Merge branch 'ripple/wasmi-host-functions' into ripple/se/wasmi-tests

Conflict resolution: - fixtures.cpp: took the regenerated blobs from ripple/wasmi-host-functions for the fixtures both branches carry (kAllHostFunctionsWasmHex, kAllKeyletsWasmHex, kCodecovTestsWasmHex); kept this branch's other 57 fixtures unchanged. - Wasm_test.cpp: took the gas expectations from ripple/wasmi-host-functions, which reflect the trace host function refactor, and kept the test blocks that only exist on this branch. testFloat is commented out. kFloatTestsWasmHex and kFloat0Hex were built against the old trace ABI, where the trace_* host functions returned i32 rather than void, so neither module instantiates any more. Regenerating them needs the float_tests/ and float_0/ sources ported to the current stdlib first; see the TODO in Wasm_test.cpp.
2026-08-19 13:20:54 +00:00 · 2026-08-09 17:05:54 -04:00
parent e227e2ce8b abfa572370
commit fe1436fb3e
688 changed files with 32879 additions and 23578 deletions
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -75,6 +75,8 @@ Checks: "-*,
 # readability-static-accessed-through-instance,        # this check is probably unnecessary. It makes the code less readable
 # ---

+FormatStyle: file
+
 CheckOptions:
  bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
  bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc
@@ -83,6 +85,8 @@ CheckOptions:

  readability-braces-around-statements.ShortStatementLines: 2
  readability-identifier-naming.MacroDefinitionCase: UPPER_CASE
+  readability-identifier-naming.NamespaceCase: lower_case
+  readability-identifier-naming.InlineNamespaceCase: lower_case
  readability-identifier-naming.ClassCase: CamelCase
  readability-identifier-naming.StructCase: CamelCase
  readability-identifier-naming.UnionCase: CamelCase
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -32,7 +32,9 @@ ignoreRegExpList:
  - ABCDEFGHIJKLMNOPQRSTUVWXYZ
  - ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
 overrides:
-  - filename: "**/*_test.cpp" # all test files
+  - filename:
+      - "**/*_test.cpp" # legacy boost.test files
+      - "src/tests/**/*.cpp" # gtest test files
    ignoreRegExpList:
      - /"[^"]*"/g # double-quoted strings
      - /'[^']*'/g # single-quoted strings
@@ -133,6 +135,7 @@ words:
  - godexsoft
  - gpgcheck
  - gpgkey
+  - Hinnant
  - hotwallet
  - hwaddress
  - hwrap
@@ -166,6 +169,7 @@ words:
  - llection
  - LOCALGOOD
  - logwstream
+  - Lombrozo
  - lseq
  - lsmf
  - ltype
@@ -175,7 +179,6 @@ words:
  - MPTAMM
  - MPTDEX
  - Merkle
-  - Metafuncton
  - misprediction
  - missingok
  - mptbalance
@@ -203,6 +206,7 @@ words:
  - nftokens
  - nftpage
  - nikb
+  - Nikolaos
  - nixfmt
  - nixos
  - nixpkgs
--- a/.envrc
+++ b/.envrc
@@ -1 +1,3 @@
+watch_file nix/*.nix
+
 use flake
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,3 +15,7 @@ updates:
    commit-message:
      prefix: "ci: [DEPENDABOT] "
    target-branch: develop
+    groups:
+      github-actions:
+        patterns:
+          - "*"
--- a/.github/scripts/levelization/README.md
+++ b/.github/scripts/levelization/README.md
@@ -40,18 +40,18 @@ listed later.
 | 04           | xrpl/protocol                       |
 | 05           | xrpl/core xrpl/resource xrpl/server |
 | 06           | xrpl/ledger xrpl/nodestore xrpl/net |
-| 07           | xrpl/shamap                         |
+| 07           | xrpl/shamap xrpl/consensus          |

 ## xrpld Modules (Application Implementation)

-| Level / Tier | Module(s)                        |
-| ------------ | -------------------------------- |
-| 05           | xrpld/conditions xrpld/consensus |
-| 06           | xrpld/core xrpld/peerfinder      |
-| 07           | xrpld/shamap xrpld/overlay       |
-| 08           | xrpld/app                        |
-| 09           | xrpld/rpc                        |
-| 10           | xrpld/perflog                    |
+| Level / Tier | Module(s)                   |
+| ------------ | --------------------------- |
+| 05           | xrpld/conditions            |
+| 06           | xrpld/core xrpld/peerfinder |
+| 07           | xrpld/shamap xrpld/overlay  |
+| 08           | xrpld/app                   |
+| 09           | xrpld/rpc                   |
+| 10           | xrpld/perflog               |

 ## Test Modules

--- a/.github/scripts/levelization/results/loops.txt
+++ b/.github/scripts/levelization/results/loops.txt
@@ -1,9 +1,6 @@
 Loop: xrpld.app xrpld.overlay
  xrpld.app > xrpld.overlay

-Loop: xrpld.app xrpld.peerfinder
-  xrpld.peerfinder ~= xrpld.app
-
 Loop: xrpld.app xrpld.rpc
  xrpld.rpc > xrpld.app

--- a/.github/scripts/levelization/results/ordering.txt
+++ b/.github/scripts/levelization/results/ordering.txt
@@ -6,6 +6,8 @@ libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions
 libxrpl.config > xrpl.basics
 libxrpl.config > xrpl.config
+libxrpl.consensus > xrpl.basics
+libxrpl.consensus > xrpl.consensus
 libxrpl.core > xrpl.basics
 libxrpl.core > xrpl.core
 libxrpl.core > xrpl.json
@@ -25,6 +27,9 @@ libxrpl.nodestore > xrpl.config
 libxrpl.nodestore > xrpl.json
 libxrpl.nodestore > xrpl.nodestore
 libxrpl.nodestore > xrpl.protocol
+libxrpl.peerfinder > xrpl.basics
+libxrpl.peerfinder > xrpl.peerfinder
+libxrpl.peerfinder > xrpl.protocol
 libxrpl.protocol > xrpl.basics
 libxrpl.protocol > xrpl.json
 libxrpl.protocol > xrpl.protocol
@@ -60,9 +65,9 @@ test.app > test.jtx
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config
+test.app > xrpl.consensus
 test.app > xrpl.core
 test.app > xrpld.app
-test.app > xrpld.consensus
 test.app > xrpld.core
 test.app > xrpld.overlay
 test.app > xrpld.rpc
@@ -83,12 +88,9 @@ test.basics > xrpl.protocol
 test.beast > xrpl.basics
 test.conditions > xrpl.basics
 test.conditions > xrpl.conditions
-test.consensus > test.csf
 test.consensus > test.jtx
-test.consensus > test.unit_test
 test.consensus > xrpl.basics
 test.consensus > xrpld.app
-test.consensus > xrpld.consensus
 test.consensus > xrpl.ledger
 test.consensus > xrpl.protocol
 test.consensus > xrpl.shamap
@@ -103,10 +105,6 @@ test.core > xrpl.json
 test.core > xrpl.protocol
 test.core > xrpl.rdb
 test.core > xrpl.server
-test.csf > xrpl.basics
-test.csf > xrpld.consensus
-test.csf > xrpl.json
-test.csf > xrpl.ledger
 test.json > test.jtx
 test.json > xrpl.json
 test.jtx > test.unit_test
@@ -132,12 +130,9 @@ test.ledger > xrpl.json
 test.ledger > xrpl.ledger
 test.ledger > xrpl.protocol
 test.nodestore > test.jtx
-test.nodestore > test.unit_test
 test.nodestore > xrpl.basics
-test.nodestore > xrpl.config
 test.nodestore > xrpld.core
 test.nodestore > xrpl.nodestore
-test.nodestore > xrpl.protocol
 test.nodestore > xrpl.rdb
 test.overlay > test.jtx
 test.overlay > test.unit_test
@@ -146,19 +141,13 @@ test.overlay > xrpl.config
 test.overlay > xrpld.app
 test.overlay > xrpld.core
 test.overlay > xrpld.overlay
-test.overlay > xrpld.peerfinder
 test.overlay > xrpl.json
 test.overlay > xrpl.nodestore
+test.overlay > xrpl.peerfinder
 test.overlay > xrpl.protocol
 test.overlay > xrpl.resource
 test.overlay > xrpl.server
 test.overlay > xrpl.shamap
-test.peerfinder > test.beast
-test.peerfinder > test.unit_test
-test.peerfinder > xrpl.basics
-test.peerfinder > xrpld.core
-test.peerfinder > xrpld.peerfinder
-test.peerfinder > xrpl.protocol
 test.protocol > test.jtx
 test.protocol > test.unit_test
 test.protocol > xrpl.basics
@@ -192,11 +181,13 @@ test.unit_test > xrpl.basics
 test.unit_test > xrpl.protocol
 tests.libxrpl > xrpl.basics
 tests.libxrpl > xrpl.config
+tests.libxrpl > xrpl.consensus
 tests.libxrpl > xrpl.core
 tests.libxrpl > xrpl.json
 tests.libxrpl > xrpl.ledger
 tests.libxrpl > xrpl.net
 tests.libxrpl > xrpl.nodestore
+tests.libxrpl > xrpl.peerfinder
 tests.libxrpl > xrpl.protocol
 tests.libxrpl > xrpl.protocol_autogen
 tests.libxrpl > xrpl.resource
@@ -206,6 +197,10 @@ tests.libxrpl > xrpl.tx
 xrpl.conditions > xrpl.basics
 xrpl.conditions > xrpl.protocol
 xrpl.config > xrpl.basics
+xrpl.consensus > xrpl.basics
+xrpl.consensus > xrpl.json
+xrpl.consensus > xrpl.ledger
+xrpl.consensus > xrpl.protocol
 xrpl.core > xrpl.basics
 xrpl.core > xrpl.json
 xrpl.core > xrpl.protocol
@@ -220,6 +215,8 @@ xrpl.nodestore > xrpl.basics
 xrpl.nodestore > xrpl.config
 xrpl.nodestore > xrpl.json
 xrpl.nodestore > xrpl.protocol
+xrpl.peerfinder > xrpl.basics
+xrpl.peerfinder > xrpl.protocol
 xrpl.protocol > xrpl.basics
 xrpl.protocol > xrpl.json
 xrpl.protocol_autogen > xrpl.json
@@ -246,23 +243,20 @@ xrpl.tx > xrpl.protocol
 xrpld.app > test.unit_test
 xrpld.app > xrpl.basics
 xrpld.app > xrpl.config
+xrpld.app > xrpl.consensus
 xrpld.app > xrpl.core
-xrpld.app > xrpld.consensus
 xrpld.app > xrpld.core
 xrpld.app > xrpl.json
 xrpld.app > xrpl.ledger
 xrpld.app > xrpl.net
 xrpld.app > xrpl.nodestore
+xrpld.app > xrpl.peerfinder
 xrpld.app > xrpl.protocol
 xrpld.app > xrpl.rdb
 xrpld.app > xrpl.resource
 xrpld.app > xrpl.server
 xrpld.app > xrpl.shamap
 xrpld.app > xrpl.tx
-xrpld.consensus > xrpl.basics
-xrpld.consensus > xrpl.json
-xrpld.consensus > xrpl.ledger
-xrpld.consensus > xrpl.protocol
 xrpld.core > xrpl.basics
 xrpld.core > xrpl.config
 xrpld.core > xrpl.core
@@ -271,21 +265,22 @@ xrpld.core > xrpl.protocol
 xrpld.core > xrpl.rdb
 xrpld.overlay > xrpl.basics
 xrpld.overlay > xrpl.config
+xrpld.overlay > xrpl.consensus
 xrpld.overlay > xrpl.core
-xrpld.overlay > xrpld.consensus
 xrpld.overlay > xrpld.core
 xrpld.overlay > xrpld.peerfinder
 xrpld.overlay > xrpl.json
 xrpld.overlay > xrpl.ledger
+xrpld.overlay > xrpl.peerfinder
 xrpld.overlay > xrpl.protocol
 xrpld.overlay > xrpl.resource
 xrpld.overlay > xrpl.server
 xrpld.overlay > xrpl.shamap
 xrpld.overlay > xrpl.tx
 xrpld.peerfinder > xrpl.basics
-xrpld.peerfinder > xrpl.config
+xrpld.peerfinder > xrpld.app
 xrpld.peerfinder > xrpld.core
-xrpld.peerfinder > xrpl.protocol
+xrpld.peerfinder > xrpl.peerfinder
 xrpld.peerfinder > xrpl.rdb
 xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config
--- a/.github/scripts/rename/namespace.sh
+++ b/.github/scripts/rename/namespace.sh
@@ -46,9 +46,6 @@ for DIRECTORY in "${DIRECTORIES[@]}"; do
    done
 done

-# Special case for NuDBFactory that has ripple twice in the test suite name.
-${SED_COMMAND} -i -E 's/(BEAST_DEFINE_TESTSUITE.+)ripple(.+)/\1xrpl\2/g' src/test/nodestore/NuDBFactory_test.cpp
-
 DIRECTORY=$1
 find "${DIRECTORY}" -type f -name "*.md" | while read -r FILE; do
    echo "Processing file: ${FILE}"
--- a/.github/scripts/strategy-matrix/generate.py
+++ b/.github/scripts/strategy-matrix/generate.py
@@ -33,6 +33,10 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
 # Every config must declare 'minimal'. Minimal configs form the reduced matrix
 # built for pull requests by default; the full matrix adds the rest. Packaging
 # configs declare it too, but packaging is gated in the workflow, not by it.
+#
+# Configs may also opt into 'benchmark' to smoke-run the benchmarks. Note that
+# the flag applies to every entry a config expands into, so only set it on
+# configs that expand to a single combination.


@dataclasses.dataclass
@@ -43,6 +47,7 @@ class LinuxConfig:
    build_type: list[str]
    arch: list[str]
    minimal: bool
+    benchmark: bool = False  # if true, smoke-run the benchmarks after testing
    sanitizers: list[str] = dataclasses.field(default_factory=list)
    suffix: str = ""
    extra_cmake_args: str = ""
@@ -81,6 +86,7 @@ class PlatformConfig:
    build_type: list[str]
    minimal: bool
    build_only: bool = False  # if true, skip tests (e.g. macos/Windows Debug)
+    benchmark: bool = False  # if true, smoke-run the benchmarks after testing
    extra_cmake_args: str = ""

    def __post_init__(self) -> None:
@@ -125,6 +131,7 @@ class MatrixEntry:
    cmake_args: str
    cmake_target: str
    build_only: bool
+    benchmark: bool
    build_type: str
    architecture: Architecture
    sanitizers: str
@@ -136,7 +143,8 @@ class MatrixEntry:
 class PackagingEntry:
    """One entry in the generated packaging strategy matrix."""

-    artifact_name: str
+    xrpld_artifact_name: str
+    validator_keys_artifact_name: str
    image: str
    distro: str  # e.g. "debian" or "rhel"; drives package-format-specific steps

@@ -193,6 +201,7 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                        cmake_args=get_cmake_args(build_type, cfg.extra_cmake_args),
                        cmake_target="all",
                        build_only=False,
+                        benchmark=cfg.benchmark,
                        build_type=build_type,
                        architecture=arch_info,
                        sanitizers=sanitizer,
@@ -210,14 +219,19 @@ def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
    the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
    is taken from the distro's archive rather than from nixpkgs. Each config
    entry carries its own 'image'.
+
+    The artifact names must match what the build job uploads: one artifact per
+    binary, each named after the build config.
    """
    entries = []
    for distro, configs in linux.package_configs.items():
        for cfg in configs:
            for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
+                config_name = f"{distro}-{compiler}-{build_type.lower()}-amd64"
                entries.append(
                    PackagingEntry(
-                        artifact_name=f"xrpld-{distro}-{compiler}-{build_type.lower()}-amd64",
+                        xrpld_artifact_name=f"xrpld-{config_name}",
+                        validator_keys_artifact_name=f"validator-keys-{config_name}",
                        image=cfg.image,
                        distro=distro,
                    )
@@ -245,6 +259,7 @@ def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]
                    cmake_args=get_cmake_args(build_type, cfg.extra_cmake_args),
                    cmake_target="install" if is_windows else "all",
                    build_only=cfg.build_only,
+                    benchmark=cfg.benchmark,
                    build_type=build_type,
                    architecture=Architecture(platform=pf.platform, runner=pf.runner),
                    sanitizers="",
--- a/.github/scripts/strategy-matrix/linux.json
+++ b/.github/scripts/strategy-matrix/linux.json
@@ -1,13 +1,23 @@
 {
-  "image_tag": "sha-3122de8",
+  "image_tag": "sha-fecfc0c",
  "configs": {
    "ubuntu": [
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Debug"],
+        "arch": ["amd64"],
+        "minimal": true,
+        "suffix": "coverage",
+        "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=500 -Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0"
+      },
      {
        "compiler": ["clang"],
        "build_type": ["Release"],
        "arch": ["amd64"],
-        "minimal": true
+        "minimal": true,
+        "benchmark": true
      },
+
      {
        "compiler": ["gcc"],
        "build_type": ["Release"],
@@ -29,14 +39,6 @@
        "sanitizers": ["address", "undefinedbehavior"]
      },

-      {
-        "compiler": ["gcc"],
-        "build_type": ["Debug"],
-        "arch": ["amd64"],
-        "minimal": true,
-        "suffix": "coverage",
-        "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=500 -Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0"
-      },
      {
        "compiler": ["clang"],
        "build_type": ["Debug"],
@@ -68,7 +70,8 @@
        "compiler": ["gcc"],
        "build_type": ["Release"],
        "arch": ["amd64"],
-        "minimal": false
+        "minimal": false,
+        "extra_cmake_args": "-Dvalidator_keys=ON"
      }
    ],

@@ -77,7 +80,8 @@
        "compiler": ["gcc"],
        "build_type": ["Release"],
        "arch": ["amd64"],
-        "minimal": false
+        "minimal": false,
+        "extra_cmake_args": "-Dvalidator_keys=ON"
      }
    ]
  },
--- a/.github/workflows/build-nix-images.yml
+++ b/.github/workflows/build-nix-images.yml
@@ -13,6 +13,7 @@ on:
      - "!nix/docker/README.md"
      - "!nix/devshell.nix"
      - "bin/check-tools.sh"
+      - "bin/default-loader-path.sh"
      - "bin/install-sanitizer-libs.sh"
  pull_request:
    paths:
@@ -24,6 +25,7 @@ on:
      - "!nix/docker/README.md"
      - "!nix/devshell.nix"
      - "bin/check-tools.sh"
+      - "bin/default-loader-path.sh"
      - "bin/install-sanitizer-libs.sh"
  workflow_dispatch:

--- a/.github/workflows/check-pr-description.yml
+++ b/.github/workflows/check-pr-description.yml
@@ -23,7 +23,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Write PR body to file
        env:
--- a/.github/workflows/check-tools.yml
+++ b/.github/workflows/check-tools.yml
@@ -0,0 +1,114 @@
+# Verifies the committed snapshots of `bin/check-tools.sh` output for each Nix
+# environment (see nix/check-tools/). If the environment changes — a new image
+# tag, an updated flake.lock, a different tool list — without the matching
+# snapshot being regenerated and committed, this workflow fails so the drift is
+# caught in review.
+#
+# To regenerate the snapshots, see nix/check-tools/README.md.
+name: Check tools
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/check-tools.yml"
+      - ".github/scripts/strategy-matrix/linux.json"
+      - "bin/check-tools.sh"
+      - "nix/**"
+      - "flake.nix"
+      - "flake.lock"
+      - "rust-toolchain.toml"
+  push:
+    branches:
+      - "develop"
+    paths:
+      - ".github/workflows/check-tools.yml"
+      - ".github/scripts/strategy-matrix/linux.json"
+      - "bin/check-tools.sh"
+      - "nix/**"
+      - "flake.nix"
+      - "flake.lock"
+      - "rust-toolchain.toml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  # The nix-nixos image tag is pinned alongside the build matrix in linux.json,
+  # so snapshots are checked against the exact image CI builds against.
+  linux-image-tag:
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Read nix image tag
+        id: tag
+        run: echo "tag=$(jq -r .image_tag .github/scripts/strategy-matrix/linux.json)" >>"${GITHUB_OUTPUT}"
+
+  # One job for all environments; they differ only in whether the tools come
+  # from the nix-nixos container (Linux) or `nix develop` (macOS).
+  check-tools:
+    needs: linux-image-tag
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            snapshot: nix/check-tools/nix-ubuntu-amd64.txt
+            nix_develop: false
+          - runner: ubuntu-24.04-arm
+            snapshot: nix/check-tools/nix-ubuntu-arm64.txt
+            nix_develop: false
+          - runner: macos-26-apple-clang-21
+            snapshot: nix/check-tools/macos.txt
+            nix_develop: true
+    runs-on: ${{ matrix.runner }}
+    # Linux runs inside the pinned nix-nixos image; macOS runs natively and uses
+    # the flake's dev shell instead (see the run step below).
+    container: ${{ !matrix.nix_develop && format('ghcr.io/xrplf/xrpld/nix-ubuntu:{0}', needs.linux-image-tag.outputs.tag) || null }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        with:
+          enable_ccache: false
+
+      - name: Regenerate snapshot
+        env:
+          CHECK_TOOLS_SKIP_CLONE: "1"
+          # check-tools.sh skips some macOS tools when CI is set; the snapshots
+          # capture the full `nix develop` environment, so unset it here.
+          CI: ""
+        run: |
+          if [ "${{ matrix.nix_develop }}" = "true" ]; then
+              # `nix develop` prints the dev-shell greeting first; keep only the
+              # check-tools.sh output (from the "Detected OS:" line onward).
+              nix --extra-experimental-features "nix-command flakes" develop \
+                  -c bash bin/check-tools.sh | sed -n '/^Detected OS:/,$p' >"${{ matrix.snapshot }}"
+          else
+              bash bin/check-tools.sh >"${{ matrix.snapshot }}"
+          fi
+
+      - name: Verify snapshot is up to date
+        run: |
+          if ! git diff --exit-code -- "${{ matrix.snapshot }}"; then
+              echo "::error::${{ matrix.snapshot }} is out of date. Regenerate it (see nix/check-tools/README.md) and commit the result."
+              exit 1
+          fi
+
+      - name: Upload regenerated snapshot
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: check-tools-${{ runner.os }}-${{ runner.arch }}
+          path: ${{ matrix.snapshot }}
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -52,7 +52,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Determine changed files
        # This step checks whether any files have changed that should
        # cause the next jobs to run. We do it this way rather than
@@ -82,6 +82,7 @@ jobs:
            .github/scripts/strategy-matrix/**
            .github/workflows/reusable-build-test-config.yml
            .github/workflows/reusable-build-test.yml
+            .github/workflows/reusable-check-autogen.yml
            .github/workflows/reusable-clang-tidy.yml
            .github/workflows/reusable-package.yml
            .github/workflows/reusable-strategy-matrix.yml
@@ -90,6 +91,7 @@ jobs:
            .clang-tidy
            .codecov.yml
            bin/check-tools.sh
+            bin/default-loader-path.sh
            cfg/**
            cmake/**
            conan/**
@@ -125,6 +127,11 @@ jobs:
    outputs:
      go: ${{ steps.go.outputs.go == 'true' }}

+  check-autogen:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.go == 'true' }}
+    uses: ./.github/workflows/reusable-check-autogen.yml
+
  check-levelization:
    needs: should-run
    if: ${{ needs.should-run.outputs.go == 'true' }}
@@ -199,6 +206,7 @@ jobs:
  passed:
    if: failure() || cancelled()
    needs:
+      - check-autogen
      - check-levelization
      - check-rename
      - clang-tidy
--- a/.github/workflows/on-trigger.yml
+++ b/.github/workflows/on-trigger.yml
@@ -20,6 +20,7 @@ on:
      - ".github/scripts/strategy-matrix/**"
      - ".github/workflows/reusable-build-test-config.yml"
      - ".github/workflows/reusable-build-test.yml"
+      - ".github/workflows/reusable-check-autogen.yml"
      - ".github/workflows/reusable-clang-tidy.yml"
      - ".github/workflows/reusable-package.yml"
      - ".github/workflows/reusable-strategy-matrix.yml"
@@ -28,6 +29,7 @@ on:
      - ".clang-tidy"
      - ".codecov.yml"
      - "bin/check-tools.sh"
+      - "bin/default-loader-path.sh"
      - "cfg/**"
      - "cmake/**"
      - "conan/**"
@@ -66,6 +68,9 @@ defaults:
    shell: bash

 jobs:
+  check-autogen:
+    uses: ./.github/workflows/reusable-check-autogen.yml
+
  clang-tidy:
    uses: ./.github/workflows/reusable-clang-tidy.yml
    permissions:
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -41,13 +41,13 @@ env:
 jobs:
  build:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
+        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
        with:
          enable_ccache: false

--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -3,6 +3,12 @@ name: Build and test configuration
 on:
  workflow_call:
    inputs:
+      benchmark:
+        description: "Whether to smoke-run the benchmarks after testing."
+        required: false
+        type: boolean
+        default: false
+
      build_only:
        description: 'Whether to only build or to build and test the code ("true", "false").'
        required: true
@@ -100,9 +106,10 @@ jobs:
      # header files are copied into separate directories by CMake, which will
      # otherwise result in cache misses.
      CCACHE_SLOPPINESS: include_file_ctime,include_file_mtime
-      # Determine if coverage and voidstar should be enabled.
+      # Determine if coverage, voidstar and validator-keys should be enabled.
      COVERAGE_ENABLED: ${{ contains(inputs.cmake_args, '-Dcoverage=ON') }}
      VOIDSTAR_ENABLED: ${{ contains(inputs.cmake_args, '-Dvoidstar=ON') }}
+      VALIDATOR_KEYS_ENABLED: ${{ contains(inputs.cmake_args, '-Dvalidator_keys=ON') }}
      SANITIZERS_ENABLED: ${{ inputs.sanitizers != '' }}
    steps:
      - name: Cleanup workspace (macOS and Windows)
@@ -110,10 +117,10 @@ jobs:
        uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4

      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
+        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
        with:
          enable_ccache: ${{ inputs.ccache_enabled }}

@@ -170,9 +177,9 @@ jobs:
              ..

      # Export the sanitizer options before any instrumented binary runs. The
-      # protocol code-gen and build steps below invoke instrumented dependency
-      # tools (protoc, grpc), so setting UBSAN_OPTIONS here lets the UBSan
-      # suppression list silence their diagnostics too, not just at test time.
+      # build step below invokes instrumented dependency tools (protoc, grpc),
+      # so setting UBSAN_OPTIONS here lets the UBSan suppression list silence
+      # their diagnostics too, not just at test time.
      # GITHUB_WORKSPACE (not the github.workspace context) is used so the path
      # resolves correctly inside the container job.
      - name: Set sanitizer options
@@ -190,32 +197,6 @@ jobs:
          echo "UBSAN_OPTIONS=include=${SUPP}/runtime-ubsan-options.txt:suppressions=${SUPP}/ubsan.supp" >>${GITHUB_ENV}
          echo "LSAN_OPTIONS=include=${SUPP}/runtime-lsan-options.txt:suppressions=${SUPP}/lsan.supp" >>${GITHUB_ENV}

-      - name: Check protocol autogen files are up-to-date
-        working-directory: ${{ env.BUILD_DIR }}
-        env:
-          MESSAGE: |
-
-            The generated protocol wrapper classes are out of date.
-
-            This typically happens when the macro files or generator scripts
-            have changed but the generated files were not regenerated.
-
-            To fix this:
-              1. Run: cmake --build . --target setup_code_gen
-              2. Run: cmake --build . --target code_gen
-              3. Commit and push the regenerated files
-        run: |
-          set -e
-          cmake --build . --target setup_code_gen
-          cmake --build . --target code_gen
-          DIFF=$(git -C .. status --porcelain -- include/xrpl/protocol_autogen src/tests/libxrpl/protocol_autogen)
-          if [ -n "${DIFF}" ]; then
-              echo "::error::Generated protocol files are out of date"
-              git -C .. diff -- include/xrpl/protocol_autogen src/tests/libxrpl/protocol_autogen
-              echo "${MESSAGE}"
-              exit 1
-          fi
-
      - name: Build the binary
        working-directory: ${{ env.BUILD_DIR }}
        env:
@@ -249,6 +230,22 @@ jobs:
          retention-days: 3
          if-no-files-found: error

+      - name: Run the validator-keys tests
+        if: ${{ env.VALIDATOR_KEYS_ENABLED == 'true' }}
+        working-directory: ${{ env.BUILD_DIR }}
+        run: ./validator-keys --unittest
+
+      - name: Upload the validator-keys binary
+        if: ${{ github.event.repository.visibility == 'public' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: validator-keys-${{ inputs.config_name }}
+          path: |
+            ${{ env.BUILD_DIR }}/validator-keys
+            ${{ env.BUILD_DIR }}/validator-keys-LICENSE
+          retention-days: 3
+          if-no-files-found: error
+
      - name: Upload the test binary (Linux)
        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -266,7 +263,7 @@ jobs:
          ./xrpld --definitions | python3 -m json.tool >server_definitions.json

      - name: Upload server definitions
-        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'debian-gcc-release-amd64' }}
+        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: server-definitions
@@ -328,11 +325,14 @@ jobs:

      # Smoke-run every benchmark module with a single repetition to confirm the
      # benchmarks still build and execute. This is a correctness check, not a
-      # performance measurement, so it is skipped for instrumented builds
-      # (sanitizers/coverage/voidstar), where it would be slow and meaningless,
-      # and on Windows, where the `install` target does not build them.
+      # performance measurement, so there is nothing to gain from repeating it
+      # across configurations: it is opted into by a single config in the
+      # strategy matrix (see the 'benchmark' flag in the JSON files), which
+      # keeps it off instrumented builds (sanitizers/coverage/voidstar), where
+      # it would be slow and meaningless, off Debug builds, where it is much
+      # slower, and off Windows, where the `install` target does not build them.
      - name: Run the benchmarks
-        if: ${{ !inputs.build_only && runner.os != 'Windows' && env.SANITIZERS_ENABLED == 'false' && env.COVERAGE_ENABLED != 'true' && env.VOIDSTAR_ENABLED != 'true' }}
+        if: ${{ inputs.benchmark }}
        working-directory: ${{ env.BUILD_DIR }}
        run: |
          rc=0
@@ -387,7 +387,7 @@ jobs:
              --target coverage

      - name: Upload coverage report
-        if: ${{ github.repository == 'XRPLF/rippled' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
+        if: ${{ github.repository_owner == 'XRPLF' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          disable_search: true
--- a/.github/workflows/reusable-build-test.yml
+++ b/.github/workflows/reusable-build-test.yml
@@ -40,6 +40,7 @@ jobs:
      fail-fast: ${{ github.event_name == 'merge_group' }}
      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
    with:
+      benchmark: ${{ matrix.benchmark }}
      build_only: ${{ matrix.build_only }}
      build_type: ${{ matrix.build_type }}
      ccache_enabled: ${{ inputs.ccache_enabled }}
--- a/.github/workflows/reusable-check-autogen.yml
+++ b/.github/workflows/reusable-check-autogen.yml
@@ -0,0 +1,76 @@
+# This workflow checks that the generated protocol wrapper classes are
+# up-to-date with the macro files and generator scripts they are produced from,
+# see more info in include/xrpl/protocol_autogen/README.md.
+name: Check autogen
+
+# This workflow can only be triggered by other workflows.
+on: workflow_call
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-autogen
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  BUILD_DIR: build/codegen
+
+jobs:
+  autogen:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+
+      # Code generation is pure Python, so the standalone project below offers
+      # the same targets as the main build without needing its dependencies or
+      # a compiler, which keeps this job down to a few seconds.
+      - name: Configure CMake
+        run: cmake -S cmake/codegen -B "${BUILD_DIR}"
+
+      - name: Install code generation dependencies
+        run: cmake --build "${BUILD_DIR}" --target setup_code_gen
+
+      - name: Generate code
+        run: cmake --build "${BUILD_DIR}" --target code_gen
+
+      - name: Check for differences
+        env:
+          MESSAGE: |
+
+            The generated protocol wrapper classes are out of date.
+
+            This typically happens when the macro files or generator scripts
+            have changed but the generated files were not regenerated.
+
+            Run the following from the repository root, then commit and push
+            the regenerated files. This needs neither the dependencies nor a
+            compiler. See include/xrpl/protocol_autogen/README.md for more info.
+
+              cmake -S cmake/codegen -B build/codegen
+              cmake --build build/codegen --target setup_code_gen
+              cmake --build build/codegen --target code_gen
+
+            In an already configured build directory, the 'setup_code_gen' and
+            'code_gen' targets do the same thing.
+        run: |
+          # Record untracked files in the index without staging their contents,
+          # so that classes generated for a newly added transaction or ledger
+          # entry type show up in the diff below rather than silently as an
+          # empty one.
+          git add --intent-to-add .
+          DIFF=$(git status --porcelain)
+          if [ -n "${DIFF}" ]; then
+              # Print the differences to give the contributor a hint about what to
+              # expect when running code generation on their own machine.
+              git diff
+              echo "${MESSAGE}"
+              exit 1
+          fi
--- a/.github/workflows/reusable-check-levelization.yml
+++ b/.github/workflows/reusable-check-levelization.yml
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Check levelization
        run: python .github/scripts/levelization/generate.py
      - name: Check for differences
--- a/.github/workflows/reusable-check-rename.yml
+++ b/.github/workflows/reusable-check-rename.yml
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Check definitions
        run: .github/scripts/rename/definitions.sh .
      - name: Check copyright notices
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -34,16 +34,16 @@ jobs:
    needs: [determine-files]
    if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-3122de8"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-fecfc0c"
    permissions:
      contents: read
      issues: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
+        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
        with:
          enable_ccache: false

@@ -95,7 +95,7 @@ jobs:
          TARGETS: ${{ needs.determine-files.outputs.need_full_run != 'true' && needs.determine-files.outputs.cpp_changed_files || 'include src tests' }}
        run: |
          set -o pipefail
-          run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"
+          run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -format -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"

      - name: Print filtered clang-tidy errors
        if: ${{ steps.run_clang_tidy.outcome != 'success' }}
--- a/.github/workflows/reusable-package.yml
+++ b/.github/workflows/reusable-package.yml
@@ -1,7 +1,7 @@
-# Build Linux packages (DEB and RPM) from pre-built binary artifacts.
-# Discovers which configurations to package from linux.json (configs in
-# "package_configs") and fans out one job per distro. Only linux/amd64 is
-# supported; the runner is hardcoded in the job below.
+# Build Linux packages (DEB and RPM) from pre-built binary artifacts (xrpld and
+# validator-keys). Discovers which configurations to package from linux.json
+# (configs in "package_configs") and fans out one job per distro. Only
+# linux/amd64 is supported; the runner is hardcoded in the job below.
 name: Package

 on:
@@ -27,7 +27,7 @@ jobs:
      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -45,7 +45,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
-    name: "${{ matrix.artifact_name }}"
+    name: "${{ matrix.xrpld_artifact_name }}"
    permissions:
      contents: read
    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
@@ -54,16 +54,22 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

-      - name: Download pre-built binary
+      - name: Download pre-built xrpld binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
-          name: ${{ matrix.artifact_name }}
+          name: ${{ matrix.xrpld_artifact_name }}
          path: ${{ env.BUILD_DIR }}

-      - name: Make binary executable
-        run: chmod +x "${BUILD_DIR}/xrpld"
+      - name: Download pre-built validator-keys binary
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ matrix.validator_keys_artifact_name }}
+          path: ${{ env.BUILD_DIR }}
+
+      - name: Make binaries executable
+        run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"

      - name: Build package
        env:
@@ -73,7 +79,7 @@ jobs:
      - name: Upload package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: ${{ matrix.artifact_name }}-pkg
+          name: ${{ matrix.xrpld_artifact_name }}-pkg
          path: |
            ${{ env.BUILD_DIR }}/debbuild/*.deb
            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
--- a/.github/workflows/reusable-strategy-matrix.yml
+++ b/.github/workflows/reusable-strategy-matrix.yml
@@ -23,7 +23,7 @@ jobs:
      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
--- a/.github/workflows/reusable-upload-recipe.yml
+++ b/.github/workflows/reusable-upload-recipe.yml
@@ -40,14 +40,14 @@ defaults:
 jobs:
  upload:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
    env:
      REMOTE_NAME: ${{ inputs.remote_name }}
      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
      CONAN_PASSWORD_XRPLF: ${{ secrets.remote_password }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Generate build version number
        id: version
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -65,10 +65,10 @@ jobs:
        uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4

      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
+        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
        with:
          enable_ccache: false

--- a/API-CHANGELOG.md
+++ b/API-CHANGELOG.md
@@ -42,6 +42,7 @@ This section contains changes targeting a future version.

 ### Bugfixes

+- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
 - Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
 - `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
 - gRPC `GetLedgerDiff`: Fixed error message that incorrectly said "base ledger not validated" when the desired ledger was not validated. [#6730](https://github.com/XRPLF/rippled/pull/6730)
--- a/BUILD.md
+++ b/BUILD.md
@@ -42,6 +42,8 @@ Our Linux CI tooling is distro-independent and uses a Nix-based environment, so
 ### macOS

 Many `xrpld` engineers use macOS for development.
+The minimum supported version is macOS 15 (Sequoia).
+CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.

 ### Windows

@@ -245,7 +247,17 @@ cmake --build . --target setup_code_gen  # create venv and install dependencies
 cmake --build . --target code_gen        # regenerate code
 ```

-The regenerated files should be committed alongside your changes.
+The same targets are also available as a standalone project, which does not
+need the dependencies to be configured first:
+
+```
+cmake -S cmake/codegen -B build/codegen
+cmake --build build/codegen --target setup_code_gen
+cmake --build build/codegen --target code_gen
+```
+
+The regenerated files should be committed alongside your changes. CI verifies
+that they are up-to-date.

 ## Coverage report

--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -13,6 +13,23 @@ if(DEFINED CMAKE_MODULE_PATH)
 endif()
 list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake")

+# Must be set before project() because project() consumes it when configuring the compiler and SDK.
+# A user-provided -DCMAKE_OSX_DEPLOYMENT_TARGET still takes precedence.
+#
+# CMAKE_SYSTEM_NAME can't be used before project(), so CMAKE_HOST_SYSTEM_NAME is used instead.
+#
+# When CMAKE_OSX_DEPLOYMENT_TARGET is bumped to >=26.0, FastFloat dependency won't be needed anymore
+if(
+    CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin"
+    AND NOT DEFINED CMAKE_OSX_DEPLOYMENT_TARGET
+)
+    set(CMAKE_OSX_DEPLOYMENT_TARGET
+        "15.0"
+        CACHE STRING
+        "Minimum macOS deployment version"
+    )
+endif()
+
 project(xrpl)
 set(CMAKE_CXX_EXTENSIONS OFF)
 set(CMAKE_CXX_STANDARD 23)
@@ -87,6 +104,7 @@ include(deps/Boost)
 add_subdirectory(external/antithesis-sdk)
 find_package(date REQUIRED)
 find_package(ed25519 REQUIRED)
+find_package(FastFloat REQUIRED)
 find_package(gRPC REQUIRED)
 find_package(LibArchive REQUIRED)
 find_package(lz4 REQUIRED)
@@ -103,6 +121,7 @@ target_link_libraries(
    xrpl_libs
    INTERFACE
        ed25519::ed25519
+        FastFloat::fast_float
        lz4::lz4
        mpt-crypto::mpt-crypto
        OpenSSL::Crypto
@@ -143,8 +162,10 @@ endif()
 include(XrplCore)
 include(XrplProtocolAutogen)
 include(XrplInstall)
-include(XrplPackaging)
 include(XrplValidatorKeys)
+# Must come after XrplValidatorKeys: the 'package' target depends on the
+# validator-keys target existing.
+include(XrplPackaging)

 if(tests)
    include(CTest)
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -348,12 +348,14 @@ run-clang-tidy -p build -allow-no-checks src tests
 ```

 This will check all source files in the `src`, `include` and `tests` directories using the compile commands from your `build` directory.
-If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix` to the above command:
+If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix -format` to the above command:

 ```
-run-clang-tidy -p build -quiet -fix -allow-no-checks src tests
+run-clang-tidy -p build -quiet -fix -format -allow-no-checks src tests
 ```

+`-format` reformats the fixed code with [`.clang-format`](./.clang-format); without it the fixes are inserted in LLVM style and the `clang-format` hook rewrites them afterwards.
+
 ## Contracts and instrumentation

 We are using [Antithesis](https://antithesis.com/) for continuous fuzzing,
--- a/bin/check-tools.sh
+++ b/bin/check-tools.sh
@@ -30,8 +30,10 @@ missing=()
 checked=0

 # check <name> [probe-command...]
-# Runs the probe (default: "<name> --version") quietly. Records <name> as
-# missing if the command is not found or exits non-zero.
+# Runs the probe (default: "<name> --version"), capturing both stdout and
+# stderr, and prints one aligned line: the status, the name, and the first
+# non-blank line of the probe output (its version). Records <name> as missing
+# if the command is not found or exits non-zero.
 check() {
    local name="$1"
    shift
@@ -40,10 +42,11 @@ check() {
        probe=("${name}" --version)
    fi

-    echo "Checking ${name}..."
    checked=$((checked + 1))
-    if "${probe[@]}" | head -n 1; then
-        printf '  [ ok ] %s\n' "${name}"
+    local output version
+    if output="$("${probe[@]}" 2>&1)"; then
+        version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
+        printf '  [ ok ] %-20s %s\n' "${name}" "${version}"
    else
        printf '  [MISS] %s\n' "${name}"
        missing+=("${name}")
@@ -85,12 +88,14 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
    check file
    check less
    check make
-    check netstat which netstat
+    # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
+    # version flag, so fall back to a presence marker there.
+    check netstat sh -c 'command -v netstat >/dev/null && { netstat --version 2>&1 | grep -m1 -oE "net-tools [0-9.]+" || echo present; }'
    check ninja
-    check perl
+    check perl perl -e 'print "$^V\n"'
    check pkg-config
    check vim
-    check zip
+    check zip bash -c 'zip --version 2>&1 | grep -m1 -oE "Zip [0-9.]+"'

    # These tools are present in our Linux CI images and in local development
    # setups, but not in the macOS CI environment. So check them everywhere
--- a/bin/default-loader-path.sh
+++ b/bin/default-loader-path.sh
--- a/bin/pre-commit/clang_tidy_check.py
+++ b/bin/pre-commit/clang_tidy_check.py
@@ -144,7 +144,11 @@ def main():
            + files
        )
        canonicalize_fix_paths(Path(fixes_dir))
-        applied = subprocess.run([clang_apply_replacements, fixes_dir])
+        # `FormatStyle` in .clang-tidy does not reach this path,
+        # so ask for the repository style here.
+        applied = subprocess.run(
+            [clang_apply_replacements, "--format", "--style=file", fixes_dir]
+        )

    return result.returncode or applied.returncode

--- a/cfg/xrpld-example.cfg
+++ b/cfg/xrpld-example.cfg
@@ -488,6 +488,17 @@
 #   Must be a number between 100 and 1000, defaults to 250
 #
 #
+# [max_subscriptions_per_connection]
+#
+#   Maximum number of account, real-time account, and account-history
+#   subscriptions a single client connection may hold at once. Bounds the
+#   per-connection state torn down when the connection disconnects. Book
+#   subscriptions are tracked separately and are not counted here.
+#
+#   Defaults to 100000 if not set; large enough for legitimate power users
+#   such as block explorers.
+#
+#
 # [overlay]
 #
 #   Controls settings related to the peer to peer overlay.
@@ -538,6 +549,45 @@
 #       only be used for local testing and debugging. Do not disable
 #       on mainnet.
 #
+#   max_untrusted_count = <number>
+#
+#       The number of manifests the server keeps for validators it does not
+#       list, and the number it sends and processes in a single peer protocol
+#       message. Once the server holds this many, a manifest for a new
+#       unlisted validator is rejected, so peer gossip cannot grow the cache
+#       without end.
+#
+#       This option can take any value between 50 and 1000, inclusive. If
+#       the option is not present the server uses its built-in value.
+#
+#       The current default (which is subject to change) is 300.
+#
+#   max_trusted_count = <number>
+#
+#       The number of manifests for listed validators to allow for when
+#       sizing peer protocol messages. Manifests for listed validators are
+#       never dropped, whether sending or receiving, because doing so would
+#       delay a validator key change reaching this server. Set this above the
+#       number of validators the server lists.
+#
+#       Together the two counts above set the largest manifest message the
+#       server accepts: bigger messages are discarded without reading them,
+#       and without penalising the sender. Raising either means the server
+#       accepts and sends bigger messages than a peer using the defaults, and
+#       those peers will discard what this server sends. Lowering either below
+#       what peers send makes this server discard their manifest messages,
+#       which it does without recording anything.
+#
+#       This option can take any value between 50 and 1000, inclusive. If
+#       the option is not present the server uses its built-in value.
+#
+#       The current default (which is subject to change) is 300.
+#
+#       NOTE: These two options (max_untrusted_count and max_trusted_count)
+#       are transitional. They exist to bound manifest-message size and cache
+#       growth during the network upgrade. They may be removed in a future
+#       release once the fleet has upgraded, and should not be relied upon as
+#       stable configuration.
 #
 # [transaction_queue] EXPERIMENTAL
 #
--- a/cmake/CompilationEnv.cmake
+++ b/cmake/CompilationEnv.cmake
@@ -29,6 +29,27 @@ if(CMAKE_GENERATOR STREQUAL "Xcode")
    set(is_xcode TRUE)
 endif()

+# --------------------------------------------------------------------
+# Nix toolchain detection
+# --------------------------------------------------------------------
+# True when the C++ compiler resolves into the Nix store. CMAKE_CXX_COMPILER may
+# be referenced through a symlink outside the store (a Nix profile, a /usr/bin
+# alternative, ...), so resolve the real path before matching.
+set(is_nix_compiler FALSE)
+get_filename_component(_cxx_real "${CMAKE_CXX_COMPILER}" REALPATH)
+if(_cxx_real MATCHES "^/nix/store/")
+    set(is_nix_compiler TRUE)
+endif()
+unset(_cxx_real)
+
+# True inside the Nix CI Docker image, identified by the /nix/ci-env tree it
+# ships (see nix/docker/Dockerfile). The dev shell and bare systems don't have
+# it, so it distinguishes the CI image from other Nix-compiler environments.
+set(is_ci_image FALSE)
+if(EXISTS "/nix/ci-env/bin")
+    set(is_ci_image TRUE)
+endif()
+
 # --------------------------------------------------------------------
 # Operating system detection
 # --------------------------------------------------------------------
--- a/cmake/PatchNixBinary.cmake
+++ b/cmake/PatchNixBinary.cmake
@@ -1,26 +1,38 @@
 #[===================================================================[
   Patch executables to run in non-Nix environments.

-   The Nix-based CI image links binaries against an ELF interpreter (loader)
+   The Nix toolchain links binaries against an ELF interpreter (loader)
   that lives in the Nix store, so the resulting binaries don't run elsewhere
-   (including once installed from the .deb package). `patch_nix_binary` adds a
-   POST_BUILD step that resets the interpreter to the system default loader and
-   drops the rpath.
+   (including once installed from the .deb package). `patch_nix_binary` resets
+   the interpreter to the system default loader and drops the rpath, once the
+   binary has been linked.

-   This is only active inside the Nix-based image, detected by the presence of
-   /tmp/loader-path.sh (shipped by that image, resolves the default loader). It
-   is skipped for sanitizer builds, whose runtime libraries are resolved through
-   the rpath. Everywhere else `patch_nix_binary` is a no-op.
+   This runs by default for Nix-toolchain builds (determined by whether the compiler resolves under /nix/store/).
+   Those builds are where binaries get a Nix-store loader.
+   It is opted out of by setting the XRPLD_NO_PATCH_NIX_BINARY environment variable —
+   the plain Nix dev shells set it, since their binaries link a newer glibc
+   and must not be retargeted to the system loader.
+
+   Non-Nix builds (a system compiler, already using the system loader) and sanitizer builds
+   (runtime libraries resolved through the rpath) are skipped too.
+   Everywhere else `patch_nix_binary` is a no-op.
+
+   The default loader is resolved by bin/default-loader-path.sh.
 #]===================================================================]

 include_guard(GLOBAL)

 include(CompilationEnv)

-# Provided by the Nix-based CI image; prints the system default ELF loader path.
-set(_loader_path_script "/tmp/loader-path.sh")
+# Resolves the system default ELF loader path for the current architecture.
+set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")

-if(is_linux AND NOT SANITIZERS_ENABLED AND EXISTS "${_loader_path_script}")
+if(
+    is_linux
+    AND NOT SANITIZERS_ENABLED
+    AND is_nix_compiler
+    AND NOT DEFINED ENV{XRPLD_NO_PATCH_NIX_BINARY}
+)
    execute_process(
        COMMAND "${_loader_path_script}"
        OUTPUT_VARIABLE DEFAULT_LOADER_PATH
@@ -41,13 +53,38 @@ function(patch_nix_binary target)
    if(NOT PATCH_NIX_BINARIES)
        return()
    endif()
-    add_custom_command(
-        TARGET ${target}
-        POST_BUILD
-        COMMAND
-            "${PATCHELF_COMMAND}" --set-interpreter "${DEFAULT_LOADER_PATH}"
-            --remove-rpath "$<TARGET_FILE:${target}>"
-        COMMENT "Patching ${target}: set default loader, remove rpath"
-        VERBATIM
+
+    set(patch_command
+        "${PATCHELF_COMMAND}"
+        --set-interpreter
+        "${DEFAULT_LOADER_PATH}"
+        --remove-rpath
+        "$<TARGET_FILE:${target}>"
    )
+    set(comment "Patching ${target}: set default loader, remove rpath")
+
+    # POST_BUILD is the cheap way to do this: it runs only when the binary is
+    # relinked. It is also only available in the directory that defined the
+    # target, so for a target from elsewhere (e.g. a FetchContent subproject)
+    # fall back to a custom target that runs after the binary is linked. That
+    # one runs on every build, which is harmless because patchelf is idempotent.
+    get_target_property(target_source_dir ${target} SOURCE_DIR)
+    if("${target_source_dir}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
+        add_custom_command(
+            TARGET ${target}
+            POST_BUILD
+            COMMAND ${patch_command}
+            COMMENT "${comment}"
+            VERBATIM
+        )
+    else()
+        add_custom_target(
+            ${target}-patch-nix
+            ALL
+            COMMAND ${patch_command}
+            COMMENT "${comment}"
+            VERBATIM
+        )
+        add_dependencies(${target}-patch-nix ${target})
+    endif()
 endfunction()
--- a/cmake/XrplAddBenchmark.cmake
+++ b/cmake/XrplAddBenchmark.cmake
@@ -1,3 +1,5 @@
+include_guard()
+
 include(isolate_headers)

 # Define a benchmark executable for the module `name`.
--- a/cmake/XrplCompiler.cmake
+++ b/cmake/XrplCompiler.cmake
@@ -171,9 +171,8 @@ else()
    # Clang wrapper supplies those paths itself (via -nostdinc++), so at compile time the
    # flag is unused -> Clang errors under our -Werror. At link time the flag IS consumed
    # (it selects the C++ runtime), so we move it there instead of dropping it entirely.
-    get_filename_component(_cxx_real "${CMAKE_CXX_COMPILER}" REALPATH)
    if(
-        _cxx_real MATCHES "^/nix/store/"
+        is_nix_compiler
        AND is_linux
        AND is_clang
        AND CMAKE_CXX_FLAGS MATCHES "stdlib=libstdc"
--- a/cmake/XrplCore.cmake
+++ b/cmake/XrplCore.cmake
@@ -134,6 +134,12 @@ target_link_libraries(
 add_module(xrpl resource)
 target_link_libraries(xrpl.libxrpl.resource PUBLIC xrpl.libxrpl.protocol)

+add_module(xrpl peerfinder)
+target_link_libraries(
+    xrpl.libxrpl.peerfinder
+    PUBLIC xrpl.libxrpl.basics xrpl.libxrpl.protocol
+)
+
 # Level 08
 add_module(xrpl net)
 target_link_libraries(
@@ -202,6 +208,16 @@ target_link_libraries(
 add_module(xrpl tx)
 target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)

+add_module(xrpl consensus)
+target_link_libraries(
+    xrpl.libxrpl.consensus
+    PUBLIC
+        xrpl.libxrpl.basics
+        xrpl.libxrpl.json
+        xrpl.libxrpl.protocol
+        xrpl.libxrpl.ledger
+)
+
 add_library(xrpl.libxrpl)
 set_target_properties(xrpl.libxrpl PROPERTIES OUTPUT_NAME xrpl)

@@ -221,6 +237,7 @@ target_link_modules(
    beast
    conditions
    config
+    consensus
    core
    crypto
    git
@@ -228,6 +245,7 @@ target_link_modules(
    ledger
    net
    nodestore
+    peerfinder
    protocol
    protocol_autogen
    rdb
--- a/cmake/XrplPackaging.cmake
+++ b/cmake/XrplPackaging.cmake
@@ -25,6 +25,19 @@ if(NOT (RPMBUILD_EXECUTABLE OR DPKG_BUILDPACKAGE_EXECUTABLE))
    return()
 endif()

+if(NOT TARGET xrpld)
+    message(STATUS "xrpld=ON is required; 'package' target not available")
+    return()
+endif()
+
+if(NOT TARGET validator-keys)
+    message(
+        STATUS
+        "validator_keys=ON is required; 'package' target not available"
+    )
+    return()
+endif()
+
 set(package_env
    SRC_DIR=${CMAKE_SOURCE_DIR}
    BUILD_DIR=${CMAKE_BINARY_DIR}
@@ -37,7 +50,7 @@ add_custom_target(
        ${CMAKE_COMMAND} -E env ${package_env}
        ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
    WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-    DEPENDS xrpld
+    DEPENDS xrpld validator-keys
    COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
    VERBATIM
 )
--- a/cmake/XrplProtocolAutogen.cmake
+++ b/cmake/XrplProtocolAutogen.cmake
@@ -2,21 +2,22 @@
   Protocol Autogen - Code generation for protocol wrapper classes
 #]===================================================================]

+# The repository root, derived from the location of this file rather than from
+# the including project, so that the targets below can also be offered on their
+# own by cmake/codegen/CMakeLists.txt.
+get_filename_component(XRPL_ROOT "${CMAKE_CURRENT_LIST_DIR}/.." ABSOLUTE)
+
 set(CODEGEN_VENV_DIR
-    "${CMAKE_CURRENT_SOURCE_DIR}/.venv"
+    "${XRPL_ROOT}/.venv"
    CACHE PATH
    "Path to a Python virtual environment for code generation. A venv will be created here by setup_code_gen and used to run generation scripts."
 )

 # Directory paths
-set(MACRO_DIR "${CMAKE_CURRENT_SOURCE_DIR}/include/xrpl/protocol/detail")
-set(AUTOGEN_HEADER_DIR
-    "${CMAKE_CURRENT_SOURCE_DIR}/include/xrpl/protocol_autogen"
-)
-set(AUTOGEN_TEST_DIR
-    "${CMAKE_CURRENT_SOURCE_DIR}/src/tests/libxrpl/protocol_autogen"
-)
-set(SCRIPTS_DIR "${CMAKE_CURRENT_SOURCE_DIR}/cmake/scripts/codegen")
+set(MACRO_DIR "${XRPL_ROOT}/include/xrpl/protocol/detail")
+set(AUTOGEN_HEADER_DIR "${XRPL_ROOT}/include/xrpl/protocol_autogen")
+set(AUTOGEN_TEST_DIR "${XRPL_ROOT}/src/tests/libxrpl/protocol_autogen")
+set(SCRIPTS_DIR "${XRPL_ROOT}/cmake/scripts/codegen")

 # Input macro files
 set(TRANSACTIONS_MACRO "${MACRO_DIR}/transactions.macro")
@@ -114,14 +115,14 @@ if(CODEGEN_VENV_DIR)
        setup_code_gen
        COMMAND ${Python3_EXECUTABLE} -m venv "${CODEGEN_VENV_DIR}"
        COMMAND ${CODEGEN_PYTHON} -m pip install -r "${REQUIREMENTS_FILE}"
-        WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+        WORKING_DIRECTORY "${XRPL_ROOT}"
        COMMENT "Creating venv and installing code generation dependencies..."
    )
 else()
    add_custom_target(
        setup_code_gen
        COMMAND ${Python3_EXECUTABLE} -m pip install -r "${REQUIREMENTS_FILE}"
-        WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+        WORKING_DIRECTORY "${XRPL_ROOT}"
        COMMENT "Installing code generation dependencies..."
    )
 endif()
@@ -139,8 +140,8 @@ add_custom_target(
        -DSFIELDS_MACRO=${SFIELDS_MACRO}
        -DAUTOGEN_HEADER_DIR=${AUTOGEN_HEADER_DIR}
        -DAUTOGEN_TEST_DIR=${AUTOGEN_TEST_DIR} -P
-        "${CMAKE_CURRENT_SOURCE_DIR}/cmake/XrplProtocolAutogenRun.cmake"
-    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+        "${CMAKE_CURRENT_LIST_DIR}/XrplProtocolAutogenRun.cmake"
+    WORKING_DIRECTORY "${XRPL_ROOT}"
    COMMENT "Running protocol code generation..."
    SOURCES ${ALL_INPUT_FILES}
 )
--- a/cmake/XrplSanity.cmake
+++ b/cmake/XrplSanity.cmake
@@ -36,6 +36,19 @@ elseif(is_gcc)
    endif()
 endif()

+# A Nix compiler is only meant to be used from a managed environment: the xrpld
+# dev shell (which exports XRPL_DEVSHELL) or the CI image. Using one from a bare
+# shell usually means a leaked toolchain (picked up via PATH or a Conan profile)
+# and leads to confusing breakage, so fail early with guidance.
+if(is_nix_compiler AND NOT is_ci_image AND NOT DEFINED ENV{XRPL_DEVSHELL})
+    message(
+        FATAL_ERROR
+        "A Nix compiler (${CMAKE_CXX_COMPILER}) is being used outside the xrpld "
+        "dev shell. Enter it with `nix develop` (see docs/build/nix.md) before "
+        "configuring the build."
+    )
+endif()
+
 # check for in-source build and fail
 if("${CMAKE_CURRENT_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
    message(
--- a/cmake/XrplValidatorKeys.cmake
+++ b/cmake/XrplValidatorKeys.cmake
@@ -5,22 +5,39 @@ option(
 )

 if(validator_keys)
-    git_branch(current_branch)
-    # default to tracking VK master branch unless we are on release
-    if(NOT (current_branch STREQUAL "release"))
-        set(current_branch "master")
-    endif()
-    message(STATUS "Tracking ValidatorKeys branch: ${current_branch}")
+    # Own the install destination below rather than relying on another module
+    # having pulled this in first.
+    include(GNUInstallDirs)
+
+    # Pinned to an exact commit, not a branch: the tool ships inside our
+    # packages, so the same xrpld version must always package the same
+    # validator-keys. Bump this deliberately.
+    set(validator_keys_commit "4c0fb75eec9601c711645998c904507e87e910ae")
+    message(STATUS "Using ValidatorKeys commit: ${validator_keys_commit}")

    FetchContent_Declare(
        validator_keys
        GIT_REPOSITORY https://github.com/ripple/validator-keys-tool.git
-        GIT_TAG "${current_branch}"
+        GIT_TAG "${validator_keys_commit}"
    )
    FetchContent_MakeAvailable(validator_keys)
+    # The tool's own CMakeLists excludes the target from 'all' when it is built
+    # as a subproject. Undo that, so validator_keys=ON really does build it.
    set_target_properties(
        validator-keys
-        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
+        PROPERTIES
+            RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
+            EXCLUDE_FROM_ALL OFF
+            EXCLUDE_FROM_DEFAULT_BUILD OFF
+    )
+    # We ship this binary, so like xrpld it must not keep the Nix store's ELF
+    # loader, or it cannot run on the target distro at all.
+    patch_nix_binary(validator-keys)
+
+    configure_file(
+        "${validator_keys_SOURCE_DIR}/LICENSE"
+        "${CMAKE_BINARY_DIR}/validator-keys-LICENSE"
+        COPYONLY
    )
    install(TARGETS validator-keys RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 endif()
--- a/cmake/codegen/CMakeLists.txt
+++ b/cmake/codegen/CMakeLists.txt
@@ -0,0 +1,21 @@
+#[===================================================================[
+   Protocol Autogen - Standalone project
+
+   Exposes the 'setup_code_gen' and 'code_gen' targets on their own, without
+   configuring the rest of xrpl. Code generation is pure Python, so this needs
+   neither the dependencies nor a compiler, which makes it usable in CI and by
+   contributors who only want to regenerate the protocol wrapper classes:
+
+     cmake -S cmake/codegen -B build/codegen
+     cmake --build build/codegen --target setup_code_gen
+     cmake --build build/codegen --target code_gen
+
+   The targets are identical to the ones offered by the top-level build, since
+   both come from cmake/XrplProtocolAutogen.cmake.
+#]===================================================================]
+
+cmake_minimum_required(VERSION 3.16)
+
+project(xrpl_codegen LANGUAGES NONE)
+
+include("${CMAKE_CURRENT_LIST_DIR}/../XrplProtocolAutogen.cmake")
--- a/conan.lock
+++ b/conan.lock
@@ -13,7 +13,7 @@
        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
-        "mpt-crypto/0.4.0-rc4#ffdba12f2332357f0d8b0ae944cfff52%1784138702.932355",
+        "mpt-crypto/1.0.2#b313cef0c1a493eb970ad185b2e9bab7%1784285108.866483",
        "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
        "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
@@ -21,6 +21,7 @@
        "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
        "grpc/1.81.1#f729f6d75992d20f9c72828e9142d62f%1783945160.094135",
+        "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1782494504.298",
        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
@@ -35,7 +36,7 @@
        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
        "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
-        "m4/1.4.19#34c4bbc3eeebe98ca6edf2f52d602e7d%1777282960.259",
+        "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
        "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
        "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
--- a/conan/profiles/default
+++ b/conan/profiles/default
@@ -5,6 +5,13 @@
 {% if os == "Linux" %}
 {% set compiler_version = detect_api.default_compiler_version(compiler, version) %}
 {% endif %}
+{% if os == "Macos" %}
+{# Minimum macOS the dependencies target. #}
+{# Without this, Conan builds each dependency against the (possibly newer) host SDK, so the #}
+{# dependency objects target a newer macOS than the binary and the linker warns. #}
+{# Keep at or below CMAKE_OSX_DEPLOYMENT_TARGET in CMakeLists.txt. #}
+{% set min_macos_version = "15.0" %}
+{% endif %}

 [settings]
 os={{ os }}
@@ -18,6 +25,9 @@ compiler.runtime=static
 {% else %}
 compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}
+{% if os == "Macos" %}
+os.version={{ min_macos_version }}
+{% endif %}

 [conf]
 {# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
@@ -41,3 +51,13 @@ tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
+
+{% if os == "Macos" %}
+[buildenv]
+{# os.version adds -mmacosx-version-min to compiler command lines, #}
+{# but Boost.Context's b2 assembly (.S) rule ignores it, #}
+{# so those objects keep the host SDK version and still warn at link time. #}
+{# clang's assembler honors this env var regardless, pinning them. #}
+{# Scoped to boost/* since it is the only gap. #}
+boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
+{% endif %}
--- a/conanfile.py
+++ b/conanfile.py
@@ -29,6 +29,7 @@ class Xrpl(ConanFile):

    requires = [
        "ed25519/2015.03",
+        "fast_float/8.2.10",
        "grpc/1.81.1",
        "libarchive/3.8.7",
        "nudb/2.0.9",
@@ -139,7 +140,7 @@ class Xrpl(ConanFile):
        if self.options.jemalloc:
            self.requires("jemalloc/5.3.1")
        self.requires("lz4/1.10.0", force=True)
-        self.requires("mpt-crypto/0.4.0-rc4", transitive_headers=True)
+        self.requires("mpt-crypto/1.0.2", transitive_headers=True)
        self.requires("protobuf/6.33.5", force=True)
        if self.options.rocksdb:
            self.requires("rocksdb/10.5.1")
@@ -212,6 +213,7 @@ class Xrpl(ConanFile):
            "boost::thread",
            "date::date",
            "ed25519::ed25519",
+            "fast_float::fast_float",
            "grpc::grpc++",
            "libarchive::libarchive",
            "lz4::lz4",
--- a/docs/build/nix.md
+++ b/docs/build/nix.md
@@ -38,8 +38,10 @@ The first time you run this command, it will take a few minutes to download and

 ### Platform notes

- **Linux**: `nix develop` gives you a shell with all the tooling necessary to
-  develop xrpld and with GCC 15.2 (also provided by Nix). There are no caveats.
+- **Linux**: `nix develop` gives you a shell with all the tooling necessary to develop xrpld
+  and with the same GCC/glibc toolchain that Nix builds for CI.
+  See [Choosing a different compiler](#choosing-a-different-compiler)
+  for the custom-vs-plain toolchain trade-off.
 - **macOS**: `nix develop` gives you a full environment too, with Clang (and
  every other tool, including Conan) provided by Nix. To use your system-wide
  Apple Clang instead, enter `nix develop .#apple-clang`. Conan has no binary in
@@ -63,8 +65,16 @@ The first time you run this command, it will take a few minutes to download and
 ### Choosing a different compiler

 A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix develop .#clang`.
-The `.#gcc` and `.#clang` shells provide the same GCC and Clang versions used in CI
-(pinned in [`nix/packages.nix`](../../nix/packages.nix)).
+
+On Linux, `.#gcc` and `.#clang` provide the exact toolchain CI uses:
+the compiler (pinned in [`nix/packages.nix`](../../nix/packages.nix))
+rebuilt against the pinned custom glibc (see [`nix/compilers.nix`](../../nix/compilers.nix)).
+Building that toolchain the first time is slow unless it is fetched from a Nix binary cache.
+If you don't need the custom glibc, the Linux-only `.#gcc-plain` and `.#clang-plain`
+give you the stock nixpkgs compilers of the same versions.
+On macOS there is no custom glibc, so `.#gcc` and `.#clang` are already the plain nixpkgs toolchain,
+and the `-plain` variants do not exist.
+
 Use `nix flake show` to see all the available development shells.

 Use `nix develop .#no-compiler` to use the compiler from your system.
@@ -72,14 +82,18 @@ Use `nix develop .#no-compiler` to use the compiler from your system.
 ### Example Usage

 ```bash
-# Use GCC (same version as CI)
+# Use GCC — same toolchain as CI (custom glibc on Linux)
 nix develop .#gcc

-# Use Clang (same version as CI)
+# Use Clang — same toolchain as CI (custom glibc on Linux)
 nix develop .#clang

 # Use default for your platform
 nix develop
+
+# Stock nixpkgs GCC/Clang, Linux only — skips the custom-glibc build, but does not match CI
+nix develop .#gcc-plain
+nix develop .#clang-plain
 ```

 ### Using a different shell
@@ -110,6 +124,10 @@ nix develop -c "$SHELL"

 Once inside the Nix development shell, follow the standard [build instructions](../../BUILD.md#steps). The Nix shell provides all necessary tools (CMake, Ninja, Conan, etc.).

+Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Linux):
+each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
+The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.
+
 ## Automatic Activation with direnv

 [direnv](https://direnv.net/) or [nix-direnv](https://github.com/nix-community/nix-direnv) can automatically activate the Nix development shell when you enter the repository directory.
@@ -136,6 +154,14 @@ conan install .. --output-folder . --build '*' --settings build_type=Release

 To update `flake.lock` to the latest revision use `nix flake update` command.

+## Tooling snapshots
+
+The tool versions in each Nix environment are recorded in
+[`nix/check-tools/`](../../nix/check-tools) and verified by CI. If you change the
+environment (bump the CI image tag, update `flake.lock`, or edit the tool list in
+`bin/check-tools.sh`), CI fails until you regenerate and commit the affected
+snapshot — see [`nix/check-tools/README.md`](../../nix/check-tools/README.md).
+
 ## Troubleshooting

 See [Troubleshooting Nix problems](./nix_troubleshooting.md) for common issues,
--- a/docs/build/nix_troubleshooting.md
+++ b/docs/build/nix_troubleshooting.md
@@ -3,6 +3,78 @@
 Common issues encountered when using the [Nix development shell](./nix.md), and
 how to resolve them.

+## `command not found: nix` after a macOS update
+
+If a shell suddenly can't find `nix` at all:
+
+```
+$ nix develop
+zsh: command not found: nix
+```
+
+then Nix is almost certainly still installed — only the shell hook that puts it
+on your `PATH` is gone. Confirm that first:
+
+```bash
+ls -l /nix/var/nix/profiles/default/bin/nix
+```
+
+If that exists, the installation is fine and this is purely a `PATH` problem.
+
+### Why it happens
+
+The installer does not touch your dotfiles. Instead it sources a setup script
+from the Nix store by editing **system-wide** rc files:
+
+| Shell | File the installer edits              |
+| ----- | ------------------------------------- |
+| bash  | `/etc/bashrc`, `/etc/bash.bashrc`     |
+| zsh   | `/etc/zshrc`                          |
+| fish  | `$__fish_sysconf_dir/conf.d/nix.fish` |
+
+macOS manages `/etc/zshrc`, so an OS update can replace it with the vendor copy
+and silently drop the Nix block. `/etc/bashrc` and the fish file usually survive,
+which is why the breakage often shows up in zsh only. You can verify this by
+diffing against the backup the installer left behind:
+
+```bash
+diff /etc/zshrc /etc/zshrc.backup-before-nix
+```
+
+If they are identical, the Nix snippet was wiped. This is upstream issue
+[NixOS/nix#3616](https://github.com/NixOS/nix/issues/3616).
+
+### Fix
+
+To unblock the current shell:
+
+```bash
+. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+```
+
+For a permanent fix, add the snippet to your **user** rc file rather than
+restoring `/etc/zshrc` — user dotfiles are not clobbered by OS updates:
+
+```bash
+cat >>~/.zshrc <<'EOF'
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+EOF
+```
+
+The scripts guard against double-sourcing via `__ETC_PROFILE_NIX_SOURCED`, so
+this is safe even if a system-wide hook is later restored.
+
+> [!NOTE]
+> `/etc/zshrc` and `~/.zshrc` are only read by **interactive** zsh. If the
+> snippet is present but `zsh -c '…'`, a script, or an IDE terminal still can't
+> find `nix`, that shell is non-interactive — put the snippet in `~/.zshenv`
+> instead.
+
 ## Git worktrees

 If `nix develop` fails with an error like:
--- a/include/xrpl/basics/Resolver.h
+++ b/include/xrpl/basics/Resolver.h
@@ -11,7 +11,7 @@ namespace xrpl {
 class Resolver
 {
 public:
-    using HandlerType = std::function<void(std::string, std::vector<beast::IP::Endpoint>)>;
+    using HandlerType = std::function<void(std::string, std::vector<beast::ip::Endpoint>)>;

    virtual ~Resolver() = 0;

--- a/include/xrpl/basics/Slice.h
+++ b/include/xrpl/basics/Slice.h
@@ -11,6 +11,7 @@
 #include <limits>
 #include <stdexcept>
 #include <string>
+#include <string_view>
 #include <type_traits>
 #include <vector>

@@ -251,4 +252,11 @@ makeSlice(std::basic_string<char, Traits, Alloc> const& s)
    return Slice(s.data(), s.size());
 }

+template <class Traits>
+Slice
+makeSlice(std::basic_string_view<char, Traits> s)
+{
+    return Slice(s.data(), s.size());
+}
+
 }  // namespace xrpl
--- a/include/xrpl/basics/base64.h
+++ b/include/xrpl/basics/base64.h
@@ -41,6 +41,35 @@

 namespace xrpl {

+namespace base64 {
+
+/**
+ * Returns the maximum number of characters needed to base64-encode @p nBytes bytes.
+ *
+ * @param nBytes Number of input bytes.
+ * @return Size of the encoded string, including padding.
+ */
+constexpr std::size_t
+encodedSize(std::size_t const nBytes)
+{
+    return 4 * ((nBytes + 2) / 3);
+}
+
+/**
+ * Returns the maximum number of bytes a base64 string of @p numChars characters
+ * decodes to.
+ *
+ * @param numChars Number of base64 characters.
+ * @return Upper bound on the number of decoded bytes.
+ */
+constexpr std::size_t
+decodedSize(std::size_t const numChars)
+{
+    return ((numChars / 4) * 3) + 2;
+}
+
+}  // namespace base64
+
 std::string
 base64Encode(std::uint8_t const* data, std::size_t len);

--- a/include/xrpl/beast/container/detail/aged_unordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_unordered_container.h
@@ -5,6 +5,7 @@
 #include <xrpl/beast/container/detail/aged_associative_container.h>
 #include <xrpl/beast/container/detail/aged_container_iterator.h>
 #include <xrpl/beast/container/detail/empty_base_optimization.h>
+#include <xrpl/beast/utility/instrumentation.h>

 #include <boost/intrusive/list.hpp>
 #include <boost/intrusive/unordered_set.hpp>
--- a/include/xrpl/beast/core/LexicalCast.h
+++ b/include/xrpl/beast/core/LexicalCast.h
@@ -58,7 +58,7 @@ struct LexicalCast<Out, std::string_view>
        "beast::LexicalCast can only be used with integral types");

    template <class Integral = Out>
-    bool
+    constexpr bool
    operator()(Integral& out, std::string_view in) const
        requires(std::is_integral_v<Integral> && !std::is_same_v<Integral, bool>)
    {
@@ -110,7 +110,7 @@ struct LexicalCast<Out, boost::core::basic_string_view<char>>
 {
    explicit LexicalCast() = default;

-    bool
+    constexpr bool
    operator()(Out& out, boost::core::basic_string_view<char> in) const
    {
        return LexicalCast<Out, std::string_view>()(out, in);
@@ -123,7 +123,7 @@ struct LexicalCast<Out, std::string>
 {
    explicit LexicalCast() = default;

-    bool
+    constexpr bool
    operator()(Out& out, std::string in) const
    {
        return LexicalCast<Out, std::string_view>()(out, in);
@@ -136,7 +136,7 @@ struct LexicalCast<Out, char const*>
 {
    explicit LexicalCast() = default;

-    bool
+    constexpr bool
    operator()(Out& out, char const* in) const
    {
        XRPL_ASSERT(in, "beast::detail::LexicalCast(char const*) : non-null input");
@@ -151,7 +151,7 @@ struct LexicalCast<Out, char*>
 {
    explicit LexicalCast() = default;

-    bool
+    constexpr bool
    operator()(Out& out, char* in) const
    {
        XRPL_ASSERT(in, "beast::detail::LexicalCast(char*) : non-null input");
@@ -177,7 +177,7 @@ struct BadLexicalCast : public std::bad_cast
 * @return `false` if there was a parsing or range error
 */
 template <class Out, class In>
-bool
+constexpr bool
 lexicalCastChecked(Out& out, In in)
 {
    return detail::LexicalCast<Out, In>()(out, in);
@@ -191,7 +191,7 @@ lexicalCastChecked(Out& out, In in)
 * @return The new type.
 */
 template <class Out, class In>
-Out
+constexpr Out
 lexicalCastThrow(In in)
 {
    if (Out out; lexicalCastChecked(out, in))
@@ -207,7 +207,7 @@ lexicalCastThrow(In in)
 * @return The new type.
 */
 template <class Out, class In>
-Out
+constexpr Out
 lexicalCast(In in, Out defaultValue = Out())
 {
    if (Out out; lexicalCastChecked(out, in))
--- a/include/xrpl/beast/core/SemanticVersion.h
+++ b/include/xrpl/beast/core/SemanticVersion.h
@@ -17,14 +17,14 @@ namespace beast {
 class SemanticVersion
 {
 public:
-    using identifier_list = std::vector<std::string>;
+    using IdentifierList = std::vector<std::string>;

    int majorVersion;
    int minorVersion;
    int patchVersion;

-    identifier_list preReleaseIdentifiers;
-    identifier_list metaData;
+    IdentifierList preReleaseIdentifiers;
+    IdentifierList metaData;

    SemanticVersion();

--- a/include/xrpl/beast/insight/StatsDCollector.h
+++ b/include/xrpl/beast/insight/StatsDCollector.h
@@ -26,7 +26,7 @@ public:
     * @param journal Destination for logging output.
     */
    static std::shared_ptr<StatsDCollector>
-    make(IP::Endpoint const& address, std::string const& prefix, Journal journal);
+    make(ip::Endpoint const& address, std::string const& prefix, Journal journal);
 };

 }  // namespace beast::insight
--- a/include/xrpl/beast/net/IPAddress.h
+++ b/include/xrpl/beast/net/IPAddress.h
@@ -15,7 +15,7 @@
 //------------------------------------------------------------------------------

 namespace beast {
-namespace IP {
+namespace ip {

 using Address = boost::asio::ip::address;

@@ -73,13 +73,13 @@ isPublic(Address const& addr)
    return (addr.is_v4()) ? isPublic(addr.to_v4()) : isPublic(addr.to_v6());
 }

-}  // namespace IP
+}  // namespace ip

 //------------------------------------------------------------------------------

 template <class Hasher>
 void
-hash_append(Hasher& h, beast::IP::Address const& addr) noexcept
+hash_append(Hasher& h, beast::ip::Address const& addr) noexcept
 {
    using beast::hash_append;
    if (addr.is_v4())
@@ -101,12 +101,12 @@ hash_append(Hasher& h, beast::IP::Address const& addr) noexcept

 namespace boost {
 template <>
-struct hash<::beast::IP::Address>
+struct hash<::beast::ip::Address>
 {
    explicit hash() = default;

    std::size_t
-    operator()(::beast::IP::Address const& addr) const
+    operator()(::beast::ip::Address const& addr) const
    {
        return ::beast::Uhash<>{}(addr);
    }
--- a/include/xrpl/beast/net/IPAddressConversion.h
+++ b/include/xrpl/beast/net/IPAddressConversion.h
@@ -4,7 +4,7 @@

 #include <boost/asio.hpp>

-namespace beast::IP {
+namespace beast::ip {

 /**
 * Convert to Endpoint.
@@ -32,7 +32,7 @@ toAsioAddress(Endpoint const& endpoint);
 boost::asio::ip::tcp::endpoint
 toAsioEndpoint(Endpoint const& endpoint);

-}  // namespace beast::IP
+}  // namespace beast::ip

 namespace beast {

@@ -41,25 +41,25 @@ struct IPAddressConversion
 {
    explicit IPAddressConversion() = default;

-    static IP::Endpoint
+    static ip::Endpoint
    fromAsio(boost::asio::ip::address const& address)
    {
-        return IP::fromAsio(address);
+        return ip::fromAsio(address);
    }
-    static IP::Endpoint
+    static ip::Endpoint
    fromAsio(boost::asio::ip::tcp::endpoint const& endpoint)
    {
-        return IP::fromAsio(endpoint);
+        return ip::fromAsio(endpoint);
    }
    static boost::asio::ip::address
-    toAsioAddress(IP::Endpoint const& address)
+    toAsioAddress(ip::Endpoint const& address)
    {
-        return IP::toAsioAddress(address);
+        return ip::toAsioAddress(address);
    }
    static boost::asio::ip::tcp::endpoint
-    toAsioEndpoint(IP::Endpoint const& address)
+    toAsioEndpoint(ip::Endpoint const& address)
    {
-        return IP::toAsioEndpoint(address);
+        return ip::toAsioEndpoint(address);
    }
 };

--- a/include/xrpl/beast/net/IPAddressV4.h
+++ b/include/xrpl/beast/net/IPAddressV4.h
@@ -2,7 +2,7 @@

 #include <boost/asio/ip/address_v4.hpp>

-namespace beast::IP {
+namespace beast::ip {

 using AddressV4 = boost::asio::ip::address_v4;

@@ -25,4 +25,4 @@ isPublic(AddressV4 const& addr);
 char
 getClass(AddressV4 const& address);

-}  // namespace beast::IP
+}  // namespace beast::ip
--- a/include/xrpl/beast/net/IPAddressV6.h
+++ b/include/xrpl/beast/net/IPAddressV6.h
@@ -2,7 +2,7 @@

 #include <boost/asio/ip/address_v6.hpp>

-namespace beast::IP {
+namespace beast::ip {

 using AddressV6 = boost::asio::ip::address_v6;

@@ -18,4 +18,4 @@ isPrivate(AddressV6 const& addr);
 bool
 isPublic(AddressV6 const& addr);

-}  // namespace beast::IP
+}  // namespace beast::ip
--- a/include/xrpl/beast/net/IPEndpoint.h
+++ b/include/xrpl/beast/net/IPEndpoint.h
@@ -13,7 +13,7 @@
 #include <optional>
 #include <string>

-namespace beast::IP {
+namespace beast::ip {

 using Port = std::uint16_t;

@@ -223,7 +223,7 @@ operator<<(OutputStream& os, Endpoint const& endpoint)
 std::istream&
 operator>>(std::istream& is, Endpoint& endpoint);

-}  // namespace beast::IP
+}  // namespace beast::ip

 //------------------------------------------------------------------------------

@@ -232,12 +232,12 @@ namespace std {
 * std::hash support.
 */
 template <>
-struct hash<::beast::IP::Endpoint>
+struct hash<::beast::ip::Endpoint>
 {
    hash() = default;

    std::size_t
-    operator()(::beast::IP::Endpoint const& endpoint) const
+    operator()(::beast::ip::Endpoint const& endpoint) const
    {
        return ::beast::Uhash<>{}(endpoint);
    }
@@ -249,12 +249,12 @@ namespace boost {
 * boost::hash support.
 */
 template <>
-struct hash<::beast::IP::Endpoint>
+struct hash<::beast::ip::Endpoint>
 {
    hash() = default;

    std::size_t
-    operator()(::beast::IP::Endpoint const& endpoint) const
+    operator()(::beast::ip::Endpoint const& endpoint) const
    {
        return ::beast::Uhash<>{}(endpoint);
    }
--- a/include/xrpl/beast/unit_test/suite.h
+++ b/include/xrpl/beast/unit_test/suite.h
@@ -295,6 +295,20 @@ public:
        return runner_->arg();
    }

+protected:
+    /**
+     * Lets a suite compose other suites (e.g. an aggregator that reruns a
+     * group of related suites under its own name) via `SuiteInfo::run`.
+     *
+     * @return The runner this suite is executing under.
+     */
+    Runner&
+    runner() const
+    {
+        return *runner_;
+    }
+
+public:
    /**
     * DEPRECATED
     * @return `true` if the test condition indicates success(a false value)
--- a/include/xrpl/config/Constants.h
+++ b/include/xrpl/config/Constants.h
@@ -25,6 +25,7 @@ struct Sections
    static constexpr auto kLedgerHistory = "ledger_history";
    static constexpr auto kLedgerReplay = "ledger_replay";
    static constexpr auto kLedgerTxTables = "ledger_tx_tables";
+    static constexpr auto kMaxSubscriptionsPerConnection = "max_subscriptions_per_connection";
    static constexpr auto kMaxTransactions = "max_transactions";
    static constexpr auto kNetworkId = "network_id";
    static constexpr auto kNetworkQuorum = "network_quorum";
@@ -118,7 +119,9 @@ struct Keys
    static constexpr auto kLogInterval = "log_interval";
    static constexpr auto kMaxDivergedTime = "max_diverged_time";
    static constexpr auto kMaxLedgerCountsToStore = "max_ledger_counts_to_store";
+    static constexpr auto kMaxTrustedCount = "max_trusted_count";
    static constexpr auto kMaxUnknownTime = "max_unknown_time";
+    static constexpr auto kMaxUntrustedCount = "max_untrusted_count";
    static constexpr auto kMaximumTxnInLedger = "maximum_txn_in_ledger";
    static constexpr auto kMaximumTxnPerAccount = "maximum_txn_per_account";
    static constexpr auto kMemoryLevel = "memory_level";
--- a/src/xrpld/app/consensus/RCLCensorshipDetector.h
+++ b/src/xrpld/app/consensus/RCLCensorshipDetector.h
@@ -10,7 +10,7 @@
 namespace xrpl {

 template <class TxID, class Sequence>
-class RCLCensorshipDetector
+class CensorshipDetector
 {
 public:
    struct TxIDSeq
@@ -49,7 +49,7 @@ private:
    TxIDSeqVec tracker_;

 public:
-    RCLCensorshipDetector() = default;
+    CensorshipDetector() = default;

    /**
     * Add transactions being proposed for the current consensus round.
--- a/include/xrpl/consensus/Consensus.h
+++ b/include/xrpl/consensus/Consensus.h
@@ -1,15 +1,14 @@
 #pragma once

-#include <xrpld/consensus/ConsensusParms.h>
-#include <xrpld/consensus/ConsensusProposal.h>
-#include <xrpld/consensus/ConsensusTypes.h>
-
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/consensus/ConsensusParms.h>
+#include <xrpl/consensus/ConsensusProposal.h>
+#include <xrpl/consensus/ConsensusTypes.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/json_writer.h>
 #include <xrpl/ledger/LedgerTiming.h>
@@ -22,6 +21,7 @@
 #include <map>
 #include <memory>
 #include <optional>
+#include <ranges>
 #include <sstream>
 #include <string>
 #include <utility>
@@ -1580,7 +1580,13 @@ Consensus<Adaptor>::updateOurPositions(std::unique_ptr<std::stringstream> const&
        JLOG(j_.info()) << ss.str();
        CLOG(clog) << ss.str();

-        for (auto const& [t, v] : closeTimeVotes)
+        // Walk the votes highest-time first so that, among close times tied
+        // for the most votes, the earliest wins. The smaller value is the
+        // safer choice: without close-time consensus this round, the winner
+        // only updates our position for the next proposal, and a too-early
+        // time is bounded below by the prior ledger's close time. Only the
+        // tie-break changes; the bin with the most votes still wins.
+        for (auto const& [t, v] : std::views::reverse(closeTimeVotes))
        {
            JLOG(j_.debug()) << "CCTime: seq "
                             << static_cast<std::uint32_t>(previousLedger_.seq()) + 1 << ": "
--- a/include/xrpl/consensus/ConsensusParms.h
+++ b/include/xrpl/consensus/ConsensusParms.h
--- a/include/xrpl/consensus/ConsensusProposal.h
+++ b/include/xrpl/consensus/ConsensusProposal.h
--- a/include/xrpl/consensus/ConsensusTypes.h
+++ b/include/xrpl/consensus/ConsensusTypes.h
@@ -1,15 +1,16 @@
 #pragma once

-#include <xrpld/consensus/ConsensusProposal.h>
-#include <xrpld/consensus/DisputedTx.h>
-
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/consensus/ConsensusProposal.h>
+#include <xrpl/consensus/DisputedTx.h>

 #include <chrono>
 #include <cstddef>
+#include <cstdint>
 #include <map>
+#include <optional>
 #include <string>

 namespace xrpl {
@@ -190,6 +191,75 @@ struct ConsensusCloseTimes
    NetClock::time_point self;
 };

+/**
+ * Offset of the network's close time relative to ours, using a weighted median.
+ *
+ * Treats the sample set as `{self x 1}` merged with `{t x w}` for each
+ * `(t, w)` in `times.peers`, in time order, and returns `(median - self)`
+ * in whole seconds. Uses the lower weighted median: the median is the
+ * earliest time at which the running weight reaches half the total, so an
+ * even total whose halfway point falls between two bins resolves to the
+ * earlier bin.
+ *
+ * @param times Our own close time and the weighted close times of peers.
+ * @return Weighted median of all close times minus our own, in whole seconds.
+ */
+inline std::chrono::seconds
+medianCloseOffset(ConsensusCloseTimes const& times)
+{
+    using namespace std::chrono;
+    using time_point = NetClock::time_point;
+
+    std::int64_t totalWeight = 1;
+    for (auto const& [_, w] : times.peers)
+        totalWeight += w;
+
+    std::int64_t const halfWeight = (totalWeight + 1) / 2;
+
+    std::optional<time_point> median{};
+    std::int64_t tally = 0;
+    bool selfPlaced = false;
+
+    // Accumulate weight in time order; the first bin to reach halfWeight is
+    // the (lower) weighted median. Returns true once that bin is found.
+    auto step = [&](time_point t, std::int64_t w) {
+        XRPL_ASSERT(tally < halfWeight, "xrpl::medianCloseOffset::step : median not yet found");
+        tally += w;
+        if (tally >= halfWeight)
+        {
+            median = t;
+            return true;
+        }
+        return false;
+    };
+
+    for (auto const& [t, w] : times.peers)
+    {
+        if (!selfPlaced && times.self <= t)
+        {
+            selfPlaced = true;
+            if (step(times.self, 1))
+                break;
+        }
+        if (step(t, w))
+            break;
+    }
+    if (!selfPlaced && !median)
+        step(times.self, 1);
+
+    if (!median)
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::medianCloseOffset : median not found");
+        median = times.self;
+        // LCOV_EXCL_STOP
+    }
+
+    return duration_cast<seconds>(
+        duration<std::int64_t>{median->time_since_epoch().count()} -
+        duration<std::int64_t>{times.self.time_since_epoch().count()});
+}
+
 /**
 * Whether we have or don't have a consensus
 */
--- a/include/xrpl/consensus/DisputedTx.h
+++ b/include/xrpl/consensus/DisputedTx.h
@@ -1,9 +1,8 @@
 #pragma once

-#include <xrpld/consensus/ConsensusParms.h>
-
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/consensus/ConsensusParms.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/json_writer.h>

--- a/include/xrpl/consensus/LedgerTrie.h
+++ b/include/xrpl/consensus/LedgerTrie.h
--- a/include/xrpl/consensus/README.md
+++ b/include/xrpl/consensus/README.md
--- a/include/xrpl/consensus/Validations.h
+++ b/include/xrpl/consensus/Validations.h
@@ -1,7 +1,5 @@
 #pragma once

-#include <xrpld/consensus/LedgerTrie.h>
-
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
@@ -11,6 +9,7 @@
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/consensus/LedgerTrie.h>
 #include <xrpl/json/json_value.h>

 #include <algorithm>
--- a/include/xrpl/core/ServiceRegistry.h
+++ b/include/xrpl/core/ServiceRegistry.h
@@ -15,12 +15,12 @@
 namespace xrpl {

 // Forward declarations
-namespace NodeStore {
+namespace node_store {
 class Database;
-}  // namespace NodeStore
-namespace Resource {
+}  // namespace node_store
+namespace resource {
 class Manager;
-}  // namespace Resource
+}  // namespace resource
 namespace perf {
 class PerfLog;
 }  // namespace perf
@@ -160,11 +160,11 @@ public:
    virtual PeerReservationTable&
    getPeerReservations() = 0;

-    virtual Resource::Manager&
+    virtual resource::Manager&
    getResourceManager() = 0;

    // Storage services
-    virtual NodeStore::Database&
+    virtual node_store::Database&
    getNodeStore() = 0;

    virtual SHAMapStore&
--- a/include/xrpl/json/json_value.h
+++ b/include/xrpl/json/json_value.h
@@ -623,6 +623,7 @@ class ValueConstIterator : public ValueIteratorBase
 public:
    using size_t = unsigned int;
    using difference_type = int;
+    using value_type = Value const;
    using reference = Value const&;
    using pointer = Value const*;
    using SelfType = ValueConstIterator;
@@ -687,6 +688,7 @@ class ValueIterator : public ValueIteratorBase
 public:
    using size_t = unsigned int;
    using difference_type = int;
+    using value_type = Value;
    using reference = Value&;
    using pointer = Value*;
    using SelfType = ValueIterator;
--- a/include/xrpl/ledger/helpers/EscrowHelpers.h
+++ b/include/xrpl/ledger/helpers/EscrowHelpers.h
@@ -2,6 +2,7 @@

 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
@@ -15,6 +16,7 @@
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/MPTAmount.h>
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/SField.h>
@@ -241,10 +243,25 @@ escrowUnlockApplyHelper<MPTIssue>(
    auto finalAmt = amount;
    if ((!senderIssuer && !receiverIssuer) && lockedRate != kParityRate)
    {
-        // compute transfer fee, if any
-        auto const xferFee = amount.value() - divideRound(amount, lockedRate, amount.asset(), true);
-        // compute balance to transfer
-        finalAmt = amount.value() - xferFee;
+        if (ctx.view.rules().enabled(fixCleanup3_4_0))
+        {
+            XRPL_ASSERT(
+                lockedRate >= kParityRate,
+                "xrpl::escrowUnlockApplyHelper<MPTIssue> : lockedRate is at least parity");
+            // MPTs are integral, so round the delivered amount down and
+            // charge any fractional transfer fee to the escrowed amount.
+            auto const delivered =
+                mulRatio(amount.mpt(), kParityRate.value, lockedRate.value, false);
+            finalAmt = STAmount(amount.asset(), delivered.value());
+        }
+        else
+        {
+            // compute transfer fee, if any
+            auto const xferFee =
+                amount.value() - divideRound(amount, lockedRate, amount.asset(), true);
+            // compute balance to transfer
+            finalAmt = amount.value() - xferFee;
+        }
    }
    return unlockEscrowMPT(
        ctx.view,
--- a/include/xrpl/ledger/helpers/LendingHelpers.h
+++ b/include/xrpl/ledger/helpers/LendingHelpers.h
@@ -286,6 +286,77 @@ computeFullPaymentInterest(
    std::uint32_t startDate,
    TenthBips32 closeInterestRate);

+// Deltas applied to Vault.AssetsTotal and LoanBroker.DebtTotal at a single
+// accounting touch point (origination, payment, impair/unimpair/default).
+struct AccountingDeltas
+{
+    Number assetsTotalDelta;
+    Number debtTotalDelta;
+};
+
+// Whole-life (pre-LendingProtocolV1_1) recognition model: interest is
+// recognized into AssetsTotal/DebtTotal up front, at origination.
+namespace accrual {
+
+// LoanSet origination: what's added to Vault.AssetsTotal and LoanBroker.DebtTotal
+AccountingDeltas
+loanOriginationDeltas(Number const& principalRequested, Number const& interestDue);
+
+// LoanSet origination: would recognizing this loan's interest push
+// Vault.AssetsTotal past Vault.AssetsMaximum?
+bool
+loanOriginationExceedsVaultMaximum(
+    Number const& vaultMaximum,
+    Number const& vaultTotal,
+    Number const& interestDue);
+
+// LoanManage impair/unimpair/default: the vault's exposure to this loan
+Number
+loanVaultExposure(SLE::const_ref loanSle);
+
+// LoanPay: what's added to Vault.AssetsTotal and subtracted from LoanBroker.DebtTotal for a payment
+AccountingDeltas
+loanPaymentDeltas(LoanPaymentParts const& parts);
+
+}  // namespace accrual
+
+// Cash-basis (LendingProtocolV1_1) recognition model: AssetsTotal/DebtTotal
+// are principal-only, interest is recognized only as it's actually paid.
+namespace cash_basis {
+
+AccountingDeltas
+loanOriginationDeltas(Number const& principalRequested);
+
+Number
+loanVaultExposure(SLE::const_ref loanSle);
+
+AccountingDeltas
+loanPaymentDeltas(LoanPaymentParts const& parts);
+
+}  // namespace cash_basis
+
+// Public dispatchers: pick cash_basis:: if featureLendingProtocolV1_1 is
+// enabled AND the Vault's LEVersion (VaultHelpers::getVaultVersion) is
+// VaultVersion::CashBasis, else accrual::. These are the only entry points
+// transactors call.
+AccountingDeltas
+loanOriginationDeltas(
+    SLE::const_ref vaultSle,
+    Number const& principalRequested,
+    Number const& interestDue);
+
+bool
+loanOriginationExceedsVaultMaximum(
+    SLE::const_ref vaultSle,
+    Number const& vaultTotal,
+    Number const& interestDue);
+
+Number
+loanVaultExposure(SLE::const_ref vaultSle, SLE::const_ref loanSle);
+
+AccountingDeltas
+loanPaymentDeltas(SLE::const_ref vaultSle, LoanPaymentParts const& parts);
+
 namespace detail {
 // These classes and functions should only be accessed by LendingHelper
 // functions and unit tests
--- a/include/xrpl/ledger/helpers/VaultHelpers.h
+++ b/include/xrpl/ledger/helpers/VaultHelpers.h
@@ -2,6 +2,7 @@

 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>

@@ -107,4 +108,19 @@ sharesToAssetsWithdraw(
 [[nodiscard]] bool
 isSoleShareholder(ReadView const& view, AccountID const& account, SLE::const_ref issuance);

+/**
+ * Resolves a Vault's LEVersion, the single point every accounting touch
+ * point should call to determine which recognition model (accrual vs.
+ * cash-basis) a Vault uses. Vaults created before featureLendingProtocolV1_1
+ * activated never have sfLEVersion set, which resolves here to
+ * VaultVersion::Legacy.
+ *
+ * @param vault The vault SLE.
+ *
+ * @return The Vault's LEVersion, or VaultVersion::Legacy if the field is
+ * absent.
+ */
+[[nodiscard]] VaultVersion
+getVaultVersion(SLE::const_ref vault);
+
 }  // namespace xrpl
--- a/include/xrpl/net/AutoSocket.h
+++ b/include/xrpl/net/AutoSocket.h
@@ -67,16 +67,16 @@ public:
        return socket_->next_layer();
    }

-    beast::IP::Endpoint
+    beast::ip::Endpoint
    localEndpoint()
    {
-        return beast::IP::fromAsio(lowestLayer().local_endpoint());
+        return beast::ip::fromAsio(lowestLayer().local_endpoint());
    }

-    beast::IP::Endpoint
+    beast::ip::Endpoint
    remoteEndpoint()
    {
-        return beast::IP::fromAsio(lowestLayer().remote_endpoint());
+        return beast::ip::fromAsio(lowestLayer().remote_endpoint());
    }

    lowest_layer_type&
--- a/include/xrpl/nodestore/Backend.h
+++ b/include/xrpl/nodestore/Backend.h
@@ -13,7 +13,7 @@
 #include <stdexcept>
 #include <string>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * A backend used for the NodeStore.
@@ -163,4 +163,4 @@ public:
    fdRequired() const = 0;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/Database.h
+++ b/include/xrpl/nodestore/Database.h
@@ -25,7 +25,7 @@ namespace xrpl {
 class Section;
 }  // namespace xrpl

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * Persistency layer for NodeObject
@@ -248,7 +248,7 @@ protected:
    void
    storeStats(std::uint64_t count, std::uint64_t sz)
    {
-        XRPL_ASSERT(count <= sz, "xrpl::NodeStore::Database::storeStats : valid inputs");
+        XRPL_ASSERT(count <= sz, "xrpl::node_store::Database::storeStats : valid inputs");
        storeCount_ += count;
        storeSz_ += sz;
    }
@@ -308,4 +308,4 @@ private:
    threadEntry();
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/DatabaseRotating.h
+++ b/include/xrpl/nodestore/DatabaseRotating.h
@@ -9,7 +9,7 @@
 #include <memory>
 #include <string>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /* This class has two key-value store Backend objects for persisting SHAMap
 * records. This facilitates online deletion of data. New backends are
@@ -38,7 +38,7 @@ public:
     */
    virtual void
    rotate(
-        std::unique_ptr<NodeStore::Backend>&& newBackend,
+        std::unique_ptr<node_store::Backend>&& newBackend,
        std::function<void(std::string const& writableName, std::string const& archiveName)> const&
            f) = 0;

@@ -56,4 +56,4 @@ public:
    setRotationInFlight(bool inFlight) = 0;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/DummyScheduler.h
+++ b/include/xrpl/nodestore/DummyScheduler.h
@@ -3,7 +3,7 @@
 #include <xrpl/nodestore/Scheduler.h>
 #include <xrpl/nodestore/Task.h>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * Simple NodeStore Scheduler that just performs the tasks synchronously.
@@ -21,4 +21,4 @@ public:
    onBatchWrite(BatchWriteReport const& report) override;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/Factory.h
+++ b/include/xrpl/nodestore/Factory.h
@@ -14,7 +14,7 @@ namespace xrpl {
 class Section;
 }  // namespace xrpl

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * Base class for backend factories.
@@ -70,4 +70,4 @@ public:
    }
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/Manager.h
+++ b/include/xrpl/nodestore/Manager.h
@@ -10,7 +10,7 @@
 #include <memory>
 #include <string>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * Singleton for managing NodeStore factories and back ends.
@@ -98,4 +98,4 @@ public:
        beast::Journal journal) = 0;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/NodeObject.h
+++ b/include/xrpl/nodestore/NodeObject.h
@@ -8,7 +8,7 @@
 #include <cstdint>
 #include <memory>

-// VFALCO NOTE Intentionally not in the NodeStore namespace
+// VFALCO NOTE Intentionally not in the node_store namespace

 namespace xrpl {

--- a/include/xrpl/nodestore/Scheduler.h
+++ b/include/xrpl/nodestore/Scheduler.h
@@ -4,7 +4,7 @@

 #include <chrono>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 enum class FetchType { Synchronous, Async };

@@ -71,4 +71,4 @@ public:
    onBatchWrite(BatchWriteReport const& report) = 0;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/Task.h
+++ b/include/xrpl/nodestore/Task.h
@@ -1,6 +1,6 @@
 #pragma once

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * Derived classes perform scheduled tasks.
@@ -17,4 +17,4 @@ struct Task
    performScheduledTask() = 0;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/Types.h
+++ b/include/xrpl/nodestore/Types.h
@@ -5,7 +5,7 @@
 #include <memory>
 #include <vector>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 // This is only used to pre-allocate the array for
 // batch objects and does not affect the amount written.
@@ -36,4 +36,4 @@ enum class Status {
 */
 using Batch = std::vector<std::shared_ptr<NodeObject>>;

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/detail/BatchWriter.h
+++ b/include/xrpl/nodestore/detail/BatchWriter.h
@@ -9,7 +9,7 @@
 #include <memory>
 #include <mutex>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * Batch-writing assist logic.
@@ -86,4 +86,4 @@ private:
    Batch writeSet_;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/detail/DatabaseNodeImp.h
+++ b/include/xrpl/nodestore/detail/DatabaseNodeImp.h
@@ -22,7 +22,7 @@
 #include <stdexcept>
 #include <utility>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 class DatabaseNodeImp : public Database
 {
@@ -68,7 +68,7 @@ public:

        XRPL_ASSERT(
            backend_,
-            "xrpl::NodeStore::DatabaseNodeImp::DatabaseNodeImp : non-null "
+            "xrpl::node_store::DatabaseNodeImp::DatabaseNodeImp : non-null "
            "backend");
    }

@@ -138,4 +138,4 @@ private:
    }
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
+++ b/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
@@ -16,7 +16,7 @@
 #include <mutex>
 #include <string>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 class DatabaseRotatingImp : public DatabaseRotating
 {
@@ -41,7 +41,7 @@ public:

    void
    rotate(
-        std::unique_ptr<NodeStore::Backend>&& newBackend,
+        std::unique_ptr<node_store::Backend>&& newBackend,
        std::function<void(std::string const& writableName, std::string const& archiveName)> const&
            f) override;

@@ -94,4 +94,4 @@ private:
    forEach(std::function<void(std::shared_ptr<NodeObject>)> f) override;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/detail/DecodedBlob.h
+++ b/include/xrpl/nodestore/detail/DecodedBlob.h
@@ -4,7 +4,7 @@

 #include <memory>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * Parsed key/value blob into NodeObject components.
@@ -49,4 +49,4 @@ private:
    int dataBytes_;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/detail/EncodedBlob.h
+++ b/include/xrpl/nodestore/detail/EncodedBlob.h
@@ -12,7 +12,7 @@
 #include <memory>
 #include <stdexcept>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 /**
 * Convert a NodeObject from in-memory to database format.
@@ -68,7 +68,7 @@ class EncodedBlob
 public:
    explicit EncodedBlob(std::shared_ptr<NodeObject> const& obj)
        : size_([&obj]() {
-            XRPL_ASSERT(obj, "xrpl::NodeStore::EncodedBlob::EncodedBlob : non-null input");
+            XRPL_ASSERT(obj, "xrpl::node_store::EncodedBlob::EncodedBlob : non-null input");

            if (!obj)
                throw std::runtime_error("EncodedBlob: unseated std::shared_ptr used.");
@@ -88,7 +88,7 @@ public:
        XRPL_ASSERT(
            ((ptr_ == payload_.data()) && (size_ <= payload_.size())) ||
                ((ptr_ != payload_.data()) && (size_ > payload_.size())),
-            "xrpl::NodeStore::EncodedBlob::~EncodedBlob : valid payload "
+            "xrpl::node_store::EncodedBlob::~EncodedBlob : valid payload "
            "pointer");

        if (ptr_ != payload_.data())
@@ -114,4 +114,4 @@ public:
    }
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/detail/ManagerImp.h
+++ b/include/xrpl/nodestore/detail/ManagerImp.h
@@ -13,7 +13,7 @@
 #include <string>
 #include <vector>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 class ManagerImp : public Manager
 {
@@ -57,4 +57,4 @@ public:
        beast::Journal journal) override;
 };

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/detail/Varint.h
+++ b/include/xrpl/nodestore/detail/Varint.h
@@ -6,25 +6,25 @@
 #include <cstdint>
 #include <type_traits>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 // This is a variant of the base128 varint format from
 // google protocol buffers:
 // https://developers.google.com/protocol-buffers/docs/encoding#varints

 // field tag
-struct varint;
+struct Varint;

-// Metafuncton to return largest
+// Metafunction to return largest
 // possible size of T represented as varint.
 // T must be unsigned
 template <class T, bool = std::is_unsigned_v<T>>
-struct varint_traits;
+struct VarintTraits;

 template <class T>
-struct varint_traits<T, true>
+struct VarintTraits<T, true>
 {
-    explicit varint_traits() = default;
+    explicit VarintTraits() = default;

    static constexpr std::size_t kMax = ((8 * sizeof(T)) + 6) / 7;
 };
@@ -104,7 +104,7 @@ writeVarint(void* p0, std::size_t v)
 template <class T>
 void
 read(nudb::detail::istream& is, std::size_t& u)
-    requires(std::is_same_v<T, varint>)
+    requires(std::is_same_v<T, Varint>)
 {
    auto p0 = is(1);
    auto p1 = p0;
@@ -118,9 +118,9 @@ read(nudb::detail::istream& is, std::size_t& u)
 template <class T>
 void
 write(nudb::detail::ostream& os, std::size_t t)
-    requires(std::is_same_v<T, varint>)
+    requires(std::is_same_v<T, Varint>)
 {
    writeVarint(os.data(sizeVarint(t)), t);
 }

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/nodestore/detail/codec.h
+++ b/include/xrpl/nodestore/detail/codec.h
@@ -10,7 +10,7 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/nodestore/NodeObject.h>
-#include <xrpl/nodestore/detail/varint.h>
+#include <xrpl/nodestore/detail/Varint.h>
 #include <xrpl/protocol/HashPrefix.h>

 #include <nudb/detail/field.hpp>
@@ -21,7 +21,7 @@
 #include <cstring>
 #include <string>

-namespace xrpl::NodeStore {
+namespace xrpl::node_store {

 template <class BufferFactory>
 std::pair<void const*, std::size_t>
@@ -59,7 +59,7 @@ lz4Compress(void const* in, std::size_t inSize, BufferFactory&& bf)
    using std::runtime_error;
    using namespace nudb::detail;
    std::pair<void const*, std::size_t> result;
-    std::array<std::uint8_t, varint_traits<std::size_t>::kMax> vi{};
+    std::array<std::uint8_t, VarintTraits<std::size_t>::kMax> vi{};
    auto const n = writeVarint(vi.data(), inSize);
    auto const outMax = LZ4_compressBound(inSize);
    auto* out = reinterpret_cast<std::uint8_t*>(bf(n + outMax));
@@ -240,7 +240,7 @@ nodeobjectCompress(void const* in, std::size_t inSize, BufferFactory&& bf)
                auto* out = reinterpret_cast<std::uint8_t*>(bf(result.second));
                result.first = out;
                ostream os(out, result.second);
-                write<varint>(os, type);
+                write<Varint>(os, type);
                write<std::uint16_t>(os, mask);
                write(os, vh.data(), n * 32);
                return result;
@@ -252,13 +252,13 @@ nodeobjectCompress(void const* in, std::size_t inSize, BufferFactory&& bf)
            auto* out = reinterpret_cast<std::uint8_t*>(bf(result.second));
            result.first = out;
            ostream os(out, result.second);
-            write<varint>(os, type);
+            write<Varint>(os, type);
            write(os, vh.data(), n * 32);
            return result;
        }
    }

-    std::array<std::uint8_t, varint_traits<std::size_t>::kMax> vi{};
+    std::array<std::uint8_t, VarintTraits<std::size_t>::kMax> vi{};

    static constexpr std::size_t kCodecType = 1;
    auto const vn = writeVarint(vi.data(), kCodecType);
@@ -269,7 +269,7 @@ nodeobjectCompress(void const* in, std::size_t inSize, BufferFactory&& bf)
        case 1:  // lz4
        {
            std::uint8_t* p = nullptr;
-            auto const lzr = NodeStore::lz4Compress(in, inSize, [&p, &vn, &bf](std::size_t n) {
+            auto const lzr = node_store::lz4Compress(in, inSize, [&p, &vn, &bf](std::size_t n) {
                p = reinterpret_cast<std::uint8_t*>(bf(vn + n));
                return p + vn;
            });
@@ -316,4 +316,4 @@ filterInner(void* in, std::size_t inSize)
    }
 }

-}  // namespace xrpl::NodeStore
+}  // namespace xrpl::node_store
--- a/include/xrpl/peerfinder/Config.h
+++ b/include/xrpl/peerfinder/Config.h
@@ -0,0 +1,163 @@
+#pragma once
+
+#include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/peerfinder/detail/Tuning.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+
+namespace xrpl::peer_finder {
+
+struct PeerLimitConfig
+{
+    std::optional<std::size_t> maxPeers;
+    std::optional<std::size_t> inPeers;
+    std::optional<std::size_t> outPeers;
+};
+
+/**
+ * PeerFinder configuration settings.
+ */
+struct Config
+{
+    /**
+     * The largest number of public peer slots to allow.
+     * This includes both inbound and outbound, but does not include
+     * fixed peers.
+     */
+    std::size_t maxPeers{tuning::kDefaultMaxPeers};
+
+    /**
+     * The number of automatic outbound connections to maintain.
+     * Outbound connections are only maintained if autoConnect
+     * is `true`.
+     */
+    std::size_t outPeers = calcOutPeers();  // Note: relies on `maxPeers` being initialized
+
+    /**
+     * The number of automatic inbound connections to maintain.
+     * Inbound connections are only maintained if wantIncoming
+     * is `true`.
+     */
+    std::size_t inPeers{0};
+
+    /**
+     * `true` if we want our IP address kept private.
+     */
+    bool peerPrivate = true;
+
+    /**
+     * `true` if we want to accept incoming connections.
+     */
+    bool wantIncoming{true};
+
+    /**
+     * `true` if we want to establish connections automatically
+     */
+    bool autoConnect{true};
+
+    /**
+     * The listening port number.
+     */
+    std::uint16_t listeningPort{0};
+
+    /**
+     * The set of features we advertise.
+     */
+    std::string features;
+
+    /**
+     * Limit how many incoming connections we allow per IP
+     */
+    int ipLimit{0};
+
+    /**
+     * `true` if we want to verify endpoints in TMEndpoints messages
+     */
+    bool verifyEndpoints = true;
+
+    //--------------------------------------------------------------------------
+
+    /**
+     * Returns a suitable value for outPeers according to the rules.
+     */
+    [[nodiscard]] std::size_t
+    calcOutPeers() const;
+
+    /**
+     * Adjusts the values so they follow the business rules.
+     */
+    void
+    applyTuning();
+
+    /**
+     * Write the configuration into a property stream
+     */
+    void
+    onWrite(beast::PropertyStream::Map& map) const;
+
+    /**
+     * Make peer_finder::Config from peer limit and server mode parameters.
+     */
+    static Config
+    makeConfig(
+        bool peerPrivate,
+        bool standalone,
+        PeerLimitConfig const& limits,
+        std::uint16_t port,
+        bool validationPublicKey,
+        int ipLimit,
+        bool verifyEndpoints);
+
+    /**
+     * Compares two configurations for equality field by field.
+     */
+    friend bool
+    operator==(Config const& lhs, Config const& rhs) = default;
+};
+
+//------------------------------------------------------------------------------
+
+/**
+ * Possible results from activating a slot.
+ */
+enum class Result { InboundDisabled, DuplicatePeer, IpLimitExceeded, Full, Success };
+
+/**
+ * @brief Converts a `Result` enum value to its string representation.
+ *
+ * This function provides a human-readable string for a given `Result` enum,
+ * which is useful for logging, debugging, or displaying status messages.
+ *
+ * @param result The `Result` enum value to convert.
+ * @return A `std::string_view` representing the enum value. Returns "unknown"
+ * if the enum value is not explicitly handled.
+ *
+ * @note This function returns a `std::string_view` for performance.
+ * A `std::string` would need to allocate memory on the heap and copy the
+ * string literal into it every time the function is called.
+ */
+inline std::string_view
+to_string(Result result) noexcept
+{
+    switch (result)
+    {
+        case Result::InboundDisabled:
+            return "inbound disabled";
+        case Result::DuplicatePeer:
+            return "peer already connected";
+        case Result::IpLimitExceeded:
+            return "ip limit exceeded";
+        case Result::Full:
+            return "slots full";
+        case Result::Success:
+            return "success";
+    }
+
+    return "unknown";
+}
+
+}  // namespace xrpl::peer_finder
--- a/include/xrpl/peerfinder/PeerfinderManager.h
+++ b/include/xrpl/peerfinder/PeerfinderManager.h
@@ -0,0 +1,179 @@
+#pragma once
+
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/peerfinder/Config.h>
+#include <xrpl/peerfinder/Slot.h>
+#include <xrpl/peerfinder/Types.h>
+#include <xrpl/protocol/PublicKey.h>
+
+#include <boost/asio/ip/tcp.hpp>
+
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+namespace xrpl::peer_finder {
+
+/**
+ * Maintains a set of IP addresses used for getting into the network.
+ */
+class Manager : public beast::PropertyStream::Source
+{
+protected:
+    Manager() noexcept;
+
+public:
+    /**
+     * Destroy the object.
+     * Any pending source fetch operations are aborted.
+     * There may be some listener calls made before the
+     * destructor returns.
+     */
+    ~Manager() override = default;
+
+    /**
+     * Set the configuration for the manager.
+     * The new settings will be applied asynchronously.
+     * Thread safety:
+     *     Can be called from any threads at any time.
+     */
+    virtual void
+    setConfig(Config const& config) = 0;
+
+    /**
+     * Transition to the started state, synchronously.
+     */
+    virtual void
+    start() = 0;
+
+    /**
+     * Transition to the stopped state, synchronously.
+     */
+    virtual void
+    stop() = 0;
+
+    /**
+     * Returns the configuration for the manager.
+     */
+    virtual Config
+    config() = 0;
+
+    /**
+     * Add a peer that should always be connected.
+     * This is useful for maintaining a private cluster of peers.
+     * The string is the name as specified in the configuration
+     * file, along with the set of corresponding IP addresses.
+     */
+    virtual void
+    addFixedPeer(std::string_view name, std::vector<beast::ip::Endpoint> const& addresses) = 0;
+
+    /**
+     * Add a set of strings as fallback ip::Endpoint sources.
+     * @param name A label used for diagnostics.
+     */
+    virtual void
+    addFallbackStrings(std::string const& name, std::vector<std::string> const& strings) = 0;
+
+    /**
+     * Add a URL as a fallback location to obtain ip::Endpoint sources.
+     * @param name A label used for diagnostics.
+     */
+    /* VFALCO NOTE Unimplemented
+    virtual void addFallbackURL (std::string const& name,
+        std::string const& url) = 0;
+    */
+
+    //--------------------------------------------------------------------------
+
+    /**
+     * Create a new inbound slot with the specified remote endpoint.
+     * If nullptr is returned, then the slot could not be assigned.
+     * Usually this is because of a detected self-connection.
+     */
+    virtual std::pair<std::shared_ptr<Slot>, Result>
+    newInboundSlot(
+        beast::ip::Endpoint const& localEndpoint,
+        beast::ip::Endpoint const& remoteEndpoint) = 0;
+
+    /**
+     * Create a new outbound slot with the specified remote endpoint.
+     * If nullptr is returned, then the slot could not be assigned.
+     * Usually this is because of a duplicate connection.
+     */
+    virtual std::pair<std::shared_ptr<Slot>, Result>
+    newOutboundSlot(beast::ip::Endpoint const& remoteEndpoint) = 0;
+
+    /**
+     * Called when mtENDPOINTS is received.
+     */
+    virtual void
+    onEndpoints(std::shared_ptr<Slot> const& slot, Endpoints const& endpoints) = 0;
+
+    /**
+     * Called when the slot is closed.
+     * This always happens when the socket is closed, unless the socket
+     * was canceled.
+     */
+    virtual void
+    onClosed(std::shared_ptr<Slot> const& slot) = 0;
+
+    /**
+     * Called when an outbound connection is deemed to have failed
+     */
+    virtual void
+    onFailure(std::shared_ptr<Slot> const& slot) = 0;
+
+    /**
+     * Called when we received redirect IPs from a busy peer.
+     */
+    virtual void
+    onRedirects(
+        boost::asio::ip::tcp::endpoint const& remoteAddress,
+        std::vector<boost::asio::ip::tcp::endpoint> const& eps) = 0;
+
+    //--------------------------------------------------------------------------
+
+    /**
+     * Called when an outbound connection attempt succeeds.
+     * The local endpoint must be valid. If the caller receives an error
+     * when retrieving the local endpoint from the socket, it should
+     * proceed as if the connection attempt failed by calling on_closed
+     * instead of on_connected.
+     * @return `true` if the connection should be kept
+     */
+    virtual bool
+    onConnected(std::shared_ptr<Slot> const& slot, beast::ip::Endpoint const& localEndpoint) = 0;
+
+    /**
+     * Request an active slot type.
+     */
+    virtual Result
+    activate(std::shared_ptr<Slot> const& slot, PublicKey const& key, bool reserved) = 0;
+
+    /**
+     * Returns a set of endpoints suitable for redirection.
+     */
+    virtual std::vector<Endpoint>
+    redirect(std::shared_ptr<Slot> const& slot) = 0;
+
+    /**
+     * Return a set of addresses we should connect to.
+     */
+    virtual std::vector<beast::ip::Endpoint>
+    autoconnect() = 0;
+
+    virtual std::vector<std::pair<std::shared_ptr<Slot>, std::vector<Endpoint>>>
+    buildEndpointsForPeers() = 0;
+
+    /**
+     * Perform periodic activity.
+     * This should be called once per second.
+     */
+    virtual void
+    oncePerSecond() = 0;
+};
+
+}  // namespace xrpl::peer_finder
--- a/include/xrpl/peerfinder/Slot.h
+++ b/include/xrpl/peerfinder/Slot.h
@@ -7,7 +7,7 @@
 #include <memory>
 #include <optional>

-namespace xrpl::PeerFinder {
+namespace xrpl::peer_finder {

 /**
 * Properties and state associated with a peer to peer overlay connection.
@@ -52,13 +52,13 @@ public:
    /**
     * The remote endpoint of socket.
     */
-    [[nodiscard]] virtual beast::IP::Endpoint const&
+    [[nodiscard]] virtual beast::ip::Endpoint const&
    remoteEndpoint() const = 0;

    /**
     * The local endpoint of the socket, when known.
     */
-    [[nodiscard]] virtual std::optional<beast::IP::Endpoint> const&
+    [[nodiscard]] virtual std::optional<beast::ip::Endpoint> const&
    localEndpoint() const = 0;

    [[nodiscard]] virtual std::optional<std::uint16_t>
@@ -72,4 +72,4 @@ public:
    publicKey() const = 0;
 };

-}  // namespace xrpl::PeerFinder
+}  // namespace xrpl::peer_finder
--- a/include/xrpl/peerfinder/Types.h
+++ b/include/xrpl/peerfinder/Types.h
@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/beast/clock/abstract_clock.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/peerfinder/detail/Tuning.h>
+
+#include <chrono>
+#include <cstdint>
+#include <vector>
+
+namespace xrpl::peer_finder {
+
+using clock_type = beast::AbstractClock<std::chrono::steady_clock>;
+
+/**
+ * Represents a set of addresses.
+ */
+using IPAddresses = std::vector<beast::ip::Endpoint>;
+
+//------------------------------------------------------------------------------
+
+/**
+ * Describes a connectable peer address along with some metadata.
+ */
+struct Endpoint
+{
+    Endpoint() = default;
+
+    Endpoint(beast::ip::Endpoint ep, std::uint32_t hops);
+
+    std::uint32_t hops = 0;
+    beast::ip::Endpoint address;
+};
+
+inline bool
+operator<(Endpoint const& lhs, Endpoint const& rhs)
+{
+    return lhs.address < rhs.address;
+}
+
+/**
+ * A set of Endpoint used for connecting.
+ */
+using Endpoints = std::vector<Endpoint>;
+
+}  // namespace xrpl::peer_finder
--- a/Show More
+++ b/Show More