if (ctx.rules.enabled(fixCleanup3_3_0) && ctx.tx[sfCheckID] == beast::kZero)
+        return temMALFORMED;
+
     // Exactly one of Amount or DeliverMin must be present.
     auto const optAmount = ctx.tx[~sfAmount];
     auto const optDeliverMin = ctx.tx[~sfDeliverMin];
diff --git a/src/test/app/Check_test.cpp b/src/test/app/Check_test.cpp
index b19a9f6894..840c06bd84 100644
--- a/src/test/app/Check_test.cpp
+++ b/src/test/app/Check_test.cpp
@@ -1257,6 +1257,13 @@ class Check_test : public beast::unit_test::Suite
             env.close();
         }
 
+        // Can't run pre-amendment behavior due to assertion failure.
+        if (features[fixCleanup3_3_0])
+        {
+            env(check::cash(bob, uint256{}, usd(20)), Ter(temMALFORMED));
+            env.close();
+        }
+
         // alice creates her checks ahead of time.
         uint256 const chkIdU{getCheckIndex(alice, env.seq(alice))};
         env(check::create(alice, bob, usd(20)));
@@ -1704,6 +1711,13 @@ class Check_test : public beast::unit_test::Suite
         // Non-existent check.
         env(check::cancel(bob, getCheckIndex(alice, env.seq(alice))), Ter(tecNO_ENTRY));
         env.close();
+
+        // Can't run pre-amendment behavior due to assertion failure.
+        if (features[fixCleanup3_3_0])
+        {
+            env(check::cancel(bob, uint256{}), Ter(temMALFORMED));
+            env.close();
+        }
     }
 
     void

From cd38c0e800fe3e8cd9d125b2b2ece0cb2666fdb2 Mon Sep 17 00:00:00 2001
From: Peter Chen <34582813+PeterChen13579@users.noreply.github.com>
Date: Wed, 15 Jul 2026 16:47:22 -0700
Subject: [PATCH 082/100] chore: Update mpt-crypto-lib to 0.4.0-rc4 (#7813)

---
 conan.lock   | 10 +++++-----
 conanfile.py |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/conan.lock b/conan.lock
index b6ddfa4e58..9dfbb86960 100644
--- a/conan.lock
+++ b/conan.lock
@@ -10,22 +10,22 @@
         "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1782392413.075713",
         "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
+        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
         "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
-        "mpt-crypto/0.4.0-rc2#a580f2f9ad0e795de696aa62d54fb9af%1782425834.488828",
+        "mpt-crypto/0.4.0-rc4#ffdba12f2332357f0d8b0ae944cfff52%1784138702.932355",
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
         "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
         "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
         "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#5217e6ef0544c42b46f4af35d5e7f649%1782307148.845616",
+        "grpc/1.81.1#f729f6d75992d20f9c72828e9142d62f%1783945160.094135",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
         "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
         "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
     ],
     "build_requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
@@ -38,7 +38,7 @@
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
     ],
     "python_requires": [],
     "overrides": {
diff --git a/conanfile.py b/conanfile.py
index db12dcb585..f0b10cf34b 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -134,7 +134,7 @@ class Xrpl(ConanFile):
         if self.options.jemalloc:
             self.requires("jemalloc/5.3.1")
         self.requires("lz4/1.10.0", force=True)
-        self.requires("mpt-crypto/0.4.0-rc2", transitive_headers=True)
+        self.requires("mpt-crypto/0.4.0-rc4", transitive_headers=True)
         self.requires("protobuf/6.33.5", force=True)
         if self.options.rocksdb:
             self.requires("rocksdb/10.5.1")

From b42cde3e859819ac3f5d2db8c5b7ded43e180668 Mon Sep 17 00:00:00 2001
From: Mayukha Vadari <mvadari@ripple.com>
Date: Thu, 16 Jul 2026 05:51:19 -0400
Subject: [PATCH 083/100] refactor: Remove redundant enable checks in
 ConfidentialMPT txs (#7809)

---
 src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp  | 4 ----
 src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp   | 4 ----
 .../tx/transactors/token/ConfidentialMPTConvertBack.cpp       | 4 ----
 .../tx/transactors/token/ConfidentialMPTMergeInbox.cpp        | 4 ----
 src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp      | 3 ---
 5 files changed, 19 deletions(-)

diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp
index e0d1d28a8f..6366e99105 100644
--- a/src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp
@@ -4,7 +4,6 @@
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/ConfidentialTransfer.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
@@ -22,9 +21,6 @@ namespace xrpl {
 NotTEC
 ConfidentialMPTClawback::preflight(PreflightContext const& ctx)
 {
-    if (!ctx.rules.enabled(featureConfidentialTransfer))
-        return temDISABLED;
-
     auto const account = ctx.tx[sfAccount];
 
     // Only issuer can clawback
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp
index 44e2596325..454eb39ead 100644
--- a/src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp
@@ -7,7 +7,6 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/ConfidentialTransfer.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/MPTIssue.h>
@@ -26,9 +25,6 @@ namespace xrpl {
 NotTEC
 ConfidentialMPTConvert::preflight(PreflightContext const& ctx)
 {
-    if (!ctx.rules.enabled(featureConfidentialTransfer))
-        return temDISABLED;
-
     // issuer cannot convert
     if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
         return temMALFORMED;
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTConvertBack.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTConvertBack.cpp
index d6fed78833..87f9e476d6 100644
--- a/src/libxrpl/tx/transactors/token/ConfidentialMPTConvertBack.cpp
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTConvertBack.cpp
@@ -6,7 +6,6 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/ConfidentialTransfer.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
@@ -25,9 +24,6 @@ namespace xrpl {
 NotTEC
 ConfidentialMPTConvertBack::preflight(PreflightContext const& ctx)
 {
-    if (!ctx.rules.enabled(featureConfidentialTransfer))
-        return temDISABLED;
-
     // issuer cannot convert back
     if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
         return temMALFORMED;
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTMergeInbox.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTMergeInbox.cpp
index 02c759c521..0b98382a61 100644
--- a/src/libxrpl/tx/transactors/token/ConfidentialMPTMergeInbox.cpp
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTMergeInbox.cpp
@@ -6,7 +6,6 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/ConfidentialTransfer.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
@@ -24,9 +23,6 @@ namespace xrpl {
 NotTEC
 ConfidentialMPTMergeInbox::preflight(PreflightContext const& ctx)
 {
-    if (!ctx.rules.enabled(featureConfidentialTransfer))
-        return temDISABLED;
-
     // issuer cannot merge
     if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
         return temMALFORMED;
diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp
index 302b7d239b..d121ec2634 100644
--- a/src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTSend.cpp
@@ -31,9 +31,6 @@ ConfidentialMPTSend::checkExtraFeatures(PreflightContext const& ctx)
 NotTEC
 ConfidentialMPTSend::preflight(PreflightContext const& ctx)
 {
-    if (!ctx.rules.enabled(featureConfidentialTransfer))
-        return temDISABLED;
-
     auto const account = ctx.tx[sfAccount];
     auto const issuer = MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer();
 

From 69b70d7a0d4642848513a30c46edae7face686e3 Mon Sep 17 00:00:00 2001
From: Denis Angell <dangell@transia.co>
Date: Thu, 16 Jul 2026 09:15:59 -0400
Subject: [PATCH 084/100] fix: Refactor Batch Transaction IDs (#7736)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Mayukha Vadari <mvadari@ripple.com>
---
 include/xrpl/protocol/STObject.h            |   7 -
 include/xrpl/protocol/STTx.h                |  32 +++-
 include/xrpl/tx/transactors/system/Batch.h  |   8 +
 src/libxrpl/protocol/STObject.cpp           |  14 --
 src/libxrpl/protocol/STTx.cpp               | 180 +++++++++++--------
 src/libxrpl/tx/apply.cpp                    |   4 +-
 src/libxrpl/tx/transactors/system/Batch.cpp | 109 +++++-------
 src/test/app/Batch_test.cpp                 | 185 ++++++++++----------
 src/test/protocol/STTx_test.cpp             |  81 ++++++++-
 9 files changed, 353 insertions(+), 267 deletions(-)

diff --git a/include/xrpl/protocol/STObject.h b/include/xrpl/protocol/STObject.h
index a1cdff22e0..ad87d106c4 100644
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -229,13 +229,6 @@ public:
     [[nodiscard]] AccountID
     getAccountID(SField const& field) const;
 
-    /**
-     * The account responsible for the authorization: the delegate when
-     * sfDelegate is present, otherwise the account.
-     */
-    [[nodiscard]] AccountID
-    getInitiator() const;
-
     [[nodiscard]] Blob
     getFieldVL(SField const& field) const;
     [[nodiscard]] STAmount const&
diff --git a/include/xrpl/protocol/STTx.h b/include/xrpl/protocol/STTx.h
index 989bd11c10..d329d42eee 100644
--- a/include/xrpl/protocol/STTx.h
+++ b/include/xrpl/protocol/STTx.h
@@ -142,9 +142,26 @@ public:
         TxnSql status,
         std::string const& escapedMetaData) const;
 
-    [[nodiscard]] std::vector<uint256> const&
+    /**
+     * The IDs of the inner transactions of a Batch.
+     */
+    [[nodiscard]] std::vector<uint256>
     getBatchTransactionIDs() const;
 
+    /**
+     * The inner transactions of a Batch, built and validated at construction.
+     * Always seated for Batch STTx instances (construction throws if oversized).
+     */
+    [[nodiscard]] std::vector<std::shared_ptr<STTx const>> const&
+    getBatchTransactions() const;
+
+    /**
+     * The account responsible for the authorization: the delegate when
+     * sfDelegate is present, otherwise the account.
+     */
+    [[nodiscard]] AccountID
+    getInitiator() const;
+
     [[nodiscard]] AccountID
     getFeePayerID() const;
 
@@ -166,13 +183,16 @@ private:
     checkMultiSign(Rules const& rules, STObject const& sigObject) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkBatchSingleSign(STObject const& batchSigner) const;
+    checkBatchSingleSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkBatchMultiSign(STObject const& batchSigner, Rules const& rules) const;
+    checkBatchMultiSign(
+        STObject const& batchSigner,
+        Rules const& rules,
+        std::vector<uint256> const& txIds) const;
 
     void
-    buildBatchTxnIds();
+    buildBatchTxns();
 
     STBase*
     copy(std::size_t n, void* buf) const override;
@@ -180,11 +200,11 @@ private:
     move(std::size_t n, void* buf) override;
 
     friend class detail::STVar;
-    std::optional<std::vector<uint256>> batchTxnIds_;
+    std::optional<std::vector<std::shared_ptr<STTx const>>> batchTxns_;
 };
 
 bool
-passesLocalChecks(STObject const& st, std::string&);
+passesLocalChecks(STTx const& tx, std::string&);
 
 /**
  * Sterilize a transaction.
diff --git a/include/xrpl/tx/transactors/system/Batch.h b/include/xrpl/tx/transactors/system/Batch.h
index 6540005877..ceaa42e8e0 100644
--- a/include/xrpl/tx/transactors/system/Batch.h
+++ b/include/xrpl/tx/transactors/system/Batch.h
@@ -12,6 +12,7 @@
 
 #include <array>
 #include <cstdint>
+#include <optional>
 
 namespace xrpl {
 
@@ -39,6 +40,9 @@ public:
     static NotTEC
     checkSign(PreclaimContext const& ctx);
 
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
     TER
     doApply() override;
 
@@ -76,6 +80,10 @@ private:
     // only be reached through Batch::checkSign.
     static NotTEC
     checkBatchSign(PreclaimContext const& ctx);
+
+    // nullopt on overflow or oversized signer arrays.
+    static std::optional<XRPAmount>
+    calculateBaseFeeImpl(ReadView const& view, STTx const& tx);
 };
 
 }  // namespace xrpl
diff --git a/src/libxrpl/protocol/STObject.cpp b/src/libxrpl/protocol/STObject.cpp
index ab9ae7d4d7..4b3ace2be3 100644
--- a/src/libxrpl/protocol/STObject.cpp
+++ b/src/libxrpl/protocol/STObject.cpp
@@ -633,20 +633,6 @@ STObject::getAccountID(SField const& field) const
     return getFieldByValue<STAccount>(field);
 }
 
-AccountID
-STObject::getInitiator() const
-{
-    // If sfDelegate is present, the delegate account is the initiator
-    // note: if a delegate is specified, its authorization to act on behalf of the account is
-    // enforced in `Transactor::invokeCheckPermission`
-    // cryptographic signature validity is checked separately (e.g., in `Transactor::checkSign`)
-    if (isFieldPresent(sfDelegate))
-        return getAccountID(sfDelegate);
-
-    // Default initiator
-    return getAccountID(sfAccount);
-}
-
 Blob
 STObject::getFieldVL(SField const& field) const
 {
diff --git a/src/libxrpl/protocol/STTx.cpp b/src/libxrpl/protocol/STTx.cpp
index be4ba2e8e5..17d7617590 100644
--- a/src/libxrpl/protocol/STTx.cpp
+++ b/src/libxrpl/protocol/STTx.cpp
@@ -72,7 +72,7 @@ STTx::STTx(STObject&& object)
 {
     applyTemplate(getTxFormat(txType_)->getSOTemplate());  //  may throw
     tid_ = getHash(HashPrefix::TransactionId);
-    buildBatchTxnIds();
+    buildBatchTxns();
 }
 
 STTx::STTx(SerialIter& sit) : STObject(sfTransaction)
@@ -89,7 +89,7 @@ STTx::STTx(SerialIter& sit) : STObject(sfTransaction)
 
     applyTemplate(getTxFormat(txType_)->getSOTemplate());  // May throw
     tid_ = getHash(HashPrefix::TransactionId);
-    buildBatchTxnIds();
+    buildBatchTxns();
 }
 
 STTx::STTx(TxType type, std::function<void(STObject&)> assembler) : STObject(sfTransaction)
@@ -110,7 +110,7 @@ STTx::STTx(TxType type, std::function<void(STObject&)> assembler) : STObject(sfT
         logicError("Transaction type was mutated during assembly");
 
     tid_ = getHash(HashPrefix::TransactionId);
-    buildBatchTxnIds();
+    buildBatchTxns();
 }
 
 STBase*
@@ -279,12 +279,9 @@ STTx::checkSign(Rules const& rules) const
             return std::unexpected("Sponsor: " + ret.error());
     }
 
-    // Verify the batch signer signatures here too, so they are cached with the
-    // rest of signature checking (checkValidity / SF_SIGGOOD) and stay out of
-    // the transaction engine. Gated on a batch (batchTxnIds_ seated) that
-    // actually carries signers; a batch whose inners are all from the outer
-    // account has no sfBatchSigners and needs no signer crypto.
-    if (batchTxnIds_ && isFieldPresent(sfBatchSigners))
+    // Verify batch signer signatures here so they are cached with the rest
+    // of signature checking.
+    if (isFieldPresent(sfBatchSigners))
     {
         if (auto const ret = checkBatchSign(rules); !ret)
             return ret;
@@ -307,11 +304,28 @@ STTx::checkBatchSign(Rules const& rules) const
         if (!isFieldPresent(sfBatchSigners))
             return std::unexpected("Missing BatchSigners field.");  // LCOV_EXCL_LINE
         STArray const& signers{getFieldArray(sfBatchSigners)};
+        // Bound signature verification to the protocol cap. This runs in
+        // checkValidity (via checkSign) at relay / submit time, BEFORE preflight
+        // and passesLocalChecks enforce the cap. Without this guard a malicious
+        // peer could put an oversized sfBatchSigners array in a 1 MB blob and
+        // force one signature verification per entry before any of those checks
+        // (or the fee charge) runs.
+        if (signers.size() > kMaxBatchSigners)
+            return std::unexpected("BatchSigners array exceeds max entries.");
+        // Defensive.
+        if (!batchTxns_)
+        {
+            // LCOV_EXCL_START
+            UNREACHABLE("STTx::checkBatchSign : batch transactions not built");
+            return std::unexpected("Missing inner transactions.");
+            // LCOV_EXCL_STOP
+        }
+        auto const txIds = getBatchTransactionIDs();
         for (auto const& signer : signers)
         {
             Blob const& signingPubKey = signer.getFieldVL(sfSigningPubKey);
-            auto const result = signingPubKey.empty() ? checkBatchMultiSign(signer, rules)
-                                                      : checkBatchSingleSign(signer);
+            auto const result = signingPubKey.empty() ? checkBatchMultiSign(signer, rules, txIds)
+                                                      : checkBatchSingleSign(signer, txIds);
 
             if (!result)
                 return result;
@@ -441,12 +455,11 @@ STTx::checkSingleSign(STObject const& sigObject) const
 }
 
 std::expected<void, std::string>
-STTx::checkBatchSingleSign(STObject const& batchSigner) const
+STTx::checkBatchSingleSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const
 {
     XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::checkBatchSingleSign : batch transaction");
     Serializer msg;
-    serializeBatch(
-        msg, getAccountID(sfAccount), getSeqValue(), getFlags(), getBatchTransactionIDs());
+    serializeBatch(msg, getAccountID(sfAccount), getSeqValue(), getFlags(), txIds);
     finishMultiSigningData(batchSigner.getAccountID(sfAccount), msg);
     return singleSignHelper(batchSigner, msg.slice());
 }
@@ -529,7 +542,10 @@ multiSignHelper(
 }
 
 std::expected<void, std::string>
-STTx::checkBatchMultiSign(STObject const& batchSigner, Rules const& rules) const
+STTx::checkBatchMultiSign(
+    STObject const& batchSigner,
+    Rules const& rules,
+    std::vector<uint256> const& txIds) const
 {
     XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::checkBatchMultiSign : batch transaction");
     // We can ease the computational load inside the loop a bit by
@@ -537,8 +553,7 @@ STTx::checkBatchMultiSign(STObject const& batchSigner, Rules const& rules) const
     // with the stuff that stays constant from signature to signature.
     auto const batchSignerAccount = batchSigner.getAccountID(sfAccount);
     Serializer dataStart;
-    serializeBatch(
-        dataStart, getAccountID(sfAccount), getSeqValue(), getFlags(), getBatchTransactionIDs());
+    serializeBatch(dataStart, getAccountID(sfAccount), getSeqValue(), getFlags(), txIds);
     dataStart.addBitString(batchSignerAccount);
     return multiSignHelper(
         batchSigner,
@@ -577,38 +592,79 @@ STTx::checkMultiSign(Rules const& rules, STObject const& sigObject) const
 }
 
 void
-STTx::buildBatchTxnIds()
+STTx::buildBatchTxns()
 {
     // Precondition: the template must have been applied first, so the fields
     // (including sfRawTransactions) are canonical before the inner txns are
     // hashed. The constructors call this immediately after applying the
     // template; isFree() being false confirms a template is set.
-    XRPL_ASSERT(!isFree(), "STTx::buildBatchTxnIds : template applied");
-    if (getTxnType() != ttBATCH || !isFieldPresent(sfRawTransactions))
+    XRPL_ASSERT(!isFree(), "STTx::buildBatchTxns : template applied");
+    if (getTxnType() != ttBATCH)
         return;
+    // A Batch always seats its inner transactions here, so every downstream
+    // consumer can rely on them. sfRawTransactions is required by the format
+    // (applyTemplate rejects a Batch without it); this guards a future change
+    // that made it optional.
+    if (!isFieldPresent(sfRawTransactions))
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("STTx::buildBatchTxns : missing RawTransactions");
+        Throw<std::runtime_error>("Batch has no RawTransactions.");
+        // LCOV_EXCL_STOP
+    }
 
     auto const& raw = getFieldArray(sfRawTransactions);
+    if (raw.size() > kMaxBatchTxCount)
+        Throw<std::runtime_error>("Batch has too many inner transactions.");
 
-    // Seated for any batch with raw transactions. The count is validated in
-    // preflight and at the relay boundary, so build every id here; this keeps
-    // the invariant batchTxnIds_->size() == rawTransactions.size().
-    auto& ids = batchTxnIds_.emplace();
-    ids.reserve(raw.size());
+    // Build and validate each inner as an STTx once. A malformed inner throws;
+    // a nested batch is rejected before building it (a batch cannot contain a
+    // batch, and building one would recurse).
+    auto& txns = batchTxns_.emplace();
+    txns.reserve(raw.size());
     for (STObject const& rb : raw)
-        ids.push_back(rb.getHash(HashPrefix::TransactionId));
+    {
+        if (rb.getFieldU16(sfTransactionType) == ttBATCH)
+            Throw<std::runtime_error>("Batch inner transaction cannot be a Batch.");
+
+        txns.push_back(std::make_shared<STTx const>(STObject{rb}));
+    }
 }
 
-std::vector<uint256> const&
+std::vector<uint256>
 STTx::getBatchTransactionIDs() const
 {
-    XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::getBatchTransactionIDs : batch transaction");
+    auto const& txns = getBatchTransactions();
+    std::vector<uint256> ids;
+    ids.reserve(txns.size());
+    for (auto const& stx : txns)
+        ids.push_back(stx->getTransactionID());
+    return ids;
+}
+
+std::vector<std::shared_ptr<STTx const>> const&
+STTx::getBatchTransactions() const
+{
+    XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::getBatchTransactions : batch transaction");
+    XRPL_ASSERT(batchTxns_.has_value(), "STTx::getBatchTransactions : batch transactions built");
     XRPL_ASSERT(
-        batchTxnIds_.has_value(), "STTx::getBatchTransactionIDs : batch transaction IDs built");
-    XRPL_ASSERT(
-        batchTxnIds_->size() == getFieldArray(sfRawTransactions).size(),
-        "STTx::getBatchTransactionIDs : batch transaction IDs size mismatch");
-    // NOLINTNEXTLINE(bugprone-unchecked-optional-access): guarded by assert above
-    return *batchTxnIds_;
+        batchTxns_->size() == getFieldArray(sfRawTransactions).size(),
+        "STTx::getBatchTransactions : batch transactions size mismatch");
+    return *batchTxns_;
+}
+
+AccountID
+STTx::getInitiator() const
+{
+    // If sfDelegate is present, the delegate account is the initiator
+    // note: if a delegate is specified, its authorization to act on behalf of the account is
+    // enforced in `Transactor::invokeCheckPermission`
+    // cryptographic signature validity is checked separately (e.g., in `Transactor::checkSign`)
+    if (isFieldPresent(sfDelegate))
+        return getAccountID(sfDelegate);
+
+    // Default initiator
+    return getAccountID(sfAccount);
 }
 
 AccountID
@@ -754,86 +810,62 @@ invalidMPTAmountInTx(STObject const& tx)
 }
 
 static bool
-isBatchRawTransactionOkay(STObject const& st, std::string& reason)
+isBatchRawTransactionOkay(STTx const& tx, std::string& reason)
 {
-    if (!st.isFieldPresent(sfRawTransactions))
+    if (!tx.isFieldPresent(sfRawTransactions))
         return true;
 
     // sfRawTransactions only appears on a Batch. passesLocalChecks runs on
     // unverified user and peer input, so reject (rather than assert) a non-batch
     // transaction that carries it.
-    if (st.getFieldU16(sfTransactionType) != ttBATCH)
+    if (tx.getTxnType() != ttBATCH)
     {
         reason = "Only Batch transactions may contain raw transactions.";
         return false;
     }
 
-    if (st.isFieldPresent(sfBatchSigners) &&
-        st.getFieldArray(sfBatchSigners).size() > kMaxBatchSigners)
+    if (tx.isFieldPresent(sfBatchSigners) &&
+        tx.getFieldArray(sfBatchSigners).size() > kMaxBatchSigners)
     {
-        reason = "Batch Signers array exceeds max entries.";
+        reason = "BatchSigners array exceeds max entries.";
         return false;
     }
 
-    auto const& rawTxns = st.getFieldArray(sfRawTransactions);
-    if (rawTxns.size() > kMaxBatchTxCount)
+    // Inner structure (type, template, no nesting, count) is validated when the
+    // batch STTx is constructed; here we only run each inner's local checks.
+    for (auto const& inner : tx.getBatchTransactions())
     {
-        reason = "Raw Transactions array exceeds max entries.";
-        return false;
-    }
-    for (STObject raw : rawTxns)
-    {
-        try
-        {
-            auto const tt = safeCast<TxType>(raw.getFieldU16(sfTransactionType));
-            if (tt == ttBATCH)
-            {
-                reason = "Raw Transactions may not contain batch transactions.";
-                return false;
-            }
-
-            raw.applyTemplate(getTxFormat(tt)->getSOTemplate());
-
-            // passesLocalChecks recurses back into isBatchRawTransactionOkay,
-            // but an inner can never be a batch (rejected above), so the
-            // recursion terminates at depth 1.
-            if (!passesLocalChecks(raw, reason))
-                return false;
-        }
-        catch (std::exception const& e)
-        {
-            reason = e.what();
+        if (!passesLocalChecks(*inner, reason))
             return false;
-        }
     }
     return true;
 }
 
 bool
-passesLocalChecks(STObject const& st, std::string& reason)
+passesLocalChecks(STTx const& tx, std::string& reason)
 {
-    if (!isMemoOkay(st, reason))
+    if (!isMemoOkay(tx, reason))
         return false;
 
-    if (!isAccountFieldOkay(st))
+    if (!isAccountFieldOkay(tx))
     {
         reason = "An account field is invalid.";
         return false;
     }
 
-    if (isPseudoTx(st))
+    if (isPseudoTx(tx))
     {
         reason = "Cannot submit pseudo transactions.";
         return false;
     }
 
-    if (invalidMPTAmountInTx(st))
+    if (invalidMPTAmountInTx(tx))
     {
         reason = "Amount can not be MPT.";
         return false;
     }
 
-    if (!isBatchRawTransactionOkay(st, reason))
+    if (!isBatchRawTransactionOkay(tx, reason))
         return false;
 
     return true;
diff --git a/src/libxrpl/tx/apply.cpp b/src/libxrpl/tx/apply.cpp
index d85c4cfc40..f93b19a158 100644
--- a/src/libxrpl/tx/apply.cpp
+++ b/src/libxrpl/tx/apply.cpp
@@ -177,9 +177,9 @@ applyBatchTransactions(
 
     int applied = 0;
 
-    for (STObject rb : batchTxn.getFieldArray(sfRawTransactions))
+    for (auto const& stx : batchTxn.getBatchTransactions())
     {
-        auto const result = applyOneTransaction(STTx{std::move(rb)});
+        auto const result = applyOneTransaction(*stx);
         XRPL_ASSERT(
             result.applied == (isTesSuccess(result.ter) || isTecClaim(result.ter)),
             "Outer Batch failure, inner transaction should not be applied");
diff --git a/src/libxrpl/tx/transactors/system/Batch.cpp b/src/libxrpl/tx/transactors/system/Batch.cpp
index dee465cb88..ccb113e07b 100644
--- a/src/libxrpl/tx/transactors/system/Batch.cpp
+++ b/src/libxrpl/tx/transactors/system/Batch.cpp
@@ -15,7 +15,6 @@
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/SystemParameters.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/TxFormats.h>
@@ -28,6 +27,7 @@
 #include <cstddef>
 #include <cstdint>
 #include <limits>
+#include <optional>
 #include <unordered_map>
 #include <unordered_set>
 #include <utility>
@@ -46,17 +46,11 @@ namespace xrpl {
  *
  * @param view The ledger view providing fee and state information.
  * @param tx The batch transaction to calculate the fee for.
- * @return XRPAmount The total base fee required for the batch transaction.
- *
- * @throws std::overflow_error If any fee calculation would overflow the
- * XRPAmount type.
- * @throws std::length_error If the number of inner transactions or signers
- * exceeds the allowed maximum.
- * @throws std::invalid_argument If an inner transaction is itself a batch
- * transaction.
+ * @return XRPAmount The total base fee required for the batch transaction,
+ * or std::nullopt on failure (overflow, oversized arrays).
  */
-XRPAmount
-Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
+std::optional<XRPAmount>
+Batch::calculateBaseFeeImpl(ReadView const& view, STTx const& tx)
 {
     XRPAmount const maxAmount{std::numeric_limits<XRPAmount::value_type>::max()};
 
@@ -67,49 +61,26 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
     if (baseFee > maxAmount - view.fees().base)
     {
         JLOG(debugLog().error()) << "BatchTrace: Base fee overflow detected.";
-        return XRPAmount{kInitialXrp};
+        return std::nullopt;
     }
     // LCOV_EXCL_STOP
 
     XRPAmount const batchBase = view.fees().base + baseFee;
 
-    // Calculate the Inner Txn Fees
+    // Calculate the Inner Txn Fees. Inners are built and validated (count,
+    // no nesting) at construction, so they are reused here directly.
     XRPAmount txnFees{0};
-    if (tx.isFieldPresent(sfRawTransactions))
+    for (auto const& stx : tx.getBatchTransactions())
     {
-        auto const& txns = tx.getFieldArray(sfRawTransactions);
-
+        auto const fee = xrpl::calculateBaseFee(view, *stx);
         // LCOV_EXCL_START
-        if (txns.size() > kMaxBatchTxCount)
+        if (txnFees > maxAmount - fee)
         {
-            JLOG(debugLog().error()) << "BatchTrace: Raw Transactions array exceeds max entries.";
-            return XRPAmount{kInitialXrp};
+            JLOG(debugLog().error()) << "BatchTrace: XRPAmount overflow in txnFees calculation.";
+            return std::nullopt;
         }
         // LCOV_EXCL_STOP
-
-        for (STObject txn : txns)
-        {
-            STTx const stx = STTx{std::move(txn)};
-
-            // LCOV_EXCL_START
-            if (stx.getTxnType() == ttBATCH)
-            {
-                JLOG(debugLog().error()) << "BatchTrace: Inner Batch transaction found.";
-                return XRPAmount{kInitialXrp};
-            }
-            // LCOV_EXCL_STOP
-
-            auto const fee = xrpl::calculateBaseFee(view, stx);
-            // LCOV_EXCL_START
-            if (txnFees > maxAmount - fee)
-            {
-                JLOG(debugLog().error())
-                    << "BatchTrace: XRPAmount overflow in txnFees calculation.";
-                return XRPAmount{kInitialXrp};
-            }
-            // LCOV_EXCL_STOP
-            txnFees += fee;
-        }
+        txnFees += fee;
     }
 
     // Calculate the Signers/BatchSigners Fees
@@ -122,7 +93,7 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
         if (signers.size() > kMaxBatchSigners)
         {
             JLOG(debugLog().error()) << "BatchTrace: Batch Signers array exceeds max entries.";
-            return XRPAmount{kInitialXrp};
+            return std::nullopt;
         }
         // LCOV_EXCL_STOP
 
@@ -140,7 +111,7 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
                 {
                     JLOG(debugLog().error())
                         << "BatchTrace: Nested Signers array exceeds max entries.";
-                    return kInitialXrp;
+                    return std::nullopt;
                 }
                 // LCOV_EXCL_STOP
                 signerCount += nestedSigners.size();
@@ -152,7 +123,7 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
     if (signerCount > 0 && view.fees().base > maxAmount / signerCount)
     {
         JLOG(debugLog().error()) << "BatchTrace: XRPAmount overflow in signerCount calculation.";
-        return XRPAmount{kInitialXrp};
+        return std::nullopt;
     }
     // LCOV_EXCL_STOP
 
@@ -162,13 +133,13 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
     if (signerFees > maxAmount - txnFees)
     {
         JLOG(debugLog().error()) << "BatchTrace: XRPAmount overflow in signerFees calculation.";
-        return XRPAmount{kInitialXrp};
+        return std::nullopt;
     }
     XRPAmount const innerFees = txnFees + signerFees;
     if (innerFees > maxAmount - batchBase)
     {
         JLOG(debugLog().error()) << "BatchTrace: XRPAmount overflow in total fee calculation.";
-        return XRPAmount{kInitialXrp};
+        return std::nullopt;
     }
     // LCOV_EXCL_STOP
 
@@ -176,6 +147,24 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
     return innerFees + batchBase;
 }
 
+XRPAmount
+Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
+{
+    if (auto const fee = calculateBaseFeeImpl(view, tx))
+        return *fee;
+    // The fee could not be computed, so return a placeholder the account can
+    // pay; preclaim rejects the transaction with tecINSUFF_FEE.
+    return view.fees().base;  // LCOV_EXCL_LINE
+}
+
+TER
+Batch::preclaim(PreclaimContext const& ctx)
+{
+    if (!calculateBaseFeeImpl(ctx.view, ctx.tx))
+        return tecINSUFF_FEE;  // LCOV_EXCL_LINE
+    return tesSUCCESS;
+}
+
 std::uint32_t
 Batch::getFlagsMask(PreflightContext const& ctx)
 {
@@ -246,13 +235,6 @@ Batch::preflight(PreflightContext const& ctx)
         return temARRAY_EMPTY;
     }
 
-    if (rawTxns.size() > kMaxBatchTxCount)
-    {
-        JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]:"
-                            << "txns array exceeds 8 entries.";
-        return temARRAY_TOO_LARGE;
-    }
-
     if (ctx.tx.isFieldPresent(sfBatchSigners) &&
         ctx.tx.getFieldArray(sfBatchSigners).size() > kMaxBatchSigners)
     {
@@ -293,9 +275,9 @@ Batch::preflight(PreflightContext const& ctx)
 
         return tesSUCCESS;
     };
-    for (STObject rb : rawTxns)
+    for (auto const& stxPtr : ctx.tx.getBatchTransactions())
     {
-        STTx const stx = STTx{std::move(rb)};
+        STTx const& stx = *stxPtr;
         auto const hash = stx.getTransactionID();
         if (!uniqueHashes.emplace(hash).second)
         {
@@ -306,14 +288,6 @@ Batch::preflight(PreflightContext const& ctx)
         }
 
         auto const txType = stx.getFieldU16(sfTransactionType);
-        if (txType == ttBATCH)
-        {
-            JLOG(ctx.j.debug()) << "BatchTrace[" << parentBatchId << "]: "
-                                << "batch cannot have an inner batch txn. "
-                                << "txID: " << hash;
-            return temINVALID;
-        }
-
         if (std::ranges::any_of(
                 kDisabledTxTypes, [txType](auto const& disabled) { return txType == disabled; }))
         {
@@ -434,15 +408,14 @@ Batch::preflightSigValidated(PreflightContext const& ctx)
         ctx.tx.getTxnType() == ttBATCH, "xrpl::Batch::preflightSigValidated : batch transaction");
     auto const parentBatchId = ctx.tx.getTransactionID();
     auto const outerAccount = ctx.tx.getAccountID(sfAccount);
-    auto const& rawTxns = ctx.tx.getFieldArray(sfRawTransactions);
-
     // Accounts that must sign the batch: each inner authorizer and counterparty
     // (excluding the outer account), sorted and de-duplicated to match against
     // the ascending, unique batch signers.
     std::vector<AccountID> requiredSigners;
     requiredSigners.reserve(kMaxBatchSigners);
-    for (STObject const& rb : rawTxns)
+    for (auto const& stxPtr : ctx.tx.getBatchTransactions())
     {
+        STTx const& rb = *stxPtr;
         // A delegated inner is signed by the delegate, not the account holder,
         // so the delegate is the required signer when present.
         AccountID const authorizer = rb.getInitiator();
diff --git a/src/test/app/Batch_test.cpp b/src/test/app/Batch_test.cpp
index f9c156fe06..5085ad6172 100644
--- a/src/test/app/Batch_test.cpp
+++ b/src/test/app/Batch_test.cpp
@@ -56,7 +56,6 @@
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/Sign.h>
-#include <xrpl/protocol/SystemParameters.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/TxFormats.h>
@@ -72,6 +71,7 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
+#include <exception>
 #include <map>
 #include <memory>
 #include <optional>
@@ -313,8 +313,8 @@ class Batch_test : public beast::unit_test::Suite
             env.close();
         }
 
-        // DEFENSIVE: temARRAY_TOO_LARGE: Batch: txns array exceeds 8 entries.
-        // ACTUAL: telENV_RPC_FAILED: isRawTransactionOkay()
+        // An oversized batch (more than kMaxBatchTxCount inners) fails STTx
+        // construction, so the transaction cannot be built.
         {
             auto const seq = env.seq(alice);
             auto const batchFee = batch::calcBatchFee(env, 0, 9);
@@ -328,7 +328,7 @@ class Batch_test : public beast::unit_test::Suite
                 batch::Inner(pay(alice, bob, XRP(1)), seq + 7),
                 batch::Inner(pay(alice, bob, XRP(1)), seq + 8),
                 batch::Inner(pay(alice, bob, XRP(1)), seq + 9),
-                Ter(telENV_RPC_FAILED));
+                Ter(temMALFORMED));
             env.close();
         }
 
@@ -345,15 +345,15 @@ class Batch_test : public beast::unit_test::Suite
             env.close();
         }
 
-        // DEFENSIVE: temINVALID: Batch: batch cannot have inner batch txn.
-        // ACTUAL: telENV_RPC_FAILED: isRawTransactionOkay()
+        // A batch may not contain a batch: the nested inner fails STTx
+        // construction, so the transaction cannot be built.
         {
             auto const seq = env.seq(alice);
             auto const batchFee = batch::calcBatchFee(env, 0, 2);
             env(batch::outer(alice, seq, batchFee, tfAllOrNothing),
                 batch::Inner(batch::outer(alice, seq, batchFee, tfAllOrNothing), seq),
                 batch::Inner(pay(alice, bob, XRP(1)), seq + 2),
-                Ter(telENV_RPC_FAILED));
+                Ter(temMALFORMED));
             env.close();
         }
 
@@ -938,80 +938,41 @@ class Batch_test : public beast::unit_test::Suite
 
         env.fund(XRP(10000), alice, bob);
 
+        // An inner missing a required field can no longer be submitted: the
+        // outer STTx builds and validates each inner at construction, so
+        // building the batch (as signing does) throws. Returns true if the
+        // build fails.
+        auto batchCtorFails = [&](json::StaticString const& field) -> bool {
+            auto const batchFee = batch::calcBatchFee(env, 1, 2);
+            auto const seq = env.seq(alice);
+            auto tx1 = batch::Inner(pay(alice, bob, XRP(10)), seq + 1);
+            tx1.removeMember(field);
+            try
+            {
+                // Env::st swallows the construction failure and yields a null
+                // stx, so a malformed inner shows up as no transaction built.
+                auto const jt = env.jtnofill(
+                    batch::outer(alice, seq, batchFee, tfAllOrNothing),
+                    tx1,
+                    batch::Inner(pay(alice, bob, XRP(10)), seq + 2));
+                return jt.stx == nullptr;
+            }
+            catch (std::exception const&)
+            {
+                return true;
+            }
+        };
+
         // Invalid: sfTransactionType
-        {
-            auto const batchFee = batch::calcBatchFee(env, 1, 2);
-            auto const seq = env.seq(alice);
-            auto tx1 = batch::Inner(pay(alice, bob, XRP(10)), seq + 1);
-            tx1.removeMember(jss::TransactionType);
-            auto jt = env.jtnofill(
-                batch::outer(alice, seq, batchFee, tfAllOrNothing),
-                tx1,
-                batch::Inner(pay(alice, bob, XRP(10)), seq + 2));
-
-            env(jt.jv, batch::Sig(bob), Ter(telENV_RPC_FAILED));
-            env.close();
-        }
-
+        BEAST_EXPECT(batchCtorFails(jss::TransactionType));
         // Invalid: sfAccount
-        {
-            auto const batchFee = batch::calcBatchFee(env, 1, 2);
-            auto const seq = env.seq(alice);
-            auto tx1 = batch::Inner(pay(alice, bob, XRP(10)), seq + 1);
-            tx1.removeMember(jss::Account);
-            auto jt = env.jtnofill(
-                batch::outer(alice, seq, batchFee, tfAllOrNothing),
-                tx1,
-                batch::Inner(pay(alice, bob, XRP(10)), seq + 2));
-
-            env(jt.jv, batch::Sig(bob), Ter(telENV_RPC_FAILED));
-            env.close();
-        }
-
+        BEAST_EXPECT(batchCtorFails(jss::Account));
         // Invalid: sfSequence
-        {
-            auto const batchFee = batch::calcBatchFee(env, 1, 2);
-            auto const seq = env.seq(alice);
-            auto tx1 = batch::Inner(pay(alice, bob, XRP(10)), seq + 1);
-            tx1.removeMember(jss::Sequence);
-            auto jt = env.jtnofill(
-                batch::outer(alice, seq, batchFee, tfAllOrNothing),
-                tx1,
-                batch::Inner(pay(alice, bob, XRP(10)), seq + 2));
-
-            env(jt.jv, batch::Sig(bob), Ter(telENV_RPC_FAILED));
-            env.close();
-        }
-
+        BEAST_EXPECT(batchCtorFails(jss::Sequence));
         // Invalid: sfFee
-        {
-            auto const batchFee = batch::calcBatchFee(env, 1, 2);
-            auto const seq = env.seq(alice);
-            auto tx1 = batch::Inner(pay(alice, bob, XRP(10)), seq + 1);
-            tx1.removeMember(jss::Fee);
-            auto jt = env.jtnofill(
-                batch::outer(alice, seq, batchFee, tfAllOrNothing),
-                tx1,
-                batch::Inner(pay(alice, bob, XRP(10)), seq + 2));
-
-            env(jt.jv, batch::Sig(bob), Ter(telENV_RPC_FAILED));
-            env.close();
-        }
-
+        BEAST_EXPECT(batchCtorFails(jss::Fee));
         // Invalid: sfSigningPubKey
-        {
-            auto const batchFee = batch::calcBatchFee(env, 1, 2);
-            auto const seq = env.seq(alice);
-            auto tx1 = batch::Inner(pay(alice, bob, XRP(10)), seq + 1);
-            tx1.removeMember(jss::SigningPubKey);
-            auto jt = env.jtnofill(
-                batch::outer(alice, seq, batchFee, tfAllOrNothing),
-                tx1,
-                batch::Inner(pay(alice, bob, XRP(10)), seq + 2));
-
-            env(jt.jv, batch::Sig(bob), Ter(telENV_RPC_FAILED));
-            env.close();
-        }
+        BEAST_EXPECT(batchCtorFails(jss::SigningPubKey));
 
         // Inner OfferCreate with MPT TakerPays. Valid under featureMPTokensV2.
         {
@@ -1512,11 +1473,13 @@ class Batch_test : public beast::unit_test::Suite
                 batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
                 batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
                 batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
-                Ter(telENV_RPC_FAILED));
+                Ter(temMALFORMED));
             env.close();
         }
 
-        // temARRAY_TOO_LARGE: Batch: txns array exceeds 8 entries.
+        // An oversized batch (more than kMaxBatchTxCount inners) fails STTx
+        // construction, so it never reaches apply or checkValidity - Env::st
+        // swallows the failure and yields a null stx.
         {
             Env env{*this, features};
 
@@ -1539,11 +1502,44 @@ class Batch_test : public beast::unit_test::Suite
                 batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
                 batch::Inner(pay(alice, bob, XRP(1)), aliceSeq));
 
-            env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal j) {
-                auto const result = xrpl::apply(env.app(), view, *jt.stx, TapNone, j);
-                BEAST_EXPECT(!result.applied && result.ter == temARRAY_TOO_LARGE);
-                return result.applied;
-            });
+            BEAST_EXPECT(jt.stx == nullptr);
+        }
+
+        // An oversized batch cannot slip through as validly signed even when it
+        // carries a BatchSigners array: the oversized inner array fails STTx
+        // construction before any signature is checked, so the batch can't be
+        // built at all (building it - as signing does - throws).
+        {
+            Env env{*this, features};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            env.fund(XRP(10000), alice, bob);
+            env.close();
+
+            auto const aliceSeq = env.seq(alice);
+            auto const batchFee = batch::calcBatchFee(env, kMaxBatchSigners + 1, 9);
+            bool threw = false;
+            try
+            {
+                env.jtnofill(
+                    batch::outer(alice, aliceSeq, batchFee, tfAllOrNothing),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Inner(pay(alice, bob, XRP(1)), aliceSeq),
+                    batch::Sig(std::vector<Reg>(kMaxBatchSigners + 1, bob)));
+            }
+            catch (std::exception const&)
+            {
+                threw = true;
+            }
+            BEAST_EXPECT(threw);
         }
 
         // Regression: the relay-boundary local check (isBatchRawTransactionOkay)
@@ -1598,6 +1594,14 @@ class Batch_test : public beast::unit_test::Suite
                 BEAST_EXPECT(!result.applied && result.ter == temARRAY_TOO_LARGE);
                 return result.applied;
             });
+
+            // Regression (uncapped batch-signer verification): the relay
+            // boundary (checkValidity) rejects the oversized signers array via
+            // the checkBatchSign guard, BEFORE verifying a single signature.
+            auto const [valid, reason] =
+                xrpl::checkValidity(env.app().getHashRouter(), *jt.stx, env.current()->rules());
+            BEAST_EXPECT(valid == xrpl::Validity::SigBad);
+            BEAST_EXPECT(reason == "BatchSigners array exceeds max entries.");
         }
     }
 
@@ -5524,7 +5528,8 @@ class Batch_test : public beast::unit_test::Suite
             return Batch::calculateBaseFee(*env.current(), *jtx.stx);
         };
 
-        // bad: Inner Batch transaction found
+        // bad: a batch may not contain a batch - the nested inner fails STTx
+        // construction, so the transaction cannot be built.
         {
             auto const seq = env.seq(alice);
             XRPAmount const batchFee = batch::calcBatchFee(env, 0, 2);
@@ -5532,11 +5537,11 @@ class Batch_test : public beast::unit_test::Suite
                 batch::outer(alice, seq, batchFee, tfAllOrNothing),
                 batch::Inner(batch::outer(alice, seq, batchFee, tfAllOrNothing), seq),
                 batch::Inner(pay(alice, bob, XRP(1)), seq + 2));
-            XRPAmount const txBaseFee = getBaseFee(jtx);
-            BEAST_EXPECT(txBaseFee == XRPAmount(kInitialXrp));
+            BEAST_EXPECT(jtx.stx == nullptr);
         }
 
-        // bad: Raw Transactions array exceeds max entries.
+        // bad: an oversized batch (more than kMaxBatchTxCount inners) fails
+        // STTx construction, so it cannot be built.
         {
             auto const seq = env.seq(alice);
             XRPAmount const batchFee = batch::calcBatchFee(env, 0, 2);
@@ -5553,8 +5558,7 @@ class Batch_test : public beast::unit_test::Suite
                 batch::Inner(pay(alice, bob, XRP(1)), seq + 8),
                 batch::Inner(pay(alice, bob, XRP(1)), seq + 9));
 
-            XRPAmount const txBaseFee = getBaseFee(jtx);
-            BEAST_EXPECT(txBaseFee == XRPAmount(kInitialXrp));
+            BEAST_EXPECT(jtx.stx == nullptr);
         }
 
         // bad: Signers array exceeds max entries.
@@ -5567,8 +5571,9 @@ class Batch_test : public beast::unit_test::Suite
                 batch::Inner(pay(alice, bob, XRP(10)), seq + 1),
                 batch::Inner(pay(alice, bob, XRP(5)), seq + 2),
                 batch::Sig(std::vector<Reg>(kMaxBatchSigners + 1, bob)));
+            // Failure paths fall back to the ledger base fee.
             XRPAmount const txBaseFee = getBaseFee(jtx);
-            BEAST_EXPECT(txBaseFee == XRPAmount(kInitialXrp));
+            BEAST_EXPECT(txBaseFee == env.current()->fees().base);
         }
 
         // good:
diff --git a/src/test/protocol/STTx_test.cpp b/src/test/protocol/STTx_test.cpp
index 45bd2729c4..777234be83 100644
--- a/src/test/protocol/STTx_test.cpp
+++ b/src/test/protocol/STTx_test.cpp
@@ -21,6 +21,7 @@
 
 #include <xrpl.pb.h>
 
+#include <cstdint>
 #include <cstring>
 #include <exception>
 #include <memory>
@@ -50,15 +51,10 @@ public:
     run() override
     {
         testMalformedSerializedForm();
-
-        testcase("secp256k1 signatures");
         testSTTx(KeyType::Secp256k1);
-
-        testcase("ed25519 signatures");
         testSTTx(KeyType::Ed25519);
-
-        testcase("STObject constructor errors");
         testObjectCtorErrors();
+        testBatchInnerCtorErrors();
     }
 
     void
@@ -1328,6 +1324,8 @@ public:
     void
     testSTTx(KeyType keyType)
     {
+        testcase(std::string(to_string(keyType)) + " signatures");
+
         auto const keypair = randomKeyPair(keyType);
 
         STTx j(ttACCOUNT_SET, [&keypair](auto& obj) {
@@ -1382,6 +1380,8 @@ public:
     void
     testObjectCtorErrors()
     {
+        testcase("STObject constructor errors");
+
         auto const kp1 = randomKeyPair(KeyType::Secp256k1);
         auto const id1 = calcAccountID(kp1.first);
 
@@ -1463,6 +1463,75 @@ public:
             BEAST_EXPECT(got == "Field 'Fee' is required but missing.");
         }
     }
+
+    void
+    testBatchInnerCtorErrors()
+    {
+        testcase("Batch inner transaction validation");
+
+        auto const kp1 = randomKeyPair(KeyType::Secp256k1);
+        auto const id1 = calcAccountID(kp1.first);
+
+        auto const kp2 = randomKeyPair(KeyType::Secp256k1);
+        auto const id2 = calcAccountID(kp2.first);
+
+        // A raw inner transaction object of the given transaction type.
+        auto makeInner = [&](std::uint16_t txType) {
+            STObject inner(sfRawTransaction);
+            inner.setFieldU16(sfTransactionType, txType);
+            inner.setAccountID(sfAccount, id1);
+            inner.setAccountID(sfDestination, id2);
+            inner.setFieldAmount(sfAmount, STAmount(10000000000ull));
+            inner.setFieldAmount(sfFee, STAmount(0ull));
+            inner.setFieldU32(sfSequence, 1);
+            inner.setFieldVL(sfSigningPubKey, Slice(kp1.first.data(), kp1.first.size()));
+            return inner;
+        };
+
+        // An outer Batch STObject wrapping the given inner.
+        auto makeBatch = [&](STObject inner) {
+            STArray rawTxns(sfRawTransactions);
+            rawTxns.push_back(std::move(inner));
+
+            STObject batch(sfGeneric);
+            batch.setFieldU16(sfTransactionType, ttBATCH);
+            batch.setAccountID(sfAccount, id1);
+            batch.setFieldAmount(sfFee, STAmount(20ull));
+            batch.setFieldU32(sfSequence, 1);
+            batch.setFieldVL(sfSigningPubKey, Slice(kp1.first.data(), kp1.first.size()));
+            batch.setFieldArray(sfRawTransactions, rawTxns);
+            return batch;
+        };
+
+        {
+            // A batch whose inner is a well-formed transaction constructs.
+            std::string errorMsg;
+            try
+            {
+                STTx{makeBatch(makeInner(ttPAYMENT))};
+            }
+            catch (std::exception const& err)
+            {
+                errorMsg = err.what();
+            }
+            BEAST_EXPECT(errorMsg.empty());
+        }
+        {
+            // A batch whose inner carries an unregistered transaction type is
+            // rejected at construction, rather than surviving as a raw STObject
+            // and throwing later from an unprotected fee-calculation path.
+            std::string errorMsg;
+            try
+            {
+                STTx{makeBatch(makeInner(60000))};
+            }
+            catch (std::exception const& err)
+            {
+                errorMsg = err.what();
+            }
+            BEAST_EXPECT(matches(errorMsg.c_str(), "Invalid transaction type 60000"));
+        }
+    }
 };
 
 class InnerObjectFormatsSerializer_test : public beast::unit_test::Suite

From 18e311e1e245bcc1813363bd1771b94931585d80 Mon Sep 17 00:00:00 2001
From: Bart <bthomee@users.noreply.github.com>
Date: Thu, 16 Jul 2026 09:54:12 -0400
Subject: [PATCH 085/100] chore: Bump version to 3.3.0-rc1 (#7806)

Co-authored-by: Bart <11445373+bthomee@users.noreply.github.com>
Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
---
 src/libxrpl/protocol/BuildInfo.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libxrpl/protocol/BuildInfo.cpp b/src/libxrpl/protocol/BuildInfo.cpp
index 793ddb18d2..6ac352f3e1 100644
--- a/src/libxrpl/protocol/BuildInfo.cpp
+++ b/src/libxrpl/protocol/BuildInfo.cpp
@@ -23,7 +23,7 @@ namespace {
 //------------------------------------------------------------------------------
 // clang-format off
 // NOLINTNEXTLINE(readability-identifier-naming)
-char const* const versionString = "3.3.0-b1"
+char const* const versionString = "3.3.0-rc1"
     // clang-format on
     ;
 

From b1a670c46e5d7316aa95f71d1f7a6e4e6e240ac9 Mon Sep 17 00:00:00 2001
From: Sergey Kuznetsov <skuznetsov@ripple.com>
Date: Thu, 16 Jul 2026 16:28:04 +0100
Subject: [PATCH 086/100] ci: Add Rust to CI (#7808)

Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
---
 .cspell.config.yaml                              | 3 +++
 .github/scripts/strategy-matrix/linux.json       | 2 +-
 .github/workflows/publish-docs.yml               | 4 ++--
 .github/workflows/reusable-build-test-config.yml | 2 +-
 .github/workflows/reusable-clang-tidy.yml        | 4 ++--
 .github/workflows/reusable-upload-recipe.yml     | 2 +-
 .github/workflows/upload-conan-deps.yml          | 2 +-
 rust-toolchain.toml                              | 8 ++++++++
 8 files changed, 19 insertions(+), 8 deletions(-)
 create mode 100644 rust-toolchain.toml

diff --git a/.cspell.config.yaml b/.cspell.config.yaml
index 13da132b90..e220cd0249 100644
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -262,6 +262,8 @@ words:
   - Rohrs
   - roundings
   - rustc
+  - rustfmt
+  - rustup
   - sahyadri
   - Satoshi
   - scons
@@ -305,6 +307,7 @@ words:
   - takerpays
   - ters
   - TMEndpointv2
+  - toolchain
   - tparam
   - trixie
   - tx
diff --git a/.github/scripts/strategy-matrix/linux.json b/.github/scripts/strategy-matrix/linux.json
index 03ac1c6334..7edbf96ef6 100644
--- a/.github/scripts/strategy-matrix/linux.json
+++ b/.github/scripts/strategy-matrix/linux.json
@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-e29b523",
+  "image_tag": "sha-2e25435",
   "configs": {
     "ubuntu": [
       {
diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index 1ac8d61655..90182e7cbb 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-2e25435
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@ad188deb3dae79dc39816e16ddfdad1e06c6fab2
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/reusable-build-test-config.yml b/.github/workflows/reusable-build-test-config.yml
index b2327f67ea..975b788c0d 100644
--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -113,7 +113,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@ad188deb3dae79dc39816e16ddfdad1e06c6fab2
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
diff --git a/.github/workflows/reusable-clang-tidy.yml b/.github/workflows/reusable-clang-tidy.yml
index a6bbe669ce..4a10e4b0f7 100644
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -34,7 +34,7 @@ jobs:
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-e29b523"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-2e25435"
     permissions:
       contents: read
       issues: write
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@ad188deb3dae79dc39816e16ddfdad1e06c6fab2
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/reusable-upload-recipe.yml b/.github/workflows/reusable-upload-recipe.yml
index feeee0a621..07077163ed 100644
--- a/.github/workflows/reusable-upload-recipe.yml
+++ b/.github/workflows/reusable-upload-recipe.yml
@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-2e25435
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
diff --git a/.github/workflows/upload-conan-deps.yml b/.github/workflows/upload-conan-deps.yml
index 22ad36d98f..abc0867b15 100644
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@ad188deb3dae79dc39816e16ddfdad1e06c6fab2
         with:
           enable_ccache: false
 
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000000..dbc9e74c5d
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,8 @@
+# Rust toolchain pin for rustup-based CI runners and local development.
+# rustup reads this file and installs the pinned toolchain (see the
+# prepare-runner action in XRPLF/actions, which runs `rustup toolchain install`).
+# NOTE: the Nix CI image and development shell ignore this file; its rustc comes from flake.lock.
+[toolchain]
+channel = "1.95"
+components = ["rustfmt", "clippy"]
+profile = "minimal"

From 701311f27e19d273ab1e527c6121819234d00f6b Mon Sep 17 00:00:00 2001
From: Andrzej Budzanowski <andrzej.budzanowski@neti-soft.com>
Date: Thu, 16 Jul 2026 17:44:43 +0200
Subject: [PATCH 087/100] test: Add google benchmark dependency and migrate
 `nodestore` timing test as a benchmark (#7317)

Co-authored-by: Marek Foss <marek.foss@neti-soft.com>
Co-authored-by: Alex Kremer <akremer@ripple.com>
---
 .gersemi/definitions.cmake                    |   3 +
 .../scripts/levelization/results/ordering.txt |   3 +
 .../workflows/reusable-build-test-config.yml  |  17 +
 CMakeLists.txt                                |   8 +
 CONTRIBUTING.md                               |   1 +
 cmake/XrplAddBenchmark.cmake                  |  36 +
 cmake/XrplSettings.cmake                      |   2 +
 conan.lock                                    |   1 +
 conanfile.py                                  |   5 +
 src/benchmarks/libxrpl/CMakeLists.txt         |  22 +
 src/benchmarks/libxrpl/nodestore/Backend.cpp  | 329 ++++++++
 src/benchmarks/libxrpl/nodestore/Database.cpp | 243 ++++++
 .../libxrpl/nodestore/NodeStoreBench.h        | 318 ++++++++
 src/test/nodestore/Timing_test.cpp            | 729 ------------------
 14 files changed, 988 insertions(+), 729 deletions(-)
 create mode 100644 cmake/XrplAddBenchmark.cmake
 create mode 100644 src/benchmarks/libxrpl/CMakeLists.txt
 create mode 100644 src/benchmarks/libxrpl/nodestore/Backend.cpp
 create mode 100644 src/benchmarks/libxrpl/nodestore/Database.cpp
 create mode 100644 src/benchmarks/libxrpl/nodestore/NodeStoreBench.h
 delete mode 100644 src/test/nodestore/Timing_test.cpp

diff --git a/.gersemi/definitions.cmake b/.gersemi/definitions.cmake
index aa63076c8b..0932a72463 100644
--- a/.gersemi/definitions.cmake
+++ b/.gersemi/definitions.cmake
@@ -11,6 +11,9 @@ endfunction()
 function(create_symbolic_link target link)
 endfunction()
 
+function(xrpl_add_benchmark name)
+endfunction()
+
 macro(exclude_from_default target_)
 endmacro()
 
diff --git a/.github/scripts/levelization/results/ordering.txt b/.github/scripts/levelization/results/ordering.txt
index b31e6ae961..3c9c514516 100644
--- a/.github/scripts/levelization/results/ordering.txt
+++ b/.github/scripts/levelization/results/ordering.txt
@@ -1,3 +1,6 @@
+benchmarks.libxrpl > xrpl.basics
+benchmarks.libxrpl > xrpl.config
+benchmarks.libxrpl > xrpl.nodestore
 libxrpl.basics > xrpl.basics
 libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions
diff --git a/.github/workflows/reusable-build-test-config.yml b/.github/workflows/reusable-build-test-config.yml
index 975b788c0d..d4135207fe 100644
--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -324,6 +324,23 @@ jobs:
 
           LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee unittest.log
 
+      # Smoke-run every benchmark module with a single repetition to confirm the
+      # benchmarks still build and execute. This is a correctness check, not a
+      # performance measurement, so it is skipped for instrumented builds
+      # (sanitizers/coverage/voidstar), where it would be slow and meaningless,
+      # and on Windows, where the `install` target does not build them.
+      - name: Run the benchmarks
+        if: ${{ !inputs.build_only && runner.os != 'Windows' && env.SANITIZERS_ENABLED == 'false' && env.COVERAGE_ENABLED != 'true' && env.VOIDSTAR_ENABLED != 'true' }}
+        working-directory: ${{ env.BUILD_DIR }}
+        run: |
+          rc=0
+          while IFS= read -r bench; do
+              echo "::group::${bench}"
+              "./${bench}" --benchmark_repetitions=1 || rc=1
+              echo "::endgroup::"
+          done < <(find src/benchmarks -type f -perm -u+x -name 'xrpl.bench.*')
+          exit "${rc}"
+
       - name: Show test failure summary
         if: ${{ failure() && !inputs.build_only }}
         env:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1e8befcc8f..f2e8fb3ae5 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -131,6 +131,10 @@ else()
 endif()
 target_link_libraries(xrpl_libs INTERFACE ${nudb})
 
+if(benchmark)
+    find_package(benchmark REQUIRED)
+endif()
+
 if(coverage)
     include(XrplCov)
 endif()
@@ -145,3 +149,7 @@ if(tests)
     include(CTest)
     add_subdirectory(src/tests/libxrpl)
 endif()
+
+if(benchmark)
+    add_subdirectory(src/benchmarks/libxrpl)
+endif()
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9929b2eb39..7632741e35 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -83,6 +83,7 @@ If you create new source files, they must be organized as follows:
   `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
 - All test source files must go under `src/test`.
+- All benchmark source files must go under `src/benchmarks`.
 
 The source must be formatted according to the style guide below. The easiest
 way to satisfy this is to install the [`pre-commit`](#pre-commit-hooks) hooks,
diff --git a/cmake/XrplAddBenchmark.cmake b/cmake/XrplAddBenchmark.cmake
new file mode 100644
index 0000000000..1dd875dd61
--- /dev/null
+++ b/cmake/XrplAddBenchmark.cmake
@@ -0,0 +1,36 @@
+include(isolate_headers)
+
+# Define a benchmark executable for the module `name`.
+#
+# This follows the same general pattern as other build helpers in this repo
+# (e.g. `add_module`): create a target and isolate headers, but here the target
+# is a benchmark executable and no `add_test(...)` is registered.
+#
+# `isolate_headers` exposes only `${CMAKE_CURRENT_SOURCE_DIR}/${name}` on the
+# include path, rooted at `src`, so a benchmark's own headers are reached as
+# `<benchmarks/.../${name}/...>` and nothing else in the tree leaks in.
+function(xrpl_add_benchmark name)
+    set(target ${PROJECT_NAME}.bench.${name})
+
+    file(
+        GLOB_RECURSE sources
+        CONFIGURE_DEPENDS
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}/*.cpp"
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}.cpp"
+    )
+    add_executable(${target} ${ARGN} ${sources})
+
+    # Benchmark sources register cases through Google Benchmark's static
+    # registrars (anonymous-namespace lambdas). Merging several such files into
+    # one unity translation unit collides those internal-linkage entities, so
+    # keep benchmarks out of the unity build - mirroring xrpl.libpb in
+    # XrplCore.cmake. Each file compiles fine on its own.
+    set_target_properties(${target} PROPERTIES UNITY_BUILD OFF)
+
+    isolate_headers(
+        ${target}
+        "${CMAKE_SOURCE_DIR}/src"
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}"
+        PRIVATE
+    )
+endfunction()
diff --git a/cmake/XrplSettings.cmake b/cmake/XrplSettings.cmake
index 757a596096..be9bf1fda2 100644
--- a/cmake/XrplSettings.cmake
+++ b/cmake/XrplSettings.cmake
@@ -30,6 +30,8 @@ if(tests)
     endif()
 endif()
 
+option(benchmark "Build benchmarks" ON)
+
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are
diff --git a/conan.lock b/conan.lock
index 9dfbb86960..c6a4070c77 100644
--- a/conan.lock
+++ b/conan.lock
@@ -25,6 +25,7 @@
         "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
         "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
+        "benchmark/1.9.5#b885dc73ad67b40a55d45684d1c88ad1%1782736613.864841",
         "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
     ],
     "build_requires": [
diff --git a/conanfile.py b/conanfile.py
index f0b10cf34b..f883761f0e 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -15,6 +15,7 @@ class Xrpl(ConanFile):
     settings = "os", "compiler", "build_type", "arch"
     options = {
         "assertions": [True, False],
+        "benchmark": [True, False],
         "coverage": [True, False],
         "fPIC": [True, False],
         "jemalloc": [True, False],
@@ -46,6 +47,7 @@ class Xrpl(ConanFile):
 
     default_options = {
         "assertions": False,
+        "benchmark": True,
         "coverage": False,
         "fPIC": True,
         "jemalloc": False,
@@ -129,6 +131,8 @@ class Xrpl(ConanFile):
             self.options["boost"].without_cobalt = True
 
     def requirements(self):
+        if self.options.benchmark:
+            self.requires("benchmark/1.9.5")
         self.requires("boost/1.91.0", force=True, transitive_headers=True)
         self.requires("date/3.0.4", transitive_headers=True)
         if self.options.jemalloc:
@@ -162,6 +166,7 @@ class Xrpl(ConanFile):
     def generate(self):
         tc = CMakeToolchain(self)
         tc.variables["tests"] = self.options.tests
+        tc.variables["benchmark"] = self.options.benchmark
         tc.variables["assert"] = self.options.assertions
         tc.variables["coverage"] = self.options.coverage
         tc.variables["jemalloc"] = self.options.jemalloc
diff --git a/src/benchmarks/libxrpl/CMakeLists.txt b/src/benchmarks/libxrpl/CMakeLists.txt
new file mode 100644
index 0000000000..ac751a0413
--- /dev/null
+++ b/src/benchmarks/libxrpl/CMakeLists.txt
@@ -0,0 +1,22 @@
+include(XrplAddBenchmark)
+
+# Benchmark requirements.
+find_package(benchmark REQUIRED)
+
+# Custom target for all benchmarks defined in this file.
+add_custom_target(xrpl.benchmarks)
+
+# Common library dependencies for every benchmark module. `benchmark_main`
+# supplies a `main()` that parses the standard Google Benchmark CLI flags
+# (`--benchmark_filter`, `--benchmark_format`, ...), so no per-module main.cpp
+# is needed.
+add_library(xrpl.imports.bench INTERFACE)
+target_link_libraries(
+    xrpl.imports.bench
+    INTERFACE benchmark::benchmark_main xrpl.libxrpl
+)
+
+# One benchmark executable for each module.
+xrpl_add_benchmark(nodestore)
+target_link_libraries(xrpl.bench.nodestore PRIVATE xrpl.imports.bench)
+add_dependencies(xrpl.benchmarks xrpl.bench.nodestore)
diff --git a/src/benchmarks/libxrpl/nodestore/Backend.cpp b/src/benchmarks/libxrpl/nodestore/Backend.cpp
new file mode 100644
index 0000000000..7db0185053
--- /dev/null
+++ b/src/benchmarks/libxrpl/nodestore/Backend.cpp
@@ -0,0 +1,329 @@
+#include <xrpl/nodestore/Backend.h>
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/nodestore/NodeObject.h>
+#include <xrpl/nodestore/Types.h>
+
+#include <benchmark/benchmark.h>
+#include <benchmarks/libxrpl/nodestore/NodeStoreBench.h>
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+namespace xrpl::NodeStore {
+namespace {
+
+constexpr std::size_t kPoolSizes[] = {1000, 10000, 100000};
+constexpr int kThreadCounts[] = {1, 4, 8};
+constexpr std::size_t kBatchSize = 256;
+
+constexpr std::string_view kNamePrefix = "BM_Backend_";
+constexpr std::string_view kNameSeparator = "/";
+
+struct RunState
+{
+    std::unique_ptr<BackendHarness> harness;
+    Batch present;                     // prefix-1 objects, eligible to be stored
+    Batch recent;                      // prefix-1 objects in the "future" key space
+    std::vector<uint256> missing;      // prefix-2 keys that are never stored
+    std::vector<std::size_t> shuffle;  // [0, poolSize) permutation for random-like access
+    std::size_t avgPayload = 0;        // mean getData().size() over `present`
+
+    void
+    release()
+    {
+        harness.reset();
+        Batch{}.swap(present);
+        Batch{}.swap(recent);
+        std::vector<uint256>{}.swap(missing);
+        std::vector<std::size_t>{}.swap(shuffle);
+    }
+};
+
+struct SetupContext
+{
+    RunState& rs;
+    Backend& backend;
+    std::size_t poolSize;
+};
+
+struct IterateContext
+{
+    RunState& rs;
+    Backend& backend;
+    std::size_t index;
+    std::size_t poolSize;
+};
+
+struct Workload
+{
+    std::string_view name;
+    std::function<void(SetupContext const&)> setup;
+    std::function<void(IterateContext const&)> iterate;
+    bool reportBytes = false;  // SetBytesProcessed from rs.avgPayload
+    bool clobber = true;       // ClobberMemory after the loop (false for pure stores)
+    bool pinToPool = false;    // pin iterations to one pool sweep instead of autotuning
+};
+
+// One store() per iteration. Iterations are pinned to one pool sweep (per
+// thread) so the index never wraps past the pool - otherwise NuDB::doInsert
+// swallows key_exists and the workload degenerates into duplicate-detection
+// no-ops.
+Workload const kInsert{
+    .name = "Insert",
+    .setup =
+        [](SetupContext const& ctx) {
+            ctx.rs.present = makePool(1, ctx.poolSize);
+            ctx.rs.avgPayload = averagePayload(ctx.rs.present);
+        },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, backend, index, poolSize] = ctx;
+            backend.store(rs.present[index % poolSize]);
+        },
+    .reportBytes = true,
+    .clobber = false,
+    .pinToPool = true,
+};
+
+// One fetch() of a present key (a hit) per iteration.
+Workload const kFetch{
+    .name = "Fetch",
+    .setup =
+        [](SetupContext const& ctx) {
+            ctx.rs.present = makePool(1, ctx.poolSize);
+            ctx.rs.avgPayload = averagePayload(ctx.rs.present);
+            prepopulate(ctx.backend, ctx.rs.present);
+        },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, backend, index, poolSize] = ctx;
+            std::shared_ptr<NodeObject> result;
+            backend.fetch(rs.present[index % poolSize]->getHash(), &result);
+            benchmark::DoNotOptimize(result);
+        },
+    .reportBytes = true,
+};
+
+// One fetch() of a never-stored key (a miss); the backend is left empty.
+Workload const kMissing{
+    .name = "Missing",
+    .setup = [](SetupContext const& ctx) { ctx.rs.missing = makeMissingKeys(ctx.poolSize); },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, backend, index, poolSize] = ctx;
+            std::shared_ptr<NodeObject> result;
+            backend.fetch(rs.missing[index % poolSize], &result);
+            benchmark::DoNotOptimize(result);
+        },
+};
+
+// 80% hits / 20% misses. The fetch index comes from a shuffle table so access
+// is random-like without per-iteration RNG cost; sequential `index % poolSize`
+// would be artificially cache-friendly to RocksDB's block cache.
+Workload const kMixed{
+    .name = "Mixed",
+    .setup =
+        [](SetupContext const& ctx) {
+            ctx.rs.present = makePool(1, ctx.poolSize);
+            ctx.rs.missing = makeMissingKeys(ctx.poolSize);
+            ctx.rs.shuffle = makeShuffle(ctx.poolSize, /*seed=*/1);
+            prepopulate(ctx.backend, ctx.rs.present);
+        },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, backend, index, poolSize] = ctx;
+            std::shared_ptr<NodeObject> result;
+            auto const pick = rs.shuffle[index % poolSize];
+            if (index % 5 == 0)
+            {
+                backend.fetch(rs.missing[pick], &result);
+            }
+            else
+            {
+                backend.fetch(rs.present[pick]->getHash(), &result);
+            }
+            benchmark::DoNotOptimize(result);
+        },
+};
+
+// An xrpld-like cycle: a hit, a maybe-miss recent fetch, and a store. The
+// recent fetch uses the shuffle table (not `slot`) so it doesn't fetch the item
+// it's about to store this iteration - which would give an all-miss-then-hit
+// step instead of a smooth ramp. The store walks sequentially so each recent
+// object is stored once.
+Workload const kWork{
+    .name = "Work",
+    .setup =
+        [](SetupContext const& ctx) {
+            ctx.rs.present = makePool(1, ctx.poolSize);
+            ctx.rs.recent = makePool(1, ctx.poolSize, ctx.poolSize);
+            ctx.rs.shuffle = makeShuffle(ctx.poolSize, /*seed=*/2);
+            prepopulate(ctx.backend, ctx.rs.present);
+        },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, backend, index, poolSize] = ctx;
+            auto const slot = index % poolSize;
+            auto const pick = rs.shuffle[slot];
+
+            std::shared_ptr<NodeObject> historical;
+            backend.fetch(rs.present[pick]->getHash(), &historical);
+            benchmark::DoNotOptimize(historical);
+
+            std::shared_ptr<NodeObject> recent;
+            backend.fetch(rs.recent[pick]->getHash(), &recent);
+            benchmark::DoNotOptimize(recent);
+
+            backend.store(rs.recent[slot]);
+        },
+    .clobber = true,
+    .pinToPool = true,
+};
+
+auto
+makeRunner(Workload w, std::string cfg, std::shared_ptr<RunState> rs)
+{
+    return [w = std::move(w), cfg = std::move(cfg), rs = std::move(rs)](benchmark::State& state) {
+        auto const poolSize = static_cast<std::size_t>(state.range(0));
+        if (state.thread_index() == 0)
+        {
+            rs->harness = std::make_unique<BackendHarness>(cfg);
+            w.setup(
+                SetupContext{.rs = *rs, .backend = *rs->harness->backend, .poolSize = poolSize});
+        }
+
+        std::size_t index = state.thread_index();
+        for (auto _ : state)
+        {
+            w.iterate(
+                IterateContext{
+                    .rs = *rs,
+                    .backend = *rs->harness->backend,
+                    .index = index,
+                    .poolSize = poolSize});
+            index += state.threads();
+        }
+
+        if (w.clobber)
+            benchmark::ClobberMemory();
+
+        state.SetItemsProcessed(state.iterations());
+        if (w.reportBytes)
+            state.SetBytesProcessed(static_cast<std::int64_t>(state.iterations() * rs->avgPayload));
+
+        if (state.thread_index() == 0)
+            rs->release();
+    };
+}
+
+// Register workload `w` against backend `bc`, choosing the registration shape
+// from `w.pinToPool`.
+void
+registerWorkload(BackendConfig const& bc, Workload const& w)
+{
+    std::string const cfg = bc.config;
+    std::string name{kNamePrefix};
+    name += w.name;
+    name += kNameSeparator;
+    name += bc.name;
+
+    if (!w.pinToPool)
+    {
+        auto rs = std::make_shared<RunState>();
+        auto* b = benchmark::RegisterBenchmark(name, makeRunner(w, cfg, rs));
+        b->RangeMultiplier(10)->Range(kPoolSizes[0], kPoolSizes[std::size(kPoolSizes) - 1]);
+        b->Threads(1)->Threads(4)->Threads(8)->UseRealTime();
+
+        return;
+    }
+
+    for (auto const poolSize : kPoolSizes)
+    {
+        for (auto const threads : kThreadCounts)
+        {
+            if (poolSize % static_cast<std::size_t>(threads) != 0)
+                continue;
+
+            auto rs = std::make_shared<RunState>();
+            benchmark::RegisterBenchmark(name, makeRunner(w, cfg, rs))
+                ->Arg(poolSize)
+                ->Iterations(poolSize / static_cast<std::size_t>(threads))
+                ->Threads(threads)
+                ->UseRealTime();
+        }
+    }
+}
+
+// One storeBatch() of kBatchSize objects per iteration. Single-threaded:
+// Backend::storeBatch must not run concurrently with itself or store().
+// Iterations are pinned to the batch count so the index never wraps into
+// key_exists no-ops. Kept separate from Workload: batch slicing and the
+// per-batch item/byte accounting don't fit the thread-axis mold.
+void
+registerStoreBatch(BackendConfig const& bc)
+{
+    std::string const cfg = bc.config;
+    std::string name{kNamePrefix};
+    name += "StoreBatch";
+    name += kNameSeparator;
+    name += bc.name;
+    for (auto const poolSize : kPoolSizes)
+    {
+        auto const numBatches = poolSize / kBatchSize;
+        if (numBatches == 0)
+            continue;
+
+        auto rs = std::make_shared<RunState>();
+        benchmark::RegisterBenchmark(
+            name,
+            [rs, cfg](benchmark::State& state) {
+                auto const poolSize = static_cast<std::size_t>(state.range(0));
+                rs->harness = std::make_unique<BackendHarness>(cfg);
+                rs->present = makePool(1, poolSize);
+                rs->avgPayload = averagePayload(rs->present);
+                std::vector<Batch> const batches = sliceBatches(rs->present, kBatchSize);
+                if (batches.empty())
+                {
+                    state.SkipWithError("pool smaller than one batch");
+                    return;
+                }
+
+                std::size_t index = 0;
+                for (auto _ : state)
+                {
+                    rs->harness->backend->storeBatch(batches[index % batches.size()]);
+                    ++index;
+                }
+
+                state.SetItemsProcessed(static_cast<std::int64_t>(state.iterations() * kBatchSize));
+                state.SetBytesProcessed(
+                    static_cast<std::int64_t>(state.iterations() * kBatchSize * rs->avgPayload));
+                rs->release();
+            })
+            ->Arg(poolSize)
+            ->Iterations(numBatches);
+    }
+}
+
+[[maybe_unused]] bool const kRegistered = [] {
+    auto const workloads = std::to_array({&kInsert, &kFetch, &kMissing, &kMixed, &kWork});
+    for (auto const& bc : backendConfigs())
+    {
+        for (auto const* w : workloads)
+            registerWorkload(bc, *w);
+
+        registerStoreBatch(bc);
+    }
+    return true;
+}();
+
+}  // namespace
+}  // namespace xrpl::NodeStore
diff --git a/src/benchmarks/libxrpl/nodestore/Database.cpp b/src/benchmarks/libxrpl/nodestore/Database.cpp
new file mode 100644
index 0000000000..2303075ab9
--- /dev/null
+++ b/src/benchmarks/libxrpl/nodestore/Database.cpp
@@ -0,0 +1,243 @@
+#include <xrpl/nodestore/Database.h>
+
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/nodestore/NodeObject.h>
+#include <xrpl/nodestore/Types.h>
+
+#include <benchmark/benchmark.h>
+#include <benchmarks/libxrpl/nodestore/NodeStoreBench.h>
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+namespace xrpl::NodeStore {
+namespace {
+
+// Number of distinct objects pre-generated per run.
+constexpr std::size_t kDefaultPoolSize = 100000;
+
+// Async read threads the Database spawns. Unused by the synchronous fetch path
+// these benchmarks take; kept fixed so runs are comparable.
+constexpr int kReadThreads = 4;
+
+constexpr std::string_view kNamePrefix = "BM_Database_";
+constexpr std::string_view kNameSeparator = "/";
+
+struct RunState
+{
+    std::unique_ptr<DatabaseHarness> harness;
+    Batch present;                     // prefix-1 objects, eligible to be stored
+    Batch recent;                      // prefix-1 objects in the "future" key space
+    std::vector<uint256> missing;      // prefix-2 keys that are never stored
+    std::vector<std::size_t> shuffle;  // [0, poolSize) permutation for random-like access
+    std::size_t avgPayload = 0;        // mean getData().size() over `present`
+};
+
+struct SetupContext
+{
+    RunState& rs;
+    Database& db;
+    std::size_t poolSize;
+};
+
+struct IterateContext
+{
+    RunState& rs;
+    Database& db;
+    std::uint32_t seq;
+    std::size_t index;
+    std::size_t poolSize;
+};
+
+struct Workload
+{
+    std::string_view name;
+    std::function<void(SetupContext const&)> setup;
+    std::function<void(IterateContext const&)> iterate;
+    bool reportBytes = false;
+    bool pinIterations = false;
+};
+
+void
+prepopulate(Database& db, Batch const& objects)
+{
+    auto const seq = db.earliestLedgerSeq();
+    for (auto const& obj : objects)
+    {
+        Blob data(obj->getData());
+        db.store(obj->getType(), std::move(data), obj->getHash(), seq);
+    }
+    db.sync();
+}
+
+// One store() per iteration; a fresh Blob copy is handed over each time.
+Workload const kStore{
+    .name = "Store",
+    .setup =
+        [](SetupContext const& ctx) {
+            ctx.rs.present = makePool(1, ctx.poolSize);
+            ctx.rs.avgPayload = averagePayload(ctx.rs.present);
+        },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, db, seq, index, poolSize] = ctx;
+            auto const& obj = rs.present[index % poolSize];
+            Blob data(obj->getData());
+            db.store(obj->getType(), std::move(data), obj->getHash(), seq);
+        },
+    .reportBytes = true,
+    .pinIterations = true,
+};
+
+// One fetchNodeObject() of a stored key (a hit) per iteration.
+Workload const kFetch{
+    .name = "Fetch",
+    .setup =
+        [](SetupContext const& ctx) {
+            ctx.rs.present = makePool(1, ctx.poolSize);
+            ctx.rs.avgPayload = averagePayload(ctx.rs.present);
+            prepopulate(ctx.db, ctx.rs.present);
+        },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, db, seq, index, poolSize] = ctx;
+            auto obj = db.fetchNodeObject(rs.present[index % poolSize]->getHash(), seq);
+            benchmark::DoNotOptimize(obj);
+        },
+    .reportBytes = true,
+};
+
+// One fetchNodeObject() of a never-stored key (a miss) per iteration.
+Workload const kMissing{
+    .name = "Missing",
+    .setup = [](SetupContext const& ctx) { ctx.rs.missing = makeMissingKeys(ctx.poolSize); },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, db, seq, index, poolSize] = ctx;
+            auto obj = db.fetchNodeObject(rs.missing[index % poolSize], seq);
+            benchmark::DoNotOptimize(obj);
+        },
+};
+
+// 80% hits / 20% misses. The fetch index comes from a shuffle table so access
+// is random-like without per-iteration RNG cost; sequential `index % poolSize`
+// would be artificially cache-friendly.
+Workload const kMixed{
+    .name = "Mixed",
+    .setup =
+        [](SetupContext const& ctx) {
+            ctx.rs.present = makePool(1, ctx.poolSize);
+            ctx.rs.missing = makeMissingKeys(ctx.poolSize);
+            ctx.rs.shuffle = makeShuffle(ctx.poolSize, /*seed=*/1);
+            prepopulate(ctx.db, ctx.rs.present);
+        },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, db, seq, index, poolSize] = ctx;
+            auto const pick = rs.shuffle[index % poolSize];
+            std::shared_ptr<NodeObject> obj;
+            if (index % 5 == 0)
+            {
+                obj = db.fetchNodeObject(rs.missing[pick], seq);
+            }
+            else
+            {
+                obj = db.fetchNodeObject(rs.present[pick]->getHash(), seq);
+            }
+            benchmark::DoNotOptimize(obj);
+        },
+};
+
+// An xrpld-like cycle: a hit, a maybe-miss recent fetch, and a store. The
+// recent fetch uses the shuffle table (not `slot`) so it doesn't fetch the item
+// it's about to store this iteration - which would give an all-miss-then-hit
+// step instead of a smooth ramp. The store walks sequentially so each recent
+// object is stored once.
+Workload const kWork{
+    .name = "Work",
+    .setup =
+        [](SetupContext const& ctx) {
+            ctx.rs.present = makePool(1, ctx.poolSize);
+            ctx.rs.recent = makePool(1, ctx.poolSize, ctx.poolSize);
+            ctx.rs.shuffle = makeShuffle(ctx.poolSize, /*seed=*/2);
+            prepopulate(ctx.db, ctx.rs.present);
+        },
+    .iterate =
+        [](IterateContext const& ctx) {
+            auto& [rs, db, seq, index, poolSize] = ctx;
+            auto const slot = index % poolSize;
+            auto const pick = rs.shuffle[slot];
+
+            auto historical = db.fetchNodeObject(rs.present[pick]->getHash(), seq);
+            benchmark::DoNotOptimize(historical);
+
+            auto recent = db.fetchNodeObject(rs.recent[pick]->getHash(), seq);
+            benchmark::DoNotOptimize(recent);
+
+            auto const& obj = rs.recent[slot];
+            Blob data(obj->getData());
+            db.store(obj->getType(), std::move(data), obj->getHash(), seq);
+        },
+    .pinIterations = true,
+};
+
+void
+registerWorkload(BackendConfig const& bc, Workload const& w)
+{
+    auto rs = std::make_shared<RunState>();
+    std::string const cfg = bc.config;
+    std::string name{kNamePrefix};
+    name += w.name;
+    name += kNameSeparator;
+    name += bc.name;
+    auto* b = benchmark::RegisterBenchmark(name, [rs, cfg, w](benchmark::State& state) {
+        auto const poolSize = static_cast<std::size_t>(state.range(0));
+        rs->harness = std::make_unique<DatabaseHarness>(cfg, kReadThreads);
+        auto& db = *rs->harness->db;
+        w.setup(SetupContext{.rs = *rs, .db = db, .poolSize = poolSize});
+        auto const seq = db.earliestLedgerSeq();
+
+        std::size_t index = 0;
+        for (auto _ : state)
+        {
+            w.iterate(
+                IterateContext{
+                    .rs = *rs, .db = db, .seq = seq, .index = index, .poolSize = poolSize});
+            ++index;
+        }
+        benchmark::ClobberMemory();
+
+        state.SetItemsProcessed(state.iterations());
+        if (w.reportBytes)
+        {
+            state.SetBytesProcessed(static_cast<std::int64_t>(state.iterations() * rs->avgPayload));
+        }
+        rs->harness.reset();
+    });
+
+    b->Arg(kDefaultPoolSize);
+
+    if (w.pinIterations)
+        b->Iterations(kDefaultPoolSize);
+}
+
+[[maybe_unused]] bool const kRegistered = [] {
+    auto const workloads = std::to_array({&kStore, &kFetch, &kMissing, &kMixed, &kWork});
+    for (auto const& bc : backendConfigs())
+    {
+        for (auto const* w : workloads)
+            registerWorkload(bc, *w);
+    }
+    return true;
+}();
+
+}  // namespace
+}  // namespace xrpl::NodeStore
diff --git a/src/benchmarks/libxrpl/nodestore/NodeStoreBench.h b/src/benchmarks/libxrpl/nodestore/NodeStoreBench.h
new file mode 100644
index 0000000000..fe6c2a350e
--- /dev/null
+++ b/src/benchmarks/libxrpl/nodestore/NodeStoreBench.h
@@ -0,0 +1,318 @@
+#pragma once
+
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/ByteUtilities.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/safe_cast.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/temp_dir.h>
+#include <xrpl/beast/xor_shift_engine.h>
+#include <xrpl/config/BasicConfig.h>
+#include <xrpl/nodestore/Backend.h>
+#include <xrpl/nodestore/Database.h>
+#include <xrpl/nodestore/DummyScheduler.h>
+#include <xrpl/nodestore/Manager.h>
+#include <xrpl/nodestore/NodeObject.h>
+#include <xrpl/nodestore/Scheduler.h>
+#include <xrpl/nodestore/Types.h>
+
+#include <boost/algorithm/string/classification.hpp>
+#include <boost/algorithm/string/split.hpp>
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <memory>
+#include <numeric>
+#include <random>
+#include <string>
+#include <utility>
+#include <vector>
+
+// Shared helpers for the NodeStore benchmarks.
+//
+namespace xrpl::NodeStore {
+
+// Fill `bytes` of memory at `buffer` with random bits drawn from `g`.
+template <class Generator>
+inline void
+rngcpy(void* buffer, std::size_t bytes, Generator& g)
+{
+    using result_type = typename Generator::result_type;
+    while (bytes >= sizeof(result_type))
+    {
+        auto const v = g();
+        std::memcpy(buffer, &v, sizeof(v));
+        buffer = reinterpret_cast<std::uint8_t*>(buffer) + sizeof(v);
+        bytes -= sizeof(v);
+    }
+
+    if (bytes > 0)
+    {
+        auto const v = g();
+        std::memcpy(buffer, &v, bytes);
+    }
+}
+
+/**
+ * @brief Deterministic generator of a reproducible sequence of random NodeObjects.
+ *
+ * Indexing is stable: `obj(n)` and `key(n)` always return the same value for a
+ * given `n`, regardless of call order, because the engine is reseeded from `n`
+ * on every call.
+ *
+ * Using different prefixes guarantees the two key spaces are disjoint for the fetch-miss
+ * workloads.
+ */
+class Sequence
+{
+private:
+    static constexpr auto kMinSize = 250;
+    static constexpr auto kMaxSize = 1250;
+
+    beast::xor_shift_engine gen_;
+    std::uint8_t prefix_;
+    std::discrete_distribution<std::uint32_t> dType_;
+    std::uniform_int_distribution<std::uint32_t> dSize_;
+
+public:
+    explicit Sequence(std::uint8_t prefix)
+        : prefix_(prefix)
+        // uniform distribution over hotLEDGER - hotTRANSACTION_NODE
+        // but exclude hotTRANSACTION = 2 (removed)
+        , dType_({1, 1, 0, 1, 1})
+        , dSize_(kMinSize, kMaxSize)
+    {
+    }
+
+    // Returns the n-th key. Used to generate keys that are never stored.
+    // The layout mirrors obj()'s: prefix at byte 0, RNG over the rest, so the
+    // two key spaces stay disjoint by construction (not by coincidence).
+    uint256
+    key(std::size_t n)
+    {
+        gen_.seed(n + 1);
+        uint256 result;
+        auto const data = static_cast<std::uint8_t*>(&*result.begin());
+        *data = prefix_;
+        rngcpy(data + 1, result.size() - 1, gen_);
+        return result;
+    }
+
+    // Returns the n-th complete NodeObject.
+    std::shared_ptr<NodeObject>
+    obj(std::size_t n)
+    {
+        gen_.seed(n + 1);
+        uint256 key;
+        auto const data = static_cast<std::uint8_t*>(&*key.begin());
+        *data = prefix_;
+        rngcpy(data + 1, key.size() - 1, gen_);
+        Blob value(dSize_(gen_));
+        rngcpy(&value[0], value.size(), gen_);
+        return NodeObject::createObject(
+            safeCast<NodeObjectType>(dType_(gen_)), std::move(value), key);
+    }
+
+    // Fills `b` with `size` consecutive NodeObjects starting at index `n`.
+    void
+    batch(std::size_t n, Batch& b, std::size_t size)
+    {
+        b.clear();
+        b.reserve(size);
+        while ((size--) != 0u)
+            b.push_back(obj(n++));
+    }
+};
+
+// Parse a comma-separated "key=value,key=value" string into a config Section.
+inline Section
+parseConfig(std::string const& s)
+{
+    Section section;
+    std::vector<std::string> values;
+    boost::split(values, s, boost::algorithm::is_any_of(","));
+    section.append(values);
+    return section;
+}
+
+// Pre-generate `count` distinct objects from key space `prefix`, starting at
+// sequence index `start`.
+inline Batch
+makePool(std::uint8_t prefix, std::size_t count, std::size_t start = 0)
+{
+    Sequence seq(prefix);
+    Batch pool;
+    pool.reserve(count);
+    for (std::size_t i = 0; i < count; ++i)
+        pool.push_back(seq.obj(start + i));
+    return pool;
+}
+
+// Pre-generate `count` keys disjoint from every `makePool(...)` object, for
+// measuring fetches that miss.
+inline std::vector<uint256>
+makeMissingKeys(std::size_t count)
+{
+    Sequence seq(2);
+    std::vector<uint256> keys;
+    keys.reserve(count);
+    for (std::size_t i = 0; i < count; ++i)
+        keys.push_back(seq.key(i));
+    return keys;
+}
+
+// Mean payload size across a pool, used for SetBytesProcessed throughput.
+inline std::size_t
+averagePayload(Batch const& pool)
+{
+    if (pool.empty())
+        return 0;
+    std::size_t total = 0;
+    for (auto const& obj : pool)
+        total += obj->getData().size();
+    return total / pool.size();
+}
+
+// Store every object and flush, so a following fetch exercises the real read
+// path rather than an in-memory write buffer.
+//
+// We chunk the write at kBatchWriteLimitSize because Types.h documents that as
+// the maximum allowed batch size. NuDB happens to tolerate larger batches
+// today, but the benchmark should not rely on that.
+//
+// sync() is a no-op for both NuDB and RocksDB at the moment (NuDB has a small
+// internal burst buffer that the timed loop will warm up). That is a contract
+// hint, not a guarantee; if either backend ever grows a real flush we get it
+// here for free.
+inline void
+prepopulate(Backend& backend, Batch const& objects)
+{
+    for (std::size_t i = 0; i < objects.size(); i += kBatchWriteLimitSize)
+    {
+        auto const end = std::min(i + kBatchWriteLimitSize, objects.size());
+        backend.storeBatch(Batch(objects.begin() + i, objects.begin() + end));
+    }
+    backend.sync();
+}
+
+// A deterministic permutation of [0, size). Lets the timed loop visit the
+// pre-generated pool in a random-like order with zero RNG cost per iteration -
+// the Timing_test workloads it replaces used uniform_int_distribution per
+// fetch, and a shuffle table reproduces that access pattern without paying for
+// the distribution inside the timed region.
+inline std::vector<std::size_t>
+makeShuffle(std::size_t size, std::uint64_t seed)
+{
+    std::vector<std::size_t> v(size);
+    std::iota(v.begin(), v.end(), std::size_t{0});
+    beast::xor_shift_engine gen(seed);
+    std::shuffle(v.begin(), v.end(), gen);
+    return v;
+}
+
+// Partition a pool into fixed-size batches. Any trailing remainder shorter than
+// `batchSize` is dropped, so every returned batch has exactly `batchSize`.
+inline std::vector<Batch>
+sliceBatches(Batch const& pool, std::size_t batchSize)
+{
+    std::vector<Batch> batches;
+    if (batchSize == 0)
+        return batches;
+    batches.reserve(pool.size() / batchSize);
+    for (std::size_t i = 0; i + batchSize <= pool.size(); i += batchSize)
+        batches.emplace_back(pool.begin() + i, pool.begin() + i + batchSize);
+    return batches;
+}
+
+/**
+ * @brief RAII owner of a NodeStore Backend opened on a private temporary directory.
+ *
+ * Member declaration order matters: `tempDir` is declared first so it is
+ * destroyed last, after the backend has closed and released its files.
+ */
+struct BackendHarness
+{
+    beast::TempDir tempDir;
+    DummyScheduler scheduler;
+    beast::Journal journal{beast::Journal::getNullSink()};
+    std::unique_ptr<Backend> backend;
+
+    explicit BackendHarness(std::string const& configString)
+    {
+        Section config = parseConfig(configString);
+        // A private, unique path per harness, so concurrent or repeated runs
+        // never share on-disk state.
+        config.set("path", tempDir.path());
+        backend =
+            Manager::instance().makeBackend(config, megabytes(std::size_t{4}), scheduler, journal);
+        backend->setDeletePath();
+        backend->open();
+    }
+
+    ~BackendHarness()
+    {
+        if (backend)
+            backend->close();
+    }
+};
+
+/**
+ * RAII owner of a NodeStore Database - the application-facing wrapper around a
+ * Backend, which adds fetch/store accounting and the async read-thread pool.
+ */
+struct DatabaseHarness
+{
+    beast::TempDir tempDir;
+    DummyScheduler scheduler;
+    beast::Journal journal{beast::Journal::getNullSink()};
+    std::unique_ptr<Database> db;
+
+    DatabaseHarness(std::string const& configString, int readThreads)
+    {
+        Section config = parseConfig(configString);
+        config.set("path", tempDir.path());
+        db = Manager::instance().makeDatabase(
+            megabytes(std::size_t{4}), scheduler, readThreads, config, journal);
+    }
+
+    ~DatabaseHarness()
+    {
+        if (db)
+            db->stop();
+    }
+};
+
+// A NodeStore backend to benchmark, named for the --benchmark_filter CLI flag.
+struct BackendConfig
+{
+    char const* name;    // short label, e.g. "nudb"
+    char const* config;  // parseConfig() string, e.g. "type=nudb"
+};
+
+// The backends every workload is registered against.
+//
+// The in-memory backend is intentionally excluded. It keeps its table in a
+// process-global map keyed by path, with no removal API, so building a fresh
+// backend per run - as a microbenchmark must - would leak the whole dataset on
+// every run. Timing_test, the suite this benchmark replaces, excluded it for
+// the same reason. NuDB and RocksDB are the production backends worth timing.
+//
+// RocksDB is included only when it was compiled in (xrpl.libxrpl carries
+// XRPL_ROCKSDB_AVAILABLE transitively).
+inline std::vector<BackendConfig> const&
+backendConfigs()
+{
+    static std::vector<BackendConfig> const kConfigs = {
+        {.name = "nudb", .config = "type=nudb"},
+#if XRPL_ROCKSDB_AVAILABLE
+        {.name = "rocksdb",
+         .config = "type=rocksdb,open_files=2000,filter_bits=12,cache_mb=256,"
+                   "file_size_mb=8,file_size_mult=2"},
+#endif
+    };
+    return kConfigs;
+}
+
+}  // namespace xrpl::NodeStore
diff --git a/src/test/nodestore/Timing_test.cpp b/src/test/nodestore/Timing_test.cpp
deleted file mode 100644
index 1f282d9d7f..0000000000
--- a/src/test/nodestore/Timing_test.cpp
+++ /dev/null
@@ -1,729 +0,0 @@
-#include <test/nodestore/TestBase.h>
-#include <test/unit_test/SuiteJournal.h>
-
-#include <xrpl/basics/Blob.h>
-#include <xrpl/basics/ByteUtilities.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/contract.h>
-#include <xrpl/basics/safe_cast.h>
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/beast/unit_test/thread.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/beast/utility/temp_dir.h>
-#include <xrpl/beast/xor_shift_engine.h>
-#include <xrpl/config/BasicConfig.h>
-#include <xrpl/config/Constants.h>
-#include <xrpl/nodestore/Backend.h>
-#include <xrpl/nodestore/DummyScheduler.h>
-#include <xrpl/nodestore/Manager.h>
-#include <xrpl/nodestore/NodeObject.h>
-#include <xrpl/nodestore/Scheduler.h>
-#include <xrpl/nodestore/Types.h>
-
-#include <boost/algorithm/string/classification.hpp>
-#include <boost/algorithm/string/split.hpp>
-
-#include <algorithm>
-#include <atomic>
-#include <chrono>
-#include <cstddef>
-#include <cstdint>
-#include <exception>
-#include <functional>
-#include <iomanip>
-#include <ios>
-#include <memory>
-#include <ostream>
-#include <random>
-#include <sstream>
-#include <string>
-#include <utility>
-#include <vector>
-
-#ifndef NODESTORE_TIMING_DO_VERIFY
-#define NODESTORE_TIMING_DO_VERIFY 0
-#endif
-
-namespace xrpl::NodeStore {
-
-std::unique_ptr<Backend>
-makeBackend(Section const& config, Scheduler& scheduler, beast::Journal journal)
-{
-    return Manager::instance().makeBackend(config, megabytes(4), scheduler, journal);
-}
-
-// Fill memory with random bits
-template <class Generator>
-static void
-rngcpy(void* buffer, std::size_t bytes, Generator& g)
-{
-    using result_type = Generator::result_type;
-    while (bytes >= sizeof(result_type))
-    {
-        auto const v = g();
-        memcpy(buffer, &v, sizeof(v));
-        buffer = reinterpret_cast<std::uint8_t*>(buffer) + sizeof(v);
-        bytes -= sizeof(v);
-    }
-
-    if (bytes > 0)
-    {
-        auto const v = g();
-        memcpy(buffer, &v, bytes);
-    }
-}
-
-// Instance of node factory produces a deterministic sequence
-// of random NodeObjects within the given
-class Sequence
-{
-private:
-    static constexpr auto kMinLedger = 1;
-    static constexpr auto kMaxLedger = 1000000;
-    static constexpr auto kMinSize = 250;
-    static constexpr auto kMaxSize = 1250;
-
-    beast::xor_shift_engine gen_;
-    std::uint8_t prefix_;
-    std::discrete_distribution<std::uint32_t> dType_;
-    std::uniform_int_distribution<std::uint32_t> dSize_;
-
-public:
-    explicit Sequence(std::uint8_t prefix)
-        : prefix_(prefix)
-        // uniform distribution over hotLEDGER - hotTRANSACTION_NODE
-        // but exclude  hotTRANSACTION = 2 (removed)
-        , dType_({1, 1, 0, 1, 1})
-        , dSize_(kMinSize, kMaxSize)
-    {
-    }
-
-    // Returns the n-th key
-    uint256
-    key(std::size_t n)
-    {
-        gen_.seed(n + 1);
-        uint256 result;
-        rngcpy(&*result.begin(), result.size(), gen_);
-        return result;
-    }
-
-    // Returns the n-th complete NodeObject
-    std::shared_ptr<NodeObject>
-    obj(std::size_t n)
-    {
-        gen_.seed(n + 1);
-        uint256 key;
-        auto const data = static_cast<std::uint8_t*>(&*key.begin());
-        *data = prefix_;
-        rngcpy(data + 1, key.size() - 1, gen_);
-        Blob value(dSize_(gen_));
-        rngcpy(&value[0], value.size(), gen_);
-        return NodeObject::createObject(
-            safeCast<NodeObjectType>(dType_(gen_)), std::move(value), key);
-    }
-
-    // returns a batch of NodeObjects starting at n
-    void
-    batch(std::size_t n, Batch& b, std::size_t size)
-    {
-        b.clear();
-        b.reserve(size);
-        while ((size--) != 0u)
-            b.emplace_back(obj(n++));
-    }
-};
-
-//----------------------------------------------------------------------------------
-
-class Timing_test : public beast::unit_test::Suite
-{
-public:
-    static constexpr auto kMissingNodePercent = 20;  // percent of fetches for missing nodes
-
-    std::size_t const defaultRepeat = 3;
-#ifndef NDEBUG
-    std::size_t const defaultItems = 10000;
-#else
-    std::size_t const defaultItems = 100000;  // release
-#endif
-
-    using clock_type = std::chrono::steady_clock;
-    using duration_type = std::chrono::milliseconds;
-
-    struct Params
-    {
-        std::size_t items;
-        std::size_t threads;
-    };
-
-    static std::string
-    toString(Section const& config)
-    {
-        std::string s;
-        for (auto iter = config.begin(); iter != config.end(); ++iter)
-            s += (iter != config.begin() ? "," : "") + iter->first + "=" + iter->second;
-        return s;
-    }
-
-    static std::string
-    toString(duration_type const& d)
-    {
-        std::stringstream ss;
-        ss << std::fixed << std::setprecision(3) << (d.count() / 1000.) << "s";
-        return ss.str();
-    }
-
-    static Section
-    parse(std::string s)
-    {
-        Section section;
-        std::vector<std::string> v;
-        boost::split(v, s, boost::algorithm::is_any_of(","));
-        section.append(v);
-        return section;
-    }
-
-    //--------------------------------------------------------------------------
-
-    // Workaround for GCC's parameter pack expansion in lambdas
-    // https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47226
-    template <class Body>
-    class ParallelForLambda
-    {
-    private:
-        std::size_t const n_;
-        std::atomic<std::size_t>& c_;
-
-    public:
-        ParallelForLambda(std::size_t n, std::atomic<std::size_t>& c) : n_(n), c_(c)
-        {
-        }
-
-        template <class... Args>
-        void
-        operator()(Args&&... args)
-        {
-            Body body(args...);
-            for (;;)
-            {
-                auto const i = c_++;
-                if (i >= n_)
-                    break;
-                body(i);
-            }
-        }
-    };
-
-    /*  Execute parallel-for loop.
-
-        Constructs `number_of_threads` instances of `Body`
-        with `args...` parameters and runs them on individual threads
-        with unique loop indexes in the range [0, n).
-    */
-    template <class Body, class... Args>
-    void
-    parallelFor(std::size_t const n, std::size_t numberOfThreads, Args const&... args)
-    {
-        std::atomic<std::size_t> c(0);
-        std::vector<beast::unit_test::Thread> t;
-        t.reserve(numberOfThreads);
-        for (std::size_t id = 0; id < numberOfThreads; ++id)
-            t.emplace_back(*this, ParallelForLambda<Body>(n, c), args...);
-        for (auto& _ : t)
-            _.join();
-    }
-
-    template <class Body, class... Args>
-    void
-    parallelForId(std::size_t const n, std::size_t numberOfThreads, Args const&... args)
-    {
-        std::atomic<std::size_t> c(0);
-        std::vector<beast::unit_test::Thread> t;
-        t.reserve(numberOfThreads);
-        for (std::size_t id = 0; id < numberOfThreads; ++id)
-            t.emplace_back(*this, ParallelForLambda<Body>(n, c), id, args...);
-        for (auto& _ : t)
-            _.join();
-    }
-
-    //--------------------------------------------------------------------------
-
-    // Insert only
-    void
-    doInsert(Section const& config, Params const& params, beast::Journal journal)
-    {
-        DummyScheduler scheduler;
-        auto backend = makeBackend(config, scheduler, journal);
-        BEAST_EXPECT(backend != nullptr);
-        backend->open();
-
-        class Body
-        {
-        private:
-            Suite& suite_;
-            Backend& backend_;
-            Sequence seq_;
-
-        public:
-            explicit Body(Suite& s, Backend& backend) : suite_(s), backend_(backend), seq_(1)
-            {
-            }
-
-            void
-            operator()(std::size_t i)
-            {
-                try
-                {
-                    backend_.store(seq_.obj(i));
-                }
-                catch (std::exception const& e)
-                {
-                    suite_.fail(e.what());
-                }
-            }
-        };
-
-        try
-        {
-            parallelFor<Body>(params.items, params.threads, std::ref(*this), std::ref(*backend));
-        }
-        catch (std::exception const&)
-        {
-#if NODESTORE_TIMING_DO_VERIFY
-            backend->verify();
-#endif
-            rethrow();
-        }
-        backend->close();
-    }
-
-    // Fetch existing keys
-    void
-    doFetch(Section const& config, Params const& params, beast::Journal journal)
-    {
-        DummyScheduler scheduler;
-        auto backend = makeBackend(config, scheduler, journal);
-        BEAST_EXPECT(backend != nullptr);
-        backend->open();
-
-        class Body
-        {
-        private:
-            Suite& suite_;
-            Backend& backend_;
-            Sequence seq1_;
-            beast::xor_shift_engine gen_;
-            std::uniform_int_distribution<std::size_t> dist_;
-
-        public:
-            Body(std::size_t id, Suite& s, Params const& params, Backend& backend)
-                : suite_(s), backend_(backend), seq1_(1), gen_(id + 1), dist_(0, params.items - 1)
-            {
-            }
-
-            void
-            operator()(std::size_t i)
-            {
-                try
-                {
-                    std::shared_ptr<NodeObject> obj;
-                    std::shared_ptr<NodeObject> result;
-                    obj = seq1_.obj(dist_(gen_));
-                    backend_.fetch(obj->getHash(), &result);
-                    suite_.expect(result && isSame(result, obj));
-                }
-                catch (std::exception const& e)
-                {
-                    suite_.fail(e.what());
-                }
-            }
-        };
-        try
-        {
-            parallelForId<Body>(
-                params.items,
-                params.threads,
-                std::ref(*this),
-                std::ref(params),
-                std::ref(*backend));
-        }
-        catch (std::exception const&)
-        {
-#if NODESTORE_TIMING_DO_VERIFY
-            backend->verify();
-#endif
-            rethrow();
-        }
-        backend->close();
-    }
-
-    // Perform lookups of non-existent keys
-    void
-    doMissing(Section const& config, Params const& params, beast::Journal journal)
-    {
-        DummyScheduler scheduler;
-        auto backend = makeBackend(config, scheduler, journal);
-        BEAST_EXPECT(backend != nullptr);
-        backend->open();
-
-        class Body
-        {
-        private:
-            Suite& suite_;
-            // Params const& params_;
-            Backend& backend_;
-            Sequence seq2_;
-            beast::xor_shift_engine gen_;
-            std::uniform_int_distribution<std::size_t> dist_;
-
-        public:
-            Body(std::size_t id, Suite& s, Params const& params, Backend& backend)
-                : suite_(s)
-                //, params_ (params)
-                , backend_(backend)
-                , seq2_(2)
-                , gen_(id + 1)
-                , dist_(0, params.items - 1)
-            {
-            }
-
-            void
-            operator()(std::size_t i)
-            {
-                try
-                {
-                    auto const hash = seq2_.key(i);
-                    std::shared_ptr<NodeObject> result;
-                    backend_.fetch(hash, &result);
-                    suite_.expect(!result);
-                }
-                catch (std::exception const& e)
-                {
-                    suite_.fail(e.what());
-                }
-            }
-        };
-
-        try
-        {
-            parallelForId<Body>(
-                params.items,
-                params.threads,
-                std::ref(*this),
-                std::ref(params),
-                std::ref(*backend));
-        }
-        catch (std::exception const&)
-        {
-#if NODESTORE_TIMING_DO_VERIFY
-            backend->verify();
-#endif
-            rethrow();
-        }
-        backend->close();
-    }
-
-    // Fetch with present and missing keys
-    void
-    doMixed(Section const& config, Params const& params, beast::Journal journal)
-    {
-        DummyScheduler scheduler;
-        auto backend = makeBackend(config, scheduler, journal);
-        BEAST_EXPECT(backend != nullptr);
-        backend->open();
-
-        class Body
-        {
-        private:
-            Suite& suite_;
-            // Params const& params_;
-            Backend& backend_;
-            Sequence seq1_;
-            Sequence seq2_;
-            beast::xor_shift_engine gen_;
-            std::uniform_int_distribution<std::uint32_t> rand_;
-            std::uniform_int_distribution<std::size_t> dist_;
-
-        public:
-            Body(std::size_t id, Suite& s, Params const& params, Backend& backend)
-                : suite_(s)
-                //, params_ (params)
-                , backend_(backend)
-                , seq1_(1)
-                , seq2_(2)
-                , gen_(id + 1)
-                , rand_(0, 99)
-                , dist_(0, params.items - 1)
-            {
-            }
-
-            void
-            operator()(std::size_t i)
-            {
-                try
-                {
-                    if (rand_(gen_) < kMissingNodePercent)
-                    {
-                        auto const hash = seq2_.key(dist_(gen_));
-                        std::shared_ptr<NodeObject> result;
-                        backend_.fetch(hash, &result);
-                        suite_.expect(!result);
-                    }
-                    else
-                    {
-                        std::shared_ptr<NodeObject> obj;
-                        std::shared_ptr<NodeObject> result;
-                        obj = seq1_.obj(dist_(gen_));
-                        backend_.fetch(obj->getHash(), &result);
-                        suite_.expect(result && isSame(result, obj));
-                    }
-                }
-                catch (std::exception const& e)
-                {
-                    suite_.fail(e.what());
-                }
-            }
-        };
-
-        try
-        {
-            parallelForId<Body>(
-                params.items,
-                params.threads,
-                std::ref(*this),
-                std::ref(params),
-                std::ref(*backend));
-        }
-        catch (std::exception const&)
-        {
-#if NODESTORE_TIMING_DO_VERIFY
-            backend->verify();
-#endif
-            rethrow();
-        }
-        backend->close();
-    }
-
-    // Simulate an xrpld workload:
-    // Each thread randomly:
-    //      inserts a new key
-    //      fetches an old key
-    //      fetches recent, possibly non existent data
-    void
-    doWork(Section const& config, Params const& params, beast::Journal journal)
-    {
-        DummyScheduler scheduler;
-        auto backend = makeBackend(config, scheduler, journal);
-        BEAST_EXPECT(backend != nullptr);
-        backend->setDeletePath();
-        backend->open();
-
-        class Body
-        {
-        private:
-            Suite& suite_;
-            Params const& params_;
-            Backend& backend_;
-            Sequence seq1_;
-            beast::xor_shift_engine gen_;
-            std::uniform_int_distribution<std::uint32_t> rand_;
-            std::uniform_int_distribution<std::size_t> recent_;
-            std::uniform_int_distribution<std::size_t> older_;
-
-        public:
-            Body(std::size_t id, Suite& s, Params const& params, Backend& backend)
-                : suite_(s)
-                , params_(params)
-                , backend_(backend)
-                , seq1_(1)
-                , gen_(id + 1)
-                , rand_(0, 99)
-                , recent_(params.items, (params.items * 2) - 1)
-                , older_(0, params.items - 1)
-            {
-            }
-
-            void
-            operator()(std::size_t i)
-            {
-                try
-                {
-                    if (rand_(gen_) < 200)
-                    {
-                        // historical lookup
-                        std::shared_ptr<NodeObject> obj;
-                        std::shared_ptr<NodeObject> result;
-                        auto const j = older_(gen_);
-                        obj = seq1_.obj(j);
-                        backend_.fetch(obj->getHash(), &result);
-                        suite_.expect(result != nullptr);
-                        suite_.expect(isSame(result, obj));
-                    }
-
-                    char p[2];
-                    p[0] = rand_(gen_) < 50 ? 0 : 1;
-                    p[1] = 1 - p[0];
-                    for (char const op : p)
-                    {
-                        // NOLINTNEXTLINE(bugprone-switch-missing-default-case)
-                        switch (op)
-                        {
-                            case 0: {
-                                // fetch recent
-                                std::shared_ptr<NodeObject> obj;
-                                std::shared_ptr<NodeObject> result;
-                                auto const j = recent_(gen_);
-                                obj = seq1_.obj(j);
-                                backend_.fetch(obj->getHash(), &result);
-                                suite_.expect(!result || isSame(result, obj));
-                                break;
-                            }
-
-                            case 1: {
-                                // insert new
-                                auto const j = i + params_.items;
-                                backend_.store(seq1_.obj(j));
-                                break;
-                            }
-                        }
-                    }
-                }
-                catch (std::exception const& e)
-                {
-                    suite_.fail(e.what());
-                }
-            }
-        };
-
-        try
-        {
-            parallelForId<Body>(
-                params.items,
-                params.threads,
-                std::ref(*this),
-                std::ref(params),
-                std::ref(*backend));
-        }
-        catch (std::exception const&)
-        {
-#if NODESTORE_TIMING_DO_VERIFY
-            backend->verify();
-#endif
-            rethrow();
-        }
-        backend->close();
-    }
-
-    //--------------------------------------------------------------------------
-
-    using test_func = void (Timing_test::*)(Section const&, Params const&, beast::Journal);
-    using test_list = std::vector<std::pair<std::string, test_func>>;
-
-    duration_type
-    doTest(test_func f, Section const& config, Params const& params, beast::Journal journal)
-    {
-        auto const start = clock_type::now();
-        (this->*f)(config, params, journal);
-        return std::chrono::duration_cast<duration_type>(clock_type::now() - start);
-    }
-
-    void
-    doTests(
-        std::size_t threads,
-        test_list const& tests,
-        std::vector<std::string> const& configStrings)
-    {
-        using std::setw;
-        int w = 8;
-        for (auto const& test : tests)
-        {
-            w = std::max<std::basic_string<char>::size_type>(w, test.first.size());
-        }
-        log << threads << " Thread" << (threads > 1 ? "s" : "") << ", " << defaultItems
-            << " Objects" << std::endl;
-        {
-            std::stringstream ss;
-            ss << std::left << setw(10) << "Backend" << std::right;
-            for (auto const& test : tests)
-                ss << " " << setw(w) << test.first;
-            log << ss.str() << std::endl;
-        }
-
-        using beast::Severity;
-        test::SuiteJournal journal("Timing_test", *this);
-
-        for (auto const& configString : configStrings)
-        {
-            Params params{};
-            params.items = defaultItems;
-            params.threads = threads;
-            for (auto i = defaultRepeat; (i--) != 0u;)
-            {
-                beast::TempDir const tempDir;
-                Section config = parse(configString);
-                config.set(Keys::kPath, tempDir.path());
-                std::stringstream ss;
-                ss << std::left << setw(10) << get(config, Keys::kType, std::string())
-                   << std::right;
-                for (auto const& test : tests)
-                {
-                    ss << " " << setw(w) << toString(doTest(test.second, config, params, journal));
-                }
-                ss << "   " << toString(config);
-                log << ss.str() << std::endl;
-            }
-        }
-    }
-
-    void
-    run() override
-    {
-        testcase("Timing", beast::unit_test::AbortT::AbortOnFail);
-
-        /*  Parameters:
-
-            repeat          Number of times to repeat each test
-            items           Number of objects to create in the database
-
-        */
-        std::string const defaultArgs =
-            "type=nudb"
-#if XRPL_ROCKSDB_AVAILABLE
-            ";type=rocksdb,open_files=2000,filter_bits=12,cache_mb=256,"
-            "file_size_mb=8,file_size_mult=2"
-#endif
-            ;
-
-        test_list const tests = {
-            {"Insert", &Timing_test::doInsert},
-            {"Fetch", &Timing_test::doFetch},
-            {"Missing", &Timing_test::doMissing},
-            {"Mixed", &Timing_test::doMixed},
-            {"Work", &Timing_test::doWork}};
-
-        auto args = arg().empty() ? defaultArgs : arg();
-        std::vector<std::string> configStrings;
-        boost::split(configStrings, args, boost::algorithm::is_any_of(";"));
-        for (auto iter = configStrings.begin(); iter != configStrings.end();)
-        {
-            if (iter->empty())
-            {
-                iter = configStrings.erase(iter);
-            }
-            else
-            {
-                ++iter;
-            }
-        }
-
-        doTests(1, tests, configStrings);
-        doTests(4, tests, configStrings);
-        doTests(8, tests, configStrings);
-        // do_tests (16, tests, config_strings);
-    }
-};
-
-BEAST_DEFINE_TESTSUITE_MANUAL_PRIO(Timing, nodestore, xrpl, 1);
-
-}  // namespace xrpl::NodeStore

From 5ce0b1c2c7cc40c76cf863f3845d5ab59a4bae0d Mon Sep 17 00:00:00 2001
From: Vito Tumas <5780819+Tapanito@users.noreply.github.com>
Date: Thu, 16 Jul 2026 17:47:56 +0200
Subject: [PATCH 088/100] refactor: Restructure LendingHelpers to improve
 readability (#7807)

---
 include/xrpl/ledger/helpers/LendingHelpers.h  |   7 +-
 src/libxrpl/ledger/helpers/LendingHelpers.cpp | 782 +++++++++---------
 src/test/app/Loan_test.cpp                    |   6 +-
 3 files changed, 392 insertions(+), 403 deletions(-)

diff --git a/include/xrpl/ledger/helpers/LendingHelpers.h b/include/xrpl/ledger/helpers/LendingHelpers.h
index e2605e9ab7..8e0d11cccb 100644
--- a/include/xrpl/ledger/helpers/LendingHelpers.h
+++ b/include/xrpl/ledger/helpers/LendingHelpers.h
@@ -263,10 +263,11 @@ constructLoanState(
     Number const& principalOutstanding,
     Number const& managementFeeOutstanding);
 
-// Constructs a valid LoanState object from a Loan object, which always has
-// rounded values
+// Overload of constructLoanState() that reads the three tracked fields
+// directly from a Loan ledger object, which always holds rounded values,
+// rather than taking them as separate Number arguments.
 LoanState
-constructRoundedLoanState(SLE::const_ref loan);
+constructLoanState(SLE::const_ref loan);
 
 Number
 computeManagementFee(
diff --git a/src/libxrpl/ledger/helpers/LendingHelpers.cpp b/src/libxrpl/ledger/helpers/LendingHelpers.cpp
index f7ec8a8bc3..e6c3d632c1 100644
--- a/src/libxrpl/ledger/helpers/LendingHelpers.cpp
+++ b/src/libxrpl/ledger/helpers/LendingHelpers.cpp
@@ -312,6 +312,25 @@ computeInterestAndFeeParts(
     return std::make_pair(interest - fee, fee);
 }
 
+/* Rounds a raw (unrounded) interest amount to the loan's scale, then splits
+ * the rounded amount into net interest (to the vault) and management fee (to
+ * the broker).
+ *
+ * This is the common "round then split" step shared by late payment, full
+ * payment, and overpayment interest calculations.
+ */
+std::pair<Number, Number>
+roundAndSplitInterest(
+    Asset const& asset,
+    Number const& rawInterest,
+    TenthBips16 managementFeeRate,
+    std::int32_t loanScale,
+    Number::RoundingMode mode = Number::getround())
+{
+    auto const interest = roundToAsset(asset, rawInterest, loanScale, mode);
+    return computeInterestAndFeeParts(asset, interest, managementFeeRate, loanScale);
+}
+
 /* Calculates penalty interest accrued on overdue payments.
  * Returns 0 if payment is not late.
  *
@@ -387,22 +406,18 @@ loanAccruedInterest(
  *
  * This is the core function that updates the Loan ledger object fields based on
  * a computed payment.
-
- * The function is templated to work with both direct Number/uint32_t values
- * (for testing/simulation) and ValueProxy types (for actual ledger updates).
  */
-template <class NumberProxy, class UInt32Proxy, class UInt32OptionalProxy>
 LoanPaymentParts
-doPayment(
-    ExtendedPaymentComponents const& payment,
-    NumberProxy& totalValueOutstandingProxy,
-    NumberProxy& principalOutstandingProxy,
-    NumberProxy& managementFeeOutstandingProxy,
-    UInt32Proxy& paymentRemainingProxy,
-    UInt32Proxy& prevPaymentDateProxy,
-    UInt32OptionalProxy& nextDueDateProxy,
-    std::uint32_t paymentInterval)
+doPayment(ExtendedPaymentComponents const& payment, SLE::ref loan)
 {
+    auto totalValueOutstandingProxy = loan->at(sfTotalValueOutstanding);
+    auto principalOutstandingProxy = loan->at(sfPrincipalOutstanding);
+    auto managementFeeOutstandingProxy = loan->at(sfManagementFeeOutstanding);
+    auto paymentRemainingProxy = loan->at(sfPaymentRemaining);
+    auto prevPaymentDateProxy = loan->at(sfPreviousPaymentDueDate);
+    auto nextDueDateProxy = loan->at(sfNextPaymentDueDate);
+    std::uint32_t const paymentInterval = loan->at(sfPaymentInterval);
+
     XRPL_ASSERT_PARTS(nextDueDateProxy, "xrpl::detail::doPayment", "Next due date proxy set");
 
     if (payment.specialCase == PaymentSpecialCase::Final)
@@ -470,16 +485,12 @@ doPayment(
 
     // Principal can never exceed total value (principal is part of total value)
     XRPL_ASSERT_PARTS(
-        // Use an explicit cast because the template parameter can be
-        // ValueProxy<Number> or Number
         static_cast<Number>(principalOutstandingProxy) <=
             static_cast<Number>(totalValueOutstandingProxy),
         "xrpl::detail::doPayment",
         "principal does not exceed total");
 
     XRPL_ASSERT_PARTS(
-        // Use an explicit cast because the template parameter can be
-        // ValueProxy<Number> or Number
         static_cast<Number>(managementFeeOutstandingProxy) >= beast::kZero,
         "xrpl::detail::doPayment",
         "fee outstanding stays valid");
@@ -717,22 +728,23 @@ tryOverpayment(
  * overpayment would leave the loan in an invalid state, we can reject it
  * gracefully without corrupting the ledger data.
  */
-template <class NumberProxy>
 std::expected<LoanPaymentParts, TER>
 doOverpayment(
     Rules const& rules,
     Asset const& asset,
     std::int32_t loanScale,
     ExtendedPaymentComponents const& overpaymentComponents,
-    NumberProxy& totalValueOutstandingProxy,
-    NumberProxy& principalOutstandingProxy,
-    NumberProxy& managementFeeOutstandingProxy,
-    NumberProxy& periodicPaymentProxy,
+    SLE::ref loan,
     Number const& periodicRate,
-    std::uint32_t const paymentRemaining,
     TenthBips16 const managementFeeRate,
     beast::Journal j)
 {
+    auto totalValueOutstandingProxy = loan->at(sfTotalValueOutstanding);
+    auto principalOutstandingProxy = loan->at(sfPrincipalOutstanding);
+    auto managementFeeOutstandingProxy = loan->at(sfManagementFeeOutstanding);
+    auto periodicPaymentProxy = loan->at(sfPeriodicPayment);
+    auto const paymentsRemaining = loan->at(sfPaymentRemaining);
+
     auto const loanState = constructLoanState(
         totalValueOutstandingProxy, principalOutstandingProxy, managementFeeOutstandingProxy);
     auto const periodicPayment = periodicPaymentProxy;
@@ -744,7 +756,7 @@ doOverpayment(
                     << ", interestPart: " << overpaymentComponents.trackedInterestPart()
                     << ", untrackedInterest: " << overpaymentComponents.untrackedInterest
                     << ", totalDue: " << overpaymentComponents.totalDue
-                    << ", payments remaining :" << paymentRemaining;
+                    << ", payments remaining :" << paymentsRemaining;
 
     // Attempt to re-amortize the loan with the overpayment applied.
     // This modifies the temporary copies, leaving the proxies unchanged.
@@ -756,7 +768,7 @@ doOverpayment(
         loanState,
         periodicPayment,
         periodicRate,
-        paymentRemaining,
+        paymentsRemaining,
         managementFeeRate,
         j);
     if (!ret)
@@ -864,16 +876,15 @@ std::expected<ExtendedPaymentComponents, TER>
 computeLatePayment(
     Asset const& asset,
     ApplyView const& view,
-    Number const& principalOutstanding,
-    std::int32_t nextDueDate,
+    SLE::const_ref loan,
     ExtendedPaymentComponents const& periodic,
-    TenthBips32 lateInterestRate,
-    std::int32_t loanScale,
-    Number const& latePaymentFee,
     STAmount const& amount,
     TenthBips16 managementFeeRate,
     beast::Journal j)
 {
+    std::int32_t const nextDueDate = loan->at(sfNextPaymentDueDate);
+    std::int32_t const loanScale = loan->at(sfLoanScale);
+
     // Check if the due date has passed. If not, reject the payment as
     // being too soon
     if (!hasExpired(view, nextDueDate))
@@ -881,15 +892,15 @@ computeLatePayment(
 
     // Calculate the penalty interest based on how long the payment is overdue.
     auto const latePaymentInterest = loanLatePaymentInterest(
-        principalOutstanding, lateInterestRate, view.parentCloseTime(), nextDueDate);
+        loan->at(sfPrincipalOutstanding),
+        TenthBips32{loan->at(sfLateInterestRate)},
+        view.parentCloseTime(),
+        nextDueDate);
 
     // Round the late interest and split it between the vault (net interest)
-    // and the broker (management fee portion). This lambda ensures we
-    // round before splitting to maintain precision.
-    auto const [roundedLateInterest, roundedLateManagementFee] = [&]() {
-        auto const interest = roundToAsset(asset, latePaymentInterest, loanScale);
-        return computeInterestAndFeeParts(asset, interest, managementFeeRate, loanScale);
-    }();
+    // and the broker (management fee portion).
+    auto const [roundedLateInterest, roundedLateManagementFee] =
+        roundAndSplitInterest(asset, latePaymentInterest, managementFeeRate, loanScale);
 
     XRPL_ASSERT(roundedLateInterest >= 0, "xrpl::detail::computeLatePayment : valid late interest");
     XRPL_ASSERT_PARTS(
@@ -908,7 +919,7 @@ computeLatePayment(
         // 1. Regular service fee (from periodic.untrackedManagementFee)
         // 2. Late payment fee (fixed penalty)
         // 3. Management fee portion of late interest
-        periodic.untrackedManagementFee + latePaymentFee + roundedLateManagementFee,
+        periodic.untrackedManagementFee + loan->at(sfLatePaymentFee) + roundedLateManagementFee,
 
         // Untracked interest includes:
         // 1. Any untracked interest from the regular payment (usually 0)
@@ -958,22 +969,15 @@ std::expected<ExtendedPaymentComponents, TER>
 computeFullPayment(
     Asset const& asset,
     ApplyView& view,
-    Number const& principalOutstanding,
-    Number const& managementFeeOutstanding,
-    Number const& periodicPayment,
-    std::uint32_t paymentRemaining,
-    std::uint32_t prevPaymentDate,
-    std::uint32_t const startDate,
-    std::uint32_t const paymentInterval,
-    TenthBips32 const closeInterestRate,
-    std::int32_t loanScale,
-    Number const& totalInterestOutstanding,
+    SLE::const_ref loan,
     Number const& periodicRate,
-    Number const& closePaymentFee,
     STAmount const& amount,
     TenthBips16 managementFeeRate,
     beast::Journal j)
 {
+    std::uint32_t const paymentRemaining = loan->at(sfPaymentRemaining);
+    std::int32_t const loanScale = loan->at(sfLoanScale);
+
     // Full payment must be made before the final scheduled payment.
     if (paymentRemaining <= 1)
     {
@@ -986,7 +990,7 @@ computeFullPayment(
     // This theoretical (unrounded) value is used to compute interest and
     // penalties accurately.
     Number const theoreticalPrincipalOutstanding = loanPrincipalFromPeriodicPayment(
-        view.rules(), periodicPayment, periodicRate, paymentRemaining);
+        view.rules(), loan->at(sfPeriodicPayment), periodicRate, paymentRemaining);
 
     // Full payment interest includes both accrued interest (time since last
     // payment) and prepayment penalty (for closing early).
@@ -994,18 +998,21 @@ computeFullPayment(
         theoreticalPrincipalOutstanding,
         periodicRate,
         view.parentCloseTime(),
-        paymentInterval,
-        prevPaymentDate,
-        startDate,
-        closeInterestRate);
+        loan->at(sfPaymentInterval),
+        loan->at(sfPreviousPaymentDueDate),
+        loan->at(sfStartDate),
+        TenthBips32{loan->at(sfCloseInterestRate)});
 
-    // Split the full payment interest into net interest (to vault) and
-    // management fee (to broker), applying proper rounding.
-    auto const [roundedFullInterest, roundedFullManagementFee] = [&]() {
-        auto const interest =
-            roundToAsset(asset, fullPaymentInterest, loanScale, Number::RoundingMode::Downward);
-        return computeInterestAndFeeParts(asset, interest, managementFeeRate, loanScale);
-    }();
+    // Split the full payment interest into net interest (to vault) and management fee (to broker),
+    // applying proper rounding.
+    auto const [roundedFullInterest, roundedFullManagementFee] = roundAndSplitInterest(
+        asset, fullPaymentInterest, managementFeeRate, loanScale, Number::RoundingMode::Downward);
+
+    LoanState const loanState = constructLoanState(loan);
+    Number const principalOutstanding = loanState.principalOutstanding;
+    Number const managementFeeOutstanding = loanState.managementFeeDue;
+    Number const totalInterestOutstanding = loanState.interestDue;
+    Number const closePaymentFee = roundToAsset(asset, loan->at(sfClosePaymentFee), loanScale);
 
     ExtendedPaymentComponents const full{
         PaymentComponents{
@@ -1046,8 +1053,7 @@ computeFullPayment(
         "xrpl::detail::computeFullPayment",
         "total due is rounded");
 
-    JLOG(j.trace()) << "computeFullPayment result: periodicPayment: " << periodicPayment
-                    << ", periodicRate: " << periodicRate
+    JLOG(j.trace()) << "computeFullPayment result: periodicRate: " << periodicRate
                     << ", paymentRemaining: " << paymentRemaining
                     << ", theoreticalPrincipalOutstanding: " << theoreticalPrincipalOutstanding
                     << ", fullPaymentInterest: " << fullPaymentInterest
@@ -1298,6 +1304,34 @@ computePaymentComponents(
     };
 }
 
+/* Thin overload of computePaymentComponents() that unwraps the tracked
+ * fields directly from the Loan ledger object. `periodicRate` is derived
+ * rather than stored, and `managementFeeRate` comes from the LoanBroker, not
+ * the Loan, so both remain explicit parameters. Kept separate from the
+ * value-based overload above, which is exercised directly by unit tests
+ * against simulated (non-ledger) loan states.
+ */
+PaymentComponents
+computePaymentComponents(
+    Rules const& rules,
+    Asset const& asset,
+    SLE::ref loan,
+    Number const& periodicRate,
+    TenthBips16 managementFeeRate)
+{
+    return computePaymentComponents(
+        rules,
+        asset,
+        loan->at(sfLoanScale),
+        loan->at(sfTotalValueOutstanding),
+        loan->at(sfPrincipalOutstanding),
+        loan->at(sfManagementFeeOutstanding),
+        loan->at(sfPeriodicPayment),
+        periodicRate,
+        loan->at(sfPaymentRemaining),
+        managementFeeRate);
+}
+
 /* Computes payment components for an overpayment scenario.
  *
  * An overpayment occurs when a borrower pays more than the scheduled periodic
@@ -1342,11 +1376,12 @@ computeOverpaymentComponents(
     // This interest doesn't follow the normal amortization schedule - it's
     // a one-time charge for paying early.
     // Equation (20) and (21) from XLS-66 spec, Section A-2 Equation Glossary
-    auto const [roundedOverpaymentInterest, roundedOverpaymentManagementFee] = [&]() {
-        auto const interest =
-            roundToAsset(asset, tenthBipsOfValue(overpayment, overpaymentInterestRate), loanScale);
-        return detail::computeInterestAndFeeParts(asset, interest, managementFeeRate, loanScale);
-    }();
+    auto const [roundedOverpaymentInterest, roundedOverpaymentManagementFee] =
+        roundAndSplitInterest(
+            asset,
+            tenthBipsOfValue(overpayment, overpaymentInterestRate),
+            managementFeeRate,
+            loanScale);
 
     auto const result = detail::ExtendedPaymentComponents{
         // Build the payment components, after fees and penalty
@@ -1373,6 +1408,265 @@ computeOverpaymentComponents(
     return result;
 }
 
+/* Derives the two rate values every make*Payment() helper needs: the
+ * broker's management fee rate, and the loan's periodic (per-payment-period)
+ * interest rate.
+ */
+std::pair<TenthBips16, Number>
+loanRatesFor(SLE::const_ref loan, SLE::const_ref brokerSle)
+{
+    TenthBips16 const managementFeeRate{brokerSle->at(sfManagementFeeRate)};
+    TenthBips32 const interestRate{loan->at(sfInterestRate)};
+    Number const periodicRate = loanPeriodicRate(interestRate, loan->at(sfPaymentInterval));
+    XRPL_ASSERT(interestRate == 0 || periodicRate > 0, "xrpl::detail::loanRatesFor : valid rate");
+    return {managementFeeRate, periodicRate};
+}
+
+/* Handles a full (early payoff) payment. Implements the "full payment"
+ * branch of the make_payment function from the XLS-66 spec, Section
+ * 3.2.4.4.
+ */
+std::expected<LoanPaymentParts, TER>
+makeFullPayment(
+    Asset const& asset,
+    ApplyView& view,
+    SLE::ref loan,
+    SLE::const_ref brokerSle,
+    STAmount const& amount,
+    beast::Journal j)
+{
+    auto const [managementFeeRate, periodicRate] = loanRatesFor(loan, brokerSle);
+
+    auto const fullPaymentComponents =
+        computeFullPayment(asset, view, loan, periodicRate, amount, managementFeeRate, j);
+
+    // computeFullPayment only ever fails with a genuine error TER (never
+    // tesSUCCESS), so there is no separate "no-op" outcome to handle here.
+    if (fullPaymentComponents.has_value())
+        return doPayment(*fullPaymentComponents, loan);
+    return std::unexpected(fullPaymentComponents.error());
+}
+
+/* Handles a late payment (past due date, with the late-payment flag set).
+ * Implements the "late payment" branch of the make_payment function from
+ * the XLS-66 spec, Section 3.2.4.4.
+ */
+std::expected<LoanPaymentParts, TER>
+makeLatePayment(
+    Asset const& asset,
+    ApplyView const& view,
+    SLE::ref loan,
+    SLE::const_ref brokerSle,
+    STAmount const& amount,
+    beast::Journal j)
+{
+    auto const [managementFeeRate, periodicRate] = loanRatesFor(loan, brokerSle);
+
+    Number const serviceFee = loan->at(sfLoanServiceFee);
+    ExtendedPaymentComponents const periodic{
+        computePaymentComponents(view.rules(), asset, loan, periodicRate, managementFeeRate),
+        serviceFee};
+    XRPL_ASSERT_PARTS(
+        periodic.trackedPrincipalDelta >= 0,
+        "xrpl::detail::makeLatePayment",
+        "regular payment valid principal");
+
+    auto const latePaymentComponents =
+        computeLatePayment(asset, view, loan, periodic, amount, managementFeeRate, j);
+
+    // computeLatePayment only ever fails with a genuine error TER (never
+    // tesSUCCESS), so there is no separate "no-op" outcome to handle here.
+    if (latePaymentComponents.has_value())
+        return doPayment(*latePaymentComponents, loan);
+    return std::unexpected(latePaymentComponents.error());
+}
+
+/* Handles regular scheduled payments, including an optional overpayment tail.
+ * Implements the "regular" and "overpayment" branches of the make_payment
+ * function from the XLS-66 spec, Section 3.2.4.4.
+ */
+std::expected<LoanPaymentParts, TER>
+makeRegularPayment(
+    Asset const& asset,
+    ApplyView const& view,
+    SLE::ref loan,
+    SLE::const_ref brokerSle,
+    STAmount const& amount,
+    LoanPaymentType const paymentType,
+    beast::Journal j)
+{
+    using namespace Lending;
+
+    XRPL_ASSERT_PARTS(
+        paymentType == LoanPaymentType::Regular || paymentType == LoanPaymentType::Overpayment,
+        "xrpl::detail::makeRegularPayment",
+        "regular payment type");
+
+    auto const [managementFeeRate, periodicRate] = loanRatesFor(loan, brokerSle);
+
+    std::int32_t const loanScale = loan->at(sfLoanScale);
+    Number const serviceFee = loan->at(sfLoanServiceFee);
+
+    ExtendedPaymentComponents periodic{
+        computePaymentComponents(view.rules(), asset, loan, periodicRate, managementFeeRate),
+        serviceFee};
+    XRPL_ASSERT_PARTS(
+        periodic.trackedPrincipalDelta >= 0,
+        "xrpl::detail::makeRegularPayment",
+        "regular payment valid principal");
+
+    // Keep a running total of the actual parts paid
+    LoanPaymentParts totalParts;
+    Number totalPaid = kNumZero;
+    std::size_t numPayments = 0;
+
+    // Cached here (rather than re-looking up loan->at(sfPaymentRemaining) at each use) since it's
+    // read multiple times below. It's a write-through proxy, so it still reflects doPayment's
+    // mutations each iteration.
+    auto paymentRemainingProxy = loan->at(sfPaymentRemaining);
+
+    while ((amount >= (totalPaid + periodic.totalDue)) && paymentRemainingProxy > 0 &&
+           numPayments < kLoanMaximumPaymentsPerTransaction)
+    {
+        // Try to make more payments
+        XRPL_ASSERT_PARTS(
+            periodic.trackedPrincipalDelta >= 0,
+            "xrpl::detail::makeRegularPayment",
+            "payment pays non-negative principal");
+
+        totalPaid += periodic.totalDue;
+        totalParts += doPayment(periodic, loan);
+        ++numPayments;
+
+        XRPL_ASSERT_PARTS(
+            (periodic.specialCase == PaymentSpecialCase::Final) == (paymentRemainingProxy == 0),
+            "xrpl::detail::makeRegularPayment",
+            "final payment is the final payment");
+
+        // Don't compute the next payment if this was the last payment
+        if (periodic.specialCase == PaymentSpecialCase::Final)
+            break;
+
+        periodic = ExtendedPaymentComponents{
+            computePaymentComponents(view.rules(), asset, loan, periodicRate, managementFeeRate),
+            serviceFee};
+    }
+
+    if (numPayments == 0)
+    {
+        JLOG(j.warn()) << "Regular loan payment amount is insufficient. Due: " << periodic.totalDue
+                       << ", paid: " << amount;
+        return std::unexpected(tecINSUFFICIENT_PAYMENT);
+    }
+
+    XRPL_ASSERT_PARTS(
+        totalParts.principalPaid + totalParts.interestPaid + totalParts.feePaid == totalPaid,
+        "xrpl::detail::makeRegularPayment",
+        "payment parts add up");
+    XRPL_ASSERT_PARTS(
+        totalParts.valueChange == 0, "xrpl::detail::makeRegularPayment", "no value change");
+
+    // -------------------------------------------------------------
+    // overpayment handling
+    //
+    // If the "fixCleanup3_1_3" amendment is enabled, truncate "amount",
+    // at the loan scale. If the raw value is used, the overpayment
+    // amount could be meaningless dust. Trying to process such a small
+    // amount will, at best, waste time when all the result values round
+    // to zero. At worst, it can cause logical errors with tiny amounts
+    // of interest that don't add up correctly.
+    auto const roundedAmount = view.rules().enabled(fixCleanup3_1_3)
+        ? roundToAsset(asset, amount, loanScale, Number::RoundingMode::TowardsZero)
+        : amount;
+
+    bool const overpaymentSupported =
+        paymentType == LoanPaymentType::Overpayment && loan->isFlag(lsfLoanOverpayment);
+
+    bool const overpaymentAllowed =   //
+        paymentRemainingProxy > 0 &&  //
+        totalPaid < roundedAmount &&  //
+        numPayments < kLoanMaximumPaymentsPerTransaction;
+
+    if (overpaymentSupported && overpaymentAllowed)
+    {
+        TenthBips32 const overpaymentInterestRate{loan->at(sfOverpaymentInterestRate)};
+        TenthBips32 const overpaymentFeeRate{loan->at(sfOverpaymentFee)};
+
+        // It shouldn't be possible for the overpayment to be greater than
+        // totalValueOutstanding, because that would have been processed as
+        // another normal payment. But cap it just in case.
+        Number const overpaymentRaw =
+            std::min(roundedAmount - totalPaid, *loan->at(sfTotalValueOutstanding));
+
+        bool const fixEnabled = view.rules().enabled(fixCleanup3_2_0);
+        Number const overpayment = fixEnabled
+            ? roundToAsset(asset, overpaymentRaw, loanScale, Number::RoundingMode::Downward)
+            : overpaymentRaw;
+
+        // Post-amendment, the rounded overpayment can be zero; pre-amendment
+        // it's always positive given the surrounding guards.
+        if (!fixEnabled || overpayment > 0)
+        {
+            ExtendedPaymentComponents const overpaymentComponents = computeOverpaymentComponents(
+                view.rules(),
+                asset,
+                loanScale,
+                overpayment,
+                overpaymentInterestRate,
+                overpaymentFeeRate,
+                managementFeeRate);
+
+            // Don't process an overpayment if the whole amount (or more!)
+            // gets eaten by fees and interest.
+            if (overpaymentComponents.trackedPrincipalDelta > 0)
+            {
+                XRPL_ASSERT_PARTS(
+                    overpaymentComponents.untrackedInterest >= beast::kZero,
+                    "xrpl::detail::makeRegularPayment",
+                    "overpayment penalty did not reduce value of loan");
+                if (auto const overResult = doOverpayment(
+                        view.rules(),
+                        asset,
+                        loanScale,
+                        overpaymentComponents,
+                        loan,
+                        periodicRate,
+                        managementFeeRate,
+                        j))
+                {
+                    totalParts += *overResult;
+                }
+                else if (overResult.error())
+                {
+                    // error() will be the TER returned if a payment is not
+                    // made. It will only evaluate to true if it's unsuccessful.
+                    // Otherwise, tesSUCCESS means nothing was done, so
+                    // continue.
+                    return std::unexpected(overResult.error());
+                }
+            }
+        }
+    }
+
+    // Check the final results are rounded, to double-check that the
+    // intermediate steps were rounded.
+    XRPL_ASSERT(
+        isRounded(asset, totalParts.principalPaid, loanScale) &&
+            totalParts.principalPaid >= beast::kZero,
+        "xrpl::detail::makeRegularPayment : total principal paid is valid");
+    XRPL_ASSERT(
+        isRounded(asset, totalParts.interestPaid, loanScale) &&
+            totalParts.interestPaid >= beast::kZero,
+        "xrpl::detail::makeRegularPayment : total interest paid is valid");
+    XRPL_ASSERT(
+        isRounded(asset, totalParts.valueChange, loanScale),
+        "xrpl::detail::makeRegularPayment : loan value change is valid");
+    XRPL_ASSERT(
+        isRounded(asset, totalParts.feePaid, loanScale) && totalParts.feePaid >= beast::kZero,
+        "xrpl::detail::makeRegularPayment : fee paid is valid");
+    return totalParts;
+}
+
 }  // namespace detail
 
 detail::LoanStateDeltas
@@ -1632,8 +1926,10 @@ constructLoanState(
 }
 
 LoanState
-constructRoundedLoanState(SLE::const_ref loan)
+constructLoanState(SLE::const_ref loan)
 {
+    XRPL_ASSERT(loan && loan->getType() == ltLOAN, "xrpl::constructLoanState : valid loan SLE");
+
     return constructLoanState(
         loan->at(sfTotalValueOutstanding),
         loan->at(sfPrincipalOutstanding),
@@ -1790,12 +2086,7 @@ loanMakePayment(
     LoanPaymentType const paymentType,
     beast::Journal j)
 {
-    using namespace Lending;
-
-    auto principalOutstandingProxy = loan->at(sfPrincipalOutstanding);
-    auto paymentRemainingProxy = loan->at(sfPaymentRemaining);
-
-    if (paymentRemainingProxy == 0 || principalOutstandingProxy == 0)
+    if (loan->at(sfPaymentRemaining) == 0 || loan->at(sfPrincipalOutstanding) == 0)
     {
         // Loan complete this is already checked in LoanPay::preclaim()
         // LCOV_EXCL_START
@@ -1804,9 +2095,6 @@ loanMakePayment(
         // LCOV_EXCL_STOP
     }
 
-    auto totalValueOutstandingProxy = loan->at(sfTotalValueOutstanding);
-    auto managementFeeOutstandingProxy = loan->at(sfManagementFeeOutstanding);
-
     // Next payment due date must be set unless the loan is complete
     auto nextDueDateProxy = loan->at(sfNextPaymentDueDate);
     if (*nextDueDateProxy == 0)
@@ -1815,26 +2103,8 @@ loanMakePayment(
         return std::unexpected(tecINTERNAL);
     }
 
-    std::int32_t const loanScale = loan->at(sfLoanScale);
-
-    TenthBips32 const interestRate{loan->at(sfInterestRate)};
-
-    Number const serviceFee = loan->at(sfLoanServiceFee);
-    TenthBips16 const managementFeeRate{brokerSle->at(sfManagementFeeRate)};
-
-    Number const periodicPayment = loan->at(sfPeriodicPayment);
-
-    auto prevPaymentDateProxy = loan->at(sfPreviousPaymentDueDate);
-    std::uint32_t const startDate = loan->at(sfStartDate);
-
-    std::uint32_t const paymentInterval = loan->at(sfPaymentInterval);
-
-    // Compute the periodic rate that will be used for calculations
-    // throughout
-    Number const periodicRate = loanPeriodicRate(interestRate, paymentInterval);
-    XRPL_ASSERT(interestRate == 0 || periodicRate > 0, "xrpl::loanMakePayment : valid rate");
-
-    XRPL_ASSERT(*totalValueOutstandingProxy > 0, "xrpl::loanMakePayment : valid total value");
+    XRPL_ASSERT(
+        *loan->at(sfTotalValueOutstanding) > 0, "xrpl::loanMakePayment : valid total value");
 
     view.update(loan);
 
@@ -1844,311 +2114,29 @@ loanMakePayment(
     {
         // If the payment is late, and the late flag was not set, it's not
         // valid
-        JLOG(j.warn()) << "Loan payment is overdue. Use the tfLoanLatePayment "
-                          "transaction "
-                          "flag to make a late payment. Loan was created on "
-                       << startDate << ", prev payment due date is " << prevPaymentDateProxy
-                       << ", next payment due date is " << nextDueDateProxy << ", ledger time is "
+        JLOG(j.warn()) << "Loan payment is overdue. Use the tfLoanLatePayment transaction flag to "
+                          "make a late payment. Loan was created on "
+                       << loan->at(sfStartDate) << ", prev payment due date is "
+                       << loan->at(sfPreviousPaymentDueDate) << ", next payment due date is "
+                       << nextDueDateProxy << ", ledger time is "
                        << view.parentCloseTime().time_since_epoch().count();
         return std::unexpected(tecEXPIRED);
     }
 
-    // -------------------------------------------------------------
-    // full payment handling
-    if (paymentType == LoanPaymentType::Full)
+    switch (paymentType)
     {
-        TenthBips32 const closeInterestRate{loan->at(sfCloseInterestRate)};
-        Number const closePaymentFee = roundToAsset(asset, loan->at(sfClosePaymentFee), loanScale);
-
-        LoanState const roundedLoanState = constructLoanState(
-            totalValueOutstandingProxy, principalOutstandingProxy, managementFeeOutstandingProxy);
-
-        auto const fullPaymentComponents = detail::computeFullPayment(
-            asset,
-            view,
-            principalOutstandingProxy,
-            managementFeeOutstandingProxy,
-            periodicPayment,
-            paymentRemainingProxy,
-            prevPaymentDateProxy,
-            startDate,
-            paymentInterval,
-            closeInterestRate,
-            loanScale,
-            roundedLoanState.interestDue,
-            periodicRate,
-            closePaymentFee,
-            amount,
-            managementFeeRate,
-            j);
-
-        if (fullPaymentComponents.has_value())
-        {
-            return doPayment(
-                *fullPaymentComponents,
-                totalValueOutstandingProxy,
-                principalOutstandingProxy,
-                managementFeeOutstandingProxy,
-                paymentRemainingProxy,
-                prevPaymentDateProxy,
-                nextDueDateProxy,
-                paymentInterval);
-        }
-
-        if (fullPaymentComponents.error())
-        {
-            // error() will be the TER returned if a payment is not made. It
-            // will only evaluate to true if it's unsuccessful. Otherwise,
-            // tesSUCCESS means nothing was done, so continue.
-            return std::unexpected(fullPaymentComponents.error());
-        }
-
-        // LCOV_EXCL_START
-        UNREACHABLE("xrpl::loanMakePayment : invalid full payment result");
-        JLOG(j.error()) << "Full payment computation failed unexpectedly.";
-        return std::unexpected(tecINTERNAL);
-        // LCOV_EXCL_STOP
+        case LoanPaymentType::Full:
+            return detail::makeFullPayment(asset, view, loan, brokerSle, amount, j);
+        case LoanPaymentType::Late:
+            return detail::makeLatePayment(asset, view, loan, brokerSle, amount, j);
+        case LoanPaymentType::Regular:
+        case LoanPaymentType::Overpayment:
+            return detail::makeRegularPayment(asset, view, loan, brokerSle, amount, paymentType, j);
     }
 
-    // -------------------------------------------------------------
-    // compute the periodic payment info that will be needed whether the
-    // payment is late or regular
-    detail::ExtendedPaymentComponents periodic{
-        detail::computePaymentComponents(
-            view.rules(),
-            asset,
-            loanScale,
-            totalValueOutstandingProxy,
-            principalOutstandingProxy,
-            managementFeeOutstandingProxy,
-            periodicPayment,
-            periodicRate,
-            paymentRemainingProxy,
-            managementFeeRate),
-        serviceFee};
-    XRPL_ASSERT_PARTS(
-        periodic.trackedPrincipalDelta >= 0,
-        "xrpl::loanMakePayment",
-        "regular payment valid principal");
-
-    // -------------------------------------------------------------
-    // late payment handling
-    if (paymentType == LoanPaymentType::Late)
-    {
-        TenthBips32 const lateInterestRate{loan->at(sfLateInterestRate)};
-        Number const latePaymentFee = loan->at(sfLatePaymentFee);
-
-        auto const latePaymentComponents = detail::computeLatePayment(
-            asset,
-            view,
-            principalOutstandingProxy,
-            nextDueDateProxy,
-            periodic,
-            lateInterestRate,
-            loanScale,
-            latePaymentFee,
-            amount,
-            managementFeeRate,
-            j);
-
-        if (latePaymentComponents.has_value())
-        {
-            return doPayment(
-                *latePaymentComponents,
-                totalValueOutstandingProxy,
-                principalOutstandingProxy,
-                managementFeeOutstandingProxy,
-                paymentRemainingProxy,
-                prevPaymentDateProxy,
-                nextDueDateProxy,
-                paymentInterval);
-        }
-
-        if (latePaymentComponents.error())
-        {
-            // error() will be the TER returned if a payment is not made. It
-            // will only evaluate to true if it's unsuccessful.
-            return std::unexpected(latePaymentComponents.error());
-        }
-
-        // LCOV_EXCL_START
-        UNREACHABLE("xrpl::loanMakePayment : invalid late payment result");
-        JLOG(j.error()) << "Late payment computation failed unexpectedly.";
-        return std::unexpected(tecINTERNAL);
-        // LCOV_EXCL_STOP
-    }
-
-    // -------------------------------------------------------------
-    // regular periodic payment handling
-
-    XRPL_ASSERT_PARTS(
-        paymentType == LoanPaymentType::Regular || paymentType == LoanPaymentType::Overpayment,
-        "xrpl::loanMakePayment",
-        "regular payment type");
-
-    // Keep a running total of the actual parts paid
-    LoanPaymentParts totalParts;
-    Number totalPaid;
-    std::size_t numPayments = 0;
-
-    while ((amount >= (totalPaid + periodic.totalDue)) && paymentRemainingProxy > 0 &&
-           numPayments < kLoanMaximumPaymentsPerTransaction)
-    {
-        // Try to make more payments
-        XRPL_ASSERT_PARTS(
-            periodic.trackedPrincipalDelta >= 0,
-            "xrpl::loanMakePayment",
-            "payment pays non-negative principal");
-
-        totalPaid += periodic.totalDue;
-        totalParts += detail::doPayment(
-            periodic,
-            totalValueOutstandingProxy,
-            principalOutstandingProxy,
-            managementFeeOutstandingProxy,
-            paymentRemainingProxy,
-            prevPaymentDateProxy,
-            nextDueDateProxy,
-            paymentInterval);
-        ++numPayments;
-
-        XRPL_ASSERT_PARTS(
-            (periodic.specialCase == detail::PaymentSpecialCase::Final) ==
-                (paymentRemainingProxy == 0),
-            "xrpl::loanMakePayment",
-            "final payment is the final payment");
-
-        // Don't compute the next payment if this was the last payment
-        if (periodic.specialCase == detail::PaymentSpecialCase::Final)
-            break;
-
-        periodic = detail::ExtendedPaymentComponents{
-            detail::computePaymentComponents(
-                view.rules(),
-                asset,
-                loanScale,
-                totalValueOutstandingProxy,
-                principalOutstandingProxy,
-                managementFeeOutstandingProxy,
-                periodicPayment,
-                periodicRate,
-                paymentRemainingProxy,
-                managementFeeRate),
-            serviceFee};
-    }
-
-    if (numPayments == 0)
-    {
-        JLOG(j.warn()) << "Regular loan payment amount is insufficient. Due: " << periodic.totalDue
-                       << ", paid: " << amount;
-        return std::unexpected(tecINSUFFICIENT_PAYMENT);
-    }
-
-    XRPL_ASSERT_PARTS(
-        totalParts.principalPaid + totalParts.interestPaid + totalParts.feePaid == totalPaid,
-        "xrpl::loanMakePayment",
-        "payment parts add up");
-    XRPL_ASSERT_PARTS(totalParts.valueChange == 0, "xrpl::loanMakePayment", "no value change");
-
-    // -------------------------------------------------------------
-    // overpayment handling
-    //
-    // If the "fixCleanup3_1_3" amendment is enabled, truncate "amount",
-    // at the loan scale. If the raw value is used, the overpayment
-    // amount could be meaningless dust. Trying to process such a small
-    // amount will, at best, waste time when all the result values round
-    // to zero. At worst, it can cause logical errors with tiny amounts
-    // of interest that don't add up correctly.
-    auto const roundedAmount = view.rules().enabled(fixCleanup3_1_3)
-        ? roundToAsset(asset, amount, loanScale, Number::RoundingMode::TowardsZero)
-        : amount;
-    if (paymentType == LoanPaymentType::Overpayment && loan->isFlag(lsfLoanOverpayment) &&
-        paymentRemainingProxy > 0 && totalPaid < roundedAmount &&
-        numPayments < kLoanMaximumPaymentsPerTransaction)
-    {
-        TenthBips32 const overpaymentInterestRate{loan->at(sfOverpaymentInterestRate)};
-        TenthBips32 const overpaymentFeeRate{loan->at(sfOverpaymentFee)};
-
-        // It shouldn't be possible for the overpayment to be greater than
-        // totalValueOutstanding, because that would have been processed as
-        // another normal payment. But cap it just in case.
-        Number const overpaymentRaw =
-            std::min(roundedAmount - totalPaid, *totalValueOutstandingProxy);
-
-        bool const fixEnabled = view.rules().enabled(fixCleanup3_2_0);
-        Number const overpayment = fixEnabled
-            ? roundToAsset(asset, overpaymentRaw, loanScale, Number::RoundingMode::Downward)
-            : overpaymentRaw;
-
-        // Post-amendment, the rounded overpayment can be zero; pre-amendment
-        // it's always positive given the surrounding guards.
-        if (!fixEnabled || overpayment > 0)
-        {
-            detail::ExtendedPaymentComponents const overpaymentComponents =
-                detail::computeOverpaymentComponents(
-                    view.rules(),
-                    asset,
-                    loanScale,
-                    overpayment,
-                    overpaymentInterestRate,
-                    overpaymentFeeRate,
-                    managementFeeRate);
-
-            // Don't process an overpayment if the whole amount (or more!)
-            // gets eaten by fees and interest.
-            if (overpaymentComponents.trackedPrincipalDelta > 0)
-            {
-                XRPL_ASSERT_PARTS(
-                    overpaymentComponents.untrackedInterest >= beast::kZero,
-                    "xrpl::loanMakePayment",
-                    "overpayment penalty did not reduce value of loan");
-                // Can't just use `periodicPayment` here, because it might
-                // change
-                auto periodicPaymentProxy = loan->at(sfPeriodicPayment);
-                if (auto const overResult = detail::doOverpayment(
-                        view.rules(),
-                        asset,
-                        loanScale,
-                        overpaymentComponents,
-                        totalValueOutstandingProxy,
-                        principalOutstandingProxy,
-                        managementFeeOutstandingProxy,
-                        periodicPaymentProxy,
-                        periodicRate,
-                        paymentRemainingProxy,
-                        managementFeeRate,
-                        j))
-                {
-                    totalParts += *overResult;
-                }
-                else if (overResult.error())
-                {
-                    // error() will be the TER returned if a payment is not
-                    // made. It will only evaluate to true if it's unsuccessful.
-                    // Otherwise, tesSUCCESS means nothing was done, so
-                    // continue.
-                    return std::unexpected(overResult.error());
-                }
-            }
-        }
-    }
-
-    // Check the final results are rounded, to double-check that the
-    // intermediate steps were rounded.
-    XRPL_ASSERT(
-        isRounded(asset, totalParts.principalPaid, loanScale) &&
-            totalParts.principalPaid >= beast::kZero,
-        "xrpl::loanMakePayment : total principal paid is valid");
-    XRPL_ASSERT(
-        isRounded(asset, totalParts.interestPaid, loanScale) &&
-            totalParts.interestPaid >= beast::kZero,
-        "xrpl::loanMakePayment : total interest paid is valid");
-    XRPL_ASSERT(
-        isRounded(asset, totalParts.valueChange, loanScale),
-        "xrpl::loanMakePayment : loan value change is valid");
-    XRPL_ASSERT(
-        isRounded(asset, totalParts.feePaid, loanScale) && totalParts.feePaid >= beast::kZero,
-        "xrpl::loanMakePayment : fee paid is valid");
-    return totalParts;
+    // LCOV_EXCL_START
+    UNREACHABLE("xrpl::loanMakePayment : invalid payment type");
+    return std::unexpected(tecINTERNAL);
+    // LCOV_EXCL_STOP
 }
 }  // namespace xrpl
diff --git a/src/test/app/Loan_test.cpp b/src/test/app/Loan_test.cpp
index 371fcae54f..231a3b405a 100644
--- a/src/test/app/Loan_test.cpp
+++ b/src/test/app/Loan_test.cpp
@@ -446,7 +446,7 @@ protected:
                 env.test.BEAST_EXPECT(loan->at(sfPeriodicPayment) == periodicPayment);
                 env.test.BEAST_EXPECT(loan->at(sfFlags) == flags);
 
-                auto const ls = constructRoundedLoanState(loan);
+                auto const ls = constructLoanState(loan);
 
                 auto const interestRate = TenthBips32{loan->at(sfInterestRate)};
                 auto const paymentInterval = loan->at(sfPaymentInterval);
@@ -1119,7 +1119,7 @@ protected:
                     // No reason for this not to exist
                     return;
                 }
-                auto const current = constructRoundedLoanState(loanSle);
+                auto const current = constructLoanState(loanSle);
                 auto const errors = nextTrueState - current;
                 log << currencyLabel << " Loan balances: "
                     << "\n\tAmount taken: " << paymentComponents.trackedValueDelta
@@ -6056,7 +6056,7 @@ protected:
             auto const loanSle = env.le(loanKeylet);
             if (!BEAST_EXPECT(loanSle))
                 return;
-            auto const state = constructRoundedLoanState(loanSle);
+            auto const state = constructLoanState(loanSle);
 
             log << "Loan state:" << std::endl;
             log << "  ValueOutstanding: " << state.valueOutstanding << std::endl;

From b2f45813e072515fab3ddddcae89d64e1e0b3751 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 20 Jul 2026 15:04:08 +0100
Subject: [PATCH 089/100] chore: Workaround boost compiler resolution inside
 Nix environment (#7826)

---
 conan/profiles/default | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/conan/profiles/default b/conan/profiles/default
index ae6e23c3c3..6534f8092b 100644
--- a/conan/profiles/default
+++ b/conan/profiles/default
@@ -20,6 +20,22 @@ compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}
 
 [conf]
+{# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
+{# Instead it hand-rolls the compiler for user-config.jam, #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
+{# so on a host that also has a system `g++-15` the probe escapes Nix #}
+{# and picks the system compiler, which is mismatched with the Nix libraries #}
+{# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
+{# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
+{# resolve the same compiler. #}
+{# Not part of the package ID, so binaries stay shareable. #}
+{% if os != "Windows" %}
+{% set cc_exe  = {"gcc": "gcc",  "clang": "clang",   "apple-clang": "clang"}.get(compiler) %}
+{% set cxx_exe = {"gcc": "g++",  "clang": "clang++", "apple-clang": "clang++"}.get(compiler) %}
+tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
+{% endif %}
+
 {# By default, Conan tries to reuse binaries built with different cppstd versions. #}
 {# We want to avoid that to improve reproduceability, so we add the cppstd version to the package ID. #}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}

From 4c869ee16c33286fd501448d1a4ce673712778a8 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 20 Jul 2026 18:40:38 +0100
Subject: [PATCH 090/100] ci: Build separate pre-commit docker image (#7831)

---
 .github/workflows/build-nix-images.yml       |  4 +--
 .github/workflows/build-packaging-images.yml |  4 +--
 .github/workflows/build-pre-commit-image.yml | 36 +++++++++++++++++++
 bin/pre-commit/Dockerfile                    | 38 ++++++++++++++++++++
 4 files changed, 78 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/build-pre-commit-image.yml
 create mode 100644 bin/pre-commit/Dockerfile

diff --git a/.github/workflows/build-nix-images.yml b/.github/workflows/build-nix-images.yml
index 54911ef6e0..da28b8db49 100644
--- a/.github/workflows/build-nix-images.yml
+++ b/.github/workflows/build-nix-images.yml
@@ -1,4 +1,4 @@
-name: Build Nix Docker images
+name: Build `nix` Docker images
 
 on:
   push:
@@ -36,7 +36,7 @@ defaults:
 
 jobs:
   build-merge:
-    name: Build and push nix-${{ matrix.distro.name }}
+    name: Build and push `nix-${{ matrix.distro.name }}` image
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-packaging-images.yml b/.github/workflows/build-packaging-images.yml
index 3633847ef3..e72ea876a7 100644
--- a/.github/workflows/build-packaging-images.yml
+++ b/.github/workflows/build-packaging-images.yml
@@ -1,4 +1,4 @@
-name: Build packaging Docker images
+name: Build `packaging` Docker images
 
 on:
   push:
@@ -26,7 +26,7 @@ defaults:
 
 jobs:
   build-merge:
-    name: Build and push packaging-${{ matrix.distro.name }}
+    name: Build and push `packaging-${{ matrix.distro.name }}` image
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-pre-commit-image.yml b/.github/workflows/build-pre-commit-image.yml
new file mode 100644
index 0000000000..1d0a479846
--- /dev/null
+++ b/.github/workflows/build-pre-commit-image.yml
@@ -0,0 +1,36 @@
+name: Build `pre-commit` Docker image
+
+on:
+  push:
+    branches:
+      - develop
+    paths:
+      - ".github/workflows/build-pre-commit-image.yml"
+      - "bin/pre-commit/Dockerfile"
+  pull_request:
+    paths:
+      - ".github/workflows/build-pre-commit-image.yml"
+      - "bin/pre-commit/Dockerfile"
+  workflow_dispatch:
+
+concurrency:
+  # Read `on-trigger.yml` for the rationale behind this concurrency group name.
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-merge:
+    name: Build and push `pre-commit` image
+    permissions:
+      contents: read
+      packages: write
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
+    with:
+      image_name: xrpld/pre-commit
+      dockerfile: bin/pre-commit/Dockerfile
+      base_image: ubuntu:26.04
+      push: ${{ github.event_name == 'push' }}
diff --git a/bin/pre-commit/Dockerfile b/bin/pre-commit/Dockerfile
new file mode 100644
index 0000000000..fcd07146c3
--- /dev/null
+++ b/bin/pre-commit/Dockerfile
@@ -0,0 +1,38 @@
+ARG BASE_IMAGE=ubuntu:26.04
+
+FROM ${BASE_IMAGE}
+
+SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
+ENTRYPOINT ["/bin/bash"]
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN <<EOF
+pkgs=()
+pkgs+=(curl)         # Required to install nix.
+pkgs+=(git)          # Required for prepare-runner.
+pkgs+=(libatomic1)   # Required to run pre-commit provided `node`.
+pkgs+=(python3)      # Python 3 interpreter.
+pkgs+=(python3-pip)  # Package manager for Python applications.
+pkgs+=(xz-utils)     # Required to install nix
+
+apt-get update
+apt-get install -y --no-install-recommends "${pkgs[@]}"
+apt-get clean
+rm -rf /var/lib/apt/lists/*
+EOF
+
+ARG PRE_COMMIT_VERSION=4.6.0
+RUN pip install --no-cache --break-system-packages \
+    pre-commit==${PRE_COMMIT_VERSION}
+
+RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes
+
+# Add nix to PATH and set NIX environment variables,
+# so nix is available in all shells including non-interactive shells (e.g., GitHub Actions).
+ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
+ENV NIX_PROFILES="/nix/var/nix/profiles/default"
+ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+
+# Verify nix installation
+RUN nix --version

From 60b49f3fe0d2649cd41c796341a61c815eb9b770 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:11:09 +0100
Subject: [PATCH 091/100] ci: Use in-house image for pre-commit (#7610)

---
 .github/workflows/pre-commit.yml | 2 +-
 .pre-commit-config.yaml          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 1acd28208e..37207c41ef 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -17,4 +17,4 @@ jobs:
     uses: XRPLF/actions/.github/workflows/pre-commit.yml@1bde119a1ab71305ba5d3716e7a82cea1c7bdede
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/ci/tools-rippled-pre-commit:sha-41ec7c1" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-4c869ee" }'
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 8a689c0f8b..d339cb29ed 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -55,7 +55,7 @@ repos:
         types_or: [c++, c]
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: dd18dad857d6133e90bbe478f4f2f22ec0030269 # frozen: v22.1.5
+    rev: f4d7745e17a28aad7eed2f4874ca8d1568c11c4c # frozen: v22.1.8
     hooks:
       - id: clang-format
         args: [--style=file]
@@ -68,7 +68,7 @@ repos:
       - id: gersemi
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 39e2973981e6d2f9b6c543b0086a2d2393abdc89 # frozen: v3.9.4
+    rev: 9337a74165b178ae2c766f60bee7252a0f06f3e8 # frozen: v3.9.5
     hooks:
       - id: prettier
         args: [--end-of-line=auto]

From 042c9660cd1354981ec957a6c723eecf07902145 Mon Sep 17 00:00:00 2001
From: Bart <bthomee@users.noreply.github.com>
Date: Mon, 20 Jul 2026 17:06:24 -0400
Subject: [PATCH 092/100] chore: Add CODEOWNERS for CI-related changes (#7832)

Co-authored-by: Bart <11445373+bthomee@users.noreply.github.com>
---
 CODEOWNERS | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 CODEOWNERS

diff --git a/CODEOWNERS b/CODEOWNERS
new file mode 100644
index 0000000000..f92cb81924
--- /dev/null
+++ b/CODEOWNERS
@@ -0,0 +1,4 @@
+# By default, anyone can review changes.
+
+# The CI tooling team should review changes to the CI configuration.
+/.github/ @XRPLF/ci-tooling

From ee0a3dfad77a4993b8ef04680d2993e151686207 Mon Sep 17 00:00:00 2001
From: Mayukha Vadari <mvadari@ripple.com>
Date: Tue, 21 Jul 2026 09:14:40 -0400
Subject: [PATCH 093/100] ci: Improve test debuggability (#7619)

Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
---
 .../workflows/reusable-build-test-config.yml  | 42 +++++++++--------
 src/test/app/Invariants_test.cpp              | 45 +++++++++++--------
 2 files changed, 49 insertions(+), 38 deletions(-)

diff --git a/.github/workflows/reusable-build-test-config.yml b/.github/workflows/reusable-build-test-config.yml
index d4135207fe..69fa7a7bef 100644
--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -223,11 +223,13 @@ jobs:
           BUILD_TYPE: ${{ inputs.build_type }}
           CMAKE_TARGET: ${{ inputs.cmake_target }}
         run: |
+          set -o pipefail
           cmake \
               --build . \
               --config "${BUILD_TYPE}" \
               --parallel "${BUILD_NPROC}" \
-              --target "${CMAKE_TARGET}"
+              --target "${CMAKE_TARGET}" \
+              2>&1 | tee "${GITHUB_WORKSPACE}/build.log"
 
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}
@@ -322,7 +324,7 @@ jobs:
               PRELOAD=""
           fi
 
-          LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee unittest.log
+          LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee "${GITHUB_WORKSPACE}/unittest.log"
 
       # Smoke-run every benchmark module with a single repetition to confirm the
       # benchmarks still build and execute. This is a correctness check, not a
@@ -341,25 +343,27 @@ jobs:
           done < <(find src/benchmarks -type f -perm -u+x -name 'xrpl.bench.*')
           exit "${rc}"
 
-      - name: Show test failure summary
-        if: ${{ failure() && !inputs.build_only }}
-        env:
-          WORKING_DIR: ${{ runner.os == 'Windows' && format('{0}\{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
+      - name: Show build/test failure summary
+        if: ${{ failure() }}
         run: |
-          if [ ! -d "${WORKING_DIR}" ]; then
-              echo "Working directory '${WORKING_DIR}' does not exist."
-              exit 0
-          fi
+          cd "${GITHUB_WORKSPACE}"
 
-          cd "${WORKING_DIR}"
-
-          if [ ! -f unittest.log ]; then
-              echo "unittest.log not found; embedded tests may not have run."
-              exit 0
-          fi
-
-          if ! grep -E "failed" unittest.log; then
-              echo "Log present but no failure lines found in unittest.log."
+          if [ -f unittest.log ]; then
+              if ! grep -E "failed" unittest.log | grep -vE "^I[0-9]|^[0-9]+> (ERR:|FTL:)"; then
+                  echo "unittest.log present but no failure lines found."
+              fi
+          elif [ -f build.log ]; then
+              # GCC/Clang emit "error:" (covers "fatal error:"); MSVC emits
+              # "error C####:", "error LNK####:", and "fatal error LNK####:".
+              # -A6 prints the lines that follow each match (source line, caret,
+              # notes, and the "N errors generated" tally) to capture the whole
+              # diagnostic block.
+              if ! grep -E -A6 "error:|error C[0-9]{4}|error LNK[0-9]{4}|fatal error" build.log; then
+                  echo "build.log present but no compile errors found."
+              fi
+          else
+              echo "unittest.log/build.log not found; something went wrong."
+              exit 1
           fi
       - name: Debug failure (Linux)
         if: ${{ failure() && runner.os == 'Linux' && !inputs.build_only }}
diff --git a/src/test/app/Invariants_test.cpp b/src/test/app/Invariants_test.cpp
index 076e39a42b..eaf1f2704c 100644
--- a/src/test/app/Invariants_test.cpp
+++ b/src/test/app/Invariants_test.cpp
@@ -3,6 +3,7 @@
 #include <test/jtx/Env.h>
 #include <test/jtx/TestHelpers.h>
 #include <test/jtx/amount.h>
+#include <test/jtx/envconfig.h>
 #include <test/jtx/fee.h>
 #include <test/jtx/mpt.h>
 #include <test/jtx/pay.h>
@@ -101,6 +102,12 @@ class Invariants_test : public beast::unit_test::Suite
         return xrpl::test::jtx::testableAmendments() | fixCleanup3_1_3 | fixCleanup3_2_0;
     }
 
+    test::jtx::Env
+    makeEnv(FeatureBitset features)
+    {
+        return {*this, test::jtx::envconfig(), features, nullptr, beast::Severity::Disabled};
+    }
+
     /**
      * Run a specific test case to put the ledger into a state that will be
      * detected by an invariant. Simulates the actions of a transaction that
@@ -130,7 +137,7 @@ class Invariants_test : public beast::unit_test::Suite
         TxAccount setTxAccount = TxAccount::None)
     {
         doInvariantCheck(
-            test::jtx::Env(*this, defaultAmendments()),
+            makeEnv(defaultAmendments()),
             expectLogs,
             precheck,
             fee,
@@ -1494,7 +1501,7 @@ class Invariants_test : public beast::unit_test::Suite
         testcase << "PermissionedDomain" + std::string(fixEnabled ? " fix" : "");
 
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"permissioned domain with no rules."}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
                 return createPermissionedDomain(ac, a1, a2, 0).get();
@@ -1507,7 +1514,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         static constexpr auto kTooBig = kMaxPermissionedDomainCredentialsArraySize + 1;
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"permissioned domain bad credentials size " + std::to_string(kTooBig)}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
                 return !!createPermissionedDomain(ac, a1, a2, kTooBig);
@@ -1518,7 +1525,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         testcase << "PermissionedDomain 3";
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"permissioned domain credentials aren't sorted"}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
                 auto slePd = createPermissionedDomain(ac, a1, a2, 0);
@@ -1542,7 +1549,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         testcase << "PermissionedDomain 4";
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"permissioned domain credentials aren't unique"}},
             [](Account const& a1, Account const& a2, ApplyContext& ac) {
                 auto slePd = createPermissionedDomain(ac, a1, a2, 0);
@@ -1565,7 +1572,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         testcase << "PermissionedDomain Set 1";
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"permissioned domain with no rules."}},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 // create PD
@@ -1586,7 +1593,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         testcase << "PermissionedDomain Set 2";
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"permissioned domain bad credentials size " + std::to_string(kTooBig)}},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 // create PD
@@ -1617,7 +1624,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         testcase << "PermissionedDomain Set 3";
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"permissioned domain credentials aren't sorted"}},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 // create PD
@@ -1647,7 +1654,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         testcase << "PermissionedDomain Set 4";
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"permissioned domain credentials aren't unique"}},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 // create PD
@@ -1688,7 +1695,7 @@ class Invariants_test : public beast::unit_test::Suite
         {
             testcase << "PermissionedDomain set 2 domains ";
             doInvariantCheck(
-                Env(*this, features),
+                makeEnv(features),
                 fixEnabled ? badMoreThan1 : emptyV,
                 [](Account const& a1, Account const& a2, ApplyContext& ac) {
                     createPermissionedDomain(ac, a1, a2);
@@ -1734,7 +1741,7 @@ class Invariants_test : public beast::unit_test::Suite
         {
             testcase << "PermissionedDomain set 0 domains ";
             doInvariantCheck(
-                Env(*this, features),
+                makeEnv(features),
                 fixEnabled ? badNoDomains : emptyV,
                 [](Account const&, Account const&, ApplyContext&) { return true; },
                 XRPAmount{},
@@ -1757,7 +1764,7 @@ class Invariants_test : public beast::unit_test::Suite
             env1.close();
 
             doInvariantCheck(
-                Env(*this, features),
+                makeEnv(features),
                 a1,
                 a2,
                 fixEnabled ? badNoDomains : emptyV,
@@ -1798,7 +1805,7 @@ class Invariants_test : public beast::unit_test::Suite
         {
             testcase << "PermissionedDomain del, create domain ";
             doInvariantCheck(
-                Env(*this, features),
+                makeEnv(features),
                 fixEnabled ? badNotDeleted : emptyV,
                 [](Account const& a1, Account const& a2, ApplyContext& ac) {
                     createPermissionedDomain(ac, a1, a2);
@@ -1995,7 +2002,7 @@ class Invariants_test : public beast::unit_test::Suite
         testcase << "PermissionedDEX" + std::string(fixEnabled ? " fix" : "");
 
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"domain doesn't exist"}},
             [](Account const& a1, Account const&, ApplyContext& ac) {
                 Keylet const offerKey = keylet::offer(a1.id(), 10);
@@ -2022,7 +2029,7 @@ class Invariants_test : public beast::unit_test::Suite
 
         // missing domain ID in offer object
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             {{"hybrid offer is malformed"}},
             [&](Account const& a1, Account const& a2, ApplyContext& ac) {
                 Keylet const offerKey = keylet::offer(a2.id(), 10);
@@ -4342,7 +4349,7 @@ class Invariants_test : public beast::unit_test::Suite
         };
 
         doInvariantCheck(
-            Env{*this, defaultAmendments() - fixCleanup3_2_0},
+            makeEnv(defaultAmendments() - fixCleanup3_2_0),
             {},
             [](Account const&, Account const&, ApplyContext&) { return true; },
             XRPAmount{},
@@ -5468,7 +5475,7 @@ class Invariants_test : public beast::unit_test::Suite
         // sfHighLimit issue, not the keylet currency).
         testcase << "overwrite: NoXRPTrustLines" + std::string(fixEnabled ? " fix" : "");
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             fixEnabled ? std::vector<std::string>{{"an XRP trust line was created"}}
                        : std::vector<std::string>{},
             [&insertOrderedTrustLinePair](Account const& a1, Account const& a2, ApplyContext& ac) {
@@ -5496,7 +5503,7 @@ class Invariants_test : public beast::unit_test::Suite
         // Regression: bad deep-freeze trust line followed by a valid one.
         testcase << "overwrite: NoDeepFreeze" + std::string(fixEnabled ? " fix" : "");
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             fixEnabled ? std::vector<std::string>{{"a trust line with deep freeze flag without "
                                                    "normal freeze was created"}}
                        : std::vector<std::string>{},
@@ -5530,7 +5537,7 @@ class Invariants_test : public beast::unit_test::Suite
         // still fires ("a MPT issuance was created").
         testcase << "overwrite: NoZeroEscrow MPT" + std::string(fixEnabled ? " fix" : "");
         doInvariantCheck(
-            Env(*this, features),
+            makeEnv(features),
             fixEnabled ? std::vector<std::string>{{"escrow specifies invalid amount"}}
                        : std::vector<std::string>{{"a MPT issuance was created"}},
             [](Account const& a1, Account const&, ApplyContext& ac) {

From 4918f3bb200c1c56a2769e7a94ec701728138216 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:38:26 +0000
Subject: [PATCH 094/100] chore: Add doxygen in pre-commit image (#7836)

---
 bin/pre-commit/Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bin/pre-commit/Dockerfile b/bin/pre-commit/Dockerfile
index fcd07146c3..3e803297ce 100644
--- a/bin/pre-commit/Dockerfile
+++ b/bin/pre-commit/Dockerfile
@@ -10,6 +10,7 @@ ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 pkgs=()
 pkgs+=(curl)         # Required to install nix.
+pkgs+=(doxygen)      # Needed for Clio's check-doxygen-docs.sh.
 pkgs+=(git)          # Required for prepare-runner.
 pkgs+=(libatomic1)   # Required to run pre-commit provided `node`.
 pkgs+=(python3)      # Python 3 interpreter.

From f56b79f00d0c5f7df5f506c385e81525cf034cdc Mon Sep 17 00:00:00 2001
From: Sergey Kuznetsov <skuznetsov@ripple.com>
Date: Tue, 21 Jul 2026 13:39:37 +0000
Subject: [PATCH 095/100] ci: Add cargo to pre-commit image (#7835)

---
 .github/workflows/build-pre-commit-image.yml |  2 ++
 bin/pre-commit/Dockerfile                    | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/.github/workflows/build-pre-commit-image.yml b/.github/workflows/build-pre-commit-image.yml
index 1d0a479846..9b20dc7951 100644
--- a/.github/workflows/build-pre-commit-image.yml
+++ b/.github/workflows/build-pre-commit-image.yml
@@ -7,10 +7,12 @@ on:
     paths:
       - ".github/workflows/build-pre-commit-image.yml"
       - "bin/pre-commit/Dockerfile"
+      - "rust-toolchain.toml"
   pull_request:
     paths:
       - ".github/workflows/build-pre-commit-image.yml"
       - "bin/pre-commit/Dockerfile"
+      - "rust-toolchain.toml"
   workflow_dispatch:
 
 concurrency:
diff --git a/bin/pre-commit/Dockerfile b/bin/pre-commit/Dockerfile
index 3e803297ce..a96f3e4c25 100644
--- a/bin/pre-commit/Dockerfile
+++ b/bin/pre-commit/Dockerfile
@@ -37,3 +37,19 @@ ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt
 
 # Verify nix installation
 RUN nix --version
+
+ENV RUSTUP_HOME="/opt/rust/rustup"
+ENV CARGO_HOME="/opt/rust/cargo"
+ENV PATH="/opt/rust/cargo/bin:${PATH}"
+
+WORKDIR /tmp
+COPY rust-toolchain.toml /tmp/rust-toolchain.toml
+RUN <<EOF
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+    | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
+rustup toolchain install
+rustup show
+cargo fmt --version
+EOF
+
+WORKDIR /

From c414e1877d5225ee91df8f5e56b20693a9e7efa7 Mon Sep 17 00:00:00 2001
From: Sergey Kuznetsov <skuznetsov@ripple.com>
Date: Tue, 21 Jul 2026 15:37:47 +0000
Subject: [PATCH 096/100] ci: Update pre-commit image (#7838)

---
 .github/workflows/pre-commit.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 37207c41ef..9970e9a07d 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -17,4 +17,4 @@ jobs:
     uses: XRPLF/actions/.github/workflows/pre-commit.yml@1bde119a1ab71305ba5d3716e7a82cea1c7bdede
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-4c869ee" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'

From ba01b05f33d4b28c30ce347d0cd68c4d83005359 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 16:04:45 +0000
Subject: [PATCH 097/100] ci: [DEPENDABOT] bump actions/setup-python from 6.3.0
 to 7.0.0 (#7830)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/reusable-package.yml         | 2 +-
 .github/workflows/reusable-strategy-matrix.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reusable-package.yml b/.github/workflows/reusable-package.yml
index 6feecbfb75..55bc20dc5c 100644
--- a/.github/workflows/reusable-package.yml
+++ b/.github/workflows/reusable-package.yml
@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/reusable-strategy-matrix.yml b/.github/workflows/reusable-strategy-matrix.yml
index b6091b99d9..de8d9cfc8e 100644
--- a/.github/workflows/reusable-strategy-matrix.yml
+++ b/.github/workflows/reusable-strategy-matrix.yml
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
 

From 7edf39e62223b6d8296ec68051c749432a4d24e1 Mon Sep 17 00:00:00 2001
From: Sergey Kuznetsov <skuznetsov@ripple.com>
Date: Wed, 22 Jul 2026 14:00:17 +0000
Subject: [PATCH 098/100] ci: Use rust-overlay to bring Rust into nix (#7837)

---
 .cspell.config.yaml                           |  1 +
 .github/workflows/build-nix-images.yml        |  2 ++
 .gitignore                                    |  3 ++
 flake.lock                                    | 23 +++++++++++-
 flake.nix                                     | 17 +++++++--
 nix/docker/Dockerfile                         |  1 +
 nix/docker/README.md                          | 35 +++++++++++--------
 nix/docker/test_files/rust/compile-sources.sh | 23 ++++++++++++
 .../test_files/rust/proc_macro/Cargo.lock     | 14 ++++++++
 .../test_files/rust/proc_macro/Cargo.toml     |  3 ++
 .../rust/proc_macro/echo_macro/Cargo.toml     |  8 +++++
 .../rust/proc_macro/echo_macro/src/lib.rs     |  6 ++++
 .../rust/proc_macro/test_macro/Cargo.toml     |  8 +++++
 .../rust/proc_macro/test_macro/src/main.rs    |  9 +++++
 nix/docker/test_files/rust/run-binaries.sh    |  7 ++--
 nix/packages.nix                              |  8 ++---
 nix/utils.nix                                 | 13 +++++--
 rust-toolchain.toml                           |  6 +---
 18 files changed, 154 insertions(+), 33 deletions(-)
 create mode 100644 nix/docker/test_files/rust/proc_macro/Cargo.lock
 create mode 100644 nix/docker/test_files/rust/proc_macro/Cargo.toml
 create mode 100644 nix/docker/test_files/rust/proc_macro/echo_macro/Cargo.toml
 create mode 100644 nix/docker/test_files/rust/proc_macro/echo_macro/src/lib.rs
 create mode 100644 nix/docker/test_files/rust/proc_macro/test_macro/Cargo.toml
 create mode 100644 nix/docker/test_files/rust/proc_macro/test_macro/src/main.rs

diff --git a/.cspell.config.yaml b/.cspell.config.yaml
index e220cd0249..e26eef9227 100644
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -216,6 +216,7 @@ words:
   - Nyffenegger
   - onlatest
   - ostr
+  - oxalica
   - pargs
   - partitioner
   - paychan
diff --git a/.github/workflows/build-nix-images.yml b/.github/workflows/build-nix-images.yml
index da28b8db49..fd480cff67 100644
--- a/.github/workflows/build-nix-images.yml
+++ b/.github/workflows/build-nix-images.yml
@@ -8,6 +8,7 @@ on:
       - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
+      - "rust-toolchain.toml"
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
@@ -18,6 +19,7 @@ on:
       - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
+      - "rust-toolchain.toml"
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
diff --git a/.gitignore b/.gitignore
index 6bd34ece04..13b59a7e2c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -81,6 +81,9 @@ DerivedData
 # Python
 __pycache__
 
+# Rust build artifacts.
+target/
+
 # Direnv's directory
 /.direnv
 
diff --git a/flake.lock b/flake.lock
index 80243ccf15..cd9289c998 100644
--- a/flake.lock
+++ b/flake.lock
@@ -36,7 +36,28 @@
     "root": {
       "inputs": {
         "nixpkgs": "nixpkgs",
-        "nixpkgs-custom-glibc": "nixpkgs-custom-glibc"
+        "nixpkgs-custom-glibc": "nixpkgs-custom-glibc",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784611586,
+        "narHash": "sha256-OfqgY+0hp/zseZB7uyH0U8kIDPS4scZZCyAurEplvG0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "14f58845249f3552a89b07772626b8d3c632fa86",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index c52f4d050e..ee2fd13efc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -10,12 +10,25 @@
       url = "github:NixOS/nixpkgs/9cd98386a38891d1074fc18036b842dc4416f562";
       flake = false;
     };
+    # Pinned Rust toolchains, delivered from the Nix store. Lets the Nix CI
+    # image and dev shell honour the single `rust-toolchain.toml` pin (shared
+    # with the rustup-based non-Nix runners) while staying hermetic — the
+    # toolchain lands in the image's Nix closure and is locked by flake.lock.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
-    { nixpkgs, nixpkgs-custom-glibc, ... }:
+    {
+      nixpkgs,
+      nixpkgs-custom-glibc,
+      rust-overlay,
+      ...
+    }:
     let
-      forEachSystem = import ./nix/utils.nix { inherit nixpkgs nixpkgs-custom-glibc; };
+      forEachSystem = import ./nix/utils.nix { inherit nixpkgs nixpkgs-custom-glibc rust-overlay; };
     in
     {
       devShells = forEachSystem (import ./nix/devshell.nix);
diff --git a/nix/docker/Dockerfile b/nix/docker/Dockerfile
index 7222cc8fa8..8b851fd9e0 100644
--- a/nix/docker/Dockerfile
+++ b/nix/docker/Dockerfile
@@ -12,6 +12,7 @@ COPY nix/packages.nix /tmp/build/nix/packages.nix
 COPY nix/utils.nix /tmp/build/nix/utils.nix
 COPY flake.nix /tmp/build/
 COPY flake.lock /tmp/build/
+COPY rust-toolchain.toml /tmp/build/
 WORKDIR /tmp/build
 
 FROM builder-source AS builder
diff --git a/nix/docker/README.md b/nix/docker/README.md
index 23ad05049e..7b4d4b9387 100644
--- a/nix/docker/README.md
+++ b/nix/docker/README.md
@@ -47,7 +47,9 @@ work without `ca-certificates` being installed in the base image.
      [`test_files/cpp/sources/`](./test_files/cpp/sources) with both `g++` and
      `clang++`, and sanitizers, and
    - compiles the Rust test programs in
-     [`test_files/rust/sources/`](./test_files/rust/sources) with `rustc`.
+     [`test_files/rust/sources/`](./test_files/rust/sources) with `rustc`, and
+     builds the [`test_files/rust/proc_macro/`](./test_files/rust/proc_macro)
+     workspace with `cargo` to exercise proc-macro dylib loading.
 3. **`tester`** — Start again from a clean `BASE_IMAGE` (no Nix toolchain),
    install only the sanitizer runtime libraries
    ([`install-sanitizer-libs.sh`](./install-sanitizer-libs.sh)), and run the
@@ -76,20 +78,23 @@ toolchain being present at runtime. Two pieces make that work:
   [`loader-path.sh`](./loader-path.sh) reports the expected loader path for the
   current architecture, so we can patch the binaries to use the correct loader.
 
-The build then verifies all of this end to end: the C++ test programs in
-`test_files/cpp/sources/` (a regular binary plus ASan/TSan/UBSan variants) and
-the Rust test programs in `test_files/rust/sources/` (a hello binary plus panic
-and overflow-check variants) are compiled in `final`, their `PT_INTERP` is
-patched to the target loader, and they are run in the clean `tester` stage to
-confirm each emits the expected diagnostic on a stock base image.
+The build then verifies all of this end to end, and the C++ and Rust programs
+go through the same pipeline: each is compiled in `final`, has its `PT_INTERP`
+patched to the target loader, and is then run in the clean `tester` stage to
+confirm it emits the expected diagnostic on a stock base image. The C++ programs
+are in `test_files/cpp/sources/` (a regular binary plus ASan/TSan/UBSan
+variants); the Rust programs are in `test_files/rust/sources/` (a hello binary
+plus panic and overflow-check variants), plus the `test_files/rust/proc_macro/`
+workspace — a crate whose compilation additionally loads a proc-macro dylib, and
+whose resulting binary is patched and run like the others.
 
 ## Files
 
-| File                                                                    | Purpose                                                                       |
-| ----------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
-| [`./Dockerfile`](./Dockerfile)                                          | Multi-stage build described above.                                            |
-| [`./loader-path.sh`](./loader-path.sh)                                  | Print the dynamic-linker (`PT_INTERP`) path for the current architecture.     |
-| [`./test_files/cpp/`](./test_files/cpp)                                 | C++ sanitizer smoke test: sources + compile/run scripts.                      |
-| [`./test_files/rust/`](./test_files/rust)                               | Rust rustc smoke test: sources + compile/run scripts.                         |
-| [`/bin/check-tools.sh`](../../bin/check-tools.sh)                       | Verify every expected tools are present and runnable.                         |
-| [`/bin/install-sanitizer-libs.sh`](../../bin/install-sanitizer-libs.sh) | Install `libasan`/`libtsan`/`libubsan` runtimes on the supported base images. |
+| File                                                                    | Purpose                                                                              |
+| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| [`./Dockerfile`](./Dockerfile)                                          | Multi-stage build described above.                                                   |
+| [`./loader-path.sh`](./loader-path.sh)                                  | Print the dynamic-linker (`PT_INTERP`) path for the current architecture.            |
+| [`./test_files/cpp/`](./test_files/cpp)                                 | C++ sanitizer smoke test: sources + compile/run scripts.                             |
+| [`./test_files/rust/`](./test_files/rust)                               | Rust smoke test: rustc sources + a cargo proc-macro workspace + compile/run scripts. |
+| [`/bin/check-tools.sh`](../../bin/check-tools.sh)                       | Verify every expected tools are present and runnable.                                |
+| [`/bin/install-sanitizer-libs.sh`](../../bin/install-sanitizer-libs.sh) | Install `libasan`/`libtsan`/`libubsan` runtimes on the supported base images.        |
diff --git a/nix/docker/test_files/rust/compile-sources.sh b/nix/docker/test_files/rust/compile-sources.sh
index 5e5ecc0dcb..106855a3ab 100755
--- a/nix/docker/test_files/rust/compile-sources.sh
+++ b/nix/docker/test_files/rust/compile-sources.sh
@@ -40,6 +40,29 @@ compile hello
 compile panic
 compile overflow "-C overflow-checks=on"
 
+function compile_proc_macro() {
+    local proj="${src_dir}/../proc_macro"
+
+    echo "=== Building proc-macro workspace (cargo) ==="
+    cargo build --manifest-path "${proj}/Cargo.toml" --offline
+
+    local built="${proj}/target/debug/test_macro"
+    if [ ! -f "${built}" ]; then
+        echo "ERROR: built test_macro binary not found at ${built}" >&2
+        exit 1
+    fi
+
+    local binary="${dst_dir}/proc_macro"
+    cp "${built}" "${binary}"
+
+    echo "=== Patching ${binary} to use ${loader} as PT_INTERP ==="
+    patchelf --set-interpreter "${loader}" --remove-rpath "${binary}"
+
+    rm -rf "${proj}/target"
+}
+
+compile_proc_macro
+
 echo "=== All binaries compiled ==="
 
 ls -la "${dst_dir}"
diff --git a/nix/docker/test_files/rust/proc_macro/Cargo.lock b/nix/docker/test_files/rust/proc_macro/Cargo.lock
new file mode 100644
index 0000000000..acab3fa0b9
--- /dev/null
+++ b/nix/docker/test_files/rust/proc_macro/Cargo.lock
@@ -0,0 +1,14 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "echo_macro"
+version = "0.0.0"
+
+[[package]]
+name = "test_macro"
+version = "0.0.0"
+dependencies = [
+ "echo_macro",
+]
diff --git a/nix/docker/test_files/rust/proc_macro/Cargo.toml b/nix/docker/test_files/rust/proc_macro/Cargo.toml
new file mode 100644
index 0000000000..d54955de3d
--- /dev/null
+++ b/nix/docker/test_files/rust/proc_macro/Cargo.toml
@@ -0,0 +1,3 @@
+[workspace]
+resolver = "2"
+members = ["echo_macro", "test_macro"]
diff --git a/nix/docker/test_files/rust/proc_macro/echo_macro/Cargo.toml b/nix/docker/test_files/rust/proc_macro/echo_macro/Cargo.toml
new file mode 100644
index 0000000000..b0f92ce75a
--- /dev/null
+++ b/nix/docker/test_files/rust/proc_macro/echo_macro/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "echo_macro"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[lib]
+proc-macro = true
diff --git a/nix/docker/test_files/rust/proc_macro/echo_macro/src/lib.rs b/nix/docker/test_files/rust/proc_macro/echo_macro/src/lib.rs
new file mode 100644
index 0000000000..e4b90d58fe
--- /dev/null
+++ b/nix/docker/test_files/rust/proc_macro/echo_macro/src/lib.rs
@@ -0,0 +1,6 @@
+use proc_macro::TokenStream;
+
+#[proc_macro]
+pub fn define_echo(item: TokenStream) -> TokenStream {
+    format!("fn echo() -> u32 {{ {item} }}").parse().unwrap()
+}
diff --git a/nix/docker/test_files/rust/proc_macro/test_macro/Cargo.toml b/nix/docker/test_files/rust/proc_macro/test_macro/Cargo.toml
new file mode 100644
index 0000000000..25b6ba8e45
--- /dev/null
+++ b/nix/docker/test_files/rust/proc_macro/test_macro/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "test_macro"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+echo_macro = { path = "../echo_macro" }
diff --git a/nix/docker/test_files/rust/proc_macro/test_macro/src/main.rs b/nix/docker/test_files/rust/proc_macro/test_macro/src/main.rs
new file mode 100644
index 0000000000..77718b9d75
--- /dev/null
+++ b/nix/docker/test_files/rust/proc_macro/test_macro/src/main.rs
@@ -0,0 +1,9 @@
+use echo_macro::define_echo;
+
+define_echo!(42);
+
+fn main() {
+    let a = echo();
+    println!("proc-macro answer = {a}");
+    assert_eq!(a, 42, "proc-macro expansion produced the wrong value");
+}
diff --git a/nix/docker/test_files/rust/run-binaries.sh b/nix/docker/test_files/rust/run-binaries.sh
index b627c12609..4cafee00ec 100755
--- a/nix/docker/test_files/rust/run-binaries.sh
+++ b/nix/docker/test_files/rust/run-binaries.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # Run pre-compiled Rust binaries and confirm each emits its expected diagnostic.
 # Binaries must already exist in <bins_dir> as <name> for name in
-# {hello,panic,overflow}.
+# {hello,panic,overflow,proc_macro}.
 
 set -eo pipefail
 
@@ -54,12 +54,13 @@ declare -A expect=(
     [hello]="Hello from main thread"
     [panic]="explicit panic from test"
     [overflow]="attempt to add with overflow"
+    [proc_macro]="proc-macro answer = 42"
 )
 
-for name in hello panic overflow; do
+for name in hello panic overflow proc_macro; do
     binary="${bins_dir}/${name}"
 
-    if [ "${name}" = "hello" ]; then
+    if [ "${name}" = "hello" ] || [ "${name}" = "proc_macro" ]; then
         expected_rc=0
     else
         expected_rc=nonzero
diff --git a/nix/packages.nix b/nix/packages.nix
index 41d7e97328..dbd9597c25 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -15,6 +15,8 @@ let
   runClangTidy = pkgs.writeShellScriptBin "run-clang-tidy" ''
     exec ${pkgs.python3}/bin/python3 ${llvmPackages.clang-unwrapped}/bin/run-clang-tidy "$@"
   '';
+
+  rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml;
 in
 {
   inherit
@@ -63,14 +65,10 @@ in
     vim
     zip
     # Rust packages
-    cargo
     cargo-audit
     cargo-llvm-cov
     cargo-nextest
-    clippy
     corrosion
-    rust-analyzer
-    rustc
-    rustfmt
+    rustToolchain
   ];
 }
diff --git a/nix/utils.nix b/nix/utils.nix
index d83e612c16..0b70183ef3 100644
--- a/nix/utils.nix
+++ b/nix/utils.nix
@@ -1,4 +1,8 @@
-{ nixpkgs, nixpkgs-custom-glibc }:
+{
+  nixpkgs,
+  nixpkgs-custom-glibc,
+  rust-overlay,
+}:
 function:
 nixpkgs.lib.genAttrs
   [
@@ -10,7 +14,12 @@ nixpkgs.lib.genAttrs
   (
     system:
     function {
-      pkgs = import nixpkgs { inherit system; };
+      # rust-overlay adds `pkgs.rust-bin`, from which we build the pinned Rust
+      # toolchain (see packages.nix). Consumed by both the CI image and dev shell.
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ (import rust-overlay) ];
+      };
       # glibc 2.31 — matches the system libc on Ubuntu 20.04 LTS. Sourced
       # from the nixpkgs snapshot pinned via the `nixpkgs-custom-glibc`
       # flake input, so the build uses the compiler from that snapshot
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index dbc9e74c5d..3206cf59c0 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,8 +1,4 @@
-# Rust toolchain pin for rustup-based CI runners and local development.
-# rustup reads this file and installs the pinned toolchain (see the
-# prepare-runner action in XRPLF/actions, which runs `rustup toolchain install`).
-# NOTE: the Nix CI image and development shell ignore this file; its rustc comes from flake.lock.
 [toolchain]
 channel = "1.95"
-components = ["rustfmt", "clippy"]
+components = ["rustfmt", "clippy", "rust-analyzer"]
 profile = "minimal"

From 3122de86bfd3b41c5f14361dedadb4752b32ae96 Mon Sep 17 00:00:00 2001
From: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>
Date: Wed, 22 Jul 2026 17:04:02 +0000
Subject: [PATCH 099/100] build: Create versioned compiler/tooling symlinks in
 nix environments (#7844)

---
 .cspell.config.yaml |  1 +
 nix/ci-env.nix      | 21 +++++++++++++++++++
 nix/devshell.nix    | 23 ++++++++++++++++++++-
 nix/packages.nix    | 50 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 94 insertions(+), 1 deletion(-)

diff --git a/.cspell.config.yaml b/.cspell.config.yaml
index e26eef9227..c862379f08 100644
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -341,6 +341,7 @@ words:
   - unsquelch
   - unsquelched
   - unsquelching
+  - unsuffixed
   - unvalidated
   - unveto
   - unvetoed
diff --git a/nix/ci-env.nix b/nix/ci-env.nix
index 9b754af97d..63bddb46d8 100644
--- a/nix/ci-env.nix
+++ b/nix/ci-env.nix
@@ -7,8 +7,10 @@ let
   inherit (import ./packages.nix { inherit pkgs; })
     commonPackages
     gccPackage
+    gccVersion
     llvmPackages
     llvmVersion
+    mkVersionedToolLinks
     ;
 
   # Underlying compiler toolchains to wrap (versions pinned in packages.nix).
@@ -127,6 +129,25 @@ in
       customGcov
       customClangForCiEnv
       customBinutils
+      (mkVersionedToolLinks {
+        name = "gcc";
+        package = customGcc;
+        version = gccVersion;
+        tools = [
+          "gcc"
+          "g++"
+          "cpp"
+        ];
+      })
+      (mkVersionedToolLinks {
+        name = "clang";
+        package = customClang;
+        version = llvmVersion;
+        tools = [
+          "clang"
+          "clang++"
+        ];
+      })
       # CA certificate bundle so HTTPS clients (git, curl, conan) can verify
       # TLS connections without ca-certificates being installed in the system.
       pkgs.cacert
diff --git a/nix/devshell.nix b/nix/devshell.nix
index 34f173ef08..1316fe4234 100644
--- a/nix/devshell.nix
+++ b/nix/devshell.nix
@@ -3,7 +3,9 @@ let
   inherit (import ./packages.nix { inherit pkgs; })
     commonPackages
     gccVersion
+    llvmVersion
     llvmPackages
+    mkVersionedToolLinks
     ;
 
   # Plain nixpkgs stdenvs — no custom glibc, unlike ci-env.nix.
@@ -15,6 +17,8 @@ let
     {
       stdenv,
       compilerName,
+      version ? null,
+      versionedTools ? [ ],
     }:
     let
       compilerVersion =
@@ -25,9 +29,15 @@ let
             echo "Compiler: "
             ${compilerName} --version
           '';
+      versionedLinks = pkgs.lib.optional (version != null) (mkVersionedToolLinks {
+        name = compilerName;
+        package = stdenv.cc;
+        inherit version;
+        tools = versionedTools;
+      });
     in
     (pkgs.mkShell.override { inherit stdenv; }) {
-      packages = commonPackages;
+      packages = commonPackages ++ versionedLinks;
       shellHook = ''
         echo "Welcome to xrpld development shell";
         ${compilerVersion}
@@ -41,11 +51,22 @@ rec {
   gcc = makeShell {
     stdenv = gccStdenv;
     compilerName = "gcc";
+    version = gccVersion;
+    versionedTools = [
+      "gcc"
+      "g++"
+      "cpp"
+    ];
   };
 
   clang = makeShell {
     stdenv = clangStdenv;
     compilerName = "clang";
+    version = llvmVersion;
+    versionedTools = [
+      "clang"
+      "clang++"
+    ];
   };
 
   # Nix provides no compiler; use the one from your system (e.g. Apple Clang).
diff --git a/nix/packages.nix b/nix/packages.nix
index dbd9597c25..1d9b6cd2f8 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -17,6 +17,53 @@ let
   '';
 
   rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml;
+
+  # Nix wraps its toolchain so that binaries are exposed only under unsuffixed
+  # names (gcc, g++, clang-tidy, ...). Several tools probe for a
+  # version-suffixed name first and fall back to a system binary on the PATH
+  # when Nix doesn't provide it:
+  #   - Conan's Boost recipe looks up `g++-<major>` before plain `g++`.
+  #   - bin/pre-commit/clang_tidy_check.py looks up `run-clang-tidy-<v>` and
+  #     `clang-apply-replacements-<v>` before the unsuffixed names.
+  # On a host that also has the matching system binary (e.g. Ubuntu's
+  # `/usr/bin/g++-15` or `clang-tidy-22`) the probe escapes Nix and mixes a
+  # system tool into the Nix environment. Generate version-suffixed symlinks
+  # next to a package's tools so those probes resolve to the Nix ones.
+  #
+  # Compiler links must point at whichever compiler is active in a given
+  # environment (the plain stdenv compiler in the dev shell, the custom-glibc
+  # wrappers in ci-env.nix), so those callers pass their own `package`; the
+  # clang tooling is environment-independent and is linked in commonPackages.
+  mkVersionedToolLinks =
+    {
+      name,
+      package,
+      version,
+      tools,
+    }:
+    pkgs.linkFarm "${name}-${toString version}-versioned-links" (
+      map (tool: {
+        name = "bin/${tool}-${toString version}";
+        path = "${package}/bin/${tool}";
+      }) tools
+    );
+
+  clangToolLinks = mkVersionedToolLinks {
+    name = "clang-tools";
+    package = clangTools;
+    version = llvmVersion;
+    tools = [
+      "clang-tidy"
+      "clang-apply-replacements"
+      "clang-format"
+    ];
+  };
+  runClangTidyLink = mkVersionedToolLinks {
+    name = "run-clang-tidy";
+    package = runClangTidy;
+    version = llvmVersion;
+    tools = [ "run-clang-tidy" ];
+  };
 in
 {
   inherit
@@ -24,9 +71,12 @@ in
     llvmVersion
     gccPackage
     llvmPackages
+    mkVersionedToolLinks
     ;
 
   commonPackages = with pkgs; [
+    clangToolLinks
+    runClangTidyLink
     ccache
     clangbuildanalyzer
     clangTools

From 12ed506565d32e4f52b4d5633dd3558a0cb328e9 Mon Sep 17 00:00:00 2001
From: Mayukha Vadari <mvadari@ripple.com>
Date: Wed, 22 Jul 2026 18:50:10 +0000
Subject: [PATCH 100/100] chore: Clean up grammar in PR template (#7846)

---
 .github/pull_request_template.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index f1f7aa18f7..95d75c04b4 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,10 +1,10 @@
 <!--
-This PR template helps you to write a good pull request description.
+This PR template helps you write a good pull request description.
 Please feel free to include additional useful information even beyond what is requested below.
 
 If your branch is on a personal fork and has a name that allows it to
 run CI build/test jobs (e.g. "ci/foo"), remember to rename it BEFORE
-opening the PR.  This avoids unnecessary redundant test runs. Renaming
+opening the PR. This avoids redundant test runs. Renaming
 the branch after opening the PR will close the PR.
 https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch
 -->
@@ -15,7 +15,7 @@ https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-
 Please include a summary of the changes.
 This may be a direct input to the release notes.
 If too broad, please consider splitting into multiple PRs.
-If a relevant task or issue, please link it here.
+If there is a relevant task or issue, please link it here.
 -->
 
 ### Context of Change
@@ -65,5 +65,5 @@ This section may not be needed if your change includes thoroughly commented unit
 
 <!--
 ## Future Tasks
-For future tasks related to PR.
+For future tasks related to this PR.
 -->