Merge branch 'ripple/wasmi-host-functions' of https://github.com/XRPLF/rippled into mvadari/remove-float-root

chore: upgrade wasmi to 2.0.0-beta.10

.cspell.config.yaml

@@ -7,6 +7,8 @@ ignorePaths:
   - cmake/**
   - LICENSE.md
   - .clang-tidy
+  - src/test/app/wasm_fixtures/*.c
+  - nix/check-tools/*.txt # generated, and full of Nix store hashes
 language: en
 allowCompoundWords: true # TODO (#6334)
 ignoreRandomStrings: true
@@ -69,6 +71,7 @@ words:
   - canonicality
   - cdylib
   - canonicalised
+  - cctools
   - changespq
   - checkme
   - choco
@@ -111,6 +114,7 @@ words:
   - disablerepo
   - distro
   - doxyfile
+  - dsymutil
   - dxrpl
   - elgamal
   - enabled
@@ -172,6 +176,7 @@ words:
   - LOCALGOOD
   - logwstream
   - Lombrozo
+  - lresolv
   - lseq
   - lsmf
   - ltype
@@ -225,6 +230,7 @@ words:
   - Nyffenegger
   - onlatest
   - ostr
+  - otool
   - oxalica
   - pargs
   - partitioner
@@ -255,11 +261,15 @@ words:
   - Raphson
   - rcflags
   - replayer
+  - repodata
+  - repomd
   - rerandomize
   - rerandomization
   - rerandomized
   - rerandomizes
   - rerere
+  - retargeted
+  - retargets
   - retriable
   - RIPD
   - ripdtop
@@ -295,6 +305,7 @@ words:
   - sles
   - soci
   - socidb
+  - Sonatype
   - sponsee
   - sponsees
   - SRPMS
@@ -365,6 +376,7 @@ words:
   - vfalco
   - vinnie
   - wasmi
+  - wasmparser
   - Werror
   - wextra
   - wptr
@@ -373,13 +385,16 @@ words:
   - wthread
   - xbridge
   - xchain
+  - xcrun
   - xfloat
   - ximinez
   - XMACRO
+  - xored
   - xrpkuwait
   - xrpl
   - xrpld
   - xrplf
   - xxhash
   - xxhasher
+  - zstdio
   - CGNAT

.envrc

@@ -1,3 +1,7 @@
 watch_file nix/*.nix
 
+# The dev shell derivation includes all of conan/ (see nix/devshell.nix), so any
+# change in there has to invalidate direnv's cached environment.
+watch_dir conan
+
 use flake

.github/actions/cargo-cache/action.yml

@@ -0,0 +1,38 @@
+name: Use cargo artifacts cache
+description: >
+  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
+  when saving the cache, rust-cache deletes all binaries that were already
+  present there, which on persistent self-hosted runners wipes the tools
+  installed by prepare-runner. Harmless on ephemeral runners, but kept
+  consistent everywhere.
+
+inputs:
+  workspaces:
+    description: "Workspaces to cache, as 'workspace -> target' lines."
+    required: false
+    default: crates
+  key:
+    description: "Additional part of the cache key."
+    required: false
+    default: ""
+  cache-directories:
+    description: "Additional non-workspace directories to cache."
+    required: false
+    default: ""
+  save-if:
+    description: "Condition for saving the cache after the job."
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+
+  steps:
+    - name: Use cargo artifacts cache
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        cache-bin: "false"
+        cache-directories: ${{ inputs.cache-directories }}
+        key: ${{ inputs.key }}
+        save-if: ${{ inputs.save-if }}
+        workspaces: ${{ inputs.workspaces }}

.github/actions/generate-version/action.yml

@@ -1,44 +0,0 @@
-name: Generate build version number
-description: "Generate build version number."
-
-outputs:
-  version:
-    description: "The generated build version number."
-    value: ${{ steps.version.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    # When a tag is pushed, the version is used as-is.
-    - name: Generate version for tag event
-      if: ${{ startsWith(github.ref, 'refs/tags/') }}
-      shell: bash
-      env:
-        VERSION: ${{ github.ref_name }}
-      run: echo "VERSION=${VERSION}" >>"${GITHUB_ENV}"
-
-    # When a tag is not pushed, then the version (e.g. 1.2.3-b0) is extracted
-    # from the BuildInfo.cpp file and the shortened commit hash appended to it.
-    # We use a plus sign instead of a hyphen because Conan recipe versions do
-    # not support two hyphens.
-    - name: Generate version for non-tag event
-      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-      shell: bash
-      run: |
-        echo 'Extracting version from BuildInfo.cpp.'
-        VERSION="$(cat src/libxrpl/protocol/BuildInfo.cpp | grep "versionString =" | awk -F '"' '{print $2}')"
-        if [[ -z "${VERSION}" ]]; then
-            echo 'Unable to extract version from BuildInfo.cpp.'
-            exit 1
-        fi
-
-        echo 'Appending shortened commit hash to version.'
-        SHA='${{ github.sha }}'
-        VERSION="${VERSION}+${SHA:0:7}"
-
-        echo "VERSION=${VERSION}" >>"${GITHUB_ENV}"
-
-    - name: Output version
-      id: version
-      shell: bash
-      run: echo "version=${VERSION}" >>"${GITHUB_OUTPUT}"

.github/actions/release-info/action.yml

@@ -0,0 +1,90 @@
+name: Release info
+description: "Derive the version, release channel and package release number for this build."
+
+outputs:
+  version:
+    description: "The build version number."
+    value: ${{ steps.version.outputs.version }}
+  channel:
+    description: "The release channel this build belongs to."
+    value: ${{ steps.channel.outputs.channel }}
+  pkg_release:
+    description: "The package release number: 1 for a tag, the run number otherwise."
+    value: ${{ steps.pkg_release.outputs.pkg_release }}
+
+runs:
+  using: composite
+  steps:
+    # A tag names its own version. Anything else takes it from BuildInfo.cpp and
+    # appends the commit hash as build metadata, joined with a plus sign because a
+    # Conan version cannot contain two hyphens.
+    - name: Determine version
+      id: version
+      shell: bash
+      env:
+        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
+        REF_NAME: ${{ github.ref_name }}
+        SHA: ${{ github.sha }}
+      run: |
+        if [[ "${IS_TAG}" == "true" ]]; then
+            version="${REF_NAME}"
+        else
+            version="$(awk -F'"' '/versionString =/ { print $2 }' src/libxrpl/protocol/BuildInfo.cpp)"
+            if [[ -z "${version}" ]]; then
+                echo "Unable to read versionString from BuildInfo.cpp." >&2
+                exit 1
+            fi
+            version="${version}+${SHA:0:7}"
+        fi
+
+        echo "version=${version}" | tee -a "${GITHUB_OUTPUT}"
+
+    # Only a tag says how mature a build is: a push is a develop build whatever
+    # its version, and a non-public codebase keeps its packages to itself.
+    - name: Determine release channel
+      id: channel
+      shell: bash
+      env:
+        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
+        REF_NAME: ${{ github.ref_name }}
+        VISIBILITY: ${{ github.event.repository.visibility }}
+      run: |
+        pre_release=""
+        if [[ "${REF_NAME}" == *-* ]]; then
+            pre_release="${REF_NAME#*-}"
+        fi
+
+        if [[ "${VISIBILITY}" != "public" ]]; then
+            channel=private
+        elif [[ "${IS_TAG}" != "true" ]]; then
+            channel=develop
+        elif [[ -z "${pre_release}" ]]; then
+            channel=stable
+        elif [[ "${pre_release}" =~ ^rc[0-9]+(\+.*)?$ ]]; then
+            channel=unstable
+        elif [[ "${pre_release}" =~ ^b(0|[1-9][0-9]*)(\+.*)?$ ]]; then
+            channel=experimental
+        else
+            echo "Unsupported pre-release in tag '${REF_NAME}'. Use bN or rcN." >&2
+            exit 1
+        fi
+
+        echo "channel=${channel}" | tee -a "${GITHUB_OUTPUT}"
+
+    # A tag is packaged once, so its release number is fixed at 1. Develop builds
+    # repeat the same version, so the run number is what makes each push an
+    # upgrade rather than a reinstall.
+    - name: Determine package release
+      id: pkg_release
+      shell: bash
+      env:
+        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
+        RUN_NUMBER: ${{ github.run_number }}
+      run: |
+        if [[ "${IS_TAG}" == "true" ]]; then
+            pkg_release=1
+        else
+            pkg_release="${RUN_NUMBER}"
+        fi
+
+        echo "pkg_release=${pkg_release}" | tee -a "${GITHUB_OUTPUT}"

.github/actions/setup-nix-env/action.yml

@@ -0,0 +1,69 @@
+name: Setup Nix environment
+description: "Build the flake's CI environment and put its tools on PATH."
+
+# The environment from nix/ci-env.nix, the same one the Linux CI images bake in
+# (see nix/docker). Exported onto PATH rather than entered with `nix develop`:
+# the composite actions below run plain `bash` and would escape a dev shell.
+
+runs:
+  using: composite
+
+  steps:
+    - name: Build the CI environment
+      id: build
+      shell: bash
+      env:
+        # --out-link doubles as a GC root for the length of the job.
+        OUT_LINK: ${{ runner.temp }}/xrpld-ci-env
+      run: |
+        # --extra-experimental-features: flakes may not be on in the runner's nix.conf.
+        nix --extra-experimental-features "nix-command flakes" \
+            build .#default --out-link "${OUT_LINK}" --print-build-logs
+        echo "path=$(readlink -f "${OUT_LINK}")" >>"${GITHUB_OUTPUT}"
+
+    - name: Export the environment
+      shell: bash
+      env:
+        ENV_PATH: ${{ steps.build.outputs.path }}
+      run: |
+        echo "${ENV_PATH}/bin" >>"${GITHUB_PATH}"
+
+        # Already KEY=VALUE per line. See `darwinEnv` in nix/ci-env.nix.
+        ENV_FILE="${ENV_PATH}/share/xrpld-ci-env/env"
+        if [ -f "${ENV_FILE}" ]; then
+            cat "${ENV_FILE}" >>"${GITHUB_ENV}"
+        fi
+
+        # XrplSanity.cmake otherwise rejects a Nix compiler as one that leaked.
+        echo "XRPL_DEVSHELL=ci-env" >>"${GITHUB_ENV}"
+
+        # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
+        # own trust store, and pinning would break TLS to hosts relying on it.
+
+        # Workspace-local, so `cleanup-workspace` clears it, but not the
+        # `.conan2` prepare-runner hands the system toolchain: that Conan is a
+        # different version, and the two would migrate each other's cache.
+        echo "CONAN_HOME=${{ github.workspace }}/.conan2-nix" >>"${GITHUB_ENV}"
+
+    # Config, profiles and remote, exactly as the dev shell sets them up on
+    # entry; the `setup-conan` action is skipped for this toolchain.
+    - name: Setup Conan
+      shell: bash
+      run: ./conan/init.sh
+
+    # `Check tools` runs later but swallows failures; a bad export would just
+    # build with the system toolchain.
+    - name: Verify the toolchain resolves into the Nix store
+      shell: bash
+      run: |
+        for tool in clang clang++ cmake ninja conan; do
+            path="$(command -v "${tool}" || true)"
+            echo "${tool} -> ${path:-<not found>}"
+            case "${path}" in
+                /nix/store/*) ;;
+                *)
+                    echo "::error::${tool} does not resolve into the Nix store"
+                    exit 1
+                    ;;
+            esac
+        done

.github/dependabot.yml

@@ -4,7 +4,8 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
-      - .github/actions/generate-version/
+      - .github/actions/cargo-cache/
+      - .github/actions/release-info/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/
     schedule:
@@ -28,10 +29,9 @@ updates:
       time: "04:00"
       timezone: Etc/GMT
     commit-message:
-      prefix: "ci: [DEPENDABOT] "
+      prefix: "chore: [DEPENDABOT] "
     target-branch: develop
     open-pull-requests-limit: 10
-    # Bundle all Rust dependency bumps into a single PR per run to reduce noise.
     groups:
       rust-dependencies:
         patterns:

.github/scripts/rename/binary.sh

@@ -49,7 +49,7 @@ ${SED_COMMAND} -i -E 's@ripple/xrpld@XRPLF/rippled@g' BUILD.md
 ${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' BUILD.md
 ${SED_COMMAND} -i -E 's@xrpld \(`xrpld`\)@xrpld@g' BUILD.md
 ${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' CONTRIBUTING.md
-${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' docs/build/install.md
+${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' docs/install.md
 
 popd
 echo "Processing complete."

.github/scripts/rename/docs.sh

@@ -77,8 +77,8 @@ ${SED_COMMAND} -i 's/Ripple integrators/XRPL developers/' README.md
 ${SED_COMMAND} -i 's/sanitizer-configuration-for-rippled/sanitizer-configuration-for-xrpld/' docs/build/sanitizers.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' .github/scripts/levelization/README.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' .github/scripts/strategy-matrix/generate.py
-${SED_COMMAND} -i 's@/rippled@/xrpld@g' docs/build/install.md
-${SED_COMMAND} -i 's@github.com/XRPLF/xrpld@github.com/XRPLF/rippled@g' docs/build/install.md
+${SED_COMMAND} -i 's@/rippled@/xrpld@g' docs/install.md
+${SED_COMMAND} -i 's@github.com/XRPLF/xrpld@github.com/XRPLF/rippled@g' docs/install.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' docs/Doxyfile
 ${SED_COMMAND} -i 's/ripple_basics/basics/' include/xrpl/basics/CountedObject.h
 ${SED_COMMAND} -i 's/<ripple/<xrpl/' include/xrpl/protocol/AccountID.h

.github/scripts/strategy-matrix/generate.py

@@ -7,7 +7,12 @@ from pathlib import Path
 
 THIS_DIR = Path(__file__).parent.resolve()
 
-_BASE_CMAKE_ARGS = ["-Dtests=ON", "-Dwerr=ON", "-Dxrpld=ON", "-Dwextra=ON"]
+_BASE_CMAKE_ARGS = [
+    "-Dtests=ON",
+    "-Dwerr=ON",
+    "-Dxrpld=ON",
+    "-Dwextra=ON",
+]
 
 # Maps sanitizer names (as used in cmake) to short config-name suffixes.
 _SANITIZER_SUFFIX: dict[str, str] = {
@@ -88,6 +93,9 @@ class PlatformConfig:
     build_only: bool = False  # if true, skip tests (e.g. macos/Windows Debug)
     benchmark: bool = False  # if true, smoke-run the benchmarks after testing
     extra_cmake_args: str = ""
+    # "" is the runner's system compiler, "nix" the flake's CI environment.
+    # macOS only: Linux always builds in a Nix image, Windows has no Nix.
+    toolchain: str = ""
 
     def __post_init__(self) -> None:
         if isinstance(self.build_type, str):
@@ -137,6 +145,7 @@ class MatrixEntry:
     sanitizers: str
     image: str = ""  # container image; empty for macOS/Windows (runs natively)
     compiler: str = ""  # compiler name ("gcc" or "clang"); empty for macOS/Windows
+    toolchain: str = ""  # "nix" for the flake's CI environment; see PlatformConfig
 
 
 @dataclasses.dataclass
@@ -215,7 +224,7 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
 def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
     """Generate the packaging matrix from a LinuxFile's package_configs section.
 
-    Packaging uses vanilla distro images (debian:bookworm, ubi9, …) instead of
+    Packaging uses vanilla distro images (debian:bookworm, almalinux:9) instead of
     the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
     is taken from the distro's archive rather than from nixpkgs. Each config
     entry carries its own 'image'.
@@ -253,9 +262,12 @@ def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]
         if minimal and not cfg.minimal:
             continue
         for build_type in cfg.build_type:
+            name = f"{platform_name}-{arch}-{build_type.lower()}"
+            if cfg.toolchain:
+                name += f"-{cfg.toolchain}"
             entries.append(
                 MatrixEntry(
-                    config_name=f"{platform_name}-{arch}-{build_type.lower()}",
+                    config_name=name,
                     cmake_args=get_cmake_args(build_type, cfg.extra_cmake_args),
                     cmake_target="install" if is_windows else "all",
                     build_only=cfg.build_only,
@@ -263,6 +275,7 @@ def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]
                     build_type=build_type,
                     architecture=Architecture(platform=pf.platform, runner=pf.runner),
                     sanitizers="",
+                    toolchain=cfg.toolchain,
                 )
             )
     return entries

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-fecfc0c",
+  "image_tag": "sha-a0074f8",
   "configs": {
     "ubuntu": [
       {
@@ -92,7 +92,7 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-577d745"
+        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-a6983f8"
       }
     ],
 
@@ -102,7 +102,7 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-577d745"
+        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-a6983f8"
       }
     ]
   }

.github/scripts/strategy-matrix/macos.json

@@ -12,6 +12,19 @@
       "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
       "build_only": true,
       "minimal": false
+    },
+    {
+      "build_type": "Release",
+      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
+      "toolchain": "nix",
+      "minimal": false
+    },
+    {
+      "build_type": "Debug",
+      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
+      "toolchain": "nix",
+      "build_only": true,
+      "minimal": false
     }
   ]
 }

.github/workflows/build-nix-images.yml

@@ -58,7 +58,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -36,9 +36,10 @@ jobs:
         distro:
           - name: debian
             base_image: debian:bookworm
+          # AlmaLinux rather than UBI9, which does not ship rpm-sign.
           - name: rhel
-            base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+            base_image: almalinux:9
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
       dockerfile: package/Dockerfile

.github/workflows/build-pre-commit-image.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/cargo-audit.yml

@@ -1,8 +1,3 @@
-# This workflow audits the Rust dependencies in crates/ for known security
-# advisories using cargo-audit. It runs on a weekly schedule, whenever the
-# dependency graph changes (Cargo.lock / Cargo.toml), and on demand. On a
-# scheduled run, a failure opens a tracking issue (matching the clang-tidy
-# workflow's behavior); on push/PR it simply fails the check.
 name: Cargo audit
 
 on:
@@ -12,7 +7,7 @@ on:
   push:
     branches:
       - "develop"
-      - "release*"
+      - "release/*"
     paths:
       - "crates/**/Cargo.toml"
       - "crates/Cargo.lock"
@@ -39,14 +34,14 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-debian:sha-2e25435
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run cargo audit
         id: audit
@@ -81,4 +76,5 @@ jobs:
         if: ${{ steps.audit.outcome != 'success' }}
         run: |
           echo "cargo audit found advisories!"
+          cat /tmp/cargo-audit.txt
           exit 1

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

.github/workflows/on-pr.yml

@@ -77,8 +77,9 @@ jobs:
 
             # Keep the paths below in sync with those in `on-trigger.yml`.
             .github/actions/build-deps/**
-            .github/actions/generate-version/**
+            .github/actions/release-info/**
             .github/actions/setup-conan/**
+            .github/actions/setup-nix-env/**
             .github/scripts/strategy-matrix/**
             .github/workflows/reusable-build-test-config.yml
             .github/workflows/reusable-build-test.yml
@@ -91,6 +92,7 @@ jobs:
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
+            bin/check-nix-store-refs.sh
             bin/check-tools.sh
             bin/default-loader-path.sh
             cfg/**
@@ -104,6 +106,9 @@ jobs:
             CMakeLists.txt
             conanfile.py
             conan.lock
+            flake.lock
+            flake.nix
+            nix/**
             LICENSE.md
             package/**
             README.md

.github/workflows/on-tag.yml

@@ -1,5 +1,9 @@
-# This workflow uploads the libxrpl recipe to the Conan remote and builds
-# release packages when a versioned tag is pushed.
+# When a versioned tag is pushed, this workflow:
+#
+#   - uploads the libxrpl recipe to the Conan remote
+#   - builds and tests the release binaries
+#   - builds the DEB and RPM packages
+#   - publishes those packages to the XRPLF package repositories
 name: Tag
 
 on:
@@ -24,7 +28,7 @@ jobs:
       remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   build-test:
-    if: ${{ github.repository == 'XRPLF/rippled' }}
+    if: ${{ github.repository_owner == 'XRPLF' }}
     uses: ./.github/workflows/reusable-build-test.yml
     strategy:
       fail-fast: true
@@ -37,6 +41,12 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   package:
-    if: ${{ github.repository == 'XRPLF/rippled' }}
+    if: ${{ github.repository_owner == 'XRPLF' }}
     needs: build-test
     uses: ./.github/workflows/reusable-package.yml
+    with:
+      publish: true
+    secrets:
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      signing_key: ${{ secrets.NEXUS_PACKAGES_PRIVATE_KEY }}

.github/workflows/on-trigger.yml

@@ -15,8 +15,9 @@ on:
 
       # Keep the paths below in sync with those in `on-pr.yml`.
       - ".github/actions/build-deps/**"
-      - ".github/actions/generate-version/**"
+      - ".github/actions/release-info/**"
       - ".github/actions/setup-conan/**"
+      - ".github/actions/setup-nix-env/**"
       - ".github/scripts/strategy-matrix/**"
       - ".github/workflows/reusable-build-test-config.yml"
       - ".github/workflows/reusable-build-test.yml"
@@ -29,6 +30,7 @@ on:
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
+      - "bin/check-nix-store-refs.sh"
       - "bin/check-tools.sh"
       - "bin/default-loader-path.sh"
       - "cfg/**"
@@ -42,6 +44,9 @@ on:
       - "CMakeLists.txt"
       - "conanfile.py"
       - "conan.lock"
+      - "flake.lock"
+      - "flake.nix"
+      - "nix/**"
       - "LICENSE.md"
       - "package/**"
       - "README.md"
@@ -115,3 +120,11 @@ jobs:
   package:
     needs: build-test
     uses: ./.github/workflows/reusable-package.yml
+    with:
+      # Packages are built on every trigger; only develop pushes in XRPLF/rippled
+      # publish them, matching upload-recipe above.
+      publish: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
+    secrets:
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      signing_key: ${{ secrets.NEXUS_PACKAGES_PRIVATE_KEY }}

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131
     with:
       runs_on: ubuntu-latest
       container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

.github/workflows/reusable-build-test-config.yml

@@ -69,6 +69,12 @@ on:
         type: string
         default: ""
 
+      toolchain:
+        description: 'Where the toolchain comes from ("nix" to build the flake CI environment on the runner, empty for the system one). macOS only: Linux always builds in a Nix image, and Nix has no Windows support.'
+        required: false
+        type: string
+        default: ""
+
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
@@ -111,6 +117,9 @@ jobs:
       VOIDSTAR_ENABLED: ${{ contains(inputs.cmake_args, '-Dvoidstar=ON') }}
       VALIDATOR_KEYS_ENABLED: ${{ contains(inputs.cmake_args, '-Dvalidator_keys=ON') }}
       SANITIZERS_ENABLED: ${{ inputs.sanitizers != '' }}
+      # The binaries reusable-package.yml consumes. A private repository skips
+      # them except on a tag push, which is what produces its release packages.
+      PACKAGING_ARTIFACTS_ENABLED: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
     steps:
       - name: Cleanup workspace (macOS and Windows)
         if: ${{ runner.os == 'macOS' || runner.os == 'Windows' }}
@@ -120,10 +129,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
+      # Before any step that uses a build tool, composite actions included.
+      - name: Setup Nix environment
+        if: ${{ inputs.toolchain == 'nix' }}
+        uses: ./.github/actions/setup-nix-env
+
       - name: Set ccache log file
         if: ${{ inputs.ccache_enabled && runner.debug == '1' }}
         run: echo "CCACHE_LOGFILE=${{ runner.temp }}/ccache.log" >>"${GITHUB_ENV}"
@@ -148,7 +162,22 @@ jobs:
         with:
           compiler: ${{ inputs.compiler }}
 
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
+        with:
+          cache-directories: ${{ env.BUILD_DIR }}/corrosion
+          key: ${{ inputs.config_name }}
+          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
+          # two workspaces here because build artifacts are located in 2 places:
+          # - crates/target when cargo is called directly
+          # - build/cargo when cargo is called by cmake
+          workspaces: |
+            crates
+            crates -> ${{ runner.os == 'Windows' && format('../{0}/x64/{1}/cargo', env.BUILD_DIR, inputs.build_type) || format('../{0}/cargo', env.BUILD_DIR) }}
+
+      # `setup-nix-env` already did this for the Nix toolchain.
       - name: Setup Conan
+        if: ${{ inputs.toolchain != 'nix' }}
         env:
           SANITIZERS: ${{ inputs.sanitizers }}
         uses: ./.github/actions/setup-conan
@@ -212,6 +241,24 @@ jobs:
               --target "${CMAKE_TARGET}" \
               2>&1 | tee "${GITHUB_WORKSPACE}/build.log"
 
+      # Nothing may reference the store, so whole trees are checked - the Conan
+      # cache included, since what it holds is what gets uploaded and reused.
+      - name: Check the build output for Nix store references (Nix toolchain)
+        if: ${{ inputs.toolchain == 'nix' }}
+        run: ./bin/check-nix-store-refs.sh "${BUILD_DIR}"
+
+      - name: Check the Conan cache for Nix store references (Nix toolchain)
+        if: ${{ inputs.toolchain == 'nix' }}
+        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
+
+      # Only what PatchNixBinary.cmake retargets: the toolchain in the Linux
+      # images always references the store. Same condition it uses.
+      - name: Check for Nix store references (Linux)
+        if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
+        run: |
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
+
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}
         run: |
@@ -222,7 +269,7 @@ jobs:
           fi
 
       - name: Upload the binary (Linux)
-        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
+        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && runner.os == 'Linux' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: xrpld-${{ inputs.config_name }}
@@ -236,7 +283,7 @@ jobs:
         run: ./validator-keys --unittest
 
       - name: Upload the validator-keys binary
-        if: ${{ github.event.repository.visibility == 'public' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
+        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: validator-keys-${{ inputs.config_name }}
@@ -276,7 +323,7 @@ jobs:
         working-directory: ${{ env.BUILD_DIR }}
         run: |
           ldd ./xrpld
-          if [ "$(ldd ./xrpld | grep -E '(libstdc\+\+)' | wc -l)" -eq 0 ]; then
+          if [ "$(ldd ./xrpld | grep -E '(libstdc\+\+|libgcc)' | wc -l)" -eq 0 ]; then
               echo 'The binary is statically linked.'
           else
               echo 'The binary is dynamically linked.'
@@ -289,14 +336,6 @@ jobs:
         run: |
           ./xrpld --version | grep libvoidstar
 
-      - name: Run Rust tests
-        if: ${{ !inputs.build_only }}
-        working-directory: crates
-        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
-        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
-        # whose C++ shims only the CMake build defines. The other runners cover these tests.
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
-
       - name: Run the separate tests
         if: ${{ !inputs.build_only }}
         working-directory: ${{ runner.os == 'Windows' && format('{0}/{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
@@ -331,6 +370,14 @@ jobs:
 
           LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee "${GITHUB_WORKSPACE}/unittest.log"
 
+      - name: Run Rust tests
+        if: ${{ !inputs.build_only }}
+        working-directory: crates
+        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
+        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
+        # whose C++ shims only the CMake build defines. The other runners cover these tests.
+        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
+
       # Smoke-run every benchmark module with a single repetition to confirm the
       # benchmarks still build and execute. This is a correctness check, not a
       # performance measurement, so there is nothing to gain from repeating it

.github/workflows/reusable-build-test.yml

@@ -51,5 +51,6 @@ jobs:
       config_name: ${{ matrix.config_name }}
       sanitizers: ${{ matrix.sanitizers }}
       compiler: ${{ matrix.compiler || '' }}
+      toolchain: ${{ matrix.toolchain || '' }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/reusable-clang-tidy.yml

@@ -27,14 +27,14 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-fecfc0c"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-a0074f8"
     permissions:
       contents: read
       issues: write
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 
@@ -59,6 +59,13 @@ jobs:
         with:
           compiler: ${{ env.COMPILER }}
 
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
+        with:
+          cache-directories: ${{ env.BUILD_DIR }}/corrosion
+          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
+          workspaces: crates -> ../${{ env.BUILD_DIR }}/cargo
+
       - name: Setup Conan
         uses: ./.github/actions/setup-conan
 
@@ -82,17 +89,10 @@ jobs:
               -Dverify_headers=ON \
               ..
 
-      # clang-tidy needs headers generated from proto files
-      - name: Build libxrpl.libpb
+      - name: Build clang-tidy prerequisites
         working-directory: ${{ env.BUILD_DIR }}
         run: |
-          ninja -j ${{ steps.nproc.outputs.nproc }} xrpl.libpb
-
-      # clang-tidy needs cxxbridge headers generated from Rust crates
-      - name: Build xrpl_crates
-        working-directory: ${{ env.BUILD_DIR }}
-        run: |
-          ninja -j ${{ steps.nproc.outputs.nproc }} xrpl_crates
+          ninja -j ${{ steps.nproc.outputs.nproc }} tidy_prerequisites
 
       - name: Run clang tidy
         id: run_clang_tidy

.github/workflows/reusable-package.yml

@@ -1,17 +1,37 @@
-# Build Linux packages (DEB and RPM) from pre-built binary artifacts (xrpld and
-# validator-keys). Discovers which configurations to package from linux.json
-# (configs in "package_configs") and fans out one job per distro. Only
-# linux/amd64 is supported; the runner is hardcoded in the job below.
+# Build Linux packages from the pre-built xrpld and validator-keys artifacts:
+#
+#   - one job per distro, taken from "package_configs" in linux.json
+#   - each job runs in that distro's container, which is what decides DEB or RPM
+#   - with 'publish: true' a job also uploads what it built
+#     (see package/publish_pkg.sh)
+#
+# Only linux/amd64 is supported; the runner is hardcoded in the job below.
 name: Package
 
 on:
   workflow_call:
     inputs:
-      pkg_release:
-        description: "Package release number. Increment when repackaging the same executable."
+      publish:
+        description: "Whether to publish the packages after building them."
+        required: false
+        type: boolean
+        default: false
+      nexus_url:
+        description: "The base URL of the Nexus instance hosting the deb and rpm repositories."
         required: false
         type: string
-        default: "1"
+        default: https://packages.xrplf.org
+
+    secrets:
+      remote_username:
+        description: "The username of a Nexus account with write access to the repositories."
+        required: false
+      remote_password:
+        description: "The password or token for that Nexus account."
+        required: false
+      signing_key:
+        description: "Armoured PGP private key used to sign the RPMs. Required when publishing."
+        required: false
 
 defaults:
   run:
@@ -41,7 +61,7 @@ jobs:
 
   package:
     needs: [generate-matrix]
-    if: ${{ github.event.repository.visibility == 'public' }}
+    if: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
@@ -71,11 +91,24 @@ jobs:
       - name: Make binaries executable
         run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"
 
+      - name: Determine release info
+        id: release_info
+        uses: ./.github/actions/release-info
+
       - name: Build package
         env:
-          PKG_RELEASE: ${{ inputs.pkg_release }}
+          PKG_RELEASE: ${{ steps.release_info.outputs.pkg_release }}
+          PKG_CHANNEL: ${{ steps.release_info.outputs.channel }}
         run: ./package/build_pkg.sh
 
+      # Before the upload, so the artifact and the published package are the
+      # same bytes. DEBs are not signed, so the key is never set on that job.
+      - name: Sign RPM
+        if: ${{ inputs.publish && matrix.distro == 'rhel' }}
+        env:
+          PKG_SIGNING_KEY: ${{ secrets.signing_key }}
+        run: ./package/sign_rpm.sh "${BUILD_DIR}"
+
       - name: Upload package artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -85,3 +118,12 @@ jobs:
             ${{ env.BUILD_DIR }}/debbuild/*.ddeb
             ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
           if-no-files-found: error
+
+      - name: Publish package
+        if: ${{ inputs.publish }}
+        env:
+          CHANNEL: ${{ steps.release_info.outputs.channel }}
+          NEXUS_URL: ${{ inputs.nexus_url }}
+          NEXUS_USERNAME: ${{ secrets.remote_username }}
+          NEXUS_PASSWORD: ${{ secrets.remote_password }}
+        run: ./package/publish_pkg.sh "${CHANNEL}" "${BUILD_DIR}"

.github/workflows/reusable-rust.yml

@@ -14,7 +14,7 @@ on:
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
-        required: false
+        required: true
 
 defaults:
   run:
@@ -27,30 +27,26 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
 
       - name: Run clippy
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
 
       - name: Generate coverage report
         run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
@@ -70,15 +66,13 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
 
       - name: Build documentation
         env:

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -49,9 +49,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Generate build version number
-        id: version
-        uses: ./.github/actions/generate-version
+      - name: Determine release info
+        id: release_info
+        uses: ./.github/actions/release-info
 
       - name: Set up Conan
         uses: ./.github/actions/setup-conan
@@ -64,8 +64,8 @@ jobs:
 
       - name: Upload Conan recipe (version)
         run: |
-          conan export . --version=${{ steps.version.outputs.version }}
-          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.version.outputs.version }}
+          conan export . --version=${{ steps.release_info.outputs.version }}
+          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.release_info.outputs.version }}
 
       # When this workflow is triggered by a push event, it will always be when merging into the
       # 'develop' branch, see on-trigger.yml.
@@ -92,4 +92,4 @@ jobs:
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/release
 
     outputs:
-      ref: xrpl/${{ steps.version.outputs.version }}
+      ref: xrpl/${{ steps.release_info.outputs.version }}

.github/workflows/upload-conan-deps.yml

@@ -68,10 +68,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 
+      # Before any step that uses a build tool, composite actions included.
+      - name: Setup Nix environment
+        if: ${{ matrix.toolchain == 'nix' }}
+        uses: ./.github/actions/setup-nix-env
+
       - name: Print build environment
         uses: XRPLF/actions/print-build-env@59dec886e4afb05a1724443af08baccbc045b574
 
@@ -87,7 +92,9 @@ jobs:
         with:
           compiler: ${{ matrix.compiler }}
 
+      # `setup-nix-env` already did this for the Nix toolchain.
       - name: Setup Conan
+        if: ${{ matrix.toolchain != 'nix' }}
         env:
           SANITIZERS: ${{ matrix.sanitizers }}
         uses: ./.github/actions/setup-conan
@@ -106,6 +113,10 @@ jobs:
           log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ matrix.sanitizers }}
 
+      - name: Check the Conan cache for Nix store references (Nix toolchain)
+        if: ${{ matrix.toolchain == 'nix' }}
+        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
+
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
         run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.NEXUS_REMOTE_USERNAME }}" --password "${{ secrets.NEXUS_REMOTE_PASSWORD }}"

API-CHANGELOG.md

@@ -54,6 +54,8 @@ This section contains changes targeting a future version.
 - `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
+- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
+- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 
 ## XRP Ledger server version 3.1.0
 

BUILD.md

@@ -1,37 +1,17 @@
-| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
+| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, Rust, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
 
 ## Minimum Requirements
 
-See [System Requirements](https://xrpl.org/system-requirements.html).
+For the hardware needed to run a node, see
+[System Requirements](https://xrpl.org/system-requirements.html).
 
-Building xrpld generally requires Git, Python, Conan, CMake, and a C++
-compiler.
-
-- [Python](https://www.python.org/downloads/)
-- [Conan](https://conan.io/downloads.html)
-- [CMake](https://cmake.org/download/)
-
-You can verify that the required tools are installed and runnable with:
-
-```bash
-./bin/check-tools.sh
-```
-
-`xrpld` is written in the C++23 dialect. The [tested compiler versions][cpp23-support] are:
-
-| Compiler    | Version         |
-| ----------- | --------------- |
-| GCC         | 15.2            |
-| Clang       | 22              |
-| Apple Clang | 21              |
-| MSVC        | 19.44[^windows] |
+For the software needed to build xrpld, see the
+[environment setup guide](./docs/build/environment.md).
 
 ## Operating Systems
 
-Please see the [environment setup guide](./docs/build/environment.md) for detailed instructions for all platforms.
-
 ### Linux
 
 The Ubuntu Linux distribution has received the highest level of quality
@@ -47,9 +27,8 @@ CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOY
 
 ### Windows
 
-Windows is used by some engineers for development only.
-
-[^windows]: Windows is not recommended for production use.
+Windows is used by some engineers for development only, and is not recommended
+for production use.
 
 ## Steps
 
@@ -74,37 +53,25 @@ releases](https://github.com/XRPLF/rippled/releases).
 
 ### Set Up Conan
 
-After you have a [C++ development environment](./docs/build/environment.md) ready with Git, Python,
-Conan, CMake, and a C++ compiler, you may need to set up your Conan profile.
-
-These instructions assume a basic familiarity with Conan and CMake. If you are
-unfamiliar with Conan, then please read [this crash course](./docs/build/conan.md) or the official
-[Getting Started][conan-getting-started] walkthrough.
-
-#### Profiles
-
-We recommend that you install our Conan profiles:
+Once your [development environment](./docs/build/environment.md) is ready, set
+Conan up for this repository:
 
 ```bash
-conan config install conan/profiles/ -tf $(conan config home)/profiles/
+./conan/init.sh
 ```
 
-You can check your Conan profile by running:
+That installs our [`global.conf`](./conan/global.conf), our Conan
+[profiles](./conan/profiles), and the `xrplf` remote that hosts some of our
+dependencies. It honours `CONAN_HOME` and never deletes an existing Conan home,
+so it is safe to re-run — it only overwrites the files it manages.
 
-```bash
-conan profile show
-```
+> [!TIP]
+> In the [Nix development shell](./docs/build/nix.md#conan-configuration) this is
+> already done for you: the script runs on entry.
 
-If the default profile is not suitable for your environment, you can create a custom profile and pass it to Conan.
-More information on customizing Conan can be found in the [Advanced Conan configuration](./docs/build/advanced_conan.md).
-
-#### Add xrplf remote
-
-Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
-
-```bash
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
-```
+You can inspect the resulting profile with `conan profile show`. If it is not
+suitable for your environment, create a custom profile and pass it to Conan — see
+[Advanced Conan configuration](./docs/build/advanced_conan.md).
 
 ### Set Up Ccache
 
@@ -269,10 +236,14 @@ which is only enabled when the `coverage` option is set, e.g. with
 Prerequisites for the coverage report:
 
 - [gcovr tool][gcovr] (can be installed e.g. with [pip][python-pip])
-- `gcov` for GCC (installed with the compiler by default) or
-- `llvm-cov` for Clang (installed with the compiler by default)
+- `gcov` for GCC or `llvm-cov` for Clang, usually installed with the compiler
 - `Debug` build type
 
+> [!NOTE]
+> Clang coverage is not available in the [Nix development shell](./docs/build/nix.md#building-xrpld-in-the-nix-shell):
+> its `clang` shells do not ship `llvm-cov`. Use a `gcc` shell instead (`.#gcc`,
+> or `.#gcc-plain` on Linux), which provides a `gcov` matching its compiler.
+
 A coverage report is created when the following steps are completed, in order:
 
 1. `xrpld` binary built with instrumentation data, enabled by the `coverage`
@@ -345,6 +316,22 @@ memory) since they concatenate sources into fewer translation units. Non-unity
 builds may be faster for incremental builds, and can be helpful for detecting
 `#include` omissions.
 
+### Rust crates
+
+The build compiles the Rust workspace in `crates/` and generates the cxxbridge
+bindings the C++ side includes, so it needs a Rust toolchain (`cargo`, `rustc`)
+at the channel pinned in [`rust-toolchain.toml`](./rust-toolchain.toml). The
+[Nix development shell](./docs/build/nix.md) provides one; otherwise install it
+as described in [Rust](./docs/build/environment.md#rust).
+
+The crates also have their own Rust unit tests. Those are run with `cargo` and
+need only the Rust toolchain, independently of CMake (CI runs them with
+`cargo nextest`):
+
+```bash
+cargo test --manifest-path crates/Cargo.toml --workspace
+```
+
 ### Verifying headers
 
 The regular build only compiles `.cpp` files, so a header is only ever checked
@@ -389,10 +376,14 @@ After any updates or changes to dependencies, you may need to do the following:
 4. [Regenerate lockfile](./docs/build/advanced_conan.md#conan-lockfile).
 5. Re-run [conan install](#build-and-test).
 
+If you are using the Nix development shell, whether prebuilt Conan binaries apply
+depends on your platform — see
+[Prebuilt packages](./docs/build/nix.md#prebuilt-packages).
+
 #### ERROR: Package not resolved
 
 If you're seeing an error like `ERROR: Package 'snappy/1.1.10' not resolved: Unable to find 'snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1756234314.246' in remotes.`,
-please [add `xrplf` remote](#add-xrplf-remote) or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
+please [set Conan up](#set-up-conan) so the `xrplf` remote is configured, or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
 
 ### `protobuf/port_def.inc` file not found
 
@@ -412,7 +403,6 @@ For example, if you want to build Debug:
 1. For conan install, pass `--settings build_type=Debug`
 2. For cmake, pass `-DCMAKE_BUILD_TYPE=Debug`
 
-[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [conan-getting-started]: https://docs.conan.io/en/latest/getting_started.html
 [unity-build]: https://en.wikipedia.org/wiki/Unity_build
 [gcovr]: https://gcovr.com/en/stable/getting-started.html

CMakeLists.txt

@@ -158,6 +158,8 @@ if(coverage)
     include(XrplCov)
 endif()
 
+add_custom_target(tidy_prerequisites)
+
 add_subdirectory(crates)
 include(XrplCore)
 include(XrplProtocolAutogen)

CONTRIBUTING.md

@@ -225,8 +225,9 @@ environment, so you don't need to install most of the individual tools
 yourself. The version of each hook sourced from an external repository
 (`clang-format`, `gersemi`, etc.) is pinned in that file, so running the hooks
 locally uses exactly the same versions as CI. A few `local` hooks — most notably
-`clang-tidy` — run tools from your own environment; see
-[Installing clang-tidy](#installing-clang-tidy) for how to get those.
+`clang-tidy` and `cargo fmt` — run tools from your own environment; see
+[Installing clang-tidy](#installing-clang-tidy) and
+[Rust](./docs/build/environment.md#rust) for how to get those.
 
 To get started, install `pre-commit` and enable the git hook scripts:
 
@@ -255,6 +256,7 @@ The hooks configured in this repository include, among others:
 - `clang-tidy` — C++ static analysis (see [Clang-tidy](#clang-tidy)); opt in with `TIDY=1`
 - `fix-include-style`, `fix-pragma-once`, `check-doxygen-style` — C++ hygiene
 - `gersemi` — CMake formatting
+- `cargo fmt` — Rust formatting for the crates in `crates/`
 - `prettier`, `black`, `shfmt` — formatting for JavaScript/JSON/Markdown, Python, and shell
 - `cspell` — spell checking
 
@@ -319,7 +321,11 @@ See the [environment setup guide](./docs/build/environment.md#clang-tidy) for ho
 
 ### Running clang-tidy locally
 
-Before running clang-tidy, you must build the project to generate required files (particularly protobuf headers). Refer to [`BUILD.md`](./BUILD.md) for build instructions.
+Before running clang-tidy, you must generate the files it depends on (protobuf headers and the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
+
+```bash
+cmake --build build --target tidy_prerequisites
+```
 
 #### Via pre-commit (recommended)
 

README.md

@@ -54,6 +54,7 @@ Here are some good places to start learning the source code:
 | `./docs`   | Source documentation files and doxygen config. |
 | `./cfg`    | Example configuration files.                   |
 | `./src`    | Source code.                                   |
+| `./crates` | Rust source code.                              |
 
 Some of the directories under `src` are external repositories included using
 git-subtree. See those directories' README files for more details.

bin/check-nix-store-refs.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# Fail if a binary under <path> records a /nix/store path it resolves at run
+# time. See docs/build/nix.md#prebuilt-packages for why that matters.
+#
+# <path> is a file or a directory. macOS: nothing may reference the store, so
+# point it at whole trees. Linux: the toolchain always writes the store into
+# PT_INTERP and RUNPATH, so only at what cmake/PatchNixBinary.cmake retargets.
+#
+# Only Mach-O / ELF is inspected. Static archives hold store paths in debug info
+# alone; the scripts in a Conan cache are all git hook samples and autotools
+# scratch, 36 false positives to 0 real.
+#
+# Usage: bin/check-nix-store-refs.sh <path>
+
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+    echo "usage: $0 <path>" >&2
+    exit 2
+fi
+
+if [ ! -e "$1" ]; then
+    echo "$0: no such path: $1" >&2
+    exit 2
+fi
+
+case "$(uname -s)" in
+    Darwin)
+        format=Mach-O
+        recorded_paths=macho_recorded_paths
+        tool=otool
+        ;;
+    Linux)
+        format=ELF
+        recorded_paths=elf_recorded_paths
+        tool=readelf
+        ;;
+    *)
+        echo "Unsupported OS - skipping the Nix store reference check."
+        exit 0
+        ;;
+esac
+
+# `pipefail` would catch this too, but only as a bare nonzero exit.
+if ! command -v "${tool}" >/dev/null; then
+    echo "$0: ${tool} not found; cannot inspect binaries" >&2
+    exit 2
+fi
+
+# Both list what the file records. `ldd` would answer what this machine resolves
+# now, which is wrong both ways: store paths for a correctly patched binary,
+# silence for a store RUNPATH that resolves nowhere.
+
+# `name` covers LC_ID_DYLIB and LC_LOAD*_DYLIB, `path` covers LC_RPATH.
+macho_recorded_paths() {
+    otool -l "$1" | sed -nE 's#^ *(name|path) ([^ ]*).*#\2#p'
+}
+
+# RPATH and RUNPATH are colon-separated.
+elf_recorded_paths() {
+    readelf -ldW "$1" |
+        sed -nE \
+            -e 's#.*program interpreter: ([^]]*)\].*#\1#p' \
+            -e 's#.*\((RPATH|RUNPATH|NEEDED)\).*\[([^]]*)\].*#\2#p' |
+        tr ':' '\n'
+}
+
+checked=0
+skipped=0
+leaked=0
+
+while IFS= read -r file; do
+    case "$(file -b "${file}" 2>/dev/null)" in
+        *"${format}"*) ;;
+        *)
+            skipped=$((skipped + 1))
+            continue
+            ;;
+    esac
+    checked=$((checked + 1))
+
+    # Filter after extracting, or a search path starting elsewhere ($ORIGIN)
+    # hides the rest. `sed` not `grep`: grep calls "no matches" a failure, and
+    # the `|| true` that would need masks a broken pipeline too.
+    refs="$("${recorded_paths}" "${file}" | sed -n '\#^/nix/store/#p' | sort -u)"
+    if [ -n "${refs}" ]; then
+        leaked=$((leaked + 1))
+        echo "::error file=${file}::references the Nix store at run time"
+        echo "${file}"
+        echo "${refs}" | sed 's/^/    /'
+    fi
+done < <(find "$1" -type f \( -perm -u+x -o -name '*.dylib' -o -name '*.so*' \))
+
+echo "$1: checked ${checked}, skipped ${skipped}, ${leaked} with Nix store references."
+
+if [ "${leaked}" -ne 0 ]; then
+    cat >&2 <<'EOF'
+
+Fixes, in order of preference:
+  - A Conan package built before this check existed: drop it
+    (`conan remove '<name>/*'`) and rebuild.
+  - A binary that should have been retargeted to the system loader: check that
+    cmake/PatchNixBinary.cmake ran for it.
+  - Link the macOS system library instead of the Nix one - see
+    libresolvSystemStub in nix/darwin.nix.
+  - No system library exists (libstdc++): link it statically.
+  - None of the above: pin the toolchain into the package ID, following
+    `user.package:libc_version` in conan/profiles/ci.
+EOF
+    exit 1
+fi

bin/check-tools.sh

@@ -15,10 +15,14 @@
 #   - Windows: the core build tools only (CMake, Conan, Git, Python).
 #              MSVC is expected to be provided separately and is not checked here.
 #
-# Some tools (clang-format, doxygen, gcovr, gh, git-cliff, gpg, pre-commit,
-# run-clang-tidy) are present in our Linux CI images and in local development
-# setups, but not in the macOS CI environment. They are checked everywhere
-# except when running in CI on macOS.
+# Some tools (clang-format, clang-tidy, doxygen, gcovr, gh, git-cliff, gpg,
+# pre-commit, run-clang-tidy) are present in our Linux CI images and in local
+# development setups, but not in the macOS CI environment. They are checked
+# everywhere except when running in CI on macOS.
+#
+# Tools that Nix also exposes under a version-suffixed name (`clang-tidy-22`,
+# `g++-15`, ...) are probed under both names: a suffixed name can break while
+# the plain one still works (see mkVersionedToolLinks in nix/packages.nix).
 #
 # Environment variables:
 #   CI                      if set, skip the tools above when on macOS.
@@ -26,14 +30,27 @@
 
 set -uo pipefail
 
+# Version suffixes of the Nix tool links, tracking nix/packages.nix.
+gcc_version=15
+llvm_version=22
+
 missing=()
 checked=0
 
+# tool_path <name>
+# Fully resolved path of a tool, so the snapshots record which derivation
+# provides it. Prints nothing when it isn't on PATH.
+tool_path() {
+    local path
+    path="$(command -v "$1" 2>/dev/null)" || return 0
+    readlink -f "${path}" 2>/dev/null || printf '%s' "${path}"
+}
+
 # check <name> [probe-command...]
 # Runs the probe (default: "<name> --version"), capturing both stdout and
-# stderr, and prints one aligned line: the status, the name, and the first
-# non-blank line of the probe output (its version). Records <name> as missing
-# if the command is not found or exits non-zero.
+# stderr, and prints three lines: the status and name, the first non-blank line
+# of the probe output (its version, or the error when it failed), and the tool's
+# resolved path. Records <name> as missing if it is not found or exits non-zero.
 check() {
     local name="$1"
     shift
@@ -43,14 +60,17 @@ check() {
     fi
 
     checked=$((checked + 1))
-    local output version
+    local output version path
+    path="$(tool_path "${name}")"
     if output="$("${probe[@]}" 2>&1)"; then
-        version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
-        printf '  [ ok ] %-20s %s\n' "${name}" "${version}"
+        printf '  ✅ %s\n' "${name}"
     else
-        printf '  [MISS] %s\n' "${name}"
+        printf '  ❌ %s\n' "${name}"
         missing+=("${name}")
     fi
+    version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
+    printf '     %s\n' "${version:-(no output)}"
+    printf '     %s\n' "${path:-(not found)}"
 }
 
 case "$(uname -s)" in
@@ -82,7 +102,9 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     echo "Development tooling:"
     check ccache
     check clang
+    check "clang-${llvm_version}"
     check clang++
+    check "clang++-${llvm_version}"
     check ClangBuildAnalyzer
     check curl
     check file
@@ -101,7 +123,14 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     # setups, but not in the macOS CI environment. So check them everywhere
     # except when running in CI on macOS.
     if [ "${os}" = "linux" ] || [ -z "${CI:-}" ]; then
+        check clang-apply-replacements
+        check "clang-apply-replacements-${llvm_version}"
         check clang-format
+        check "clang-format-${llvm_version}"
+        # clang-tidy leads --version with the LLVM banner, not the version.
+        tidy_probe="--version | grep -m1 -oE 'LLVM version [0-9.]+'"
+        check clang-tidy sh -c "clang-tidy ${tidy_probe}"
+        check "clang-tidy-${llvm_version}" sh -c "clang-tidy-${llvm_version} ${tidy_probe}"
         check dot
         check doxygen
         check gcovr
@@ -112,6 +141,7 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
         # pre-commit, or its alternative implementation prek
         check pre-commit sh -c 'pre-commit --version || prek --version'
         check run-clang-tidy run-clang-tidy --help
+        check "run-clang-tidy-${llvm_version}" "run-clang-tidy-${llvm_version}" --help
     fi
 fi
 
@@ -126,7 +156,7 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check cargo-audit cargo audit --version
     check cargo-llvm-cov cargo llvm-cov --version
     check cargo-nextest cargo nextest --version
-    check clippy clippy-driver --version
+    check clippy-driver
     check rust-analyzer
     check rustc
     check rustfmt
@@ -138,7 +168,11 @@ if [ "${os}" = "linux" ]; then
     echo
     echo "GCC toolchain:"
     check gcc
+    check "gcc-${gcc_version}"
     check g++
+    check "g++-${gcc_version}"
+    check cpp
+    check "cpp-${gcc_version}"
     check gcov
 
     echo
@@ -163,9 +197,9 @@ else
     checked=$((checked + 1))
     tmp_clone="$(mktemp -d)"
     if git clone --depth 1 https://github.com/XRPLF/actions.git "${tmp_clone}/actions" >/dev/null 2>&1; then
-        printf '  [ ok ] git clone over HTTPS\n'
+        printf '  ✅ git clone over HTTPS\n'
     else
-        printf '  [MISS] git clone over HTTPS\n'
+        printf '  ❌ git clone over HTTPS\n'
         missing+=("git-https-clone")
     fi
     rm -rf "${tmp_clone}"
@@ -173,9 +207,9 @@ fi
 
 echo
 if [ "${#missing[@]}" -eq 0 ]; then
-    echo "All ${checked} checked tools are present and runnable."
+    echo "✅ All ${checked} checked tools are present and runnable."
 else
-    echo "Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
+    echo "❌ Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
     for tool in "${missing[@]}"; do
         echo "  - ${tool}" >&2
     done

cmake/XrplCompiler.cmake

@@ -120,7 +120,10 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
+    target_link_libraries(
+        common
+        INTERFACE -errorreport:none -machine:X64 -ignore:4099
+    )
 else()
     target_compile_options(
         common
@@ -266,10 +269,50 @@ elseif(use_lld)
     )
     if("${LD_VERSION}" MATCHES "LLD")
         target_link_libraries(common INTERFACE -fuse-ld=lld)
+        # remembered for the linker flag probe below
+        set(fuse_ld_flag "-fuse-ld=lld")
     endif()
     unset(LD_VERSION)
 endif()
 
+# Linker warnings are errors where we control the toolchain and the dependencies: CI and the Nix dev shell.
+# On non-Nix macOS we suppress the deployment target warning: an old Conan profile may not pin os.version.
+# Only the new Apple linker understands the flag, so probe the actual linker (lld may be selected above).
+if(is_macos OR is_linux)
+    if(is_ci OR is_nix_compiler)
+        if(is_macos)
+            set(fatal_warnings_flag "-Wl,-fatal_warnings")
+        else()
+            set(fatal_warnings_flag "-Wl,--fatal-warnings")
+        endif()
+        message(
+            STATUS
+            "Treating all linker warnings as errors (${fatal_warnings_flag})"
+        )
+        target_link_options(common INTERFACE "${fatal_warnings_flag}")
+        unset(fatal_warnings_flag)
+    elseif(is_macos)
+        set(silence_flag "-Wl,-deployment_target_mismatches,suppress")
+        set(probe_flags ${fuse_ld_flag} "${silence_flag}")
+        include(CheckLinkerFlag)
+        check_linker_flag(
+            CXX
+            "${probe_flags}"
+            have_deployment_target_mismatches
+        )
+        if(have_deployment_target_mismatches)
+            message(
+                STATUS
+                "Silencing macOS deployment target mismatch warnings (${silence_flag})"
+            )
+            target_link_options(common INTERFACE "${silence_flag}")
+        endif()
+        unset(probe_flags)
+        unset(silence_flag)
+    endif()
+endif()
+unset(fuse_ld_flag)
+
 if(assert)
     foreach(var_ CMAKE_C_FLAGS_RELEASE CMAKE_CXX_FLAGS_RELEASE)
         string(REGEX REPLACE "[-/]DNDEBUG" "" ${var_} "${${var_}}")

cmake/XrplCore.cmake

@@ -51,6 +51,8 @@ target_compile_options(
 
 target_link_libraries(xrpl.libpb PUBLIC protobuf::libprotobuf gRPC::grpc++)
 
+add_dependencies(tidy_prerequisites xrpl.libpb)
+
 # TODO: Clean up the number of library targets later.
 add_library(xrpl.imports.main INTERFACE)
 
@@ -205,16 +207,10 @@ target_link_libraries(
 )
 
 add_module(xrpl tx)
-# The wasm engine is a Rust crate reached over cxx: the bridge target supplies the
-# generated `lib.h` and `rust/cxx.h` that `tx/wasm` compiles against, and the Rust
-# static library everything downstream links. PUBLIC because the include path travels
-# with the module's own public headers.
 target_link_libraries(
     xrpl.libxrpl.tx
     PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
 )
-# Those headers do not exist at configure time, and the header-verification target
-# compiles this module's headers on their own, so both need the crates built first.
 add_dependencies(xrpl.libxrpl.tx xrpl_crates)
 
 add_module(xrpl consensus)

cmake/XrplCov.cmake

@@ -44,6 +44,7 @@ setup_target_for_coverage_gcovr(
     EXCLUDE
         "src/test"
         "src/tests"
+        "src/benchmarks"
         "include/xrpl/beast/test"
         "include/xrpl/beast/unit_test"
         "${CMAKE_BINARY_DIR}/pb-xrpl.libpb"

conan.lock

@@ -23,6 +23,7 @@
         "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1782494504.298",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
+        "corrosion/0.6.1#bfa292df0a957bc70a450ff316cd9435%1786119416.131296",
         "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
         "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",

conan/init.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Install our Conan configuration, profiles and the xrplf remote into CONAN_HOME.
+# Safe to re-run; never deletes the Conan home.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+CONAN_DIR="$(conan config home)"
+
+echo "Installing Conan configuration into ${CONAN_DIR}"
+conan config install "${SCRIPT_DIR}/global.conf"
+conan config install "${SCRIPT_DIR}/profiles" -tf "${CONAN_DIR}/profiles"
+# This script manages these files, so make them read-only - Conan does not
+# preserve the source mode. Only the files: the directories must stay writable
+# for `conan config install` to replace them.
+chmod a-w "${CONAN_DIR}/global.conf"
+find "${CONAN_DIR}/profiles" -type f -exec chmod a-w {} +
+
+echo "Adding the xrplf Conan remote"
+# --index 0: our patched recipes must win over Conan Center.
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/

conan/profiles/default

@@ -1,10 +1,7 @@
 {% set os = detect_api.detect_os() %}
 {% set arch = detect_api.detect_arch() %}
 {% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}
-{% set compiler_version = version %}
-{% if os == "Linux" %}
 {% set compiler_version = detect_api.default_compiler_version(compiler, version) %}
-{% endif %}
 {% if os == "Macos" %}
 {# Minimum macOS the dependencies target. #}
 {# Without this, Conan builds each dependency against the (possibly newer) host SDK, so the #}

conanfile.py

@@ -28,6 +28,7 @@ class Xrpl(ConanFile):
     }
 
     requires = [
+        "corrosion/0.6.1",
         "ed25519/2015.03",
         "fast_float/8.2.10",
         "grpc/1.81.1",
@@ -151,8 +152,12 @@ class Xrpl(ConanFile):
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",
+        "crates/*",
+        "crates/.cargo/*",
+        "!crates/target/*",
         "external/*",
         "include/*",
+        "rust-toolchain.toml",
         "src/*",
     )
 

crates/.cargo/config.toml

@@ -1,5 +1,17 @@
-[target.x86_64-unknown-linux-gnu]
+# The Rust static libraries are linked into C++ targets, so the runtime linkage
+# here has to match what the C++ build uses (see cmake/XrplCompiler.cmake).
+#
+# macOS needs nothing: AppleClang cannot link libgcc/libc++ statically, so the
+# C++ build skips those flags on Apple as well.
+
+# Both amd64 and arm64 Linux builds link libgcc statically. This only affects
+# links that rustc itself drives (`cargo test` binaries and the like) — the
+# `staticlib` crates consumed by CMake are archived, not linked, so rustc
+# silently ignores link args for them. Keeping libgcc_s.so.1 off the xrpld link
+# line is handled in crates/CMakeLists.txt instead.
+[target.'cfg(target_os = "linux")']
 rustflags = ["-C", "link-args=-static-libgcc"]
 
-[target.x86_64-pc-windows-msvc]
+# Windows builds use the static MSVC runtime.
+[target.'cfg(windows)']
 rustflags = ["-C", "target-feature=+crt-static"]

crates/CMakeLists.txt

@@ -1,37 +1,90 @@
-set(CORROSION_VERSION 0.6.1)
-
-find_package(Corrosion ${CORROSION_VERSION} QUIET)
-if(NOT Corrosion_FOUND)
-    include(FetchContent)
-    FetchContent_Declare(
-        Corrosion
-        GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-        GIT_TAG v${CORROSION_VERSION}
-    )
-    FetchContent_MakeAvailable(Corrosion)
-endif()
+find_package(Corrosion REQUIRED)
 
 corrosion_import_crate(MANIFEST_PATH ${CMAKE_CURRENT_SOURCE_DIR}/Cargo.toml)
 
-file(
-    WRITE "${CMAKE_CURRENT_BINARY_DIR}/.clang-tidy"
-    "# Auto-generated by crates/CMakeLists.txt. Do not edit.\n"
-    "# Neutralizes clang-tidy for corrosion/cxxbridge-generated C++.\n"
-    "# One check kept enabled to avoid clang-tidy's \"no checks enabled\" error.\n"
-    "Checks: '-*,google-readability-todo'\n"
-    "WarningsAsErrors: ''\n"
-    "HeaderFilterRegex: ''\n"
-    "InheritParentConfig: false\n"
+# The generated C++ lands in the build tree, so put a .clang-tidy next to it to
+# keep clang-tidy from analyzing code we don't own.
+configure_file(
+    generated.clang-tidy
+    "${CMAKE_CURRENT_BINARY_DIR}/.clang-tidy"
+    COPYONLY
 )
 
-# Umbrella target that aggregates all crate-generated code (cxxbridge headers,
-# etc.). Build this before running clang-tidy so generated headers are present.
 add_custom_target(xrpl_crates)
+add_dependencies(tidy_prerequisites xrpl_crates)
+
+# On macOS, ld warns `ignoring duplicate libraries` when linking a crate.
+# Corrosion is the source of both duplicates it names:
+#
+# * The crate archive and its cxxbridge archive, because
+#   `corrosion_add_cxxbridge` makes the two depend on each other, and CMake
+#   repeats a static library cycle on the link line so single-pass linkers can
+#   resolve it. (LINK_INTERFACE_MULTIPLICITY can only raise that count.)
+# * `-lSystem`, which Corrosion copies from rustc's `native-static-libs` even
+#   though the compiler driver always links libSystem.
+#
+# ld needs neither: it resolves the cycle from one copy of each archive and
+# links libSystem once. So silence the warning rather than rewrite Corrosion's
+# link interface, which the cycle is also part of. The option itself is old —
+# Xcode 15 is only where the warning became the default — and the check below
+# leaves it out on a linker that does not know it.
+if(is_macos)
+    include(CheckLinkerFlag)
+    check_linker_flag(
+        CXX
+        -Wl,-no_warn_duplicate_libraries
+        have_no_warn_duplicate_libraries
+    )
+endif()
+
+function(_unlink_libgcc_s crate)
+    if(NOT (is_linux AND static))
+        return()
+    endif()
+
+    # Corrosion exposes a crate's staticlib as an imported `<crate>-static`
+    # target and puts the native libs in its INTERFACE_LINK_LIBRARIES. If either
+    # of those changes, warn instead of silently letting libgcc_s.so.1 return.
+    set(imported "${crate}-static")
+    if(NOT TARGET ${imported})
+        message(
+            FATAL_ERROR
+            "Corrosion did not create the imported target '${imported}', so "
+            "libgcc_s cannot be removed from the link interface of '${crate}'. "
+            "xrpld will link libgcc_s.so.1 dynamically. Check where Corrosion "
+            "${CORROSION_VERSION} now records `native-static-libs`."
+        )
+        return()
+    endif()
+
+    get_target_property(libs ${imported} INTERFACE_LINK_LIBRARIES)
+    if(NOT "gcc_s" IN_LIST libs)
+        message(
+            WARNING
+            "'gcc_s' was not in the link interface of '${imported}' as "
+            "expected. If the Rust toolchain stopped reporting it this "
+            "workaround is obsolete and can be deleted; otherwise xrpld may "
+            "link libgcc_s.so.1 dynamically. Verify with: "
+            "objdump -p xrpld | grep NEEDED"
+        )
+        return()
+    endif()
+
+    list(REMOVE_ITEM libs gcc_s)
+    set_property(TARGET ${imported} PROPERTY INTERFACE_LINK_LIBRARIES ${libs})
+endfunction()
 
-# add_xrpl_crate(<name> CRATE <crate> FILES <file>...) Creates a cxxbridge
-# target <name>_cxxbridge and registers it with xrpl_crates.
 function(add_xrpl_crate name)
     cmake_parse_arguments(ARG "" "CRATE" "FILES" ${ARGN})
+    _unlink_libgcc_s(${ARG_CRATE})
+    # `cc` picks its runtime flag from `crt-static` alone, so it compiles a
+    # crate's C++ with `-MT`; Debug needs `-MTd` (to match cmake/XrplCompiler.cmake).
+    if(is_msvc)
+        corrosion_set_env_vars(
+            ${ARG_CRATE}
+            "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>"
+        )
+    endif()
     corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
                             ${ARG_FILES}
     )
@@ -39,20 +92,19 @@ function(add_xrpl_crate name)
     # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the
     # existence check — build-time ordering is enforced by the custom commands.
     set_target_properties(${name}_cxxbridge PROPERTIES INTERFACE_SOURCES "")
+    if(have_no_warn_duplicate_libraries)
+        target_link_options(
+            ${name}_cxxbridge
+            INTERFACE -Wl,-no_warn_duplicate_libraries
+        )
+    endif()
     add_dependencies(xrpl_crates ${name}_cxxbridge)
 endfunction()
 
 add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
 
-# Test-only, and deliberately not part of xrpl_wasm_vm_ffi: it carries the `wat` assembler,
-# which the engine's `wasmi default-features = false` exists to keep out of the consensus
-# path. Linked from src/tests/libxrpl only, so the shipped node cannot contain it.
 add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
 
-# The wasm bridge `include!`s a project header, so its generated translation unit needs
-# the project's include root. Deliberately only that: a header reached from here must
-# stay light enough to compile without the Boost paths this target does not get, which
-# is why `HostContext.h` forward-declares `xrpl::HostFunctions` instead of including it.
 target_include_directories(
     xrpl_wasm_vm_ffi_cxxbridge
     PRIVATE ${CMAKE_SOURCE_DIR}/include

crates/Cargo.lock

@@ -69,9 +69,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
+checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
 dependencies = [
  "cc",
  "cxx-build",
@@ -84,9 +84,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
+checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -99,9 +99,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
+checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -113,15 +113,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
+checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
+checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
 dependencies = [
  "indexmap",
  "proc-macro2",
@@ -348,49 +348,49 @@ dependencies = [
 
 [[package]]
 name = "wasmi"
-version = "1.1.0"
+version = "2.0.0-beta.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2300d0f78cba12f14e29e8dd157ea64050c0a688179aefdb2050105805594a0c"
+checksum = "ab57cbb8db5ee46c6667b642544d7664adfbc0ea6a1ab219c92d734b795f36b1"
 dependencies = [
  "spin",
  "wasmi_collections",
  "wasmi_core",
  "wasmi_ir",
- "wasmparser 0.239.0",
+ "wasmparser 0.228.0",
 ]
 
 [[package]]
 name = "wasmi_collections"
-version = "1.1.0"
+version = "2.0.0-beta.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8a8c42a2a76148d43097b1d7cc2a5bf33d5c23bd4dd69015fc887e311767884"
+checksum = "55ea3ee266456966465c55a1f440e33116caf2b05a4fc30da36cb0c9813059d5"
 dependencies = [
  "string-interner",
 ]
 
 [[package]]
 name = "wasmi_core"
-version = "1.1.0"
+version = "2.0.0-beta.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9013136083d988725953390bf668b64b7a218fabf26f8b913bbc59546b97ee27"
+checksum = "1f8285efe48a9e1afbcdfcc19cd807b3eb20129b7e199c7a99efd30ba192926b"
 dependencies = [
  "libm",
 ]
 
 [[package]]
 name = "wasmi_ir"
-version = "1.1.0"
+version = "2.0.0-beta.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba1fa003f79156f406d62ef0e1464dc03e11ace37170e9fa7524299a75ad8f68"
+checksum = "6227be1aebba39b4815ab6a312d0528590f0db2473621ec9285606410889b0a6"
 dependencies = [
  "wasmi_core",
 ]
 
 [[package]]
 name = "wasmparser"
-version = "0.239.0"
+version = "0.228.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9d90bb93e764f6beabf1d02028c70a2156a6583e63ac4218dd07ef733368b0"
+checksum = "4abf1132c1fdf747d56bbc1bb52152400c70f336870f968b85e89ea422198ae3"
 dependencies = [
  "bitflags",
  "indexmap",

crates/Cargo.toml

@@ -1,9 +1,15 @@
 [workspace]
-members = ["xrpl-wasm-vm-ffi", "xrpl-wasm-vm", "xrpl-wasm-testkit", "xrpl-host-functions", "xrpl-host-functions-macros"]
+members = [
+    "xrpl-wasm-vm-ffi",
+    "xrpl-wasm-vm",
+    "xrpl-wasm-testkit",
+    "xrpl-host-functions",
+    "xrpl-host-functions-macros",
+]
 resolver = "3"
 
 [workspace.dependencies]
-cxx = { version = "1.0.198", features = ["c++20"] }
+cxx = { version = "1.0.199", features = ["c++20"] }
 
 [workspace.package]
 edition = "2024"

crates/generated.clang-tidy

@@ -0,0 +1,10 @@
+---
+# Neutralizes clang-tidy for the corrosion/cxxbridge-generated C++. Copied into
+# the crates build directory by crates/CMakeLists.txt, next to the generated
+# sources, so clang-tidy picks it up instead of the top-level configuration.
+#
+# One check is kept enabled to avoid clang-tidy's "no checks enabled" error.
+Checks: "-*,google-readability-todo"
+WarningsAsErrors: ""
+HeaderFilterRegex: ""
+InheritParentConfig: false

crates/xrpl-host-functions-macros/Cargo.toml

@@ -11,8 +11,8 @@ syn = { version = "3", features = ["full"] }
 quote = "1"
 proc-macro2 = "1"
 
-# The expansion names `::xrpl_host_functions::HostFnSpec`, so the doctest needs the
-# facade crate. Cargo allows this cycle because dev-dependencies are outside the
-# library build graph.
+# The doctest declares host functions returning `HostResult`, which the facade
+# crate hand-writes. Cargo allows this cycle because dev-dependencies are outside
+# the library build graph.
 [dev-dependencies]
 xrpl-host-functions.path = "../xrpl-host-functions"

crates/xrpl-host-functions-macros/src/lib.rs

@@ -20,9 +20,29 @@ use parsed_host_function::ParsedHostFunction;
 /// are kept and appear on the generated items.
 ///
 /// This crate is an implementation detail of `xrpl-host-functions`, which
-/// hand-writes the types the expansion refers to and holds the one declaration
-/// block. The expansion names those types by absolute path, so a call site needs
-/// `xrpl-host-functions` as a dependency but no imports from it.
+/// hand-writes the types the declarations refer to and holds the one declaration
+/// block.
+///
+/// # What it generates
+///
+/// Three items, in the scope the block is written in:
+///
+/// - `pub trait HostFunctions`: one method per declaration, emitted verbatim —
+///   receiver, parameters, return type and doc comment exactly as written. An
+///   execution environment implements it; the rest of the expansion does not
+///   mention it.
+/// - `pub enum HostFunctionSpec`: one variant per declaration, named by
+///   PascalCasing the function name (`get_ledger_sqn` becomes `GetLedgerSqn`) and
+///   carrying that declaration's doc comment. Its `const fn wasm_name` and
+///   `const fn gas` are the ABI metadata, and `ALL` is every variant in
+///   declaration order — what a wasm engine iterates to build its import table.
+/// - `struct HostFnSpec`: private, one row of that metadata table. It exists only
+///   so `wasm_name` and `gas` read from a single `match` over the declarations,
+///   and never appears in a signature a caller can name.
+///
+/// The expansion introduces no other name and reaches for none: the only paths in
+/// it are `Self::Variant` and whatever the declarations themselves spell. So the
+/// block compiles wherever the types it names — `HostResult` above — resolve.
 ///
 /// ```
 /// use xrpl_host_functions::HostResult;
@@ -40,20 +60,22 @@ use parsed_host_function::ParsedHostFunction;
 ///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
 /// }
 ///
-/// // A `HostFunctions` trait, holding the declarations verbatim:
-/// struct Host;
-/// impl HostFunctions for Host {
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize> {
-///         out[..4].copy_from_slice(&7u32.to_le_bytes());
-///         Ok(4)
-///     }
-///     fn trace_num(&self, _msg: &str, _number: i64) -> HostResult<()> { Ok(()) }
+/// // The trait's methods are the declarations, down to the `&self` receiver the
+/// // VM calls the host through.
+/// fn ledger_sqn(host: &dyn HostFunctions, out: &mut [u8]) -> HostResult<usize> {
+///     host.get_ledger_sqn(out)
 /// }
 ///
-/// // A `HostFunctionSpec` enum carrying the ABI metadata as a `const` table:
-/// assert_eq!(HostFunctionSpec::GetLedgerSqn.gas(), 60);
-/// assert_eq!(HostFunctionSpec::TraceNum.wasm_name(), "trace_num");
-/// assert_eq!(HostFunctionSpec::ALL.len(), 2);
+/// // The metadata is a `const` table, so gas and import names are available at
+/// // compile time rather than looked up at run time.
+/// const TRACE_GAS: u64 = HostFunctionSpec::TraceNum.gas();
+/// assert_eq!(TRACE_GAS, 500);
+///
+/// assert_eq!(HostFunctionSpec::GetLedgerSqn.wasm_name(), "ldgr_index");
+/// assert_eq!(
+///     HostFunctionSpec::ALL,
+///     &[HostFunctionSpec::GetLedgerSqn, HostFunctionSpec::TraceNum],
+/// );
 /// ```
 ///
 /// A declaration must be a plain `fn` taking `&self` and returning
@@ -154,8 +176,7 @@ fn generate(functions: &[ParsedHostFunction]) -> TokenStream {
         /// handing over a region clamped to the field cap — but it cannot take
         /// back what a method already put there. A host that wrote a truncated
         /// prefix and then reported the larger length would leave those bytes in
-        /// guest memory behind a refusal the guest is told to ignore. C++'s
-        /// `setData` is the reference point: it wrote only on a value that fit.
+        /// guest memory behind a refusal the guest is told to ignore.
         pub trait HostFunctions {
             #(#trait_methods)*
         }

crates/xrpl-host-functions-macros/src/parsed_host_function.rs

@@ -1,8 +1,8 @@
 use proc_macro2::TokenStream;
-use quote::{format_ident, quote};
+use quote::{ToTokens, format_ident, quote};
 use syn::{
-    Attribute, Expr, ExprLit, Ident, Lit, LitStr, PathArguments, ReceiverKind, ReturnType, Safety,
-    Signature, TraitItemFn, Type, TypePath,
+    Attribute, Ident, LitInt, LitStr, PathArguments, ReceiverKind, ReturnType, Safety, Signature,
+    TraitItemFn, Type, TypePath, parse::Parse,
 };
 
 use crate::errors;
@@ -85,8 +85,8 @@ impl ParsedHostFunction {
                 }
             } else if attr.path().is_ident(WASM_NAME) {
                 saw_wasm_name = true;
-                if let Err(error) =
-                    string_value(&attr).and_then(|v| set_once(&mut wasm_name, v, &attr))
+                if let Err(error) = value::<LitStr>(&attr, "a string literal")
+                    .and_then(|v| set_once(&mut wasm_name, v, &attr))
                 {
                     errors.push(error);
                 }
@@ -335,39 +335,28 @@ fn set_once<T>(slot: &mut Option<T>, value: T, attr: &Attribute) -> syn::Result<
     Ok(())
 }
 
-fn int_value(attr: &Attribute) -> syn::Result<u64> {
-    match &attr.meta.require_name_value()?.value {
-        Expr::Lit(ExprLit {
-            lit: Lit::Int(int), ..
-        }) => {
-            // `LitInt` keeps the sign in its digits, so `base10_parse::<u64>`
-            // would report a negative value as "invalid digit found in string".
-            if int.base10_digits().starts_with('-') {
-                return Err(syn::Error::new_spanned(
-                    int,
-                    format!("`{}` must not be negative", path_name(attr)),
-                ));
-            }
-            int.base10_parse()
-        }
-        other => Err(syn::Error::new_spanned(
-            other,
-            format!("`{}` expects an integer literal", path_name(attr)),
-        )),
-    }
+/// The value of `#[name = <value>]`, parsed as `T`.
+///
+/// `expected` completes "`gas` expects …": syn's own message for the wrong kind
+/// of literal names neither the attribute nor what it wanted.
+fn value<T: Parse>(attr: &Attribute, expected: &str) -> syn::Result<T> {
+    let expr = &attr.meta.require_name_value()?.value;
+    syn::parse2(expr.to_token_stream()).map_err(|_| {
+        syn::Error::new_spanned(expr, format!("`{}` expects {expected}", path_name(attr)))
+    })
 }
 
-fn string_value(attr: &Attribute) -> syn::Result<LitStr> {
-    match &attr.meta.require_name_value()?.value {
-        Expr::Lit(ExprLit {
-            lit: Lit::Str(string),
-            ..
-        }) => Ok(string.clone()),
-        other => Err(syn::Error::new_spanned(
-            other,
-            format!("`{}` expects a string literal", path_name(attr)),
-        )),
+fn int_value(attr: &Attribute) -> syn::Result<u64> {
+    let int: LitInt = value(attr, "an integer literal")?;
+    // `LitInt` keeps the sign in its digits, so `base10_parse::<u64>` would
+    // report a negative value as "invalid digit found in string".
+    if int.base10_digits().starts_with('-') {
+        return Err(syn::Error::new_spanned(
+            int,
+            format!("`{}` must not be negative", path_name(attr)),
+        ));
     }
+    int.base10_parse()
 }
 
 /// The attribute's path as written, for diagnostics: `gas`, or `foo::bar`.
@@ -383,8 +372,7 @@ fn path_name(attr: &Attribute) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use quote::ToTokens;
-    use syn::parse_quote;
+    use syn::{Expr, ExprLit, Lit, parse_quote};
 
     /// The message of every diagnostic recorded by one failed `parse`.
     ///

crates/xrpl-host-functions/src/lib.rs

@@ -90,16 +90,15 @@ host_functions! {
     #[wasm_name = "base_fee"]
     fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize>;
 
-    /// Whether an amendment is enabled. The input is either its 32-byte id or its
-    /// name; the answer is `1` if enabled and `0` if not. Unlike the getters, this
-    /// reads an input region and returns the flag directly rather than writing bytes.
+    /// Whether an amendment is enabled. The input is either its 32-byte id or its name;
+    /// the answer is `1` if enabled and `0` if not.
     #[gas = 100]
     #[wasm_name = "amendment_enabled"]
     fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32>;
 
     /// Load the ledger object with the given 32-byte id into a cache slot, so later
     /// calls can read its fields. `cache_idx` selects the slot (1-based); `0` asks the
-    /// host to assign a free one. Returns the slot used, or a negative error.
+    /// host to assign a free one. Answers the slot used.
     #[gas = 5000]
     #[wasm_name = "cache_le"]
     fn cache_ledger_obj(&self, obj_id: &[u8], cache_idx: i32) -> HostResult<i32>;
@@ -122,14 +121,14 @@ host_functions! {
     fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// The serialized bytes of a nested field of the transaction, reached by a
-    /// `locator`: a path of little-endian `i32` steps (so its byte length is a
-    /// non-zero multiple of 4). Reads the locator region and writes the field bytes.
+    /// `locator`: a path of little-endian `i32` steps (so its byte length is a non-zero
+    /// multiple of 4).
     #[gas = 110]
     #[wasm_name = "tx_inner"]
     fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
     /// The serialized bytes of a nested field of the current (escrow) ledger object,
-    /// reached by a `locator`, as with [`Self::get_tx_nested_field`].
+    /// reached by a `locator`, as with [`HostFunctions::get_tx_nested_field`].
     #[gas = 110]
     #[wasm_name = "home_le_inner"]
     fn get_current_ledger_obj_nested_field(
@@ -150,14 +149,13 @@ host_functions! {
     ) -> HostResult<usize>;
 
     /// The number of elements in an array field of the transaction, selected by its
-    /// `SField` code. Answers the count directly, or a negative error (`NoArray` if
-    /// the field is not an array). Reads and writes no memory.
+    /// `SField` code. Answers the count directly; `NoArray` if the field is not an array.
     #[gas = 40]
     #[wasm_name = "tx_arr_len"]
     fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
 
     /// The number of elements in an array field of the current (escrow) ledger
-    /// object, as with [`Self::get_tx_array_len`].
+    /// object, as with [`HostFunctions::get_tx_array_len`].
     #[gas = 40]
     #[wasm_name = "home_le_arr_len"]
     fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32>;
@@ -169,13 +167,13 @@ host_functions! {
     fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32>;
 
     /// The number of elements in a nested array field of the transaction, reached by a
-    /// `locator`. Reads the locator region and answers the count directly.
+    /// `locator`.
     #[gas = 70]
     #[wasm_name = "tx_inner_arr_len"]
     fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
 
     /// The number of elements in a nested array field of the current (escrow) ledger
-    /// object, reached by a `locator`, as with [`Self::get_tx_nested_array_len`].
+    /// object, reached by a `locator`, as with [`HostFunctions::get_tx_nested_array_len`].
     #[gas = 70]
     #[wasm_name = "home_le_inner_arr_len"]
     fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
@@ -186,14 +184,8 @@ host_functions! {
     #[wasm_name = "le_inner_arr_len"]
     fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32>;
 
-    /// Verify `signature` over `message` under `pubkey`. Reads the three regions and
-    /// answers `1` if the signature is valid, `0` if not, or a negative error.
-    ///
-    /// GAS DISCREPANCY: this 300 is the value the C-ABI fork registered
-    /// (`rippled-wasm-host-functions`, WasmVM.cpp), which this port follows. The
-    /// prior C++ integration in this tree charged 35000 for the same call — 100x
-    /// more, and closer to the real cost of signature verification. The value is
-    /// consensus-critical, so confirm which is intended before this ships.
+    /// Verify `signature` over `message` under `pubkey`. Answers `1` if the signature
+    /// is valid, `0` if not, or a negative error.
     #[gas = 300]
     #[wasm_name = "check_sig"]
     fn check_signature(
@@ -204,28 +196,26 @@ host_functions! {
     ) -> HostResult<i32>;
 
     /// The 32-byte ledger key (keylet) of an account's `AccountRoot`, computed from a
-    /// 20-byte account id. Reads the account region and writes the keylet.
+    /// 20-byte account id.
     #[gas = 350]
     #[wasm_name = "accountroot_id"]
     fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
-    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a
-    /// byte slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued
-    /// currency + issuer). Reads both asset regions and writes the keylet.
+    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a byte
+    /// slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued currency +
+    /// issuer).
     #[gas = 450]
     #[wasm_name = "amm_id"]
     fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
     /// The 32-byte keylet of a `Check`, computed from a 20-byte account id and its
     /// sequence number. `seq` is the guest's `u32` carried as its `i32` bit pattern.
-    /// Reads the account region and writes the keylet.
     #[gas = 350]
     #[wasm_name = "check_id"]
     fn check_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and
-    /// issuer account ids and a credential-type byte string. Reads all three regions
-    /// and writes the keylet.
+    /// issuer account ids and a credential-type byte string.
     #[gas = 350]
     #[wasm_name = "credential_id"]
     fn credential_keylet(
@@ -236,8 +226,8 @@ host_functions! {
         out: &mut [u8],
     ) -> HostResult<usize>;
 
-    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account
-    /// and the account it authorizes. Reads both account regions and writes the keylet.
+    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account and
+    /// the account it authorizes.
     #[gas = 350]
     #[wasm_name = "delegate_id"]
     fn delegate_keylet(
@@ -248,8 +238,7 @@ host_functions! {
     ) -> HostResult<usize>;
 
     /// The 32-byte keylet of a `DepositPreauth`, computed from the 20-byte account and
-    /// the account it authorizes to deposit. Reads both account regions and writes the
-    /// keylet.
+    /// the account it authorizes to deposit.
     #[gas = 350]
     #[wasm_name = "deposit_preauth_id"]
     fn deposit_preauth_keylet(
@@ -260,21 +249,19 @@ host_functions! {
     ) -> HostResult<usize>;
 
     /// The 32-byte keylet of an account's `DID`, computed from its 20-byte account id.
-    /// Reads the account region and writes the keylet.
     #[gas = 350]
     #[wasm_name = "did_id"]
     fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
     /// The 32-byte keylet of an `Escrow`, computed from the 20-byte owner account and
     /// its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern. Reads the account region and writes the keylet.
+    /// pattern.
     #[gas = 350]
     #[wasm_name = "escrow_id"]
     fn escrow_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// The 32-byte keylet of a `RippleState` (trust line), computed from two 20-byte
-    /// account ids and a 20-byte currency. Reads all three regions and writes the
-    /// keylet.
+    /// account ids and a 20-byte currency.
     #[gas = 400]
     #[wasm_name = "trustline_id"]
     fn trust_line_keylet(
@@ -286,8 +273,8 @@ host_functions! {
     ) -> HostResult<usize>;
 
     /// The 32-byte keylet of an `MPTokenIssuance`, computed from the 20-byte issuer
-    /// account and its sequence number. `seq` is the guest's `u32` carried as its
-    /// `i32` bit pattern. Reads the account region and writes the keylet.
+    /// account and its sequence number. `seq` is the guest's `u32` carried as its `i32`
+    /// bit pattern.
     #[gas = 350]
     #[wasm_name = "mpt_issuance_id"]
     fn mptoken_issuance_keylet(
@@ -298,14 +285,14 @@ host_functions! {
     ) -> HostResult<usize>;
 
     /// The 32-byte keylet of an `MPToken`, computed from a 24-byte MPT issuance id and
-    /// the 20-byte holder account. Reads both regions and writes the keylet.
+    /// the 20-byte holder account.
     #[gas = 500]
     #[wasm_name = "mptoken_id"]
     fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
     /// The 32-byte keylet of an `NFTokenOffer`, computed from the 20-byte owner account
     /// and its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern. Reads the account region and writes the keylet.
+    /// pattern.
     #[gas = 350]
     #[wasm_name = "nft_offer_id"]
     fn nftoken_offer_keylet(
@@ -317,22 +304,20 @@ host_functions! {
 
     /// The 32-byte keylet of an `Offer`, computed from the 20-byte owner account and
     /// its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern. Reads the account region and writes the keylet.
+    /// pattern.
     #[gas = 350]
     #[wasm_name = "offer_id"]
     fn offer_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// The 32-byte keylet of an `Oracle`, computed from the 20-byte owner account and
     /// its document id. `doc_id` is the guest's `u32` carried as its `i32` bit pattern.
-    /// Reads the account region and writes the keylet.
     #[gas = 350]
     #[wasm_name = "oracle_id"]
     fn oracle_keylet(&self, account: &[u8], doc_id: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// The 32-byte keylet of a `PayChannel`, computed from the 20-byte source account,
     /// the 20-byte destination account, and the channel's sequence number. `seq` is the
-    /// guest's `u32` carried as its `i32` bit pattern. Reads both account regions and
-    /// writes the keylet.
+    /// guest's `u32` carried as its `i32` bit pattern.
     #[gas = 350]
     #[wasm_name = "paychan_id"]
     fn paychannel_keylet(
@@ -345,7 +330,7 @@ host_functions! {
 
     /// The 32-byte keylet of a `PermissionedDomain`, computed from the 20-byte owner
     /// account and its sequence number. `seq` is the guest's `u32` carried as its `i32`
-    /// bit pattern. Reads the account region and writes the keylet.
+    /// bit pattern.
     #[gas = 350]
     #[wasm_name = "permissioned_domain_id"]
     fn permissioned_domain_keylet(
@@ -356,21 +341,19 @@ host_functions! {
     ) -> HostResult<usize>;
 
     /// The 32-byte keylet of a `SignerList`, computed from its 20-byte owner account.
-    /// Reads the account region and writes the keylet.
     #[gas = 350]
     #[wasm_name = "signers_id"]
     fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
-    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and its
-    /// ticket sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern. Reads the account region and writes the keylet.
+    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and
+    /// its ticket sequence number. `seq` is the guest's `u32` carried as its `i32` bit
+    /// pattern.
     #[gas = 350]
     #[wasm_name = "ticket_id"]
     fn ticket_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// The 32-byte keylet of a `Vault`, computed from the 20-byte owner account and its
     /// sequence number. `seq` is the guest's `u32` carried as its `i32` bit pattern.
-    /// Reads the account region and writes the keylet.
     #[gas = 350]
     #[wasm_name = "vault_id"]
     fn vault_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
@@ -388,51 +371,48 @@ host_functions! {
     ///
     /// It is also the one declaration that is **not** the wasm parameter order.
     /// `data_type` is the third wasm parameter, between the two regions, because that
-    /// is where xrpld's `trace_proto` and the guest stdlib put it; `register.rs` takes
-    /// the arguments in wasm order and calls this in declaration order.
+    /// is where the guest stdlib declares it; `register.rs` takes the arguments in wasm
+    /// order and calls this in declaration order.
     #[gas = 30]
     #[wasm_name = "trace"]
     fn trace(&self, msg: &str, data: &[u8], data_type: TraceDataType) -> HostResult<()>;
 
     /// Stores `data` as the current object's data field, replacing whatever was there,
-    /// and returns the number of bytes stored. Reads the data region; `DataFieldTooLarge`
-    /// if it exceeds the host's limit.
+    /// and returns the number of bytes stored; `DataFieldTooLarge` if it exceeds the
+    /// host's limit.
     #[gas = 1000]
     #[wasm_name = "set_data"]
     fn update_data(&self, data: &[u8]) -> HostResult<i32>;
 
     /// The URI of the `NFToken` with id `nft_id` (32 bytes) held by the 20-byte
-    /// `account`. Reads both regions and writes the URI bytes.
+    /// `account`.
     #[gas = 5000]
     #[wasm_name = "nft_uri"]
     fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
     /// The 20-byte issuer account encoded in the `NFToken` id `nft_id` (32 bytes).
-    /// Reads the id region and writes the issuer bytes.
     #[gas = 70]
     #[wasm_name = "nft_issuer"]
     fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
-    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id region
-    /// and writes the taxon as its four little-endian bytes.
+    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes), as four little-endian
+    /// bytes.
     #[gas = 60]
     #[wasm_name = "nft_taxon"]
     fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
 
-    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id region
-    /// and returns the flags as the call's scalar result.
+    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes).
     #[gas = 60]
     #[wasm_name = "nft_flags"]
     fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32>;
 
-    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id
-    /// region and returns the fee as the call's scalar result.
+    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes).
     #[gas = 60]
     #[wasm_name = "nft_xfer_fee"]
     fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32>;
 
-    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes). Reads the
-    /// id region and writes the sequence as its four little-endian bytes.
+    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes), as four
+    /// little-endian bytes.
     #[gas = 60]
     #[wasm_name = "nft_serial"]
     fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
@@ -441,39 +421,35 @@ host_functions! {
     // holds opaquely and hands back to these functions. Inputs and outputs that are
     // floats are byte regions; `mode` is the rounding mode, a scalar the guest chooses.
 
-    /// A float built from the signed integer `x` under rounding `mode`. Writes the
-    /// float bytes; no input region.
+    /// A float built from the signed integer `x` under rounding `mode`.
     #[gas = 100]
     #[wasm_name = "float_from_int"]
     fn float_from_int(&self, x: i64, mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// A float built from the unsigned integer in the 8-byte region `x` under rounding
-    /// `mode`. Reads the integer region and writes the float bytes.
+    /// `mode`.
     #[gas = 130]
     #[wasm_name = "float_from_uint"]
     fn float_from_uint(&self, x: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// A float built from the serialized `STAmount` in `amount` under rounding `mode`.
-    /// Reads the amount region and writes the float bytes.
     #[gas = 150]
     #[wasm_name = "float_from_stamount"]
     fn float_from_stamount(&self, amount: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
     /// A float built from the serialized `STNumber` in `number` under rounding `mode`.
-    /// Reads the number region and writes the float bytes.
     #[gas = 150]
     #[wasm_name = "float_from_stnumber"]
     fn float_from_stnumber(&self, number: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
-    /// The float `x` rounded to a signed integer under rounding `mode`. Reads the float
-    /// region and writes the integer as its eight little-endian bytes.
+    /// The float `x` rounded to a signed integer under rounding `mode`, as eight
+    /// little-endian bytes.
     #[gas = 130]
     #[wasm_name = "float_to_int"]
     fn float_to_int(&self, x: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
-    /// The float `x` split into its mantissa and exponent. Reads the float region and
-    /// writes the mantissa (eight little-endian bytes) and the exponent (four little-
-    /// endian bytes) to two separate output regions.
+    /// The float `x` split into its mantissa (eight little-endian bytes) and its exponent
+    /// (four little-endian bytes), each written to its own output region.
     #[gas = 130]
     #[wasm_name = "float_to_mant_exp"]
     fn float_to_mant_exp(
@@ -483,8 +459,7 @@ host_functions! {
         exponent_out: &mut [u8],
     ) -> HostResult<usize>;
 
-    /// A float built from `mantissa` and `exponent` under rounding `mode`. Writes the
-    /// float bytes; no input region.
+    /// A float built from `mantissa` and `exponent` under rounding `mode`.
     #[gas = 100]
     #[wasm_name = "float_from_mant_exp"]
     fn float_from_mant_exp(
@@ -496,43 +471,32 @@ host_functions! {
     ) -> HostResult<usize>;
 
     /// Compares floats `x` and `y`, returning a negative, zero, or positive scalar as
-    /// `x` is less than, equal to, or greater than `y`. Reads both float regions.
+    /// `x` is less than, equal to, or greater than `y`.
     #[gas = 80]
     #[wasm_name = "float_cmp"]
     fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<i32>;
 
-    /// The float sum `x + y` under rounding `mode`. Reads both float regions and writes
-    /// the result bytes.
+    /// The float sum `x + y` under rounding `mode`.
     #[gas = 160]
     #[wasm_name = "float_add"]
     fn float_add(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
-    /// The float difference `x - y` under rounding `mode`. Reads both float regions and
-    /// writes the result bytes.
+    /// The float difference `x - y` under rounding `mode`.
     #[gas = 160]
     #[wasm_name = "float_sub"]
     fn float_subtract(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
-    /// The float product `x * y` under rounding `mode`. Reads both float regions and
-    /// writes the result bytes.
+    /// The float product `x * y` under rounding `mode`.
     #[gas = 300]
     #[wasm_name = "float_mult"]
     fn float_multiply(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
-    /// The float quotient `x / y` under rounding `mode`. Reads both float regions and
-    /// writes the result bytes.
+    /// The float quotient `x / y` under rounding `mode`.
     #[gas = 300]
     #[wasm_name = "float_div"]
     fn float_divide(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
 
-    /// The `n`-th root of the float `x` under rounding `mode`. Reads the float region
-    /// and writes the result bytes.
-    #[gas = 5500]
-    #[wasm_name = "float_root"]
-    fn float_root(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float `x` raised to the power `n` under rounding `mode`. Reads the float
-    /// region and writes the result bytes.
+    /// The float `x` raised to the power `n` under rounding `mode`.
     #[gas = 5500]
     #[wasm_name = "float_pow"]
     fn float_power(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize>;

crates/xrpl-host-functions/tests/generated_abi.rs

@@ -1,5 +1,8 @@
-//! Exercises what `host_functions!` generates: the trait is implementable and
-//! the spec table agrees with the declarations in `src/lib.rs`.
+//! Exercises the API that `host_functions!` generates, not the macro itself:
+//! the `HostFunctions` trait is implementable and callable both directly and
+//! through `&dyn`, and the generated `HostFunctionSpec` and `TraceDataType`
+//! tables agree with the declarations in `src/lib.rs`. The macro's own parsing
+//! and diagnostics are covered by the unit tests in `xrpl-host-functions-macros`.
 
 use std::cell::RefCell;
 use std::collections::HashSet;
@@ -557,14 +560,6 @@ impl HostFunctions for FakeHost {
         put(out, &[x[0]])
     }
 
-    /// A one-float-and-integer operator; `InvalidParams` on an empty operand.
-    fn float_root(&self, x: &[u8], _n: i32, _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if x.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[x[0]])
-    }
-
     /// The same shape, for exponentiation.
     fn float_power(&self, x: &[u8], _n: i32, _mode: i32, out: &mut [u8]) -> HostResult<usize> {
         if x.is_empty() {
@@ -821,7 +816,6 @@ fn the_trait_is_implementable() {
     assert_eq!(host.float_subtract(&[3; 8], &[4; 8], 0, &mut out), Ok(1));
     assert_eq!(host.float_multiply(&[3; 8], &[4; 8], 0, &mut out), Ok(1));
     assert_eq!(host.float_divide(&[3; 8], &[4; 8], 0, &mut out), Ok(1));
-    assert_eq!(host.float_root(&[3; 8], 2, 0, &mut out), Ok(1));
     assert_eq!(host.float_power(&[3; 8], 2, 0, &mut out), Ok(1));
 
     assert_eq!(*host.traced.borrow(), ["hello/AsHex/2"]);
@@ -948,7 +942,6 @@ fn the_spec_table_matches_the_declarations() {
             ("float_sub", 160),
             ("float_mult", 300),
             ("float_div", 300),
-            ("float_root", 5500),
             ("float_pow", 5500),
         ]
     );

crates/xrpl-wasm-testkit/src/lib.rs

@@ -4,8 +4,8 @@
 //! point. The engine pins `wasmi = { default-features = false }` precisely so a text
 //! assembler cannot reach the consensus path — wasmi's `wat` feature is on by default and
 //! makes `Module::new` accept text as readily as binary, which would make a transaction's
-//! validity a build flag (review finding A5). Putting `compile_wat` on the production bridge
-//! would link `wat` into xrpld even if nothing called it.
+//! validity a build flag. Putting `compile_wat` on the production bridge would link `wat`
+//! into xrpld even if nothing called it.
 //!
 //! Linked only into `xrpl_tests`, never into `libxrpl` or `xrpld`, so "no assembler in the
 //! shipped node" is a property of the link graph rather than a flag someone can flip.

crates/xrpl-wasm-vm-ffi/src/lib.rs

@@ -1,23 +1,25 @@
 //! The cxx bridge between the escrow wasm engine and xrpld.
 //!
-//! Three crossings. C++ calls `run_escrow` once per escrow finish; the engine's host
-//! calls come back out through the C++ `HostContext`, which `CxxHost` presents to the
-//! engine as an ordinary [`HostFunctions`] implementor. The ABI those calls speak is
-//! declared once, in `xrpl-host-functions`, so neither side of this file gets to
-//! restate a signature.
+//! Three crossings:
 //!
-//! `check_escrow` is the third, and it crosses in one direction only: screening a
-//! module needs no host, so nothing comes back out.
+//! - **In:** C++ calls `run_escrow`, once per escrow finish.
+//! - **Back out:** that run's host calls leave through the C++ `HostContext`, which
+//!   `CxxHost` presents to the engine as an ordinary [`HostFunctions`] implementor.
+//! - **In only:** C++ screens a module with `check_escrow`. Screening needs no host,
+//!   so nothing comes back out.
 //!
-//! **Neither direction may unwind into the other**, and the two halves of that are
+//! The ABI the host calls speak is declared once, in `xrpl-host-functions`, so neither
+//! side of this file gets to restate a signature.
+//!
+//! **Neither language may unwind into the other**, and the two halves of that are
 //! not symmetric:
 //!
 //! - A **Rust panic** is caught here, by `guarded`. Letting one reach C++ is
 //!   undefined behaviour; `[profile.release]` turns overflow checks on, so this is a
 //!   live path and not a formality.
 //! - A **C++ exception** is stopped on the C++ side: every `HostContext` method is
-//!   `noexcept` and reports failure as a negative `HostError` code. That is what
-//!   makes `guarded` sufficient — see its documentation.
+//!   `noexcept` and catches its own. That is what makes `guarded` sufficient — see
+//!   its documentation.
 //!
 //! Everything hand-written here is private, so the names above are code spans rather
 //! than links, and `cargo doc` needs `--document-private-items` to show any of it.
@@ -97,6 +99,8 @@ mod ffi {
         EntryPoint,
         /// The module asks for more linear memory than the engine grants.
         Memory,
+        /// The module asks for a larger table than the engine grants.
+        Table,
         /// The engine panicked. A defect in this crate or the one below it, and
         /// not a fault in the module — which is why it is a status of its own
         /// rather than one more way a contract can be malformed.
@@ -166,7 +170,7 @@ mod ffi {
         /// The C++ side of the ABI: one method per host function, forwarding to
         /// `xrpl::HostFunctions`.
         ///
-        /// Every method is `noexcept` and answers with a code, so a host call cannot
+        /// Every method is `noexcept` and catches everything, so a host call cannot
         /// unwind into the engine.
         ///
         /// `cxx_name` on each method below is not cosmetic: the declarations keep the
@@ -510,10 +514,6 @@ mod ffi {
         #[cxx_name = "floatDivide"]
         fn float_divide(self: &HostContext, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> i32;
 
-        #[namespace = "xrpl"]
-        #[cxx_name = "floatRoot"]
-        fn float_root(self: &HostContext, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> i32;
-
         #[namespace = "xrpl"]
         #[cxx_name = "floatPower"]
         fn float_power(self: &HostContext, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> i32;
@@ -876,10 +876,6 @@ impl HostFunctions for CxxHost<'_> {
         bytes_written(self.ctx.float_divide(x, y, mode, out))
     }
 
-    fn float_root(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        bytes_written(self.ctx.float_root(x, n, mode, out))
-    }
-
     fn float_power(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize> {
         bytes_written(self.ctx.float_power(x, n, mode, out))
     }
@@ -939,7 +935,7 @@ impl ffi::CheckResult {
 /// **Why catching here is enough.** An unwind can only be caught where every frame
 /// between the panic and the catch is Rust, and every frame here is: the engine and
 /// wasmi are Rust, and a host call cannot start a C++ unwind because each
-/// `HostContext` method is `noexcept` and answers with a code. So the only unwind
+/// `HostContext` method is `noexcept` and catches everything. So the only unwind
 /// that can reach this frame started in Rust, and this stops it.
 ///
 /// [`AssertUnwindSafe`] is sound because nothing survives to be observed in a torn
@@ -1036,6 +1032,7 @@ impl From<&CheckError> for ffi::CheckStatus {
             CheckError::Import(_) => ffi::CheckStatus::Import,
             CheckError::EntryPoint(_) => ffi::CheckStatus::EntryPoint,
             CheckError::Memory(_) => ffi::CheckStatus::Memory,
+            CheckError::Table(_) => ffi::CheckStatus::Table,
         }
     }
 }
@@ -1242,6 +1239,7 @@ mod tests {
             CheckError::Import(String::new()),
             CheckError::EntryPoint(String::new()),
             CheckError::Memory(String::new()),
+            CheckError::Table(String::new()),
         ]
     }
 

crates/xrpl-wasm-vm/Cargo.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 edition.workspace = true
 
 [dependencies]
-wasmi = { version = "1.1.0", default-features = false, features = ["std"] }
+wasmi = { version = "2.0.0-beta.10", default-features = false, features = ["std", "validate", "portable-dispatch"] }
 xrpl-host-functions = { path = "../xrpl-host-functions" }
 
 [dev-dependencies]

crates/xrpl-wasm-vm/src/abi.rs

@@ -1,5 +1,6 @@
 use crate::region::Region;
 use crate::vm::{MAX_FIELD_BYTES, VmState};
+use core::ops::Range;
 use wasmi::{Caller, Memory};
 use xrpl_host_functions::{HostError, HostFunctionSpec, HostFunctions, HostResult};
 
@@ -165,7 +166,7 @@ pub(crate) fn read_borrowed<'a>(
 ///
 /// The ABI transports these as a 4-byte region rather than a wasm scalar (the guest
 /// SDK passes `seq.to_le_bytes()`), so the region must be exactly four bytes;
-/// `InvalidParams` otherwise, matching the C-ABI wrapper's `getDataUInt32`.
+/// `InvalidParams` otherwise.
 pub(crate) fn read_u32_arg(bytes: &[u8]) -> HostResult<i32> {
     let arr: [u8; 4] = bytes.try_into().map_err(|_| HostError::InvalidParams)?;
     Ok(i32::from_le_bytes(arr))
@@ -176,8 +177,8 @@ pub(crate) fn read_u32_arg(bytes: &[u8]) -> HostResult<i32> {
 ///
 /// **`fill` returns the value's true length, not what it wrote**: a host holding 64
 /// bytes and offered room for 4 writes nothing and answers `64`, which is how the
-/// guest learns the size to ask for. So `n` is bounded by neither the region nor the
-/// cap, and both checks below are reachable.
+/// guest learns the size to ask for. So `n` is bounded by neither the region, the
+/// cap, nor the budget, and all three checks below are reachable.
 pub(crate) fn write_into(
     caller: &mut Caller<'_, VmState<'_>>,
     out: Region,
@@ -187,15 +188,12 @@ pub(crate) fn write_into(
     let cap = range.len();
     let mem = memory(caller)?;
     let host: &dyn HostFunctions = caller.data().host;
-    // Bounds-checked over the guest's whole declared region, so a buffer running
-    // past memory is a wrong pointer rather than a truncated prefix being served…
+    let budget = usize::try_from(caller.data().transfer_budget.get()).unwrap_or(usize::MAX);
     let buf = mem
         .data_mut(&mut *caller)
         .get_mut(range)
         .ok_or(HostError::PointerOutOfBounds)?;
-    // …of which only the field cap is writable, so no call can exceed it whatever
-    // the guest declared.
-    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES)];
+    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES).min(budget)];
 
     let n = fill(host, buf)?;
 
@@ -273,6 +271,16 @@ pub(crate) fn write_buffered(
 const MANTISSA_BYTES: usize = 8;
 const EXPONENT_BYTES: usize = 4;
 
+fn check_fits(data: &[u8], range: &Range<usize>, width: usize) -> HostResult<()> {
+    let region = data
+        .get(range.clone())
+        .ok_or(HostError::PointerOutOfBounds)?;
+    if region.len() < width {
+        return Err(HostError::BufferTooSmall);
+    }
+    Ok(())
+}
+
 /// Service `float_to_mant_exp`, the one call that writes two output regions: the host
 /// fills the run's output buffer with the mantissa followed by the exponent, and each
 /// is copied to its own guest region once every rule has passed.
@@ -281,6 +289,12 @@ const EXPONENT_BYTES: usize = 4;
 /// to a scratch buffer, so the input stays borrowed rather than copied. The two output
 /// regions are judged after the input, and the mantissa's region before the exponent's,
 /// so the first fault reported is the leftmost.
+///
+/// The two widths are the ABI's rather than the guest's, so the length the host reports
+/// is checked against their sum for equality rather than as a bound, and ahead of the
+/// output regions: a wrong total means there is no answer to place, whatever the guest
+/// declared. That is a fatal error and not a status, since the guest asked for nothing
+/// wrong.
 pub(crate) fn write_mant_exp(
     caller: &mut Caller<'_, VmState<'_>>,
     mantissa_out: Region,
@@ -299,32 +313,35 @@ pub(crate) fn write_mant_exp(
 
     let total = call(host, data, mant_buf, exp_buf)?;
 
-    // Copy the mantissa, then the exponent, each only if its whole value fits its
-    // region — a region too small is `BufferTooSmall`, with nothing written.
+    // Both buffers are fixed-width and were offered whole, so the only length the host
+    // can correctly report is their sum. Anything else is the host contradicting the
+    // ABI: with the widths in doubt, part of what would be copied out is whatever the
+    // previous call left in the buffer, so none of it is copied.
+    if total != MANTISSA_BYTES + EXPONENT_BYTES {
+        return Err(HostError::InternalFatal.into());
+    }
+
     let mant_range = mantissa_out.range()?;
+    check_fits(data, &mant_range, MANTISSA_BYTES)?;
+    let exp_range = exponent_out.range()?;
+    check_fits(data, &exp_range, EXPONENT_BYTES)?;
+
+    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
+
     let mant_dst = data
         .get_mut(mant_range)
         .ok_or(HostError::PointerOutOfBounds)?;
-    if mant_dst.len() < MANTISSA_BYTES {
-        return Err(HostError::BufferTooSmall.into());
-    }
     mant_dst[..MANTISSA_BYTES].copy_from_slice(&state.out_buffer[..MANTISSA_BYTES]);
-
-    let exp_range = exponent_out.range()?;
     let exp_dst = data
         .get_mut(exp_range)
         .ok_or(HostError::PointerOutOfBounds)?;
-    if exp_dst.len() < EXPONENT_BYTES {
-        return Err(HostError::BufferTooSmall.into());
-    }
     exp_dst[..EXPONENT_BYTES]
         .copy_from_slice(&state.out_buffer[MANTISSA_BYTES..MANTISSA_BYTES + EXPONENT_BYTES]);
 
-    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
     #[expect(
         clippy::cast_possible_truncation,
         clippy::cast_possible_wrap,
-        reason = "the total is 12, far inside i32"
+        reason = "a total other than 12 returned above, and 12 is far inside i32"
     )]
     let total = total as i32;
     Ok(total)
@@ -640,9 +657,6 @@ mod tests {
         ) -> HostResult<usize> {
             unreachable!("no unit test in this module calls the host")
         }
-        fn float_root(&self, _x: &[u8], _n: i32, _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
         fn float_power(
             &self,
             _x: &[u8],
@@ -807,4 +821,24 @@ mod tests {
             "one {MAX_FIELD_BYTES}-byte value against a {TRANSFER_LIMIT_BYTES}-byte budget"
         );
     }
+
+    #[test]
+    fn read_u32_arg_success() {
+        let number: u32 = 0x12345678;
+        let le_array: [u8; 4] = number.to_le_bytes();
+        assert_eq!(le_array, [0x78, 0x56, 0x34, 0x12]);
+
+        let result = read_u32_arg(&le_array);
+        assert!(result.is_ok());
+        assert_eq!(result.unwrap(), number.try_into().unwrap());
+    }
+
+    #[test]
+    fn read_u32_arg_invalid_length() {
+        let le_array = [0x56, 0x34, 0x12];
+
+        let result = read_u32_arg(&le_array);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err(), HostError::InvalidParams);
+    }
 }

crates/xrpl-wasm-vm/src/lib.rs

@@ -23,6 +23,6 @@ mod vm;
 
 pub use preflight::{CheckError, check};
 pub use vm::{
-    MAX_FIELD_BYTES, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, RunError, RunFailure, RunOutcome,
-    TRANSFER_LIMIT_BYTES, run,
+    MAX_FIELD_BYTES, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError, RunFailure,
+    RunOutcome, TRANSFER_LIMIT_BYTES, run,
 };

crates/xrpl-wasm-vm/src/preflight.rs

@@ -13,15 +13,17 @@
 //! passes: it is guest code, and executing it is the one thing a check must not do
 //! — a trap in one is charged to the contract like any other trap.
 //!
-//! One thing it screens that a run can only discover: an exported memory larger
-//! than the engine grants. See [`check_memory`] for what stays invisible.
+//! Two things it screens that a run can only discover: an exported memory, or an
+//! exported table, larger than the engine grants. Both read the same export list, so
+//! [`check_exported_resources`] is one pass — see it for what stays invisible, and
+//! why the table case leaves much more of it there.
 
 use std::fmt;
 use wasmi::{ExternType, FuncType, Module, ValType};
 use xrpl_host_functions::HostFunctionSpec;
 
 use crate::register::HOST_MODULE;
-use crate::vm::{MAX_MEMORY_PAGES, compile};
+use crate::vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, compile};
 
 /// Why a module cannot be run. One variant per stage, since the caller maps the
 /// stages separately.
@@ -37,6 +39,8 @@ pub enum CheckError {
     EntryPoint(String),
     /// The module asks for more linear memory than the engine grants.
     Memory(String),
+    /// The module asks for a larger table than the engine grants.
+    Table(String),
 }
 
 impl fmt::Display for CheckError {
@@ -48,22 +52,24 @@ impl fmt::Display for CheckError {
             // "no entry point" would be wrong for an export of the wrong type.
             CheckError::EntryPoint(detail) => write!(f, "{detail}"),
             CheckError::Memory(detail) => write!(f, "memory: {detail}"),
+            CheckError::Table(detail) => write!(f, "table: {detail}"),
         }
     }
 }
 
 /// Screen `wasm`: it must compile, import only what the engine serves, export
-/// `function_name` as `() -> i32`, and ask for no more memory than it may have.
+/// `function_name` as `() -> i32`, and ask for no more memory or table than it may
+/// have.
 ///
 /// The stages are ordered by how much of the module each explains. An import fault
 /// is reported before a missing entry point because the imports are what the rest of
-/// the module is built on; memory comes last, being a resource request rather than a
+/// the module is built on; the resource caps come last, being a request rather than a
 /// mistake about the ABI.
 pub fn check(wasm: &[u8], function_name: &str) -> Result<(), CheckError> {
     let module = compile(wasm).map_err(CheckError::Compile)?;
     check_imports(&module)?;
     check_entry_point(&module, function_name)?;
-    check_memory(&module)
+    check_exported_resources(&module)
 }
 
 /// Every import must be one the linker defines. The first that is not ends the
@@ -116,18 +122,30 @@ fn is_entry_point(ty: &FuncType) -> bool {
     ty.params().is_empty() && matches!(ty.results(), [ValType::I32])
 }
 
-/// A module may not declare more linear memory than the engine grants.
+/// A module may declare no more linear memory, and no larger a table, than the
+/// engine grants. One pass over the exports, since both rules read the same list and
+/// the export table is the only place either is visible.
 ///
-/// Only what it *exports* is visible here. A memory a module keeps to itself is not
-/// in its exports, and the store's limiter is what refuses that one — at
-/// instantiation, where the run is charged nothing and the caller cannot tell it
-/// from any other resource failure. Screening the exported case covers every
-/// contract built against the guest SDK, since a contract needs an exported memory
-/// to make a host call at all.
-fn check_memory(module: &Module) -> Result<(), CheckError> {
+/// **A memory or table the module keeps to itself is therefore not screened**: it is
+/// absent from the exports, and the store's limiter is what refuses it, at
+/// instantiation. That gap is wide for tables — Rust exports
+/// `__indirect_function_table` only under `--export-table`, so unexported is the
+/// normal shape — and narrow for memories, since a contract needs an exported one to
+/// make any host call at all.
+///
+/// A module faulting on both is reported by whichever it declares first. Neither
+/// fault explains the other, so there is no precedence to preserve — only the need
+/// for every node to reach the same verdict, which export order already gives.
+fn check_exported_resources(module: &Module) -> Result<(), CheckError> {
     for export in module.exports() {
-        if let ExternType::Memory(ty) = export.ty() {
-            check_initial_pages(ty.minimum()).map_err(CheckError::Memory)?;
+        match export.ty() {
+            ExternType::Memory(ty) => {
+                check_initial_pages(ty.minimum()).map_err(CheckError::Memory)?;
+            }
+            ExternType::Table(ty) => {
+                check_initial_elements(ty.minimum()).map_err(CheckError::Table)?;
+            }
+            _ => {}
         }
     }
     Ok(())
@@ -148,6 +166,21 @@ fn check_initial_pages(pages: u64) -> Result<(), String> {
     Ok(())
 }
 
+/// Whether the engine will grant a table of this declared initial size.
+///
+/// The *minimum* is the whole question: `table.grow` belongs to the reference-types
+/// proposal, which [`crate::vm`]'s engine turns off, so a table never becomes larger
+/// than it was declared and a declared maximum past the cap is simply unreachable.
+fn check_initial_elements(elements: u64) -> Result<(), String> {
+    let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("the cap is a small constant");
+    if elements > cap {
+        return Err(format!(
+            "initial table of {elements} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
+        ));
+    }
+    Ok(())
+}
+
 /// How an entry-point lookup failed, in the words both stages use: a check and a
 /// run describe the same module the same way, and "no entry point" would send a
 /// contract author looking for a function they already have.
@@ -310,6 +343,25 @@ mod tests {
         );
     }
 
+    /// The cap itself is granted; one element past it is not. The boundary is the
+    /// whole rule, and it is the same boundary the store's limiter applies at
+    /// instantiation.
+    #[test]
+    fn the_initial_table_may_reach_the_cap_but_not_pass_it() {
+        let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("fits");
+        assert_eq!(check_initial_elements(0), Ok(()));
+        assert_eq!(check_initial_elements(cap), Ok(()));
+
+        let past = cap + 1;
+        let refusal = check_initial_elements(past).expect_err("one element past the cap");
+        assert_eq!(
+            refusal,
+            format!(
+                "initial table of {past} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
+            )
+        );
+    }
+
     /// The bridge logs this string and the C++ tests match on it, so the stage's
     /// prefix is part of the interface rather than a debugging aid.
     #[test]
@@ -322,6 +374,10 @@ mod tests {
             CheckError::Memory("initial memory of 129 pages".to_string()).to_string(),
             "memory: initial memory of 129 pages"
         );
+        assert_eq!(
+            CheckError::Table("initial table of 1025 elements".to_string()).to_string(),
+            "table: initial table of 1025 elements"
+        );
         assert_eq!(
             CheckError::Import("no host function 'x'".to_string()).to_string(),
             "import: no host function 'x'"

crates/xrpl-wasm-vm/src/register.rs

@@ -1169,26 +1169,6 @@ pub(crate) fn register_host_functions(
                     })
                 },
             ),
-            HostFunctionSpec::FloatRoot => linker.func_wrap(
-                HOST_MODULE,
-                op.wasm_name(),
-                |mut caller: Caller<'_, VmState<'_>>,
-                 in_ptr: i32,
-                 in_len: i32,
-                 n: i32,
-                 out_ptr: i32,
-                 out_len: i32,
-                 mode: i32|
-                 -> Result<i32, wasmi::Error> {
-                    charged(&mut caller, HostFunctionSpec::FloatRoot, |c| {
-                        let out = Region::new(out_ptr, out_len);
-                        let x = Region::new(in_ptr, in_len);
-                        write_buffered(c, out, |host, data, buf| {
-                            host.float_root(x.read(data)?, n, mode, buf)
-                        })
-                    })
-                },
-            ),
             HostFunctionSpec::FloatPower => linker.func_wrap(
                 HOST_MODULE,
                 op.wasm_name(),

crates/xrpl-wasm-vm/src/vm.rs

@@ -20,8 +20,21 @@ pub const MAX_MEMORY_PAGES: u32 = 128;
 /// [`MAX_MEMORY_PAGES`] in bytes: 8 MiB.
 pub const MAX_MEMORY_BYTES: usize = (MAX_MEMORY_PAGES * WASM_PAGE_BYTES) as usize;
 
-/// Total bytes that may cross the host/guest boundary in one [`run`], separate
-/// from gas.
+/// Cap on a table's element count.
+///
+/// A table entry is 8 bytes and wasmi materializes every one of them inside
+/// `instantiate_and_start` — before the guest's first instruction, so no gas charge
+/// can reach the cost. Without this cap the ceiling is the validator's, `u32::MAX`
+/// entries, which a module asks for in five bytes of LEB128 and pays for in ~34 GiB.
+pub const MAX_TABLE_ELEMENTS: usize = 1024;
+
+/// Total bytes the host may write into guest memory in one [`run`], separate from
+/// gas.
+///
+/// One direction only. What the guest passes in is not charged: it reaches the host
+/// as a borrowed slice of guest memory, capped per value at [`MAX_FIELD_BYTES`] by
+/// `Region::read` and in number by gas, and a host that keeps a copy (`update_data`)
+/// bounds it on its own side.
 pub const TRANSFER_LIMIT_BYTES: u64 = 1 << 20;
 
 /// Size cap on any single value crossing the boundary, in either direction; over
@@ -33,8 +46,8 @@ pub const MAX_FIELD_BYTES: usize = 1024;
 /// State threaded through every host call, stored in the wasmi [`Store`].
 pub(crate) struct VmState<'h> {
     pub(crate) host: &'h dyn HostFunctions,
-    /// Enforces [`MAX_MEMORY_BYTES`] via `Store::limiter`, which needs a `&mut`
-    /// into it from `&mut VmState` — hence a field rather than a local.
+    /// Enforces [`store_limits`] via `Store::limiter`, which needs a `&mut` into it
+    /// from `&mut VmState` — hence a field rather than a local.
     pub(crate) mem_limits: StoreLimits,
     /// Remaining transfer budget for this run ([`TRANSFER_LIMIT_BYTES`]).
     ///
@@ -248,12 +261,37 @@ fn build_wasm_engine() -> Engine {
     config.floats(false);
     config.wasm_multi_memory(false);
     config.wasm_custom_page_sizes(false);
-    config.wasm_memory64(false);
+    // Disabled through the crate feature flag.
+    // config.wasm_memory64(false);
     config.wasm_wide_arithmetic(false);
-    // TODO: enable option to reject wasm code containing start section after wasmi 2.0 release
+    config.allow_start_fn(false);
     Engine::new(&config)
 }
 
+/// Every resource ceiling a run is given, in one place.
+///
+/// The two *size* caps are what a contract can reach today. The three *count* caps
+/// are set to 1 although [`build_wasm_engine`] already forces each: turning
+/// `wasm_reference_types` on would let a module declare up to
+/// `wasmparser::MAX_WASM_TABLES` tables, `wasm_multi_memory` likewise for memories,
+/// and both size caps are **per table and per memory, not aggregate** — so a feature
+/// flag flipped in isolation would multiply the ceiling by a hundred rather than
+/// leave it be. The counts are what keeps those two decisions independent.
+///
+/// wasmi enforces the counts by asking the limiter before it allocates
+/// (`can_create_more_instances`/`_memories`/`_tables`); they default to 10000, so
+/// leaving them unset is not the same as their being unreachable.
+fn store_limits() -> StoreLimits {
+    StoreLimitsBuilder::new()
+        .memory_size(MAX_MEMORY_BYTES)
+        .table_elements(MAX_TABLE_ELEMENTS)
+        .instances(1)
+        .tables(1)
+        .memories(1)
+        .trap_on_grow_failure(true)
+        .build()
+}
+
 /// Compile `wasm` for this engine.
 ///
 /// The one path to a [`Module`]: the configuration is what decides whether a
@@ -275,15 +313,11 @@ pub fn run<'h>(
     let module =
         compile(wasm).map_err(|detail| RunFailure::owing_nothing(RunError::Compile(detail)))?;
 
-    let mem_limits = StoreLimitsBuilder::new()
-        .memory_size(MAX_MEMORY_BYTES)
-        .trap_on_grow_failure(true)
-        .build();
     let mut store = Store::new(
         engine,
         VmState {
             host,
-            mem_limits,
+            mem_limits: store_limits(),
             transfer_budget: Cell::new(TRANSFER_LIMIT_BYTES),
             memory: None,
             out_buffer: [0u8; MAX_FIELD_BYTES],
@@ -341,12 +375,30 @@ mod tests {
         assert!(Engine::same(wasm_engine(), wasm_engine()));
     }
 
+    /// One instance, one table, one memory — asserted here rather than through a
+    /// module, because no module can reach these. `wasm_reference_types(false)` and
+    /// `wasm_multi_memory(false)` make a module declaring a second table or memory
+    /// fail *validation*, so a run never gets far enough to consult the limiter.
+    /// That is exactly why the counts are worth pinning: they are the ceiling that
+    /// survives one of those flags being turned on, and nothing else would fail if
+    /// they were silently dropped.
+    #[test]
+    fn the_store_grants_one_of_each_thing_a_module_can_own() {
+        use wasmi::ResourceLimiter;
+
+        let limits = store_limits();
+        assert_eq!(limits.instances(), 1);
+        assert_eq!(limits.tables(), 1);
+        assert_eq!(limits.memories(), 1);
+    }
+
     /// The only place these numbers appear as literals; every other test derives
     /// them from the constants.
     #[test]
     fn the_limits_are_the_protocol_limits() {
         assert_eq!(MAX_MEMORY_PAGES, 128, "linear-memory page cap");
         assert_eq!(MAX_MEMORY_BYTES, 8 * 1024 * 1024, "page cap in bytes");
+        assert_eq!(MAX_TABLE_ELEMENTS, 1024, "table-element cap");
         assert_eq!(MAX_FIELD_BYTES, 1024, "kMaxWasmDataLength");
         assert_eq!(TRANSFER_LIMIT_BYTES, 1 << 20, "kWasmTransferLimit");
     }

crates/xrpl-wasm-vm/tests/budgets.rs

@@ -26,25 +26,25 @@ fn fuel_for(body: &str, parts: &[&str], host: &FakeHost) -> u64 {
 /// table is consensus input.
 const EMPTY_MODULE_FUEL: u64 = 30;
 
-/// wasmi's own fuel for a host call whose operands are all constants under 64: 14
-/// per `*.const`, plus 1 for the call. Our gas sits on top.
+/// wasmi's own fuel for a host call whose operands are all small constants: 15 per
+/// `*.const`, and the `call` itself is free. Our gas sits on top.
 ///
-/// The formula holds only under 64, because wasmi widens a constant's encoding
-/// above that, each tier costing 7 more. Every call in [`call_for`] keeps its
-/// operands small for that reason; one with a larger constant fails here by a
-/// multiple of 7.
+/// This holds only while every operand is a small constant. wasmi widens a
+/// constant's encoding past a threshold, and a wider const costs more, so a call
+/// built with a large constant fails here. Every call in [`call_for`] keeps its
+/// operands small for that reason.
 fn wasmi_call_fuel(small_const_operands: u64) -> u64 {
-    14 * small_const_operands + 1
+    15 * small_const_operands
 }
 
 /// What wasmi charges on top of that for a call to a function with no result —
 /// `trace`'s shape, and nothing else in the ABI. Per call, not per module. Measured
 /// and pinned like the figures above.
-const WASMI_NO_RESULT_FUEL: u64 = 14;
+const WASMI_NO_RESULT_FUEL: u64 = 15;
 
 /// wasmi's fuel for one `(drop …)`, which is how a module makes more than one call
 /// and keeps only the last result. Pinned like the two above.
-const WASMI_DROP_FUEL: u64 = 21;
+const WASMI_DROP_FUEL: u64 = 22;
 
 /// The wasm a test needs in order to call one host function: the `(import …)`
 /// declaration, a call with small-constant operands, and how many it pushes.
@@ -382,11 +382,6 @@ fn call_for(op: HostFunctionSpec) -> Call {
             "(call $float_div (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
             7,
         ),
-        HostFunctionSpec::FloatRoot => (
-            import::FLOAT_ROOT,
-            "(call $float_root (i32.const 0) (i32.const 8) (i32.const 2) (i32.const 8) (i32.const 8) (i32.const 0))",
-            6,
-        ),
         HostFunctionSpec::FloatPower => (
             import::FLOAT_POW,
             "(call $float_pow (i32.const 0) (i32.const 8) (i32.const 2) (i32.const 8) (i32.const 8) (i32.const 0))",
@@ -540,9 +535,15 @@ fn an_endless_loop_is_stopped_by_gas() {
         matches!(failure.error, RunError::OutOfGas),
         "expected the meter to stop it, got: {failure}"
     );
+    // The cost break down is as follows:
+    // 1. There is a function entry charge (finish function) which seems to be 63 units of fuel.
+    // 2. Each iteration costs 2 units of fuel.
+    // For a GAS amount of 100,000, we will be limited to burning an odd number of fuel.
+    // So the way the test is written, the most fuel that will be used is 99,999 units.
     assert_eq!(
-        failure.fuel_used, GAS,
-        "a runaway guest burns the whole limit"
+        failure.fuel_used,
+        GAS - 1,
+        "a runaway guest burns all but the last unit of the limit"
     );
 }
 
@@ -658,6 +659,183 @@ fn a_modest_run_never_meets_the_budget() {
     assert_eq!(outcome.result, MAX_FIELD_BYTES as i32);
 }
 
+/// A write the budget refuses is a write that did not happen. `float_to_mant_exp` is
+/// the case worth pinning: its two regions are charged as one, so a call that cannot
+/// pay for both must leave both alone rather than place the mantissa and refuse.
+#[test]
+fn a_write_the_budget_refuses_reaches_guest_memory_in_no_part() {
+    let host = FakeHost::new()
+        .answering_field(1, Answer::filler(MAX_FIELD_BYTES))
+        .answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
+
+    // Spend the budget on 1 KiB fields at offset 0, then ask for a mantissa and an
+    // exponent at offsets well clear of them.
+    let call = "(call $float_to_mant_exp (i32.const 0) (i32.const 8) (i32.const 2048) (i32.const 8) (i32.const 2064) (i32.const 4))";
+    let spent = |tail: &str| {
+        module(
+            &[import::HOME_LE_FIELD, import::FLOAT_TO_MANT_EXP, ONE_PAGE],
+            &format!(
+                "(local $r i32)
+                 (loop $l
+                   (local.set $r (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES})))
+                   (br_if $l {WHILE_POSITIVE}))
+                 {tail}"
+            ),
+        )
+    };
+
+    let refused = run(&spent(call), &host).expect("the module should run");
+    assert_eq!(refused.result, code(HostError::OutOfTransferLimit));
+
+    let wat = spent(&format!(
+        "(drop {call})
+         (i32.or (i32.load8_u (i32.const 2048)) (i32.load8_u (i32.const 2064)))"
+    ));
+    let outcome = run(&wat, &host).expect("the module should run");
+    assert_eq!(outcome.result, 0, "neither region should be written");
+}
+
+/// The same rule on the path that writes straight into guest memory: `write_into`
+/// hands the host a slice *of the guest's own buffer*, so a value the budget cannot
+/// pay for has to be kept out of that slice before the host fills it.
+///
+/// The probe region is one the spending loop never writes to, so anything found there
+/// came from the refused call.
+#[test]
+fn a_straight_write_the_budget_refuses_reaches_guest_memory_in_no_part() {
+    /// Clear of the offset the spending loop writes to.
+    const PROBE: usize = 2048;
+    /// Every byte of the value, so the fold sees a prefix as readily as the whole.
+    const MARK: u8 = 0xff;
+
+    let host = FakeHost::new().answering_field(1, Answer::bytes(vec![MARK; MAX_FIELD_BYTES]));
+    let call = format!(
+        "(call $home_le_field (i32.const 1) (i32.const {PROBE}) (i32.const {MAX_FIELD_BYTES}))"
+    );
+
+    // Every local the tails below use is declared here: wasm wants them all ahead of
+    // the first instruction.
+    let spent = |tail: &str| {
+        module(
+            &[import::HOME_LE_FIELD, ONE_PAGE],
+            &format!(
+                "(local $r i32) (local $i i32) (local $seen i32)
+                 (loop $l
+                   (local.set $r (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES})))
+                   (br_if $l {WHILE_POSITIVE}))
+                 {tail}"
+            ),
+        )
+    };
+
+    let refused = run(&spent(&call), &host).expect("the module should run");
+    assert_eq!(refused.result, code(HostError::OutOfTransferLimit));
+
+    // Guest memory starts zero-filled, so or-ing the region together reports whether
+    // any byte of it was written.
+    let wat = spent(&format!(
+        "(drop {call})
+         (loop $l
+           (local.set $seen (i32.or (local.get $seen)
+                                    (i32.load8_u (i32.add (i32.const {PROBE}) (local.get $i)))))
+           (local.set $i (i32.add (local.get $i) (i32.const 1)))
+           (br_if $l (i32.lt_u (local.get $i) (i32.const {MAX_FIELD_BYTES}))))
+         (local.get $seen)"
+    ));
+    let outcome = run(&wat, &host).expect("the module should run");
+    assert_eq!(outcome.result, 0, "not one byte should have been written");
+}
+
+/// What a write may deliver is what is *left* of the budget, to the byte.
+///
+/// The prologue spends all but `LEFT`, and field 3's host answers with as much as it
+/// is offered — so the window `write_into` opened is what it reports and what it
+/// leaves in guest memory, and both are read off as `LEFT`. A mark is a 1, so the
+/// fold over the probe's whole buffer counts the bytes that reached it.
+///
+/// `LEFT` is under [`MAX_FIELD_BYTES`] and the buffer is wider than both probes'
+/// values, so it is the budget answering and neither the field cap nor the guest's
+/// capacity. Field 4 is the byte past it: a host whose value is one larger than what
+/// is left, which no window can hold.
+#[test]
+fn a_write_may_deliver_what_is_left_of_the_budget_and_not_a_byte_more() {
+    /// Full-cap writes, all the prologue can make without overshooting.
+    const BULK: u64 = TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64 - 1;
+    /// What the prologue leaves unspent.
+    const LEFT: usize = MAX_FIELD_BYTES / 2;
+    /// The write that trims what [`BULK`] leaves down to [`LEFT`].
+    const TRIM: usize = MAX_FIELD_BYTES - LEFT;
+    /// Clear of the offset the prologue writes to.
+    const PROBE: usize = 2048;
+    const BUFFER: usize = MAX_FIELD_BYTES;
+    /// One per byte written, so the fold below sums to how many there were.
+    const MARK: u8 = 1;
+
+    assert_eq!(
+        BULK * MAX_FIELD_BYTES as u64 + TRIM as u64 + LEFT as u64,
+        TRANSFER_LIMIT_BYTES,
+        "the prologue must spend all but LEFT of the budget"
+    );
+
+    let host = FakeHost::new()
+        .answering_field(1, Answer::filler(MAX_FIELD_BYTES))
+        .answering_field(2, Answer::filler(TRIM))
+        .answering_field(3, Answer::as_much_as_offered(MARK))
+        .answering_field(4, Answer::claiming(LEFT + 1));
+
+    let probe = |field: i32| {
+        format!(
+            "(call $home_le_field (i32.const {field}) (i32.const {PROBE}) (i32.const {BUFFER}))"
+        )
+    };
+    // Every local the tails use, declared where wasm wants them.
+    let after_prologue = |tail: String| {
+        let wat = module(
+            &[import::HOME_LE_FIELD, ONE_PAGE],
+            &format!(
+                "(local $i i32) (local $marks i32)
+                 (loop $l
+                   (drop (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES})))
+                   (local.set $i (i32.add (local.get $i) (i32.const 1)))
+                   (br_if $l (i32.lt_u (local.get $i) (i32.const {BULK}))))
+                 (drop (call $home_le_field (i32.const 2) (i32.const 0) (i32.const {TRIM})))
+                 (local.set $i (i32.const 0))
+                 {tail}"
+            ),
+        );
+        run(&wat, &host).expect("the module should run").result
+    };
+
+    assert_eq!(
+        after_prologue(probe(3)),
+        LEFT as i32,
+        "the host should be offered exactly what is left"
+    );
+
+    // Guest memory starts zero-filled, so summing the probe's whole buffer counts the
+    // marks in it.
+    assert_eq!(
+        after_prologue(format!(
+            "(drop {})
+             (loop $l
+               (local.set $marks (i32.add (local.get $marks)
+                                          (i32.load8_u (i32.add (i32.const {PROBE}) (local.get $i)))))
+               (local.set $i (i32.add (local.get $i) (i32.const 1)))
+               (br_if $l (i32.lt_u (local.get $i) (i32.const {BUFFER}))))
+             (local.get $marks)",
+            probe(3)
+        )),
+        LEFT as i32,
+        "and that many marks, no more, should reach guest memory"
+    );
+
+    assert_eq!(
+        after_prologue(probe(4)),
+        code(HostError::OutOfTransferLimit),
+        "a value one byte past what is left fits no window"
+    );
+}
+
 /// Reads leave the budget alone: `read_borrowed` hands the host a slice *aliasing*
 /// guest memory, so there are no copied bytes to charge. What bounds how many reads
 /// a run can make is gas, which every host call pays before its body runs.
@@ -748,3 +926,64 @@ fn only_the_output_half_of_a_read_write_spends_the_budget() {
         "only the digests are charged, and they fit"
     );
 }
+
+// cspell:disable
+/// Measures each pinned fuel figure straight from wasmi and asserts the constant
+/// still matches. This is what fails first when a wasmi upgrade shifts the fuel
+/// table, and it prints every measured number so the constants can be re-derived:
+///
+///     cargo test -p xrpl-wasm-vm --test budgets probe_fuel -- --exact --nocapture
+///
+/// The behavioural tests above build totals out of these constants; this one ties
+/// each constant back to the one measurement that defines it.
+// cspell:enable
+#[test]
+fn probe_fuel() {
+    let h = FakeHost::new().answering_field(1, Answer::bytes([0xaa]));
+
+    // EMPTY_MODULE_FUEL: a module that only returns a constant.
+    let empty = fuel_for("(i32.const 0)", &[ONE_PAGE], &h);
+    eprintln!("EMPTY_MODULE_FUEL = {empty}");
+    assert_eq!(empty, EMPTY_MODULE_FUEL, "EMPTY_MODULE_FUEL");
+
+    // wasmi_call_fuel(operands) = fuel(1 call) - empty - gas, for every op. Asserting
+    // it against the formula across all operand counts pins both slope and intercept.
+    eprintln!("--- wasmi_call_fuel by operand count ---");
+    for &op in HostFunctionSpec::ALL {
+        let c = call_for(op);
+        // A no-result op's body ends in a trailing constant, not the call's result,
+        // so its total carries an extra push; it is pinned in the NO_RESULT section.
+        if !c.yields {
+            continue;
+        }
+        let one = fuel_for(&c.body(1), &[c.import, ONE_PAGE], &h);
+        let measured = one - empty - op.gas();
+        eprintln!(
+            "operands={:2}  wasmi_call_fuel={measured:3}  {}",
+            c.operands, c.call
+        );
+        assert_eq!(
+            measured,
+            wasmi_call_fuel(c.operands),
+            "wasmi_call_fuel({}) for {}",
+            c.operands,
+            c.call
+        );
+    }
+
+    // WASMI_DROP_FUEL: a second yielding call adds one call plus one drop.
+    let g = call_for(HostFunctionSpec::GetLedgerSqn);
+    let g1 = fuel_for(&g.body(1), &[g.import, ONE_PAGE], &h);
+    let g2 = fuel_for(&g.body(2), &[g.import, ONE_PAGE], &h);
+    let drop = (g2 - g1) - (wasmi_call_fuel(g.operands) + HostFunctionSpec::GetLedgerSqn.gas());
+    eprintln!("WASMI_DROP_FUEL = {drop}");
+    assert_eq!(drop, WASMI_DROP_FUEL, "WASMI_DROP_FUEL");
+
+    // WASMI_NO_RESULT_FUEL: trace is the only no-result op; its module ends in a
+    // trailing constant instead of the call's result.
+    let t = call_for(HostFunctionSpec::Trace);
+    let t1 = fuel_for(&t.body(1), &[t.import, ONE_PAGE], &h);
+    let no_result = t1 - empty - wasmi_call_fuel(t.operands) - HostFunctionSpec::Trace.gas();
+    eprintln!("WASMI_NO_RESULT_FUEL = {no_result}");
+    assert_eq!(no_result, WASMI_NO_RESULT_FUEL, "WASMI_NO_RESULT_FUEL");
+}

crates/xrpl-wasm-vm/tests/host_calls.rs

@@ -935,6 +935,48 @@ fn float_to_mant_exp_writes_both_regions() {
     assert_eq!(status(&wat, &host), 9, "the exponent's first byte");
 }
 
+/// The widths that call writes are the ABI's, so a host reporting any other total has
+/// contradicted it: the regions are wide enough and the guest asked for nothing wrong,
+/// yet the mantissa is short of its eight bytes, so the rest of what would be copied is
+/// whatever the buffer already held. The run stops instead.
+#[test]
+fn float_to_mant_exp_with_a_wrong_total_stops_the_run() {
+    let host = FakeHost::new().answering_float_mant_exp(vec![1, 2, 3, 4], vec![9, 10, 11, 12]);
+
+    let wat = module(
+        &[import::FLOAT_TO_MANT_EXP, ONE_PAGE],
+        "(call $float_to_mant_exp (i32.const 0) (i32.const 8) (i32.const 64) (i32.const 8) (i32.const 80) (i32.const 4))",
+    );
+    assert!(
+        matches!(failure(&wat, &host).error, RunError::Internal),
+        "a total that is not the two widths must stop the run"
+    );
+}
+
+/// The two regions are one answer, so a call that cannot place all of it places none
+/// of it: an exponent region too small refuses the call with the mantissa's own region
+/// wide enough and untouched.
+#[test]
+fn float_to_mant_exp_with_a_short_exponent_region_writes_neither() {
+    let host =
+        FakeHost::new().answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
+
+    // Eight bytes for the mantissa at offset 64, but two for the exponent at 80.
+    let call = "(call $float_to_mant_exp (i32.const 0) (i32.const 8) (i32.const 64) (i32.const 8) (i32.const 80) (i32.const 2))";
+
+    let wat = module(&[import::FLOAT_TO_MANT_EXP, ONE_PAGE], call);
+    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
+
+    let wat = module(
+        &[import::FLOAT_TO_MANT_EXP, ONE_PAGE],
+        &format!(
+            "(drop {call})
+             (i32.or (i32.load8_u (i32.const 64)) (i32.load8_u (i32.const 80)))"
+        ),
+    );
+    assert_eq!(status(&wat, &host), 0, "neither region should be written");
+}
+
 /// A comparison that reads two float regions and returns a scalar verdict, no output
 /// region involved.
 #[test]
@@ -964,28 +1006,11 @@ fn float_add_reads_both_operands_and_the_mode() {
     );
     assert_eq!(status(&wat, &host), 8, "the result length");
     assert_eq!(
-        *host.float_binops_asked.borrow(),
+        *host.float_binary_ops_asked.borrow(),
         vec![("add", vec![0u8; 8], vec![0u8; 8], 2)]
     );
 }
 
-/// A unary operator that reads one float region, an integer, and a mode: all three
-/// reach the host, tagged by operator.
-#[test]
-fn float_root_reads_the_float_the_degree_and_the_mode() {
-    let host = FakeHost::new().answering_float(support::Answer::filler(8));
-
-    let wat = module(
-        &[import::FLOAT_ROOT, ONE_PAGE],
-        "(call $float_root (i32.const 0) (i32.const 8) (i32.const 3) (i32.const 64) (i32.const 8) (i32.const 1))",
-    );
-    assert_eq!(status(&wat, &host), 8, "the result length");
-    assert_eq!(
-        *host.float_unops_asked.borrow(),
-        vec![("root", vec![0u8; 8], 3, 1)]
-    );
-}
-
 /// A leading scalar parameter reaches the host as declared.
 #[test]
 fn home_le_field_passes_the_field_selector_through() {

crates/xrpl-wasm-vm/tests/preflight.rs

@@ -8,7 +8,7 @@ mod support;
 
 use support::{ENTRY, FakeHost, ONE_PAGE, PLENTY_OF_GAS, assemble, import, module};
 use xrpl_host_functions::HostFunctionSpec;
-use xrpl_wasm_vm::{CheckError, MAX_MEMORY_PAGES, RunError};
+use xrpl_wasm_vm::{CheckError, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError};
 
 /// Assert which stage screening refused a module at, because the caller maps the
 /// stages separately. The error comes back out for the tests that also read its
@@ -98,7 +98,7 @@ fn a_disabled_feature_does_not_pass() {
 
 /// Every host function the ABI declares, spelled as a guest imports it. The count
 /// is asserted against the ABI so a function added to it cannot be left out here.
-const ALL_IMPORTS: [&str; 61] = [
+const ALL_IMPORTS: [&str; 60] = [
     import::LDGR_INDEX,
     import::PARENT_LDGR_TIME,
     import::PARENT_LDGR_HASH,
@@ -158,7 +158,6 @@ const ALL_IMPORTS: [&str; 61] = [
     import::FLOAT_SUB,
     import::FLOAT_MULT,
     import::FLOAT_DIV,
-    import::FLOAT_ROOT,
     import::FLOAT_POW,
 ];
 
@@ -464,39 +463,113 @@ fn a_declared_maximum_past_the_cap_still_passes() {
     ));
 }
 
-/// The gap, listed rather than described, and now one entry long. A memory a module
-/// keeps to itself is not in its exports, so this is the one module that passes
-/// screening and then fails to *instantiate* — which is why a run's refusal at that
-/// stage cannot be read as the node's fault.
+/// A module asking for more table than the engine grants is refused for the same
+/// reason a memory is. The cap itself passes.
+#[test]
+fn an_exported_table_past_the_cap_does_not_pass() {
+    let wat = module(
+        &[&format!(
+            r#"(table (export "t") {} funcref)"#,
+            MAX_TABLE_ELEMENTS + 1
+        )],
+        "(i32.const 0)",
+    );
+    let refusal = assert_stage!(refusal(&wat), CheckError::Table(_)).to_string();
+    assert!(refusal.contains("past the 1024-element cap"), "{refusal}");
+
+    passes(&module(
+        &[&format!(
+            r#"(table (export "t") {MAX_TABLE_ELEMENTS} funcref)"#
+        )],
+        "(i32.const 0)",
+    ));
+}
+
+/// Both caps are applied in one pass over the exports, so neither may end the walk
+/// early: a passing memory must not hide a failing table declared after it, and a
+/// passing table must not hide a failing memory.
+#[test]
+fn one_pass_screens_both_resources() {
+    let after_a_passing_memory = refusal(&module(
+        &[
+            ONE_PAGE,
+            &format!(r#"(table (export "t") {} funcref)"#, MAX_TABLE_ELEMENTS + 1),
+        ],
+        "(i32.const 0)",
+    ));
+    assert_stage!(after_a_passing_memory, CheckError::Table(_));
+
+    let after_a_passing_table = refusal(&module(
+        &[
+            r#"(table (export "t") 1 funcref)"#,
+            &format!(r#"(memory (export "memory") {})"#, MAX_MEMORY_PAGES + 1),
+        ],
+        "(i32.const 0)",
+    ));
+    assert_stage!(after_a_passing_table, CheckError::Memory(_));
+}
+
+/// As with memory, a declared *maximum* past the cap is unreachable rather than
+/// wrong: `vm_limits` runs this very module to completion.
+#[test]
+fn a_declared_table_maximum_past_the_cap_still_passes() {
+    passes(&module(
+        &[&format!(
+            r#"(table (export "t") 1 {} funcref)"#,
+            MAX_TABLE_ELEMENTS + 1
+        )],
+        "(i32.const 0)",
+    ));
+}
+
+/// The gap, listed rather than described. A memory or a table a module keeps to
+/// itself is not in its exports, so these are the modules that pass screening and
+/// then fail to *instantiate* — which is why a run's refusal at that stage cannot be
+/// read as the node's fault.
 ///
-/// A contract needs an exported memory to make any host call, so a module of this
-/// shape can do nothing but compute; the SDK does not produce one.
+/// The two entries are not equally remote. A contract needs an exported memory to
+/// make any host call, so the memory row can do nothing but compute and the SDK does
+/// not produce one. A table, though, is *normally* unexported — Rust exports
+/// `__indirect_function_table` only under `--export-table` — so the table row is the
+/// shape a hostile module actually takes, and the store's limiter is the only thing
+/// standing in front of it.
 #[test]
 fn what_static_screening_cannot_see() {
     let host = FakeHost::new();
-    let wat = format!(
-        r#"(module (memory {})
-             (func (export "finish") (result i32) (i32.const 0)))"#,
-        MAX_MEMORY_PAGES + 1
-    );
 
-    passes(&wat);
+    for (label, declaration) in [
+        ("memory", format!("(memory {})", MAX_MEMORY_PAGES + 1)),
+        (
+            "table",
+            format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1),
+        ),
+    ] {
+        let wat = format!(
+            r#"(module {declaration}
+                 (func (export "finish") (result i32) (i32.const 0)))"#
+        );
 
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("the store's limiter must refuse the memory");
-    assert!(
-        matches!(failure.error, RunError::Instantiate(_)),
-        "{failure}"
-    );
+        passes(&wat);
+
+        let failure = match xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY) {
+            Err(failure) => failure,
+            Ok(outcome) => panic!(
+                "the store's limiter must refuse the {label}, but the module returned {}",
+                outcome.result
+            ),
+        };
+        assert!(
+            matches!(failure.error, RunError::Instantiate(_)),
+            "{label}: {failure}"
+        );
+    }
 }
 
-/// A start section is guest code, so screening cannot see whether it traps — but it
-/// no longer has to. A trap is the guest's fault wherever it happens, so the run
-/// charges the contract for what it burned instead of reporting a module the node
-/// should have screened.
+/// A start section runs guest code at instantiation, before the entry point. The
+/// engine disallows it, so screening refuses the module outright rather than letting
+/// any code run ahead of the entry point.
 #[test]
-fn a_start_section_screening_cannot_see_is_charged_as_a_trap() {
-    let host = FakeHost::new();
+fn a_start_section_is_refused_by_screening() {
     let wat = format!(
         r#"(module {ONE_PAGE}
              (func $init (unreachable))
@@ -504,13 +577,19 @@ fn a_start_section_screening_cannot_see_is_charged_as_a_trap() {
              (func (export "finish") (result i32) (i32.const 0)))"#
     );
 
-    passes(&wat);
+    let refusal = assert_stage!(refusal(&wat), CheckError::Compile(_)).to_string();
+    assert!(refusal.contains("start"), "{refusal}");
+}
 
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a start section that traps must not complete the run");
-    assert!(matches!(failure.error, RunError::Trap(_)), "{failure}");
+#[test]
+fn a_memory64_memory_is_refused_by_screening() {
+    let wat = r#"(module
+        (memory i64 1)
+        (func (export "finish") (result i32) (i32.const 0)))"#;
+
+    let refusal = assert_stage!(refusal(wat), CheckError::Compile(_)).to_string();
     assert!(
-        failure.fuel_used > 0,
-        "charged for what it burned: {failure}"
+        refusal.contains("memory64") || refusal.contains("i64"),
+        "{refusal}"
     );
 }

crates/xrpl-wasm-vm/tests/support/mod.rs

@@ -31,6 +31,11 @@ pub enum Answer {
     /// test can reach the over-cap and buffer-fit rules without a value that
     /// large.
     Value { bytes: Vec<u8>, len: usize },
+    /// Fills the output region with `mark` and reports its length: a host whose
+    /// value is as large as the room it is given. What it writes and what it
+    /// reports are then both the width of the window the engine opened, which is
+    /// how a test observes that width rather than inferring it from a refusal.
+    AsMuchAsOffered { mark: u8 },
     /// Fails without touching the output region.
     Fail(HostError),
 }
@@ -70,6 +75,12 @@ impl Answer {
         Answer::bytes((0..len).map(|i| i as u8).collect::<Vec<u8>>())
     }
 
+    /// A `mark` in every byte it is offered, reporting that many. See
+    /// [`Answer::AsMuchAsOffered`].
+    pub fn as_much_as_offered(mark: u8) -> Answer {
+        Answer::AsMuchAsOffered { mark }
+    }
+
     fn fill(&self, out: &mut [u8]) -> HostResult<usize> {
         match self {
             Answer::Value { bytes, len } => {
@@ -78,6 +89,10 @@ impl Answer {
                 }
                 Ok(*len)
             }
+            Answer::AsMuchAsOffered { mark } => {
+                out.fill(*mark);
+                Ok(out.len())
+            }
             Answer::Fail(error) => Err(*error),
         }
     }
@@ -91,6 +106,25 @@ pub struct Trace {
     pub data: Vec<u8>,
 }
 
+/// The `(message, signature, pubkey)` `check_signature` takes.
+pub type SigCheck = (Vec<u8>, Vec<u8>, Vec<u8>);
+
+/// The `(subject, issuer, type)` `credential_keylet` takes.
+pub type CredentialKey = (Vec<u8>, Vec<u8>, Vec<u8>);
+
+/// The `(account1, account2, currency)` `trust_line_keylet` takes.
+pub type TrustLineKey = (Vec<u8>, Vec<u8>, Vec<u8>);
+
+/// The `(account, destination, seq)` `paychannel_keylet` takes.
+pub type PaychannelKey = (Vec<u8>, Vec<u8>, i32);
+
+/// One call to a float operator over two floats — `float_add`, `float_subtract`,
+/// `float_multiply`, `float_divide` — as `(operator, x, y, mode)`.
+pub type FloatBinaryCall = (&'static str, Vec<u8>, Vec<u8>, i32);
+
+/// One call to a float operator over a float and an integer — `float_power` — as `(operator, x, n, mode)`.
+pub type FloatUnaryCall = (&'static str, Vec<u8>, i32, i32);
+
 /// A `HostFunctions` implementation that answers from what the test put in it and
 /// records what it was asked. The ABI's receiver is `&self`, so the recording goes
 /// behind `RefCell`, as a real mutating host's would.
@@ -172,7 +206,7 @@ pub struct FakeHost {
     /// What `check_signature` answers, whatever it is given.
     pub sig_valid: HostResult<i32>,
     /// Every (message, signature, pubkey) `check_signature` was asked to verify.
-    pub sigs_checked: RefCell<Vec<(Vec<u8>, Vec<u8>, Vec<u8>)>>,
+    pub sigs_checked: RefCell<Vec<SigCheck>>,
     /// What `account_keylet` answers, by account bytes. An unlisted account answers
     /// `InvalidAccount`.
     pub account_keylets: HashMap<Vec<u8>, Answer>,
@@ -190,9 +224,9 @@ pub struct FakeHost {
     pub check_keylets_asked: RefCell<Vec<(Vec<u8>, i32)>>,
     /// What `credential_keylet` answers, by (subject, issuer, type) bytes. An unlisted
     /// key answers `InvalidAccount`.
-    pub credential_keylets: HashMap<(Vec<u8>, Vec<u8>, Vec<u8>), Answer>,
+    pub credential_keylets: HashMap<CredentialKey, Answer>,
     /// Every (subject, issuer, type) `credential_keylet` was asked for.
-    pub credential_keylets_asked: RefCell<Vec<(Vec<u8>, Vec<u8>, Vec<u8>)>>,
+    pub credential_keylets_asked: RefCell<Vec<CredentialKey>>,
     /// What `delegate_keylet` answers, by (account, authorize) bytes. An unlisted key
     /// answers `InvalidAccount`.
     pub delegate_keylets: HashMap<(Vec<u8>, Vec<u8>), Answer>,
@@ -215,9 +249,9 @@ pub struct FakeHost {
     pub escrow_keylets_asked: RefCell<Vec<(Vec<u8>, i32)>>,
     /// What `trust_line_keylet` answers, by (account1, account2, currency) bytes. An
     /// unlisted key answers `InvalidAccount`.
-    pub trust_line_keylets: HashMap<(Vec<u8>, Vec<u8>, Vec<u8>), Answer>,
+    pub trust_line_keylets: HashMap<TrustLineKey, Answer>,
     /// Every (account1, account2, currency) `trust_line_keylet` was asked for.
-    pub trust_line_keylets_asked: RefCell<Vec<(Vec<u8>, Vec<u8>, Vec<u8>)>>,
+    pub trust_line_keylets_asked: RefCell<Vec<TrustLineKey>>,
     /// What `mptoken_issuance_keylet` answers, by (issuer bytes, seq). An unlisted key
     /// answers `InvalidAccount`.
     pub mpt_issuance_keylets: HashMap<(Vec<u8>, i32), Answer>,
@@ -245,9 +279,9 @@ pub struct FakeHost {
     pub oracle_keylets_asked: RefCell<Vec<(Vec<u8>, i32)>>,
     /// What `paychannel_keylet` answers, by (account, destination, seq). An unlisted
     /// key answers `InvalidAccount`.
-    pub paychannel_keylets: HashMap<(Vec<u8>, Vec<u8>, i32), Answer>,
+    pub paychannel_keylets: HashMap<PaychannelKey, Answer>,
     /// Every (account, destination, seq) `paychannel_keylet` was asked for.
-    pub paychannel_keylets_asked: RefCell<Vec<(Vec<u8>, Vec<u8>, i32)>>,
+    pub paychannel_keylets_asked: RefCell<Vec<PaychannelKey>>,
     /// What `permissioned_domain_keylet` answers, by (account bytes, seq). An unlisted
     /// key answers `InvalidAccount`.
     pub domain_keylets: HashMap<(Vec<u8>, i32), Answer>,
@@ -335,10 +369,9 @@ pub struct FakeHost {
     pub float_compare_asked: RefCell<Vec<(Vec<u8>, Vec<u8>)>>,
     /// Every `(x, y, mode)` the four binary float operators were asked for, tagged by
     /// operator name.
-    pub float_binops_asked: RefCell<Vec<(&'static str, Vec<u8>, Vec<u8>, i32)>>,
-    /// Every `(x, n, mode)` `float_root` and `float_power` were asked for, tagged by
-    /// operator name.
-    pub float_unops_asked: RefCell<Vec<(&'static str, Vec<u8>, i32, i32)>>,
+    pub float_binary_ops_asked: RefCell<Vec<FloatBinaryCall>>,
+    /// Every `(x, n, mode)` `float_power` was asked for, tagged by operator name.
+    pub float_unary_ops_asked: RefCell<Vec<FloatUnaryCall>>,
 }
 
 impl Default for FakeHost {
@@ -453,8 +486,8 @@ impl Default for FakeHost {
             float_from_mant_exp_asked: RefCell::new(Vec::new()),
             float_compare_answer: Ok(0),
             float_compare_asked: RefCell::new(Vec::new()),
-            float_binops_asked: RefCell::new(Vec::new()),
-            float_unops_asked: RefCell::new(Vec::new()),
+            float_binary_ops_asked: RefCell::new(Vec::new()),
+            float_unary_ops_asked: RefCell::new(Vec::new()),
         }
     }
 }
@@ -1327,42 +1360,35 @@ impl HostFunctions for FakeHost {
     }
 
     fn float_add(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        self.float_binops_asked
+        self.float_binary_ops_asked
             .borrow_mut()
             .push(("add", x.to_vec(), y.to_vec(), mode));
         self.float_answer.fill(out)
     }
 
     fn float_subtract(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        self.float_binops_asked
+        self.float_binary_ops_asked
             .borrow_mut()
             .push(("sub", x.to_vec(), y.to_vec(), mode));
         self.float_answer.fill(out)
     }
 
     fn float_multiply(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        self.float_binops_asked
+        self.float_binary_ops_asked
             .borrow_mut()
             .push(("mult", x.to_vec(), y.to_vec(), mode));
         self.float_answer.fill(out)
     }
 
     fn float_divide(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        self.float_binops_asked
+        self.float_binary_ops_asked
             .borrow_mut()
             .push(("div", x.to_vec(), y.to_vec(), mode));
         self.float_answer.fill(out)
     }
 
-    fn float_root(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        self.float_unops_asked
-            .borrow_mut()
-            .push(("root", x.to_vec(), n, mode));
-        self.float_answer.fill(out)
-    }
-
     fn float_power(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        self.float_unops_asked
+        self.float_unary_ops_asked
             .borrow_mut()
             .push(("pow", x.to_vec(), n, mode));
         self.float_answer.fill(out)
@@ -1453,7 +1479,6 @@ pub mod import {
     pub const FLOAT_SUB: &str = r#"(import "host_lib" "float_sub" (func $float_sub (param i32 i32 i32 i32 i32 i32 i32) (result i32)))"#;
     pub const FLOAT_MULT: &str = r#"(import "host_lib" "float_mult" (func $float_mult (param i32 i32 i32 i32 i32 i32 i32) (result i32)))"#;
     pub const FLOAT_DIV: &str = r#"(import "host_lib" "float_div" (func $float_div (param i32 i32 i32 i32 i32 i32 i32) (result i32)))"#;
-    pub const FLOAT_ROOT: &str = r#"(import "host_lib" "float_root" (func $float_root (param i32 i32 i32 i32 i32 i32) (result i32)))"#;
     pub const FLOAT_POW: &str = r#"(import "host_lib" "float_pow" (func $float_pow (param i32 i32 i32 i32 i32 i32) (result i32)))"#;
 }
 

crates/xrpl-wasm-vm/tests/vm_limits.rs

@@ -1,5 +1,5 @@
 //! What the engine refuses outright: modules it will not compile, will not
-//! instantiate, or cannot find an entry point in — plus the linear-memory cap.
+//! instantiate, or cannot find an entry point in — plus the memory and table caps.
 //!
 //! These are the sandbox's outer wall. Everything here fails the run rather than
 //! returning a code to the guest, so each test reads the failure's message.
@@ -9,7 +9,7 @@ mod support;
 use support::{
     FakeHost, ONE_PAGE, PLENTY_OF_GAS, failure, import, module, run, run_entry, run_with_gas,
 };
-use xrpl_wasm_vm::{MAX_MEMORY_PAGES, RunError};
+use xrpl_wasm_vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError};
 
 /// Assert which stage a run failed at, because the caller maps the stages to
 /// different outcomes. A stage is one `RunError` variant, so the expectation is a
@@ -99,6 +99,68 @@ fn a_declared_maximum_past_the_cap_is_allowed_but_unreachable() {
     assert_stage!(failure(&wat, &host), RunError::Trap(_));
 }
 
+// ---------------------------------------------------------------------------
+// Tables
+// ---------------------------------------------------------------------------
+
+/// A table's whole cost is paid at instantiation: wasmi writes all 8 bytes of every
+/// element before the guest's first instruction, so a module declaring more than the
+/// cap must be refused there rather than charged for it.
+#[test]
+fn an_initial_table_past_the_cap_is_refused() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[&format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1)],
+        "(i32.const 0)",
+    );
+    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
+}
+
+/// The cap itself is allowed.
+#[test]
+fn an_initial_table_at_the_cap_is_allowed() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[&format!("(table {MAX_TABLE_ELEMENTS} funcref)")],
+        "(i32.const 0)",
+    );
+    assert_eq!(run(&wat, &host).expect("should run").result, 0);
+}
+
+/// The cap binds a table the module keeps to itself, which is the case that matters:
+/// a contract has no reason to export its table, so screening never sees the one a
+/// hostile module declares.
+#[test]
+fn the_table_cap_binds_an_unexported_table() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[&format!("(table {} funcref)", u32::from(u16::MAX) * 100)],
+        "(i32.const 0)",
+    );
+    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
+}
+
+/// A declared *maximum* past the cap is legal and simply unreachable, mirroring what
+/// linear memory allows. Nothing can reach it: `table.grow` is a reference-types
+/// instruction and the engine turns that feature off, so a table's declared minimum
+/// is also its final size.
+#[test]
+fn a_declared_table_maximum_past_the_cap_is_allowed_but_unreachable() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[&format!(
+            "(table 1 {} funcref)",
+            u64::try_from(MAX_TABLE_ELEMENTS).expect("fits") + 1
+        )],
+        "(i32.const 0)",
+    );
+    assert_eq!(run(&wat, &host).expect("should run").result, 0);
+}
+
 // ---------------------------------------------------------------------------
 // Engine configuration
 // ---------------------------------------------------------------------------
@@ -200,7 +262,7 @@ fn disabled_features() -> Vec<(&'static str, Vec<&'static str>, &'static str, &'
 ///
 /// `wasm_custom_page_sizes` and `wasm_wide_arithmetic` are off by default in wasmi
 /// 1.1 (`engine/config.rs:72,74`), so their rows guard against wasmi changing that
-/// default rather than against our own config.
+/// default rather than against this engine's own config.
 #[test]
 fn every_disabled_feature_is_refused_by_name() {
     let host = FakeHost::new();
@@ -217,9 +279,9 @@ fn every_disabled_feature_is_refused_by_name() {
 }
 
 /// The three knobs [`every_disabled_feature_is_refused_by_name`] cannot cover. The
-/// engine is a process-wide `LazyLock`, so a test observes the one configuration we
-/// build: a knob masked by another, or with no caller-visible effect, has no
-/// distinguishing module.
+/// engine is a process-wide `LazyLock`, so a test observes the one configuration
+/// `build_wasm_engine` makes: a knob masked by another, or with no caller-visible
+/// effect, has no distinguishing module.
 #[test]
 fn the_knobs_without_a_module_of_their_own() {
     let host = FakeHost::new();
@@ -368,18 +430,14 @@ fn an_unused_import_is_still_linked() {
 // The start section
 // ---------------------------------------------------------------------------
 
-/// A start section runs guest code during instantiation, before the entry point
-/// is even looked up, and `set_fuel` and the memory limiter are both installed by
-/// then — so it is metered like any other guest code, and a run it stops is
-/// charged for what it burned.
-///
-/// Reported as a **trap**, not as a module that would not instantiate: a trap is the
-/// guest's fault wherever it happens, and the stage a run stopped at is not what the
-/// caller maps. Filing it under the stage would put a contract's own defect among the
-/// faults a caller treats as the node's, and charge nothing for the instructions the
-/// contract burned reaching it.
+/// The engine disallows start sections, so a module carrying one is rejected at
+/// compile and never runs. No guest code executes ahead of the entry point, whatever
+/// that code would have done — trap, loop, or call the host — so nothing is metered
+/// and no fuel is burned. Screening catches the same module up front
+/// (`preflight::a_start_section_is_refused_by_screening`); this pins that `run`
+/// refuses it the same way rather than instantiating it.
 #[test]
-fn a_trapping_start_section_is_a_guest_trap_and_is_charged() {
+fn a_start_section_module_is_rejected_at_compile() {
     let host = FakeHost::new();
 
     let wat = format!(
@@ -390,12 +448,12 @@ fn a_trapping_start_section_is_a_guest_trap_and_is_charged() {
     );
     let failure = assert_stage!(
         run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a start section that traps must not complete the run"),
-        RunError::Trap(_)
+            .expect_err("a module with a start section must not run"),
+        RunError::Compile(_)
     );
-    assert!(
-        failure.fuel_used > 0,
-        "the start section's instructions are metered: {failure}"
+    assert_eq!(
+        failure.fuel_used, 0,
+        "no guest code runs, so nothing is charged: {failure}"
     );
 }
 
@@ -424,62 +482,6 @@ fn instantiation_failure_is_a_module_the_engine_will_not_accept() {
     assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
 }
 
-/// A start section that runs out of gas is reported as out of gas, not as a module
-/// that would not instantiate. The stage a run stopped at is not what the caller
-/// maps — the reason is — and gas exhaustion is one outcome wherever the guest
-/// reaches it.
-#[test]
-fn a_start_section_that_exhausts_gas_is_out_of_gas_not_an_instantiation_failure() {
-    const GAS: u64 = 10_000;
-
-    let host = FakeHost::new();
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (loop $l (br $l)))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-
-    let failure = assert_stage!(
-        run_with_gas(&wat, GAS, &host).expect_err("an endless start section must not instantiate"),
-        RunError::OutOfGas
-    );
-    assert_eq!(
-        failure.fuel_used, GAS,
-        "a runaway start section burns the whole limit"
-    );
-}
-
-/// A start section cannot make a host call that needs guest memory, even in a
-/// module that exports one: the memory is resolved from the *instance's* exports,
-/// and instantiation is what produces the instance, so a call made while it is
-/// still running has no memory to work in and ends the run.
-///
-/// Not a choice: `Module::instantiate` is `pub(crate)` in wasmi, so instantiation
-/// cannot be split from the start section to resolve the memory in between.
-#[test]
-fn a_start_section_cannot_make_a_host_call() {
-    let host = FakeHost::new();
-
-    let wat = format!(
-        r#"(module {ldgr_index} {ONE_PAGE}
-             (func $init (drop (call $ldgr_index (i32.const 0) (i32.const 4))))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#,
-        ldgr_index = import::LDGR_INDEX
-    );
-
-    let failure = assert_stage!(
-        run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a host call from a start section must not be served"),
-        RunError::NoMemory
-    );
-    assert!(
-        failure.fuel_used > 0,
-        "the start section is metered up to the refused call: {failure}"
-    );
-}
-
 // ---------------------------------------------------------------------------
 // The entry point
 // ---------------------------------------------------------------------------
@@ -578,3 +580,21 @@ fn a_trapping_guest_fails_the_run() {
     let wat = module(&[ONE_PAGE], "(i32.load (i32.const 100000))");
     assert_stage!(failure(&wat, &host), RunError::Trap(_));
 }
+
+#[test]
+fn a_memory64_module_is_rejected_at_compile() {
+    let host = FakeHost::new();
+    let wat = r#"(module
+        (memory i64 1)
+        (func (export "finish") (result i32) (i32.const 0)))"#;
+
+    let failure = assert_stage!(
+        run_with_gas(wat, PLENTY_OF_GAS, &host)
+            .expect_err("a module using 64-bit memory must not run"),
+        RunError::Compile(_)
+    );
+    assert_eq!(
+        failure.fuel_used, 0,
+        "rejected before instantiation, so nothing is charged: {failure}"
+    );
+}

docs/build/environment.md

@@ -1,27 +1,58 @@
 Our [build instructions][BUILD.md] assume you have a C++ development
-environment complete with Git, Python, Conan, CMake, and a C++ compiler.
+environment complete with Git, Python, Conan, CMake, Rust, and a C++ compiler.
 This document explains how to set one up.
 
 [BUILD.md]: ../../BUILD.md
 
 ## Tested compiler versions
 
-`xrpld` is built in the **C++23** dialect by default.
-Make sure your toolchain is recent enough — the compiler versions currently tested in CI are:
+`xrpld` is built in the **C++23** dialect by default, so your toolchain has to
+support it — see [compiler support for C++23][cpp23-support].
+The versions currently tested in CI are:
 
-| Compiler    | Version |
-| ----------- | ------- |
-| GCC         | 15.2    |
-| Clang       | 22      |
-| Apple Clang | 17      |
-| MSVC        | 19.44   |
+| Compiler    | Version            |
+| ----------- | ------------------ |
+| GCC         | 15.2               |
+| Clang       | 22                 |
+| Apple Clang | 21                 |
+| MSVC        | Visual Studio 2026 |
 
 LLVM tools (`clang-tidy` and `clang-format`) are also pinned to version 22.
 
+### Older compilers
+
 Older compilers may fail to build the latest `develop` code: the codebase now
 relies on C++23 features and has been adjusted for `clang-tidy`.
 If the latest code doesn't build for you, update your build toolchain first.
 
+If updating isn't an option for you, we do accept pull requests that fix builds
+on older compilers, as long as the change is small and doesn't make the code
+harder to read. What we can't promise is that older compilers will keep working:
+only the versions in the table above are tested in CI, and we won't hold back
+the use of C++23 features or add invasive workarounds to keep an untested
+compiler building. Treat support for anything outside the table as best-effort.
+
+## Required tools
+
+Besides a compiler, building `xrpld` requires:
+
+| Tool                                        | Minimum version          |
+| ------------------------------------------- | ------------------------ |
+| [Git](https://git-scm.com/downloads)        | any recent               |
+| [Python](https://www.python.org/downloads/) | 3.11                     |
+| [Conan](https://conan.io/downloads.html)    | 2.17                     |
+| [CMake](https://cmake.org/download/)        | 3.16                     |
+| [Rust](https://rustup.rs)                   | 1.95 (see [Rust](#rust)) |
+
+On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
+(see below). On Windows they have to be installed manually.
+
+Once they are in place, verify that everything is installed and runnable with:
+
+```bash
+./bin/check-tools.sh
+```
+
 ## Linux and macOS
 
 The **recommended way** to get a development environment on Linux and macOS is
@@ -39,20 +70,15 @@ Clang. If you instead opt to use your system-wide Apple Clang (via
 below).
 
 See [Using the Nix development shell](./nix.md) for installation and usage
-details, including how to select a different compiler.
-
-> [!NOTE]
-> Using Nix is not mandatory. Any custom environment (Homebrew packages or
-> anything else) will continue to work, but then it is up to you to keep it in
-> sync with the environment used in CI. Nix unifies the development environment
-> for everyone and synchronizes updates, which is why we recommend it.
+details, including how to select a different compiler and why we recommend Nix
+over a hand-maintained environment.
 
 ### macOS: managing the Apple Clang version
 
 If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
 the compiler version is whatever your installed Xcode (or Command Line Tools)
 provides. The following command should return a version greater than or equal to
-the [minimum required](#tested-compiler-versions):
+the [tested one](#tested-compiler-versions):
 
 ```bash
 clang --version
@@ -89,23 +115,38 @@ building xrpld. You may want to install and pin a specific version of Xcode:
 Nix is not available on Windows, so the required tools have to be installed
 manually:
 
-- [Visual Studio 2022](https://visualstudio.microsoft.com/) with the
+- [Visual Studio 2026](https://visualstudio.microsoft.com/) with the
   **"Desktop development with C++"** workload — this provides MSVC and the
-  "x64 Native Tools Command Prompt".
+  "x64 Native Tools Command Prompt". CI configures CMake with the
+  `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
-- [Python 3.11](https://www.python.org/downloads/), or higher
-- [Conan 2.17](https://conan.io/downloads.html), or higher
-- [CMake 3.22](https://cmake.org/download/), or higher
+- Python, Conan, CMake, and Rust, at the versions listed in
+  [Required tools](#required-tools).
 
-> [!NOTE]
-> Windows is used for development only and is not recommended for production.
+## Rust
+
+The repository contains a Rust workspace in [`crates/`](../../crates), whose
+crates are exposed to C++ through [cxx](https://cxx.rs) bindings and compiled by
+the CMake build, so a Rust toolchain is required.
+
+The toolchain (`cargo`, `rustc`) is pinned to the channel in
+[`rust-toolchain.toml`](../../rust-toolchain.toml) at the repository root. If
+you install Rust with [rustup](https://rustup.rs), that file is picked up
+automatically, and `cargo`/`rustc` in the repository will use the pinned
+version.
+
+Everything else the Rust build needs on the CMake side comes from Conan along
+with the rest of the dependencies, so there is nothing further to install.
 
 ## Clang-tidy
 
 `clang-tidy` is required to run static analysis checks locally (see
 [CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
-project. This project currently uses `clang-tidy` version 22.
+project. The version this project uses is listed in
+[Tested compiler versions](#tested-compiler-versions).
 
-On Linux and macOS, the [Nix development shell](./nix.md) provides `clang-tidy`
-22 out of the box — run it via `run-clang-tidy`. No separate installation is
-needed.
+On Linux and macOS, the [Nix development shell](./nix.md) provides that exact
+version out of the box — run it via `run-clang-tidy`. No separate installation
+is needed.
+
+[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23

docs/build/nix.md

@@ -7,7 +7,7 @@ This guide explains how to use Nix to set up a reproducible development environm
 ## Benefits of Using Nix
 
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
-- **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment
+- **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment, and CI builds some macOS configurations in it as well
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
 - **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
@@ -68,7 +68,7 @@ A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix d
 
 On Linux, `.#gcc` and `.#clang` provide the exact toolchain CI uses:
 the compiler (pinned in [`nix/packages.nix`](../../nix/packages.nix))
-rebuilt against the pinned custom glibc (see [`nix/compilers.nix`](../../nix/compilers.nix)).
+rebuilt against the pinned custom glibc (see [`nix/linux.nix`](../../nix/linux.nix)).
 Building that toolchain the first time is slow unless it is fetched from a Nix binary cache.
 If you don't need the custom glibc, the Linux-only `.#gcc-plain` and `.#clang-plain`
 give you the stock nixpkgs compilers of the same versions.
@@ -120,7 +120,7 @@ nix develop -c "$SHELL"
 >
 > If it doesn't, either adjust your shell configuration so it doesn't override `$PATH`, or use [direnv](#automatic-activation-with-direnv) (below), which loads the environment _after_ your shell config and so takes precedence regardless of the shell you use.
 
-## Building xrpld with Nix
+## Building xrpld in the Nix shell
 
 Once inside the Nix development shell, follow the standard [build instructions](../../BUILD.md#steps). The Nix shell provides all necessary tools (CMake, Ninja, Conan, etc.).
 
@@ -128,6 +128,99 @@ Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Li
 each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
 The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.
 
+The Rust toolchain the build needs is included too: every shell provides the
+channel pinned in [`rust-toolchain.toml`](../../rust-toolchain.toml) (see
+[Rust](./environment.md#rust)), plus the `cargo-audit`, `cargo-llvm-cov` and
+`cargo-nextest` plugins.
+
+## Conan configuration
+
+The shell runs [`conan/init.sh`](../../conan/init.sh) on entry, so
+[Set Up Conan](../../BUILD.md#set-up-conan) is already done for you. It installs
+into the shell's own Conan home: `CONAN_HOME=~/.conan2-nix`.
+
+### Prebuilt packages
+
+On **Linux**, the binaries on the `xrplf` remote are built in this same Nix
+environment — CI runs in Docker images that bundle the dev shell's toolchain (see
+[`nix/docker`](../../nix/docker)) — so `.#gcc` and `.#clang` can reuse them. The
+`-plain` shells do not match that toolchain's glibc, so binaries from the remote
+are not a reliable match there.
+
+On **macOS**, CI also builds in this Nix environment, in Debug and Release (the
+`macos-arm64-*-nix` configurations — Debug because the profile defaults to it).
+The Nix build resolves to `compiler=clang`, so it gets its own package IDs,
+separate from the Apple Clang ones. The
+[dependency upload](../../.github/workflows/upload-conan-deps.yml) publishes them
+on pushes to `develop` and on manual runs — its nightly run rebuilds everything
+from source but uploads nothing — so once a set has been published `nix develop`
+can reuse it instead of compiling every dependency locally. These configurations
+run outside the reduced pull-request matrix, so label a PR `Full CI build` when it
+touches `flake.lock` or `nix/`.
+
+To compile everything from source, add `--build '*'` to the `conan install`
+command.
+
+### Why the nixpkgs revision is not part of the package ID
+
+A Conan package ID records the compiler and its major version, but nothing about
+the nixpkgs revision the toolchain came from — and `flake.lock` moves far more
+often than the toolchain meaningfully changes, so folding it in would rebuild
+every dependency on every bump for nothing.
+
+That is safe as long as no cached artifact resolves a `/nix/store` path at run
+time, because store paths change on every update and the old ones disappear with
+`nix-collect-garbage`. With the `clang` toolchain macOS CI and the dev shell use,
+they do not: it links against `/usr/lib/libc++` and `/usr/lib/libSystem`, and
+store paths reach the `.a` files only through debug info, which nothing resolves
+at link or run time.
+
+> [!WARNING]
+> This does not hold for `nix develop .#gcc` on macOS. There is no system
+> libstdc++, so GCC links its own from the store and every binary keeps a
+> `/nix/store` reference. That shell is fine for tooling, but it is not a build
+> configuration CI covers, and no dependency binaries are published for it.
+
+This is checked rather than assumed.
+[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) takes one file
+or directory and fails if a binary under it resolves a store path at run time.
+CI runs it over the build output and the Conan cache, and again in the upload job
+before anything is published. You can run it yourself:
+
+```bash
+bin/check-nix-store-refs.sh build
+bin/check-nix-store-refs.sh ~/.conan2-nix
+```
+
+It works on Linux too, but asserts something narrower there: the toolchain always
+writes the store into `PT_INTERP` and `RUNPATH`, and CI builds inside an image
+whose store is fixed for its lifetime, so that is fine. Only the binaries
+[`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake) retargets to the
+system loader have to be clean, and those are what CI checks:
+
+```bash
+bin/check-nix-store-refs.sh build/xrpld
+```
+
+### The libresolv stub
+
+This is not hypothetical: `xrpld` used to be caught by it. The c-ares package
+tells the linker to pass `-lresolv`, and nixpkgs keeps `libresolv` out of the
+macOS SDK and ships it as an ordinary store dylib — so every Nix-built `xrpld`
+recorded a `/nix/store/…-libresolv-93/lib/libresolv.9.dylib` load command and
+stopped running once that path was collected. Nothing in the link uses a single
+symbol from it.
+
+Both environments now put a stub on the linker search path
+(`libresolvSystemStub` in [`nix/darwin.nix`](../../nix/darwin.nix)): the
+same library with its install name set to `/usr/lib/libresolv.9.dylib`, which is
+exactly the load command the Apple Clang build records.
+
+Package IDs did not change, so Conan keeps serving anything built before the
+stub landed. If a binary fails to start with `Library not loaded: /nix/store/…`,
+see [that entry](./nix_troubleshooting.md#library-not-loaded-nixstore-from-a-binary-that-used-to-work)
+in the troubleshooting guide.
+
 ## Automatic Activation with direnv
 
 [direnv](https://direnv.net/) or [nix-direnv](https://github.com/nix-community/nix-direnv) can automatically activate the Nix development shell when you enter the repository directory.
@@ -142,14 +235,6 @@ The repository already ships an `.envrc` at its root that activates the Nix flak
 > [!NOTE]
 > direnv only caches the `.direnv` directory (already listed in `.gitignore`); no other repository files are affected.
 
-## Conan and Prebuilt Packages
-
-Please note that there is no guarantee that binaries from conan cache will work when using nix. If you encounter any errors, please use `--build '*'` to force conan to compile everything from source:
-
-```bash
-conan install .. --output-folder . --build '*' --settings build_type=Release
-```
-
 ## Updating `flake.lock` file
 
 To update `flake.lock` to the latest revision use `nix flake update` command.

docs/build/nix_troubleshooting.md

@@ -131,3 +131,91 @@ once it picks up that rebuild, then re-run the `grep libgit2` check above to
 confirm it reports `1.9.4` or newer.
 
 Until then, prefer the workarounds above.
+
+## `wint_t` / `uint32_t` errors from the Nix libc++ headers
+
+A build that mixes the Nix toolchain with the system SDK fails in libc++ itself,
+with errors that look nothing like your code:
+
+```
+/nix/store/...-libcxx-.../include/c++/v1/cwchar:136:9: error: target of using declaration conflicts with declaration already in scope
+  136 | using ::wint_t _LIBCPP_USING_IF_EXISTS;
+/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/_types/_wint_t.h:32:25: note: target of using declaration
+...
+error: use of undeclared identifier 'UINT32_C'
+```
+
+The give-away is the second path: Nix's libc++ headers are being combined with
+the **Xcode Command Line Tools** SDK instead of the Nix one.
+
+### Why it happens
+
+`SDKROOT` and `DEVELOPER_DIR` are what point the toolchain at the Nix SDK, and
+they are not baked into the compiler — a dev shell gets them from the
+`apple-sdk` setup hook. CMake, finding neither, asks `xcrun`, which answers with
+the system SDK. Nix's `libc++` and Apple's headers then declare the same types
+twice.
+
+### Fix
+
+Run the build from inside the dev shell (`nix develop`), or from an environment
+that exports both variables. To confirm which SDK a configured build is using:
+
+```bash
+grep -o '\-isysroot [^ ]*' build/compile_commands.json | sort -u
+```
+
+It should print a `/nix/store/...-apple-sdk-*` path. If it prints
+`/Library/Developer/CommandLineTools/...`, re-configure from within the shell —
+CMake caches the sysroot, so an existing `build/` directory keeps the wrong one.
+
+## `Library not loaded: /nix/store/…` from a binary that used to work
+
+A binary stops starting after a `nix flake update`, or after
+`nix-collect-garbage` removes the paths the previous toolchain used:
+
+```
+dyld[57271]: Library not loaded: /nix/store/…-libresolv-93/lib/libresolv.9.dylib
+```
+
+[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) finds the same
+thing without having to run anything, and names the file:
+
+```
+$ bin/check-nix-store-refs.sh ~/.conan2-nix
+::error file=/Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig::references the Nix store at run time
+/Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig
+    /nix/store/p4lp3xq4imd1qzqh08x8vcq2zfhi7rca-libresolv-93/lib/libresolv.9.dylib
+/Users/you/.conan2-nix: checked 135, skipped 2495, 1 with Nix store references.
+```
+
+Conan's cache folders are named after a truncated package name plus a hash, so
+ask Conan which package the offending one belongs to — pass the folder holding
+the hash, not the file itself:
+
+```
+$ conan cache ref ~/.conan2-nix/p/b/c-area24ded30c388c
+c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650:dab5992496abe6d219defb7986ecbf367615a5e5#…
+```
+
+### Why it happens
+
+The binary records a store path that no longer exists. Nothing we build should:
+see [Prebuilt packages](./nix.md#prebuilt-packages) for why, and
+`libresolvSystemStub` in [`nix/darwin.nix`](../../nix/darwin.nix) for the one
+dependency that needed help to comply.
+
+A Conan package ID does not encode the nixpkgs revision, so a package built
+before that stub existed stays in your local cache and keeps being reused. The
+dev shell is also what tends to produce one: it is a slightly _less_ isolated
+build environment than CI's, because `mkShell` puts every tool's headers and
+libraries on the compiler's search path — which is how c-ares found the Nix
+`libresolv` in the first place.
+
+### Fix
+
+Drop that package and let Conan refetch or rebuild it:
+
+```bash
+conan remove 'c-ares/*'
+```

docs/install-legacy.md

@@ -1,3 +1,10 @@
+# Installing xrpld 3.3.0 and earlier
+
+> [!IMPORTANT]
+> These instructions apply to xrpld 3.3.0 and earlier, published to
+> repos.ripple.com.
+> For later releases see [install.md](./install.md).
+
 This document contains instructions for installing xrpld.
 The APT package manager is common on Debian-based Linux distributions like
 Ubuntu,
@@ -52,7 +59,7 @@ The default [prefix][1] is typically `/usr/local` on Linux and macOS and
 
 5.  Add the appropriate XRPL repository for your operating system version:
 
-        echo "deb [signed-by=/usr/local/share/keyrings/ripple-key.gpg] https://repos.ripple.com/repos/xrpld-deb focal stable" | \
+        echo "deb [signed-by=/usr/local/share/keyrings/ripple-key.gpg] https://repos.ripple.com/repos/rippled-deb focal stable" | \
             sudo tee -a /etc/apt/sources.list.d/ripple.list
 
     The above example is appropriate for **Ubuntu 20.04 Focal Fossa**. For other operating systems, replace the word `focal` with one of the following:
@@ -106,8 +113,8 @@ The default [prefix][1] is typically `/usr/local` on Linux and macOS and
         enabled=1
         gpgcheck=0
         repo_gpgcheck=1
-        baseurl=https://repos.ripple.com/repos/xrpld-rpm/stable/
-        gpgkey=https://repos.ripple.com/repos/xrpld-rpm/stable/repodata/repomd.xml.key
+        baseurl=https://repos.ripple.com/repos/rippled-rpm/stable/
+        gpgkey=https://repos.ripple.com/repos/rippled-rpm/stable/repodata/repomd.xml.key
         REPOFILE
 
     _Unstable_
@@ -118,8 +125,8 @@ The default [prefix][1] is typically `/usr/local` on Linux and macOS and
         enabled=1
         gpgcheck=0
         repo_gpgcheck=1
-        baseurl=https://repos.ripple.com/repos/xrpld-rpm/unstable/
-        gpgkey=https://repos.ripple.com/repos/xrpld-rpm/unstable/repodata/repomd.xml.key
+        baseurl=https://repos.ripple.com/repos/rippled-rpm/unstable/
+        gpgkey=https://repos.ripple.com/repos/rippled-rpm/unstable/repodata/repomd.xml.key
         REPOFILE
 
     _Nightly_
@@ -130,8 +137,8 @@ The default [prefix][1] is typically `/usr/local` on Linux and macOS and
         enabled=1
         gpgcheck=0
         repo_gpgcheck=1
-        baseurl=https://repos.ripple.com/repos/xrpld-rpm/nightly/
-        gpgkey=https://repos.ripple.com/repos/xrpld-rpm/nightly/repodata/repomd.xml.key
+        baseurl=https://repos.ripple.com/repos/rippled-rpm/nightly/
+        gpgkey=https://repos.ripple.com/repos/rippled-rpm/nightly/repodata/repomd.xml.key
         REPOFILE
 
 2.  Fetch the latest repo updates:

docs/install.md

@@ -0,0 +1,144 @@
+# Installing xrpld
+
+> [!NOTE]
+> These instructions apply to packages published from 2026-08-19 onwards.
+> For xrpld 3.3.0 and earlier see [install-legacy.md](./install-legacy.md).
+
+`xrpld` is published as DEB and RPM packages for 64-bit x86 Linux.
+Use APT on Debian-based distributions such as Debian and Ubuntu,
+and YUM on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux.
+To build from source instead, see [BUILD.md](../BUILD.md).
+
+## Release channels
+
+Packages are published to four channels:
+
+- `stable` - the latest production release
+- `unstable` - release candidates
+- `experimental` - beta builds
+- `develop` - every push to the [`develop` branch](https://github.com/XRPLF/rippled/tree/develop)
+
+See [Publishing packages](../package/README.md#publishing-packages) for how channels are produced.
+
+The instructions below use `stable`.
+To follow another channel, replace `stable` with its name
+wherever it appears in the repository configuration.
+
+> [!WARNING]
+> Channels other than `stable` may be broken at any time.
+> Do not use them for production servers.
+
+## Install the xrpld package
+
+### With the APT package manager
+
+1.  Install utilities:
+
+    ```bash
+    sudo apt update -y
+    sudo apt install -y apt-transport-https ca-certificates curl gnupg
+    ```
+
+2.  Add the XRPL Foundation package-signing key to your list of trusted keys:
+
+    ```bash
+    sudo install -d -m 0755 /etc/apt/keyrings
+    sudo curl -fsS https://packages.xrplf.org/xrplf.asc -o /etc/apt/keyrings/xrplf.asc
+    ```
+
+3.  Check the fingerprint of the newly-added key:
+
+    ```bash
+    gpg --show-keys /etc/apt/keyrings/xrplf.asc
+    ```
+
+    The output should be:
+
+    ```text
+    pub   rsa4096 2026-08-18 [SC]
+          B655416741221F780FBCFBC9AA84D41A11D29FA9
+    uid                      XRPLF Packages <distribution@xrplf.org>
+    ```
+
+    In particular, make sure that the fingerprint matches.
+
+4.  Add the repository, using the channel you picked in [Release channels](#release-channels):
+
+    ```bash
+    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \
+        sudo tee /etc/apt/sources.list.d/xrplf.list
+    ```
+
+5.  Fetch the repository:
+
+    ```bash
+    sudo apt -y update
+    ```
+
+6.  Install the `xrpld` software package:
+
+    ```bash
+    sudo apt -y install xrpld
+    ```
+
+### With the YUM package manager
+
+1.  Add the XRPL Foundation package-signing key:
+
+    ```bash
+    sudo rpm --import https://packages.xrplf.org/xrplf.asc
+    ```
+
+2.  Add the repository, using the channel you picked in [Release channels](#release-channels):
+
+    ```bash
+    cat << REPOFILE | sudo tee /etc/yum.repos.d/xrplf.repo
+    [xrplf-stable]
+    name=XRP Ledger Packages
+    enabled=1
+    baseurl=https://packages.xrplf.org/repository/rpm-stable/
+    gpgcheck=1
+    repo_gpgcheck=1
+    gpgkey=https://packages.xrplf.org/xrplf.asc
+    REPOFILE
+    ```
+
+    `gpgcheck=1` verifies each package against the key above.
+    `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key.
+
+3.  Install the `xrpld` package:
+
+    ```bash
+    sudo yum install -y xrpld
+    ```
+
+## The xrpld service
+
+Both package managers install a systemd unit and enable it, so `xrpld` starts on boot.
+Check whether it is already running:
+
+```bash
+systemctl status xrpld.service
+```
+
+The APT packages start it immediately as well; the YUM packages do not, so start it yourself:
+
+```bash
+sudo systemctl start xrpld.service
+```
+
+### Optional: binding to privileged ports
+
+To serve incoming API requests on port 80 or 443, grant the service the capability to bind them.
+You must also update the config file's port settings.
+
+```bash
+sudo install -d -m 0755 /etc/systemd/system/xrpld.service.d
+sudo tee /etc/systemd/system/xrpld.service.d/privileged-ports.conf >/dev/null <<'EOF'
+[Service]
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+EOF
+sudo systemctl daemon-reload
+sudo systemctl restart xrpld.service
+```

docs/sample_chart.doc

@@ -1,24 +0,0 @@
-/*!
-    \page somestatechart Example state diagram
-
-    \startuml SomeState "my state diagram"
-    scale 600 width
-
-    [*] -> State1
-    State1 --> State2 : Succeeded
-    State1 --> [*] : Aborted
-    State2 --> State3 : Succeeded
-    State2 --> [*] : Aborted
-    state State3 {
-      state "Accumulate Enough Data\nLong State Name" as long1
-      long1 : Just a test
-      [*] --> long1
-      long1 --> long1 : New Data
-      long1 --> ProcessData : Enough Data
-    }
-    State3 --> State3 : Failed
-    State3 --> [*] : Succeeded / Save Result
-    State3 --> [*] : Aborted
-
-    \enduml
-*/

include/xrpl/basics/Archive.h

@@ -1,6 +1,6 @@
 #pragma once
 
-#include <boost/filesystem.hpp>
+#include <filesystem>
 
 namespace xrpl {
 
@@ -13,6 +13,6 @@ namespace xrpl {
  * @throws runtime_error
  */
 void
-extractTarLz4(boost::filesystem::path const& src, boost::filesystem::path const& dst);
+extractTarLz4(std::filesystem::path const& src, std::filesystem::path const& dst);
 
 }  // namespace xrpl

include/xrpl/basics/Buffer.h

@@ -3,6 +3,7 @@
 #include <xrpl/basics/Slice.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
+#include <algorithm>
 #include <cstdint>
 #include <cstring>
 #include <memory>
@@ -156,6 +157,19 @@ public:
     }
     /** @} */
 
+    /**
+     * Set every byte in the buffer to the given value.
+     *
+     * The size is unchanged, and this is a no-op on an empty buffer.
+     *
+     * @param value the byte to write to every position.
+     */
+    void
+    fill(std::uint8_t value) noexcept
+    {
+        std::fill_n(p_.get(), size_, value);
+    }
+
     /**
      * Reset the buffer.
      * All memory is deallocated. The resulting size is 0.
@@ -226,10 +240,4 @@ operator==(Buffer const& lhs, Buffer const& rhs) noexcept
     return std::memcmp(lhs.data(), rhs.data(), lhs.size()) == 0;
 }
 
-inline bool
-operator!=(Buffer const& lhs, Buffer const& rhs) noexcept
-{
-    return !(lhs == rhs);
-}
-
 }  // namespace xrpl

include/xrpl/basics/FileUtilities.h

@@ -1,24 +1,79 @@
 #pragma once
 
-#include <boost/filesystem.hpp>
-#include <boost/system/error_code.hpp>
-
 #include <cstddef>
+#include <filesystem>
 #include <optional>
 #include <string>
+#include <system_error>
 
 namespace xrpl {
 
 std::string
 getFileContents(
-    boost::system::error_code& ec,
-    boost::filesystem::path const& sourcePath,
+    std::error_code& ec,
+    std::filesystem::path const& sourcePath,
     std::optional<std::size_t> maxSize = std::nullopt);
 
 void
 writeFileContents(
-    boost::system::error_code& ec,
-    boost::filesystem::path const& destPath,
+    std::error_code& ec,
+    std::filesystem::path const& destPath,
     std::string const& contents);
 
+/**
+ * Generate a unique, non-existing path under @p base whose filename starts with
+ * @p prefix and ends with a random hex suffix.
+ *
+ * Attempts up to @p maxAttempts paths. Throws `std::runtime_error` if a unique
+ * path cannot be found or if the filesystem returns an error while checking for
+ * existence.
+ */
+std::filesystem::path
+uniqueRandomPath(
+    std::filesystem::path const& base,
+    std::string const& prefix = "",
+    std::size_t maxAttempts = 100);
+
+/**
+ * RAII temporary directory.
+ *
+ * The directory and all its contents are deleted when
+ * the instance of `TempDir` is destroyed.
+ */
+class TempDir
+{
+    std::filesystem::path path_;
+
+public:
+#if !GENERATING_DOCS
+    TempDir(TempDir const&) = delete;
+    TempDir&
+    operator=(TempDir const&) = delete;
+#endif
+
+    /**
+     * Construct a temporary directory.
+     */
+    TempDir();
+
+    /**
+     * Destroy a temporary directory.
+     */
+    ~TempDir();
+
+    /**
+     * Get the native path for the temporary directory.
+     */
+    [[nodiscard]] std::string
+    path() const;
+
+    /**
+     * Get the native path for a file.
+     *
+     * The file does not need to exist.
+     */
+    [[nodiscard]] std::string
+    file(std::string const& name) const;
+};
+
 }  // namespace xrpl

include/xrpl/basics/IntrusivePointer.h

@@ -96,9 +96,6 @@ public:
     SharedIntrusive&
     operator=(SharedIntrusive const& rhs);
 
-    bool
-    operator!=(std::nullptr_t) const;
-
     bool
     operator==(std::nullptr_t) const;
 

include/xrpl/basics/IntrusivePointer.ipp

@@ -111,13 +111,6 @@ SharedIntrusive<T>::operator=(SharedIntrusive<TT>&& rhs)
     return *this;
 }
 
-template <class T>
-bool
-SharedIntrusive<T>::operator!=(std::nullptr_t) const
-{
-    return this->get() != nullptr;
-}
-
 template <class T>
 bool
 SharedIntrusive<T>::operator==(std::nullptr_t) const

include/xrpl/basics/Log.h

@@ -3,8 +3,8 @@
 #include <xrpl/beast/utility/Journal.h>
 
 #include <boost/beast/core/string.hpp>
-#include <boost/filesystem.hpp>
 
+#include <filesystem>
 #include <fstream>
 #include <map>
 #include <memory>
@@ -84,7 +84,7 @@ private:
          * @return `true` if the file was opened.
          */
         bool
-        open(boost::filesystem::path const& path);
+        open(std::filesystem::path const& path);
 
         /**
          * Close and re-open the system file associated with the log
@@ -133,7 +133,7 @@ private:
 
     private:
         std::unique_ptr<std::ofstream> stream_;
-        boost::filesystem::path path_;
+        std::filesystem::path path_;
     };
 
     std::mutex mutable mutex_;
@@ -152,7 +152,7 @@ public:
     virtual ~Logs() = default;
 
     bool
-    open(boost::filesystem::path const& pathToLogFile);
+    open(std::filesystem::path const& pathToLogFile);
 
     beast::Journal::Sink&
     get(std::string const& name);

include/xrpl/basics/Number.h

@@ -304,7 +304,7 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  *      on-ledger are non-negative. This is due to implementation details of
  *      several operations which use unsigned arithmetic internally. This is
  *      sufficient to represent all valid XRP values (where the absolute value
- *      can not exceed INITIAL_XRP: 10^17), and MPT values (where the absolute
+ *      can not exceed kInitialXRP: 10^17), and MPT values (where the absolute
  *      value can not exceed maxMPTokenAmount: 2^63-1).
  *
  * ---- Mantissa Range Switching ----
@@ -449,12 +449,6 @@ public:
             x.exponent_ == y.exponent_;
     }
 
-    friend constexpr bool
-    operator!=(Number const& x, Number const& y) noexcept
-    {
-        return !(x == y);
-    }
-
     friend constexpr bool
     operator<(Number const& l, Number const& r) noexcept
     {

include/xrpl/basics/SHAMapHash.h

@@ -85,12 +85,6 @@ public:
     }
 };
 
-inline bool
-operator!=(SHAMapHash const& x, SHAMapHash const& y)
-{
-    return !(x == y);
-}
-
 template <>
 inline std::size_t
 extract(SHAMapHash const& key)

include/xrpl/basics/Slice.h

@@ -208,12 +208,6 @@ operator==(Slice const& lhs, Slice const& rhs) noexcept
     return std::memcmp(lhs.data(), rhs.data(), lhs.size()) == 0;
 }
 
-inline bool
-operator!=(Slice const& lhs, Slice const& rhs) noexcept
-{
-    return !(lhs == rhs);
-}
-
 inline bool
 operator<(Slice const& lhs, Slice const& rhs) noexcept
 {

include/xrpl/basics/StringUtilities.h

@@ -2,7 +2,6 @@
 
 #include <xrpl/basics/Blob.h>
 
-#include <boost/format.hpp>
 #include <boost/utility/string_view.hpp>
 
 #include <array>
@@ -125,9 +124,31 @@ struct ParsedUrl
 bool
 parseUrl(ParsedUrl& pUrl, std::string const& strUrl);
 
+/**
+ * Remove leading and trailing ASCII whitespace.
+ *
+ * Whitespace is the fixed set " \t\n\v\f\r"; the current locale is not
+ * consulted, so the result depends only on the input.
+ *
+ * @param str The string to trim.
+ * @return @p str without leading or trailing whitespace.
+ */
 std::string
 trimWhitespace(std::string str);
 
+/**
+ * Fold ASCII upper case letters to lower case.
+ *
+ * Only 'A' through 'Z' are remapped; every other byte is left alone and the
+ * current locale is not consulted, so the result depends only on the input.
+ *
+ * @param str The string to fold.
+ * @return @p str with each ASCII upper case letter replaced by its lower case
+ *         equivalent.
+ */
+std::string
+toLower(std::string str);
+
 std::optional<std::uint64_t>
 toUInt64(std::string const& s);
 

include/xrpl/basics/partitioned_unordered_map.h

@@ -116,12 +116,6 @@ public:
         {
             return lhs.map == rhs.map && lhs.ait == rhs.ait && lhs.mit == rhs.mit;
         }
-
-        friend bool
-        operator!=(Iterator const& lhs, Iterator const& rhs)
-        {
-            return !(lhs == rhs);
-        }
     };
 
     struct ConstIterator
@@ -189,12 +183,6 @@ public:
         {
             return lhs.map == rhs.map && lhs.ait == rhs.ait && lhs.mit == rhs.mit;
         }
-
-        friend bool
-        operator!=(ConstIterator const& lhs, ConstIterator const& rhs)
-        {
-            return !(lhs == rhs);
-        }
     };
 
 private:

include/xrpl/beast/container/detail/aged_ordered_container.h

@@ -1038,25 +1038,6 @@ public:
                Compare,
                OtherAllocator> const& other) const;
 
-    template <
-        bool OtherIsMulti,
-        bool OtherIsMap,
-        class OtherT,
-        class OtherDuration,
-        class OtherAllocator>
-    bool
-    operator!=(AgedOrderedContainer<
-               OtherIsMulti,
-               OtherIsMap,
-               Key,
-               OtherT,
-               OtherDuration,
-               Compare,
-               OtherAllocator> const& other) const
-    {
-        return !(this->operator==(other));
-    }
-
     template <
         bool OtherIsMulti,
         bool OtherIsMap,

include/xrpl/beast/container/detail/aged_unordered_container.h

@@ -1340,28 +1340,6 @@ public:
                OtherAllocator> const& other) const
         requires MaybeMulti;
 
-    template <
-        bool OtherIsMulti,
-        bool OtherIsMap,
-        class OtherKey,
-        class OtherT,
-        class OtherDuration,
-        class OtherHash,
-        class OtherAllocator>
-    bool
-    operator!=(AgedUnorderedContainer<
-               OtherIsMulti,
-               OtherIsMap,
-               OtherKey,
-               OtherT,
-               OtherDuration,
-               OtherHash,
-               KeyEqual,
-               OtherAllocator> const& other) const
-    {
-        return !(this->operator==(other));
-    }
-
 private:
     bool
     wouldExceed(size_type additional) const

include/xrpl/beast/core/List.h

@@ -82,13 +82,6 @@ public:
         return node_ == other.node_;
     }
 
-    template <typename M>
-    bool
-    operator!=(ListIterator<M> const& other) const noexcept
-    {
-        return !((*this) == other);
-    }
-
     reference
     operator*() const noexcept
     {

include/xrpl/beast/net/IPEndpoint.h

@@ -110,12 +110,6 @@ public:
     operator==(Endpoint const& lhs, Endpoint const& rhs);
     friend bool
     operator<(Endpoint const& lhs, Endpoint const& rhs);
-
-    friend bool
-    operator!=(Endpoint const& lhs, Endpoint const& rhs)
-    {
-        return !(lhs == rhs);
-    }
     friend bool
     operator>(Endpoint const& lhs, Endpoint const& rhs)
     {

include/xrpl/beast/rfc2616.h

@@ -11,6 +11,7 @@
 #include <cstddef>
 #include <iterator>
 #include <string>
+#include <string_view>
 #include <vector>
 
 namespace beast::rfc2616 {
@@ -186,7 +187,7 @@ splitCommas(FwdIt first, FwdIt last)
 
 template <class Result = std::vector<std::string>>
 Result
-splitCommas(boost::beast::string_view const& s)
+splitCommas(std::string_view s)
 {
     return splitCommas(s.begin(), s.end());
 }
@@ -229,12 +230,6 @@ public:
         return other.it_ == it_ && other.end_ == end_ && other.value_.size() == value_.size();
     }
 
-    bool
-    operator!=(ListIterator const& other) const
-    {
-        return !(*this == other);
-    }
-
     reference
     operator*() const
     {

include/xrpl/beast/unit_test/reporter.h

@@ -8,7 +8,6 @@
 #include <xrpl/beast/unit_test/runner.h>
 #include <xrpl/beast/unit_test/suite_info.h>
 
-#include <boost/lexical_cast.hpp>
 #include <boost/optional.hpp>
 
 #include <algorithm>
@@ -188,7 +187,7 @@ Reporter<Unused>::fmtdur(clock_type::duration const& d)
     using namespace std::chrono;
     auto const ms = duration_cast<milliseconds>(d);
     if (ms < seconds{1})
-        return boost::lexical_cast<std::string>(ms.count()) + "ms";
+        return std::to_string(ms.count()) + "ms";
     std::stringstream ss;
     ss << std::fixed << std::setprecision(1) << (ms.count() / 1000.) << "s";
     return ss.str();

include/xrpl/beast/unit_test/suite.h

@@ -6,11 +6,10 @@
 
 #include <xrpl/beast/unit_test/runner.h>
 
-#include <boost/filesystem.hpp>
-#include <boost/lexical_cast.hpp>
 #include <boost/throw_exception.hpp>
 
 #include <exception>
+#include <filesystem>
 #include <memory>
 #include <ostream>
 #include <sstream>
@@ -27,10 +26,10 @@ makeReason(String const& reason, char const* file, int line)
     std::string s(reason);
     if (!s.empty())
         s.append(": ");
-    namespace fs = boost::filesystem;
+    namespace fs = std::filesystem;
     s.append(fs::path{file}.filename().string());
     s.append("(");
-    s.append(boost::lexical_cast<std::string>(line));
+    s.append(std::to_string(line));
     s.append(")");
     return s;
 }

include/xrpl/beast/utility/temp_dir.h

@@ -1,71 +0,0 @@
-#pragma once
-
-#include <boost/filesystem.hpp>
-
-#include <string>
-
-namespace beast {
-
-/**
- * RAII temporary directory.
- *
- * The directory and all its contents are deleted when
- * the instance of `temp_dir` is destroyed.
- */
-class TempDir
-{
-    boost::filesystem::path path_;
-
-public:
-#if !GENERATING_DOCS
-    TempDir(TempDir const&) = delete;
-    TempDir&
-    operator=(TempDir const&) = delete;
-#endif
-
-    /**
-     * Construct a temporary directory.
-     */
-    TempDir()
-    {
-        auto const dir = boost::filesystem::temp_directory_path();
-        do
-        {
-            path_ = dir / boost::filesystem::unique_path();
-        } while (boost::filesystem::exists(path_));
-        boost::filesystem::create_directory(path_);
-    }
-
-    /**
-     * Destroy a temporary directory.
-     */
-    ~TempDir()
-    {
-        // use non-throwing calls in the destructor
-        boost::system::error_code ec;
-        boost::filesystem::remove_all(path_, ec);
-        // TODO: warn/notify if ec set ?
-    }
-
-    /**
-     * Get the native path for the temporary directory
-     */
-    [[nodiscard]] std::string
-    path() const
-    {
-        return path_.string();
-    }
-
-    /**
-     * Get the native path for the a file.
-     *
-     * The file does not need to exist.
-     */
-    [[nodiscard]] std::string
-    file(std::string const& name) const
-    {
-        return (path_ / name).string();
-    }
-};
-
-}  // namespace beast

include/xrpl/conditions/Condition.h

@@ -92,10 +92,4 @@ operator==(Condition const& lhs, Condition const& rhs)
         lhs.fingerprint == rhs.fingerprint;
 }
 
-inline bool
-operator!=(Condition const& lhs, Condition const& rhs)
-{
-    return !(lhs == rhs);
-}
-
 }  // namespace xrpl::cryptoconditions

include/xrpl/conditions/Fulfillment.h

@@ -93,12 +93,6 @@ operator==(Fulfillment const& lhs, Fulfillment const& rhs)
         lhs.fingerprint() == rhs.fingerprint();
 }
 
-inline bool
-operator!=(Fulfillment const& lhs, Fulfillment const& rhs)
-{
-    return !(lhs == rhs);
-}
-
 /**
  * Determine whether the given fulfillment and condition match
  */

include/xrpl/config/BasicConfig.h

@@ -2,7 +2,6 @@
 
 #include <xrpl/basics/contract.h>
 
-#include <boost/beast/core/string.hpp>
 #include <boost/lexical_cast.hpp>
 
 #include <algorithm>

include/xrpl/core/PerfLog.h

@@ -4,10 +4,9 @@
 #include <xrpl/core/Job.h>
 #include <xrpl/json/json_value.h>
 
-#include <boost/filesystem.hpp>
-
 #include <chrono>
 #include <cstdint>
+#include <filesystem>
 #include <functional>
 #include <memory>
 #include <string>
@@ -44,7 +43,7 @@ public:
      */
     struct Setup
     {
-        boost::filesystem::path perfLog;
+        std::filesystem::path perfLog;
         // log_interval is in milliseconds to support faster testing.
         milliseconds logInterval{seconds(1)};
     };
@@ -149,7 +148,7 @@ public:
 };
 
 PerfLog::Setup
-setupPerfLog(Section const& section, boost::filesystem::path const& configDir);
+setupPerfLog(Section const& section, std::filesystem::path const& configDir);
 
 std::unique_ptr<PerfLog>
 makePerfLog(

include/xrpl/json/Output.h

@@ -1,20 +1,19 @@
 #pragma once
 
-#include <boost/beast/core/string.hpp>
-
 #include <functional>
 #include <string>
+#include <string_view>
 
 namespace json {
 
 class Value;
 
-using Output = std::function<void(boost::beast::string_view const&)>;
+using Output = std::function<void(std::string_view)>;
 
 inline Output
 stringOutput(std::string& s)
 {
-    return [&](boost::beast::string_view const& b) { s.append(b.data(), b.size()); };
+    return [&](std::string_view b) { s.append(b.data(), b.size()); };
 }
 
 /**

include/xrpl/json/json_value.h

@@ -4,6 +4,7 @@
 #include <xrpl/json/json_forwards.h>
 
 #include <cstring>
+#include <iterator>
 #include <limits>
 #include <map>
 #include <string>
@@ -72,36 +73,18 @@ operator==(StaticString x, StaticString y)
     return strcmp(x.cStr(), y.cStr()) == 0;
 }
 
-inline bool
-operator!=(StaticString x, StaticString y)
-{
-    return !(x == y);
-}
-
 inline bool
 operator==(std::string const& x, StaticString y)
 {
     return strcmp(x.c_str(), y.cStr()) == 0;
 }
 
-inline bool
-operator!=(std::string const& x, StaticString y)
-{
-    return !(x == y);
-}
-
 inline bool
 operator==(StaticString x, std::string const& y)
 {
     return y == x;
 }
 
-inline bool
-operator!=(StaticString x, std::string const& y)
-{
-    return !(y == x);
-}
-
 /**
  * @brief Represents a <a HREF="http://www.json.org">JSON</a> value.
  *
@@ -489,12 +472,6 @@ toJson(xrpl::Number const& number)
 bool
 operator==(Value const&, Value const&);
 
-inline bool
-operator!=(Value const& x, Value const& y)
-{
-    return !(x == y);
-}
-
 bool
 operator<(Value const&, Value const&);
 
@@ -548,6 +525,7 @@ public:
 class ValueIteratorBase
 {
 public:
+    using iterator_category = std::bidirectional_iterator_tag;
     using size_t = unsigned int;
     using difference_type = int;
     using SelfType = ValueIteratorBase;
@@ -562,12 +540,6 @@ public:
         return isEqual(other);
     }
 
-    bool
-    operator!=(SelfType const& other) const
-    {
-        return !isEqual(other);
-    }
-
     /**
      * Return either the index or the member name of the referenced value as a
      * Value.

include/xrpl/ledger/BookDirs.h

@@ -49,12 +49,6 @@ public:
     bool
     operator==(const_iterator const& other) const;
 
-    bool
-    operator!=(const_iterator const& other) const
-    {
-        return !(*this == other);
-    }
-
     reference
     operator*() const;
 

include/xrpl/ledger/CanonicalTXSet.h

@@ -59,12 +59,6 @@ private:
             return lhs.txId_ == rhs.txId_;
         }
 
-        friend bool
-        operator!=(Key const& lhs, Key const& rhs)
-        {
-            return !(lhs == rhs);
-        }
-
         [[nodiscard]] uint256 const&
         getAccount() const
         {